Subway signal system log intelligent analysis method, device, equipment and medium

Abstract

The invention relates to a subway signal system log intelligent analysis method, device and equipment and a medium. The method is realized by constructing a multi-stage security architecture of an internal security network-network isolation region DMZ-public network, firstly, log data preprocessing and encryption are carried out in the network isolation region DMZ, secondly, reverse communication is blocked through unidirectional transmission hardware, and then, accurate analysis is carried out by utilizing a large model association version demand and log keywords, so that the log data encryption is realized. And finally, establishing a global knowledge base to mine common hidden dangers. Compared with the prior art, the method has the advantages that on the premise that absolute safety of the core production network is ensured, log data aggregation of the whole road network is achieved, and intelligent real-time analysis and early warning are carried out.

Description

TECHNICAL FIELD

[0001] The present application relates to a rail transit signal system, in particular to a subway signal system log intelligent analysis method, device, equipment and medium based on one-way transmission and large model. BACKGROUND

[0002] With the acceleration of urbanization, the subway has become the backbone of public transportation in large cities. Globally, there are hundreds of cities relying on the subway system. The punctual and safe operation of the subway is directly related to the daily travel of millions of passengers and the production efficiency of the entire city.

[0003] The subway signal system is the "nerve center" that ensures the safe and efficient operation of the train. The operation log generated by the signal system contains a large amount of key data such as device status, control instructions, and fault information. Currently, the analysis of the signal system log has the following pain points: Data island and security risk: The signal system is located in a highly isolated internal security network and is physically isolated from the public network. It is difficult to gather log data from each line and each city under the premise of ensuring safety using traditional methods, and it is impossible to form a global perspective. If two-way communication methods (such as VPN) are used to export data, it will introduce huge network security risks and does not meet the protection requirements of the national information security level protection 3.0 standard for key information infrastructure.

[0004] Analysis capability lags behind: Existing log analysis relies heavily on pre-set fixed rules or expert experience, and has insufficient ability to discover unknown faults and complex associated faults. When new software versions or new types of faults occur, the rule library updates slowly and cannot adapt to the rapidly changing operating environment.

[0005] Poor timeliness of early warning: Fault analysis results are often presented through traditional reports or internal system alarms, and are not actively and immediately pushed to frontline maintenance personnel. There is a delay from discovering potential problems to starting the disposal process, which may miss the best intervention opportunity.

[0006] Knowledge cannot be deposited and reused: The fault experience of a line or a city is difficult to effectively standardize and systematize for reuse in other lines or new projects, resulting in the repeated occurrence of similar faults in different places.

[0007] Through retrieval, Chinese patent publication No. CN109522391A discloses a subway operation and maintenance vehicle-mounted log analysis and early warning method, which comprises the following steps: analyzing a downloaded diary file; extracting valid state data in the diary data obtained through analysis; and inputting the valid state data into a set behavior mode for identification and matching calculation, so as to identify and predict subway faults. The existing patent automatically and accurately extracts state data without manual analysis and reading of log data, and automatically matches log information with non-uniform and irregular data formats, thereby improving log analysis accuracy and completeness. However, the existing patent has problems such as data security risk, lagging analysis capability, and poor early warning timeliness.

[0008] Therefore, there is an urgent need in the art for a technical solution capable of realizing log data aggregation of the whole railway network, and intelligent and real-time analysis and early warning under the premise of ensuring the absolute safety of the core production network. SUMMARY

[0009] The purpose of the present application is to overcome the defects of the prior art and provide a safe, intelligent, and efficient subway signal system log intelligent analysis method, device, equipment, and medium based on one-way transmission and a large model, which can realize log data aggregation of the whole railway network and intelligent and real-time analysis and early warning under the premise of ensuring the absolute safety of the core production network.

[0010] The purpose of the present application can be achieved by the following technical solutions: According to a first aspect of the present application, a subway signal system log intelligent analysis method is provided, which is realized by constructing a multi-level security architecture of an internal security network-network isolation zone DMZ-public network". First, log data preprocessing and encryption are performed in the network isolation zone DMZ. Second, one-way transmission hardware is used to block reverse communication. Third, a large model is used to accurately analyze the correlation between version requirements and log keywords. Finally, a global knowledge base is established to mine common hidden dangers.

[0011] As a preferred technical solution, the method specifically comprises the following steps: Step S100, after internal log data collection, one-way transmission to the network isolation zone DMZ is adopted; Step S200, the network isolation zone DMZ preprocesses the log data, and sends the processed data to a log receiving server located in the public network through a data one-way transmission device; Step S300, after the log receiving server receives the log data, log analysis and modeling analysis are performed; Step S400, the results of step S300 are sent to the front end for presentation, and the serious faults that are judged to possibly affect operation are sent to the pre-set relevant responsible personnel in real time. Step S500, continuously gather all line logs and analysis results for big data analysis, and mine common fault modes, software defects or optimization points.

[0012] As a preferred technical solution, the step S100 specifically comprises: The log collection end located in the internal safety network of each subway line collects original log data from the signal system; The data is unidirectionally sent to the network isolation zone DMZ through the internal safety protocol.

[0013] As a preferred technical solution, the preprocessing in the step S200 includes data cleaning, formatting, compression and encryption processing.

[0014] As a preferred technical solution, the log receiving server in the step S200 is configured to only receive internal connections, does not actively initiate requests to the internal network, and together with the unidirectional transmission device forms a double security barrier.

[0015] As a preferred technical solution, the step S300 specifically comprises: Step S310, identifying the signal system platform baseline and software version number used by the subway line according to the log source information; Step S320, calling a large language model for intelligent analysis.

[0016] As a preferred technical solution, the step S320 specifically comprises: The software version number, the preloaded version requirement specification document and the real-time log data are provided as inputs to the large model; The large model understands the system functions and fault logic defined in the requirement specification document, and finds and matches the corresponding keywords or patterns in the real-time log data, thereby identifying the fault phenomenon, and finally associating the potential fault cause.

[0017] As a preferred technical solution, in the step S400, the warning information is sent to the pre-set relevant responsible personnel in real time through the mail, SMS and or mobile application push mode.

[0018] According to the second aspect of the present application, a device for the subway signal system log intelligent analysis method is provided, comprising: The log collection end deployed in the internal safety network is used to collect original log data from the signal system, and unidirectionally send the data to the network isolation zone DMZ through the internal safety protocol; The log sending server deployed in the network isolation zone DMZ is used to receive log data from the internal network, and perform data cleaning, formatting, compression and encryption preprocessing operations, and then push the processed data packets to the unidirectional transmission device; A one-way transmission device is used for the physical one-way transmission of data from an intranet to a public network; A backend analysis engine deployed on the public network is used to parse, intelligently analyze, and issue early warnings for the received data; The front-end presentation and early warning push module is used to display analysis results to users and push early warning information through multiple channels.

[0019] As a preferred technical solution, the unidirectional transmission device is an optical shutter or a unidirectional network shutter.

[0020] As a preferred technical solution, the background analysis engine includes a log receiving server, a line context database, a large model service module, and an early warning generation module.

[0021] According to a third aspect of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described thereon.

[0022] According to a fourth aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described thereon.

[0023] Compared with the prior art, the present invention has the following advantages: 1) This invention constructs a dual unidirectional transmission architecture of "internal production network -> DMZ -> public network analysis platform" and uses hardware-level unidirectional transmission equipment (such as optical shutters) to achieve data export, fundamentally eliminating the attack path of external networks to the core signal system. Under the premise of meeting the mandatory security regulations such as the Information Security Protection Standard 3.0, it breaks down data silos and realizes the secure aggregation of logs from the entire network. It is estimated that by using mature optical shutter technology, the cost of single-point implementation can be controlled at the level of 100,000 yuan, which has extremely high security cost-effectiveness. 2) This invention deeply integrates large-scale model analysis with domain knowledge of rail transit signaling systems (platform baseline, software version, requirements documents), achieving context-aware intelligent log analysis. This overcomes the limitations of traditional fixed-rule analysis, enabling the system to perform correlation analysis and root cause inference of complex and hidden faults. When the line upgrades to new software, only the corresponding requirements document needs to be updated to the large model to quickly acquire the analysis capabilities of the new version, greatly improving the system's adaptability and intelligence. 3) This invention establishes an automated closed-loop process from intelligent analysis to proactive early warning, and integrates with multiple instant messaging channels (email, SMS), which significantly shortens the response time from the discovery of potential faults to the initiation of maintenance actions, enabling maintenance personnel to "treat problems before they occur," effectively preventing faults from occurring or escalating, thereby improving on-time operation rate and reducing the impact on passengers. 4) Based on the analysis of a single line, this invention constructs a global big data analysis module to uncover common fault hazards across lines. It can discover systemic risks from a macro perspective, guide the entire network to carry out preventive maintenance and patch deployment, and achieve a leap from "managing a single line to optimizing an entire network". This fundamentally improves the safety and reliability of the entire subway network and saves the operating unit a lot of subsequent maintenance costs and operational losses caused by faults. 5) This invention constructs a scalable access architecture for global subway lines, realizing the aggregation and centralized monitoring of data on a global scale. The constructed system architecture has high versatility and scalability. Theoretically, the subway signaling systems of all operating lines around the world can be securely connected to this platform, thereby forming a global "single map of subway signaling system operation status". This global data control capability transcends the operation and maintenance perspective of a single line or a single city, providing unprecedented data support for product strategic decision-making. Macro trend insights: By comparing and analyzing the operational data of signal systems from different regions, standards, and suppliers around the world, we can accurately identify common failure modes, system performance bottlenecks, and potential improvement needs.

[0024] Guiding Product Development Direction: These macro-level data, derived from real-world global operations, provide signal system equipment suppliers and software developers with the most direct and objective guidance for R&D direction. They can be used to guide the functional planning, reliability improvement, and technical roadmap formulation of next-generation products, ensuring that product evolution always closely aligns with the actual needs of the global market.

[0025] Optimize strategic layout: By analyzing the health status and performance of equipment on various lines around the world, operators and equipment manufacturers can develop more forward-looking market strategies, spare parts layouts, and preventive maintenance plans, thereby optimizing resource allocation from a global perspective and enhancing business competitiveness. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating the specific process of the method of the present invention; Figure 2 This is a schematic diagram of the secure unidirectional transmission architecture of the present invention; Figure 3 This is a flowchart of the intelligent analysis of the large model in this invention; Figure 4 This is a flowchart illustrating the early warning and presentation process of this invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] Example 1 This invention provides a secure, intelligent, efficient, and nationally compliant intelligent analysis method for wide-area subway signaling systems that integrates unidirectional transmission and large-scale models. Figure 1 As shown, the specific steps include: Step S100: Internal Log Collection and Secure Transmission: The log collection terminal located within the internal security network of each subway line collects raw log data from signaling equipment and subsystems (such as ATS, ATP / ATO, CBI). Subsequently, the data is unidirectionally transmitted to the log transmission server in the network isolation zone (DMZ) via an internal security protocol. The internal security network does not establish any direct connection with external networks, ensuring the closed nature of the core production system.

[0029] Step S200, DMZ Preprocessing and One-Way Secure Transmission: The log sending server located in the network isolation zone (DMZ) receives data from the internal network and performs critical preprocessing operations, including data cleaning, formatting, compression, and encryption. Subsequently, the processed data is pushed to the log receiving server located on the public network via a one-way data transmission device (such as an optical gateway or one-way network gateway) deployed at the network boundary. This server is configured to only accept internal connections and does not actively initiate requests to the internal network, forming a double security barrier together with the one-way transmission device. This transmission process is physically unidirectional; the public network cannot send any instructions or data to the internal network through this channel.

[0030] Step S300, Log Parsing and Modeling Analysis: After receiving the logs, the public network backend server decrypts and verifies them. Subsequently, the system executes the following sub-steps: Step S310, Line Context Identification: Based on the log source, identify the baseline and software version number of the signaling system platform used by the subway line.

[0031] Step S320, Large-Scale Intelligent Diagnosis: A large-scale language model is invoked for intelligent analysis. Specifically, the software version number, a pre-set requirement specification document for that version (such as functional descriptions and a fault mode library), and real-time log data are provided as input to the large-scale model. The large-scale model understands the system functions and fault logic defined in the requirement document and searches and matches corresponding keywords or patterns in the real-time logs to identify fault phenomena and correlate potential fault causes.

[0032] For example, in software version V3.10.0, the requirements document defines multiple triggering conditions for "Emergency Braking (EB)". When analyzing logs, the large model searches for keywords such as "EB", "Brake", and "Comm Loss" (communication interruption). Once a match is found, it can diagnose specific causes such as "emergency braking triggered by vehicle-to-ground communication interruption" based on pre-defined logical relationships.

[0033] Step S400, Result Feedback and Multi-Channel Early Warning: The analysis results are stored and sent to the front-end presentation system. For early warnings of serious faults that are determined to potentially affect operations, the system automatically sends the warning information to the relevant pre-set responsible personnel in a timely manner via email, SMS, mobile application push, etc.

[0034] Step S500, Global Knowledge Mining and Optimization: The backend system continuously gathers logs and analysis results from all lines, performs big data analysis, and identifies common fault modes, software defects, or optimization points. This provides data support for preventative maintenance and software patch deployment strategies across the entire network. This module not only serves a single owner, but the global knowledge base formed by its analysis results also provides crucial data for signal system design optimization, industry standard evolution, and product platform strategic planning.

[0035] Example 2 The present invention also provides an apparatus for the intelligent analysis method of subway signal system logs in Embodiment 1, comprising: Log collection terminal deployed on the internal security network: responsible for collecting raw log data from signal equipment and subsystems, and sending the data unidirectionally to the network isolation zone DMZ through the internal security protocol; The log sending server deployed in the DMZ network isolation zone is responsible for receiving log data from the internal network and performing preprocessing operations such as data cleaning, formatting, compression and encryption. Then, it pushes the processed data packets to the one-way transmission device. This server is configured to only accept connection requests from the internal network. Unidirectional transmission hardware devices, such as optical shutters or unidirectional network gateways, are connected between the DMZ and the public network to realize physical unidirectional data transmission from the internal network to the public network. The backend analysis engine deployed on the public network includes a log receiving server, a line context database, a large model service module, and an early warning generation module, which is responsible for parsing, intelligently analyzing, and making early warning judgments on the received data. Front-end presentation and early warning push module: including a web visualization interface and a message push gateway, used to display analysis results to users and push early warning information through multiple channels.

[0036] Example 3 Take a Shanghai Metro line that uses "signal system software version V3.10.0" as an example.

[0037] The overall workflow and data of this method (corresponding) Figure 1 ): Figure 1 This clearly demonstrates the complete closed loop of this solution, from data collection to value generation.

[0038] In the S100 phase, operational logs generated by the Automatic Train Monitoring System (ATS) and Automatic Train Protection System (ATP) are aggregated within the internal security network and unidirectionally transmitted to a log sending server in the Distance Management Zone (DMZ) via a security protocol. This server identifies, compresses, and encrypts the logs, forming secure data packets. This process ensures the secrecy of the core production network.

[0039] During the S200 phase, the log sending server located in the DMZ pushes data packets to the public network through a one-way optical gate. This server is configured to passively receive only internal network connections. This transmission is strictly unidirectional at the physical layer, like a one-way valve that "only lets out and never lets in," fundamentally blocking any communication path from the public network to the internal network, thus meeting the mandatory security requirements of graded protection.

[0040] In the S300 phase, the public network log receiving server receives data packets, decrypts them, and sends them to the analysis engine. Based on the log IP source, it identifies the system as the "Shanghai XX Line," and determines the software version as "V3.10.0." Subsequently, it calls the large model and loads the corresponding requirements document. Through log analysis, the large model discovers an abnormal timing relationship between the "train stops" event and the "door release" command within a certain timeframe, diagnosing a potential risk of "timing deviation in platform door control for some trains."

[0041] During the S400 phase, this risk was classified as a "medium-level warning." The analysis results were immediately displayed on the web dashboard in the monitoring center. At the same time, a warning message was automatically sent to the mobile phone of the signal maintenance engineer of the line via SMS gateway, prompting "Pay attention to check the timing of the ATS door control logic on the XX line."

[0042] During the S500 phase, the backend system discovered similar timing alarms on two other lines also using version V3.10.0 within the following week. The global knowledge mining module subsequently generated an analysis report, pointing out that "version V3.10.0 may have a common risk of insufficient design redundancy in the door control sequence under high passenger flow pressure during peak hours," providing direct data support for the R&D department to subsequently release the V3.5.3 patch.

[0043] Then combine Figure 2 This section provides a detailed explanation of the specific implementation of the secure unidirectional transmission architecture.Figure 2 It demonstrates how to build an insurmountable security barrier through partitioned deployment and dedicated hardware.

[0044] like Figure 2 As shown, the internal security network (production control area) of the subway signaling system is completely isolated from the public network. Internal systems such as ATS and ATP communicate bidirectionally with the log sending server (located in the production control area, or placed in the production management area via a forward isolation device) using internal secure communication protocols (such as proprietary protocols or hardened TCP / IP) to retrieve log data. This is the only permitted bidirectional communication link in the entire process and is strictly limited to the internal security network.

[0045] After preprocessing and encrypting the data, the log sending server proactively initiates a connection to the one-way transmission device (optical shutter). The sending end of the optical shutter is located on the internal network side, and the receiving end is located on the public network side. Internally, it ensures that data can only flow from the internal network to the public network through physical methods such as stripping the receiving fiber or disabling the reverse receiving circuit. The encrypted data packets are then "sprayed" to the log receiving server on the public network side through this physical channel.

[0046] The log receiving server acts as a data relay station, receiving and verifying the integrity of data, but it cannot send any form of confirmation or instruction internally through this channel. Subsequently, it provides the decrypted data bidirectionally to the backend public network analysis platform for in-depth processing via a standard, firewall-protected network connection. This design ensures that the core production network has no direct physical connection to the internet, isolating risks outside the DMZ zone.

[0047] Intelligent analysis (corresponding) Figure 3 ): The public network backend server receives and decrypts the logs, and performs intelligent analysis.

[0048] Input Fusion: The input to the large model service is a contextual environment that integrates information from multiple sources, including: a) real-time log text data; b) the software version number identified through step S310 (e.g., V3.10.0); c) pre-built requirement function documents and fault knowledge base that strictly correspond to this version.

[0049] Core diagnostic process: The large model is not based on arbitrary reasoning, but rather on a deep understanding of the requirements documents, establishing a mapping relationship between "function - phenomenon - log keywords". Then, it scans the real-time logs to find keywords that match the mapping relationship, thereby accurately identifying the fault phenomenon.

[0050] For example, suppose the requirements document states that in version V3.10.0, a "train positioning loss" fault will correspondingly generate keywords such as "Position Lost" and "Location Invalid" in the logs, and may be caused by "beacon antenna failure" or "trackside processor restart." When the large model scans the logs corresponding to version V3.10.0 and finds the keyword "PositionLost," it can immediately identify the "train positioning loss" fault phenomenon and, based on the causal logic defined in the document, provide specific and actionable fault causes and handling suggestions such as "check the beacon antenna" or "verify the trackside equipment." This method firmly combines the semantic understanding capabilities of the large model with domain expertise, ensuring the accuracy and professionalism of the analysis results.

[0051] First, the system identifies the IP address as belonging to the "Shanghai XX Line" based on the log source and finds that its signal system software version is "3.10.0". Next, the system calls the large model service, with the following input parameters: Log content: [Timestamp] [Device ID] ATP: Emergency Brake applied. Reason: CommLoss with preceding train. Software version: V3.10.0 Prerequisite knowledge (excerpt from V3.10.0 requirements document): "In V3.10.0, possible causes of EB braking include: a) communication interruption with the preceding vehicle; b) speeding; c) abnormal track circuit occupancy... Among these, typical log keywords for communication interruption are 'Comm Loss' and 'Link Down'..." The large model analyzed this information and deduced that: "The EB braking was caused by a communication interruption between the train and the preceding train. According to the V3.10.0 design, this situation is a safety protection braking, but frequent occurrences may indicate an instability issue in the train-to-ground communication system." Subsequently, the model generated a "moderate" warning, pointing out that the potential root cause might be "intermittent failure of the train-to-ground communication equipment."

[0052] Early warning and presentation (corresponding) Figure 4 The analysis results were stored and displayed on the monitoring center's web interface. Simultaneously, due to being classified as a "medium" warning, the system automatically triggered a push notification process, sending a warning SMS to the mobile phone of the line's communication maintenance team leader: "[Metro Maintenance Warning] Multiple EB braking incidents have occurred on Shanghai XX Line, suspected to be due to unstable train-to-ground communication. Please check the relevant equipment promptly." Global optimization (corresponding) Figure 1(S500): The backend system discovered that within the next month, two other lines nationwide using the same V3.10.0 version also experienced similar cases of "communication interruption causing EB braking". Based on this, the big data analysis module generated a common fault report, indicating that "V3.10.0 version may have communication compatibility issues in certain wireless environments". It recommended that the R&D department release a patch to address this issue and conduct preventative checks and upgrades for all V3.10.0 lines across the network, thereby preventing widespread occurrence of the fault.

[0053] The above embodiments fully demonstrate that the technical solution of the present invention can safely, intelligently, and efficiently realize the analysis and early warning of subway signal logs, and produce significant beneficial effects.

[0054] Example 4 This invention also provides an electronic device including a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). The RAM may also store various programs and data required for device operation. The CPU, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0055] Multiple components in the device are connected to the I / O interface, including: input units such as keyboards and mice; output units such as various types of displays and speakers; storage units such as disks and optical discs; and communication units such as network interface cards (NICs), modems, and wireless transceivers. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0056] The processing unit executes the various methods and processes described above, such as methods S100 to S500. For example, in some embodiments, methods S100 to S500 may be implemented as computer software programs tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the CPU, one or more steps of methods S100 to S500 described above may be performed. Alternatively, in other embodiments, the CPU may be configured to execute methods S100 to S500 by any other suitable means (e.g., by means of firmware).

[0057] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0058] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0059] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0060] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A subway signal system log intelligent analysis method, characterized in that, The method is realized by constructing a multi-level security architecture of an internal security network-network isolation zone DMZ-public network. First, log data preprocessing and encryption are performed in the network isolation zone DMZ. Second, one-way transmission hardware is used to block reverse communication. Third, a large model is used to associate version requirements with log keywords for accurate analysis. Finally, a global knowledge base is established to mine common hidden dangers.

2. The metro signal system log intelligent analysis method according to claim 1, characterized in that, The method specifically includes the following steps: Step S100, after internal log data collection, one-way transmission to the network isolation zone DMZ is adopted; Step S200, the network isolation zone DMZ preprocesses the log data, and sends the processed data to the log receiving server located in the public network through the data one-way transmission device; Step S300, after the log receiving server receives the log data, log parsing and modeling analysis are performed; Step S400, the results of step S300 are sent to the front end for presentation, and the serious faults that may affect the operation are immediately sent to the pre-set relevant responsible personnel; Step S500, continuously gather all line logs and analysis results for big data analysis to mine common fault modes, software defects or optimization points.

3. The metro signal system log intelligent analysis method according to claim 2, characterized in that, The step S100 specifically includes: The log collection end located in the internal security network of each subway line collects raw log data from the signal system; The data is one-way transmitted to the network isolation zone DMZ through the internal security protocol.

4. The metro signal system log intelligent analysis method according to claim 2, characterized in that, The preprocessing in step S200 includes data cleaning, formatting, compression and encryption processing.

5. The method of claim 2, wherein the metro signal system log intelligent analysis method is characterized by, The log receiving server in step S200 is configured to only receive internal connections and does not actively initiate requests to the internal network, and together with the one-way transmission device forms a double security barrier.

6. The method of claim 2, wherein the method further comprises: The step S300 specifically includes: Step S310, identify the signal system platform baseline and software version number used by the subway line according to the log source information; Step S320, call a large language model for intelligent analysis.

7. The metro signal system log intelligent analysis method according to claim 6, characterized in that, The step S320 specifically includes: The software version number, preloaded version requirement specification document and real-time log data are provided as input to the large model; The large model understands the system functions and fault logic defined in the requirement specification document, and finds and matches the corresponding keywords or patterns in the real-time log data, thereby identifying the fault phenomenon, and finally associating the potential fault cause.

8. The method of claim 2, wherein the metro signal system log intelligent analysis method is characterized by, In step S400, the warning information is immediately sent to the pre-set relevant responsible personnel by email, SMS and / or mobile application push method.

9. A device for the metro signal system log intelligent analysis method of any one of claims 1-8, characterized in that, It includes: The log collection end deployed in the internal security network is used to collect raw log data from the signal system, and the data is one-way transmitted to the network isolation zone DMZ through the internal security protocol; The log sending server deployed in the network isolation zone DMZ is used to receive log data from the internal network, and perform data cleaning, formatting, compression and encryption preprocessing operations, and then push the processed data packets to the one-way transmission device; The one-way transmission device is used for physical one-way transmission of data from the internal network to the public network; The background analysis engine deployed in the public network is used for log parsing, intelligent analysis and warning judgment on the received data; The front-end presentation and early warning pushing module is used for showing analysis results to users and performing multi-channel early warning information pushing.

10. The apparatus of claim 9, wherein, The unidirectional transmission device is an optical gate or a unidirectional network gate.

11. The apparatus of claim 9, wherein, The background analysis engine comprises a log receiving server, a line context database, a large model service module and an early warning generation module.

12. An electronic device comprising a memory and a processor, said memory having stored thereon a computer program, characterized in that, The processor implements the method of any one of claims 1-8 when executing the program.

13. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method of any one of claims 1-8.

Images