Engineering supervision method and system based on big data analysis and storage medium

Abstract

The application relates to the technical field of engineering supervision, and discloses an engineering supervision method and system based on big data analysis and a storage medium. The method collects historical normal engineering data to establish a baseline database, and dynamically calculates a supervision interval according to a real-time monitoring data volume. In the interval, the average value of an engineering index is calculated as a supervision threshold, and the baseline data are compared to detect abnormal signs. After the abnormal signs are checked in terms of fluctuation range and statistical attributes, an initial risk index is calculated. Further, characteristic elements such as a numerical change formula and a graphic summary are extracted from the abnormal signs, machine learning is used for category division, and it is judged whether there is a regular abnormality. If there is, a correction coefficient is calculated according to the characteristics, the initial risk index is revised, and a subsequent supervision interval is updated. The application realizes adaptive adjustment of the supervision frequency and intelligentization of abnormality identification, and effectively improves the accuracy and efficiency of engineering supervision.

Description

Technical Field

[0001] This invention relates to the field of engineering supervision technology, specifically to engineering supervision methods, systems, and storage media based on big data analysis. Background Technology

[0002] Project supervision is a crucial link in ensuring project quality and controlling costs and schedules. Traditional supervision models primarily rely on regular manual inspections and fixed-threshold alarm mechanisms. This approach has significant limitations. Manual inspections are constrained by time, manpower, and professional experience, making it difficult to achieve 24 / 7, comprehensive monitoring and prone to overlooking momentary or hidden anomalies. Fixed-threshold alarm mechanisms lack flexibility and cannot adapt to the dynamic changes in different projects and construction stages. Setting thresholds too low leads to frequent false alarms, consuming significant manpower for verification; setting them too high may ignore potential risk signs, resulting in delayed warnings.

[0003] With the widespread adoption of sensor and IoT technologies, the number of monitoring devices deployed in engineering projects has surged, generating massive amounts of real-time engineering data. This provides a data foundation for refined supervision, but also brings new challenges. Faced with this explosive growth in data volume, traditional supervision methods are struggling to keep up in terms of data processing efficiency, real-time analysis capabilities, and intelligent decision-making. Their supervision strategies are often static and rigid, unable to adapt to the characteristics of real-time data streams (such as data volume fluctuations and changes in the correlation between indicators). Furthermore, traditional methods often rely on simple out-of-bounds checks of single indicators and single points in time, lacking in-depth analysis of the coordinated changes of multiple indicators and the evolution of abnormal patterns. This makes it difficult for the system to distinguish between random fluctuations and regular abnormal patterns that may indicate significant hidden dangers, resulting in inaccurate risk assessments and insufficient targeted and effective early warnings.

[0004] Therefore, the field of engineering supervision urgently needs a new method that can overcome the aforementioned shortcomings. This method should be able to fully utilize big data resources, achieve intelligent adjustment of the pace of supervision, and have the ability to automatically and accurately identify truly risky abnormal patterns from massive amounts of data, thereby transforming passive response into proactive early warning and improving the overall effectiveness and foresight of engineering supervision. Summary of the Invention

[0005] The purpose of this invention is to provide an engineering supervision method, system, and storage medium based on big data analysis to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides an engineering supervision method based on big data analysis, the method comprising:

[0007] Collect historical normal engineering data and establish a baseline database; acquire real-time engineering monitoring data and calculate the monitoring interval based on the data volume of the real-time engineering monitoring data.

[0008] Within the regulatory interval, all engineering indicators are monitored, the average value of the indicators is calculated, and this average value is set as the regulatory threshold.

[0009] By comparing the aforementioned regulatory thresholds with the aforementioned baseline database, examine the engineering indicators, identify any abnormal signs, and mark them accordingly.

[0010] For the marked abnormal signs, check their fluctuation range and statistical attributes, and confirm whether an abnormal situation has occurred based on the check results. If an abnormal situation has occurred, calculate the initial risk index based on the number of times the abnormal situation occurs.

[0011] The feature elements, including numerical variation patterns and graphical summaries, are extracted from abnormal situations. Machine learning methods are used to classify the categories, and the classification results are used to determine whether there are regular anomalies.

[0012] When a regular anomaly is found, a correction coefficient is calculated based on the characteristics of the regular anomaly, the initial risk index is revised, and subsequent regulatory intervals are updated.

[0013] Preferably, the calculation of the monitoring interval based on the data volume of the real-time engineering monitoring data includes the following steps:

[0014] The activity of the data stream of the real-time engineering monitoring data is evaluated, and the arrival rate of data points and the integrity ratio of data packets per unit time are calculated.

[0015] Construct a monitoring interval calculation model, the input of which is the arrival rate and the integrity ratio;

[0016] The regulatory interval calculation model outputs the regulatory interval by querying a predefined interval mapping table, which defines the correspondence between different data flow activity levels and recommended regulatory intervals.

[0017] Based on the model's output, the next monitoring interval is dynamically set.

[0018] Preferably, the inspection of engineering indicators, detection of abnormal signs and their marking, is achieved through the following steps:

[0019] A dynamic confidence interval is created for each engineering indicator, and the upper and lower bounds of the interval are calculated by sliding the corresponding indicator's historical distribution in the baseline database and the indicator's average value within the current regulatory interval.

[0020] The real-time data points for each engineering indicator are compared with the dynamic confidence intervals created for them;

[0021] When a data point continuously falls outside its corresponding dynamic confidence interval for more than a preset time window, the engineering indicator status represented by that data point is marked as an abnormal sign.

[0022] Record the first occurrence time, duration, and deviation from the dynamic confidence interval for each anomalous sign.

[0023] Preferably, the step of checking its fluctuation range and statistical attributes, and confirming whether any abnormalities have occurred based on the check results, specifically includes:

[0024] Multi-scale fluctuation analysis was performed on data segments marked as anomalous to extract their energy distribution spectrum at different time scales.

[0025] The matching degree between the energy distribution spectrum and the typical energy distribution spectrum under normal operating conditions in the baseline database is calculated.

[0026] If the matching degree is lower than the preset spectral similarity threshold, the abnormal sign is determined to constitute an abnormal situation.

[0027] Simultaneously, the statistical skewness and kurtosis of the data segment showing the anomaly are calculated. When the joint distribution of skewness and kurtosis is far from the center of the normal cluster, the anomaly is further confirmed.

[0028] Preferably, the calculation of the initial risk index based on the frequency of abnormal situations is performed according to the following steps:

[0029] The number of all confirmed anomalies within the current regulatory interval is counted.

[0030] For each anomaly, a severity weight is calculated based on the magnitude of its deviation from the dynamic confidence interval, its duration, and the matching degree of its energy distribution spectrum.

[0031] The severity weights of all abnormal situations are weighted and summed to obtain a comprehensive risk assessment value;

[0032] The comprehensive risk assessment value is normalized to a preset risk index range to obtain the initial risk index.

[0033] Preferably, the step of using machine learning methods to classify categories and determining whether there are regular anomalies based on the classification results includes the following steps:

[0034] Extract a set of high-dimensional feature vectors from each anomaly, including but not limited to: wave morphology waveforms, statistical moment features, and time series autocorrelation characteristics;

[0035] A density-based hierarchical clustering algorithm is adopted, which adaptively determines the number of clusters and the shape of clusters without pre-setting the number of clusters;

[0036] The algorithm first finds high-density regions in the feature space, and then connects adjacent high-density regions to form clusters;

[0037] Analyze the distribution characteristics of anomalies within each cluster. If a cluster contains multiple anomalies from different time points but with highly similar feature vectors, then the cluster is determined to represent a regular anomaly.

[0038] Preferably, the calculation of the correction coefficient based on the characteristics of regular anomalies is accomplished through the following steps:

[0039] The spatiotemporal characteristics of the regular anomaly clusters are analyzed, including the occurrence cycle of anomalies within the clusters, their spatial distribution patterns, and the evolution trend of their feature vectors.

[0040] These spatiotemporal characteristics are matched with anomaly patterns in a knowledge base that stores feature descriptions of known anomaly patterns and their corresponding correction strategies.

[0041] If an abnormal pattern with a similarity exceeding the threshold is found in the knowledge base, the correction coefficient associated with that pattern is directly used.

[0042] If no matching pattern is found, a new correction coefficient is calculated using a nonlinear function based on the stability index and influence range index of the regular anomaly cluster.

[0043] Preferably, the update of the subsequent monitoring interval is based on the following steps:

[0044] Obtain the risk index revised by the aforementioned correction factor;

[0045] Based on the revised risk index, the corresponding adjustment ratio is found in a predefined interval adjustment strategy table, which defines the inverse relationship between risk level and regulatory interval tightness.

[0046] Multiply the current regulatory interval by the aforementioned adjustment ratio to obtain a new regulatory interval applicable to the next monitoring cycle;

[0047] The new regulatory intervals are fed back to the data collection module to control the data collection pace for the next cycle.

[0048] Preferably, the present invention also includes an engineering supervision system based on big data analysis, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor, when executing the computer program, implements the steps of the above-described engineering supervision method based on big data analysis.

[0049] Preferably, the present invention further includes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the various steps of the above-described engineering supervision method based on big data analysis.

[0050] Compared with the prior art, the beneficial effects of the present invention are:

[0051] This invention, by dynamically calculating monitoring intervals, changes the rigid model of fixed-frequency monitoring, enabling the allocation of monitoring resources to be flexibly optimized based on the load of real-time data streams. Appropriately shortening the interval during data surges to enhance monitoring, and extending the interval during stable data periods to conserve computing resources, this adaptive mechanism significantly improves the system's operational economy. By establishing a baseline database and calculating the average value of indicators as a dynamic threshold, this method strengthens the multi-dimensional and comprehensive evaluation of project status. Compared to a single fixed threshold, it better reflects the actual operational norms of projects and reduces misjudgments caused by unreasonable threshold settings. In the anomaly identification stage, by checking the fluctuation range and statistical attributes of anomalies, preliminary screening of anomaly signs can be performed, improving the reliability of anomaly confirmation.

[0052] By introducing machine learning methods to perform in-depth analysis of confirmed anomalies, extracting their feature elements and classifying them, this process enables intelligent discrimination of the nature of anomalies. It can effectively distinguish between random, occasional anomalies and recurring, pattern-driven anomalies. This discriminatory ability allows risk assessment to move beyond simply relying on the frequency of anomalies and delve into their inherent regularity, thus providing a more accurate estimate of the severity of potential risks. Correction coefficients are calculated based on the characteristics of regular anomalies to revise the initial risk index, making the final risk assessment results more aligned with reality and the warning levels more scientific.

[0053] This method forms a closed-loop optimization process. Based on the determination of regular anomalies and the revision of risk indices, the system can autonomously update subsequent monitoring intervals. This means that the monitoring strategy is not static, but continuously evolves as the understanding of the project status deepens. When the system identifies higher risks or new anomaly patterns, it can automatically trigger more intensive monitoring; conversely, when the system is stable, monitoring can be appropriately relaxed. This self-adjusting capability enhances the system's adaptability and robustness in dealing with complex and ever-changing engineering environments. Overall, this method improves the intelligence level of engineering supervision, making monitoring actions more targeted and early warning information more valuable, thus building a more effective technical guarantee for the safety and smooth implementation of engineering projects. Attached Figure Description

[0054] Figure 1 This is a schematic diagram illustrating the working principle of the engineering supervision method based on big data analysis described in this invention.

[0055] Figure 2 This is a flowchart for calculating the monitoring interval based on the data volume of real-time engineering monitoring data;

[0056] Figure 3 A flowchart for checking engineering indicators, identifying and marking abnormal signs;

[0057] Figure 4 This is a multi-scale energy distribution spectrum analysis diagram;

[0058] Figure 5 This is a high-dimensional feature clustering analysis diagram. Detailed Implementation

[0059] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] Please see Figure 1 This invention provides an engineering supervision method based on big data analysis. This method integrates historical data and real-time monitoring information to achieve intelligent anomaly detection and risk warning. The overall implementation scheme is as follows:

[0061] Historical normal engineering data is collected to establish a baseline database, which stores the statistical distribution and typical patterns of various engineering indicators under normal operating conditions. Real-time engineering monitoring data is acquired and streamed into the system. A monitoring interval is calculated based on the volume of real-time monitoring data, determining the frequency of comprehensive system checks. Within the monitoring interval, all engineering indicators are monitored, and the average value is calculated and set as the monitoring threshold. This threshold serves as a dynamic benchmark for subsequent comparisons. Engineering indicators are checked against the monitoring threshold and the baseline database. A sliding window technique is used to compare data points with historical distributions in real time, identifying and marking any anomalies. Marking information includes timestamps and the degree of deviation. For marked anomalies, their fluctuation range and statistical properties are verified, such as calculating the variance and skewness of the data segment. Based on the verification results, it is confirmed whether an anomaly has occurred. If an anomaly has occurred, an initial risk index is calculated based on the frequency of occurrence. This index reflects the potential risk level of the current engineering status. The extraction of key features from anomalies includes numerical variation patterns and graphical summaries. Numerical variation patterns capture the dynamic trends of indicators, while graphical summaries simplify the morphological characteristics of time series data. Machine learning methods are used for category classification, and the classification results determine whether there are regular anomalies. Regular anomalies indicate the existence of systemic problems. When regular anomalies are found, correction coefficients are calculated based on the characteristics of the regular anomalies, the initial risk index is revised, and subsequent regulatory intervals are updated, thereby adaptively adjusting the monitoring intensity.

[0062] Example 1: See Figure 2The system performs activity assessment on the data stream of real-time engineering monitoring data. This assessment is achieved by monitoring the transmission frequency and content integrity of data packets. It calculates the arrival rate of data points and the integrity ratio of data packets per unit time. The arrival rate reflects the activity level of the data stream, while the integrity ratio ensures that the data quality meets the analysis requirements. When calculating the arrival rate of data points per unit time, the system uses a sliding time window statistical method, such as counting the number of data points arriving in seconds and calculating the average rate. The integrity ratio of data packets is determined by verifying the checksum or hash value of each data packet, and the ratio is expressed as the ratio of valid data packets to the total number of data packets. A monitoring interval calculation model is constructed. The input to this model is the arrival rate and the integrity ratio. Internally, a linear regression algorithm maps the input to interval values, and the linear regression coefficients are obtained based on historical data training. The monitoring interval calculation model outputs the monitoring interval by querying a predefined interval mapping table. This table defines the correspondence between different data stream activity levels and recommended monitoring intervals; for example, a higher activity level corresponds to a shorter interval to enhance real-time performance. Predefined interval mapping tables are typically stored as a two-dimensional matrix. Row indices correspond to discretized intervals of arrival rates, and column indices correspond to discretized intervals of integrity ratios. Each cell stores a recommended monitoring interval value. Based on the model output, the next monitoring interval is dynamically set. This process is repeated cyclically to ensure that the system responds to changes in the data flow, and that the model update frequency is synchronized with the monitoring interval, thereby maintaining computational efficiency.

[0063] In some embodiments, activity assessment can be integrated with real-time stream processing frameworks, such as Apache Kafka or similar platforms, to achieve high-throughput data stream monitoring. When calculating arrival rate, the system maintains a circular buffer to record the timestamps of data points within the most recent time window, calculates the instantaneous rate through differentiation, and smooths it. Packet integrity ratio calculation may involve deep packet inspection techniques, parsing packet headers and payloads to verify integrity. The construction of the monitoring interval calculation model can use machine learning methods, such as support vector machines or decision trees, instead of linear regression to handle non-linear relationships. The generation of a predefined interval mapping table is based on simulations using a large amount of historical data, determining activity level partitions through cluster analysis, and optimizing interval values ​​to balance detection latency and resource overhead. When dynamically setting monitoring intervals, the system introduces a hysteresis mechanism to prevent frequent fluctuations in interval values, ensuring stability.

[0064] Optionally, the activity assessment process can be expanded to a multi-dimensional assessment, including indicators of the burstiness and continuity of the data stream, but the core focus remains on arrival rate and integrity ratio. When calculating the arrival rate, the unit of time can be selected as minutes or hours to adapt to the real-time requirements of different engineering scenarios. The calculation of the data packet integrity ratio may ignore some redundant data, improving computational efficiency. The input to the monitoring interval calculation model can be normalized, scaling the arrival rate and integrity ratio to a standard range to avoid the influence of unit of measurement. The predefined interval mapping table can be dynamically updated, adjusting the correspondence through an online learning mechanism to adapt to changes in data stream patterns. When dynamically setting the monitoring interval, system load indicators, such as CPU utilization, can be combined to further optimize the interval value.

[0065] As is understandable, activity assessment is the foundation of regulatory interval calculation, ensuring that data flow characteristics are accurately captured. Arrival rate and integrity ratio, as key inputs, directly determine the accuracy of the model output. The role of the regulatory interval calculation model is to transform data flow activity into actionable interval parameters, simplifying complex decision-making. A predefined interval mapping table provides embedded empirical knowledge, enabling the model to respond quickly without complex calculations. A dynamic setting mechanism achieves closed-loop control, allowing the regulatory interval to adapt to data flow fluctuations.

[0066] In practical implementation, when evaluating the activity of real-time engineering monitoring data streams, the system deploys dedicated data acquisition agents embedded in the engineering monitoring nodes to capture data stream metadata in real time. The arrival rate of data points per unit time is calculated through time series analysis. The system initializes a timer and a counter. The timer triggers at fixed intervals, and the counter accumulates the number of data points arriving within that interval, then the rate value is calculated. The integrity ratio of data packets is verified by parsing the packet format. For example, for TCP / IP protocol packets, the integrity of the IP header and TCP segments is checked, and the ratio is calculated as the quotient of the number of complete packets and the total number of received packets. When constructing the monitoring interval calculation model, the model uses lightweight mathematical functions, such as multivariate linear equations. The input vector includes the arrival rate and integrity ratio, and the output scalar is the monitoring interval in seconds. The monitoring interval calculation model outputs the monitoring interval by querying a predefined interval mapping table. The query operation uses bilinear interpolation to handle continuous input, avoiding discretization errors. The predefined interval mapping table is loaded from the configuration file at system startup. The mapping table structure is a lookup table, supporting fast indexing. Based on the model output, the next monitoring interval is dynamically set, and the system calls the scheduler interface to modify the monitoring task cycle, ensuring that the new interval is used in the next cycle.

[0067] In some embodiments, activity assessment can incorporate data flow entropy calculation as an auxiliary indicator, but the core remains focused on arrival rate and integrity ratio. When calculating the arrival rate, an exponentially weighted moving average can be applied to smooth instantaneous fluctuations and improve rate stability. The calculation of the packet integrity ratio may be customized for specific engineering protocols, such as Modbus or OPCUA, enhancing applicability. The construction of the monitoring interval calculation model can integrate gradient descent optimization, allowing for online adjustment of model parameters. Predefined interval mapping tables can be stored in partitions, with different sub-tables corresponding to different engineering types, improving flexibility. When dynamically setting monitoring intervals, adjustment logs can be recorded for audit trail purposes.

[0068] Optionally, the activity assessment process can be parallelized, simultaneously calculating the activity of multiple data streams on a multi-core processor. When calculating arrival rates, the unit time window size is configurable to adapt to different network latency conditions. Packet integrity ratio calculations can ignore small packets, reducing noise impact. A time decay factor can be added to the input of the monitoring interval calculation model, prioritizing recent data. Predefined interval mapping tables can be stored in a compressed manner, and hash tables can be used to accelerate lookups. When dynamically setting monitoring intervals, minimum and maximum interval boundaries can be set to prevent extreme values.

[0069] Understandably, the accuracy of activity assessment directly impacts the rationality of regulatory intervals, requiring high-precision timestamp support. Arrival rate calculation avoids simple averaging, employing a rolling window to adapt to the characteristics of streaming data. Packet integrity ratios ensure data reliability and prevent erroneous data from contaminating analysis. The simplified design of the regulatory interval calculation model reduces computational overhead, making it suitable for resource-constrained environments. A predefined interval mapping table, based on extensive experimental data, provides a reliable benchmark. A dynamic setting mechanism enables system adaptability, extending the engineering regulatory lifecycle.

[0070] In practical implementation, when evaluating the activity of real-time engineering monitoring data streams, the system may face high-concurrency data inflows. Therefore, the activity evaluation module adopts an event-driven architecture to asynchronously process data stream events. When calculating the arrival rate of data points per unit time, the system uses atomic operations to update counters, ensuring data consistency in a multi-threaded environment. The calculation of the data packet integrity ratio involves a cyclic redundancy check algorithm, with the check polynomial preset according to the engineering data format. When constructing the monitoring interval calculation model, model parameters are initialized through offline training, with training data derived from historical normal engineering data, using the least squares method to fit a linear relationship. The monitoring interval calculation model outputs the monitoring interval by querying a predefined interval mapping table. During the query process, the system discretizes continuous input values ​​to the nearest neighbor interval in the mapping table, reducing computational latency. The predefined interval mapping table update strategy supports hot reload, allowing runtime modification without service interruption. Based on the model output, the next monitoring interval is dynamically set, and the set operation triggers a system event notification to the data collection module to adjust the sampling rate.

[0071] In implementation, the activity assessment module is integrated into the front end of the data pipeline to ensure low-latency processing. When calculating the arrival rate, the unit of time is selected based on project criticality, with finer-grained time units used for high-risk projects. The calculation of the packet integrity ratio may combine multiple sensor data sources to comprehensively assess overall data quality. The input features of the monitoring interval calculation model can be expanded, but the core remains the arrival rate and integrity ratio to maintain simplicity. The predefined interval mapping table is designed for read-only memory storage to ensure fast query speed. When dynamically setting the monitoring interval, the system verifies the rationality of the new interval to avoid setting invalid values.

[0072] In practical implementation, the process of evaluating the activity of real-time engineering monitoring data streams can be accelerated using hardware, employing FPGAs to process high-frequency data streams. When calculating the arrival rate of data points per unit time, the rate value is normalized to the 0-1 range for easy model processing. A fault-tolerance mechanism is introduced for the calculation of data packet integrity ratios, allowing for the loss of some data packets without affecting the overall ratio. When constructing the monitoring interval calculation model, the model output is limited to a reasonable range, such as a minimum interval of 1 second and a maximum interval of 1 hour. When the monitoring interval calculation model queries a predefined interval mapping table, the mapping table is cached in a high-speed cache, reducing memory access latency. Version management of the predefined interval mapping table ensures consistency, with different versions of the mapping table used at different engineering stages. Based on the model output results, the next monitoring interval is dynamically set, and operation logs are set for performance analysis.

[0073] In practical implementation, the activity assessment process can be distributed, with activity indicators calculated locally on edge nodes. When calculating arrival rates, the system uses a time-series database to store historical rates, supporting trend analysis. Packet integrity ratio calculations can be weighted, assigning higher weights to important packets. The monitoring interval calculation model can be periodically retrained to adapt to shifting data flow patterns. Predefined interval mapping tables can be generated based on machine learning, using reinforcement learning to optimize interval values. When dynamically setting monitoring intervals, the system considers network bandwidth factors to avoid congestion caused by excessively short intervals.

[0074] In practical implementation, the activity assessment of the real-time engineering monitoring data stream is a continuous process, and the system sets a watchdog timer to monitor the health status of the activity assessment module. When calculating the arrival rate of data points per unit time, the rate calculation adopts an incremental method to avoid the overhead of full recalculation. The integrity ratio calculation of data packets can be performed by sampling, and random sampling of large data streams ensures efficiency. When constructing the monitoring interval calculation model, the model complexity is controlled to O(1) time complexity to meet the real-time requirements. The monitoring interval calculation model queries a predefined interval mapping table, and the size of the mapping table is optimized to be suitable for CPU cache lines. The predefined interval mapping table is backed up to persistent storage to prevent loss due to system failure. Based on the model output results, the next monitoring interval is dynamically set, and the strategy supports a rollback mechanism. When the model fails, the default interval is used.

[0075] Example 2: See Figure 3 A dynamic confidence interval is created for each engineering indicator. The upper and lower bounds of the dynamic confidence interval are calculated by sliding the historical distribution of the corresponding indicator in the baseline database and the indicator's average value within the current regulatory interval. The sliding calculation uses an exponentially weighted moving average method, giving higher weight to recent data to capture trend changes. The historical distribution is obtained from the baseline database, including the indicator's historical mean and standard deviation. The indicator's average value within the current regulatory interval is calculated in real-time from the real-time data stream. The real-time data point of each engineering indicator is compared with the dynamically created confidence interval. The comparison operation is performed immediately upon the arrival of each data point. A threshold cross-detection algorithm is used to identify potential anomalies, with the upper and lower bounds of the dynamic confidence interval serving as the comparison thresholds. When a data point continuously falls outside its corresponding dynamic confidence interval for more than a preset time window, the engineering indicator status represented by that data point is marked as an anomaly. The time window length is adjusted according to the indicator characteristics. The first occurrence time, duration, and deviation from the dynamic confidence interval of each anomaly are recorded. This metadata is stored in a temporary cache for subsequent analysis.

[0076] In some embodiments, the calculation of dynamic confidence intervals can introduce kernel density estimation methods instead of parameterized methods, allowing for more flexible fitting of historical distribution patterns. The smoothing factor in the exponentially weighted moving average method can be dynamically adjusted, automatically optimized based on data volatility. The calculation of the indicator's average value within the current regulatory interval can employ an incremental update algorithm to avoid repeatedly traversing the dataset. The threshold cross-detection algorithm can be optimized into multi-level threshold detection to distinguish deviations of different severity. The preset time window can be designed as an adaptive window, dynamically adjusting its length based on the indicator's historical behavior. When recording metadata for abnormal signs, sensor identification information can be attached, supporting multi-source data correlation analysis.

[0077] Optionally, the calculation of the upper and lower bounds of the dynamic confidence interval can be combined with quantile regression techniques to improve the robustness of the interval estimation. A volatility adjustment mechanism can be incorporated into the sliding calculation process to widen the interval width when data fluctuates drastically. Comparisons between real-time data points and the dynamic confidence interval can be parallelized, allowing for simultaneous comparisons across multiple indicators. Preset time windows can be set as indicator-dependent configuration parameters, with different time window settings corresponding to different engineering indicators. The magnitude of deviations from the dynamic confidence interval can be recorded using standardized scores for easier unified evaluation across indicators.

[0078] Understandably, the creation of dynamic confidence intervals provides an adaptive benchmark, capable of tracking the normal fluctuation range of engineering indicators. Sliding calculations based on historical distribution and current averages ensure that the intervals reflect both long-term patterns and adapt to short-term changes. Real-time comparisons between data points and intervals enable continuous monitoring, ensuring real-time anomaly detection. A continuous judgment mechanism with preset time windows effectively filters out transient noise and reduces false alarms. Detailed recording of anomaly sign metadata provides complete contextual information for subsequent analysis.

[0079] In practice, the process of creating a dynamic confidence interval for each engineering indicator begins during system initialization, where the system loads historical statistics for each indicator from the baseline database. The upper and lower bounds of the dynamic confidence interval are calculated recursively, updating the interval boundaries each time a new data point arrives. The update formula combines the quantiles of the historical distribution with the exponentially weighted moving average within the current regulatory interval. The historical distribution information stored in the baseline database includes quantile estimates and distribution shape parameters for the indicators, obtained by analyzing historical normal engineering data before system deployment. The average value of the indicator within the current regulatory interval is calculated by maintaining a sliding window, with the window size synchronized with the regulatory interval. The average value calculation uses a numerically stable online algorithm. When comparing the real-time data points of each engineering indicator with the dynamic confidence interval, the system maintains a state machine for each indicator, tracking the state of the data point relative to the interval. The threshold cross-validation algorithm is implemented as a finite state machine, detecting consecutive data point sequences exceeding the threshold. The preset time window is defined in the system configuration, with the window length set based on engineering response requirements, typically an integer multiple of multiple sampling periods. When annotating anomalies, the system creates an anomaly event object in memory. The object's attributes include an indicator identifier, a timestamp, and deviation information. The process of recording anomaly metadata employs transactional storage to ensure metadata integrity and consistency.

[0080] In practical implementation, the sliding calculation of dynamic confidence intervals may face numerical accuracy issues; therefore, a high-precision numerical calculation library is used to ensure calculation accuracy. The decay factor in the exponentially weighted moving average method is calibrated according to the indicator sampling frequency to avoid over-smoothing or over-sensitivity. The calculation of the indicator average within the current regulatory interval needs to handle changes in the number of data points within the window, employing adaptive weight allocation. The comparison operation between real-time data points and dynamic confidence intervals requires performance optimization, employing an early termination strategy to avoid unnecessary calculations. The detection of preset time windows requires high-precision timing support, using the system's monotonic clock to ensure time accuracy. The storage of anomaly sign metadata adopts a circular buffer structure, automatically discarding old data to prevent memory overflow.

[0081] In practice, the creation of dynamic confidence intervals can be distributed, with each engineering indicator assigned an independent computational unit. Historical distribution data loading employs a lazy loading strategy, reading from the baseline database on demand to reduce initialization overhead. The exponentially weighted moving average method in the sliding calculation can utilize fixed-point arithmetic to optimize computational efficiency. The calculation of the indicator's average value within the current regulatory interval can be approximated as a piecewise linear function, balancing accuracy and computational cost. Real-time data point comparison operations can be vectorized, utilizing the SIMD instructions of modern processors to process multiple data points in parallel. Preset time window detection can be modeled as a sliding window counting problem, implemented using efficient data structures. Recording anomaly metadata can be compressed for storage, reducing network transmission and storage overhead.

[0082] In practice, the update frequency of the dynamic confidence interval is synchronized with the regulatory interval to ensure that the interval reflects changes in data distribution in a timely manner. The accuracy of historical distribution data is guaranteed through periodic recalibration, with the calibration cycle set according to engineering stability. The weight allocation in the exponentially weighted moving average method can be non-linearized to better capture abrupt changes. The calculation of the average value of indicators within the current regulatory interval can be combined with outlier filtering to improve the robustness of the average value. The logic for comparing real-time data points can be extended to multivariate comparisons to handle the correlation between indicators. The boundary conditions of the preset time window require special handling to prevent window boundary effects from affecting detection accuracy. The management of anomalous sign metadata includes lifecycle management and automatic cleanup of expired metadata.

[0083] In practical implementation, the width of the dynamic confidence interval can be adaptively adjusted through volatility estimation, with the interval appropriately widened during periods of high volatility. The use of historical distribution data needs to consider distribution asymmetry, employing different quantile settings for the upper and lower bounds. Numerical stability during the sliding calculation process is guaranteed by the Kahan summation algorithm, reducing cumulative errors. The calculation of the average indicator value within the current regulatory interval can incorporate decay memory, placing greater emphasis on recent data. The results of real-time data point comparisons can be tiered, distinguishing between warning and anomaly levels. The implementation of preset time windows can utilize multiple overlapping windows to improve detection sensitivity. The recording format of anomaly sign metadata is standardized, supporting cross-system data exchange.

[0084] In practical implementation, the initialization of dynamic confidence intervals requires handling the cold start problem, and a conservative default interval is used in the initial stage of system startup. Loading historical distribution data supports incremental updates, allowing runtime updates to distribution parameters. The computational complexity of the sliding window algorithm is optimized to constant level, meeting real-time requirements. The calculation of the average value of indicators within the current monitoring interval can cache intermediate results to avoid redundant calculations. The threshold for comparing real-time data points can be dynamically softened, setting transition regions near interval boundaries. Detection within preset time windows can be parallelized, simultaneously monitoring anomalies at multiple time scales. The storage of anomaly sign metadata supports fast querying, and indexing optimizes retrieval performance.

[0085] In practical implementation, the maintenance of dynamic confidence intervals includes integrity checks and periodic verification of the rationality of interval parameters. Version management of historical distribution data ensures consistency, and related calculations are updated synchronously when distribution data is updated. Fault tolerance handling in the sliding calculation process includes outlier suppression mechanisms to prevent outliers from contaminating interval calculations. The calculation of the average value of indicators within the current regulatory interval supports multiple average value types, and an appropriate algorithm is selected based on the characteristics of the indicator. Audit logs for real-time data point comparisons record the results of each comparison for post-event analysis. The configuration verification of preset time windows prevents invalid parameter settings, and the window length must be greater than the sampling period. The backup strategy for anomaly indicator metadata ensures data reliability, and data is periodically persisted to stable storage.

[0086] Example 3: Multi-scale fluctuation analysis is performed on data segments marked as anomalous. This analysis uses wavelet transform to process the data segments, decomposing them into different scale components using a mother wavelet function. Each scale component corresponds to a specific frequency range, thereby extracting the energy distribution spectrum of the data segment at different time scales. The energy distribution spectrum is calculated by integrating the square of the wavelet coefficients of each scale component; the spectral value represents the distribution of data fluctuation energy in the time-frequency domain. The energy distribution spectrum is compared with typical energy distribution spectra under normal operating conditions in the baseline database. The matching degree is calculated using a spectral angle mapper algorithm, which calculates the cosine of the angle between the two spectral vectors as a similarity measure. If the matching degree is lower than a preset spectral similarity threshold, the anomalous sign is considered an anomaly. The spectral similarity threshold is calibrated based on historical normal data, and its value ensures a balance between false alarm and false negative rates. Simultaneously, the statistical skewness and kurtosis of the anomalous sign data segment are calculated. Statistical skewness measures the asymmetry of the data distribution, and statistical kurtosis measures the tail thickness of the data distribution. These are derived directly from the data segment samples using the moment estimation method. When the combined distribution of skewness and kurtosis is far from the normal cluster center, the anomaly is further confirmed. The normal cluster center is determined by cluster analysis of the skewness and kurtosis values ​​of normal data in the baseline database. The degree of distance is determined by Mahalanobis distance calculation. When the Mahalanobis distance value exceeds the preset distance threshold, the anomaly is confirmed.

[0087] In some embodiments, multi-scale fluctuation analysis can be extended to empirical mode decomposition methods to adapt to non-stationary data characteristics, but the core remains based on wavelet transform to ensure computational efficiency. The mother wavelet function for the wavelet transform is chosen from the Daubechies wavelet series to balance time-frequency resolution requirements. The extraction of the energy distribution spectrum can be optimized to a logarithmic scale representation to enhance spectral contrast. The spectral angle mapper algorithm can be replaced with Euclidean distance similarity, selecting an appropriate metric based on the application scenario. The spectral similarity threshold can be dynamically adjusted, adaptively changing based on real-time data stream characteristics. Robustness corrections can be added to the calculation of statistical skewness and kurtosis, using the median instead of the mean to reduce the impact of outliers. The covariance matrix in Mahalanobis distance calculation can be regularized to prevent singular matrix problems.

[0088] In some embodiments, the multi-scale fluctuation analysis process can be executed in parallel, utilizing multi-core processors to simultaneously compute fluctuations across multiple data segments. Wavelet transform scale selection covers a range from fine-grained to coarse-grained, with the number of scales automatically determined based on the data segment length. The energy distribution spectrum matching calculation can cache typical spectral data, reducing real-time computation overhead. The calibration cycle for the spectral similarity threshold is synchronized with system updates to ensure threshold timeliness. Joint distribution analysis of statistical skewness and kurtosis can be aided by visualization, but automated determination remains the core. Updates to normal cluster centers support incremental learning, gradually optimizing center positions.

[0089] In some embodiments, multi-scale wave analysis is implemented using integrated signal processing libraries, such as SciPy or similar tools, to ensure algorithm accuracy. Wavelet transform calculations employ fast algorithms to reduce computational complexity. Energy distribution spectra are stored using efficient data structures to support rapid retrieval. Matching degree calculation results are normalized to the 0-1 range for easy threshold comparison. The calculation process for statistical skewness and kurtosis verifies sufficient data segment length to avoid small sample errors. Mahalanobis distance calculations for joint distributions preprocess data standardization eliminate the influence of dimensions.

[0090] Optionally, multi-scale fluctuation analysis can be simplified to multi-resolution analysis, reducing computational resource consumption. The boundary processing of wavelet transform employs a symmetric expansion mode to improve boundary effects. Energy distribution spectrum extraction can be dimensionality-reduced, and principal component analysis can be used to retain key features. Matching degree calculation can be weighted, assigning higher weights to important frequency bands. Spectral similarity thresholds can be set in different zones, with different thresholds corresponding to different engineering indicators. Statistical skewness and kurtosis calculations can be based on kernel density estimation, non-parametrically processing the distribution pattern. The determination of normal cluster centers can use K-means clustering to automatically find the center points.

[0091] The system counts all confirmed anomalies within the current regulatory interval. This count is achieved by maintaining a counter, which resets at the beginning of each interval and increments upon confirmation of an anomaly. For each anomaly, a severity weight is calculated based on its deviation from the dynamic confidence interval, duration, and energy distribution spectrum matching degree. The severity weight calculation uses a linear combination model, with standardized feature values ​​as input. All anomaly severity weights are then weighted and summed to obtain a comprehensive risk assessment value. This weighted summation uses arithmetic summation, multiplying the weight of each anomaly by its severity weight before summing. The comprehensive risk assessment value is then normalized to a preset risk index range to obtain an initial risk index. The normalization method uses min-max scaling to map the assessment value to an index range of 0-100.

[0092] The severity weight is calculated using the following formula:

[0093]

[0094] in, Indicates severity weight, This indicates the magnitude of the deviation from the dynamic confidence interval (standardized value). Indicates duration (standardized value). Indicates the energy distribution spectrum matching degree (value 0-1). , , These are the weighting coefficients for amplitude, duration, and matching degree, respectively. These weighting coefficients are determined through training on historical data and satisfy the following conditions: The constraints. The standardization was achieved using the Z-score method, based on the historical mean and standard deviation of deviations; The standardization is achieved by linear scaling after logarithmic transformation; Use the matching degree value directly. It reflects the degree of mismatch.

[0095] In implementation, the counters for quantity statistics are implemented as thread-safe variables to prevent concurrent access conflicts. Severity weight calculation features are standardized in real-time, with standardized parameters loaded from the baseline database. Weight coefficients for the linear combination model are stored in a configuration file, allowing for runtime adjustment. The weighted accumulation operation uses a high-precision numerical accumulator to avoid rounding errors. The normalization process has a configurable preset risk index range to adapt to different engineering standards. The upper and lower bounds of the minimum-maximum scaling are derived from historical comprehensive risk assessment values ​​to ensure the comparability of the normalized indices.

[0096] Understandably, multi-scale fluctuation analysis provides in-depth extraction of fluctuation characteristics, and energy distribution spectrum captures the multi-resolution behavior of data segments. Matching degree calculation compares real-time spectra with typical spectra to quantify the degree of anomaly. Joint analysis of statistical skewness and kurtosis increases the reliability of confirmation and reduces false positives. Quantitative statistics are simple and effective, reflecting the frequency of anomalies. Severity weight calculation integrates multi-dimensional features, balancing the influence of various factors. Weighted summation aggregates individual risks, and the comprehensive risk assessment value macroscopically reflects the status. Normalization standardizes the initial risk index, facilitating cross-system comparisons.

[0097] In practice, the anomaly confirmation logic is embedded in the data stream processing pipeline, with confirmation triggering events to drive updates to the quantity statistics. The magnitude of deviation from the dynamic confidence interval is recorded as an absolute deviation value, with the magnitude calculation relativized by referencing the width of the dynamic confidence interval. Duration is calculated from the first appearance of the anomaly to the confirmation time, unitized in seconds. The energy distribution spectrum matching degree is calculated and cached for reuse in weight calculations. The weight coefficients in the severity weight formula are optimized through machine learning, using gradient descent to minimize historical errors. Before weighted accumulation, the weight of each anomaly is validated, discarding invalid values. Post-processing of the normalization operation includes boundary pruning to prevent the exponent from exceeding the range.

[0098] In practical implementation, the allocation of computational resources for multi-scale fluctuation analysis is dynamically adjusted, with more computation time allocated to complex data segments. The matching degree calculation of the energy distribution spectrum is optimized to an approximate algorithm, balancing accuracy and efficiency. Statistical skewness and kurtosis calculations are performed in batches on multiple data segments to improve throughput. Statistical results of the number of outliers are periodically persisted for trend analysis. The characteristic standardization parameters for severity weight calculation are updated online to adapt to data distribution drift. The weighted accumulation process supports streaming processing, with incremental updates to evaluation values. The normalized initial risk index is published to the message bus for downstream modules to consume.

[0099] In its implementation, Example 3 emphasizes modular design, with each step being independently testable. The multi-scale fluctuation analysis module outputs a standardized energy distribution spectrum object. The matching degree calculation module encapsulates the similarity algorithm and provides a unified interface. The anomaly confirmation module integrates multi-condition judgments and outputs a binary result. The quantity statistics module exposes a query API, returning the current interval count. The severity weight calculation module configures the loading formula parameters. The weighted accumulation module is implemented as an accumulator, supporting reset operations. The normalization module provides scaling functions with clearly defined input and output types. The initial risk index serves as the final output, triggering subsequent risk assessment processes.

[0100] See Figure 4This paper presents the results of multi-scale energy distribution spectral analysis based on wavelet transform. By decomposing the engineering monitoring signal into different frequency scales, the energy distribution characteristics of normal operating conditions and real-time monitoring are intuitively compared. The figure uses a striking two-color bar chart to clearly show the differences in energy distribution at each scale. The energy distribution under normal operating conditions represents the baseline state when the engineering equipment is running normally, while the energy distribution under real-time monitoring reflects the actual operating status within the current monitoring period. The display of spectral similarity indicators quantifies the degree of matching between the two, providing important frequency domain analysis basis for engineering anomaly detection. This multi-scale analysis method can effectively identify subtle frequency component changes in engineering signals, promptly detect potential operational risks, and provide scientific and technical support for engineering safety supervision.

[0101] Example 4: A set of high-dimensional feature vectors is extracted from each anomaly. These high-dimensional feature vectors include wave morphology waveforms, statistical moment features, and the autocorrelation characteristics of the time series. The wave morphology waveforms are converted into symbolic representations of the time series using a piecewise aggregation approximation method. The statistical moment features include third and fourth moments, i.e., skewness and kurtosis. The autocorrelation characteristics of the time series are obtained by calculating the autocorrelation coefficients for different lag orders. A density-based hierarchical clustering algorithm is employed. This algorithm adaptively determines the number of clusters and the shape of each cluster. It first finds high-density regions in the feature space and then connects adjacent high-density regions to form clusters. The distribution characteristics of anomalies within each cluster are analyzed. If a cluster contains multiple anomalies from different time points but with highly similar feature vectors, the cluster is considered to represent a regular anomaly. High similarity is quantified by calculating the Euclidean distance between feature vectors and setting a similarity threshold.

[0102] In practice, the extraction of high-dimensional feature vectors begins in the data preprocessing stage, where the original time series data corresponding to each anomaly is standardized to zero mean and unit variance. The extraction of wave patterns employs a symbolic aggregation approximation algorithm, which first segments the time series, calculates the average value of each segment, and then maps the average value to a symbolic sequence. The calculation of statistical moments uses the sample moment formula, directly calculating skewness and kurtosis values ​​from the anomaly data segments. For the calculation of the time series autocorrelation characteristics, the maximum lag order is chosen to be one-quarter of the data segment length, and the autocorrelation coefficient is accelerated using a fast Fourier transform algorithm. The density-based hierarchical clustering algorithm is an improvement on the OPTICS algorithm, which identifies density-connected clusters by calculating the ordered reachability distance map of objects. The search for high-density regions is achieved through kernel density estimation, using a Gaussian kernel function to estimate the probability density distribution in the feature space. Connections between adjacent high-density regions are based on the concept of density reachability, with a reachability distance threshold set to control the connection conditions. The distribution characteristics analysis of anomalies within clusters includes spatiotemporal distribution analysis: temporal distribution checks for the regularity of time intervals between anomaly occurrences, and spatial distribution analysis examines the geographical correlation of multi-sensor data. The high similarity between feature vectors is determined using the k-nearest neighbor concept, with a distance threshold and the minimum number of nearest neighbors set as the determination criteria.

[0103] In some embodiments, the dimensionality of high-dimensional feature vectors can be reduced using principal component analysis while retaining key feature information. The symbol mapping of wave-like waveforms can be optimized to equal-depth binning, improving the discriminative power of symbol representations. Robustness processing can be incorporated into the calculation of statistical moment features, using the median absolute deviation instead of the standard deviation. The calculation of autocorrelation characteristics can focus on key lag points, reducing computational overhead. The parameter settings of density-based hierarchical clustering algorithms can be adaptively adjusted, automatically determining parameters based on the feature space density. The search for high-density regions can be combined with grid partitioning methods to improve computational efficiency under large-scale data. The connection conditions between adjacent high-density regions can be dynamically optimized, adjusting the threshold based on cluster compactness. Cosine similarity can be introduced as an auxiliary metric for feature vector similarity determination.

[0104] Optionally, the extraction of high-dimensional feature vectors can be extended to deep learning methods, using autoencoders to learn feature representations. Waveform representations can be combined with waveform descriptors to enrich morphological feature information. Statistical moment features can include higher-order moments, but attention must be paid to estimation errors in small samples. The calculation of autocorrelation properties can be simplified to first- and second-order autocorrelation coefficients, balancing information content and computational cost. Density-based hierarchical clustering algorithms can be implemented in parallel to handle large-scale feature vector sets. Finding high-density regions can employ multi-resolution density estimation, adapting to clusters of different sizes. Connecting adjacent high-density regions can introduce graph theory algorithms, using minimum spanning trees to connect regions. Feature vector similarity determination can integrate multi-metric fusion to improve robustness.

[0105] Optionally, high-dimensional feature vectors are stored in a columnar storage format to optimize feature access efficiency. The symbol sequences of wave-like waveforms are compressed using dictionary encoding to reduce storage space. Statistical moment features are calculated using a numerically stable algorithm to prevent numerical overflow. Intermediate results are cached for autocorrelation feature calculations to avoid redundant computation. The density-based hierarchical clustering algorithm provides progress indicators and supports interruptibility during long-running computations. The results of finding high-density regions are visualized to assist parameter tuning. Connection paths between adjacent high-density regions are recorded, supporting the tracing of the cluster formation process. The threshold for feature vector similarity determination supports online learning, adjusting the threshold based on feedback.

[0106] This study analyzes the spatiotemporal characteristics of regular anomaly clusters, including the occurrence cycle, spatial distribution pattern, and evolution trend of feature vectors within the cluster. The occurrence cycle is analyzed using Fourier transform to examine the spectral characteristics of the anomaly occurrence time series and extract the dominant frequency components. The spatial distribution pattern is analyzed using a geographic information system (GIS) to examine the spatial clustering characteristics of the anomalies and calculate the spatial autocorrelation index. The evolution trend of feature vectors is analyzed using time series forecasting methods to examine the changing patterns of feature vectors within the cluster over time. These spatiotemporal characteristics are then matched with anomaly patterns in a knowledge base that stores feature descriptions of known anomaly patterns and their corresponding correction strategies. The matching process uses case-based reasoning techniques to calculate similarity. If an anomaly pattern with a similarity exceeding a threshold is found in the knowledge base, the correction coefficient associated with that pattern is directly applied. If no matching pattern is found, a new correction coefficient is calculated using a nonlinear function based on the stability and impact range indicators of the regular anomaly cluster.

[0107] In practical implementation, the spatiotemporal characteristic analysis module for regular anomaly clusters receives a list of cluster identifiers output by the clustering algorithm. Occurrence period analysis employs the Lomb-Scargle periodogram method, adaptable to non-uniformly sampled time-series data. Spatial distribution pattern analysis uses Ripley's K function to evaluate spatial point patterns and identify spatial clustering. Evolutionary trend analysis of feature vectors uses a linear regression model to fit the slope of feature values ​​over time. The knowledge base is stored using a graph database structure, where nodes represent anomaly patterns and edges represent relationships between patterns. The feature descriptions of known anomaly patterns include numerical and symbolic features; numerical features are normalized, and symbolic features are encoded using one-hot encoding. The case reasoning technique in the matching process uses the k-nearest neighbor algorithm to retrieve similar cases, and similarity calculation uses weighted Euclidean distance. The similarity threshold is set based on the distribution density of cases in the knowledge base; different thresholds may be set for different types of patterns. The storage of correction coefficients is bound to the anomaly patterns, and the coefficient values ​​are normalized. The stability index is calculated based on the temporal distribution uniformity of anomalies within a cluster, using the coefficient of variation. The impact range index is calculated by comprehensively considering the number of affected engineering indicators and the geographical scope. The nonlinear function is designed using a sigmoid function, mapping the stability index and influence range index to correction coefficients within the 0-1 range. See Table 1 for the feature descriptions of abnormal patterns in the knowledge base.

[0108] Table 1: Description of Abnormal Patterns in the Knowledge Base

[0109] Pattern identifier Periodic characteristics Spatial features Evolutionary trend Correction coefficient P001 Periodic (24h) Local clustering linear increase 0.75 P002 nonperiodic Global Distributed Stable fluctuations 0.35 P003 Periodic (168h) Multicenter clustering Exponential decay 0.82 P004 intermittent random distribution Step change 0.28

[0110] It is understandable that the extraction of high-dimensional feature vectors digitally represents the multi-dimensional features of anomalies, providing a foundation for cluster analysis. Density-based hierarchical clustering algorithms can discover clusters of arbitrary shapes and adapt to complex anomaly patterns. The determination of regular anomaly clusters is based on spatiotemporal distribution characteristics, identifying features of systemic problems. Knowledge base matching utilizes historical experience to improve the accuracy of correction coefficient formulation. Stability indicators and impact range indicators quantitatively assess the severity of anomaly clusters. Nonlinear function calculations ensure that correction coefficients reasonably reflect the level of anomaly risk.

[0111] In practice, the entire regularity anomaly analysis process is implemented as a pipeline architecture, with modules exchanging information through standard data formats. The high-dimensional feature vector extraction module outputs a feature vector set to the clustering module. The density-based hierarchical clustering algorithm module outputs a cluster list to the spatiotemporal analysis module. The determination results of regularity anomaly clusters are input to the knowledge base matching module. The correction coefficient calculation module integrates coefficient management functions and supports coefficient version control. The knowledge base update mechanism supports incremental learning, allowing the addition of new anomaly patterns. The calculation of stability indicators and impact range indicators is performed in real time, and indicator values ​​are cached for performance optimization. The parameters of the nonlinear function are configurable, supporting customized needs for different engineering scenarios. Finally, the output correction coefficient is passed to the risk index revision module to complete the closed-loop processing.

[0112] See Figure 5 This paper presents the results of anomaly pattern clustering analysis based on high-dimensional feature vectors. By extracting multi-dimensional statistical features from engineering anomaly data to construct a feature space, an advanced density clustering algorithm is used to automatically identify anomaly patterns with similar characteristics. In the figure, data points of different colors and shapes represent different anomaly categories, and star-shaped markers clearly indicate the center positions of various anomaly patterns, intuitively demonstrating the distribution patterns of anomaly data in the feature space. Clustering analysis can effectively distinguish different types of anomaly patterns in engineering projects, identify the characteristic patterns of systemic failures, and provide data support for engineering risk assessment and early warning. This analytical method helps to understand the underlying mechanisms of anomaly occurrence and provides important reference for developing targeted maintenance strategies and preventative measures.

[0113] Example 5: Obtain the risk index revised with a correction factor. The revision operation is achieved by multiplying the initial risk index by the correction factor. The correction factor acts as a multiplier to adjust the magnitude of the initial risk index, reflecting the degree of influence of regular anomalies on the overall risk level. Based on the revised risk index, the corresponding adjustment ratio is looked up in a predefined interval adjustment strategy table. This table is stored in a two-dimensional representation, with row indices corresponding to the revised risk index segment intervals and column indices corresponding to the project stage identifiers. Each cell stores the recommended adjustment ratio value. The predefined interval adjustment strategy table defines an inverse relationship between risk level and regulatory interval tightness; that is, a higher risk index corresponds to a smaller adjustment ratio, thereby shortening the regulatory interval and increasing monitoring frequency. The current regulatory interval is multiplied by the adjustment ratio to obtain a new regulatory interval suitable for the next monitoring cycle. The multiplication operation uses floating-point calculations, and the result is rounded to the nearest integer in seconds. The new regulatory interval is fed back to the data collection module to control the data collection rhythm of the next cycle. The feedback mechanism achieves real-time communication through a message queue or shared memory.

[0114] In practice, the process of obtaining the risk index revised by the correction factor reads the current value from the output interface of the risk assessment module. The revised risk index is temporarily stored in the cache for subsequent steps. A predefined interval adjustment strategy table is loaded into memory from the configuration file during system initialization, and the table structure uses a hash table for fast lookup. When looking up the corresponding adjustment ratio, the system discretizes the revised risk index to the closest segment interval and then retrieves the adjustment ratio value of the corresponding cell. The adjustment ratio value is typically a decimal number less than or greater than 1, representing the scaling factor of the regulatory interval. The calculation of multiplying the current regulatory interval by the adjustment ratio requires handling boundary cases; if the result exceeds the minimum or maximum interval value allowed by the system, it is truncated. The effective time of the new regulatory interval is set to the start time of the next monitoring cycle to ensure time continuity. Operations fed back to the data collection module trigger data acquisition parameter updates, and the data collection module reconfigures the sampling timer according to the new interval.

[0115] In some embodiments, the interface for obtaining the risk index revised by the adjustment coefficient can be designed as an asynchronous call to avoid blocking the main thread. The storage of the predefined interval adjustment strategy table can be optimized into a hierarchical structure, with different strategy sub-tables used for different project types. The process of finding the corresponding adjustment ratio can incorporate a fuzzy matching algorithm to handle risk index values ​​at segment boundaries. The parsing of adjustment ratio values ​​supports fractional formats, improving representation accuracy. The calculation of the current regulatory interval multiplied by the adjustment ratio can incorporate smoothing filtering to prevent drastic jumps in interval values. Verification of new regulatory intervals includes a rationality check, rejecting obviously unreasonable interval settings. The communication protocol fed back to the data collection module is standardized to ensure interoperability between modules.

[0116] In some embodiments, the acquisition of revised risk indices can include version tags, supporting the coexistence of multiple versions of risk indices. Updates to the predefined interval adjustment strategy table support hot reloading, allowing runtime policy updates without service interruption. The logic for finding adjustment ratios can be extended to multi-factor queries, combining environmental parameters for comprehensive decision-making. The definition of adjustment ratio values ​​can introduce non-linear mapping relationships to more finely express the risk-interval relationship. Numerical processing of multiplication operations uses a high-precision arithmetic library to ensure calculation accuracy. The allocation of new regulatory intervals considers system resource constraints, avoiding system overload caused by excessively short intervals. The feedback mechanism is implemented as bidirectional communication, with the data collection module returning a confirmation signal.

[0117] Optionally, access control for obtaining the risk index revised with the adjusted coefficient can be strengthened, allowing only authorized modules to access it. The storage of predefined interval adjustment strategy tables is encrypted to prevent unauthorized modification. The process of looking up the adjustment ratio is logged with detailed operation information for audit trail purposes. The adjustment ratio value is limited to the range of 0.1 to 10.0 to prevent extreme scaling factors. The original value is backed up before multiplying the current regulatory interval by the adjustment ratio, supporting rapid rollback. Setting new regulatory intervals is an atomic operation to ensure setting integrity. A failure retry mechanism is implemented to feed back failures to the data collection module, improving communication reliability.

[0118] Optionally, the frequency of obtaining the revised risk index can be optimized, triggering subsequent processes only when the risk index change exceeds a threshold. Queries to the predefined interval adjustment strategy table can cache recent results, reducing redundant calculation overhead. Interpolation calculations of adjustment ratios support continuous risk index values, avoiding discretization errors. Monitoring of intermediate results of multiplication operations detects numerical overflow anomalies. The effective timestamp of the new regulatory interval is accurate to milliseconds, ensuring timing accuracy. Bandwidth management of the feedback channel prioritizes the transmission of interval update messages.

[0119] Optionally, the revised risk index retrieval supports batch processing, handling multiple risk index updates at once. Version compatibility handling of the predefined interval adjustment strategy table supports smooth migration between old and new strategy versions. The performance of looking up the adjustment ratio is optimized to constant time complexity, meeting real-time requirements. Dynamic weighting of adjustment ratio values ​​adjusts the influence of the ratio based on context. Parallel processing of multiplication operations is implemented, suitable for multi-core processor architectures. Distributed synchronization of new monitoring intervals ensures interval consistency in cluster environments. Compressed transmission of feedback messages reduces network bandwidth consumption.

[0120] It is understandable that obtaining the risk index revised with the adjustment coefficient is the starting point for interval adjustment, ensuring the use of the latest risk assessment results. A predefined interval adjustment strategy table encapsulates expert knowledge, translating risk levels into specific adjustment strategies. Finding the corresponding adjustment ratio maps continuous risk values ​​to discrete adjustment actions, enabling strategy execution. Multiplying the current regulatory interval by the adjustment ratio is the core calculation step, directly determining the new monitoring intensity. The generation of the new regulatory interval enables adaptive adjustment, allowing the system to dynamically respond to changes in risk. Feedback to the data collection module completes the control loop, making the interval adjustment actually effective.

[0121] In implementation, the entire regulatory interval update process is implemented using a state machine model, with state transitions triggered by changes in the risk index. The call to obtain the risk index revised by the adjustment coefficient is encapsulated as a service interface with clearly defined input and output specifications. The predefined interval adjustment strategy table is physically stored in JSON or XML format for easy manual reading and modification. The function for finding the corresponding adjustment ratio is implemented as a lookup table interpolation, using linear interpolation within segmented intervals to improve accuracy. The application of the adjustment ratio value considers historical interval values, introducing an inertia factor to prevent frequent oscillations. The calculation result of multiplying the current regulatory interval by the adjustment ratio is verified, rejecting interval values ​​that do not conform to business logic. The new regulatory interval is persistently stored to prevent settings loss upon system restarts. The message format fed back to the data collection module is standardized, including timestamps and version information.

[0122] In implementation, the maintenance tool for the predefined interval adjustment strategy table provides a graphical interface, facilitating administrator adjustments to strategy relationships. Performance analysis of adjustment ratio lookups is performed regularly to optimize algorithm efficiency. An adaptive learning mechanism for adjustment ratio values ​​fine-tunes the values ​​based on the adjustment results. Hardware acceleration of multiplication operations is possible, utilizing coprocessors to improve computation speed. A simulated testing environment for new monitoring intervals verifies the rationality of interval settings. A load-balanced design for the feedback mechanism avoids single-point communication bottlenecks. Fault tolerance is implemented throughout the interval update process, allowing for degraded operation in case of partial module failures.

[0123] In implementation, the revised risk index is acquired in sync with the risk assessment cycle to ensure data timeliness. A predefined interval adjustment strategy table is managed by region, with large systems using different strategy tables for different functional areas. Security audits are conducted for finding adjustment ratios, recording each lookup operation and its results. A gray-scale release mechanism for adjustment ratio values ​​is implemented, allowing new ratio values ​​to be tested on a small scale first. A smooth transition algorithm for the current regulatory interval is used to avoid data discontinuity caused by abrupt interval changes. A broadcast mechanism for the new regulatory interval takes effect notifies relevant modules of the synchronization status. Encrypted transmission of feedback channels protects the security of interval setting information.

[0124] In practical implementation, performance monitoring of the regulatory interval update process includes execution time statistics and resource usage tracking. A caching strategy for the risk index revised with adjusted coefficients reduces I / O operations and improves access speed. Index optimization of the predefined interval adjustment strategy table speeds up lookups. Version management of adjustment ratio values ​​supports ratio rollback. Numerical range checks for multiplication operations prevent calculation errors. Conflict detection for new regulatory intervals handles concurrent setting conflicts. Asynchronous processing of the feedback mechanism avoids blocking the main business process. Health checks are performed regularly throughout the entire process to ensure stable system operation.

[0125] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0126] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An engineering supervision method based on big data analysis, characterized in that, include: Collect historical normal engineering data and establish a baseline database; Acquire real-time engineering monitoring data, and calculate the monitoring interval based on the data volume of the real-time engineering monitoring data; Within the regulatory interval, all engineering indicators are monitored, the average value of the indicators is calculated, and this average value is set as the regulatory threshold. By comparing the aforementioned regulatory thresholds with the aforementioned baseline database, examine the engineering indicators, identify any abnormal signs, and mark them accordingly. For the marked abnormal signs, check their fluctuation range and statistical attributes, and confirm whether an abnormal situation has occurred based on the check results. If an abnormal situation has occurred, calculate the initial risk index based on the number of times the abnormal situation occurs. The feature elements, including numerical variation patterns and graphical summaries, are extracted from abnormal situations. Machine learning methods are used to classify the categories, and the classification results are used to determine whether there are regular anomalies. When a regular anomaly is found, a correction coefficient is calculated based on the characteristics of the regular anomaly, the initial risk index is revised, and subsequent regulatory intervals are updated. The calculation of the monitoring interval based on the data volume of the real-time engineering monitoring data includes the following steps: The activity of the data stream of the real-time engineering monitoring data is evaluated, and the arrival rate of data points and the integrity ratio of data packets per unit time are calculated. Construct a monitoring interval calculation model, the input of which is the arrival rate and the integrity ratio; The regulatory interval calculation model outputs the regulatory interval by querying a predefined interval mapping table, which defines the correspondence between different data flow activity levels and recommended regulatory intervals. Based on the model's output, the next monitoring interval is dynamically set.

2. The engineering supervision method based on big data analysis according to claim 1, characterized in that, The inspection of engineering indicators, detection and marking of abnormal signs are achieved through the following steps: A dynamic confidence interval is created for each engineering indicator, and the upper and lower bounds of the interval are calculated by sliding the corresponding indicator's historical distribution in the baseline database and the indicator's average value within the current regulatory interval. The real-time data points for each engineering indicator are compared with the dynamic confidence intervals created for them; When a data point continuously falls outside its corresponding dynamic confidence interval for more than a preset time window, the engineering indicator status represented by that data point is marked as an abnormal sign. Record the first occurrence time, duration, and deviation from the dynamic confidence interval for each anomalous sign.

3. The engineering supervision method based on big data analysis according to claim 2, characterized in that, The process of checking its fluctuation range and statistical attributes, and confirming whether any abnormalities have occurred based on the check results, specifically includes: Multi-scale fluctuation analysis was performed on data segments marked as anomalous to extract their energy distribution spectrum at different time scales. The matching degree between the energy distribution spectrum and the typical energy distribution spectrum under normal operating conditions in the baseline database is calculated. If the matching degree is lower than the preset spectral similarity threshold, the abnormal sign is determined to constitute an abnormal situation. Simultaneously, the statistical skewness and kurtosis of the data segment showing the anomaly are calculated. When the joint distribution of skewness and kurtosis is far from the center of the normal cluster, the anomaly is further confirmed.

4. The engineering supervision method based on big data analysis according to claim 3, characterized in that, The initial risk index is calculated based on the frequency of abnormal situations, and the following steps are performed: The number of all confirmed anomalies within the current regulatory interval is counted. For each anomaly, a severity weight is calculated based on the magnitude of its deviation from the dynamic confidence interval, its duration, and the matching degree of its energy distribution spectrum. The severity weights of all abnormal situations are weighted and summed to obtain a comprehensive risk assessment value; The comprehensive risk assessment value is normalized to a preset risk index range to obtain the initial risk index.

5. The engineering supervision method based on big data analysis according to claim 4, characterized in that, The process of using machine learning methods to classify categories and determining whether there are regular anomalies based on the classification results includes the following steps: Extract a set of high-dimensional feature vectors from each anomaly, including: wave morphology waveform, statistical moment features, and time series autocorrelation characteristics; A density-based hierarchical clustering algorithm is adopted, which adaptively determines the number of clusters and the shape of clusters without pre-setting the number of clusters; The algorithm first finds high-density regions in the feature space, and then connects adjacent high-density regions to form clusters; Analyze the distribution characteristics of anomalies within each cluster. If a cluster contains multiple anomalies from different time points but with highly similar feature vectors, then the cluster is determined to represent a regular anomaly.

6. The engineering supervision method based on big data analysis according to claim 5, characterized in that, The calculation of the correction coefficient based on the characteristics of regular anomalies is accomplished through the following steps: Analyze the spatiotemporal characteristics of regular anomaly clusters, including the occurrence cycle of anomalies within the cluster, spatial distribution patterns, and evolution trends of eigenvectors; These spatiotemporal characteristics are matched with anomaly patterns in a knowledge base that stores feature descriptions of known anomaly patterns and their corresponding correction strategies. If an abnormal pattern with a similarity exceeding the threshold is found in the knowledge base, the correction coefficient associated with that pattern is directly used. If no matching pattern is found, a new correction coefficient is calculated using a nonlinear function based on the stability index and influence range index of the regular anomaly cluster.

7. The engineering supervision method based on big data analysis according to claim 6, characterized in that, The updated subsequent regulatory interval is based on the following steps: Obtain the risk index revised by the aforementioned correction factor; Based on the revised risk index, the corresponding adjustment ratio is found in a predefined interval adjustment strategy table, which defines the inverse relationship between risk level and regulatory interval tightness. Multiply the current regulatory interval by the aforementioned adjustment ratio to obtain a new regulatory interval applicable to the next monitoring cycle; The new regulatory intervals are fed back to the data collection module to control the data collection pace for the next cycle.

8. An engineering monitoring system based on big data analysis, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the engineering supervision method based on big data analysis as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements each step of the engineering supervision method based on big data analysis as described in any one of claims 1-7.

Images