Security risk detection method based on large model and cue word engineering and related device

Abstract

The invention provides a security risk detection method based on a large model and cue engineering and a related device, and relates to the technical field of security risk monitoring. The method comprises the following steps of: receiving user input to carry out preliminary safety detection, constructing an enhanced prompt word template, executing risk inference analysis, implementing real-time auditing and determining risk disposal actions; the problems of incomplete coverage, insufficient adaptability, coarse granularity, contradiction between real-time and depth and weak cross-round defense in an existing security mechanism are effectively solved, and the method has the advantages of improving the comprehensiveness of security coverage, enhancing the dynamic adaptability, realizing refined risk processing, giving consideration to real-time and depth analysis and enhancing the cross-round attack defense capability.

Description

Technical Field

[0001] This application relates to the field of security risk monitoring technology, and in particular to a security risk detection method and related apparatus based on large model and prompt word engineering. Background Technology

[0002] In the field of industrial site safety monitoring, existing technologies face multi-dimensional challenges. Regarding scenario adaptability, traditional methods rely on fixed rules or single models, making it difficult to address the differentiated risk characteristics of different areas within industrial sites. Existing systems cannot dynamically adjust detection logic based on real-time scenarios, resulting in insufficient generalization ability of safety strategies. At the data utilization level, historical accident records, equipment operating status, and personnel behavior data accumulated in industrial sites are often isolated, lacking effective spatiotemporal correlation mechanisms. This data silo phenomenon limits the depth of risk pattern mining, making it difficult for systems to extract valuable early warning signals from multi-source heterogeneous data. The contradiction between real-time performance and accuracy is particularly prominent; deep learning models deployed at the edge struggle to balance high accuracy and low latency requirements under computational constraints. When sudden operational anomalies occur in industrial sites, traditional models often miss critical response windows due to insufficient inference speed. During large-scale model applications, safety hazards caused by flawed prompt word design are becoming increasingly apparent. User profile construction mechanisms have significant shortcomings; existing solutions are mostly based on static modeling of historical datasets, failing to capture real-time changes in operator behavior and dynamic evolution of the scenario. For example, when personnel linger abnormally or operate in violation of regulations within industrial fences, the system cannot update risk assessment dimensions in a timely manner, resulting in delayed warnings. The rigidity of model weight allocation strategies is significant; traditional methods integrate the outputs of large and small models using preset ratios, failing to dynamically optimize based on changes in risk levels and individual user differences, leading to unbalanced resource allocation. The prompt word engineering lacks scenario adaptability; generic templates cannot generate targeted guidance content based on industrial equipment type or user risk sensitivity, causing the large model's attention to be scattered on non-critical features. The response mechanism design is too crude; existing systems mostly use uniform thresholds to trigger alarms, failing to establish a refined risk classification system. The priority of handling high-risk events and routine hazards is confused, severely impacting the timeliness of emergency response. These deficiencies collectively hinder the intelligent evolution of industrial site safety management.

[0003] To address the aforementioned issues, existing technologies urgently need improvement. Summary of the Invention

[0004] To dynamically adapt to different risk scenarios in industrial sites, improve the accuracy and real-time performance of safety risk detection, reduce response delays, and enhance the targeting of risk warnings, this application provides a safety risk detection method and related apparatus based on large-scale modeling and prompt word engineering.

[0005] Firstly, the security risk detection method based on large models and prompt word engineering provided in this application adopts the following technical solution: A security risk detection method based on large models and prompt word engineering includes: Acquire real-time data from industrial sites, including equipment operating status data, personnel operation behavior data, and environmental parameter data; Based on historical business data, user behavior data, and equipment attribute data of industrial sites, a multi-dimensional user profile is constructed, which includes: scenario characteristics, behavioral characteristics, and risk preferences. The historical safety risk event database of the industrial site is invoked, and incremental learning is performed on real-time data to update the risk scenario database in the multi-dimensional user profile to generate the target user profile. Based on the scenario features in the target user profile and the risk patterns in the historical records, the weight allocation between the large model and the small model is dynamically adjusted through reinforcement learning algorithms. Based on the scenario features and risk preferences in the target user profile, a personalized prompt word template is generated to guide the large model to focus on key risk features. Small models are used to perform preliminary annotation of real-time data. The annotated data is then combined with large models to perform deep security detection using prompt word templates. A tiered response mechanism is triggered based on the risk level of the test results.

[0006] Optionally, the construction of the user profile includes: Based on the geofence data, equipment distribution heat map and historical accident records of industrial sites, high-risk areas, normal areas and low-risk areas are divided. LSTM networks are used to analyze personnel movement trajectories and identify abnormal stops and violations. By using questionnaires and historical handling records, a user sensitivity score for risk types is constructed.

[0007] Optionally, the historical record fusion step includes: Store structured data of historical safety incidents at industrial sites and associate it with spatiotemporal coordinates; The Apriori algorithm is used to discover risk patterns and generate risk propagation maps. When real-time data matches historical risk patterns, the detection weight of the corresponding scenario is automatically increased.

[0008] Optionally, the dynamic weight adjustment of the reinforcement learning algorithm includes: Calculate the scenario risk value using a Bayesian network and classify the risk level. Based on risk levels and risk preferences in user profiles, the Q-learning algorithm is used to dynamically adjust model weights; The iteration stops when the detection accuracy fluctuation is ≤1% after three consecutive weight adjustments.

[0009] Optionally, the generation of the personalized prompt word template includes: Generate corresponding prompts based on the characteristics of the industrial site scenario; Based on the sensitivity scores in user profiles, add urgency indicators to high-risk events; Adjust the weight of suggestion keywords based on user feedback.

[0010] Optionally, the combination of the small model and the large model includes: Use a lightweight CNN to detect small objects in the sampled images and output bounding box coordinates and confidence scores; Input the bounding box output by the small model into the large model, and extract local features through RoI Align; Personalized prompts are converted into input masks to guide the attention mechanism to focus on key areas.

[0011] Optionally, the hierarchical response mechanism includes: Send text alerts to user terminals and record violations; The management terminal pop-up notification is triggered, and the edge computing node is started to perform localized processing. A structured event is sent to the emergency platform, triggering the automatic activation of the sprinkler system in the fire protection system.

[0012] Secondly, this application provides a security risk detection system based on large model and prompt word engineering, including: The data acquisition module is used to acquire real-time data from industrial sites, including equipment operating status data, personnel operation behavior data, and environmental parameter data. The user profile building module is used to build multi-dimensional user profiles based on historical business data, user behavior data, and equipment attribute data of industrial sites. The user profiles include: scenario characteristics, behavioral characteristics, and risk preferences. The profile update module is used to call the historical safety risk event library of industrial sites, perform incremental learning on real-time data, and update the risk scenario library in the multi-dimensional user profile to generate the target user profile. The weight allocation module is used to dynamically adjust the weight allocation between the large model and the small model based on the scene features in the target user profile and the risk patterns in the historical records through a reinforcement learning algorithm. The prompt word module is used to generate personalized prompt word templates based on the scenario features and risk preferences in the target user profile, guiding the large model to focus on key risk features; The detection module is used to perform preliminary annotation of real-time data using a small model, combine the annotated data with a large model, and perform deep security detection using prompt word templates. The risk level module is used to trigger a tiered response mechanism based on the risk level of the detection results.

[0013] Thirdly, this application provides a computer device, the device comprising: a memory and a processor, wherein the processor, when executing computer instructions stored in the memory, performs the method described above.

[0014] Fourthly, this application provides a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the method described above.

[0015] In summary, this application provides a security risk detection method based on large models and prompt word engineering. The method is applied to industrial sites and includes acquiring real-time data, constructing user profiles, incremental learning and updating, dynamically adjusting weights, generating prompt word templates, and combining model detection with a trigger response mechanism. By dynamically adapting to scene changes and personalized risk handling, it effectively solves the problems of poor scene adaptability, insufficient real-time performance, and low accuracy in existing technologies. It can dynamically adapt to different risk scenarios in industrial sites, improve the accuracy and real-time performance of security risk detection, reduce response delays, and enhance the targeting of risk warnings. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the computer device structure of the hardware operating environment involved in the embodiments of this application; Figure 2 This is a flowchart illustrating the first embodiment of the security risk detection method based on large model and prompt word engineering in this application; Figure 3 This is a structural block diagram of the first embodiment of the security risk detection system based on large model and prompt word engineering in this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0018] Reference Figure 1 , Figure 1 This is a schematic diagram of the computer device structure of the hardware operating environment involved in the embodiments of this application.

[0019] like Figure 1As shown, the computer device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be high-speed random access memory (RAM) or stable non-volatile memory (NVM), such as a disk drive. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0020] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the computer device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0021] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and a security risk detection program based on large model and prompt word engineering.

[0022] exist Figure 1 In the computer device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in this application can be set in the computer device. The computer device calls the security risk detection program based on large model and prompt word engineering stored in the memory 1005 through the processor 1001, and executes the security risk detection method based on large model and prompt word engineering provided in the embodiment of this application.

[0023] This application provides a security risk detection method based on large model and prompt word engineering, referring to... Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the security risk detection method based on large model and prompt word engineering in this application.

[0024] In this embodiment, the security risk detection method based on large models and prompt word engineering includes the following steps: Step S10: Obtain real-time data from the industrial site, including equipment operating status data, personnel operation behavior data, and environmental parameter data; Step S20: Based on the historical business data, user behavior data and equipment attribute data of the industrial site, construct a multi-dimensional user profile, which includes: scenario characteristics, behavioral characteristics and risk preferences.

[0025] Step S30: Call the historical safety risk event database of the industrial site, perform incremental learning on the real-time data, and update the risk scenario database in the multi-dimensional user profile to generate the target user profile.

[0026] Step S40: Based on the scene features in the target user profile and the risk patterns in the historical records, dynamically adjust the weight allocation of the large model and the small model through a reinforcement learning algorithm; Step S50: Based on the scenario features and risk preferences in the target user profile, generate personalized prompt word templates to guide the large model to focus on key risk features.

[0027] Step S60: Use a small model to perform preliminary annotation on real-time data, combine the annotated data with the large model, and perform deep security detection using prompt word templates; Step S70: Trigger the graded response mechanism based on the risk level of the detection results.

[0028] Traditional security risk monitoring technologies face several key challenges in complex scenarios such as industrial sites, including insufficient scenario adaptability, low data utilization efficiency, a conflict between real-time performance and accuracy, significant security risks associated with large-scale models, and lagging response mechanisms. Specifically, existing user profiles are static and lack dynamic response capabilities; model weights are fixed and cannot be dynamically optimized; prompts have weak generalization capabilities, making it difficult to adapt to scenario characteristics and risk preferences; and response mechanisms are coarse-grained, failing to differentiate between risk levels and handling priorities, leading to delays in addressing critical risks.

[0029] In response, this embodiment proposes a security risk detection method based on large model and prompt word engineering. This method is applied to industrial sites and includes: Acquire real-time data from industrial sites, including equipment operating status data, personnel operation behavior data, and environmental parameter data; Based on historical business data, user behavior data, and equipment attribute data of industrial sites, a multi-dimensional user profile is constructed, which includes: scenario characteristics, behavioral characteristics, and risk preferences. The historical safety risk event database of the industrial site is called up, and incremental learning is performed on real-time data to update the risk scenario database in the multi-dimensional user profile to generate the target user profile. Based on the scenario characteristics in the target user profile and the risk patterns in the historical records, the weight allocation between the large model and the small model is dynamically adjusted through reinforcement learning algorithms. Based on the scenario characteristics and risk preferences in the target user profile, personalized prompt word templates are generated to guide the large model to focus on key risk characteristics. Small models are used to perform preliminary annotation of real-time data. The annotated data is then combined with large models to perform deep security detection using prompt word templates. A tiered response mechanism is triggered based on the risk level of the test results.

[0030] For ease of understanding, the following explains some key terms in this embodiment: Industrial sites refer to various industrial production, processing, and storage sites, such as chemical plants, steel plants, and energy bases. They are characterized by complex environments, dense equipment, diverse personnel activities, and potential safety risks.

[0031] Real-time data refers to data continuously collected and immediately available during the operation of industrial sites through various sensors, monitoring equipment, and operation logs. This real-time data specifically includes equipment operating status data, such as equipment temperature, pressure, and speed; personnel operational behavior data, such as personnel movement trajectories, operating instructions, and abnormal behaviors; and environmental parameter data, such as ambient temperature, humidity, and harmful gas concentrations. This data forms the basis for safety risk detection.

[0032] Multi-dimensional user profiling refers to a digital model that comprehensively reflects the characteristics of users (including personnel, equipment, and areas) by comprehensively analyzing historical business data, user behavior data, and equipment attribute data of industrial sites. This user profile includes scenario characteristics, such as area type and equipment layout; behavioral characteristics, such as operating habits and abnormal behavior patterns; and risk preferences, such as sensitivity to specific risks and priority of handling them.

[0033] Incremental learning is a machine learning paradigm characterized by the ability of a model to continuously learn from new data and update its knowledge without retraining the entire historical dataset. In this embodiment, incremental learning is used to update the risk scenario library in a multi-dimensional user profile to adapt to the ever-changing security situation at industrial sites.

[0034] Reinforcement learning algorithms are a type of machine learning method characterized by an agent learning optimal policies through interaction with its environment, based on reward or penalty signals. In this embodiment, the reinforcement learning algorithm is used to dynamically adjust the weight allocation between the large and small models to optimize the performance of security detection.

[0035] Large models refer to pre-trained models with massive parameters and strong generalization capabilities, such as large language models or multimodal models. Their characteristics include the ability to understand complex contexts and perform advanced reasoning. Small models refer to models with relatively small parameters and high computational efficiency. Their characteristics include suitability for edge deployment and the ability to perform fast, preliminary data processing and feature extraction.

[0036] Personalized prompt templates refer to text instructions or query structures customized based on specific scenario characteristics and risk preferences to guide large-scale models in handling specific tasks. These templates aim to enable large-scale models to more accurately focus on key risk characteristics within industrial sites.

[0037] A tiered response mechanism refers to triggering different levels and types of response measures based on the risk level determined by safety risk detection results. This mechanism aims to achieve differentiated and refined management of different risks, avoiding a "one-size-fits-all" response approach.

[0038] This embodiment provides a security risk detection method based on large models and prompt word engineering, and its specific implementation process is as follows: First, acquire real-time data from the industrial site. This real-time data can be collected in various ways, such as through manual inspection records, periodic sensor reports, or periodic captures from video surveillance systems. This data covers multiple aspects, including equipment operating status, personnel operation behavior, and environmental parameters, providing foundational information for subsequent risk analysis. For example, equipment operating status data may include error codes in equipment logs or simple indicator light statuses; personnel operation behavior data may include access control card swipe records or simple location check-in information; environmental parameter data may include temperature and humidity readings obtained through manual measurement or fixed sensors.

[0039] Secondly, based on historical business data, user behavior data, and equipment attribute data from industrial sites, multi-dimensional user profiles are constructed. These profiles can be built using traditional data statistics and aggregation methods. For example, by classifying and summarizing historical business data, the business types of different areas can be identified; by frequency statistics of user behavior data, the areas where personnel frequently operate can be identified; and by summarizing equipment attribute data, the types and basic functions of equipment can be identified. This allows for the formation of preliminary user profiles that include scenario characteristics, behavioral characteristics, and risk preferences. For instance, a certain area can be labeled as a "production area," an employee can be labeled as an "operator," and a "general risk" preference can be assigned based on their historical records.

[0040] Furthermore, the historical safety risk event database of industrial sites is accessed to incrementally learn from real-time data, updating the risk scenario database within the multi-dimensional user profile to generate the target user profile. In this process, a simple rule-matching method can be used for incremental learning. For example, when keywords in the real-time data resemble the description of an event in the historical event database, the risk characteristics of that event are added to the risk scenario database of the user profile. This update method allows the user profile to gradually adapt to new risk situations, thus forming a more timely target user profile.

[0041] Based on this, and according to the scene features in the target user profile and the risk patterns in the historical records, the weight allocation of the large and small models is dynamically adjusted using a reinforcement learning algorithm. This weight adjustment can be based on a preset fixed reward function. For example, when a risk event is detected, if both the large and small models make correct judgments, they are given the same reward; if only one model is correct, it is given a higher reward. Through multiple iterations, the reinforcement learning algorithm can gradually optimize the model's weight allocation, enabling it to exhibit better detection performance in different scenarios.

[0042] Subsequently, based on the scenario characteristics and risk preferences in the target user profile, personalized prompt word templates are generated to guide the large model to focus on key risk features. These prompt word templates can be generated using predefined template filling methods. For example, based on scenario characteristics (such as "high-temperature area") and risk preferences (such as "high risk sensitivity"), "Please pay close attention to abnormal temperature changes in high-temperature areas" can be directly selected from a pre-defined template library as the prompt word. This approach enables the large model to focus on risk points related to the current scenario and user preferences when processing real-time data.

[0043] Next, a small model is used to initially label the real-time data. This labeled data is then combined with the large model for deep security detection using prompt word templates. The small model can employ a threshold-based rule engine or a simple classifier to quickly filter and initially label the real-time data. For example, when sensor data exceeds a preset threshold, the small model marks it as "abnormal"; when a specific color or shape appears in the video frame, the small model marks it as "potential risk." Subsequently, this initially labeled data, along with the prompt word templates, is input into the large model, which performs deeper semantic understanding and risk inference, thereby completing the deep security detection.

[0044] Finally, a tiered response mechanism is triggered based on the risk level of the test results. This mechanism can employ a simple hierarchical judgment logic. For example, when the test result is "low risk," only internal recording is performed; when the test result is "medium risk," an email notification is sent to the relevant personnel; and when the test result is "high risk," an emergency plan is activated, such as issuing an alarm through the broadcast system. This mechanism ensures that appropriate measures can be taken for events with different risk levels.

[0045] This embodiment acquires real-time data from industrial sites to construct and dynamically update multi-dimensional user profiles, achieving accurate capture of scene features, behavioral characteristics, and risk preferences. By dynamically adjusting the weights of the large and small models using reinforcement learning algorithms, and combining personalized prompt word templates to guide the large model to focus on key risks, it effectively solves the problems of static user profiles, fixed model weights, and weak generalization ability of prompt words in traditional methods. Therefore, it can perform in-depth detection of complex security risks in industrial sites and trigger graded responses based on risk levels, improving the real-time performance, accuracy, and scene adaptability of security risk monitoring, and avoiding the problem of coarse-grained response mechanisms.

[0046] In some of the embodiments described above, a method for constructing multi-dimensional user profiles based on historical business data, user behavior data, and equipment attribute data of industrial sites is proposed. However, in practical applications, relying solely on this macro-level data may be insufficient to accurately capture the complex spatial risk distribution within industrial sites, real-time abnormal behavior of personnel, and the personalized risk sensitivities of different users. This could lead to limitations in the constructed user profiles regarding refined risk identification and early warning, affecting the accuracy and timeliness of subsequent safety inspections.

[0047] In response, this embodiment further proposes that the construction of the user profile includes: dividing high-risk areas, normal areas, and low-risk areas based on geofence data of industrial sites, equipment distribution heat maps, and historical accident records; using LSTM network analysis to identify abnormal stays and violations; and constructing a user sensitivity score for risk types through questionnaires and historical handling records.

[0048] Specifically, when constructing user profiles, the system first refines the internal space of the industrial site based on geofencing data, equipment distribution heatmaps, and historical accident records. Geofencing data precisely defines the boundaries of various areas within the site, such as hazardous materials storage areas, high-voltage equipment areas, and restricted access areas. Equipment distribution heatmaps visually display the density and distribution of various types of equipment within the site, with particular attention to areas with high-risk equipment concentrations. Combined with historical accident records, the system can identify specific locations where accidents are frequent or have severe consequences. By comprehensively analyzing this data, the entire industrial site can be divided into high-risk, conventional, and low-risk areas. For example, areas containing flammable and explosive materials, densely packed high-voltage equipment, and with numerous historical accident records are defined as high-risk areas; areas with frequent daily operations but relatively controllable risks are defined as conventional areas; and areas with sparse personnel activity, simple equipment, and no historical accidents are defined as low-risk areas. This classification method provides important scenario characteristics for user profiles, enabling risk assessment to have a clear spatial dimension.

[0049] Secondly, to more accurately capture personnel behavioral characteristics, this embodiment employs an LSTM network to analyze personnel movement trajectories to identify abnormal stays and violations. Personnel movement trajectory data can be acquired in various ways, such as through wearable positioning devices (e.g., GPS, RFID tags), Wi-Fi or Bluetooth positioning systems within the facility, or even through video surveillance systems for personnel tracking. As a deep learning model adept at processing sequential data, the LSTM network can learn and memorize normal movement patterns, dwell times, and path regularities of personnel in different areas. Through continuous analysis of real-time personnel movement trajectories, the LSTM network can detect behaviors that significantly deviate from normal patterns, such as prolonged lingering in non-working areas (abnormal stays) or unauthorized entry into high-risk areas (violations). This dynamic behavioral analysis greatly enriches the behavioral feature dimensions of user profiles, enabling them to reflect real-time risk performance of personnel in specific scenarios.

[0050] Furthermore, to construct a user sensitivity score for risk types, this embodiment employs a comprehensive evaluation using questionnaires and historical response records. Questionnaires can be designed for employees in different positions, inquiring about their perception, level of concern, and perceived urgency of various potential risk events (such as equipment failure, chemical leaks, operational errors, etc.). These subjective responses reflect the risk preferences of individuals or groups. Simultaneously, combining historical response records—such as employees' reporting behavior, response speed, measures taken, and final outcomes when facing safety incidents or hazards—allows for an objective assessment of their risk awareness and coping capabilities. By quantitatively analyzing and integrating questionnaire results with historical response records, a sensitivity score for different risk types can be generated for each user or user group. This score will serve as part of the user profile's risk preference, used for subsequent adjustments to personalized risk alerts and response mechanisms.

[0051] Through the aforementioned technical solutions, this embodiment, in constructing multi-dimensional user profiles, is no longer limited to macroscopic historical data. Instead, by introducing geofence data, equipment distribution heatmaps, and historical accident records, it achieves a refined classification of spatial risks in industrial sites, providing precise geospatial dimensions for scene features. Simultaneously, real-time analysis of personnel movement trajectories using LSTM networks dynamically identifies abnormal stays and violations, significantly improving the real-time performance and accuracy of user profiles in terms of behavioral characteristics. Furthermore, by constructing user sensitivity scores for risk types through questionnaires and historical handling records, user profiles can reflect the risk preferences of individuals or groups, providing crucial information for subsequent personalized prompt generation and tiered response mechanisms. This more comprehensive, refined, and dynamic user profile construction method significantly enhances the perception and identification accuracy of safety risk detection methods for complex risks in industrial sites. This allows for more effective guidance of large models to focus on key risk characteristics and trigger more precise and personalized tiered response mechanisms, ultimately improving the overall safety management level of industrial sites.

[0052] In some of the above implementations of this embodiment, although it is proposed to call the historical security risk event database to perform incremental learning on real-time data to update user profiles, if only simple incremental learning is performed, it may be difficult to deeply explore the complex risk patterns and their propagation rules contained in historical events. This may result in the inability to effectively identify potential risk scenarios that are highly related to historical events when faced with real-time data, thereby affecting the accuracy of security detection and the timeliness of response.

[0053] To address this, this embodiment further proposes a step for deep integration of historical records. Specifically, this step first includes storing structured data of historical safety events at industrial sites and associating it with spatiotemporal coordinates. Structured data refers to data with a well-defined data model and an easy-to-query and analyze format, such as tabular data in a relational database. Its fields may cover event type, occurrence time, location (e.g., specific equipment, area), involved personnel, event description, handling process, and loss assessment. Associating with spatiotemporal coordinates means binding each historical event with precise timestamps and geographic location information (e.g., GPS coordinates, equipment ID, area code, etc.), which provides a foundation for subsequent analysis of event occurrence patterns, propagation paths, and correlations with specific spatiotemporal environments. In implementation, this can be done through a database management system (e.g., SQL database, NoSQL database), ensuring that timestamps and location information are forcibly included during data entry.

[0054] Building upon this foundation, this embodiment utilizes the Apriori algorithm to mine risk patterns and generate a risk propagation graph. As a classic association rule mining algorithm, the Apriori algorithm analyzes historical security event data to identify combinations of events that frequently occur simultaneously or in a specific sequence—i.e., risk patterns. For example, in a specific area, equipment failure is often accompanied by personnel misconduct. The risk propagation graph graphically displays these mined risk patterns, where nodes can represent event types, equipment states, or personnel behaviors, and edges represent the correlations or causal relationships between them, as well as the probability of risk evolving from one event or state to another, thus intuitively revealing the evolution path of risks and potential chain reactions. In specific implementation, the historical event data is first preprocessed, converting it into an item set format suitable for the Apriori algorithm's input; then, the Apriori algorithm is run, discovering frequent itemsets and association rules by setting minimum support and minimum confidence thresholds; finally, a graph is constructed based on these rules, and displayed, for example, using a graph database (such as Neo4j) or a graph visualization tool.

[0055] Furthermore, when real-time data matches historical risk patterns, the system will automatically increase the detection weight of the corresponding scenario. Matching real-time data with historical risk patterns means that when real-time monitoring data from industrial sites (such as equipment operating parameters, personnel behavior trajectories, environmental sensor readings, etc.) exhibits characteristics similar to or consistent with historical risk patterns mined through the Apriori algorithm, then when real-time data detects "equipment A overload," it is considered a match to that risk pattern. Automatically increasing the detection weight of the corresponding scenario means that in subsequent safety detection processes, scenarios related to the matched risk pattern (e.g., smoke detection in area B, overload detection of equipment A) will be given higher priority or stricter detection thresholds. This ensures that the system is more sensitive and alert in potential risk scenarios, effectively reducing false negatives. This can be achieved by introducing a dynamic weight adjustment module into the detection logic of either the large or small model. When real-time data triggers a historical risk pattern, the module will increase the weight of relevant detection features or adjust the model's decision threshold according to preset rules or algorithms (e.g., based on the confidence or severity of the risk pattern) to make it easier to identify anomalies related to the pattern.

[0056] Through the above technical solution, this embodiment provides a high-quality, traceable data foundation for subsequent risk analysis by storing structured data of historical safety events at industrial sites and associating them with spatiotemporal coordinates. Based on this, the Apriori algorithm is used to deeply mine the association rules and frequent patterns in historical events, revealing potential, non-obvious risk propagation paths and evolution patterns, and generating intuitive risk propagation maps. This compensates for the shortcomings of simple incremental learning in understanding complex risk mechanisms. When real-time data matches these historical risk patterns, the system can automatically increase the detection weight of the corresponding scenario. This enables the safety detection system to more sensitively and accurately identify potential threats when facing situations similar to historical high-risk events, effectively reducing the false negative rate and providing more targeted focus points for subsequent large-scale model deep detection. This significantly improves the early warning capability and response efficiency of industrial site safety risk detection.

[0057] In some of the embodiments described above, a method for dynamically adjusting the weight allocation between the large and small models using reinforcement learning algorithms was proposed to adapt to the complex and ever-changing environment of industrial sites. However, in practical applications, simply adjusting the weights may face challenges. For example, how to ensure that the weight adjustments accurately reflect the true risk status of the current scenario, take into account the risk preferences of different users, and avoid frequent fluctuations in model weights that could lead to system instability or waste of computing resources.

[0058] To address this, this embodiment further proposes that the dynamic weight adjustment of the reinforcement learning algorithm includes: calculating the scene risk value through a Bayesian network and classifying the risk level; dynamically adjusting the model weights using the Q-learning algorithm based on the risk level and the risk preference in the user profile; and stopping the iteration when the detection accuracy fluctuation after three consecutive weight adjustments is ≤1%.

[0059] To more accurately assess the current risk status of an industrial site, this embodiment employs a Bayesian network to calculate the scenario risk value. A Bayesian network is a probabilistic graphical model capable of effectively representing and inferring conditional dependencies between random variables. Specifically, a Bayesian network can be constructed, containing real-time data nodes representing equipment operating status data, personnel operation behavior data, and environmental parameter data, as well as intermediate nodes representing different risk events (such as equipment failure, unauthorized operation, and environmental anomalies), ultimately connected to nodes representing the scenario risk level. By inputting real-time equipment operating status data, personnel operation behavior data, and environmental parameter data as evidence, the Bayesian network can calculate the posterior probability of the current scenario being at different risk levels (e.g., low risk, medium risk, high risk, and extremely high risk) according to a preset conditional probability distribution. Based on these probabilities, the system can classify the current scenario into specific risk levels according to preset thresholds or expert experience rules, thereby providing a quantitative risk assessment result with consideration of uncertainty.

[0060] After obtaining the accurate scene risk level, this embodiment further utilizes the Q-learning algorithm to dynamically adjust the weights of the large and small models. Q-learning is a model-free reinforcement learning algorithm whose core lies in learning an optimal action value function (Q-function) to guide the agent in choosing the optimal action given a state. In this scheme, the "state" can be jointly constituted by the current scene risk level (calculated by a Bayesian network) and the risk preference (e.g., conservative, balanced, aggressive) in the target user profile. For example, when the scene risk level is "high risk" and the user risk preference is "conservative," the Q-learning algorithm may learn an action that increases the weight of the large model for deeper and more comprehensive analysis, while appropriately reducing the weight of the small model to ensure detection accuracy and recall. Conversely, if the scene risk level is "low risk" and the user risk preference is "aggressive," it may learn another action that increases the weight of the small model to improve detection efficiency, while appropriately reducing the weight of the large model. By continuously interacting with the environment and receiving reward signals (e.g., based on metrics such as detection accuracy, false positive rate, and false negative rate), the Q-learning algorithm can gradually learn and optimize the model weight adjustment strategy, enabling it to achieve optimal detection performance under different risk scenarios and user preferences.

[0061] To ensure the stability and efficiency of the weight adjustment process, this embodiment introduces a convergence judgment mechanism. After each adjustment of the model weights by the Q-learning algorithm, the system evaluates the detection accuracy of the current model. Subsequently, the system continuously monitors the fluctuation of the detection accuracy after three consecutive weight adjustments. Here, "fluctuation" can be defined as the maximum percentage difference between the three consecutive accuracy values. If the fluctuation of these three accuracy values ​​is less than or equal to a preset threshold (e.g., 1%), the model weights are considered to have reached a relatively stable optimization state. At this point, the reinforcement learning iteration process will be paused or stopped. This mechanism effectively avoids unnecessary and frequent adjustments to the model weights after they have reached the optimal or suboptimal state, thereby saving computational resources, improving the system's operating efficiency and stability, and preventing overfitting.

[0062] Through the above technical solution, this embodiment can manage the weight allocation between large and small models more precisely. First, a Bayesian network is used to quantitatively assess and classify scenario risks, providing accurate risk context information for subsequent weight adjustments. Second, the Q-learning algorithm combines this refined risk level with risk preferences from user profiles, making model weight adjustments no longer blind but intelligently adaptable to the current risk situation and the user's personalized needs, thus achieving more targeted and efficient security risk detection. For example, in high-risk scenarios, the system can intelligently favor the deep analysis capabilities of the large model, while in low-risk scenarios, it may emphasize the rapid response of the small model. Finally, by setting convergence conditions for detection accuracy fluctuations, unnecessary iterations of model weights after reaching a stable state are effectively avoided, significantly improving the system's operating efficiency and stability, ensuring the accuracy and reliability of security detection in dynamic industrial environments, and optimizing the utilization of computing resources.

[0063] In some of the embodiments described above, a personalized prompt word template is proposed to be generated based on scene features and risk preferences in the target user profile, in order to guide the large model to focus on key risk features. However, in practical applications, if the generation of prompt word templates lacks detailed consideration of specific scenarios, effective differentiation of the urgency of risk events, and a timely response mechanism to user feedback, the large model may fail to accurately capture all potential risks in complex and ever-changing industrial site environments, or misjudge the priority of risks, thereby affecting the efficiency and accuracy of safety detection.

[0064] In response, this embodiment further proposes that the generation of the personalized prompt word template includes: generating corresponding prompt words according to the characteristics of the industrial site scenario; adding urgency indicators to high-risk events based on the sensitivity score in the user profile; and adjusting the keyword weight of the prompt words based on user feedback.

[0065] Specifically, generating corresponding prompts based on the characteristics of industrial site scenarios means that the system deeply analyzes the operating environment, equipment type, environmental conditions, and common safety procedures of a specific industrial site. For example, for a chemical plant, the system might generate prompts related to "leak detection," "toxic gas," and "abnormal pressure"; while for a power plant, it might focus on "overload," "short circuit," and "equipment overheating." This generation process can utilize Natural Language Processing (NLP) technology to extract keywords from site-specific safety manuals, operation logs, and historical accident reports, and organize these keywords into prompt phrases or sentences highly relevant to the scenario characteristics in the target user profile. This aims to ensure that the large model receives highly contextualized instructions, avoiding interference from irrelevant information, thereby improving its ability to identify risks in specific environments.

[0066] Based on the sensitivity scores in user profiles, urgency level indicators are added to high-risk events. This means that the "risk preference" or "sensitivity score" included in the user profile reflects the level of importance that site operators or management attach to specific types of risks. For example, if a site has extremely low tolerance for fire hazards, the sensitivity score for fire-related events will be very high. When the system identifies a potential high-risk event (such as detecting a gas leak), this feature ensures that the generated prompt template includes a clear "urgency level indicator," such as "[Urgent]", "[High Risk]", or "[Immediate Action]". This indicator serves as a meta-instruction of the larger model, instructing it to prioritize any detection results related to this event type and potentially trigger a more immediate or more severe response. This can be achieved by mapping sensitivity scores to predefined urgency levels and embedding the corresponding urgency labels directly into the prompt string.

[0067] Adjusting keyword weights in alert phrases based on user feedback refers to the feedback provided by human operators or security managers to the detection results after large-scale model testing. This feedback might include whether the detected risks were false positives or false negatives, or whether the alert phrases led to accurate but poorly prioritized detections. This feedback is then used to adjust the "keyword weights" in the alert phrase template. For example, if a particular keyword consistently leads to false positives, its weight might be reduced; conversely, if a keyword is crucial for detecting frequently overlooked risks, its weight might be increased. This adjustment can be achieved through various machine learning techniques, such as reinforcement learning (where user feedback acts as a reward signal) or simple statistical updates, ensuring that the alert phrase templates evolve and improve their effectiveness over time, making the detection process more accurate and aligned with actual operational needs.

[0068] Through the above technical solutions, this embodiment can significantly improve the accuracy and response efficiency of the large-scale model in industrial site safety risk detection. First, corresponding prompt words are generated based on the characteristics of the industrial site scenario, ensuring the high contextualization and relevance of the prompt word templates. This prevents the large-scale model from becoming distracted by information overload in complex environments, allowing it to more effectively focus on key risk characteristics in specific scenarios. Second, urgency indicators are added to high-risk events based on sensitivity scores in user profiles, enabling the large-scale model to simultaneously consider the potential harm and priority when identifying risks. This clearly distinguishes risk levels in the detection results, providing a more accurate basis for subsequent graded response mechanisms. Finally, the keyword weights of the prompt words are adjusted based on user feedback, introducing a continuous learning and optimization mechanism. This allows the prompt word templates to dynamically iterate based on actual operating results and human experience, effectively solving the problem of potential initial biases or insufficient adaptability in the prompt word templates. This ensures that the safety detection system can continuously optimize as the industrial site environment changes and user needs evolve, ultimately achieving more intelligent and reliable safety risk warning and management.

[0069] In some of the embodiments described above, a method was proposed to use a small model to initially label real-time data and then combine the labeled data with a large model to perform deep security detection using prompt word templates. However, in actual industrial site environments, the amount of real-time data is massive and complex. The results of the initial labeling by the small model may contain a large amount of non-critical information or have limited accuracy in identifying key small targets. If these initial labeling results are directly input into the large model, it may cause the large model to become distracted during processing, making it difficult to efficiently and accurately focus on the real risk features, thereby affecting the efficiency and accuracy of deep security detection.

[0070] To address this, this embodiment further proposes a method for combining small and large models, including: using a lightweight CNN to detect small objects in the sampled images and outputting bounding box coordinates and confidence scores; inputting the bounding boxes output by the small model into the large model and extracting local features through RoI Align; and converting personalized prompts into input masks to guide the attention mechanism to focus on key regions.

[0071] Specifically, to efficiently process real-time video stream data from industrial sites, a lightweight convolutional neural network (CNN) can be used to quickly analyze frames extracted from the video stream. This lightweight CNN is designed with a small model size and low computational complexity; architectures such as MobileNet, ShuffleNet, or EfficientNet-Lite can be employed to meet the stringent real-time and resource consumption requirements of industrial environments. Its main function is to identify various small objects that may be present in the image, such as tools scattered on the ground, abnormally stacked materials, specific safety equipment worn by personnel, or unauthorized small objects. The detection results are output as bounding box coordinates, accurately indicating the location and size of the detected small objects in the image, along with a confidence score indicating the reliability of the detection results.

[0072] Building upon this foundation, to enable the large model to perform more refined analysis of potential risk regions initially detected by the small model, the bounding box coordinates output by the small model are input into the large model as guiding information. The large model then utilizes these bounding boxes to precisely extract local features corresponding to these bounding boxes from the original image or its corresponding feature map through Region Alignment (RoI Align) operations. RoI Align technology avoids the spatial misalignment problem caused by quantization operations in traditional RoI Pooling, ensuring that the extracted local features maintain a precise spatial correspondence with the original image regions. This provides the large model with high-quality, lossless local contextual information for deeper semantic understanding and risk assessment.

[0073] Meanwhile, to further enhance the targeting and efficiency of the large-scale model in deep security detection, personalized prompt word templates generated based on scene features and risk preferences in the target user profile are converted into input masks. This conversion process may include semantic parsing of the prompt words to identify the key risk types, objects, or behaviors they contain, and mapping them to specific regions or feature dimensions in the image feature space. For example, if the prompt word indicates "detect risk of falling objects from heights," the mask will guide the large-scale model's attention mechanism to focus more on the upper region of the image or features related to falling objects. This input mask will serve as prior knowledge, acting on the large-scale model's attention mechanism, enabling the large-scale model to selectively enhance its attention to regions or features highly relevant to the personalized prompt word content when processing local features extracted by RoI Align. This effectively filters out irrelevant information, ensuring that the large-scale model can accurately focus on key risk features for in-depth analysis.

[0074] Through the above technical solution, this embodiment effectively solves the problem of insufficient information transmission efficiency and accuracy between the preliminary annotation results of the small model and the deep detection of the large model in the complex environment of industrial sites. First, using a lightweight CNN for small object detection in frame-sliced ​​images can quickly identify potential risk targets with low computational cost and provide accurate bounding box coordinates and confidence scores, laying the foundation for subsequent deep analysis. Second, by inputting the bounding boxes output by the small model into the large model and using RoI Align technology to extract local features, it ensures that the feature information obtained from the preliminary detection area is of high quality and spatially aligned, avoiding information loss and bias, and enabling the large model to obtain accurate local context. More importantly, personalized prompts are converted into input masks, which guide the attention mechanism of the large model to focus on key areas. This allows the large model to purposefully filter and strengthen the processing of specific risk information based on specific scene characteristics and risk preferences when performing deep security detection, greatly improving the accuracy and efficiency of the large model in identifying risks. This combination not only enhances the system's ability to perceive subtle risks, but also enables large models to more effectively utilize their powerful semantic understanding capabilities, avoiding blind searching in massive amounts of data, thereby significantly improving the overall performance and reliability of industrial site safety risk detection.

[0075] In some of the above embodiments of this example, although large model and prompt word engineering can be used to conduct in-depth detection of safety risks in industrial sites and generate risk levels, simply obtaining risk levels without a systematic and differentiated response mechanism may lead to untimely or inappropriate handling of risk events, or even cause unnecessary losses or waste of resources, and fail to effectively cope with the complex and ever-changing safety challenges of industrial sites.

[0076] In response, this embodiment further proposes a hierarchical response mechanism, which includes: pushing text alarms to user terminals and recording violations; triggering pop-up reminders on management terminals and simultaneously activating edge computing nodes to perform localized handling; sending structured events to the emergency platform and automatically activating the sprinkler system in conjunction with the fire protection system.

[0077] Specifically, the tiered response mechanism refers to taking different levels and intensities of response measures based on the severity or urgency of the detected security risks. Its purpose is to ensure that risk events are handled promptly and appropriately, avoiding overreaction or underreaction, thereby optimizing resource allocation and improving emergency response efficiency.

[0078] Pushing text alerts to user terminals and recording violations refers to the system sending alert information to the mobile devices or fixed terminals of relevant operators, inspectors, or managers via SMS, app notifications, or in-app messages when low-risk or specific violations are detected. Text alerts typically include the risk type, time and location of occurrence, and preliminary recommendations. Recording violations involves storing detailed information about such events, such as the perpetrator, time, location, behavior description, and alert content, in a database for subsequent tracing, analysis, and statistics, providing data support for updating user profiles or adjusting security policies.

[0079] Triggering a pop-up alert on the management terminal and simultaneously initiating localized response from edge computing nodes refers to the mandatory display of alarm information in the form of a pop-up window on the computer terminals of monitoring centers or relevant management personnel when a medium-risk event or event requiring management intervention is detected. This ensures that management personnel can notice and handle the situation promptly. The pop-up window typically includes a more detailed risk description and suggested actions. Simultaneously, initiating localized response from edge computing nodes means automatically executing preset emergency procedures on edge computing devices near the risk location. For example, when an equipment malfunction is detected, the edge node can immediately adjust equipment parameters, close specific valves, or activate a localized cooling system, without waiting for instructions from the cloud, thereby shortening response time and improving efficiency.

[0080] Sending structured events to the emergency platform and triggering the automatic activation of sprinkler systems in conjunction with the fire suppression system refers to the system sending event information in a predefined, machine-readable format (such as JSON or XML) to the central emergency management platform at the industrial site when a high-risk or emergency safety event is detected. Structured event information typically includes the event ID, risk level, time of occurrence, precise location, involved equipment, and suggested response plan. Triggering the automatic activation of sprinkler systems in conjunction with the fire suppression system means that upon receiving a high-risk event (such as a fire), the emergency platform automatically triggers control commands integrated with the fire suppression system based on the event type and location information. These commands may include activating automatic sprinkler systems in specific areas, sounding alarms, or cutting off relevant power supplies, to achieve rapid and autonomous initial fire suppression or spread control, minimizing losses.

[0081] Through the aforementioned tiered response mechanism, this embodiment can automatically match and execute the most appropriate response measures based on the detected security risk level. For low-risk events, by pushing text alerts to user terminals and recording violations, timely reminders to operators and effective traceability of behavior are achieved, avoiding resource waste. For medium-risk events, pop-up reminders are triggered on management terminals and edge computing nodes are activated for localized handling, significantly shortening response time and improving the efficiency and accuracy of on-site handling. For high-risk events, by sending structured events to the emergency platform and automatically activating the sprinkler system in conjunction with the fire protection system, a rapid and automated emergency response is achieved, minimizing losses caused by accidents and ensuring the overall safety and operational continuity of industrial sites. This multi-layered, intelligent response system effectively solves the problems of insufficient or excessive response that may occur under a single response mode, improving the level of precision in security risk management.

[0082] The following example will provide a more detailed explanation of the above technical solution: In a large industrial production site, real-time and accurate detection and response to safety risks during the production process are required. This site is equipped with various sensors, high-definition cameras, and personnel positioning systems.

[0083] First, the system continuously acquires real-time data from the industrial site. This data includes operating status data of production equipment (e.g., pressure, temperature, speed), movement trajectories and operational behavior data of personnel in different areas (e.g., entering restricted areas, not wearing safety helmets), and environmental parameter data (e.g., toxic gas concentration, smoke, flame).

[0084] Simultaneously, the system constructs a multi-dimensional user profile based on the industrial site's historical business data (e.g., production plans, bills of materials), historical user behavior data (e.g., personnel inspection records, operation logs), and equipment attribute data (e.g., equipment model, maintenance cycle, safety specifications). This user profile includes scenario characteristics (e.g., the hazard levels of different areas within the site, dividing the site into high-risk, normal, and low-risk areas through geofencing data, equipment distribution heatmaps, and historical accident records), behavioral characteristics (e.g., analyzing personnel movement trajectories through LSTM networks to identify abnormal stays and violations, such as prolonged lingering in hazardous chemical storage areas), and risk preferences (e.g., constructing sensitivity scores for different managers to specific risk types through questionnaires and historical handling records).

[0085] Subsequently, the system accesses the historical safety risk event database of the industrial site. This database stores structured data of historical safety events and associates them with the time and spatial coordinates of the events. The system performs incremental learning on real-time data. For example, when a new abnormal pattern is detected in real time (such as a precursor to equipment failure), it compares it with historical events and updates the risk scenario database of multi-dimensional user profiles, thereby generating a dynamic target user profile. For instance, when real-time data matches a risk pattern mined from historical records using the Apriori algorithm (e.g., a risk propagation map of an accident caused by the simultaneous occurrence of specific equipment overload and personnel misoperation), the system automatically increases the detection weight of the corresponding scenario.

[0086] Based on the scene characteristics of the target user profile (e.g., the current detection area is a high-risk area) and historical risk patterns, the system dynamically adjusts the weight allocation of the large and small models using reinforcement learning algorithms. For example, a Bayesian network is used to calculate the risk value of the current scene and classify the risk level. Based on this risk level and the user's risk preferences (e.g., a manager has a high sensitivity to the risks of high-risk areas), the system uses a Q-learning algorithm to dynamically adjust the weights of the large and small models. When the detection accuracy fluctuates within a preset threshold range after multiple consecutive weight adjustments, the iteration stops to ensure that the model weights are in an optimized state. This dynamic adjustment mechanism avoids the limitations of traditional fixed weight allocation and can optimize detection resources according to the actual risk situation and user concerns.

[0087] Next, the system generates personalized prompt word templates based on the scenario characteristics of the target user profile (e.g., the current detection area is a hazardous chemical storage area) and risk preferences (e.g., risk events in this area require the highest priority processing). For example, prompt words such as "detecting hazardous chemical leaks, personnel violations, and abnormal smoke" are generated based on the scenario characteristics of a hazardous chemical storage area. Based on the user profile's sensitivity score, high-risk events (such as hazardous chemical leaks) are marked with "Urgency Level: High". These personalized prompt word templates guide the large model to focus on the key risk characteristics of the current scenario, improving the targeting of the large model's detection and solving the problem of weak generalization ability of traditional prompt words.

[0088] During the detection phase, the system utilizes a small model to perform preliminary annotation of real-time data. For example, for video stream data, a lightweight CNN is used to detect small objects in extracted frames, outputting bounding box coordinates and confidence scores for abnormal states of people and equipment (such as valves opening abnormally). Subsequently, the bounding boxes output by the small model are input into a large model, and local features are extracted using RoI Align. Simultaneously, personalized prompts are converted into input masks, guiding the large model's attention mechanism to focus on key areas identified by the small model and risk features specified by the prompts, enabling deep security detection. This collaborative approach between the small and large models ensures both real-time performance and improved detection accuracy, overcoming the contradiction of limited computing resources and high inference latency faced by traditional single-model deployments at the edge.

[0089] Finally, based on the risk level of the detection results, the system triggers a tiered response mechanism. For example, for low-risk events (such as personnel briefly and abnormally staying in a non-high-risk area), the system pushes a text alarm to the user terminal and records the violation. For medium-risk events (such as slightly exceeding equipment parameters), the system triggers a pop-up reminder on the management terminal and simultaneously activates edge computing nodes to perform localized handling (e.g., adjusting equipment operating parameters). For high-risk events (such as detecting a fire or toxic gas leak), the system sends a structured event to the emergency platform and automatically activates the sprinkler system in conjunction with the fire protection system. This tiered response mechanism avoids the traditional "one-size-fits-all" alarm approach, ensuring that critical risks are addressed promptly and with priority, thus improving response efficiency.

[0090] Through the above process, this method enables dynamic and accurate detection and graded response to safety risks in industrial sites, effectively solving problems such as static user profiles, fixed model weights, weak generalization ability of prompt words, and coarse-grained response mechanisms, and significantly improving the overall safety management level of industrial sites.

[0091] Furthermore, embodiments of this application also propose a computer-readable storage medium storing a program for security risk detection based on large model and prompt word engineering. When the program for security risk detection based on large model and prompt word engineering is executed by a processor, it implements the steps of the security risk detection method based on large model and prompt word engineering described above.

[0092] Reference Figure 3 , Figure 3 This is a structural block diagram of the first embodiment of the security risk detection system based on large model and prompt word engineering in this application.

[0093] like Figure 3 As shown in the embodiments of this application, the security risk detection system based on large model and prompt word engineering includes: The data acquisition module 10 is used to acquire real-time data from the industrial site, including equipment operating status data, personnel operation behavior data, and environmental parameter data. The profile building module 20 is used to build a multi-dimensional user profile based on historical business data, user behavior data and equipment attribute data of industrial sites. The user profile includes: scenario characteristics, behavioral characteristics and risk preferences. The profile update module 30 is used to call the historical safety risk event library of the industrial site, perform incremental learning on real-time data, and update the risk scenario library in the multi-dimensional user profile to generate the target user profile. The weight allocation module 40 is used to dynamically adjust the weight allocation between the large model and the small model based on the scene features in the target user profile and the risk patterns in the historical records through a reinforcement learning algorithm. The prompt word module 50 is used to generate personalized prompt word templates based on the scenario features and risk preferences in the target user profile, guiding the large model to focus on key risk features; The detection module 60 is used to perform preliminary annotation of real-time data using a small model, combine the annotated data with a large model, and perform deep security detection through prompt word templates. Risk level module 70 is used to trigger a graded response mechanism based on the risk level of the detection results.

[0094] It should be understood that the above are merely illustrative examples and do not constitute any limitation on the technical solution of this application. In specific applications, those skilled in the art can make settings as needed, and this application does not impose any restrictions on this.

[0095] This embodiment effectively addresses the problems of incomplete coverage, insufficient adaptability, coarse granularity, contradiction between real-time and in-depth analysis, and weak cross-round defense in existing security mechanisms by receiving user input for preliminary security detection, constructing enhanced prompt word templates, performing risk reasoning analysis, implementing real-time auditing, and determining risk handling actions. Combined with the characteristics of the current usage environment and the strategy library, it has the advantages of improving the comprehensiveness of security coverage, enhancing dynamic adaptability, realizing refined risk handling, taking into account both real-time and in-depth analysis, and strengthening the ability to defend against cross-round attacks.

[0096] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this application. In practical applications, those skilled in the art can select some or all of it to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0097] In addition, for technical details not described in detail in this embodiment, please refer to the security risk detection method based on large model and prompt word engineering provided in any embodiment of this application, which will not be repeated here.

[0098] Furthermore, it should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0099] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0100] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of this application. The above are only preferred embodiments of this application and do not limit the patent scope of this application. All equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A security risk detection method based on large model and prompt word engineering, characterized in that, include: Acquire real-time data from industrial sites, including equipment operating status data, personnel operation behavior data, and environmental parameter data; Based on historical business data, user behavior data, and equipment attribute data of industrial sites, a multi-dimensional user profile is constructed, which includes: scenario characteristics, behavioral characteristics, and risk preferences. The historical safety risk event database of the industrial site is invoked, and incremental learning is performed on real-time data to update the risk scenario database in the multi-dimensional user profile to generate the target user profile. Based on the scenario features in the target user profile and the risk patterns in the historical records, the weight allocation between the large model and the small model is dynamically adjusted through reinforcement learning algorithms. Based on the scenario features and risk preferences in the target user profile, a personalized prompt word template is generated to guide the large model to focus on key risk features. Small models are used to perform preliminary annotation of real-time data. The annotated data is then combined with large models to perform deep security detection using prompt word templates. A tiered response mechanism is triggered based on the risk level of the test results.

2. The method according to claim 1, characterized in that, The construction of the user profile includes: Based on the geofence data, equipment distribution heat map and historical accident records of industrial sites, high-risk areas, normal areas and low-risk areas are divided. LSTM networks are used to analyze personnel movement trajectories and identify abnormal stops and violations. By using questionnaires and historical handling records, a user sensitivity score for risk types is constructed.

3. The method according to claim 1, characterized in that, The historical record fusion step includes: Store structured data of historical safety incidents at industrial sites and associate it with spatiotemporal coordinates; The Apriori algorithm is used to discover risk patterns and generate risk propagation maps. When real-time data matches historical risk patterns, the detection weight of the corresponding scenario is automatically increased.

4. The method according to claim 1, characterized in that, The dynamic weight adjustment of the reinforcement learning algorithm includes: Calculate the scenario risk value using a Bayesian network and classify the risk level. Based on risk levels and risk preferences in user profiles, the Q-learning algorithm is used to dynamically adjust model weights; The iteration stops when the detection accuracy fluctuation is ≤1% after three consecutive weight adjustments.

5. The method according to claim 1, characterized in that, The generation of the personalized prompt word template includes: Generate corresponding prompts based on the characteristics of the industrial site scenario; Based on the sensitivity scores in user profiles, add urgency indicators to high-risk events; Adjust the weight of suggestion keywords based on user feedback.

6. The method according to claim 1, characterized in that, The combination of the small model and the large model includes: Use a lightweight CNN to detect small objects in the sampled images and output bounding box coordinates and confidence scores; Input the bounding box output by the small model into the large model, and extract local features through RoI Align; Personalized prompts are converted into input masks to guide the attention mechanism to focus on key areas.

7. The method according to claim 1, characterized in that, The graded response mechanism includes: Send text alerts to user terminals and record violations; The management terminal pop-up notification is triggered, and the edge computing node is started to perform localized processing. A structured event is sent to the emergency platform, triggering the automatic activation of the sprinkler system in the fire protection system.

8. A security risk detection system based on large model and prompt word engineering, characterized in that, include: The data acquisition module is used to acquire real-time data from industrial sites, including equipment operating status data, personnel operation behavior data, and environmental parameter data. The user profile building module is used to build multi-dimensional user profiles based on historical business data, user behavior data, and equipment attribute data of industrial sites. The user profiles include: scenario characteristics, behavioral characteristics, and risk preferences. The profile update module is used to call the historical safety risk event library of industrial sites, perform incremental learning on real-time data, and update the risk scenario library in the multi-dimensional user profile to generate the target user profile. The weight allocation module is used to dynamically adjust the weight allocation between the large model and the small model based on the scene features in the target user profile and the risk patterns in the historical records through a reinforcement learning algorithm. The prompt word module is used to generate personalized prompt word templates based on the scenario features and risk preferences in the target user profile, guiding the large model to focus on key risk features; The detection module is used to perform preliminary annotation of real-time data using a small model, combine the annotated data with a large model, and perform deep security detection using prompt word templates. The risk level module is used to trigger a tiered response mechanism based on the risk level of the detection results.

9. A computer device, characterized in that, The device includes a memory and a processor, wherein the processor, when executing computer instructions stored in the memory, performs the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Includes instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 7.

Images