Hydrological safety protection early warning method and system based on AI algorithm and medium

Abstract

The invention relates to a hydrological safety protection early warning method and system based on an AI algorithm and a medium, and the method comprises the steps: collecting hydrological safety data, dividing the hydrological safety data into three data types, and enabling the corresponding risk types to be network attacks, equipment faults or environment risks; and performing data cleaning, conversion and feature extraction on the hydrological safety data to obtain three types of anomaly detection model meta-features corresponding to the three risk categories respectively, inputting the three types of anomaly detection model meta-features into the lightweight risk category pre-judgment model, outputting to obtain a corresponding target risk category, inputting the corresponding anomaly detection model meta-features into the corresponding anomaly detection model, and determining the anomaly detection model in the lightweight risk category pre-judgment model. Outputting to obtain a first abnormal score; inputting the meta-features of the three types of anomaly detection models into the integrated model, and outputting a second anomaly score; and carrying out weighted fusion on the first abnormal score and the second abnormal score to obtain a comprehensive abnormal score, and carrying out early warning grading according to the comprehensive abnormal score. According to the invention, through a dual-channel reasoning mechanism formed by the special anomaly detection model and the integrated model, the anomaly identification precision is effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of hydrological safety technology, specifically relating to a hydrological safety protection and early warning method, system, and medium based on AI algorithms. Background Technology

[0002] Existing hydrological safety early warning technologies primarily rely on physical sensor networks and threshold alarm mechanisms, which have shortcomings: First, it only collects data from physical sensors without considering network security or abnormal physical environments; Secondly, relying on a single risk assessment model makes it difficult to conduct a comprehensive analysis and assessment of security risks, which can easily lead to misjudgments or omissions. Summary of the Invention

[0003] Based on the aforementioned shortcomings and deficiencies in the existing technology, one of the objectives of this invention is to at least solve one or more of the aforementioned problems in the existing technology. In other words, one of the objectives of this invention is to provide a hydrological safety protection and early warning method, system, and medium based on AI algorithms that meets one or more of the aforementioned needs.

[0004] To achieve the above-mentioned objectives, the present invention adopts the following technical solution: A hydrological safety protection and early warning method based on AI algorithms includes the following steps: S1. Collect hydrological safety data. Hydrological safety data has a timestamp and a data type label. Among them, hydrological safety data is divided into three types: hydrological network security data, hydrological equipment operation data, and hydrological physical environment data. The corresponding three risk categories are network attack, equipment failure, or environmental hazard. S2. Perform data cleaning, transformation and feature extraction on hydrological safety data to obtain the meta-features of the three types of anomaly detection models corresponding to the three risk categories; S3. Input the meta-features of the three types of anomaly detection models into the lightweight risk category prediction model, and output the corresponding target risk category. S4. Input the meta-features of the anomaly detection model corresponding to the target risk category into the corresponding anomaly detection model, and output the first anomaly score. The three types of anomaly detection model meta-features are also input into the integrated model to output a second anomaly score; S5. The first and second anomaly scores are weighted and fused to obtain a comprehensive anomaly score, and an early warning level is determined based on the comprehensive anomaly score.

[0005] As a preferred embodiment, in step S4, if the target risk category is network attack, then the corresponding anomaly detection model is a graph attention network, which performs loss iteration by comparing and learning to reconstruct the error, and outputs the first anomaly score.

[0006] As a preferred embodiment, in step S4, if the target risk category is equipment failure, the corresponding anomaly detection model includes an LSTM encoder and its connected original residual network ResNet-style. The LSTM encoder is used to encode the meta-features of the anomaly detection model to output the hidden state sequence at the current time. Then, the prediction head of the original residual network ResNet-style predicts the predicted value at the next time. Then, the difference between the actual observation value and the predicted value at the next time is used as the residual vector. Finally, the weighted Mahalanobis distance is used as the first anomaly score output.

[0007] As a preferred approach, residual block stacking is used to predict the value at the next time step. for: = ; in, The actual observed value at the current moment. For multi-layer convolutional or fully connected residual functions, These are the parameters for the residual block.

[0008] As a preferred embodiment, in step S4, if the target risk category is environmental hazard, then the corresponding anomaly detection model is a spatiotemporal convolutional anomaly detector. The temporal evolution and spatial distribution features of the meta-features of the anomaly detection model are extracted by a spatiotemporal convolutional encoder. Then, multi-scale feature fusion is performed by a U-Net-style skip connection in a deep learning model. During training, the mean square error (MSE) between the input and the reconstruction output is minimized. During inference, the reconstruction error is used as the first anomaly score.

[0009] As a preferred embodiment, the process of the spatiotemporal convolutional encoder extracting the temporal evolution and spatial distribution features of the meta-features of the anomaly detection model includes: First, features are extracted using 3D convolutional kernels, and then batch normalization and linear unit correction are performed sequentially. The processing yields temporal evolution and spatial distribution characteristics.

[0010] As a preferred option, the comprehensive anomaly score for: ; in, The first abnormal score, The second abnormal score, For target risk category Weighting coefficients; Weighting coefficient for: ; in, For target risk category The sliding window accuracy of the corresponding anomaly detection model, For target risk category The sliding window accuracy of the corresponding ensemble model.

[0011] As a preferred embodiment, the early warning classification is as follows: like If it is, it is classified as an observation level, and a log is recorded and added to the observation queue; like If so, it is classified as an intervention level and the preset SOAR script is executed; like If the situation is classified as blocking, immediate blocking, alarm notification, and emergency response will be initiated. in, , These are the preset warning thresholds.

[0012] This invention also provides a hydrological safety protection and early warning system based on an AI algorithm, applying the hydrological safety protection and early warning method described in any of the preceding solutions, wherein the hydrological safety protection and early warning system includes: The data acquisition module is used to collect hydrological safety data. The hydrological safety data has a timestamp and a data type label. Among them, the hydrological safety data is divided into three types: hydrological network security data, hydrological equipment operation data, and hydrological physical environment data. The corresponding three risk categories are network attack, equipment failure, or environmental hazard. The data processing module is used to clean, transform, and extract features from hydrological safety data, and obtain the meta-features of the three anomaly detection models corresponding to the three risk categories. The risk category prediction module is used to input the meta-features of the three types of anomaly detection models into the lightweight risk category prediction model and output the corresponding target risk category. The anomaly detection module is used to input the meta-features of the anomaly detection model corresponding to the target risk category into the corresponding anomaly detection model and output the first anomaly score; it is also used to input the meta-features of the three types of anomaly detection models into the integrated model and output the second anomaly score. The weighted fusion module is used to weight and fuse the first anomaly score and the second anomaly score to obtain a comprehensive anomaly score. The early warning classification module is used to classify early warnings based on the comprehensive anomaly score.

[0013] The present invention also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the hydrological safety protection and early warning method as described in any of the preceding embodiments.

[0014] Compared with the prior art, the beneficial effects of this invention are: This invention identifies potential safety risks in advance by real-time sensing, intelligent analysis, and accurate judgment of various hydrological safety data, triggering tiered early warnings and assisting emergency response, forming a closed-loop process of "data input - intelligent analysis - early warning output". Moreover, by dynamically activating dedicated anomaly detection models for different risk categories and simultaneously launching integrated models for cross-validation, a dual-channel inference mechanism is formed, effectively improving the accuracy of anomaly identification. Attached Figure Description

[0015] Figure 1 This is a flowchart of the hydrological safety protection and early warning method based on AI algorithm according to Embodiment 1 of the present invention; Figure 2 This is an overall architecture diagram of the hydrological safety protection and early warning system based on AI algorithm according to Embodiment 1 of the present invention. Detailed Implementation

[0016] To more clearly illustrate the embodiments of the present invention, specific implementation methods will be described below with reference to the accompanying drawings. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without any creative effort.

[0017] Example 1: like Figure 1 As shown, the hydrological safety protection and early warning method based on AI algorithm in this embodiment includes the following steps: (1) Collect hydrological safety data. Hydrological safety data has a timestamp and a data type label. Among them, hydrological safety data is divided into three types: hydrological network security data, hydrological equipment operation data and hydrological physical environment data. The corresponding three risk categories are network attack, equipment failure or environmental danger. Specifically, this embodiment employs a multi-mode data acquisition strategy, including real-time streaming acquisition, scheduled batch acquisition, and offline import acquisition. Real-time streaming acquisition utilizes components such as the distributed stream processing framework and computing engine Flink, and the distributed event stream platform Kafka to collect real-time network traffic and device operating status. Scheduled batch acquisition involves periodically retrieving historical logs and updating threat intelligence databases. Offline import acquisition includes historical security event datasets and device configuration information. Simultaneously, unified access to data from different sources is achieved through API interfaces, data gateways, and direct sensor connections, enabling comprehensive and real-time acquisition of various raw data in hydrological safety protection scenarios, providing data support for subsequent analysis. This embodiment collects three types of core security data sources in real time, forming hydrological security data: 1. Network security data: such as NetFlow network traffic, IDS alarms, DNS anomalies, and port scan logs; 2. Equipment operation data: including data from IoT / industrial control sensor data security devices such as CPU / memory usage, disk I / O, temperature, voltage, and heartbeat packet loss rate; 3. Physical environment data: such as smoke concentration, temperature and humidity, water immersion height, and metadata of surveillance video streams; All of the above hydrological safety data are timestamped and have source tags, forming a structured event stream for subsequent data processing.

[0018] (2) Data preprocessing is performed on the hydrological safety data of the structured event flow, namely data cleaning, transformation and feature extraction, to obtain the meta-features of the three types of anomaly detection models corresponding to the three risk categories. Specifically, the collected hydrological safety data is cleaned, transformed, and feature extracted to generate high-quality feature data that meets the input requirements of AI models, thereby improving the accuracy and efficiency of model analysis, completing the adaptation and conversion of data formats and dimensions, and extracting core features with distinctive characteristics in combination with the business characteristics of hydrological safety protection scenarios.

[0019] (3) Input the meta-features of the three types of anomaly detection models into the lightweight risk category prediction model, and output the corresponding target risk category; Specifically, by constructing an AI model adapted to hydrological safety protection scenarios, and using preprocessed feature data for training and optimization, the model is equipped with the ability to identify and predict safety risks. Based on the characteristics of different safety risk categories, an appropriate AI algorithm model is selected, and a strategy combining "single model + integrated model" is adopted. The preprocessed model meta-feature data is divided into training set, validation set and test set, and the training set is used to train the model.

[0020] For the initial risk category assessment, this embodiment deploys a lightweight risk category prediction module RTC, which quickly determines the target risk category as network attack, equipment failure, or environmental hazard based on three types of anomaly detection model meta-features (such as data source type, key field distribution, and statistical mutation indicators). The RTC uses a small XGBoost model with an inference latency of <5ms and an accuracy of >90%. This step realizes the pre-decision decision of model routing and provides a basis for subsequent selection of adapted AI models.

[0021] (4) Input the meta-features of the anomaly detection model corresponding to the target risk category into the corresponding dedicated anomaly detection model, and output the first anomaly score; The three types of anomaly detection model meta-features are also input into the integrated model to output a second anomaly score; Specifically, this embodiment employs model routing and parallel inference: a dedicated model and an integrated model work together. Based on the target risk category obtained from the initial risk category judgment, the corresponding dedicated AI model is dynamically activated, while a general integrated model is launched for cross-validation, forming a dual-channel inference mechanism.

[0022] a. If the target risk category is network attack, the corresponding dedicated anomaly detection model is Graph Attention Network (GAT-AD) to identify covert network attack behaviors such as Advanced Persistent Threats (APT), lateral movement, and command and control communications. The corresponding input data example is: constructing a heterogeneous dynamic graph using host logs, user login / permission change records, NetFlow logs, and threat intelligence IOC matching results. , Representative node, Representing the side, Represents time; among them, node types include user, host, and IP, and the corresponding edges represent interaction relationships, such as user and host, host and IP, etc. The model structure of the graph attention network GAT-AD mentioned above includes: a node embedding layer, which uses type-aware embedding for each type of node; a multi-head attention mechanism GAT, which calculates attention weights for neighboring nodes and aggregates contextual information; the specific graph attention network structure can be found in existing technologies and will not be elaborated here; finally, loss iteration is performed by contrastive learning to reconstruct the error, and the first anomaly score is output. A specific example of the anomaly detection logic is as follows: if a host establishes encrypted connections with multiple abnormal IPs within a short period of time, accompanied by unconventional user logins, GAT-AD will assign a high attention weight and output a high-risk score; it also supports path backtracking and provides an explainable attack chain.

[0023] b. If the target risk category is equipment failure, the corresponding dedicated anomaly detection model is the multivariate time series prediction residual model MTS-ResNet, which provides early warning of soft / hard failures of servers, industrial control equipment, etc. caused by aging, overload, or misconfiguration. The corresponding input data examples are multi-dimensional sensor time-series data: CPU utilization, memory usage, temperature, voltage, fan speed, heartbeat interval, etc.; the time window length is usually 5-60 minutes, and the sampling frequency is 1-10 seconds / point; The MTS-ResNet model structure of the above-mentioned multivariate time-series prediction residual model specifically includes an LSTM encoder and its connected original residual network ResNet-style. The LSTM encoder is used to encode the meta-features of the anomaly detection model to output the hidden state sequence at the current time step. Then, the prediction head of the original residual network ResNet-style predicts the predicted value at the next time step. Then, the difference between the actual observation value and the predicted value at the next time step is used as the residual vector. Finally, the weighted Mahalanobis distance is used as the first anomaly score output. Specifically, a long-term dependency is captured by an LSTM encoder, which outputs a sequence of hidden states; a ResNet-style prediction head is used to predict the next time step using residual block stacking. for: = ; in, The actual observed value at the current moment. For multi-layer convolutional or fully connected residual functions, These are the parameters of the residual block; Residual calculation: actual observed values The difference between the original value and the predicted value is the residual vector. ; Finally, the weighted Mahalanobis distance is calculated based on the residual vector as the first anomaly score. The specific formula for calculating the weighted Mahalanobis distance can be found in existing technologies and will not be elaborated here. A specific example of the anomaly detection logic is as follows: if the CPU suddenly increases to 95% and the temperature rises simultaneously, but this combination has not been seen in historical patterns, then the residual is significant, triggering an alert.

[0024] c. If the target risk category is environmental hazard, then the corresponding dedicated anomaly detection model is the Spatiotemporal Convolutional Anomaly Detector ST-CNN, which detects physical environmental risks such as computer rooms and warehouses. Corresponding input data examples include spatial sensor networks: temperature and humidity sensors are arranged in a two-dimensional network according to their physical locations; another example is video metadata: not raw data, but structured features extracted by edge AI, such as heat maps of people density, physical trajectory boxes of movement, and abnormal behavior tags; The aforementioned spatiotemporal convolutional anomaly detector ST-CNN extracts the temporal evolution and spatial distribution features of the anomaly detection model meta-features through a spatiotemporal convolutional encoder. Then, it performs multi-scale feature fusion through a U-Net-style skip connection deep learning model. During training, it minimizes the mean square error (MSE) between the input and the reconstruction output, and during inference, it uses the reconstruction error as the first anomaly score. A specific example of anomaly detection logic is as follows: if a certain area experiences a temperature spike or a rapid change in people's trajectories, then ST-CNN activates the high-response region.

[0025] In addition, for ensemble models, the input is the full set of standardized features, and the structure is a stacked ensemble: ; in, These are the meta-features of the anomaly detection models corresponding to each dedicated anomaly detection model. For learnable fusion weights, b is the bias. For activation function, For transposition, via Output the second anomaly score; These are the basic statistical features of the ensemble model.

[0026] (5) The first abnormal score and the second abnormal score are weighted and fused to obtain a comprehensive abnormal score, and the warning level is determined based on the comprehensive abnormal score.

[0027] Specifically, in this embodiment, the comprehensive anomaly score is generated through dynamic weighted fusion. for: ;

[0028] in, The first abnormal score, The second abnormal score, For target risk category Weighting coefficients; Weighting coefficient Adjustments are made based on risk category, specifically: ; in, For target risk category The sliding window accuracy of the corresponding anomaly detection model, For target risk category The corresponding sliding window accuracy of the ensemble model; the above ensures the weight coefficients Adjustments are made based on risk categories to ensure that higher weights are assigned when dedicated anomaly detection models are reliable, while relying on ensemble models to improve robustness in scenarios with ambiguous boundaries.

[0029] Furthermore, this embodiment, combining the operational needs and risk impact scope of the hydrological safety protection scenario, formulates a multi-dimensional grading standard. Based on the risk grading results, standardized early warning information is generated, including risk level, risk type, occurrence time, impact scope, related data, and preliminary handling suggestions. Based on the comprehensive anomaly score and uncertainty level, a three-level early warning is implemented: like If it is, it is classified as an observation level, and a log is recorded and added to the observation queue; like If so, it is classified as an intervention level and the preset SOAR script is executed; like If the situation is classified as blocking, immediate blocking, alarm notification, and emergency response will be initiated. in, , These are the preset warning thresholds.

[0030] The hydrological safety protection and early warning method based on AI algorithms in this embodiment uses a deployed AI model to perform inference analysis on the real-time access feature data, thereby realizing real-time identification and preliminary judgment of hydrological safety risks. A confidence threshold is set to initially screen the risk results output by the model, eliminating suspected risks with a confidence level below the threshold (reducing false alarms), and retaining high-confidence risk results for subsequent classification and judgment. At the same time, the screened risk results are cached and logged in real time for easy traceability and analysis.

[0031] Based on the above-mentioned hydrological safety protection and early warning method, this embodiment also provides a hydrological safety protection and early warning system based on AI algorithms, such as... Figure 2 As shown, it includes the following functional modules: data acquisition module, data processing module, risk category prediction module, anomaly detection module, weighted fusion module, and early warning classification module; The aforementioned data acquisition module is used to collect hydrological safety data, which includes a timestamp and a data type label. The aforementioned data processing module is used to clean, transform, and extract features from hydrological safety data, thereby obtaining three types of anomaly detection model meta-features corresponding to the three risk categories. The aforementioned risk category prediction module is used to input the meta-features of the three types of anomaly detection models into the lightweight risk category prediction model, and output the corresponding target risk category. The aforementioned anomaly detection module is used to input the meta-features of the anomaly detection model corresponding to the target risk category into the corresponding anomaly detection model and output the first anomaly score; it is also used to input the meta-features of the three types of anomaly detection models into the integrated model and output the second anomaly score. The aforementioned weighted fusion module is used to perform weighted fusion of the first anomaly score and the second anomaly score to obtain a comprehensive anomaly score; The aforementioned early warning classification module is used to classify early warnings based on a comprehensive anomaly score; The specific processing procedures of the above functional modules can be found in the detailed description of the above hydrological safety protection and early warning methods, and will not be repeated here.

[0032] The computer-readable storage medium of this embodiment stores instructions that, when executed on a computer, cause the computer to perform the above-described hydrological safety protection and early warning method, thereby realizing intelligent hydrological safety protection and early warning.

[0033] The above description is merely a detailed explanation of preferred embodiments and principles of the present invention. For those skilled in the art, there may be changes in specific implementation methods based on the ideas provided by the present invention, and these changes should also be considered within the scope of protection of the present invention.

Claims

1. A hydrological safety protection and early warning method based on AI algorithms, characterized in that, Includes the following steps: S1. Collect hydrological safety data. Hydrological safety data has a timestamp and a data type label. Among them, hydrological safety data is divided into three types: hydrological network security data, hydrological equipment operation data, and hydrological physical environment data. The corresponding three risk categories are network attack, equipment failure, or environmental hazard. S2. Perform data cleaning, transformation and feature extraction on hydrological safety data to obtain the meta-features of the three types of anomaly detection models corresponding to the three risk categories; S3. Input the meta-features of the three types of anomaly detection models into the lightweight risk category prediction model, and output the corresponding target risk category. S4. Input the meta-features of the anomaly detection model corresponding to the target risk category into the corresponding anomaly detection model and output the first anomaly score. The three types of anomaly detection model meta-features are also input into the integrated model to output a second anomaly score; S5. The first and second anomaly scores are weighted and fused to obtain a comprehensive anomaly score, and an early warning level is determined based on the comprehensive anomaly score.

2. The hydrological safety protection and early warning method according to claim 1, characterized in that, In step S4, if the target risk category is network attack, the corresponding anomaly detection model is a graph attention network. The loss is iterated by comparing and learning to reconstruct the error, and the first anomaly score is output.

3. The hydrological safety protection and early warning method according to claim 1, characterized in that, In step S4, if the target risk category is equipment failure, the corresponding anomaly detection model includes an LSTM encoder and its connected original residual network ResNet-style. The LSTM encoder is used to encode the meta-features of the anomaly detection model to output the hidden state sequence at the current time. Then, the prediction head of the original residual network ResNet-style predicts the predicted value at the next time. Then, the difference between the actual observation value and the predicted value at the next time is used as the residual vector. Finally, the weighted Mahalanobis distance is used as the first anomaly score output.

4. The hydrological safety protection and early warning method according to claim 3, characterized in that, Using residual block stacking to predict the next time step value for: = ； in, The actual observed value at the current moment. For multi-layer convolutional or fully connected residual functions, These are the parameters for the residual block.

5. The hydrological safety protection and early warning method according to claim 1, characterized in that, In step S4, if the target risk category is environmental hazard, the corresponding anomaly detection model is a spatiotemporal convolutional anomaly detector. The temporal evolution and spatial distribution features of the meta-features of the anomaly detection model are extracted by the spatiotemporal convolutional encoder. Then, multi-scale feature fusion is performed by the U-Net-style skip connection of the deep learning model. During training, the mean square error (MSE) between the input and the reconstruction output is minimized. During inference, the reconstruction error is used as the first anomaly score.

6. The hydrological safety protection and early warning method according to claim 5, characterized in that, The process by which the spatiotemporal convolutional encoder extracts the temporal evolution and spatial distribution features of the meta-features of the anomaly detection model includes: First, features are extracted using 3D convolutional kernels, and then batch normalization and linear unit correction are performed sequentially. The processing yields temporal evolution and spatial distribution characteristics.

7. The hydrological safety protection and early warning method according to any one of claims 1-6, characterized in that, The comprehensive anomaly score for: ； in, The first abnormal score, The second abnormal score, For target risk category Weighting coefficients; Weighting coefficient for: ； in, For target risk category The sliding window accuracy of the corresponding anomaly detection model, For target risk category The sliding window accuracy of the corresponding ensemble model.

8. The hydrological safety protection and early warning method according to claim 7, characterized in that, The warning levels are as follows: like If it is, it is classified as an observation level, and a log is recorded and added to the observation queue; like If so, it is classified as an intervention level and the preset SOAR script is executed; like If the situation is classified as blocking, immediate blocking, alarm notification, and emergency response will be initiated. in, , These are the preset warning thresholds.

9. A hydrological safety protection and early warning system based on AI algorithms, employing the hydrological safety protection and early warning method as described in any one of claims 1-8, characterized in that, The hydrological safety protection and early warning system includes: The data acquisition module is used to collect hydrological safety data. The hydrological safety data has a timestamp and a data type label. Among them, the hydrological safety data is divided into three types: hydrological network security data, hydrological equipment operation data, and hydrological physical environment data. The corresponding three risk categories are network attack, equipment failure, or environmental hazard. The data processing module is used to clean, transform, and extract features from hydrological safety data, and obtain the meta-features of the three anomaly detection models corresponding to the three risk categories. The risk category prediction module is used to input the meta-features of the three types of anomaly detection models into the lightweight risk category prediction model and output the corresponding target risk category. The anomaly detection module is used to input the meta-features of the anomaly detection model corresponding to the target risk category into the corresponding anomaly detection model and output the first anomaly score; it is also used to input the meta-features of the three types of anomaly detection models into the integrated model and output the second anomaly score. The weighted fusion module is used to weight and fuse the first anomaly score and the second anomaly score to obtain a comprehensive anomaly score. The early warning classification module is used to classify early warnings based on the comprehensive anomaly score.

10. A computer-readable storage medium storing instructions therein, characterized in that, When the instructions are executed on the computer, the computer performs the hydrological safety protection and early warning method as described in any one of claims 1-8.

Images