Threat prediction system and method
By employing a collaborative mechanism of quantum data capture, time-series synchronization, rule learning, and graph analysis, the heterogeneity of multi-source data in power scenarios is resolved, thereby improving the reliability and real-time performance of power threat prediction. The prediction results then feed back into the accuracy of data acquisition, enhancing the system's defense strategy.
Patent Information
- Application Number
- CN202511348969.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-19
- Publication Date
- 2026-02-17
AI Technical Summary
In power scenarios, the significant differences in data structures between physical device sensors and network security logs, as well as inconsistencies in collection frequency and real-time performance, lead to insufficient reliability of threat prediction results and an inability to predict equipment corrosion risks caused by environmental intrusions in a timely manner.
The system integrates quantum frequency domain features with semantic features through a data acquisition device, dynamically reconstructs the log collection frequency through a time synchronization device, optimizes the mapping relationship through a rule learning device, identifies risk paths through a graph analysis device, generates multi-scale risk assessments through a risk prediction device, and optimizes the rule base through a feedback correction module, thus forming a two-way closed-loop control.
It achieves efficient integration of physical and network data, improves the reliability and accuracy of threat prediction, enables timely prediction of equipment corrosion risks, and enhances system resilience and response efficiency.
Smart Images
Figure CN121547191A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of data processing, and in particular to a threat prediction system and method. BACKGROUND
[0002] Threat prediction in the power scenario is a technical process that identifies potential hazards by continuously monitoring and analyzing multi-source data. Its core lies in constructing a prediction model using historical event records, real-time sensor inputs, and network traffic patterns to infer future security risks. Given the high interconnectedness and vulnerability of power networks as critical infrastructure, any physical intrusion, cyber attack, or device failure can quickly spread and lead to power outages, thus requiring early intervention. This prediction first fuses physical and network security information through data collection, then uses machine learning algorithms for pattern recognition and anomaly detection, and finally supports risk assessment decisions, enabling operating units to deploy targeted mitigation strategies and improve system resilience and response efficiency.
[0003] In the threat prediction of the power scenario, the technical pain points are concentrated in the heterogeneity problem of the multi-source data fusion process, resulting in insufficient reliability of the prediction results. The main reason is that the data structures of physical device sensors and network security logs differ too much, and the real-time and collection frequencies are inconsistent, making it difficult to achieve effective fusion under limited computing resources, affecting the overall prediction accuracy. For example, the deployed physical humidity sensor outputs structured data every second, while the network intrusion detection log generates unstructured text at minute intervals. Without an efficient fusion mechanism, the machine learning model may miss the pattern changes associated with both, failing to predict the risk of device corrosion caused by environmental intrusion in a timely manner, resulting in potential power outcuts that are not disposed of early. SUMMARY
[0004] To address the deficiencies of the prior art, the present application provides a threat prediction system and method. The present application solves the technical problem of insufficient reliability of prediction results due to the large difference in data structures of physical device sensors and network security logs, and the inconsistency of collection frequency and real-time.
[0005] To solve the above technical problems, the specific application of the present application is as follows: In a first aspect, the present application provides a threat prediction system, comprising: A data capture device captures voltage and current frequency domain features from physical device sensors and compresses them into feature tensors, extracts protocol vectors and risk heat values from network security logs in parallel, generates a frequency domain and semantic hybrid matrix by coupling meteorological parameters, and outputs; A time synchronization device connected to the data capture device receives the hybrid matrix based on a chaotic time axis, maps the physical data stream to a dynamic time window, dynamically reconstructs the security log collection frequency when detecting a voltage mutation gradient, generates an aligned data packet, and transmits it. The rule learning device receives the aligned data packet, activates the preset physical environment threshold rule, generates the association weight of the device state and the access behavior through the neural network, executes the rule whose weight is lower than the threshold when the prediction deviation is continuously over-standard, and outputs the topology reconstruction instruction; The atlas analysis device constructs the environment level edge from the physical sensor data and constructs the behavior level edge from the security log feature in response to the topology reconstruction instruction, starts the weight adjustment when detecting that the environment level edge and the behavior level edge form a closed loop, and outputs the risk diffusion tensor; The risk prediction device receives the risk diffusion tensor, generates the device corrosion probability distribution through the long short-term memory network, calculates the power supply interruption risk value through the gated recurrent unit, and converts the risk prediction result into a sampling precision adjustment coefficient and feeds back to the data capture device.
[0006] Further, the threat prediction system of the present application, the data capture device is configured to: The data capture device performs three-layer decomposition of wavelet packet transform in the process of extracting frequency domain features, and outputs a compressed feature tensor; Receive network security logs and generate strategy vectors through pre-training semantic model coding; Trigger the log abnormal frequency detection threshold to downshift when detecting that the temperature change is accelerated, and adjust the extraction process of the strategy vector.
[0007] Further, the threat prediction system of the present application, the time sequence synchronization device is configured to: The time sequence synchronization device implements the phase space reconstruction algorithm on the security log slice, maps to the chaotic time axis and outputs; According to the Lyapunov index, the physical data stream time window is dynamically contracted; When the voltage standard deviation is over-limit, the acquisition frequency is automatically triggered to exponentially increase, and the aligned time sequence of the reconstructed security log slice is outputted.
[0008] Further, the threat prediction system of the present application, the rule learning device is configured to: The rule learning device stores the topological association matrix of the device overload code and the login behavior; Calculate the numerical contribution degree of each rule before the rule cleaning operation; When the numerical contribution degree is lower than the threshold, the rule cleaning operation is executed; The topology reconstruction instruction is outputted to the atlas analysis device after cleaning.
[0009] Further, the threat prediction system of the present application, the atlas analysis device is configured to: The atlas analysis device constructs the environment level edge and connects at least three device nodes in the same region; When performing closed loop detection, monitor that the environment parameter over-standard and the access frequency over-standard occur simultaneously; The adjustment weight operation is started when the closed loop is detected; The environment layer attribute is reinforced by the generative adversarial network, and the risk propagation weight is output.
[0010] Further, the threat prediction system of the present application, the risk prediction device is configured to: The risk prediction device generates a two-hour corrosion probability heat map through a long short-term memory network and caches it; According to the heat map, start the gated recurrent unit to calculate the outage risk value in the next thirty minutes; Based on the outage risk value, trigger the feedback operation, convert the flow cleaning success rate into the sensor sampling precision adjustment coefficient, and output it to the data capture device.
[0011] Further, the threat prediction system of the present application further comprises a feedback correction module: The feedback correction module receives the manual operation log and the system execution record; Input records to the cause and effect tracing model to locate the rule invalidation node; Based on the positioning result every twelve hours, start the new and old rule library comparison operation, retain the rules whose prediction accuracy is improved by more than 15%, and update the rule library.
[0012] Further, the threat prediction system of the present application further comprises: The feedback correction module freezes the current rule library before running; When performing the comparison operation, update the rule parameters using reinforcement learning; When the new rule meets the retention condition, cover the corresponding entry in the rule learning device.
[0013] Further, the threat prediction system of the present application further comprises: The time sequence synchronization device transmits the time reference parameter to the feedback correction module every twenty-four hours to calibrate the clock; The rule clearing instruction of the rule learning device triggers the graph analysis device to perform the topology reconstruction operation; The risk prediction device converts the defense strategy data into a sampling precision adjustment coefficient and feeds it back to the data capture device.
[0014] In a second aspect, the present application provides a threat prediction method applied to a threat prediction system, characterized in that it comprises: Step 1, compress the voltage and current frequency domain features captured from physical device sensors into feature tensors, and extract protocol vectors and risk heat values from network security logs in parallel, generate a frequency domain and semantic hybrid matrix by coupling meteorological parameters, and output; Step 2, receiving a mixed matrix based on a chaotic time base axis, mapping a physical data stream to a dynamic time window, dynamically reconstructing a security log collection frequency when a voltage mutation gradient is detected, generating an aligned data packet and transmitting; Step 3, receiving the aligned data packet, activating the preset physical environment threshold rule, generating the associated weight of the device state and the access behavior through the neural network, executing the rule whose weight is lower than the threshold when the prediction deviation is continuously over-standard, and outputting the topology reconstruction instruction; Step 4, in response to the topology reconstruction instruction, constructing the physical sensor data as an environment level edge, and constructing the security log features as a behavior level edge, starting weight adjustment when detecting that the environment level edge and the behavior level edge form a closed loop, and outputting a risk diffusion tensor; Step 5, receiving the risk diffusion tensor, generating a device corrosion probability distribution through a long short-term memory network, calculating a power supply interruption risk value through a gated recurrent unit, and converting the risk prediction result into a sampling precision adjustment coefficient feedback to step 1.
[0015] The present application has the following advantages: The present application generates a mixed matrix by fusing physical frequency domain features and network semantic features through a quantum data capture module, solves the data structure heterogeneity; a chaotic time sequence synchronization module dynamically reconstructs the log collection frequency based on the voltage gradient, realizes the non-stationary alignment of physical and network data; a meta-learning rule engine continuously optimizes the mapping relationship through the rule annihilation mechanism; a hypergraph fusion analysis module identifies the environment-behavior closed loop risk path; a multi-scale prediction execution module outputs the corrosion probability and the interruption risk value, and adjusts the data collection precision in the reverse direction; the time crystalization update law of the black hole feedback engine eliminates the time sequence drift, and finally forms a two-way closed loop system of physical environment change driving network defense strategy and prediction result feeding back data collection precision, so that the device corrosion prediction reliability induced by environmental intrusion is significantly improved. BRIEF DESCRIPTION OF DRAWINGS
[0016] In order to more clearly illustrate the technical solutions of the present application, the following will briefly introduce the drawings needed in the embodiments. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on the drawings.
[0017] Figure 1 A flowchart of a threat prediction method provided by the embodiment of the present application. DETAILED DESCRIPTION
[0018] In order to make the technical solutions of the present application clearer, the present application will be described below in conjunction with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application. The present application provided by each embodiment of the present application will be described in detail below in conjunction with the drawings. For the purpose of better understanding the present application, the present application will be further described in detail below.
[0019] In a first aspect, the present application provides a threat prediction system, comprising: A data capture device captures voltage and current frequency domain features from physical device sensors and compresses them into feature tensors, extracts protocol vectors and risk heat values from network security logs in parallel, and generates a frequency domain and semantic hybrid matrix by coupling meteorological parameters and outputs; A time synchronization device connected to the data capture device receives the hybrid matrix based on the chaotic time axis, maps the physical data stream to the dynamic time window, dynamically reconstructs the security log collection frequency when detecting voltage mutation gradient, generates aligned data packets and transmits them; A rule learning device receives the aligned data packets, activates the preset physical environment threshold rule, generates the correlation weight of device state and access behavior through the neural network, executes the rule whose weight is lower than the threshold when the prediction deviation is continuously over-standard, and outputs the topology reconstruction instruction; A graph analysis device responds to the topology reconstruction instruction, constructs the physical sensor data into environment level edges, and constructs the security log features into behavior level edges, starts weight adjustment when detecting that the environment level edges and the behavior level edges form a closed loop, and outputs the risk diffusion tensor; A risk prediction device receives the risk diffusion tensor, generates the device corrosion probability distribution through the long short-term memory network, calculates the power supply interruption risk value through the gated recurrent unit, and converts the risk prediction result into a sampling precision adjustment coefficient feedback to the data capture device.
[0020] The threat prediction system processes multi-source data through a series of devices working in coordination to solve the problem of differences in data structure and inconsistency in real-time between physical device sensors and network security logs, and improves the prediction reliability. The data capture device obtains voltage and current frequency domain features from physical device sensors, performs three-layer decomposition using wavelet packet transform, compresses them into feature tensors, receives network security logs and generates strategy vectors through pre-training semantic model coding; when detecting that temperature change is accelerated, the device triggers the log abnormal frequency detection threshold to be lowered, adjusts the extraction process of the strategy vector, and finally generates a frequency domain and semantic hybrid matrix by coupling meteorological parameters. This process integrates frequency domain features and semantic information, eliminating data structure heterogeneity.
[0021] The timing synchronization device is connected to the data acquisition device and receives the hybrid matrix based on a chaotic time axis. This device performs a phase space reconstruction algorithm on the security log slices, mapping them to the chaotic time axis output. Simultaneously, it dynamically shrinks the physical data stream time window according to the Lyapunov exponent. When the voltage standard deviation exceeds the limit, it automatically triggers an exponential increase in the acquisition frequency, reconstructing the aligned timing of the security log slices and generating aligned data packets for transmission. This dynamic adjustment mechanism synchronizes the physical and network data streams, overcoming real-time differences.
[0022] The rule learning device receives aligned data packets, activates preset physical environment threshold rules, and generates association weights between device status and access behavior through a neural network. The device stores a topological association matrix between device overload codes and login behavior. Before clearing rules, it calculates the numerical contribution of each rule. When the numerical contribution is below the threshold, the rule clearing operation is performed, and a topology reconstruction instruction is output after clearing. This step optimizes the rule base and ensures accurate mapping relationships.
[0023] The graph analysis device responds to topology reconstruction commands by constructing environmental-level edges from physical sensor data and connecting at least three device nodes in the same area. Simultaneously, it constructs behavioral-level edges from security log features. When performing loop closure detection, if both environmental parameters and access frequency exceed limits, the device initiates a weight adjustment operation upon detection. It then strengthens the risk propagation weights of environmental-level attributes through a generative adversarial network, generating a risk diffusion tensor. This analysis identifies risk paths and enhances prediction accuracy.
[0024] The risk prediction device receives the risk diffusion tensor, generates a device corrosion probability distribution through a long short-term memory network, and caches a corrosion probability heatmap for two hours. Based on the heatmap, it activates a gated loop unit to calculate the interruption risk value for the next thirty minutes. Based on the interruption risk value, it triggers a feedback operation, converting the flow cleaning success rate into a sensor sampling accuracy adjustment coefficient, which is then output to the data acquisition device. This prediction stage provides multi-scale risk assessment and forms a feedback loop.
[0025] The feedback correction module receives manual operation logs and system execution records, inputs these records into the causal tracing model to locate rule failure nodes, and initiates a comparison operation between the old and new rule bases every twelve hours based on the location results. Rules whose prediction accuracy improves by more than a set threshold are retained and the rule base is updated. Before running, this module freezes the current rule base. During the comparison operation, reinforcement learning is used to update rule parameters. When a new rule meets the retention conditions, it overwrites the corresponding entry in the rule learning device. Simultaneously, the time synchronization device periodically transmits time reference parameters to the feedback correction module to calibrate the clock. The rule clearing command from the rule learning device triggers the topology reconstruction operation of the graph analysis device, and the defense strategy data from the risk prediction device is converted into sampling accuracy adjustment coefficients and fed back to the data acquisition device. The entire system achieves non-linear coupling between the physical environment and network behavior through data flow closed-loop and collaborative mechanisms, improving the reliability of equipment corrosion prediction.
[0026] Specifically, in the threat prediction system of the present invention, the data capture device is configured as follows: The data acquisition device performs wavelet packet transform three-level decomposition during the extraction of frequency domain features and outputs a compressed feature tensor. Receive network security logs and generate policy vectors by encoding them using a pre-trained semantic model; When an accelerated temperature change is detected, the log anomaly frequency detection threshold is lowered, and the extraction process of the strategy vector is adjusted.
[0027] The data acquisition device performs wavelet packet transform three-level decomposition processing on the frequency domain features of voltage and current. The decomposition process separates the original waveform into low-frequency fundamental, mid-frequency harmonics, and high-frequency noise components, which are then compressed into a sixteen-dimensional feature tensor. Simultaneously, it receives network security log text streams, encodes protocol types into policy vectors using a pre-trained semantic model, and parses access paths into path depth matrices. When a temperature sensor detects a temperature rise rate exceeding a set threshold, it automatically triggers a threshold reduction operation for abnormal log frequencies. This operation dynamically adjusts the extraction sensitivity of the policy vectors, ultimately fusing meteorological parameters to output a frequency domain and semantic hybrid matrix. This process addresses the structural differences between physical data and log data.
[0028] Specifically, in the threat prediction system of the present invention, the timing synchronization device is configured as follows: The timing synchronization device performs a phase space reconstruction algorithm on the security log slices, maps them to the chaotic time axis, and outputs them. The physical data stream time window is dynamically shrunk based on the Lyapunov exponent; When the voltage standard deviation exceeds the limit, the acquisition frequency is automatically increased exponentially to reconstruct the alignment timing of the security log slice.
[0029] The timing synchronization device implements a phase space reconstruction algorithm on the security log slices, projecting non-uniform log data onto the chaotic time axis by calculating the correlation dimension. The time window width of the physical data stream is dynamically adjusted according to the Lyapunov exponent in the chaotic system; as the exponent increases, the window shrinks to improve real-time performance. When the voltage monitoring unit detects that the standard deviation exceeds the safety threshold, it immediately triggers the log acquisition frequency to increase exponentially, reconstructs and aligns the timing, and then generates data packets for transmission. This mechanism achieves dynamic frequency synchronization between physical and network data.
[0030] Specifically, in the threat prediction system of the present invention, the rule learning device is configured as follows: The topological correlation matrix between the storage device overload code of the rule learning device and login behavior; Calculate the numerical contribution of each rule before performing the rule clearing operation; When the numerical contribution is below the threshold, a rule clearing operation is performed. After clearing, a topology reconstruction command is output to the map analysis device.
[0031] The rule learning device stores the topological association matrix of device overload error codes and abnormal login behaviors. Before performing the cleanup operation, the Shapley value algorithm is used to calculate the numerical contribution of each rule to the prediction result. When the contribution value is lower than the dynamically adjusted threshold, the rule cleanup procedure is initiated. After the cleanup operation is completed, a topological reconstruction command is immediately sent to the graph analysis device. This process maintains the validity of the rule base.
[0032] Specifically, in the threat prediction system of the present invention, the map analysis device is configured as follows: The graph analysis device constructs environmental hierarchy edges and connects at least three device nodes in the same region; When performing closed-loop testing, both the monitoring environment parameters and the access frequency exceed the limit. When a closed loop is detected, a weight adjustment operation is initiated. The environment layer attributes are enhanced by adversarial generative networks, and risk propagation weights are output.
[0033] The graph analysis device constructs environmental layer edges and associates transformer, circuit breaker, and relay protection equipment nodes within the same substation area. During closed-loop detection, it continuously monitors signals of excessive environmental humidity and abnormal network access frequency. When both signals persist simultaneously within a time window, a weight adjustment procedure is activated. The device strengthens the association strength of environmental layer nodes through adversarial generative networks and outputs a weighted risk propagation tensor. This analysis identifies risk coupling paths between environmental and network behavior.
[0034] Specifically, in the threat prediction system of the present invention, the risk prediction device is configured as follows: The risk prediction device generates and caches a two-hour corrosion probability heatmap using a long short-term memory network; The gating loop unit is activated based on the heat map to calculate the interruption risk value for the next thirty minutes. Based on the interruption risk value, a feedback operation is triggered, and the success rate of flow cleaning is converted into a sensor sampling accuracy adjustment coefficient and output to the data acquisition device.
[0035] The risk prediction device processes the risk diffusion tensor through a long short-term memory network, generates a heat map of the spatial distribution of equipment corrosion probability for the next two hours, and stores it in a cache. Based on the spatial density distribution of the heat map, the gated loop unit is activated to calculate the power outage risk value within thirty minutes. Based on the outage risk value level, a feedback mechanism is triggered to convert the traffic scrubbing success rate in network security defense into a physical sensor sampling accuracy adjustment coefficient. This coefficient is transmitted to the data acquisition device to form a closed-loop control.
[0036] Specifically, the threat prediction system of the present invention further includes a feedback correction module: The feedback and correction module receives manual operation logs and system execution records; Input records are used to locate the failure node of the causal tracing model; Every twelve hours, a comparison between the old and new rule bases is initiated based on the positioning results. Rules that improve prediction accuracy by more than 15% are retained and the rule base is updated.
[0037] The feedback correction module receives operation logs from maintenance personnel and execution records of system defense strategies; it inputs the records into the causal tracing model and uses a Bayesian network to locate the root node of rule failure; every twelve hours, based on the analysis results of the failure node, it initiates a process to compare the prediction accuracy of the old and new rule bases, retains new rules whose accuracy improvement exceeds the set threshold, and updates the system rule base.
[0038] Specifically, the threat prediction system of the present invention further includes: The current rule base is frozen before the feedback correction module runs; Reinforcement learning is used to update rule parameters when performing comparison operations; When a new rule meets the retention criteria, it overwrites the corresponding entry in the rule learning device.
[0039] The feedback correction module freezes the current running state of the rule base before performing the rule base comparison; during the comparison process, it uses a reinforcement learning algorithm to update the rule parameters; when the accuracy gain of the new rule on the test set meets the retention condition, it automatically overwrites the corresponding rule entry in the rule learning device, thereby realizing iterative optimization of the rule base.
[0040] Specifically, the threat prediction system of the present invention further includes: The timing synchronization device transmits time reference parameters to the feedback correction module to calibrate the clock every 24 hours. The rule-clearing command from the rule-learning device triggers the topology reconstruction operation from the graph analysis device; The risk prediction device converts defense strategy data into sampling accuracy adjustment coefficients and feeds them back to the data acquisition device.
[0041] The timing synchronization device transmits chaotic time reference parameters to the feedback correction module every 24 hours to calibrate the clock synchronization of the rule base update operation; the rule clearing command of the rule learning device directly triggers the graph analysis device to reconstruct the risk propagation topology; the risk prediction device converts the defense strategy execution data into sensor sampling accuracy adjustment coefficients, and controls the feature extraction accuracy of the data acquisition device in real time through the feedback loop, forming a system-level closed-loop adaptive mechanism. The technical closed-loop path of the coordinated efforts of all devices to ensure the reliability of prediction is thus realized.
[0042] Secondly, please refer to Figure 1 This invention provides a threat prediction method, applied to a threat prediction system, comprising: Step 1: Capture voltage and current frequency domain features from physical device sensors, compress them into feature tensors, extract protocol vectors and risk heat values from network security logs in parallel, couple meteorological parameters to generate a frequency domain and semantic hybrid matrix and output it; Step 2: Based on the chaotic time-based axis receiving hybrid matrix, the physical data stream is mapped to a dynamic time window. When a voltage change gradient is detected, the safety log collection frequency is dynamically reconstructed, and aligned data packets are generated and transmitted. Step 3: Receive the alignment data packet, activate the preset physical environment threshold rule, generate the association weight between device status and access behavior through the neural network, and execute the rule to clear the weight below the threshold when the prediction deviation exceeds the standard continuously, and output the topology reconstruction instruction. Step 4: In response to the topology reconstruction command, construct the physical sensor data as environmental-level edges and the safety log features as behavioral-level edges. When a closed loop is detected between the environmental-level edge and the behavioral-level edge, initiate weight adjustment and output the risk diffusion tensor. Step 5: Receive the risk diffusion tensor, generate the equipment corrosion probability distribution through a long short-term memory network, calculate the power outage risk value through a gated cyclic unit, and convert the risk prediction result into a sampling accuracy adjustment coefficient to feed back to step 1.
[0043] This invention's threat prediction system addresses the challenge of fusion between physical and network data through multi-level technological collaboration. The data acquisition device first addresses data structure differences: voltage and current signals collected by physical device sensors are decomposed into three layers of frequency domain features via wavelet packet transform and compressed into feature tensors; network security logs are encoded using a pre-trained semantic model to generate protocol vectors and risk intensity values; meteorological parameters are used as coupling factors to dynamically adjust the log extraction threshold. This process generates a frequency domain and semantic hybrid matrix, unifying the data representation of physical signal frequency domain features and log semantic features.
[0044] To address real-time inconsistency issues, the timing synchronization device receives a hybrid matrix based on a chaotic time axis: the physical data stream dynamically allocates time windows according to the Lyapunov exponent, and security log slices are mapped to the chaotic time axis through phase space reconstruction; when the voltage standard deviation suddenly increases, the log collection frequency is automatically triggered to increase exponentially, making the network log sampling frequency adapt to the rhythm of physical signal mutations. This dynamic alignment mechanism breaks through the limitations of existing fixed-frequency sampling.
[0045] A rule learning device and a graph analysis device collaboratively optimize the prediction model: the rule base stores the correlation matrix between overloaded codes and abnormal login behaviors, and removes low-contribution rules when prediction deviation exceeds the limit; physical sensor data constructs environment-level edges, and security log features construct behavior-level edges; when an environment parameter exceeding the limit and a closed loop is detected with high-frequency access, the environment layer weights are strengthened through adversarial generative networks. This design captures the implicit correlation between environmental intrusion and network attacks.
[0046] The risk prediction device generates multi-scale risk indicators: the long short-term memory network outputs the equipment corrosion probability distribution over two hours, and the gated loop unit calculates the power outage risk value over thirty minutes; at the same time, the effect of the defense strategy is converted into a sampling accuracy adjustment coefficient and fed back to the data acquisition device, forming a closed-loop control of physical and network data.
[0047] The feedback correction module updates the rule base every twelve hours: it receives manual operation logs and system execution records, locates faulty rules through causal tracing, and updates parameters using reinforcement learning, retaining new rules whose accuracy improves beyond a set threshold. The timing synchronization device transmits time reference parameters every twenty-four hours to calibrate the system clock, eliminating timing drift errors caused by long-term operation.
[0048] In the field of power scenario threat prediction, the significant differences in data structures between physical device sensors and network security logs, along with inconsistencies in collection frequency and real-time performance, make multi-source data fusion difficult and result in insufficient prediction reliability. Physical sensors output structured voltage and current data every second, while network security logs generate unstructured text at minute intervals. Without an efficient fusion mechanism, machine learning models may miss the correlation patterns between environmental intrusions and network attacks, failing to predict the risk of power outages caused by equipment corrosion in a timely manner. This invention provides a threat prediction system and method that solves the above-mentioned technical problems through a closed-loop collaborative mechanism.
[0049] The data acquisition device captures voltage and current signals from physical device sensors, performs wavelet packet transform three-level decomposition to extract frequency domain features, and compresses them into feature tensors. It processes network security logs in parallel, generating protocol vectors and risk intensity values through pre-trained semantic model encoding. When the temperature sensor detects an abnormal temperature rise rate, it dynamically lowers the log anomaly frequency detection threshold and optimizes the strategy vector extraction process. After coupling meteorological parameters, it outputs a frequency domain and semantic hybrid matrix, unifying the data representation of physical frequency domain features and log semantic features, eliminating data structure heterogeneity. The timing synchronization device connects to the data acquisition device, receiving the hybrid matrix based on a chaotic time axis. It performs a phase space reconstruction algorithm on security log slices, mapping them to a chaotic time axis. It dynamically shrinks the physical data stream time window according to the Lyapunov exponent. When the voltage monitoring unit detects an out-of-limit standard deviation, it automatically triggers an exponential increase in the log acquisition frequency, reconstructs and aligns the timing to generate data packets for transmission, achieving dynamic frequency synchronization between physical and network data.
[0050] The rule learning device receives aligned data packets, activates preset physical environment threshold rules, and generates association weights between device status and access behavior through a neural network; it stores the topological association matrix between device overload codes and login behavior; it calculates the numerical contribution of each rule before clearing rules; when the contribution is lower than the threshold, it performs the clearing operation, and outputs a topology reconstruction command after clearing to maintain the mapping accuracy of the rule base. The graph analysis device responds to the topology reconstruction command, constructing physical sensor data as environmental-level edges and connecting transformers, circuit breakers, and relay protection device nodes within the same substation area; simultaneously, it constructs safety log features as behavioral-level edges; during closed-loop detection, it monitors for simultaneous occurrences of environmental humidity exceeding limits and network access frequency exceeding limits; when a closed loop is detected, it initiates a weight adjustment operation, strengthens environmental layer attributes through generative adversarial networks, outputs risk propagation weights, generates a risk diffusion tensor, and captures the risk coupling path between the environment and network behavior.
[0051] The risk prediction device receives the risk diffusion tensor, generates a heatmap of the equipment corrosion probability distribution for the next two hours using a long short-term memory network, and caches it. Based on the heatmap, it initiates a gated loop unit to calculate the power outage risk value for the next thirty minutes. Based on the outage risk level, it triggers a feedback operation, converting the network security defense traffic scrubbing success rate into a sensor sampling accuracy adjustment coefficient, which is then output to the data acquisition device, forming a closed-loop control of physical and network data. The feedback correction module receives manual operation logs and system execution records, inputs them into a causal tracing model to locate rule failure nodes, periodically performs a comparison operation between the old and new rule bases, retains new rules whose prediction accuracy improves beyond a set threshold, and updates the rule base. Before operation, it freezes the current rule base, updates rule parameters using reinforcement learning, and overwrites rule learning device entries when retention conditions are met. The timing synchronization device periodically transmits time reference parameters to the feedback correction module to calibrate the clock; the rule clearing command from the rule learning device triggers the graph analysis device to perform a topology reconstruction operation; the defense strategy data feedback from the risk prediction device adjusts the sampling accuracy of the data acquisition device, eliminating long-term timing drift errors.
[0052] This invention achieves a two-way closed loop where physical environment changes drive network defense strategies and prediction results feed back into data acquisition accuracy, thereby improving the reliability of equipment corrosion prediction induced by environmental intrusion. This is achieved by using quantized data capture to fuse physical frequency domain features and network semantic features, dynamically reconstructing log collection frequency through chaotic time-series synchronization, optimizing mapping relationships through a meta-learning rule engine, identifying closed-loop risk paths of environmental behavior through hypergraph fusion analysis, predicting corrosion probability and interruption risk values at multiple scales and adjusting data collection accuracy in reverse, and using a black hole feedback engine to calibrate and update the rule base in time series.
[0053] In power threat prediction systems, wavelet packet transform is a signal processing technique used to decompose voltage and current waveforms captured by sensors of physical devices, separating them into low-frequency fundamental waves, mid-frequency harmonics, and high-frequency noise components. These components are then compressed into feature tensors through a three-level decomposition to help extract frequency domain information to identify abnormal device patterns.
[0054] Pre-trained semantic models are natural language processing tools that are pre-trained on large-scale text data. They encode protocol types and access paths in network security logs into numerical vectors, such as generating protocol vectors and risk heat values, thus transforming unstructured log data into a format that can be processed by machine learning and facilitating the fusion of physical features.
[0055] The phase space reconstruction algorithm is an application of chaos theory. By calculating the correlation dimension of log data, it projects the security log slices with non-uniform timestamps onto the chaotic time axis, solving the problem of inconsistent log and physical data collection frequencies and achieving time sequence alignment.
[0056] The Lyapunov exponent is used to quantify the dynamic behavior of chaotic systems. In time synchronization, the time window width of the physical data stream is dynamically reduced according to the exponent value. When the exponent increases, the window shrinks to improve real-time performance, enabling a rapid response when physical signals change abruptly.
[0057] As the core of a rule-learning device, a neural network learns the complex correlation weights between device state and access behavior through a multi-layered neuron structure. After inputting aligned data packets, it automatically adjusts parameters to generate a predictive model that captures the mapping relationship between the environment and network risks.
[0058] The Shapley value algorithm, derived from game theory, is used to calculate the numerical contribution of each rule to the prediction result. It identifies low-contribution entries by fairly allocating rule weights, supports the rule learning device in performing a cleanup operation, and optimizes the effectiveness of the rule base.
[0059] Generative adversarial networks (GANs) consist of generator and discriminator components. In graph analysis, they enhance the attribute weights of environmental-level edges. When environmental parameters exceed limits and form a closed loop with behavioral-level edges, they generate adversarial examples to improve the accuracy of risk propagation paths.
[0060] Long Short-Term Memory (LSTM) networks are a variant of recurrent neural networks that use memory gates to process sequential data. In risk prediction, they analyze the risk diffusion tensor to generate the probability distribution of equipment corrosion and predict corrosion hotspots within the next two hours.
[0061] The gated recurrent unit simplifies the long short-term memory network structure and efficiently calculates sequence dependencies through update and reset gates to assess the risk of power outages in the next 30 minutes, thus adapting to multi-scale prediction needs.
[0062] The causal tracing model is based on Bayesian network principles. It constructs a probabilistic graphical model to locate rule failure nodes, infers the cause of failure after inputting manual operation logs and system records, and supports a feedback correction module to accurately update the rule base.
[0063] Reinforcement learning uses a reward mechanism to drive the decision-making process. By comparing the rule base, it updates the rule parameters through trial and error, retains the entries that improve prediction accuracy, and achieves self-iterative optimization of the rule base to improve the robustness of the system.
[0064] When processing signals from physical device sensors, the data acquisition device performs a three-level wavelet packet transform decomposition process to separate voltage and current waveforms into low-frequency, mid-frequency, and high-frequency components, compressing them into feature tensors. Simultaneously, when processing network security logs, a pre-trained semantic model encodes protocol types and access paths into protocol vectors and risk intensity values based on word embedding technology. When temperature changes accelerate, the log anomaly frequency detection threshold is lowered by dynamically adjusting the model's sensitivity to optimize vector extraction, coupling meteorological parameters to generate a frequency-domain and semantic hybrid matrix.
[0065] When the timing synchronization device receives the hybrid matrix based on the chaotic time axis, it uses a phase space reconstruction algorithm to reconstruct the time dimension of the security log slices. By calculating the delay time and embedding dimension, it maps the non-uniform logs to a unified chaotic axis. The physical data stream time window is dynamically adjusted according to the Lyapunov exponent; as the exponent increases, the window shrinks to improve response speed. When the voltage standard deviation exceeds the limit, the log collection frequency is multiplied exponentially to increase the number of sampling points, reconstructing and aligning the timing to generate data packets for transmission.
[0066] When the rule learning device activates physical environment threshold rules, the neural network learns the association weights between device state and access behavior through a multilayer perceptron structure, and automatically optimizes parameters after inputting aligned data packets. Before the rule clearing operation, the numerical contribution is calculated, and the Shapley value algorithm is used to fairly allocate rule weights. Low-contribution entries are identified and cleared, and a topology reconstruction instruction is output.
[0067] When the graph analysis device responds to a topology reconstruction command, environmental-level edges connect physical sensor data to device nodes in the same area, such as transformers or circuit breakers, while behavioral-level edges construct access paths based on security log features. During closed-loop detection, the concurrency of environmental parameter exceedance signals and access frequency exceedance signals within a time window is monitored, triggering a weight adjustment operation to strengthen risk propagation weights through adversarial generative networks, and outputting a risk diffusion tensor.
[0068] After receiving the risk diffusion tensor, the risk prediction device uses a long short-term memory network to handle sequence dependencies using forget gates and input gates, generating a heatmap of the equipment corrosion probability distribution. A gated recurrent unit simplifies the calculation of power outage risk values, and the prediction results are converted into sampling accuracy adjustment coefficients and fed back to the data acquisition device.
[0069] The feedback correction module receives manual operation logs and system execution records. The causal tracing model uses a Bayesian network to infer rule failure nodes. After locating the cause of the failure, it initiates a comparison between the old and new rule bases. The rule base update employs a reinforcement learning strategy to optimize parameters through a reward mechanism, retaining new rules that improve prediction accuracy.
[0070] The timing synchronization device periodically transmits time reference parameters to the feedback correction module to calibrate the clock. The rule clearing command triggers the graph analysis device to reconstruct the topology. The risk prediction device provides feedback to adjust the sampling accuracy, forming a closed-loop control.
Claims
1. A threat prediction system, characterized in that, include: The data capture device captures voltage and current frequency domain features from physical device sensors, compresses them into feature tensors, extracts protocol vectors and risk heat values from network security logs in parallel, couples meteorological parameters to generate a frequency domain and semantic hybrid matrix and outputs it. The timing synchronization device is connected to the data acquisition device. It receives the hybrid matrix based on the chaotic time axis, maps the physical data stream to the dynamic time window, and dynamically reconstructs the safety log collection frequency when a voltage change gradient is detected, generates aligned data packets and transmits them. The rule learning device receives alignment data packets, activates preset physical environment threshold rules, generates association weights between device status and access behavior through a neural network, and executes the clearing of rules with weights below the threshold when the prediction deviation exceeds the standard continuously, and outputs topology reconstruction instructions. The graph analysis device responds to the topology reconstruction command, constructs physical sensor data as environmental-level edges, and simultaneously constructs safety log features as behavioral-level edges. When a closed loop is detected between environmental-level edges and behavioral-level edges, weight adjustment is initiated, and a risk diffusion tensor is output. The risk prediction device receives the risk diffusion tensor, generates the equipment corrosion probability distribution through a long short-term memory network, calculates the power outage risk value through a gated loop unit, and converts the risk prediction result into a sampling accuracy adjustment coefficient, which is then fed back to the data acquisition device.
2. The threat prediction system according to claim 1, characterized in that, The data capture device is configured as follows: The data acquisition device performs wavelet packet transform three-level decomposition during the extraction of frequency domain features and outputs a compressed feature tensor. Receive network security logs and generate policy vectors by encoding them using a pre-trained semantic model; When an accelerated temperature change is detected, the log anomaly frequency detection threshold is lowered, and the extraction process of the strategy vector is adjusted.
3. The threat prediction system according to claim 2, characterized in that, The timing synchronization device is configured as follows: The timing synchronization device performs a phase space reconstruction algorithm on the security log slices, maps them to the chaotic time axis, and outputs them. The physical data stream time window is dynamically shrunk based on the Lyapunov exponent; When the voltage standard deviation exceeds the limit, the acquisition frequency is automatically increased exponentially to reconstruct the alignment timing of the security log slice.
4. The threat prediction system as described in claim 3, characterized in that, The rule learning device is configured as follows: The topological correlation matrix between the storage device overload code of the rule learning device and login behavior; Calculate the numerical contribution of each rule before performing the rule clearing operation; When the numerical contribution is below the threshold, a rule clearing operation is performed. After clearing, a topology reconstruction command is output to the map analysis device.
5. The threat prediction system according to claim 4, characterized in that, The spectral analysis device is configured as follows: The graph analysis device constructs environmental hierarchy edges and connects at least three device nodes in the same region; When performing closed-loop testing, both the monitoring environment parameters and the access frequency exceed the limit. When a closed loop is detected, a weight adjustment operation is initiated. The environment layer attributes are enhanced by adversarial generative networks, and risk propagation weights are output.
6. The threat prediction system according to claim 5, characterized in that, The risk prediction device is configured as follows: The risk prediction device generates and caches a two-hour corrosion probability heatmap using a long short-term memory network; The gating loop unit is activated based on the heat map to calculate the interruption risk value for the next thirty minutes. Based on the interruption risk value, a feedback operation is triggered, and the success rate of flow cleaning is converted into a sensor sampling accuracy adjustment coefficient and output to the data acquisition device.
7. The threat prediction system according to claim 6, characterized in that, It also includes a feedback correction module: The feedback and correction module receives manual operation logs and system execution records; Input records are used to locate the failure node of the causal tracing model; Every twelve hours, a comparison between the old and new rule bases is initiated based on the positioning results. Rules that improve prediction accuracy by more than 15% are retained and the rule base is updated.
8. The threat prediction system according to claim 7, characterized in that, Also includes: The current rule base is frozen before the feedback correction module runs; Reinforcement learning is used to update rule parameters when performing comparison operations; When a new rule meets the retention criteria, it overwrites the corresponding entry in the rule learning device.
9. The threat prediction system according to claim 8, characterized in that, Also includes: The timing synchronization device transmits time reference parameters to the feedback correction module to calibrate the clock every 24 hours. The rule-clearing command from the rule-learning device triggers the topology reconstruction operation from the graph analysis device; The risk prediction device converts defense strategy data into sampling accuracy adjustment coefficients and feeds them back to the data acquisition device.
10. A threat prediction method, applied to the threat prediction system as described in claims 1 to 9, characterized in that, include: Step 1: Capture voltage and current frequency domain features from physical device sensors, compress them into feature tensors, extract protocol vectors and risk heat values from network security logs in parallel, couple meteorological parameters to generate a frequency domain and semantic hybrid matrix and output it; Step 2: Based on the chaotic time-based axis receiving hybrid matrix, the physical data stream is mapped to a dynamic time window. When a voltage change gradient is detected, the safety log collection frequency is dynamically reconstructed, and aligned data packets are generated and transmitted. Step 3: Receive the alignment data packet, activate the preset physical environment threshold rule, generate the association weight between device status and access behavior through the neural network, and execute the rule to clear the weight below the threshold when the prediction deviation exceeds the standard continuously, and output the topology reconstruction instruction. Step 4: In response to the topology reconstruction command, construct the physical sensor data as environmental-level edges and the safety log features as behavioral-level edges. When a closed loop is detected between the environmental-level edge and the behavioral-level edge, initiate weight adjustment and output the risk diffusion tensor. Step 5: Receive the risk diffusion tensor, generate the equipment corrosion probability distribution through a long short-term memory network, calculate the power outage risk value through a gated cyclic unit, and convert the risk prediction result into a sampling accuracy adjustment coefficient to feed back to step 1.