Weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold

Abstract

The invention relates to the technical field of meteorological support, and discloses a weather radar monitoring and fault diagnosis system based on an EAD algorithm and an adaptive threshold, and the system comprises a storage server, a system server, a database, and a client. The system server obtains original data from the storage server and analyzes the original data, and executes data cleaning, normalization and PCA feature extraction through a data processing module to generate feature vectors; the transmission monitoring module dynamically matches a body scanning period according to an observation mode to construct a self-adaptive threshold value, and accurately judges a data transmission timeout state; the anomaly detection module performs reasoning on the feature vectors by using an EAD model integrating an isolated forest, a KNN and an LOF so as to identify operation anomaly, and performs fault classification in combination with an SVM model; and the state monitoring module fuses the transmission and operation states according to the priority logic, and controls the client to render site icons with different colors on the electronic map. According to the invention, the problems of high false alarm of a fixed threshold and low diagnosis precision of a single model are solved.

Description

Technical Field

[0001] This invention relates to the field of meteorological support technology, specifically a weather radar monitoring and fault diagnosis system based on the EAD algorithm and adaptive threshold. Background Technology

[0002] The new generation of Doppler weather radar is a key piece of equipment for meteorological disaster early warning. Its system is complex, and troubleshooting is time-consuming. With the increase in automation, radar operation has evolved from a fixed mode to intelligent switching of observation modes. This dynamic mechanism has brought challenges to traditional monitoring technologies.

[0003] Existing monitoring technologies use fixed threshold logic based on time series, which is difficult to adapt to the dynamic changes in volume scan cycle and elevation angle when switching observation modes. This results in low monitoring accuracy, easy false alarms or missed alarms, and inability to achieve accurate monitoring down to the elevation angle level.

[0004] Meanwhile, existing methods often monitor data stream transmission separately from device hardware status, lacking effective information fusion and the ability to visualize and trace historical parameters. This makes it difficult for maintenance personnel to fully grasp the overall operation, and they cannot quickly review and analyze the correlation after a failure occurs, affecting troubleshooting efficiency.

[0005] Furthermore, in terms of fault diagnosis, existing systems have a low level of intelligence, relying on simple rules or single models and lacking in-depth mining of historical data. Their models have poor generalization ability, making it difficult to effectively identify anomalies when samples are scarce, and they cannot accurately locate faults to specific subsystems or components, thus failing to meet the needs of efficient operation and maintenance. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a weather radar monitoring and fault diagnosis system based on the EAD algorithm and adaptive thresholds. It solves the problems of low monitoring accuracy caused by the inability of traditional fixed threshold monitoring to adapt to dynamic switching of radar observation modes, low fault diagnosis efficiency caused by the disconnect between data transmission and equipment operating status information, and the poor generalization ability of existing single diagnostic models, which makes it difficult to accurately locate fault sources using historical data.

[0007] To achieve the above objectives, this invention provides the following technical solution: a weather radar monitoring and fault diagnosis system based on the EAD algorithm and adaptive thresholds, comprising a storage server, a system server, a database, and a client. The system adopts a layered architecture, with the storage server responsible for aggregating raw radar status files, and the system server responsible for data parsing, transmission monitoring, anomaly detection, and comprehensive status monitoring.

[0008] At the data processing level, the system performs deduplication and interpolation cleaning on the original data, and normalization is achieved by calculating the global extremum. Subsequently, using the PCA principal component analysis algorithm, the system constructs a covariance matrix and performs eigenvalue decomposition, selects eigenvectors that satisfy the cumulative variance contribution rate to construct a projection transformation matrix, and maps the high-dimensional data into low-dimensional eigenvectors for subsequent model use.

[0009] At the transmission monitoring level, the transmission monitoring module dynamically matches the volume scan cycle and the total number of elevation angles based on the observation mode field in the data to construct an adaptive threshold. Specifically, the theoretical cutoff time is obtained by calculating the sum of the volume scan start time, scan time, and buffer time. If the actual reception time is later than this time, it is judged as a timeout. At the same time, the timeliness statistics module calculates the transmission timeliness rate based on the actual and theoretical total number of elevation angles to be received, and supports automatic switching of seasonal assessment thresholds based on flood season time parameters.

[0010] At the fault diagnosis level, the anomaly detection module employs an Enhanced Aggregate Anomaly Detection (EAD) model, running three algorithms in parallel: Isolation Forest, K-Nearest Neighbors, and Local Outlier Factor. The normalized anomaly scores from these three algorithms are weighted and summed to obtain a comprehensive anomaly score, which is used to determine whether the radar is in an abnormal state. When an anomaly is detected, a Support Vector Machine (SVM) classification model is further utilized. The features are mapped to a high-dimensional space using a radial basis function kernel, outputting a fault classification label indicating the specific physical subsystem.

[0011] At the status display level, the status monitoring module integrates transmission status and abnormal operation status based on priority logic: when the radar operation is determined to be abnormal, the client is forced to render the site in red on the electronic map; only when the operation status is normal, the site is rendered in orange (timeout) or green (timely) according to the transmission status, thereby realizing intuitive visualization of monitoring information.

[0012] This invention provides a weather radar monitoring and fault diagnosis system based on the EAD algorithm and adaptive threshold. It has the following beneficial effects: 1. This invention analyzes the observation mode field through the transmission monitoring module, dynamically matches the volume scan cycle and the total number of elevation angles to construct an adaptive threshold, and solves the problem that traditional fixed threshold monitoring cannot adapt to the intelligent switching of the new generation weather radar observation mode (VCP). It refines the granularity of data transmission monitoring to the level of a single elevation angle, improves the accuracy of data stream monitoring under complex operating conditions, and avoids false alarms or missed alarms caused by mode switching.

[0013] 2. This invention adopts a diagnostic strategy that combines an Enhanced Anomaly Detection (EAD) model with a Support Vector Machine (SVM). It uses the feature vectors after PCA dimensionality reduction to drive three algorithms—Isolation Forest, KNN, and LOF—in parallel for weighted ensemble inference, thereby overcoming the shortcomings of insufficient generalization ability of a single detection model. It effectively identifies potential anomalies without the need for a large number of labeled samples, and further classifies the anomalies to specific physical subsystems through SVM, thus realizing an intelligent upgrade from anomaly detection to precise fault source localization.

[0014] 3. This invention constructs a priority-based status comprehensive judgment logic, deeply integrating data transmission status with abnormal equipment operation status, and visually rendering the final site status using different colors on an electronic map. Combined with the historical data backtracking function under the B / S architecture, it achieves unified monitoring of data transmission information and equipment operation status information, enabling maintenance personnel to quickly review historical parameter changes through visual charts, shortening fault diagnosis time and improving the overall support efficiency of the meteorological radar. Attached Figure Description

[0015] Figure 1 A schematic diagram of the software logic layered architecture provided in an embodiment of the present invention; Figure 2 This is a flowchart of the transmission monitoring logic based on adaptive threshold in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the fault diagnosis principle based on the EAD model and SVM in an embodiment of the present invention. Detailed Implementation

[0016] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] This invention relates to a weather radar monitoring and fault diagnosis system based on the EAD algorithm and adaptive threshold. The system adopts a B / S (browser / server) architecture, and the physical deployment environment includes a storage server, a system server, a database module, and a client terminal.

[0018] The system server communicates with the storage server, and also communicates with the database module and client terminals. The system server and storage server are deployed in different operating system environments to achieve functional decoupling and resource isolation.

[0019] The storage server is configured to run a Linux operating system. In this embodiment, the storage server uses Red Hat 7.9. As a data aggregation node, the storage server is configured to receive raw status files from various weather radar stations. The raw status files are encapsulated in XML format and contain real-time status parameters during radar operation. The storage server aggregates and stores the received raw status files, providing a data source for subsequent data parsing.

[0020] The system server is configured to run a Windows operating system. In this embodiment, the system server uses a Windows 10 operating system. The system server deploys a system backend service program and a data parsing program. The data parsing program is configured to read raw status files from the storage server and parse them according to preset rules to extract the radar station's operational status data, alarm information, and transmission status data. The system backend service program is built using Python and the Flask web framework and is configured to handle business logic requests, manage routing and distribution, and execute data calculation tasks.

[0021] The database module is deployed directly on the system server or connected to the system server via a local area network. The database module employs a hybrid storage strategy, including relational databases, cached databases, and file system storage units. Specifically, the system backend service program is logically divided into a transmission monitoring module, a timeliness statistics module, an anomaly detection module, and a status monitoring module. The transmission monitoring module is responsible for real-time monitoring of data arrival time; the timeliness statistics module is responsible for periodically calculating data transmission quality indicators; the anomaly detection module is responsible for running the EAD algorithm to identify potential risks; and the status monitoring module is responsible for integrating status information from various dimensions for frontend access.

[0022] The relational database uses MySQL (e.g., MySQL version 5.7) and is configured to store structured data processed by a data parsing program. This structured data includes basic radar site information, parsed operational status parameters, alarm records, and user permission information. The relational database is also configured to store stored procedures used to calculate transmission timeliness; these stored procedures are pre-compiled sets of SQL code.

[0023] The caching database uses Redis and is configured to run between the system's data access layer and logic layer. Redis provides key-value storage services and is configured to cache frequently accessed real-time status data and temporary calculation results required by the front-end page, thereby reducing the frequency of reads from the relational database.

[0024] The file system storage unit is configured to store raw state files and historical archived data. The system server accesses historical data in the file system storage unit through a file path index to support long-term historical backtracking analysis.

[0025] The client terminal connects to the system server via a network. The client terminal does not require the installation of dedicated client software; it accesses the web service address provided by the system server using a general web browser. The client terminal is configured to send requests to the system server via HTTP or HTTPS protocols and receive HTML, CSS, and JavaScript code returned by the system server for page rendering.

[0026] The backend service programs in the system server also utilize the SQLAlchemy tool as an object-relational mapping (ORM) component. The SQLAlchemy tool is configured to establish a mapping relationship between Python objects and the table structure of the MySQL database, converting CRUD operations on objects into SQL statements to be executed in the MySQL database.

[0027] The system server also includes a data processing module built using Python's Pandas library. This module is configured to clean, normalize, and extract features from the raw data obtained from the database module. The system server also integrates a machine learning model runtime environment, configured to load pre-trained Aggregate Augmented Anomaly Detection (EAD) and Support Vector Machine (SVM) classification models to perform online inference on real-time acquired radar status data, outputting anomaly determination and fault classification results.

[0028] See attached document Figure 1 The weather radar monitoring and fault diagnosis system provided by this invention is based on a B / S (browser / server) layered architecture design. The software logical architecture includes, from top to bottom, a presentation layer, a logic layer, an access layer, a processing layer, and a storage layer. Each layer interacts with the other through defined interfaces to achieve decoupling of functional modules.

[0029] The presentation layer, located at the top of the system architecture, is configured to provide users with a visual user interface. It uses HTML, CSS, and JavaScript to build the user's front-end pages. The presentation layer integrates the Bootstrap front-end development framework and is configured to implement responsive layouts to adapt to different screen resolutions. It also integrates the Echarts visualization library, configured to render radar operation data transmitted from the backend into charts, including bar charts to display transmission timeliness, geographic information maps to display site status, and scatter plots to display anomaly detection results. The presentation layer is configured to respond to user interactions by sending HTTP requests to the logic layer and receiving JSON data or HTML page fragments returned by the logic layer for rendering.

[0030] The logic layer sits below the presentation layer and is configured to handle business logic and respond to requests. It is built using the Flask web framework in Python. The logic layer includes a routing management module, a view function module, and a template rendering module. The routing management module is configured to parse URL requests sent by the presentation layer and map them to the corresponding view functions. The view function module is configured to execute specific business logic code, including calling the algorithm model of the processing layer or operating the database through the access layer. The template rendering module is configured to populate the processing results into an HTML template, generating the final page to be returned to the presentation layer.

[0031] The access layer, situated between the logic layer and the storage layer, is configured to provide an interface for data persistence operations. It uses SQLAlchemy as its object-relational mapping (ORM) tool. The access layer defines Python class objects corresponding to the database table structures. When the logic layer needs to read or write data, the access layer is configured to receive object operation instructions from the logic layer, convert them into standard SQL statements, and submit them to the storage layer for execution. The access layer encapsulates CRUD (Create, Read, Update, Delete) operations, isolating business logic from the underlying database implementation details.

[0032] The processing layer is configured to perform core data analysis and computation tasks. It integrates Python's Pandas data analysis library and is configured to preprocess raw data retrieved from databases or file systems. Preprocessing operations include filling missing values ​​using interpolation and scaling the data using min-max normalization. The processing layer is also configured to perform feature extraction operations, using Principal Component Analysis (PCA) to reduce the dimensionality of high-dimensional feature data. Furthermore, the processing layer loads pre-trained Aggregate Augmented Anomaly Detection (EAD) and Support Vector Machine (SVM) classification models, configured to receive real-time data and output anomaly detection results and fault classification labels.

[0033] The storage layer, located at the bottom of the system architecture, is configured for the physical storage and management of data. It includes a relational database, a caching system, and a file system. The relational database (such as MySQL) is configured to store structured business data, device parameters, and statistical results. The caching system (such as Redis) is configured to store frequently accessed hot data and user session information to provide low-latency data read services. The file system is configured to store unstructured radar raw XML status files and historical archived logs. The Redis caching system runs throughout the layers, configured to provide data caching services between the access layer and the logic layer.

[0034] In this embodiment of the invention, the data processing module first performs data cleaning on the raw radar status data obtained from the database, and then normalizes the cleaned data to provide standardized input data for subsequent feature extraction and model inference.

[0035] Data cleaning involves two steps: duplicate record removal and missing value imputation. The data processing module first performs an integrity scan on the raw data, using the radar station number and data generation timestamp as a composite primary key to identify duplicate records in the database. When multiple status records for the same radar station at the same timestamp are detected, the system retains the last written record and physically deletes the remaining duplicate entries from the dataset to eliminate the impact of data redundancy on the statistical results.

[0036] To address missing values ​​in the original data, the data processing module employs a linear interpolation algorithm for filling in the missing values. The system first identifies null or non-numeric (NaN) markers in the data sequence. For each missing data point, the system obtains the immediately preceding and following valid observations in the time series. The system calculates the time difference and numerical difference between these two valid observations to determine the rate of change within that time period. Based on the time difference between the timestamp corresponding to the missing point and the preceding valid observation, and combined with the rate of change, the system calculates an estimated value for the missing point and fills this estimated value into the data sequence, thus ensuring the continuity of radar state parameters in the time dimension.

[0037] After data cleaning, the data processing module performs normalization on the feature data containing multiple physical dimensions. Since the radar status data includes 23 feature parameters with vastly different dimensions and numerical ranges, such as transmitter peak power (kilowatts), system noise temperature (Kelvin), and phase noise (decibels), directly using the raw values ​​would cause features with larger values ​​to dominate in the machine learning model training, masking changes in smaller but equally crucial features. Therefore, this embodiment employs the Min-Max Normalization method to linearly map the values ​​of all feature parameters to the closed interval [0,1].

[0038] The specific steps of the normalization operation are as follows: The system first loads a preset parameter configuration table, which stores the global maximum and global minimum values ​​of each radar characteristic parameter in historical long-term operating data. For the current dataset to be processed, the... The original observations of each feature The system reads the global maximum value corresponding to this feature. and global minimum System calculation and The difference, and divide that difference by and The difference between the two values ​​is the quotient obtained, which is the normalized eigenvalue. .

[0039] If the raw observation values ​​collected during real-time operation Greater than the preset global maximum value The system will The truncation value is assigned to 1; if the original observation value Less than the preset global minimum value The system will The truncation value is set to 0. This approach ensures that the data input to the subsequent principal component analysis (PCA) model and aggregation-enhanced anomaly detection (EAD) model are strictly limited to a predefined numerical space, avoiding excessive interference of outliers on model weights, and also eliminating the influence of different physical dimensions on distance calculations.

[0040] In this embodiment of the invention, the data processing module performs principal component analysis (PCA) on the normalized high-dimensional radar state data to eliminate multicollinearity among feature variables and reduce data dimensionality while retaining the core variance information of the data.

[0041] The data processing module first constructs the input data matrix. The input data matrix Each row represents a radar state sample, and each column represents a normalized feature dimension. In this embodiment, the input data matrix contains 23 feature columns. The data processing module calculates the input data matrix. The arithmetic mean of each column yields the mean vector. .

[0042] Subsequently, the data processing module processes the input data matrix. Decentralized processing is performed. The system will input a data matrix. Subtract the mean vector of the column corresponding to each element in the matrix. The components in the matrix are used to obtain a decentralized matrix. This step ensures that the covariance matrix calculated subsequently accurately reflects the correlation between the feature variables, without being affected by the location of the data origin.

[0043] The data processing module is based on a decentralized matrix. Calculate the feature covariance matrix. The covariance matrix is ​​a symmetric matrix, where the diagonal elements represent the variance of each feature, and the off-diagonal elements represent the covariance between different features. The data processing module performs eigenvalue decomposition on the covariance matrix to obtain a set of eigenvalues ​​and corresponding eigenvectors.

[0044] The system sorts the eigenvalues ​​and their corresponding eigenvectors in descending order based on their magnitude. The magnitude of the eigenvalue represents the amount of data information (i.e., variance) contained in the corresponding eigenvector direction. (Before system calculation...) The cumulative variance contribution rate of each feature vector is calculated, and the top features whose cumulative variance contribution rate reaches a preset threshold (e.g., 95%) are selected. One eigenvector, or directly select the two eigenvectors with the largest values ​​as the principal component directions.

[0045] The data processing module will select the first The eigenvectors are arranged in columns to form a projection transformation matrix. The system utilizes a projection transformation matrix. Decentralized high-dimensional matrix Mapping to a low-dimensional feature space, the dimensionality-reduced output feature matrix is ​​calculated. The formula for calculating this linear mapping process is as follows: ; in, This represents the output feature matrix after dimensionality reduction. In the subsequent anomaly detection steps of this embodiment, the output feature matrix... The column vectors are then labeled as low-dimensional features. and ; : Represents a decentralized matrix after calculating and subtracting the mean, with dimensions of . ,in For the sample size, The original feature dimension (i.e., 23); Indicates the selected previous The projection transformation matrix, composed of the eigenvectors corresponding to the largest eigenvalues, has dimensions of . .

[0046] Through the above steps, the system compresses the original 23-dimensional radar state features into low-dimensional features containing the main information. and And the dimensionality-reduced output feature matrix This serves as input data for subsequent aggregated enhanced anomaly detection models.

[0047] See attached document Figure 2 In this embodiment of the invention, the transmission monitoring module first performs an adaptive parameter acquisition step, which is configured to dynamically determine the key time parameters and quantity parameters used to calculate the data reception timeout threshold based on the current actual operating mode of the radar device.

[0048] The transmission monitoring module listens to and parses the status data stream uploaded by the radar site in real time through a data parsing interface deployed on the system server. The status data stream contains an observation mode field that identifies the current radar operating strategy. The system extracts the value of this observation mode field and uses it as an index key to perform a search and match in the system's pre-configured adaptive parameter table.

[0049] The adaptive parameter configuration table stores the observation mode identifier and volume scan period in key-value pairs. and total elevation angle A unique mapping relationship between them. Volume scan cycle. Defined as the standard theoretical time required for a radar to complete one full stereo scan mission, the total number of elevation angles. Defined as the theoretical total number of elevation layer data that should be generated under this observation mode.

[0050] Specifically, the parameter mapping logic of the adaptive parameter configuration table is executed as follows: when the observation mode field is identified as "VCP21" or "VCP21D", the system determines that it is currently in precipitation observation mode 2 and adjusts the volume scan period. Assign a value of 6 minutes, and set the total elevation angle to 6 minutes. The value is assigned to 11; when the observation mode field is identified as "VCP31" or "VCP31D", the system determines that it is currently in clear sky observation mode 1 and adjusts the volume scan period. Assign a value of 10 minutes and the total elevation angle. The value is assigned to 8; when the observation mode field is identified as "VCP11" or "VCP11D", the system determines that it is currently in precipitation observation mode 1 and sets the volume scan period. Assign a value of 5 minutes, and calculate the total elevation angle. The value is assigned to 16.

[0051] The transmission monitoring module is configured to immediately trigger the aforementioned parameter acquisition process upon detecting a new volume scan start signal or a change in the observation mode field. The system will acquire the currently valid parameters. and The numerical values ​​are loaded into memory variables in real time and used as input constants for subsequent calculation of the elevation angle reception timeout threshold, thereby ensuring that the monitoring logic can automatically adjust to follow the intelligent switching of radar observation modes without manual intervention.

[0052] In this embodiment of the invention, the transmission monitoring module obtains the volume scan period corresponding to the current observation mode. and total elevation angle Then, a real-time timeout determination calculation is performed for each elevation angle data packet received in the current volume scanning task.

[0053] The transmission monitoring module is configured to record the start time of the current volume scan cycle. And the current number The actual arrival time of each elevation angle data packet at the system server. Based on the aforementioned time and adaptive parameters, the system uses the following inequality to determine the transmission status of the current elevation angle data: ; in, Indicates the current number The actual arrival time of the data packet at the elevation angle to the system server; This indicates the start time when the first elevation angle data packet is received in the current volume scan task, i.e., the start reference time of the current volume scan cycle; This indicates the elevation angle data packet currently being transmitted, with a value ranging from 1 to... Integers; This indicates the total number of elevation angles that the volume scan task should include, based on the current observation mode. This indicates the volume scan cycle for this volume scan task, determined based on the current observation mode, in seconds; This represents the preset transmission delay tolerance buffer time constant. In this embodiment, It was set to 60 seconds.

[0054] The transmission monitoring module uses the calculation result of the above formula as the basis for status determination. When the above inequality condition is met, the system determines that the transmission status of the elevation angle data is timely and sends a command to the front-end presentation layer to render the corresponding elevation angle indicator icon green. When the above inequality condition is not met, that is, the actual reception time is later than the theoretically allowed latest arrival time, the system determines that the transmission status of the elevation angle data is timed out and sends a command to the front-end presentation layer to render the corresponding elevation angle indicator icon red.

[0055] In addition, for elevation angle numbers that have not yet received data and whose current system time has not exceeded the threshold calculated by the above formula, the system determines that their status is pending reception and sends an instruction to the front-end presentation layer to render the corresponding elevation angle indicator icon as gray.

[0056] The transmission monitoring module is also configured to perform site-level communication interruption monitoring. The system continuously monitors the time difference between the current system time and the time when the site last successfully completed a full volume scan data reception. When this time difference is greater than the volume scan cycle corresponding to the current observation mode, the system will monitor the interruption. When the system determines that the data transmission link of the radar station is interrupted, it triggers a station-level alarm and controls the front-end interface to render the entire row of display areas where the station is located as red and highlighted.

[0057] In this embodiment of the invention, the timeliness statistics module is configured to quantitatively calculate the data transmission quality index of the radar station within a specified time window, i.e., the transmission timeliness, based on historically stored radar status data.

[0058] The core algorithm model for calculating transmission timeliness in the timeliness statistics module is shown in the following formula: ; in, This indicates the radar data transmission timeliness rate within the statistical period, expressed as a percentage. This indicates the total number of volume scan missions actually performed at the radar site within the statistical period. Indicates the first In individual scanning tasks, the system determines the actual number of received elevation angle data that are transmitted in a timely manner. The determination of timely transmission is based on the adaptive timeout threshold logic in the aforementioned embodiment. Indicates the first In a single-scan mission, the total number of elevation angle data that the radar should theoretically receive based on the observation mode at the time of the mission. This represents the total number of actual received elevation angles, and its physical meaning is the cumulative number of all elevation angle data packets successfully and promptly uploaded to the server by the radar station within the selected statistical time window. This represents the theoretical total number of elevation angles that should be received. Its physical meaning is the cumulative total number of elevation angle data packets that should theoretically be generated and uploaded within the same statistical time window, based on the standard specifications defined by the various observation modes actually operated by the radar during that period.

[0059] The timeliness statistics module calculates... The system is configured to dynamically read the observation mode field from each volume scan mission record and obtain the corresponding total theoretical elevation angle based on the observation mode field, instead of using a fixed constant. This mechanism ensures that even if the radar changes its observation mode during the statistical period (e.g., from VCP21 to VCP11), the statistical results can still accurately reflect the transmission completion rate.

[0060] To improve statistical efficiency and reduce network load under large datasets, the system deploys pre-compiled stored procedures in the database module. These stored procedures encapsulate the summation and division logic into SQL program blocks that execute on the database server.

[0061] When a client initiates a statistical query request, it only needs to send a call instruction to the database server containing the target site identifier, the start time of the statistics, and the end time of the statistics. Upon receiving the call instruction, the database server executes a stored procedure locally, iterates through historical records that match the time range, and completes the query directly within the database engine. and The aggregation operation is performed to calculate the final radar data transmission timeliness. The database server only transmits the final calculated radar data and its transmission rate. The data is returned to the timeliness statistics module, thus avoiding the network overhead of transferring thousands of detailed records from the database server to the application server for processing.

[0062] In this embodiment of the invention, the timeliness statistics module not only performs basic numerical calculations, but is also configured to dynamically adjust the data aggregation range and evaluation criteria according to the time dimension and seasonal assessment requirements.

[0063] The timeliness statistics module is configured to receive statistical requests triggered by users through the front-end interface. These requests include a time granularity parameter, selected from daily, monthly, or annual reports. Based on the time granularity parameter, the system automatically parses and constructs a closed time window interval for database queries. When the time granularity parameter is a daily report, the system sets the query start time to 00:00:00 of the specified date and the query end time to 23:59:59 of the specified date. When the time granularity parameter is a monthly report, the system calculates the complete time span from midnight on the first day of the specified month to the end of the last day of that month. When the time granularity parameter is an annual report, the system locks the period from January 1st to December 31st of that year as the statistical range. The system passes the constructed time window parameter to the stored procedure interface of the aforementioned embodiment to ensure that the statistical results cover all body scan tasks within the selected period.

[0064] The timeliness statistics module also includes built-in adaptive switching logic for seasonal assessments. The system stores flood season time definition parameters in its configuration file, specifying the start date (e.g., May 1st) and end date (e.g., September 30th) of the flood season. This is used to calculate the radar data transmission timeliness rate. Then, the system extracts the date information of the current statistical time window and compares it with the flood season time definition parameters.

[0065] If the current statistical date falls within the range defined by the flood season time parameters, the system will automatically load the preset flood season assessment threshold. (e.g., 98%); if the current statistical date falls outside the range, the system will automatically load the preset non-flood season assessment threshold. (For example, 95%). The system will calculate the radar data transmission timeliness. Compare the numerical value with the currently loaded assessment threshold.

[0066] Based on the numerical comparison results, the system generates corresponding compliance labels. When When the transmission quality is greater than or equal to the current assessment threshold, the system determines that the transmission quality within that time period is up to standard and renders the value in a normal color (such as black or green) in the front-end statistical report; when When the transmission quality falls below the current assessment threshold, the system determines that the transmission quality within that time period is substandard and renders the value as a warning color (such as red) in the front-end statistical report, thereby achieving differentiated automatic monitoring and evaluation based on the characteristics of radar meteorological services.

[0067] See attached document Figure 3 In this embodiment of the invention, the anomaly detection module adopts an ensemble learning strategy, inputting the dimensionality-reduced low-dimensional feature vector into three parallel base anomaly detection models, and generating the final anomaly score through a weighted aggregation mechanism.

[0068] The anomaly detection module is configured to receive feature vectors from the principal component analysis output in the aforementioned embodiments as input data. The system launches three independent basis detection algorithms in parallel: Isolation Forest (IF), K-Nearest Neighbors (KNN), and Local Outlier Factor (LOF).

[0069] The Isolation Forest algorithm is configured to construct a random forest consisting of multiple binary isolation trees. For each input feature data point, the algorithm calculates the path length from the root node to a leaf node in each isolation tree. The system takes the average of all isolation tree path lengths and calculates a first outlier score based on this average path length. Since outliers are usually sparsely distributed in the feature space, they are easier to segment in a tree structure. Therefore, the shorter the path length, the easier it is to isolate the data point, i.e., the higher the degree of anomaly.

[0070] The K-Nearest Neighbors algorithm is configured to search in the feature space for the closest Euclidean distance to the current input data point. The system calculates the current data point and its neighbor samples. The average distance between the nearest neighbor samples is used to define the second anomaly score. The larger the average distance value, the greater the deviation of the data point from the center of the normal sample cluster, thus identifying it as a potential anomaly.

[0071] The local outlier factor algorithm is configured to calculate the local reachability density of the input data point and its neighborhood points. The system calculates the local reachability density of the current data point and its neighborhood points. The third anomaly score is obtained by taking the ratio of the average local reachability density of each neighboring sample. When the ratio is greater than 1, it indicates that the density around the data point is much lower than the density of its neighboring points, and the system identifies it as an outlier based on this.

[0072] Because the anomaly scores output by the three base models differ in numerical range and distribution characteristics, the anomaly detection module performs [further analysis] before aggregation. , and Normalization is performed separately. The system utilizes statistical extreme values ​​from the historical training set and employs a minimum-maximum scaling method to linearly map the three original scores to the closed interval [0,1], obtaining the normalized scores. , and .

[0073] The anomaly detection module then uses a weighted average method to calculate the final comprehensive anomaly score. The calculation process is performed according to the following formula: ; in, This represents the final anomaly score obtained after aggregation calculation, with a value range of [0,1]. This represents the outlier score output by the normalized Isolation Forest algorithm; This represents the outlier score output by the normalized K-nearest neighbor algorithm; This represents the outlier score output by the local outlier factor algorithm after normalization. , , These represent the pre-defined weight coefficients assigned to the Isolation Forest, K-Nearest Neighbors, and Local Outlier Factor algorithms, respectively. In this embodiment, these three weight coefficients satisfy the normalization constraint condition: The system dynamically adjusts the weights of each base model based on their accuracy performance on the validation set, giving higher influence to the better-performing models.

[0074] The anomaly detection module will finally calculate the results. Compared with the preset anomaly detection threshold Compare. If Greater than The system determines that the current radar status is abnormal and triggers the subsequent fault classification process; if Less than or equal to The system determines that the current radar status is normal. Furthermore, the system is also configured to... The numerical range divides the risk level into three levels: low risk, medium risk, and high risk, and controls the front-end interface to display different colors to indicate them.

[0075] In this embodiment of the invention, when the Aggregated Enhanced Anomaly Detection (EAD) model determines that the current radar status data is abnormal, the anomaly detection module automatically triggers a fault classification subroutine based on Support Vector Machine (SVM) to further determine the specific physical component or subsystem source causing the anomaly.

[0076] The anomaly detection module is configured to pass the low-dimensional feature vectors, after dimensionality reduction by Principal Component Analysis (PCA), as input data to a pre-trained SVM classifier. Considering the diversity of radar system fault types, the SVM classifier employs a one-to-one multi-classification strategy. This strategy trains a binary classifier for every two different fault categories and determines the final classification result through a voting mechanism, thus overcoming the limitation of traditional SVMs being only applicable to binary classification scenarios.

[0077] To address the potential nonlinear separability of radar feature data in low-dimensional space, the SVM classifier employs a radial basis function (RBF) as its kernel. The kernel is configured to map the input low-dimensional feature vector to a high-dimensional feature space, ensuring that data samples of different fault types exhibit a linearly separable distribution within this high-dimensional space. Based on the kernel, the anomaly detection module calculates the category of the input sample using the following decision function: ; in, This represents the current input radar state feature vector to be classified; This represents the output decision value of the classifier, and its sign determines the class to which the sample belongs; This represents the total number of support vectors, which are data points in the training set located at the edge of the classification hyperplane. Indicates the first The Lagrange multiplier coefficients corresponding to each support vector are obtained through optimization during the model training phase; Indicates the first Each support vector corresponds to a known category label, with a value of +1 or -1; Indicates the first The specific feature values ​​of each support vector; Represents the radial basis function kernel, used to calculate and The similarity between them; The bias term parameter represents the classification hyperplane.

[0078] The anomaly detection module determines the final predicted label for the input sample using a majority voting method based on the output of the aforementioned decision function. Internally, the system maintains a fault code mapping table, which defines the correspondence between predicted label values ​​and faults in the radar physical subsystems. Specifically, when the model output label is 1, the system determines it as a transmitter system anomaly; when the output label is 2, the system determines it as a receiver system anomaly; when the output label is 3, the system determines it as a servo system anomaly; and when the output label is 4, the system determines it as a signal processor anomaly. The system writes the identified specific fault type text to the database alarm log and pushes it to the front-end interface for display.

[0079] To ensure the reliability of the classification results, the system is configured to calculate the classification accuracy metric during the model training phase. The anomaly detection module evaluates the model using validation set data, and the calculation formula used for the evaluation is as follows: ; in, This represents the classification accuracy of the model; This represents the number of samples where the actual state is abnormal, and the model correctly predicts that the sample is abnormal. This represents the number of samples where the actual state is normal and the model correctly predicts that the sample is normal. This represents the number of samples that were actually normal, but the model incorrectly predicted them as abnormal; that is, the number of false alarms. This represents the number of samples that were actually abnormal but were incorrectly predicted as normal by the model, i.e., the number of missed reports.

[0080] The anomaly detection module is configured to only detect anomalies based on the calculated classification accuracy. Only when the confidence level exceeds a preset threshold (e.g., 90%) will the model version be approved to go online and perform real-time fault classification tasks.

[0081] In this embodiment of the invention, the model evaluation module is configured to quantitatively verify the performance metrics of the Aggregate Enhanced Anomaly Detection (EAD) model and the Support Vector Machine (SVM) classification model using a pre-labeled standard test dataset before the fault diagnosis model is put into online operation or during a regular update cycle.

[0082] The model evaluation module first loads the test dataset, which contains radar state feature vectors and their corresponding true class labels. The system inputs the test data into the model to be evaluated and obtains the predicted labels output by the model. The system compares each predicted label with the true class label to construct a confusion matrix. Based on the positive and negative class distributions statistically derived from the confusion matrix, the system calculates the precision index to evaluate the model's accuracy in fault prediction. The calculation formula is as follows: ; in, Precision is used to measure the proportion of samples that are actually abnormal or of that fault category, out of those predicted by the model as abnormal or of a specific fault category. This represents the number of samples where the actual state is abnormal, and the model correctly predicts that the sample is abnormal. This represents the number of samples that are actually normal but were incorrectly predicted as abnormal by the model, i.e., the number of false alarms.

[0083] The model evaluation module is also configured to calculate the recall rate metric to assess the model's ability to cover actual faults and avoid missing critical alarms. The calculation formula is as follows: ; in, Recall rate is used to measure the proportion of samples that are actually anomalies or specific fault categories that are correctly identified by the model. This represents the number of samples that were actually abnormal but were incorrectly predicted as normal by the model, i.e., the number of missed reports.

[0084] Given the often interdependent relationship between precision and recall in radar fault detection scenarios, the model evaluation module further calculates the F1 score (F1-Score) as a harmonic mean metric for comprehensively evaluating model performance. The F1 score calculation depends on the precision obtained from the above calculation. and recall The calculation formula is as follows: ; in, The F1 score represents the harmonic mean of precision and recall, and its value ranges from 0 to 1. A higher F1 score indicates that the model maintains a low false alarm rate while achieving a higher fault detection rate.

[0085] The model evaluation module is configured with model admission decision logic. The system has preset performance evaluation benchmarks, specifically including precision thresholds. (e.g., 95%), recall threshold (e.g., 90%) and F1 score threshold (For example, 0.92). The system will calculate the... , and Each metric is compared to its corresponding threshold. Only when all three metrics are simultaneously greater than or equal to their respective preset thresholds is the system deemed a qualified model version, and the system automatically performs the model deployment operation, replacing the model in the production environment's inference engine; otherwise, the system determines the model to be unqualified, terminates the deployment process, and generates an evaluation report containing specific metric discrepancies, which is then stored in the log database.

[0086] In this embodiment of the invention, the user interaction module employs Web-based Geographic Information System (GIS) technology to construct a visualized radar network integrated monitoring platform. This platform is configured to dynamically overlay and display the geographical locations of radar stations and their core operational status on an electronic map base, achieving multi-level information display from macroscopic network topology to microscopic device parameters.

[0087] The user interaction module first loads a vector tile map service through the front-end rendering engine to establish a geospatial projection based on latitude and longitude coordinates. The system reads the basic metadata of all networked radar sites from the back-end database, including site number, site name, longitude, latitude, and altitude. The rendering engine uses a coordinate transformation algorithm to map the above geographic coordinates to screen pixel coordinates and draws icon elements representing radar sites at the corresponding locations on the map.

[0088] To intuitively present the radar's real-time health status, the status monitoring module establishes a visual mapping logic. This logic integrates the transmission status output by the transmission monitoring module in the aforementioned embodiments with the device health status output by the anomaly detection module and the fault diagnosis module, assigning different color coding priorities. The specific priority determination logic is as follows: When the anomaly detection module or fault diagnosis module determines that the radar has a hardware fault (i.e., the EAD model score exceeds the limit or the SVM classifies a specific fault), regardless of the current transmission status, the status monitoring module forcibly renders the station's icon red and adds a flashing animation to indicate a high-risk alarm; when the device health status is normal, but the transmission monitoring module determines that the current volume scan task has experienced data transmission interruption or severe backlog timeout, the system renders the station's icon orange, indicating a network-side or link-side anomaly; only when the device health status is normal and the transmission status is timely (i.e., the reception time threshold inequality is met), the system renders the station's icon green; if the system does not receive any heartbeat packets or status data from the station within a preset long period, it is determined to be offline, and the icon is rendered gray.

[0089] The user interaction module is configured with an interaction event listener to capture user mouse operation commands. When the user's cursor hovers over a radar station icon, the system triggers a floating window event, popping up a semi-transparent information overview panel next to the cursor. This panel displays the static attributes of the current station and the most critical dynamic indicators, including the currently running observation mode code (such as VCP21), the elevation layer number currently being scanned, and the timestamp of the most recent data update.

[0090] When a user clicks on a radar station icon, the system triggers a drill-down details event. The front-end interface switches from the main map view to the single-station details view, or expands the sidebar details page on the right side of the current page. This details page displays the real-time values ​​and historical trend curves of the 23 radar status characteristic parameters involved in the aforementioned embodiments through chart components, and presents the data transmission and rate statistics in the form of a dashboard.

[0091] To ensure the real-time nature of monitoring data, a full-duplex communication connection based on WebSocket was established between the front-end system and the back-end server. Once the back-end monitoring service detects a change in the status of any radar station, or a new volume scan data packet is parsed and stored in the database, the server immediately pushes a JSON message containing the latest status code and timestamp to the front-end through this channel. Upon receiving the message, the front-end uses virtual DOM technology to update only the changed status icons or numerical components without refreshing the entire webpage, thus achieving millisecond-level status synchronization and visual feedback.

[0092] In this embodiment of the invention, after detecting an abnormal state of a radar site, the user interaction module provides in-depth visualization analysis functions, which aim to assist maintenance personnel in quickly locating the characteristic dimensions that cause the abnormality and the specific physical fault causes.

[0093] The user interaction module is configured to respond to user clicks on red-alert sites on the main monitoring map, redirecting them to the anomaly analysis details page. This page first loads and displays a time-series evolution graph of the anomaly scores. The system then extracts all comprehensive anomaly scores for that site from the database, calculated by the Aggregate Enhanced Anomaly Detection (EAD) model over a preset time period (e.g., 24 hours). The plotting engine uses time as the horizontal axis and anomaly scores as the vertical axis to create a trend line chart, marking the anomaly detection threshold on the vertical axis. The horizontal reference line. Through this chart, maintenance personnel can intuitively trace the entire process of the radar status gradually deteriorating from normal to abnormal, as well as the frequency and duration of the anomalies.

[0094] To uncover the specific reasons for the elevated abnormal scores, the system performs attribution analysis based on feature deviation. Since the original 23-dimensional feature data have varying dimensions, direct comparison lacks physical meaning. Therefore, the system uses a normalized distance algorithm to calculate the degree of deviation of each component in the current feature vector relative to the historical normal baseline. Normalized Deviation The calculation formula is as follows: ; in, Indicates the first The normalized deviation of each radar state characteristic. The larger this value, the more anomalous the current value of that characteristic is, and the greater its contribution to abnormal results; An index representing radar status characteristics, with values ​​ranging from 1 to 23; This indicates the number of samples collected at the current abnormal moment. The original measured values ​​of each radar state characteristic; This indicates that the radar site is in its historical normal operating state for the [number]th [period]. The arithmetic mean of the radar state characteristics; This indicates that the radar site is in its historical normal operating state for the [number]th [period]. The standard deviation of each radar state characteristic.

[0095] The user interaction module uses the calculated normalized deviation. All 23 features are sorted in descending order, and the features with the largest deviations are selected. These are features (e.g., the first 5). The system uses radar charts or multidimensional spider diagrams to visualize these features. Each feature is visualized. In the radar chart, each axis represents a feature dimension, and the scale on the axis indicates the normalization deviation. The system draws a closed polygon region representing the current state and simultaneously overlays it with the average value region of the normal baseline. By comparing the shape differences between the two polygons, maintenance personnel can easily identify which parameters (such as transmitter peak power or receiver noise figure) have experienced abnormal sudden changes.

[0096] The user interaction module also maps the output of the Support Vector Machine (SVM) classifier to visualized fault diagnosis conclusions. The system reads the fault category labels from the SVM output and displays the corresponding fault name text (e.g., transmitter system anomaly) in the core area of ​​the interface. Simultaneously, the system loads the internal structural principle diagram of the radar system. Based on the fault category labels, it automatically renders the corresponding subsystem modules (such as signal processor modules, servo motor modules, etc.) in the principle diagram as highlighted red and adds pulse animation effects, thereby achieving a visual mapping from the data feature space to the physical device space.

[0097] In addition, the system is equipped with an automatic report generation function. After the user clicks the export analysis report control, the system automatically extracts the current anomaly scoring trend chart, feature deviation radar chart, and fault location topology map, and combines them with the currently recorded fault occurrence time, duration, and key parameter values ​​involved, packaging them into a PDF format fault diagnosis report according to a predefined document template. This fault diagnosis report is sent to the maintenance department as an attachment to the work order, serving as a direct reference for on-site troubleshooting operations.

Claims

1. A weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold, characterized in that, This includes storage servers, system servers, database modules, and client terminals; The storage server is configured to run a Linux operating system and to receive raw status files from meteorological radar stations and perform aggregated storage. The system server is communicatively connected to the storage server, and the system server is configured to run a Windows operating system. The system server is equipped with a data parsing program, which is configured to read the original state file from the storage server and parse it into structured data. The system server also integrates a transmission monitoring module, a data processing module, an anomaly detection module, and a status monitoring module, and the modules are logically connected through data flow. The transmission monitoring module is configured to receive the structured data, dynamically match the volume scan cycle parameters according to the observation mode field in the structured data, construct an adaptive threshold, and use the adaptive threshold to determine the data transmission status. The data processing module is configured to clean and normalize the structured data and perform feature extraction to generate feature vectors. The anomaly detection module is configured to receive the feature vector and perform inference calculations on the feature vector using an aggregated enhanced anomaly detection model to identify abnormal radar operation status. The status monitoring module is configured to simultaneously receive the data transmission status output by the transmission monitoring module and the radar operation anomaly status output by the anomaly detection module, and integrate them into the final site status according to priority logic for the client terminal to call. The client terminal is configured to access the system server via a web browser and render the final site status on an electronic map.

2. The weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold as described in claim 1, characterized in that, The system server also includes a timeliness statistics module, and the database module includes a relational database, a cache database, and a file system storage unit; The relational database is configured to store the structured data and stored procedures; The on-time rate statistics module is configured to call the stored procedure, which is configured to statistically analyze the total number of actual received elevation angles and the total number of theoretically expected received elevation angles within a specified time period based on the structured data, and calculate the ratio of the two as the transmission on-time rate. The theoretical total number of elevation angles to be received is the cumulative value of the number of standard elevation angles determined according to the observation mode corresponding to each volume scan task within the specified time period.

3. The weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold as described in claim 1, characterized in that, The data processing module performs the cleaning and normalization processes, including: Based on the radar station number and the generated timestamp, duplicate records in the structured data are identified and removed, and missing values ​​in the structured data are filled using a linear interpolation algorithm; Obtain the global maximum and global minimum values ​​of the feature parameters in historical data, calculate the difference between the original observation value and the global minimum value, and divide the obtained difference by the difference between the global maximum and the global minimum value to obtain the normalized feature value.

4. The weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold as described in claim 3, characterized in that, The feature extraction operations performed by the data processing module include: Construct an input data matrix and calculate the arithmetic mean vector of each column of the input data matrix. Subtract the mean vector from the input data matrix to obtain a decentralized matrix. The covariance matrix of the decentralized matrix is ​​calculated by calculating the variance of each feature dimension and the covariance between feature dimensions, and then the covariance matrix is ​​decomposed into eigenvalues. Select eigenvectors whose cumulative variance contribution rate meets the preset conditions to form the projection transformation matrix; The decentralized matrix is ​​mapped to a low-dimensional output feature matrix using the projection transformation matrix; the output feature matrix is ​​the feature vector transmitted to the anomaly detection module.

5. The weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold as described in claim 1, characterized in that, The specific steps for the transmission monitoring module to construct the adaptive threshold and determine the data transmission status are as follows: Parse the observation mode field and match the corresponding volume scan cycle and total elevation angle in the configuration table; Record the start time of the current volume scan task and the reception time of the current elevation angle data packet; The cutoff time is obtained by adding the start time, the transmission delay tolerance buffer time constant, and the scan time, wherein the scan time is the current elevation angle number divided by the total number of elevation angles and then multiplied by the volume scan cycle; If the receiving time is later than the deadline, the data transmission status is determined to be timeout.

6. The weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold as described in claim 2, characterized in that, The timeliness statistics module is configured to perform seasonal performance switching: Read the preset flood season time definition parameters and determine whether the current statistical date is within the range determined by the flood season time definition parameters; If yes, apply the flood season assessment threshold; otherwise, apply the non-flood season assessment threshold. The on-time rate statistics module compares the transmission on-time rate with the loaded assessment threshold, and generates a non-compliance label when the transmission on-time rate is less than the assessment threshold.

7. The weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold as described in claim 4, characterized in that, The aggregated enhanced anomaly detection model in the anomaly detection module is configured to run the isolated forest algorithm, the K-nearest neighbor algorithm, and the local outlier factor algorithm in parallel. The isolated forest algorithm outputs a first outlier score based on path length, the K-nearest neighbor algorithm outputs a second outlier score based on average distance, and the local outlier factor algorithm outputs a third outlier score based on local reachability density. The anomaly detection module multiplies the normalized first anomaly score, second anomaly score, and third anomaly score by their respective weighting coefficients and then sums them to obtain a comprehensive anomaly score. If the overall anomaly score is greater than the preset anomaly determination threshold, the radar operation is determined to be abnormal.

8. The weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold as described in claim 7, characterized in that, The system server also integrates a support vector machine classification model; When the anomaly detection module determines that the radar is in an abnormal operating state, the support vector machine classification model receives the feature vector, maps the feature vector to a high-dimensional space using the radial basis function kernel function, and outputs a fault classification label based on a one-to-one multi-classification strategy. The fault classification label indicates a specific physical subsystem fault.

9. The weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold as described in claim 8, characterized in that, The system server is equipped with a model evaluation module, which is configured to calculate precision, recall, and F1 score before the support vector machine classification model is deployed online. The precision rate is the proportion of the number of samples correctly predicted as anomalous by the model out of the total number of samples predicted as anomalous. The recall rate is the proportion of the number of samples correctly predicted as anomalous by the model to the total number of samples that are actually anomalous, and the F1 score is the harmonic mean of the precision and the recall rate. The support vector machine classification model is allowed to run online only when the precision, recall, and F1 score are all greater than or equal to their respective preset baselines.

10. The weather radar monitoring and fault diagnosis system based on EAD algorithm and adaptive threshold as described in claim 1, characterized in that, The priority logic executed by the status monitoring module is as follows: When the radar operation abnormality status output by the anomaly detection module is abnormal, the client terminal is forced to render the site icon red, regardless of the data transmission status. When the radar operation abnormality status output by the anomaly detection module is normal, and the data transmission status determined by the transmission monitoring module is timeout, the client terminal is controlled to render the site icon orange. When the radar operation abnormality status output by the anomaly detection module is normal, and the data transmission status determined by the transmission monitoring module is timely, the client terminal is controlled to render the site icon green.

Images