Safety monitoring data abnormal value identification method based on sliding window and morphological logic

Abstract

The invention relates to the technical field of water conservancy and hydropower engineering safety monitoring, and discloses a safety monitoring data abnormal value identification method based on a sliding window and morphological logic, and the method comprises the steps: processing an original data sequence through a window sliding at a fixed odd length, calculating a median and a median absolute deviation, and estimating a standard deviation; generating a dynamic upper and lower threshold sequence; comparing with a dead zone tolerance threshold value, converting into a logic vector, identifying a connected region with continuous truth values, and secondarily marking all data points in the region with the length exceeding the maximum allowable value as abnormal to obtain an abnormal value logic sequence; and performing linear interpolation processing on the data points marked as abnormal values in the abnormal value logic sequence to obtain a cleaned data sequence without abnormal values. According to the method, more than 95% of invalid data can be efficiently eliminated while the integrity of real signals is reserved, a high-reliability data basis is provided for data analysis and structural safety evaluation, and the method has important engineering application value.

Description

Technical Field

[0001] This invention relates to the field of safety monitoring technology for water conservancy and hydropower projects, and in particular to a method for identifying outliers in safety monitoring data based on sliding windows and morphological logic. Background Technology

[0002] The safety monitoring system for water conservancy and hydropower projects is a complex multi-sensor integrated system, encompassing various monitoring items such as seepage, deformation, stress, and strain. The resulting data is characterized by its multi-source nature, large magnitude differences, and complex variation patterns. Different sensors (such as piezometers and inclinometers) output physical quantities and have different sampling frequencies, and their data sequences typically exhibit complex characteristics of coupled trends, periodicity, and randomness. Meanwhile, outliers commonly found in the monitoring data can be mainly categorized into three types: first, instantaneous spikes and abrupt changes caused by electromagnetic interference or momentary interruptions in data acquisition; second, trend deviations caused by changes in structural state or instrument reference drift; and third, constant output due to complete instrument failure. These anomalies severely interfere with the analysis and assessment of the true state of the structure.

[0003] Faced with such complex data, traditional outlier detection methods, such as the 3σ criterion based on global statistics, prove inadequate. The fundamental reason is that traditional methods assume the data follows a stationary distribution and has a single scale parameter, which contradicts the non-stationary and multi-scale characteristics of actual monitoring data. Global thresholds cannot adapt to the dynamic changes in local trends and fluctuations in the data, easily leading to misjudgments—identifying normal changes as anomalies, missing detections, or failing to identify genuine anomalies—thus reducing the reliability of monitoring analysis and the effectiveness of early warning. Therefore, developing a general outlier removal algorithm that can adapt to local data characteristics and possesses both high accuracy and strong robustness has become a key technical requirement for improving the safety monitoring level of water conservancy and hydropower projects.

[0004] Prior art 1, application number: 202510438692.6, discloses an analytical method and its application for quantitatively evaluating the degree of leakage defects using the flow mean difference method, belonging to the field of safety monitoring technology for water conservancy and hydropower projects. This method uses the flow mean difference method, based on the flow data of the downstream weirs in each reservoir section, and uses the difference between the mean of the flow increment and the mean of the head increment, or the difference between the flow increment and the mean of the square root of the head increment, in adjacent reservoir sections as the flow mean difference index for defect analysis and evaluation in each section. While determining the area where leakage defects occur and evaluating their degree can guide subsequent defect investigation and elimination work, using the flow mean difference as the sole evaluation index makes it difficult to consider both instantaneous fluctuations and overall trends in the data, and is prone to misjudgment in noisy environments.

[0005] Prior art 2, application number: 202510849220.X, discloses a stress adjustment method, system, and electronic equipment for a steel branch pipe structure, relating to the technical field of pipeline safety monitoring in water conservancy and hydropower projects. The stress adjustment method for this steel branch pipe structure includes: acquiring radial strain data of the main pipe, gap data between the steel branch pipe structure and the surrounding rock, and internal water pressure data of the main pipe; determining the stress data of the main pipe based on the internal water pressure data and gap data; and controlling the dynamic compensation layer to undergo phase change based on the radial strain data and stress data to strengthen the constraint of the dynamic compensation layer on the pressure-bearing layer. While this improves the stress stiffness of the steel branch pipe structure, thereby enhancing its adaptability to stresses arising from real-time changes, it focuses on real-time monitoring of stress, gaps, and pressure. Although it can capture instantaneous stress changes, it fails to filter for the temporal continuity of anomalies, easily mistaking short-term fluctuations for anomalies.

[0006] Existing technology three, application number: 202510396070.1, discloses an intelligent inspection mode and monitoring method for reservoir bank slopes using unmanned aerial vehicles (UAVs). It proposes four UAV-based inspection modes (annual large-scale inspection, routine key area inspection, special situation inspection, and emergency situation inspection), covering the entire lifecycle needs of reservoir bank slope monitoring. While combining different inspection modes can flexibly address monitoring needs in different scenarios, ensuring both large-scale annual monitoring and high-frequency, high-precision monitoring of key areas, and rapid response in special and emergency situations, it lacks a unified and automated method for repairing detected abnormal data, still requiring manual intervention.

[0007] Currently, existing technologies 1, 2, and 3 suffer from the problem of misjudgment and missed detection when processing monitoring data from multiple sources, which are non-stationary and have large magnitude differences. Therefore, this invention provides a method for identifying outliers in security monitoring data based on sliding windows and morphological logic; it aims to construct a novel outlier detection and cleaning framework by integrating dynamic local statistics and static morphological rules to accurately address the aforementioned practical engineering challenges. Summary of the Invention

[0008] The main objective of this invention is to provide a method for identifying outliers in security monitoring data based on sliding windows and morphological logic, so as to solve the problems of misjudgment and missed judgment in the existing technology when processing monitoring data from multiple sources, non-stationary data, and data with large magnitude differences.

[0009] To achieve the above objectives, the present invention provides the following technical solution: A method for identifying outliers in security monitoring data based on sliding window and morphological logic, comprising the following steps: The dynamic upper and lower threshold sequences are compared point by point with the original data sequence. Individual data points that exceed the threshold range are initially marked as anomalies. At the same time, the variance of the data within each window is calculated to generate a variance sequence. By comparing it with the dead zone tolerance threshold, it is transformed into a logical vector, and the connected regions of continuous true values ​​are identified. All data points in regions whose length exceeds the maximum allowable value are marked as anomalies again, resulting in a comprehensive outlier logical sequence.

[0010] As a further improvement of the present invention, the process of obtaining a comprehensive outlier logic sequence includes the following steps: The consistency of the dynamic upper and lower threshold sequences with the original data sequence is determined point by point. For each data point, it is determined whether its value exceeds the dynamic upper or lower bound of the corresponding position. The determination result is converted into a sequence of logical values, which is a preliminary abnormal logical sequence. Based on the data within each sliding window, its local variance is calculated to characterize data volatility, forming a local variance sequence. The local variance sequence is compared with a preset dead zone tolerance threshold to generate a logical vector that identifies the low volatility state of the data. In the logical vector, all segments that are continuously true are identified, i.e., connected regions. For each connected region, it is determined whether its length exceeds the maximum allowable length. Data points corresponding to regions that meet the conditions are marked as anomalies, generating a morphological anomaly logical sequence. The generated preliminary abnormal logic sequence is integrated with the generated morphological abnormal logic sequence; data points in the same position in the two sequences are logically judged, and if a data point is marked as abnormal in either sequence, it is judged as abnormal in the final sequence; after integration and judgment, a comprehensive abnormal value logic sequence containing all abnormal marking information is generated.

[0011] As a further improvement of the present invention, the process of integrating the generated preliminary abnormal logic sequence with the generated morphological abnormal logic sequence includes the following steps: Align the initial anomaly logic sequence and the morphological anomaly logic sequence based on their common data point location index to establish a location mapping framework; Under the location mapping framework, two independent anomaly checks are performed on the location of each data point; the state of the data point in the preliminary anomaly logic sequence is extracted to see if it is marked due to deviation from the dynamic threshold; the state of the data point in the morphological anomaly logic sequence is extracted to see if it is marked due to belonging to an ultra-long low fluctuation range; and the anomaly labels of each data point from two different detection mechanisms are obtained in parallel. The two anomaly label states of each extracted data point are used as input, and a fusion rule is applied: if either anomaly label state is true, the data point is determined to be the final anomaly point; the fusion rule merges the two heterogeneous anomaly label sets to generate a comprehensive anomaly value logical sequence.

[0012] As a further improvement of the present invention, the process of merging two heterogeneous anomaly tag sets by the fusion rule includes the following steps: Based on the location mapping framework, the two abnormal label states acquired in parallel for each data point are encapsulated to form a binary data unit representing the comprehensive abnormal state of the data point; the binary data units corresponding to all data points are arranged in the original sequence order to construct a heterogeneous abnormal state tuple sequence. For each binary data unit in the heterogeneous abnormal state tuple sequence, apply a logical disjunction condition. The operation of the logical disjunction condition is to check the two state components in the binary data unit. If at least one component has a logical value of true, the condition is met, and the final abnormal flag setting of the data point is triggered. All final anomaly flags generated after logical disjunction condition judgments are collected and arranged in order of their corresponding data point positions; the ordered set of final anomaly flags is organized and synthesized into a comprehensive anomaly value logical sequence.

[0013] As a further improvement of the present invention, the process of checking two state components in a binary data unit includes the following steps: From a given binary data unit, synchronously read the values ​​of its two independent state components; the two independent state components represent the anomaly flag states from the threshold comparison mechanism and the morphological logic mechanism, respectively. The two independent state component values ​​are read as inputs and fed into a logic OR unit. The logic OR unit performs a logical judgment on the two input states. When the logical value of at least one input state is true, the logic OR unit outputs a logical true value; otherwise, it outputs a logical false value. The output of the logic OR operation unit is used as the final anomaly determination for the current data point; the anomaly determination is assigned the corresponding final anomaly flag to the data point, completing the transformation from heterogeneous state to single comprehensive determination.

[0014] As a further improvement of the present invention, the process of inputting data into a logic OR operation unit includes the following steps: The threshold comparison mechanism labeled state and the morphological logic mechanism labeled state are used as two pieces of anomalous evidence with independent confidence weights and are simultaneously input into the confidence fusion-based decision unit; among them, the threshold comparison evidence reflects the degree of point-like deviation, and the morphological logic evidence reflects the morphological distortion characteristics of the sequence. Within the decision-making unit, based on the principle that any anomaly in the field of safety monitoring triggers an alarm, a dual-source evidence fusion judgment logic is constructed: if threshold comparison evidence confirms an anomaly, an anomaly judgment is generated; if morphological logic evidence confirms an anomaly, an anomaly judgment is also generated. By integrating the judgment logic, the judgment results of dual-source evidence are transformed into unique abnormal state identifiers. The abnormal state identifiers combine the dual characteristics of instantaneous anomalies of data points and continuous anomalies of segments to form the final anomaly judgment output suitable for security monitoring scenarios.

[0015] As a further improvement of the present invention, the process of converting the discrimination result of dual-source evidence into a unique abnormal state identifier includes the following steps: The anomaly judgment results generated based on the threshold comparison mechanism and the morphological logic mechanism are encapsulated into a dual-source judgment vector with a fixed format; it contains two independent but logically related judgment components, which record the judgment conclusions of point anomalies and segment anomalies respectively. The dual-source decision vector is input into the identifier generator, and the logic superposition rule is applied: when the state of any decision component in the vector is abnormal, the identifier generator outputs a high-level signal; thus forming a primary identifier of the abnormal state. The primary identifier generated after logical superposition is bound to the location information of the data point to generate a data anomaly status word containing the location index and the anomaly status; the data anomaly status word serves as the unique anomaly identifier of the data point in the system.

[0016] As a further improvement of the present invention, the process of binding the primary identifier generated after logical superposition with the location information of the data points includes the following steps: The location index of the data point in the original sequence is fed into the address encoder to generate a unique location address code; the location address code serves as the identity of the data point in the sequence and provides a positioning reference for state binding. The generated location address code and the output primary identifier are simultaneously fed into the state synthesizer; the state synthesizer uses the primary identifier as the payload and the location address code as the addressing information to synthesize an addressed state signal. The status signal with the address is input to the status word assembler and encapsulated according to the predefined data structure format. The assembly process generates a data exception status word containing the location address and the exception status, thus completing the full binding of the exception identifier and the location information.

[0017] As a further improvement of the present invention, the original data sequence is processed by a window that slides with a fixed odd length, the median and median absolute deviation of the data subsequence corresponding to each window position are calculated, and then the standard deviation is estimated to generate a set of dynamic upper and lower threshold sequences that change with the window position.

[0018] As a further improvement of the present invention, the data points marked as abnormal in the outlier logical sequence are processed by linear interpolation, and the values ​​of the nearest normal data points on the left and right sides are used for calculation and replacement to obtain a cleaned data sequence after the outlier is eliminated.

[0019] To achieve the above objectives, the present invention also provides the following technical solution: An electronic device includes a processor and a memory coupled to the processor, the memory storing program instructions executable by the processor; when the processor executes the program instructions stored in the memory, it implements the above-described method for identifying anomalies in security monitoring data based on sliding windows and morphological logic.

[0020] To achieve the above objectives, the present invention also provides the following technical solution: A storage medium storing program instructions, which, when executed by a processor, implement the above-described method for identifying anomalies in security monitoring data based on sliding windows and morphological logic.

[0021] This invention dynamically estimates the statistical characteristics of data through a sliding window, generating upper and lower thresholds that change over time, enabling anomaly detection to adapt to local fluctuations in the data. Subsequently, it combines logical discrimination based on variance and dead zone tolerance to further filter out false alarms caused by noise or short-term fluctuations, ensuring that only persistent and significant anomalies are marked. Finally, linear interpolation is used to smooth out anomalies while preserving the original trend, restoring the continuity and usability of the data. This achieves adaptive, accurate, and low-false-alarm anomaly identification and repair of monitoring data, improving the reliability of analysis and decision-making. Attached Figure Description

[0022] Figure 1 This is a flowchart illustrating the steps of an embodiment of the security monitoring data outlier identification method based on sliding window and morphological logic of the present invention. Figure 2 This is a schematic diagram of an embodiment of the security monitoring data outlier identification method based on sliding window and morphological logic of the present invention; Figure 3 This is a schematic diagram illustrating the steps of generating a dynamic upper and lower threshold sequence that changes with the window position in one embodiment of the security monitoring data outlier identification method based on sliding window and morphological logic of the present invention. Figure 4 This is a flowchart illustrating the steps of obtaining a comprehensive outlier logic sequence in an embodiment of the security monitoring data outlier identification method based on sliding window and morphological logic of the present invention. Figure 5 This is a flowchart illustrating the steps of obtaining a cleaned data sequence after eliminating outliers in an embodiment of the security monitoring data outlier identification method based on sliding window and morphological logic of the present invention. Figure 6 This is a functional module diagram of an embodiment of the security monitoring data outlier identification system based on sliding window and morphological logic of the present invention; Figure 7 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention; Figure 8 This is a schematic diagram of the structure of a storage medium according to an embodiment of the present invention; Figure 9 This is a diagram illustrating the effect of removing outlier values ​​from the piezometer head data of this invention. Figure 10 This is a diagram showing the effect of removing outlier values ​​from the ambient temperature meter data of this invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0024] The terms "first," "second," and "third" used in this invention are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first," "second," or "third" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified. All directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of this invention are only used to explain the relative positional relationships and movements between components in a specific orientation (as shown in the accompanying drawings). If the specific orientation changes, the directional indications also change accordingly. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0025] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0026] like Figure 1As shown, this embodiment provides an example of a method for identifying outliers in security monitoring data based on sliding windows and morphological logic. In this embodiment, the method specifically includes the following steps: Step S1: The original data sequence is processed by a sliding window with a fixed odd length. The median and median absolute deviation of the data subsequence corresponding to each window position are calculated, and the standard deviation is estimated to generate a set of dynamic upper and lower threshold sequences that change with the window position. Step S2: The dynamic upper and lower threshold sequences are compared point by point with the original data sequence. Individual data points that exceed the threshold range are initially marked as anomalies. At the same time, the variance of the data in each window is calculated to generate a variance sequence. By comparing it with the dead zone tolerance threshold, it is converted into a logical vector, and the connected regions of continuous true values ​​are identified. All data points in regions whose length exceeds the maximum allowable value are marked as anomalies again, resulting in a comprehensive outlier logical sequence. Step S3: Data points marked as outliers in the outlier logical sequence are processed by linear interpolation. The values ​​of the nearest normal data points on the left and right sides are used for calculation and replacement to obtain a cleaned data sequence after outlier elimination.

[0027] Preferably, the specific principle is described in the appendix. Figure 2 This embodiment dynamically estimates the statistical characteristics of the data through a sliding window, generating upper and lower thresholds that change over time, enabling anomaly detection to adapt to local fluctuations in the data. Subsequently, by combining logical discrimination based on variance and dead zone tolerance, false alarms caused by noise or short-term fluctuations are further filtered out, ensuring that only persistent and significantly anomalous anomalies are marked. Finally, linear interpolation is used to smooth out anomalies while preserving the original trend, restoring the continuity and usability of the data. This achieves adaptive, accurate, and low-false-alarm anomaly identification and repair of monitoring data, improving the reliability of analysis and decision-making.

[0028] This embodiment addresses the challenge of accurately identifying and removing outliers in traditional water conservancy and hydropower project safety monitoring data. The method includes the following steps: setting a sliding window based on the original data; calculating the sliding window threshold parameter; initially identifying and marking outliers; calculating the sliding window morphology parameter; further identifying and marking outliers based on the sliding window morphology parameter; and outlier interpolation and replacement. These steps fully integrate dynamic local statistics with static morphological rules, effectively solving the problem of accurately identifying outliers in multi-source, heterogeneous, and varying-scale water conservancy and hydropower project safety monitoring data, and have been verified through practical examples.

[0029] This embodiment constructs and verifies an intelligent anomaly identification method for security monitoring data based on sliding window and morphological logic. Its core advantage lies in effectively solving the problems of misjudgment and missed judgment faced by traditional methods when processing multi-source, non-stationary, and large-scale monitoring data by combining the sliding window adaptive threshold method with data morphological logic discrimination. Its dynamic threshold mechanism ensures that the algorithm can accurately track local trends and fluctuations in the data, rather than relying on global static assumptions, thus significantly improving the accuracy and robustness of anomaly detection. Furthermore, it combines high computational performance with strong practicality. The modular design allows for flexible adjustment of parameters (such as window size and threshold multiplier) to adapt to the characteristics of different instrument types and monitoring projects. It can not only keenly identify instantaneous spikes and trend deviations, but also has detection logic specifically designed for "dead data" caused by instrument damage, achieving full coverage of complex anomaly patterns. Verification with actual data shows that this scheme can efficiently remove more than 95% of invalid data while preserving the integrity of the real signal, providing a highly reliable data foundation for data analysis and structural safety assessment, and has significant engineering application value.

[0030] This embodiment of the security monitoring data outlier identification method based on sliding window and morphological logic specifically includes the following steps: Step (1): Original data sequence Let the original data sequence be... for:

[0031] in This represents the data length.

[0032] Step (2): Sliding window settings Calculate half-window length :

[0033] in The size of the sliding window (must be an odd number).

[0034] Calculate the starting point number of the sliding window :

[0035] in This indicates the data number currently pending processing.

[0036] Calculate the end point of the sliding window :

[0037] in This represents the data length.

[0038] Extracting data sequences within a sliding window :

[0039] in The first data in the sliding window. This is the last data in the sliding window. This is the data currently pending processing.

[0040] Step (3): Sliding window threshold calculation Calculate the number of bits in the sliding window :

[0041] Calculate the absolute deviation of the window center :

[0042] Estimated standard deviation :

[0043] Calculate dynamic upper and lower thresholds and :

[0044]

[0045] in This is the threshold multiplier (usually 2.5 to 3.5).

[0046] Step (4): Initial labeling of outliers At this time, if: or Then the data points Marked as an exception.

[0047] Step (5): Calculation of sliding window shape parameters Calculate the mean of the data within the sliding window :

[0048] Calculate the unbiased sample variance of the data within the sliding window. :

[0049] Then the local variance sequence of the data V for:

[0050] Generate logical vectors (Composed of logical values ​​of 0 or 1):

[0051] in Dead zone tolerance threshold (usually taken as 10) -5 ).

[0052] turn up All consecutive True sequences :

[0053]

[0054] In the above formula Indicates the number of connected areas. Indicates the connected area The starting point number, Indicates the connected area The endpoint number, where The following boundary conditions must be met:

[0055] The length of the connected region .

[0056] Step (6): Secondary labeling of outliers At this time, if: If so, the data points within the connected area are marked as abnormal, where This represents the maximum allowed length of the connected area, with a value ranging from 3 to 5.

[0057] Step (7): Outlier interpolation For data points marked as outliers, linear interpolation is used for replacement. Let the outlier number be... The nearest normal point to the left of the anomaly is numbered as follows: The nearest normal point to the right of the anomaly is numbered as follows: The interpolated value of the outlier is:

[0058] In the above formula This refers to the outlier interpolation replacement value.

[0059] Furthermore, such as Figure 3 As shown, the process of generating a set of dynamic upper and lower threshold sequences that change with the window position in step S1 specifically includes the following steps: Step S11: Taking the current data point to be processed as the center, according to the preset fixed window length, extract a subset containing the center point and its neighboring data in sequence from the original data sequence to form a window data sequence; the boundary of the window data sequence is adaptively adjusted according to the start and end positions of the data sequence to ensure that the window can still effectively extract data at the two ends of the sequence. Step S12: Calculate a baseline value that represents the central tendency of the window data by sorting and taking the median of the generated window data sequence; calculate the absolute distance between each data point in the window and the baseline value, and again sort and take the median to obtain a dispersion index that is not sensitive to outliers; multiply the dispersion index by a statistical conversion constant to finally obtain an estimate of the standard deviation of the window data. Step S13: Combine the calculated baseline value with the estimated value. The baseline value serves as the central axis of the threshold, and the estimated value is multiplied by a preset amplitude coefficient to serve as the allowable positive and negative fluctuation ranges deviating from the central axis. Apply the upper and lower limits of the positive and negative fluctuation ranges to the baseline value respectively to generate a pair of exclusive dynamic upper and lower bounds that change with the local characteristics of the data for each window data sequence, which together constitute the dynamic upper and lower threshold sequences.

[0060] Preferably, this embodiment uses a variable window truncation based on the center point to ensure that a locally complete subset of data can be obtained at any position in the sequence. Then, statistical analysis is performed using the median and the absolute deviation of the median to obtain a robust estimate of the central tendency and dispersion for outliers. The dispersion is then converted to an approximation of the standard deviation and multiplied by an amplitude coefficient to form an adaptive fluctuation range that varies with local characteristics. Overall, this achieves locally adaptive threshold generation for the monitoring data, reflecting the local mean and fluctuation level of the data in real time, improving the sensitivity and noise resistance of anomaly detection, and avoiding misjudgments or missed judgments caused by fixed thresholds in different segments.

[0061] Furthermore, the process of obtaining a dispersion index that is insensitive to outliers in step S12 specifically includes the following steps: Step S121: Using the obtained window data sequence and its benchmark value, calculate the non-negative difference value between each data point in the window sequence and the benchmark value, and generate a new sequence composed of the absolute deviation of all data points; Step S122: Arrange the generated new sequence in order of its numerical value to form an ordered sequence; locate and extract the value at the center position in the ordered sequence, and determine the value as the intermediate difference that can represent the degree of deviation of most data. Step S123: Combine the determined intermediate difference with a scaling factor preset based on the characteristics of the standard normal distribution, and perform scale correction on the intermediate difference through scaling operation, and finally output a dispersion index as a robust estimate of the standard deviation of the window data.

[0062] Preferably, this embodiment statistically analyzes the absolute deviation of each data point within the window from the central benchmark to generate a complete deviation sequence. Then, the median of this sequence is taken as the representative deviation, reflecting the deviation of most data points without being affected by extreme anomalies. Subsequently, this median deviation is multiplied by a scaling factor set according to the standard normal distribution to obtain a robust approximate estimate of the standard deviation. This embodiment provides a dispersion measure insensitive to outliers, allowing subsequent threshold calculations to be based on the true fluctuation level of local data without being distorted by a few outliers, thereby improving the robustness and accuracy of anomaly detection.

[0063] Furthermore, the process of scaling the intermediate difference in step S123 includes the following steps: Step S1231: Introduce a predefined constant based on the quantile characteristics of the standard normal distribution. The role of the constant is to systematically adjust the intermediate difference calculated from the normal sample to the theoretical expected value of its standard deviation. The constant is the distribution characteristic matching coefficient. Step S1232: Combine the determined intermediate difference with the introduced distribution characteristic matching coefficient; by mathematically integrating the intermediate difference with the distribution characteristic matching coefficient, a systematic transformation of the numerical amplitude of the intermediate difference is achieved. Step S1233: Systematic transformation, the output of which is a new value after numerical amplitude adjustment. This new value, as a robust estimate of the standard deviation of the window data sequence, is ultimately defined as the corrected dispersion index and used for dynamic threshold calculation.

[0064] Preferably, this embodiment introduces a constant based on the quantile characteristics of the standard normal distribution to map the median deviation in the window to the corresponding expected standard deviation. Then, the constant is mathematically integrated with the median deviation to achieve a systematic correction of the deviation amplitude. The resulting corrected dispersion index can provide a scale that matches the standard deviation of the normal distribution while maintaining robustness to outliers. This makes the upper and lower bounds of the dynamic threshold more accurately reflect the true fluctuation range of local data, thereby improving the reliability and accuracy of anomaly detection.

[0065] Furthermore, such as Figure 4 As shown, the process of obtaining a comprehensive outlier logic sequence in step S2 specifically includes the following steps: Step S21: Perform a point-by-point position correspondence determination on the dynamic upper and lower threshold sequences and the original data sequence; for each data point, determine whether its value exceeds the dynamic upper or lower bound of the corresponding position, and convert the determination result into a sequence composed of logical values, which is a preliminary abnormal logical sequence. Step S22: Based on the data within each sliding window, calculate its local variance to characterize data volatility and form a local variance sequence; compare the local variance sequence with a preset dead zone tolerance threshold to generate a logical vector that identifies the low volatility state of the data; in the logical vector, identify all segments that are continuously true, i.e. connected regions; for each connected region, determine whether its length exceeds the maximum allowable length, mark the data points corresponding to the regions that meet the conditions as anomalies, and generate a morphological anomaly logical sequence. Step S23: Integrate the generated preliminary abnormal logic sequence with the generated morphological abnormal logic sequence; perform logical judgment on data points in the same position in the two sequences. If a data point is marked as abnormal in either sequence, it will be judged as abnormal in the final sequence; generate a comprehensive abnormal value logic sequence containing all abnormal marking information after integration and judgment.

[0066] Preferably, this embodiment achieves real-time detection of single-point deviations by comparing dynamic thresholds point by point; then, it uses local variance and dead zone tolerance to identify continuous low-fluctuation segments and performs secondary labeling on ultra-long segments; finally, it performs a union fusion of the two types of logical results, enabling it to capture both instantaneous anomalies and identify continuous and significant anomalies. This embodiment forms a comprehensive anomaly discrimination mechanism that takes into account both single-point mutations and local fluctuation characteristics, improving the completeness and reliability of anomaly detection.

[0067] Furthermore, the process of integrating the generated preliminary abnormal logic sequence with the generated morphological abnormal logic sequence in step S23 specifically includes the following steps: Step S231: Align the preliminary abnormal logic sequence and the morphological abnormal logic sequence according to their common data point position index to establish a position mapping framework; ensure that all subsequent judgments are based on data points at the same position, laying a structural foundation for the fusion of logical states; Step S232: Under the location mapping framework, perform two independent anomaly checks on the location of each data point; extract whether the data point is marked due to deviation from the dynamic threshold in the preliminary anomaly logic sequence; simultaneously extract whether the data point is marked due to belonging to an ultra-long low fluctuation segment in the morphological anomaly logic sequence; and obtain the anomaly labels of each data point from two different detection mechanisms in parallel. Step S233: Take the two anomaly label states of each extracted data point as input and apply a fusion rule: if any one of the anomaly label states is true, the data point is determined to be the final anomaly point; the fusion rule merges the two heterogeneous anomaly label sets to generate a comprehensive anomaly value logic sequence; the comprehensive anomaly value logic sequence contains all the anomaly data point information identified by two different mechanisms: threshold comparison and morphological logic.

[0068] Preferably, this embodiment achieves a unified benchmark for the two types of abnormal sequences through position alignment; it checks the marking of each point under both threshold deviation and morphological anomaly mechanisms in parallel; and it merges the two detection results into one by adopting a fusion rule that either true or false indicates an anomaly. This embodiment aims to simultaneously identify instantaneous deviations and persistent anomalies, forming a comprehensive anomaly judgment sequence with more comprehensive coverage and a lower false negative rate.

[0069] Furthermore, the process of merging the two heterogeneous anomaly tag sets in step S233 specifically includes the following steps: Step S2331: Based on the location mapping framework, the two abnormal label states acquired in parallel for each data point are encapsulated to form a binary data unit representing the comprehensive abnormal state of the data point; the binary data units corresponding to all data points are arranged in the original sequence order to construct a heterogeneous abnormal state tuple sequence. Step S2332: Apply a logical disjunction condition to each binary data unit in the heterogeneous abnormal state tuple sequence; the operation of the logical disjunction condition is: check the two state components in the binary data unit, if at least one component has a logical value of true, then the condition is satisfied and the final abnormal flag setting of the data point is triggered. Step S2333: Collect and arrange all the final anomaly flags generated after the logical disjunction condition judgment according to the order of their corresponding data point positions; the ordered set of final anomaly flags is organized and synthesized into a comprehensive anomaly value logical sequence.

[0070] Preferably, this embodiment encapsulates the two types of anomaly markers for each data point by aligning their positions, forming a binary state unit. Then, logical disjunction is applied to each binary unit; an anomaly flag is triggered as long as either marker is true. Finally, all triggered flags are aggregated in their original order to generate a complete comprehensive anomaly logic sequence. This embodiment achieves a unified union fusion of results from different detection mechanisms, ensuring that all possible anomalies are captured, thus improving the coverage and reliability of anomaly detection.

[0071] Furthermore, the process of checking the two state components in the binary data unit in step S2332 specifically includes the following steps: Step S23321: Synchronously read the two independent state component values ​​contained in the given binary data unit; the two independent state components represent the abnormal marking states from the threshold comparison mechanism and the morphological logic mechanism, respectively; Step S23322: The two independent state component values ​​read are fed into a logic OR operation unit as inputs. The two input states are logically judged. When the logical value of at least one input state is true, the logic OR operation unit outputs a logical true value; otherwise, it outputs a logical false value. Step S23323: The output of the logic OR operation unit is used as the final anomaly determination conclusion for the current data point; the anomaly determination conclusion is assigned the final anomaly flag corresponding to the data point, completing the transformation from heterogeneous state to single comprehensive determination.

[0072] Preferably, this embodiment synchronously reads two types of anomaly markers: threshold comparison and morphological logic. These markers are then input into a logical OR operation, implementing a rule that determines an anomaly as long as either marker is true. The operation result is then assigned to the corresponding data point, completing the unified determination of heterogeneous states. This embodiment simplifies the fusion process of multi-source anomaly information, ensuring that all possible anomalies are captured, and improving the completeness and reliability of anomaly detection.

[0073] Furthermore, the process of feeding the input to a logic OR operation unit in step S23322 specifically includes the following steps: Step S233221: The obtained threshold comparison mechanism labeled state and morphological logic mechanism labeled state are used as two pieces of anomalous evidence with independent confidence weights, and are simultaneously input into the confidence fusion-based decision unit; wherein, the threshold comparison evidence reflects the degree of point-like deviation, and the morphological logic evidence reflects the morphological distortion characteristics of the sequence. Step S233222: Within the decision-making unit, based on the principle that any anomaly in the field of safety monitoring is an alarm, a dual-source evidence fusion decision logic is constructed: if the threshold comparison evidence confirms an anomaly, an anomaly decision is generated; if the morphological logic evidence confirms an anomaly, an anomaly decision is also generated. Step S233223: By integrating the judgment logic, the judgment results of dual-source evidence are transformed into unique abnormal state identifiers; the abnormal state identifiers combine the dual characteristics of instantaneous abnormality of data points and continuous abnormality of segments to form the final abnormal judgment output suitable for security monitoring scenarios.

[0074] Preferably, in this embodiment, threshold deviation evidence and morphological distortion evidence are respectively input into a fusion decision unit with confidence weights. Based on the principle of alarming upon the presence of one abnormal evidence, a dual-source logic is constructed. As long as either piece of evidence is determined to be abnormal, an abnormality judgment is generated. Subsequently, the judgment is unified into a unique abnormality status identifier, thereby achieving comprehensive capture of instantaneous point-like anomalies and continuous morphological anomalies, and improving the sensitivity and reliability of the monitoring system.

[0075] Furthermore, step S233223, which transforms the discrimination result of dual-source evidence into a unique anomaly status identifier, specifically includes the following steps: Step S2332231: Encapsulate the anomaly judgment results generated based on the threshold comparison mechanism and the morphological logic mechanism into a dual-source judgment vector with a fixed format; it contains two independent but logically related judgment components, which record the judgment conclusions of point anomalies and segment anomalies respectively. Step S2332232: Input the dual-source decision vector into the identifier generator and apply the logic superposition rule: when the state of any decision component in the vector is abnormal, the identifier generator outputs a high-level signal; realize the conversion from dual-source decision to single-thread signal, and form a primary identifier of abnormal state; Step S2332233: Bind the primary identifier generated after logical superposition with the location information of the data point to generate a data anomaly status word containing the location index and the anomaly status; the data anomaly status word serves as the unique anomaly identifier of the data point in the system, completing the transformation from multi-source evidence to a unified identifier.

[0076] Preferably, in this embodiment, the two anomaly decisions—threshold comparison and morphological logic—are encapsulated into a fixed-format dual-source decision vector. Then, logical superposition is applied to this vector in the identifier generator; a high-level signal is output whenever either component is anomaly, thus converting the dual-source decision into a single anomaly signal. Finally, this signal is bound to the location information of the data point to form a unique anomaly status word. This embodiment achieves unified encoding and location of multi-source anomaly evidence, ensuring that the anomaly of each data point can be presented with a unique identifier, improving the traceability of anomaly information and system processing efficiency.

[0077] Furthermore, the process of binding the primary identifier generated after logical superposition with the location information of the data points in step S2332233 specifically includes the following steps: Step S23322331: The position index of the data point in the original sequence is sent to the address encoder to generate a unique position address code; the position address code serves as the identity of the data point in the sequence and provides a positioning reference for state binding; Step S23322332: The generated location address code and the output primary identifier are simultaneously sent to the state synthesizer; the state synthesizer uses the primary identifier as the payload and the location address code as the addressing information to synthesize an addressed state signal; Step S23322333: Input the status signal with address to the status word assembler and encapsulate it according to the predefined data structure format; the assembly process generates a data exception status word containing the location address and the exception status, and completes the binding of the exception identifier and the location information.

[0078] Preferably, in this embodiment, the two anomaly decisions—threshold comparison and morphological logic—are encapsulated into a fixed-format dual-source decision vector. Then, logical superposition is applied to this vector in the identifier generator; a high-level signal is output whenever either component is anomaly, thus converting the dual-source decision into a single anomaly signal. Finally, this signal is bound to the location information of the data point to form a unique anomaly status word. This embodiment achieves unified encoding and location of multi-source anomaly evidence, ensuring that the anomaly of each data point can be presented with a unique identifier, improving the traceability of anomaly information and system processing efficiency.

[0079] Furthermore, such as Figure 5 As shown, the process of obtaining the cleaned data sequence after outlier removal in step S3 specifically includes the following steps: Step S31: Based on the comprehensive outlier logical sequence, perform a cleaning operation on all data points marked as outliers; Step S32: For each abnormal data point, based on its position index in the original sequence, perform a bidirectional scan to the left and right ends of the sequence to locate the two normal data points closest to the abnormal point; Step S33: Using the values ​​and positional relationship of two normal data points, calculate the replacement value of the outlier point through linear interpolation; replace all outliers in the original sequence with their corresponding interpolated values ​​in turn, and output the final cleaned data sequence.

[0080] Preferably, in this embodiment, after locating outlier points through comprehensive anomaly logic, linear interpolation is performed using the nearest bidirectional normal point to achieve smooth replacement of outliers. Point-by-point replacement is completed while maintaining the original sequence's temporal order, resulting in a continuous, abruptly-free cleaned data sequence. This embodiment eliminates outlier interference, restores the continuity and authenticity of the data, and provides more reliable monitoring data for analysis and decision-making.

[0081] like Figure 6 As shown, this embodiment also provides an embodiment of a security monitoring data outlier identification system based on sliding window and morphological logic. In this embodiment, the security monitoring data outlier identification system based on sliding window and morphological logic is applied to the security monitoring data outlier identification method based on sliding window and morphological logic in the above embodiment. The security monitoring data outlier identification system based on sliding window and morphological logic includes a threshold sequence generation module 1, an outlier identification module 2, and a difference processing module 3 that are electrically connected in sequence. The threshold sequence generation module 1 processes the original data sequence through a sliding window of fixed odd length, calculates the median and median absolute deviation of the data subsequence corresponding to each window position, and then estimates the standard deviation to generate a set of dynamic upper and lower threshold sequences that change with the window position. The outlier identification module 2 compares the dynamic upper and lower threshold sequences with the original data sequence point by point, initially marking individual data points that exceed the threshold range as outliers. At the same time, it calculates the variance of the data within each window to generate a variance sequence. By comparing it with the dead zone tolerance threshold, it converts it into a logical vector, identifies the connected regions of continuous true values, and marks all data points in regions whose length exceeds the maximum allowable value as outliers, resulting in a comprehensive outlier logical sequence. The difference processing module 3 processes the data points marked as outliers in the outlier logical sequence through linear interpolation, using the values ​​of the nearest normal data points on the left and right sides to calculate and replace them, resulting in a cleaned data sequence after outlier elimination.

[0082] Preferably, this embodiment uses a dynamically generated threshold through a sliding window to achieve real-time capture of local data trends and fluctuations; combined with the morphological logic of variance and dead zone tolerance, short-term noise is further filtered out, and only persistent and significant anomalies are secondary-marked; finally, linear interpolation is used to smoothly replace anomalies while maintaining sequence continuity. Overall, this forms an adaptive, robust, and low-false-alarm anomaly detection and repair system, improving the reliability of monitoring data and the accuracy of analysis.

[0083] like Figure 7 As shown, this embodiment provides an embodiment of an electronic device 4, which includes a processor 41 and a memory 42 coupled to the processor 41.

[0084] The memory 42 stores program instructions for implementing the security monitoring data anomaly identification method based on sliding window and morphological logic in any of the above embodiments.

[0085] The processor 41 is used to execute program instructions stored in the memory 42 to identify anomalies in security monitoring data based on sliding window and morphological logic.

[0086] The processor 41 can also be referred to as a CPU (Central Processing Unit). The processor 41 may be an integrated circuit chip with signal processing capabilities. The processor 41 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor can be a microprocessor or any conventional processor.

[0087] Furthermore, Figure 8 This is a schematic diagram of the structure of a storage medium according to an embodiment of this application. The storage medium 5 of this embodiment stores program instructions 51 capable of implementing all the methods described above. These program instructions 51 can be stored in the storage medium in the form of a software product, including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks, or terminal devices such as computers, servers, mobile phones, and tablets.

[0088] (1) Case 1 Taking the removal of outlier values ​​from the piezometer head data in a certain engineering project as an example, the above algorithm was implemented in MATLAB software, and its outlier identification and removal effect is as follows: Figure 9 As shown.

[0089] (2) Case 2 Taking the removal of outliers from environmental thermometer data in a certain project as an example, the results of outlier identification and removal are as follows: Figure 10 As shown.

[0090] In the several embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0091] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units. The above are merely embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

[0092] The specific embodiments of the invention have been described in detail above, but these are merely examples, and the invention is not limited to the specific embodiments described above. For those skilled in the art, any equivalent modifications or substitutions to the invention are also within the scope of this invention. Therefore, all equivalent transformations, modifications, and improvements made without departing from the spirit and principles of this invention should be included within the scope of this invention.

Claims

1. A method for identifying outliers in security monitoring data based on sliding windows and morphological logic, characterized in that, The method for identifying outliers in security monitoring data based on sliding windows and morphological logic includes the following steps: The dynamic upper and lower threshold sequences are compared point by point with the original data sequence. Individual data points that exceed the threshold range are initially marked as anomalies. At the same time, the variance of the data within each window is calculated to generate a variance sequence. By comparing it with the dead zone tolerance threshold, it is transformed into a logical vector, and the connected regions of continuous true values ​​are identified. All data points in regions whose length exceeds the maximum allowable value are marked as anomalies again, resulting in a comprehensive outlier logical sequence.

2. The method for identifying outliers in security monitoring data based on sliding window and morphological logic according to claim 1, characterized in that, The process of obtaining a comprehensive logical sequence of outliers includes the following steps: The consistency of the dynamic upper and lower threshold sequences with the original data sequence is determined point by point. For each data point, it is determined whether its value exceeds the dynamic upper or lower bound of the corresponding position. The determination result is converted into a sequence of logical values, which is a preliminary abnormal logical sequence. Based on the data within each sliding window, its local variance is calculated to characterize data volatility, forming a local variance sequence. The local variance sequence is compared with a preset dead zone tolerance threshold to generate a logical vector that identifies the low volatility state of the data. In the logical vector, all segments that are continuously true are identified, i.e., connected regions. For each connected region, it is determined whether its length exceeds the maximum allowable length. Data points corresponding to regions that meet the conditions are marked as anomalies, generating a morphological anomaly logical sequence. The generated preliminary abnormal logic sequence is integrated with the generated morphological abnormal logic sequence; data points in the same position in the two sequences are logically judged, and if a data point is marked as abnormal in either sequence, it is judged as abnormal in the final sequence; after integration and judgment, a comprehensive abnormal value logic sequence containing all abnormal marking information is generated.

3. The method for identifying outliers in security monitoring data based on sliding window and morphological logic according to claim 2, characterized in that, The process of integrating the generated preliminary abnormal logic sequence with the generated morphological abnormal logic sequence includes the following steps: Align the initial anomaly logic sequence and the morphological anomaly logic sequence based on their common data point location index to establish a location mapping framework; Under the location mapping framework, two independent anomaly checks are performed on the location of each data point; the state of the data point in the preliminary anomaly logic sequence is extracted to see if it is marked due to deviation from the dynamic threshold; the state of the data point in the morphological anomaly logic sequence is extracted to see if it is marked due to belonging to an ultra-long low fluctuation range; and the anomaly labels of each data point from two different detection mechanisms are obtained in parallel. The two anomaly label states of each extracted data point are used as input, and a fusion rule is applied: if either anomaly label state is true, the data point is determined to be the final anomaly point; the fusion rule merges the two heterogeneous anomaly label sets to generate a comprehensive anomaly value logical sequence.

4. The method for identifying outliers in security monitoring data based on sliding window and morphological logic according to claim 3, characterized in that, The fusion rule is the process of merging two heterogeneous sets of anomaly labels, which includes the following steps: Based on the location mapping framework, the two abnormal label states acquired in parallel for each data point are encapsulated to form a binary data unit representing the comprehensive abnormal state of the data point; the binary data units corresponding to all data points are arranged in the original sequence order to construct a heterogeneous abnormal state tuple sequence. For each binary data unit in the heterogeneous abnormal state tuple sequence, apply a logical disjunction condition. The operation of the logical disjunction condition is to check the two state components in the binary data unit. If at least one component has a logical value of true, the condition is satisfied, and the final abnormal flag setting of the data point is triggered. All final anomaly flags generated after logical disjunction condition judgments are collected and arranged in order of their corresponding data point positions; the ordered set of final anomaly flags is organized and synthesized into a comprehensive anomaly value logical sequence.

5. The method for identifying outliers in security monitoring data based on sliding window and morphological logic according to claim 4, characterized in that, The process of examining the two state components in a binary data unit includes the following steps: From a given binary data unit, synchronously read the values ​​of its two independent state components; the two independent state components represent the anomaly flag states from the threshold comparison mechanism and the morphological logic mechanism, respectively. The two independent state component values ​​are read as inputs and fed into a logic OR operation unit. The two input states are logically judged. When the logical value of at least one input state is true, the logic OR operation unit outputs a logical true value; otherwise, it outputs a logical false value. The output of the logic OR operation unit is used as the final anomaly determination for the current data point; the anomaly determination is assigned the corresponding final anomaly flag to the data point, completing the transformation from heterogeneous state to single comprehensive determination.

6. The method for identifying outliers in security monitoring data based on sliding window and morphological logic according to claim 5, characterized in that, The process of feeding input into a logical OR operation unit includes the following steps: The acquired threshold comparison mechanism labeled state and morphological logic mechanism labeled state are used as two pieces of anomalous evidence with independent confidence weights and are simultaneously input into the confidence fusion-based decision unit; among them, the threshold comparison evidence reflects the degree of point-like deviation, and the morphological logic evidence reflects the morphological distortion characteristics of the sequence. Within the decision-making unit, based on the principle that any anomaly in the field of safety monitoring triggers an alarm, a dual-source evidence fusion judgment logic is constructed: if threshold comparison evidence confirms an anomaly, an anomaly judgment is generated; if morphological logic evidence confirms an anomaly, an anomaly judgment is also generated. By integrating the judgment logic, the judgment results of dual-source evidence are transformed into unique abnormal state identifiers. The abnormal state identifiers combine the dual characteristics of instantaneous anomalies of data points and continuous anomalies of segments to form the final anomaly judgment output suitable for security monitoring scenarios.

7. The method for identifying outliers in security monitoring data based on sliding window and morphological logic according to claim 6, characterized in that, The process of transforming the judgment result of dual-source evidence into a unique anomaly status identifier includes the following steps: The anomaly judgment results generated based on the threshold comparison mechanism and the morphological logic mechanism are encapsulated into a dual-source judgment vector with a fixed format; it contains two independent but logically related judgment components, which record the judgment conclusions of point anomalies and segment anomalies respectively. The dual-source decision vector is input into the identifier generator, and the logic superposition rule is applied: when the state of any decision component in the vector is abnormal, the identifier generator outputs a high-level signal; thus forming a primary identifier of the abnormal state. The primary identifier generated after logical superposition is bound to the location information of the data point to generate a data anomaly status word containing the location index and the anomaly status; the data anomaly status word serves as the unique anomaly identifier of the data point in the system.

8. The method for identifying outliers in security monitoring data based on sliding window and morphological logic according to claim 7, characterized in that, The process of binding the initial identifier generated after logical overlay with the location information of the data points includes the following steps: The location index of the data point in the original sequence is fed into the address encoder to generate a unique location address code; the location address code serves as the identity of the data point in the sequence and provides a positioning reference for state binding. The generated location address code and the output primary identifier are simultaneously fed into the state synthesizer; the state synthesizer uses the primary identifier as the payload and the location address code as the addressing information to synthesize an addressed state signal. The status signal with the address is input to the status word assembler and encapsulated according to the predefined data structure format. The assembly process generates a data exception status word containing the location address and the exception status, thus completing the full binding of the exception identifier and the location information.

9. The method for identifying outliers in security monitoring data based on sliding window and morphological logic according to claim 1, characterized in that, The original data sequence is processed by sliding windows of a fixed odd length. The median and median absolute deviation of the data subsequence corresponding to each window position are calculated, and the standard deviation is estimated to generate a set of dynamic upper and lower threshold sequences that change with the window position.

10. The method for identifying outliers in security monitoring data based on sliding window and morphological logic according to claim 1, characterized in that, In the outlier logical sequence, the data points marked as outliers are processed by linear interpolation, and the values ​​of the nearest normal data points on the left and right sides are used for calculation and replacement to obtain a cleaned data sequence after the outliers are eliminated.

Images