Secondary water supply monitoring system based on dynamic protocol analysis and safety enhancement technology

Abstract

The invention belongs to the technical field of water supply monitoring, and particularly relates to a secondary water supply monitoring system based on a dynamic protocol analysis and security enhancement technology, and the system comprises a security communication gateway which is used for carrying out the protocol analysis and security enhancement of an accessed heterogeneous protocol device, and comprises a flow analysis module, a protocol analysis engine, and a self-adaptive encryption module; the edge computing node is connected with the secure communication gateway and is used for carrying out decryption, feature extraction and abnormal behavior analysis on the received encrypted data; the cloud platform is connected with the edge computing node and is used for receiving the standardized data and executing deep analysis; and the fault diagnosis engine is deployed on the cloud platform. According to the invention, the hierarchical collaborative architecture is constructed, the secure communication gateway is used as a core hub, the multi-source equipment protocol is downwards compatible, a standardized secure interface is upwards provided, and the common problems of protocol islands and encryption missing are fundamentally solved.

Description

A secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology Technical Field

[0001] This invention belongs to the field of water supply monitoring technology, specifically relating to a secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology. Background Technology

[0002] The current technical architecture of secondary water supply monitoring systems is highly dependent on imported industrial control equipment and communication protocols, resulting in significant risks of technological dependence and technical barriers. The closed nature of the underlying firmware and programming software of imported equipment makes it difficult for domestic equipment to achieve seamless replacement. For example, the engineering files generated by software from certain manufacturers can only run on specific hardware platforms and do not provide source code-level compatibility interfaces, forcing system integrators to reconstruct all control logic during localization. At the communication protocol level, although mainstream industrial standards achieve device-level interconnection, their technical barriers and certification mechanisms constitute technical thresholds. This technological dependence is very likely to evolve into a supply chain security crisis under certain circumstances. In the system data transmission process, commonly used communication protocols do not enable transport layer encryption by default. Attackers can easily obtain control commands for the pump room and launch attacks. Sensitive fields such as access control status and meter data transmitted via HTTP are simply encoded (effectively equivalent to plaintext), and key parameters (such as liquid level control thresholds) are not digitally signed. Attackers can control and damage the equipment in the pump room by tampering with information. The lack of encryption at the transport layer leads to the risk of man-in-the-middle attacks, the lack of authentication at the application layer allows unauthorized devices to access the system, and the lack of data integrity verification provides the possibility for replay attacks. The problem of multi-brand device access stems from the closed protocol strategy of manufacturers: different brands use different access protocols, which requires integrators to develop dedicated parsing libraries for each brand. Moreover, protocol incompatibility leads to data silos, heterogeneous protocols require multiple conversions for data fusion, significantly increasing latency. Fragmentation restricts system expansion, and the lagging standardization process exacerbates complexity. Although there are industry standards, most equipment manufacturers refuse to publish complete protocol documents, resulting in the protocol parsing accuracy of domestic gateways being far lower than that of international products.

[0003] Problems with existing technologies: Existing fault diagnosis systems also have many problems: First, threshold alarms are insufficient for detecting complex faults (such as water pump cavitation); second, maintenance decisions rely on engineers' experience; third, the lack of predictive maintenance results in the mean time between failures (MTBF) being lower than the industry benchmark; the barriers of proprietary protocols and the lack of security architecture create a vicious cycle, with vendors building moats with closed protocols and integrators sacrificing security for compatibility, all of which lead to a surge in enterprise maintenance costs and are accompanied by a very high risk of major security incidents. Summary of the Invention

[0004] The purpose of this invention is to provide a secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology. This system can solve the common problems of protocol silos and lack of encryption by constructing a hierarchical collaborative architecture, using a secure communication gateway as the core hub, being backward compatible with multi-source device protocols, and providing standardized security interfaces upward.

[0005] The technical solution adopted by this invention is as follows: A secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology, comprising: a secure communication gateway, used for protocol parsing and security enhancement of connected heterogeneous protocol devices, including a traffic analysis module, a protocol parsing engine, and an adaptive encryption module; an edge computing node, connected to the secure communication gateway, used for decrypting received encrypted data, extracting features, and analyzing abnormal behavior; a cloud platform, connected to the edge computing node, used for receiving standardized data and performing deep analysis; and a fault diagnosis engine, deployed on the cloud platform, used for intelligent diagnosis of device status based on time-frequency domain analysis and deep learning models, generating health indices and maintenance suggestions; wherein, the traffic analysis module of the secure communication gateway captures device data packets and extracts packet header features, data field length distribution features, and verification algorithm type features; the protocol parsing engine generates protocol fingerprints based on the extracted features and matches them with a protocol fingerprint database to identify the device communication protocol type; and the adaptive encryption module dynamically selects encryption strategies based on data sensitivity levels, network environment parameters, and device authentication status.

[0006] According to another aspect of the present invention, the edge computing node includes: a data decryption module for receiving and decrypting encrypted data from a secure communication gateway; a feature extraction module connected to the data decryption module for performing time-frequency domain analysis on the decrypted original device data to extract multi-dimensional feature vectors; a behavior analysis module connected to the feature extraction module for performing real-time behavior analysis based on the extracted feature vectors to detect abnormal behavior; and a control execution module connected to the behavior analysis module for outputting hardware-level control signals and generating audit records when abnormal behavior is detected.

[0007] According to another aspect of the present invention, the adaptive encryption module dynamically selects an encryption strategy based on the following parameters: data sensitivity level, using a high-strength encryption algorithm for highly sensitive data and a lightweight encryption algorithm for moderately sensitive data; network latency parameter, enabling a high-security key exchange algorithm when the network latency is below a preset threshold, and automatically downgrading to a low-latency encryption combination when the network latency exceeds the threshold; and device authentication status, generating digital signatures for key control parameters, with the receiving end verifying the signature validity and timestamp difference to ensure that the data has not been tampered with or replayed.

[0008] According to another aspect of the present invention, the fault diagnosis engine includes: a time-frequency domain analysis module for performing spectral analysis and wavelet decomposition on equipment vibration signals, current waveforms, and temperature field distributions; a deep learning module comprising a CNN-LSTM hybrid network for receiving time-frequency domain features, extracting spatial features through convolutional layers, and capturing temporal features through LSTM layers; and a decision output module for fusing real-time equipment parameters, safety verification results, and intelligent analysis conclusions to generate control commands or maintenance suggestions.

[0009] According to another aspect of the present invention, a data integrity verification mechanism is also included: when the sending end generates a data packet, it appends a local device timestamp, an incrementing sequence number, and the original data hash value; at the receiving end, it performs triple verification: timestamp difference verification, sequence number continuity verification, and hash value matching verification; when any verification fails, the data is determined to be abnormal and the corresponding security mechanism is triggered.

[0010] According to another aspect of the present invention, a secondary water supply monitoring method based on dynamic protocol parsing and security enhancement technology is also provided, comprising the following steps: capturing initial data packets of the device, extracting header features, data field length distribution features, and verification algorithm type features; protocol adaptation, generating a protocol fingerprint based on the extracted features, and matching it with a pre-stored protocol fingerprint database to identify the communication protocol type; parsing the original data of the device based on the identified communication protocol type; dynamically selecting an encryption strategy according to the data sensitivity level, network environment parameters, and device authentication status, and encrypting the parsed data; transmitting the encrypted data to an edge computing node for decryption and feature extraction; performing time-frequency domain analysis on the decrypted data to extract multi-dimensional features of vibration signals, current waveforms, and temperature field distribution; inputting the extracted features into a deep learning model for fault mode recognition, and generating a device health index and maintenance suggestions.

[0011] According to another aspect of the present invention, the dynamically selected encryption strategy includes the following steps: determining the data sensitivity level according to preset rules, using a high-strength encryption algorithm for highly sensitive data and a lightweight encryption algorithm for moderately sensitive data; monitoring network latency parameters, enabling a high-security key exchange algorithm when the network latency is lower than a preset threshold, and automatically downgrading to a low-latency encryption combination when the network latency exceeds the threshold; generating digital signatures for key control parameters, and ensuring that the data has not been tampered with or replayed by verifying the signature validity and timestamp difference.

[0012] According to another aspect of the present invention, the time-frequency domain analysis includes the following steps: preprocessing vibration signals, current waveforms, and temperature field distribution data; performing FFT transformation using the Hanning window function to extract frequency domain features; performing wavelet packet decomposition using Daubechies wavelets, setting the number of decomposition levels, and calculating the wavelet coefficient energy, entropy value, and standard deviation of each sub-frequency band; and fusing the frequency domain features extracted by FFT with the time-frequency domain features of wavelet packet decomposition to form a multi-dimensional feature vector.

[0013] According to another aspect of the present invention, a data integrity verification step is also included: when the sending end generates a data packet, it appends a local device timestamp, an incrementing sequence number, and an original data hash value; at the receiving end, a triple verification is performed: timestamp difference verification, sequence number continuity verification, and hash value matching verification; when any verification fails, the data is determined to be abnormal and a corresponding security mechanism is triggered.

[0014] According to another aspect of the present invention, the deep learning model adopts a CNN-LSTM hybrid network: the CNN module performs local pattern mining on the feature matrix through multi-layer convolutional kernels to extract spatial features; the LSTM module takes the feature sequence output by the CNN as input and captures the trend of feature change over time through a gating mechanism; the decision output adopts a "rule + model" dual-drive mode, generating control instructions based on a preset rule base for known fault modes, and dynamically adjusting the decision strategy through a reinforcement learning model for complex situations.

[0015] According to another aspect of the present invention, an electronic device is also provided, the electronic device including a memory and a processor; the memory is used to store a program; the processor executes the program to implement the method described in any one of the foregoing.

[0016] According to another aspect of the present invention, a computer-readable storage medium is also provided, the storage medium storing a computer program that, when executed by a processor, implements the method described in any one of the preceding embodiments.

[0017] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the method described in any one of the preceding embodiments.

[0018] The technical effects achieved by this invention are as follows: By constructing a collaborative mechanism for protocol parsing and secure encryption, this invention enables access to multiple brands of devices while ensuring data security; the layered architecture of edge computing and cloud analysis takes into account both real-time response and in-depth diagnostic needs; and the close integration of feature extraction and intelligent models improves the accuracy of fault diagnosis.

[0019] This invention establishes a dual protection mechanism covering both the transport layer and the application layer through the TLS protocol in the secure transport layer. This solves the problems of the transport layer encryption mechanism preventing man-in-the-middle attacks, the application layer authentication preventing unauthorized device access, and the data integrity verification mechanism eliminating the risk of replay attacks.

[0020] This invention, through the collaborative work of protocol parsing and security encryption, enables access to multiple brands of devices while ensuring data security; its layered architecture of edge computing and cloud analysis addresses both real-time response and in-depth diagnostic needs; and its close integration of feature extraction and intelligent models improves the accuracy of fault diagnosis.

[0021] This invention not only solves the problems of protocol fragmentation and security risks in secondary water supply systems, but also reduces equipment failure rate and improves overall system reliability through predictive maintenance, enabling proactive preventive operation and maintenance of secondary water supply systems, reducing unplanned downtime, and extending equipment lifespan.

[0022] This invention integrates historical equipment data, operating environment parameters, and a maintenance knowledge base into the maintenance suggestion generation process, providing targeted maintenance guidance for operation and maintenance personnel. By establishing a model feedback optimization mechanism and continuously collecting comparison data between predicted results and actual faults, the model parameters are continuously optimized to improve diagnostic accuracy. Attached Figure Description

[0023] Figure 1 is a schematic diagram of the system structure of the present invention; Figure 2 is a flowchart of the secure transmission layer in the present invention; Figure 3 is a flowchart of the method in the present invention; Figure 4 is a flowchart of the method for dynamically selecting encryption strategies in the present invention; Figure 5 is a flowchart of the method for time-frequency domain analysis in the present invention. Detailed Implementation

[0024] To make the objectives and advantages of this invention clearer, the invention will be specifically described below with reference to embodiments. It should be understood that the following text is merely used to describe one or more specific embodiments of the invention and does not strictly limit the scope of protection specifically claimed by the invention.

[0025] It should be noted that the terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] According to an embodiment of the present invention, a method embodiment of a secondary water supply monitoring method based on dynamic protocol parsing and security enhancement technology is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0027] As shown in Figure 1, a secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology includes: a secure communication gateway for performing protocol parsing and security enhancement on connected heterogeneous protocol devices, including a traffic analysis module, a protocol parsing engine, and an adaptive encryption module; an edge computing node connected to the secure communication gateway for decrypting, extracting features, and analyzing abnormal behavior of received encrypted data; a cloud platform connected to the edge computing node for receiving standardized data and performing deep analysis; and a fault diagnosis engine deployed on the cloud platform for intelligently diagnosing device status based on time-frequency domain analysis and deep learning models, generating health indices and maintenance suggestions. Specifically, the traffic analysis module of the secure communication gateway captures device data packets and extracts header features, data field length distribution features, and verification algorithm type features; the protocol parsing engine generates protocol fingerprints based on the extracted features and matches them with a protocol fingerprint database to identify the device's communication protocol type; and the adaptive encryption module dynamically selects encryption strategies based on data sensitivity levels, network environment parameters, and device authentication status.

[0028] As described above, the secure communication gateway adopts a three-in-one architecture of "parsing-encryption-control". Its hardware components include, but are not limited to, an industrial-grade processor, a high-speed network interface, a secure encryption chip (supporting national cryptographic standards SM4 / AES-256), and protocol expansion slots. The software architecture of the secure communication gateway includes a traffic analysis module, a protocol parsing engine, and an adaptive encryption module. The traffic analysis module captures the initial data packets of the device through network sniffing technology and extracts the packet header features (including fixed structures such as synchronization words and device addresses), data field length distribution features (using a sliding window algorithm to count the length ratio of each field), and verification algorithm type features (identified through CRC multinomial coefficients) in real time. The protocol parsing engine constructs a protocol fingerprint vector based on the above features and performs Euclidean distance matching with a pre-built protocol fingerprint database to improve the recognition accuracy.

[0029] When the matching degree is lower than the threshold, the protocol learning mode is triggered, guiding technicians to upload protocol description files and dynamically expand the fingerprint database.

[0030] The adaptive encryption module dynamically selects encryption strategies based on the data sensitivity level (automatically determined based on preset rules, such as control commands being highly sensitive and status monitoring being medium sensitive), network environment parameters (real-time monitoring of RTT value and packet loss rate), and device authentication status (verifying the validity period of digital certificates and issuing authorities), achieving a balance between security and efficiency.

[0031] Furthermore, the edge computing node adopts a processor architecture and is equipped with a dedicated AI acceleration unit. The edge computing node mainly realizes data decryption, feature extraction and abnormal behavior analysis functions. In the data decryption stage, the node realizes high-speed decryption of the national cryptographic standard SM4 / AES-256 through a hardware acceleration module. The feature extraction module uses a sliding window mechanism to perform time-frequency domain analysis on the decrypted original device data: 1024-point FFT transformation is applied to the vibration signal to extract spectral features, wavelet packet decomposition (3 layers, Daubechies-4 basis functions) is performed on the current waveform to obtain transient features, and spatial gradient calculation is performed on the temperature field data.

[0032] The behavior analysis module performs real-time matching of feature vectors using a preset behavior rule library (including but not limited to traffic mutation thresholds, instruction frequency limits, and abnormal parameter combinations). When an anomaly is detected, a dual-channel response is triggered: on the one hand, a hardware-level shutdown signal is output via GPIO, and on the other hand, a blockchain audit record (including timestamp, device ID, and anomaly type) is generated and stored on the blockchain.

[0033] Furthermore, the cloud platform connects with edge computing nodes, including but not limited to data lake storage clusters, distributed computing engines, and API gateways.

[0034] The cloud platform adopts a microservice architecture, which classifies and stores the received standardized tensor data: time series data is stored in a time series database, image data is stored in a distributed object storage, and structured parameters are stored in a relational database.

[0035] Cloud platforms use technologies such as Kubernetes to dynamically schedule computing resources, employ batch processing for non-real-time analysis tasks (such as monthly energy efficiency reports), and enable stream processing engines for real-time monitoring tasks (such as pressure anomaly warnings).

[0036] The cloud platform's security mechanisms include multi-factor authentication, role-based access control (RBAC), and full recording of operation logs to ensure compliance with Level 3 requirements of the Cybersecurity Classified Protection System 2.0.

[0037] In terms of resource optimization, the cloud platform implements a hot and cold data separation strategy, automatically migrating historically unaccessed data to a low-cost storage layer, thereby reducing storage costs.

[0038] Furthermore, the fault diagnosis engine adopts a hybrid computing architecture, including a time-frequency domain analysis module, a deep learning module, and a decision output module.

[0039] The time-frequency domain analysis module performs parallel processing on the vibration signals, current waveforms, and temperature field distribution data uploaded by the edge nodes: it performs FFT transformation on the vibration signals using a Hanning window (1024 points, 50% overlap) to extract the energy proportion of the low-frequency band (0-1kHz) and the peak frequency of the high-frequency band (1-5kHz); it performs 3-level wavelet packet decomposition on the current waveform using Daubechies-4 wavelets to calculate the wavelet coefficient energy entropy value of each sub-band; and it performs thermodynamic modeling on the temperature field data to identify non-uniform temperature distribution regions.

[0040] The deep learning module employs a CNN-LSTM hybrid network: the CNN part includes multiple convolutional layers (e.g., 3×3 kernels, stride 1) and several max-pooling layers to extract spatial features; the LSTM part includes two LSTM layers (128 hidden units) and one fully connected layer to capture temporal features. During the training phase, the CNN-LSTM hybrid network uses a transfer learning strategy. The initial weights are derived from a pre-trained model on a publicly available water pump dataset, and then fine-tuned using multiple sets of field data to improve the detection rate of complex faults (such as water pump cavitation).

[0041] The decision output module adopts a dual-drive mode of "rules + model". For known fault modes (such as vibration RMS greater than 80% of the threshold), a preset rule is triggered (reducing the frequency by 20%). For unknown modes, the optimal maintenance strategy is generated through reinforcement learning (such as Q-Learning algorithm).

[0042] In summary, once the secure communication gateway identifies the device protocol type, it loads the corresponding feature extraction template and fault diagnosis parameters, reducing manual configuration work. When the edge computing node detects abnormal behavior, it not only triggers local shutdown but also pushes a high-priority analysis task to the fault diagnosis engine, shortening the time for complex fault diagnosis. The adaptive encryption module works in conjunction with network environment parameters to automatically downgrade encryption strength under network latency conditions, ensuring transmission reliability.

[0043] As an optional embodiment, a secure transport layer is also included, located between the secure communication gateway and the edge computing node. It adopts the TLS protocol architecture to establish a secure channel between the transport layer and the application layer, ensuring the confidentiality and integrity of data during transmission.

[0044] Furthermore, the secure transport layer includes transport layer security mechanisms and application layer security mechanisms. The transport layer security mechanism is implemented by the adaptive encryption module in the secure communication gateway, specifically including: dynamically selecting encryption strategies based on data sensitivity levels, network environment parameters, and device authentication status; enabling high-security key exchange algorithms (ECDHE and SHA-384) when network latency is below a preset threshold, and automatically downgrading to low-latency encryption combinations (RSA-2048 and SHA-256) when network latency exceeds the threshold; and employing differentiated encryption algorithms for data with different sensitivities to ensure a balance between transmission efficiency and security.

[0045] The application-layer security mechanism is implemented by a data integrity verification mechanism, including: attaching a device-local timestamp (accurate to milliseconds), an incrementing sequence number, and the original data hash value (SHA-256) when generating data packets at the sending end; performing triple verification at the receiving end: timestamp difference verification, sequence number continuity verification, and hash value matching verification; generating digital signatures (ECDSA algorithm) for key control parameters, and ensuring that the data has not been tampered with or replayed by verifying the validity of the signature and the timestamp difference at the receiving end.

[0046] As an optional embodiment, referring to Figure 2, the workflow of the secure transport layer includes the following steps: S301, Establishing a secure channel: Establishing an encrypted communication channel based on the TLS protocol, and achieving end-to-end encryption through certificate exchange and key negotiation processes; S302, Transport layer encryption: The secure communication gateway applies different strength encryption algorithms to the parsed data according to sensitivity levels, and selects a key exchange mechanism suitable for the current network environment; S303, Application layer signing: Generating digital signatures for key control parameters, and attaching the signature, timestamp, and sequence number as metadata to the data packet; S304, Integrity verification: The receiving end verifies the integrity and freshness of the data packet before decryption.

[0047] Based on the above, the secure transport layer establishes a dual protection mechanism covering both the transport layer and the application layer through the TLS protocol. This solves the problem of the transport layer encryption mechanism preventing man-in-the-middle attacks, the application layer authentication preventing unauthorized device access, and the data integrity verification mechanism eliminating the risk of replay attacks.

[0048] As an optional embodiment, the edge computing node includes: a data decryption module for receiving and decrypting encrypted data from a secure communication gateway; a feature extraction module connected to the data decryption module for performing time-frequency domain analysis on the decrypted original device data to extract multi-dimensional feature vectors; a behavior analysis module connected to the feature extraction module for performing real-time behavior analysis based on the extracted feature vectors to detect abnormal behavior; and a control execution module connected to the behavior analysis module for outputting hardware-level control signals and generating audit logs when abnormal behavior is detected.

[0049] As described above, the data decryption module adopts a hardware-accelerated decryption architecture, including but not limited to the national cryptographic standard SM4 / AES-256 hardware decryption unit, key management module, and data verification unit.

[0050] The data decryption module first verifies the validity of the digital signature in the data packet, and then selects the corresponding decryption algorithm according to the encryption policy identifier (such as SM4-GCM or AES-256-CBC) transmitted by the secure communication gateway. The key management module adopts a hierarchical key structure, including a master key (stored in a secure storage area, 2048-bit RSA), a session key (temporarily generated, 256 bits), and a data key (dynamically derived, 128-256 bits). To cope with network jitter, the decryption module has a built-in data packet reassembly buffer that can cache up to 1024 data packets to ensure data integrity.

[0051] Furthermore, the feature extraction module includes a sampling synchronization unit, a time-frequency analysis unit, and a feature fusion unit.

[0052] The sampling synchronization unit employs the Dynamic Time Warping (DTW) algorithm to address the time difference issue in multi-device sampling. By constructing a time warping path matrix, it aligns asynchronous signals such as pump vibration, current waveforms, and temperature data to a unified time axis. The time-frequency analysis unit adopts differentiated processing strategies for different types of signals: for vibration signals (sampling rate 1kHz), it performs a 1024-point FFT transform and extracts 12 frequency domain features, including the energy proportion of the 0-1kHz low-frequency band and the peak frequency of the 5-10kHz high-frequency band; for current waveforms (12-bit resolution), it uses Daubechies-4 wavelets for 3-level wavelet packet decomposition and calculates the wavelet coefficient energy entropy and standard deviation of each sub-band; for water quality parameters, it performs sliding window statistical analysis to extract the rate of change and periodic fluctuation features; the feature fusion unit standardizes and concatenates the above heterogeneous feature vectors to form a 512-dimensional unified feature vector.

[0053] Furthermore, the behavior analysis module employs a multi-layered anomaly detection mechanism, including but not limited to a statistical threshold layer, a pattern recognition layer, and a correlation analysis layer.

[0054] The statistical threshold layer constructs a dynamic threshold library based on historical data (such as vibration RMS value and current harmonic distortion rate THD). When real-time features exceed the threshold, a primary alarm is triggered. The pattern recognition layer uses a lightweight random forest model to classify feature vectors in real time and identify known abnormal patterns. The correlation analysis layer monitors the correlation of behaviors of multiple devices. For example, when the access control system is abnormally opened and the water pump flow suddenly increases beyond the threshold, it is judged as a potential attack behavior.

[0055] In particular, by integrating an adaptive learning mechanism, new abnormal patterns are continuously discovered through unsupervised clustering (DBSCAN algorithm), and the behavioral baseline is updated once in each cycle.

[0056] Furthermore, the control execution module includes a safety control unit, an audit logging unit, and an emergency communication unit. The safety control unit implements hardware-level response through the GPIO interface and presets multi-level control strategies: Level 1 anomalies (such as parameter over-limit) trigger software alarms; Level 2 anomalies (such as data tampering) activate PLC control command current limiting; Level 3 anomalies (such as unauthorized device access) directly output hardware shutdown signals to relays to cut off the device power supply; The audit logging unit uses blockchain technology to build an immutable log, generating hash values ​​for abnormal events (including timestamps, device IDs, anomaly types, and handling measures) and writing them to the local consortium blockchain to ensure the traceability of audit data; The emergency communication unit activates backup communication channels (such as 4G / 5G) when the main channel is interrupted, prioritizing the transmission of critical alarm information to the maintenance terminal.

[0057] In summary, the zero-copy data channel design between the data decryption module and the feature extraction module reduces memory copying overhead and lowers end-to-end processing latency. When the behavior analysis module detects an anomaly, it not only triggers local control execution but also pushes high-priority analysis tasks to the cloud platform, shortening the time for diagnosing complex faults. In addition, the local decision-making capabilities of edge computing nodes significantly reduce dependence on the cloud, improving overall reliability and economic efficiency in the event of network fluctuations or interruptions.

[0058] As an optional embodiment, the adaptive encryption module dynamically selects the encryption strategy based on the following parameters: data sensitivity level, using a high-strength encryption algorithm for highly sensitive data and a lightweight encryption algorithm for moderately sensitive data; network latency parameter, enabling a high-security key exchange algorithm when the network latency is below a preset threshold, and automatically downgrading to a low-latency encryption combination when the network latency exceeds the threshold; and device authentication status, generating digital signatures for key control parameters, with the receiving end verifying the signature validity and timestamp difference to ensure that the data has not been tampered with or replayed.

[0059] Based on the above, the encryption strategy is dynamically optimized through the collaborative work of the sensitivity assessment unit, network status monitoring unit, and authentication verification unit. Specifically, the sensitivity identification unit obtains data type identifiers from the protocol parsing engine and classifies the data into sensitivity levels according to preset rules. Control parameters that directly affect system security, such as pump start / stop commands and liquid level control thresholds, are defined as high-sensitivity data; operating status monitoring data, such as water pressure and flow rate, are defined as medium-sensitivity data; and auxiliary parameters, such as ambient temperature and equipment operating time, are defined as low-sensitivity data. The encryption processing unit dynamically selects encryption algorithms based on the sensitivity level: for high-sensitivity data, the national standard SM4 or AES-256-GCM high-strength encryption algorithm is used; for medium-sensitivity data, the AES-128-CBC mode is used as a compromise between security and efficiency; and for low-sensitivity data, a lightweight encryption algorithm with lower computational overhead is used.

[0060] Furthermore, the network status monitoring unit collects the round-trip time (RTT) and packet loss rate parameters of network transmission in real time. When the network status is good (RTT value is lower than the preset threshold and packet loss rate is low), the key exchange unit uses the secure combination of ECDHE key exchange algorithm and SHA-384 hash function. When the network status deteriorates (RTT value exceeds the threshold or packet loss rate increases), it automatically switches to the RSA and SHA-256 combination with lower computational complexity to avoid data transmission blockage caused by encryption calculation. The adaptive mechanism ensures reliable data transmission under various network conditions.

[0061] Furthermore, the device authentication and verification unit verifies the identity of the communication device and implements digital signature protection for key control parameters (such as liquid level threshold, pump speed setpoint, and valve switching commands). The digital signature unit generates a signature using the ECDSA algorithm and binds a timestamp during the signing process. The receiving end verification unit performs dual verification: first, it verifies the mathematical validity of the digital signature, and second, it verifies whether the timestamp difference is within the allowable range. When an invalid signature or timestamp exceeds the limit, a security protection mechanism is triggered to block the execution path of abnormal commands.

[0062] Furthermore, the adaptive encryption module works in conjunction with the data integrity verification mechanism to form a complete security protection system. During the data encapsulation stage, encrypted data is combined and encapsulated with integrity verification metadata (including device local timestamp, incrementing sequence number, and data hash value). At the receiving end, integrity verification is performed first to confirm that the data has not been tampered with before decryption. This effectively prevents man-in-the-middle attacks and replay attacks, enhancing overall security. The adaptive encryption mechanism can automatically adjust security policies according to the actual operating environment without manual intervention, reducing the complexity of system maintenance and ensuring the safe and reliable operation of the secondary water supply monitoring system under various network conditions.

[0063] As an optional embodiment, the fault diagnosis engine includes a time-frequency domain analysis module, a deep learning module, and a decision output module.

[0064] The time-frequency domain analysis module is used to perform spectral analysis and wavelet decomposition on equipment vibration signals, current waveforms, and temperature field distributions. First, the original signals are preprocessed, including filtering and noise reduction, and amplitude normalization. For vibration signals, the Hanning window function is used for FFT transformation to extract frequency domain features, including the dominant frequency component, harmonic distribution, and energy proportion of specific frequency bands. For current waveforms, Daubechies wavelet decomposition is used to decompose the signal into multiple sub-frequency bands, and the energy entropy and coefficient standard deviation of each sub-frequency band are calculated. For temperature field distribution data, spatial gradient features and thermodynamic distribution patterns are extracted. The time-frequency domain analysis module fuses features obtained from different analysis methods to form a comprehensive feature vector, providing high-quality input data for subsequent deep learning analysis. Joint time-frequency domain analysis can effectively capture subtle changes in equipment operating status, and it has significant advantages, especially in the early feature extraction of complex faults such as water pump cavitation.

[0065] The deep learning module comprises a CNN-LSTM hybrid network to receive time-frequency domain features, extract spatial features through convolutional layers, and capture temporal features through LSTM layers. The deep learning module first constructs a two-dimensional feature matrix from the feature vectors output by the time-frequency domain analysis module and inputs it into the CNN part. The CNN part contains multiple convolutional and pooling layers, which scan the feature matrix with convolutional kernels of different scales to extract local spatial patterns and associated features. Subsequently, the high-order feature sequence output by the CNN is fed into the LSTM layer. The LSTM, through its unique gating mechanism, effectively captures the long-term dependencies of equipment state evolution over time and identifies potential fault development trajectories. This hybrid network structure preserves both the spatial features of the signal and takes into account the dynamic changes in the temporal dimension, enabling the classification and prediction of various fault modes, outputting equipment health indices and fault probability distributions, and providing data support for decision-making.

[0066] The decision output module integrates real-time equipment parameters, safety verification results, and intelligent analysis conclusions to generate control commands or maintenance suggestions. It employs a multi-source data fusion architecture, integrating three types of key information: equipment physical parameters (such as vibration amplitude, current harmonic distortion rate, and temperature distribution), safety verification status (data integrity verification results and equipment authentication status), and analysis conclusions from the deep learning module (health index and failure probability). In terms of decision logic, it adopts a dual-drive mechanism of "rules + models": for clear failure modes (such as bearing wear and motor overload), it directly generates corresponding control strategies based on a pre-set expert rule base; for complex or compound failure scenarios, it combines reinforcement learning algorithms, considering multiple factors such as remaining equipment lifespan, availability of maintenance resources, and the impact on water supply, to generate the optimal maintenance plan. All output commands must pass a safety verification process to confirm permissions and integrity before execution. The decision output module can not only generate immediate control commands (such as adjusting pump speed and switching to backup equipment) but also provide detailed maintenance suggestions (such as checking specific components and predicting replacement cycles), enabling fault detection and handling.

[0067] As an optional embodiment, the secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology also includes a data integrity verification mechanism. The data integrity verification mechanism adopts an end-to-end verification architecture, which ensures the authenticity and integrity of data during transmission through multi-dimensional parameter linkage. The data integrity verification mechanism includes two parts: a data encapsulation unit and a verification processing unit, which are deployed at the data sending end and the receiving end, respectively. When generating data packets at the sending end, a local device timestamp, an incrementing sequence number, and the original data hash value are appended. At the receiving end, triple verification is performed: timestamp difference verification, sequence number continuity verification, and hash value matching verification. When any verification fails, the data is determined to be abnormal and the corresponding security mechanism is triggered.

[0068] At the sending end, the data encapsulation unit is responsible for attaching integrity verification metadata when generating data packets. First, it collects the device's local timestamp with millisecond-level precision to ensure accurate time stamping. Then, it generates an incrementing sequence number using a monotonically increasing mechanism, automatically incrementing by one with each data packet generation to form a continuous data stream identifier. Finally, it calculates a hash value for the original data content using a hash algorithm (such as SHA-256) to generate a data fingerprint. These three metadata items (timestamp, sequence number, and hash value) are encapsulated together with the encrypted original data according to a predefined data structure to form a complete data packet. The encapsulation process is integrated with an adaptive encryption module to ensure that the verification metadata itself is also encrypted and protected against malicious tampering.

[0069] At the receiving end, the verification processing unit executes a triple verification process. First, it performs a timestamp difference check, comparing the timestamp of the received data packet with the current system time. If the time difference exceeds a preset dynamic threshold (which can be automatically adjusted according to the network environment), the data packet is determined to be a possible replay attack and is discarded. Second, it performs a sequence number continuity check. The verification processing unit maintains a sequence number state database, recording historically received sequence numbers. When a discontinuous sequence number is found (such as skipping or repeating), it is considered an abnormal transmission behavior, triggering an early warning mechanism. Finally, it performs a hash value matching check, recalculating the hash value of the received original data and comparing it with the hash value carried in the data packet. If the two do not match, it is determined that the data has been tampered with during transmission, and the data packet is rejected.

[0070] When any verification fails, the data is deemed abnormal and a tiered security mechanism is triggered. Depending on the type and severity of the abnormality, the security mechanism includes, but is not limited to: recording the abnormal event to the audit log, sending a security alarm to the operation and maintenance terminal, temporarily restricting the data transmission permissions of the relevant devices, or, in severe cases, cutting off the communication link of the abnormal device. All security event records include key information such as timestamps, abnormality type, and identification of the devices involved, providing a basis for subsequent security analysis. The data integrity verification mechanism and the adaptive encryption module work together to form a security protection system covering the entire data transmission link, effectively preventing security threats such as man-in-the-middle attacks, replay attacks, and data tampering, and ensuring the reliability and security of control commands and monitoring data of the secondary water supply system.

[0071] As an optional embodiment, referring to FIG3, a secondary water supply monitoring method based on dynamic protocol parsing and security enhancement technology includes the following steps: S1, capturing the initial data packet of the device and extracting the header features, data field length distribution features, and verification algorithm type features; S2, protocol adaptation, generating a protocol fingerprint based on the extracted features, and matching it with a pre-stored protocol fingerprint database to identify the communication protocol type; S3, parsing the original data of the device based on the identified communication protocol type; S4, dynamically selecting an encryption strategy based on the data sensitivity level, network environment parameters, and device authentication status, and encrypting the parsed data; S5, transmitting the encrypted data to an edge computing node for decryption and feature extraction; S6, performing time-frequency domain analysis on the decrypted data to extract multi-dimensional features of vibration signals, current waveforms, and temperature field distribution; S7, inputting the extracted features into a deep learning model for fault mode recognition, generating a device health index and maintenance suggestions.

[0072] In step S1, the initial data packets of the device are captured by the traffic analysis module. A passive listening mode is adopted to avoid interference with the original communication. The header feature extraction includes fixed structure parameters such as synchronization word recognition and source / target device address resolution. The data field length distribution feature is statistically analyzed by the sliding window algorithm to determine the length ratio of each field. The verification algorithm type feature is identified by analyzing the mathematical correlation between the verification area value and the data content to identify verification mechanisms such as CRC16, CRC32 or LRC. The multi-dimensional feature extraction method ensures that the key identification information of the protocol can be accurately captured even when the protocol document is incomplete.

[0073] In step S2, the multidimensional features extracted in step S1 are vectorized to generate a protocol fingerprint vector, which includes structured feature weight allocation. During the matching process, the Euclidean distance or cosine similarity algorithm is used to compare the real-time generated fingerprint with the pre-stored fingerprint database. When the matching degree exceeds a set threshold, the protocol type is confirmed. If the matching degree is insufficient, the system starts the protocol learning mode, guiding technicians to upload an XML format protocol description file to expand the coverage of the fingerprint database. This overcomes the limitations of fixed protocol parsing, enabling the system to adapt to the private protocols of different vendors. The protocol adaptation process realizes the dynamic generation and matching of protocol fingerprints.

[0074] In step S3, based on the identified protocol type, the corresponding protocol parsing plugin is loaded. The protocol parsing plugin includes data field mapping rules, byte order conversion logic, and semantic interpretation rules. The parsing process not only extracts the original values ​​but also includes data semantic conversion, such as converting hexadecimal status codes into readable device status descriptions. This process unifies the data models of different physical devices, provides a consistent data interface for upper-layer applications, and solves the compatibility problem of heterogeneous device access.

[0075] In step S4, the dynamic selection of the encryption strategy is based on a comprehensive evaluation across three dimensions. The data sensitivity level assessment is graded according to the data type and purpose; for example, control commands are classified as high-sensitivity and status monitoring data as medium-sensitivity. Network environment parameters, including real-time measured round-trip latency and packet loss rate, are used to balance security strength and transmission efficiency. Device authentication status is determined by verifying the integrity and validity of digital certificates. Based on these parameters, the encryption engine selects the optimal combination from a preset encryption strategy matrix. For example, when dealing with highly sensitive data and good network conditions, a combination of high-strength encryption algorithms and secure key exchange mechanisms is selected. When network conditions are poor, the encryption complexity is appropriately reduced to ensure transmission reliability. This adaptive mechanism can improve the stability and security of the system in complex network environments.

[0076] In step S5, encrypted data transmission uses secure channel technology. After receiving the data, the edge computing node first performs integrity verification and then decryption. The feature extraction process adopts a differentiated processing strategy according to the data type: for vibration signals, time-domain statistical feature extraction is performed; for electrical parameters, their harmonic components and changing trends are analyzed; for switch state quantities, the state transition time and frequency are recorded. The local processing capability of the edge node can respond to emergency events in a timely manner without relying on the cloud, reducing the delay of critical control.

[0077] In step S6, the time-frequency domain analysis adopts a multi-scale signal processing approach: for vibration signals, Fourier transform is performed to extract frequency domain features; for current waveforms, wavelet packet decomposition is used to capture transient features; for temperature field distribution, spatial gradient calculation and thermodynamic feature extraction are performed; heterogeneous features are normalized and fused to form a unified feature vector; by preserving the spatiotemporal characteristics of the original signal, high-discrimination feature input is provided for fault mode recognition.

[0078] In step S7, the deep learning model adopts a hybrid neural network architecture, combining the spatial feature extraction capability of convolutional neural networks and the time series modeling capability of long short-term memory networks; the deep learning model receives the multidimensional features extracted in step S6 and outputs the equipment health index and fault probability distribution; the maintenance suggestion generation process integrates historical equipment data, operating environment parameters, and maintenance knowledge base to provide targeted maintenance guidance for operation and maintenance personnel; by establishing a model feedback optimization mechanism and continuously collecting comparison data between prediction results and actual faults, the model parameters are continuously optimized to improve diagnostic accuracy.

[0079] Based on the above steps, the collaborative work of protocol parsing and security encryption can enable access to multiple brands of devices while ensuring data security; the layered architecture of edge computing and cloud analysis takes into account both real-time response and in-depth diagnostic needs; and the close integration of feature extraction and intelligent models improves the accuracy of fault diagnosis.

[0080] Furthermore, it not only solves the problems of protocol fragmentation and security risks in secondary water supply systems, but also reduces equipment failure rates and improves the overall reliability of the system through predictive maintenance, realizing proactive preventive operation and maintenance of secondary water supply systems, reducing unplanned downtime, and extending equipment lifespan.

[0081] As an optional embodiment, referring to Figure 4, the dynamically selected encryption strategy includes the following steps: S101, determining the data sensitivity level according to preset rules, using a high-strength encryption algorithm for highly sensitive data, and a lightweight encryption algorithm for medium-sensitive data; S102, monitoring network latency parameters, enabling a high-security key exchange algorithm when the network latency is lower than a preset threshold, and automatically downgrading to a low-latency encryption combination when the network latency exceeds the threshold; S103, generating digital signatures for key control parameters, and ensuring that the data has not been tampered with or replayed by verifying the signature validity and timestamp difference.

[0082] In step S101, the sensitivity assessment unit determines the sensitivity of the data and works in conjunction with the protocol parsing engine to obtain the semantic information of the data and classify it according to preset rules. The classification rules consider the functional attributes and security impact of the data. For example, parameters that directly control the operating status of water supply equipment (such as pump start / stop commands and valve switch control) are classified as highly sensitive data; monitoring parameters that reflect the operating status of equipment (such as flow rate and pressure values) are classified as moderately sensitive data; and parameters that are only used for environmental recording (such as ambient temperature and humidity) are considered low-sensitivity data. The encryption engine selects the appropriate encryption algorithm according to the classification results to ensure that the security measures match the importance of the data.

[0083] In step S102, the network status monitoring unit collects network transmission parameters in real time, including data packet round-trip time and transmission stability indicators; the key exchange unit dynamically adjusts the key exchange mechanism based on these parameters: when the network conditions are good, a key exchange algorithm that provides forward security is adopted; when the network conditions are poor, an alternative scheme with lower computational overhead is switched to ensure the reliability and security of data transmission in various network environments.

[0084] In step S103, a digital signature mechanism is implemented for key control parameters; the signing process binds the data content with the device's local timestamp to form a unique identifier; the receiving end verifies the validity of the signature and the rationality of the timestamp to ensure the integrity and timeliness of the data; in addition, a sequence number continuity check mechanism is implemented to verify the order of data packets to prevent data packets from being lost, duplicated, or maliciously replayed.

[0085] Based on the above steps, an adaptive mechanism is used to address the limitations of fixed encryption strategies in complex industrial environments. This not only ensures the security of critical data but also adapts to resource-constrained edge devices and unstable network environments, providing technical support for the safe and reliable operation of secondary water supply systems.

[0086] As an optional embodiment, referring to Figure 5, the time-frequency domain analysis includes the following steps: S201, preprocessing the vibration signal, current waveform, and temperature field distribution data; S202, performing FFT transformation using the Hanning window function to extract frequency domain features; S203, performing wavelet packet decomposition using the Daubechies wavelet, setting the number of decomposition levels, and calculating the wavelet coefficient energy, entropy value, and standard deviation of each sub-frequency band; S204, fusing the frequency domain features extracted by FFT with the time-frequency domain features of wavelet packet decomposition to form a multi-dimensional feature vector.

[0087] In step S201, during the time-frequency domain analysis, the original sensor data is first preprocessed. The preprocessing steps include, but are not limited to, signal noise reduction, amplitude normalization, and outlier removal. For vibration signals, the original waveforms acquired by the accelerometer are low-pass filtered to remove high-frequency interference. For current waveforms, the moving average algorithm is used to smooth the data and eliminate random noise. For temperature field distribution data, spatial smoothing is performed to eliminate local outliers.

[0088] In step S202, during the frequency domain feature extraction step, the preprocessed signal is windowed using the Hanning window function, followed by a Fast Fourier Transform (FFT). The time-domain signal is converted into a frequency-domain representation, and frequency domain features, including the dominant frequency component, harmonic distribution, and energy proportion of specific frequency bands, are extracted. For example, for pump vibration signals, the system pays special attention to the energy distribution characteristics in the 0-1kHz low-frequency band, which is closely related to the natural frequency of the pump's mechanical structure. For current waveforms, analyzing the harmonic distortion of specific frequency bands can reflect the motor winding state and load characteristics.

[0089] In step S203, the number of wavelet packet decomposition layers is dynamically configured according to signal characteristics and computational resource requirements, usually set to 2-4 layers to balance feature resolution and computational complexity. After decomposition, statistical characteristics such as wavelet coefficient energy, entropy value, and standard deviation of each sub-band are calculated. This can capture transient changes and local characteristics of the signal. For example, water pump bearing failure usually manifests as a sudden change in energy in a specific frequency band, while motor winding problems will show an abnormal increase in wavelet coefficient entropy value within a specific time period.

[0090] In step S204, feature fusion adopts a weighted combination strategy, allocating weights according to the contribution of different features to fault diagnosis; the fused feature vector contains both the global frequency domain characteristics of the signal and retains the details of local time-frequency changes, providing input information for subsequent deep learning models; the time-frequency domain analysis method is suitable for capturing the early features of complex faults such as pump cavitation and bearing wear in secondary water supply systems, improving the accuracy and timeliness of fault diagnosis.

[0091] As an optional implementation, the deep learning model adopts a CNN-LSTM hybrid network: the CNN module performs local pattern mining on the feature matrix through multi-layer convolutional kernels to extract spatial features; the LSTM module takes the feature sequence output by the CNN as input and captures the trend of feature changes over time through a gating mechanism; the decision output adopts a "rule + model" dual-drive mode, generating control instructions based on a preset rule base for known fault modes, and dynamically adjusting the decision strategy through a reinforcement learning model for complex situations.

[0092] Based on the above, in the deep learning module, the CNN-LSTM hybrid network architecture fully leverages the spatial feature extraction advantages of convolutional neural networks and the temporal modeling capabilities of long short-term memory networks. The multidimensional feature vectors output by the time-frequency domain analysis module are normalized to construct a feature matrix suitable for network input. The CNN module contains multiple convolutional and pooling layers, which scan the feature matrix using convolutional kernels of different scales to effectively extract local feature patterns, such as high-frequency noise distribution patterns and energy mutation features. The pooling layers perform dimensionality reduction on the convolutional features, retaining key information while reducing computational complexity. The high-order feature sequences processed by the CNN are fed into the LSTM module. LSTM uses its unique gating mechanism (including input gate, forget gate, and output gate) to selectively memorize and forget the sequence data, thereby capturing the long-term dependencies of device state evolution over time and effectively identifying potential trends in fault development.

[0093] In the decision-making output stage, a dual-drive decision-making mechanism of "rules + models" is adopted. For clear fault modes (such as bearing wear, motor overload, etc.), corresponding control strategies are directly generated based on a preset expert rule base. The expert rule base includes, but is not limited to, fault feature-response measure mapping tables, priority judgment conditions, and safety constraint parameters. For complex or compound fault scenarios, a reinforcement learning model is invoked for dynamic decision-making. By analyzing the equipment health status, operating parameter change trends, and historical maintenance records, the optimal maintenance plan is generated. All output decisions must undergo a safety verification process to confirm the operation permissions and instruction integrity before execution. This dual-drive mechanism ensures both rapid response to known faults and adaptability to handle unknown and complex scenarios, significantly improving the reliability and intelligence level of the secondary water supply system.

[0094] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0095] According to another aspect of the present invention, an electronic device is also provided, the electronic device including a memory and a processor; the memory is used to store a program; the processor executes the program to implement the method of any of the foregoing.

[0096] According to another aspect of the present invention, a computer-readable storage medium is also provided, the storage medium storing a computer program that, when executed by a processor, implements the method of any of the foregoing.

[0097] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the method described in any of the foregoing.

[0098] The above description is merely a preferred embodiment of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention. Structures, devices, and operating methods not specifically described or explained in this invention are implemented according to conventional methods in the art unless otherwise specified or limited.

Claims

1. A secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology, characterized in that, include: A secure communication gateway is used to perform protocol parsing and security enhancement on accessed heterogeneous protocol devices, including a traffic analysis module, a protocol parsing engine, and an adaptive encryption module; Edge computing nodes, connected to the secure communication gateway, are used to decrypt, extract features, and analyze abnormal behavior of received encrypted data. A cloud platform, connected to the edge computing nodes, is used to receive standardized data and perform deep analysis. A fault diagnosis engine, deployed on the cloud platform, is used to intelligently diagnose device status based on time-frequency domain analysis and deep learning models, generating health indices and maintenance suggestions. The traffic analysis module of the secure communication gateway captures device data packets and extracts header features, data field length distribution features, and verification algorithm type features. The protocol parsing engine generates protocol fingerprints based on the extracted features and matches them with a protocol fingerprint database to identify the device's communication protocol type. The adaptive encryption module dynamically selects encryption strategies based on data sensitivity levels, network environment parameters, and device authentication status.

2. The secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology according to claim 1, characterized in that, The edge computing node includes: a data decryption module for receiving and decrypting encrypted data from a secure communication gateway; a feature extraction module connected to the data decryption module for performing time-frequency domain analysis on the decrypted original device data to extract multi-dimensional feature vectors; a behavior analysis module connected to the feature extraction module for performing real-time behavior analysis based on the extracted feature vectors to detect abnormal behavior; and a control execution module connected to the behavior analysis module for outputting hardware-level control signals and generating audit logs when abnormal behavior is detected.

3. The secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology according to claim 1, characterized in that, The adaptive encryption module dynamically selects the encryption strategy based on the following parameters: data sensitivity level (using a high-strength encryption algorithm for highly sensitive data and a lightweight encryption algorithm for moderately sensitive data); network latency parameter (activating a high-security key exchange algorithm when the network latency is below a preset threshold and automatically downgrading to a low-latency encryption combination when the network latency exceeds the threshold); and device authentication status (generating digital signatures for key control parameters, and the receiving end verifying the signature validity and timestamp difference to ensure that the data has not been tampered with or replayed).

4. A secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology according to claim 1, characterized in that: The fault diagnosis engine includes: a time-frequency domain analysis module for performing spectral analysis and wavelet decomposition on equipment vibration signals, current waveforms, and temperature field distribution; a deep learning module containing a CNN-LSTM hybrid network for receiving time-frequency domain features, extracting spatial features through convolutional layers, and capturing temporal features through LSTM layers; and a decision output module for fusing real-time equipment parameters, safety verification results, and intelligent analysis conclusions to generate control commands or maintenance suggestions.

5. A secondary water supply monitoring system based on dynamic protocol parsing and security enhancement technology according to claim 1, characterized in that, It also includes a data integrity verification mechanism: when the sending end generates a data packet, it appends a local device timestamp, an incrementing sequence number, and the original data hash value; at the receiving end, it performs triple verification: timestamp difference verification, sequence number continuity verification, and hash value matching verification; when any verification fails, the data is determined to be abnormal and the corresponding security mechanism is triggered.

6. A secondary water supply monitoring method based on dynamic protocol parsing and security enhancement technology, using the system as described in any one of claims 1 to 5, characterized in that, Includes the following steps: The system captures initial data packets from the device, extracting header features, data field length distribution features, and verification algorithm type features. For protocol adaptation, it generates a protocol fingerprint based on the extracted features and matches it against a pre-stored protocol fingerprint database to identify the communication protocol type. Based on the identified communication protocol type, it parses the device's original data. It dynamically selects an encryption strategy based on data sensitivity level, network environment parameters, and device authentication status to encrypt the parsed data. The encrypted data is then transmitted to an edge computing node for decryption and feature extraction. Time-frequency domain analysis is performed on the decrypted data to extract multi-dimensional features of vibration signals, current waveforms, and temperature field distribution. The extracted features are then input into a deep learning model for fault mode identification, generating a device health index and maintenance recommendations.

7. A secondary water supply monitoring method based on dynamic protocol parsing and security enhancement technology according to claim 6, characterized in that: The dynamically selected encryption strategy includes the following steps: determining the data sensitivity level according to preset rules, using a high-strength encryption algorithm for highly sensitive data and a lightweight encryption algorithm for medium-sensitive data; monitoring network latency parameters, enabling a high-security key exchange algorithm when the network latency is below a preset threshold, and automatically downgrading to a low-latency encryption combination when the network latency exceeds the threshold; generating digital signatures for key control parameters, and ensuring that the data has not been tampered with or replayed by verifying the signature validity and timestamp difference at the receiving end.

8. A secondary water supply monitoring method based on dynamic protocol parsing and security enhancement technology according to claim 6, characterized in that, The time-frequency domain analysis includes the following steps: preprocessing the vibration signal, current waveform, and temperature field distribution data; performing FFT transformation using the Hanning window function to extract frequency domain features; The Daubechies wavelet is used for wavelet packet decomposition. The number of decomposition levels is set, and the wavelet coefficient energy, entropy value and standard deviation of each sub-band are calculated. The frequency domain features extracted by FFT are fused with the time-frequency domain features of wavelet packet decomposition to form a multi-dimensional feature vector.

9. A secondary water supply monitoring method based on dynamic protocol parsing and security enhancement technology according to claim 6, characterized in that: It also includes a data integrity verification step: when the sending end generates a data packet, it appends a local device timestamp, an incrementing sequence number, and the original data hash value; Triple verification is performed at the receiving end: timestamp difference verification, sequence number continuity verification, and hash value matching verification; if any verification fails, the data is determined to be abnormal and the corresponding security mechanism is triggered.

10. A secondary water supply monitoring method based on dynamic protocol parsing and security enhancement technology according to claim 6, characterized in that, The deep learning model adopts a CNN-LSTM hybrid network: the CNN module performs local pattern mining on the feature matrix through multi-layer convolutional kernels to extract spatial features; the LSTM module takes the feature sequence output by the CNN as input and captures the trend of feature changes over time through a gating mechanism; the decision output adopts a "rule + model" dual-drive mode, generating control instructions based on a preset rule base for known fault modes, and dynamically adjusting the decision strategy through a reinforcement learning model for complex situations.

Images