A knowledge graph-based monitoring center intelligent command and control method

Abstract

The application discloses a kind of based on knowledge graph's monitoring center intelligent command control method, comprising: the multi-source monitoring data of monitoring center is collected, pre-processing generates multi-source event data stream;According to time window slice, video segment is obtained, and synchronous event segment is aggregated;Improved LSKNet network is constructed, and event graph and counterfactual difference evidence are obtained;Knowledge graph is constructed, and current alarm correlation subgraph is formed;Based on hierarchical random walk, evidence surface and evidence chain are generated;In combination with counterfactual difference evidence, research and judge result and command action sequence are generated;Issue to linkage platform execution, update entity state and relationship record.The application realizes the unified semantic correlation of monitoring center alarm, interpretable research and judgment, command action automatic generation and linkage closed-loop control by introducing improved LSKNet network and hierarchical random walk reasoning.

Description

Technical Field

[0001] This invention relates to the field of knowledge graph technology, and in particular to an intelligent command and control method for a monitoring center based on knowledge graphs. Background Technology

[0002] Existing monitoring centers typically access multi-source monitoring data simultaneously, including video surveillance, IoT alarms, equipment operating status, and business events. These data sources differ in time references, spatial identifiers, event fields, and semantic granularity, resulting in data being scattered and processed independently within the platform as video clips, alarm records, and status messages. Current solutions largely rely on manual experience or rule-based alarm merging and analysis, making it difficult to achieve unified semantic expression and correlation reasoning for objects, regions, events, and equipment status. This easily leads to problems such as duplicate alarms for the same event, inability to piece together cross-platform clues, and difficulty in suppressing false alarms. Furthermore, the analysis process lacks traceable evidence organization methods, making it difficult to form an evidence chain or structure that can support review and auditing, resulting in low analysis efficiency, weak interpretability, and insufficient consistency in decision-making.

[0003] In existing monitoring centers, command and dispatch, as well as response execution, are often decoupled from the analysis results. Analysis outputs are mostly presented as unstructured information such as alarm levels, event descriptions, or screenshots, making it difficult to map them consistently with contingency plan templates, resource entities, and coordinated actions. This leads to contingency plan matching and action orchestration relying on manual selection and issuance. Cross-system coordinated execution lacks unified action sequences and acknowledgment field constraints, and acknowledgment information and the status of the handling process are difficult to write back into a unified knowledge structure, hindering closed-loop updates and dynamic adjustments. This results in inconsistent handling procedures, uncontrollable execution status, and a lack of real-time visual feedback on resource usage and equipment linkage. When the on-site status changes or new alarms occur, it is difficult to trigger timely re-analysis and re-dispatch, impacting the monitoring center's ability to respond quickly and maintain continuous control over emergencies.

[0004] Therefore, how to provide a knowledge graph-based intelligent command and control method for monitoring centers is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose an intelligent command and control method for monitoring centers based on knowledge graphs. This invention comprehensively utilizes multi-source monitoring data preprocessing and time window aggregation, an improved LSKNet network structure, and hierarchical random walk reasoning technology to complete the entire process from multi-source data acquisition, video segment feature extraction and event graph generation, knowledge graph construction and alarm association subgraph formation, evidence chain and evidence surface reasoning, analysis results and command action sequence generation, to linkage platform execution and closed-loop feedback. The improved LSKNet network innovatively introduces an event graph generation head, a differentiable graph query layer, and a counterfactual dual branch to achieve structured semantic output of video perception results and generation of counterfactual difference evidence. The hierarchical random walk innovatively employs simple complex walks and non-backtracking random walks to achieve interpretable evidence surfaces and evidence chains. Compared with existing technologies, this invention has the advantages of fast alarm association analysis speed, strong false alarm suppression capability, good evidence traceability, high consistency between contingency plan mapping and linkage execution, and outstanding closed-loop dynamic adjustment capability.

[0006] According to an embodiment of the present invention, a knowledge graph-based intelligent command and control method for a monitoring center includes: Collect multi-source monitoring data from the monitoring center, preprocess the multi-source monitoring data, and generate multi-source event data streams; Video data is extracted from multi-source monitoring data, and video segments are obtained by slicing according to time windows. At the same time, multi-source event data streams are aggregated according to the same time window to obtain synchronous event segments. An improved LSKNet network is constructed. Based on the event graph generation head, features are extracted from video segments to generate event graphs. A differentiable graph query layer is used to generate query vectors with event nodes and region nodes to update the event graphs. A counterfactual dual branch is introduced to generate fact event graphs and counterfactual event graphs respectively, and counterfactual discrepancy evidence is calculated. Synchronous event fragments are aligned with event graphs to generate entities and relationships, and a knowledge graph is constructed to form a subgraph associated with the current alarm. Based on hierarchical random walk, reasoning is performed on the current alarm association subgraph. A two-dimensional simplex is constructed using simplex walk and evidence surface is generated. An evidence chain is generated by walking with directed edges as the state through non-backtracking random walk. Based on the chain of evidence, the aspects of evidence, and counterfactual discrepancies, an assessment result and a sequence of command actions are generated. The command action sequence is sent to the linkage platform for execution, execution receipts and status change data are collected, and the execution receipts and status change data are written back to the knowledge graph to update the entity status and relationship records.

[0007] Optionally, the multi-source monitoring data includes video stream data, IoT alarm data, device status data, and business event data.

[0008] Optionally, generating a multi-source event data stream includes: Collect multi-source monitoring data from the monitoring center and write a data source identifier, collection timestamp, and spatial identifier for each piece of collected data. Time alignment and spatial identification unification processing are performed on multi-source monitoring data. The collection timestamps of each data source are converted into a unified time reference, resampling is performed according to time resolution, and camera location identifiers, sensor location identifiers and business area identifiers are mapped to a unified area identifier. After time alignment and spatial identification unification, the multi-source monitoring data is subjected to field standardization and data cleaning. The alarm type field, object identifier field, status field and numerical field are mapped to a unified field set, the numerical field is converted to a unified unit of measurement, data records with missing key fields are removed and duplicate data records are merged, and a multi-source event data stream containing event identifier, data source identifier, unified timestamp, unified area identifier, event type, object identifier and event payload is generated.

[0009] Optionally, the step of aggregating multi-source event data streams into synchronous event segments according to the same time window includes: Video data is extracted from multi-source monitoring data, and the video data is split into channels according to camera identifiers. Each channel of video data is written with the corresponding camera identifier, area identifier, and unified timestamp. Each video data stream is sliced ​​into video segments according to a time window. The time window is determined by the start time and length of the time window. The start time of the time window increases with the step size. The generated video segment contains the continuous frame sequence within the current time window and the corresponding frame timestamp sequence. The multi-source event data streams are aggregated according to the start time and length of the time window, which are consistent with the time window. Event records with a unified timestamp falling into the current time window are filtered and merged according to the camera identifier or area identifier to obtain the synchronized event segments corresponding to the video segments at the start time and area identifier of the time window.

[0010] Optionally, the calculation yields counterfactual discrepancy evidence, including: An improved LSKNet network is constructed, which includes a backbone feature extraction network, an event graph generation head, a differentiable graph query layer, and a counterfactual dual branch. Video segments are input into the backbone feature extraction network to obtain feature tensors representing the video segments. An event graph generation head is used to perform node and edge generation on the feature tensor, and outputs an initial event graph. The initial event graph contains a set of object nodes, a set of event nodes, a set of region nodes, and a set of relation edges. The set of relation edges contains object-region relation edges, event-object relation edges, and event-region relation edges. A differentiable graph query layer is used to perform query vector generation, subgraph summary reading and back-injection update on the initial event graph. Query vector generation is based on event nodes and region nodes to generate query vectors. Subgraph summary reading reads the matching subgraph summary from the knowledge graph based on the query vector. Back-injection update maps the subgraph summary to an update vector and injects it into the initial event graph to obtain the updated event graph. A counterfactual dual-branch approach is introduced to perform factual branch reasoning and counterfactual branch reasoning on the updated event graph. Factual branch reasoning outputs a fact event graph, and counterfactual branch reasoning outputs a counterfactual event graph. Perform a difference calculation on the fact event graph and the counterfactual event graph to obtain counterfactual difference evidence. The difference calculation includes calculating the differences between the two in terms of event node confidence values, relation edge existence labels, and region node association strength values, and outputs the updated event graph and counterfactual difference evidence.

[0011] Optionally, the construction of the knowledge graph to form the current alarm association subgraph includes: Establish a knowledge graph schema and initialize the knowledge graph. The knowledge graph schema includes a set of entity types and a set of relationship types. The set of entity types includes object entities, event entities, region entities, and device entities. The set of relationship types includes object-region relationships, event-object relationships, event-region relationships, and device-region relationships. Perform entity alignment on the synchronized event fragments and the updated event graph and write them to the entity set. Entity alignment includes generating entity keys for object nodes, event nodes, region nodes and device entries, and matching them with knowledge graph entity keys. If the match is successful, update the entity attributes. If the match fails, create a new entity and write it to the corresponding entity type set. Based on the entity alignment results, a relation set is generated and written. Object-region relations, event-object relations, event-region relations and device-region relations are generated and written into the corresponding relation type set to complete the knowledge graph construction. Adjacent entities and relation edges are extracted with the event entity in the current time window as the center to form the current alarm association subgraph.

[0012] Optionally, the step of constructing a two-dimensional simplex and generating an evidence surface using simplex walks, and generating an evidence chain through non-backtracking random walks with directed edges as states, includes: Extract a set of ternary relationships from the current alarm association subgraph and construct a two-dimensional simplex set. The set of ternary relationships includes the ternary relationship between object entity, region entity, and event entity, and the ternary relationship between event entity, contingency plan entity, and resource entity. The two-dimensional simplex set consists of a vertex set, an edge set, and a face set. The vertex set contains all entity nodes involved in the ternary relationship. The edge set contains a relationship edge from the set of relationship types between any two entity nodes. The face set contains a triangular face formed by the closure of three edges corresponding to the same ternary relationship. The simplex complex walk is used to perform walks on a set of two-dimensional simplexes to generate evidence surfaces. The simplex complex walk includes selecting a starting vertex from the vertex set, executing a step sequence between vertex, edge, and face and recording the set of faces traversed. Each step of the step sequence selects the next simplex from the set of adjacent simplexes of the current simplex. The set of adjacent simplexes is defined as the set of simplexes that share a vertex or an edge with the current simplex. A non-backtracking random walk is used to perform a walk on the current alarm association subgraph to generate an evidence chain. The non-backtracking random walk uses directed edges as states, and the state consists of the starting entity identifier and the ending entity identifier. In the first step, a directed edge is selected from the set of outgoing edges of the starting entity node as the initial state. In each subsequent step, the next directed edge is selected from the set of outgoing edges of the ending entity node, and the ending entity identifier of the next directed edge is not equal to the starting entity identifier of the current directed edge. The directed edge sequence is recorded to obtain the evidence chain. Output the evidence surface set and the evidence chain set. The evidence surface set includes surface identifiers, entity identifiers within the surface, and relation identifiers within the surface. The evidence chain set includes chain identifiers, directed edge sequences, and entity identifier sequences corresponding to the sequences.

[0013] Optionally, the step of generating the assessment results and command action sequence based on the chain of evidence, the evidence front, and counterfactual discrepancies includes: Based on the evidence chain set, evidence surface set, and counterfactual difference evidence, a set of judgment elements is generated. The set of judgment elements includes event entity identifier, event category, regional entity identifier, object entity identifier, equipment entity identifier, evidence chain identifier, evidence surface identifier, event node confidence difference value, and relationship edge existence difference mark. The analysis results are generated based on the set of analysis elements. The analysis results include the event type field, risk level field, scope of impact field and evidence set field. The event type field is determined by the event category. The risk level field is determined by the difference in confidence level of event nodes and the length of the evidence chain. The scope of impact field is determined by the regional entity identifier, the object entity identifier and the equipment entity identifier. The evidence set field includes the evidence chain identifier, the evidence surface identifier and the counterfactual difference evidence identifier. In the knowledge graph, the judgment results are used as search conditions to obtain a set of candidate contingency plan templates and a set of candidate available resources. Based on the set of candidate contingency plan templates and the set of candidate available resources, a sequence of command actions is generated.

[0014] Optionally, the step of sending the command action sequence to the linkage platform for execution and collecting execution receipts and status change data includes: The command action sequence is sent to the linkage platform for execution. The linkage platform calls the corresponding interface according to the action type sequence to complete the notification, dispatch and equipment linkage, and generates an execution status identifier and execution timestamp for each action identifier. Collect execution receipts and status change data corresponding to action identifiers. Execution receipts include action identifiers, a set of receipt fields, and a receipt timestamp. Status change data includes device status fields, object status fields, and area status fields, as well as corresponding timestamps. Merge execution receipts and status change data according to action identifiers to generate a receipt record set. Write the receipt record set back to the knowledge graph to update the entity status and relationship records, update the disposal status field of the event entity, update the occupancy status field of the resource entity, and update the running status field of the device entity. Update the relationship records, including the execution relationship between the write action entity and the event entity, the occupancy relationship between the write action entity and the resource entity, and the linkage relationship between the write action entity and the device entity.

[0015] The beneficial effects of this invention are: This invention improves the automation and consistency of alarm analysis by performing unified preprocessing and time window aggregation on multi-source monitoring data from the monitoring center, and by combining an improved LSKNet network to generate structured event graphs for video segments. Compared with existing methods that mainly rely on distributed alarms, single video analysis, or manual rule merging, this invention utilizes a differentiable graph query layer to achieve online interaction between perception results and knowledge graphs, introduces counterfactual dual-branch generation to generate counterfactual discrepancy evidence to suppress false alarms, and outputs evidence surfaces and evidence chains based on simple complex walks and non-backtracking random walks, enabling the analysis process to have traceable and verifiable evidence organization capabilities, thereby reducing the false alarm rate and shortening the analysis time.

[0016] This invention maps the assessment results formed by evidence chains, evidence surfaces, and counterfactual discrepancies into a sequence of command actions, which is then distributed to the linkage platform for execution. This enables structured retrieval of plans and resources, sequential distribution of actions, and closed-loop write-back of feedback. Compared to existing methods that suffer from fragmented assessment and handling, weak cross-system linkage, and difficulty in accumulating feedback, leading to inconsistencies in handling and uncontrollable execution, this invention continuously updates entity states and relationship records through a knowledge graph. This makes the handling process traceable, replayable, and supports reassessment and dynamic adjustment, improving the monitoring center's continuous control capabilities and engineering feasibility in complex scenarios. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a knowledge graph-based intelligent command and control method for monitoring centers proposed in this invention. Figure 2 This is a structural block diagram of the improved LSKNet network for a knowledge graph-based intelligent command and control method for monitoring centers proposed in this invention. Figure 3 This is a functional diagram illustrating the hierarchical random walk of a knowledge graph-based intelligent command and control method for monitoring centers proposed in this invention. Detailed Implementation

[0018] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0019] refer to Figure 1 , Figure 2 and Figure 3 A knowledge graph-based intelligent command and control method for monitoring centers includes: Collect multi-source monitoring data from the monitoring center, preprocess the multi-source monitoring data, and generate multi-source event data streams; Video data is extracted from multi-source monitoring data, and video segments are obtained by slicing according to time windows. At the same time, multi-source event data streams are aggregated according to the same time window to obtain synchronous event segments. An improved LSKNet network is constructed. Based on the event graph generation head, features are extracted from video segments to generate event graphs. A differentiable graph query layer is used to generate query vectors with event nodes and region nodes to update the event graphs. A counterfactual dual branch is introduced to generate fact event graphs and counterfactual event graphs respectively, and counterfactual discrepancy evidence is calculated. Synchronous event fragments are aligned with event graphs to generate entities and relationships, and a knowledge graph is constructed to form a subgraph associated with the current alarm. Based on hierarchical random walk, reasoning is performed on the current alarm association subgraph. A two-dimensional simplex is constructed using simplex walk and evidence surface is generated. An evidence chain is generated by walking with directed edges as the state through non-backtracking random walk. Based on the chain of evidence, the aspects of evidence, and counterfactual discrepancies, an assessment result and a sequence of command actions are generated. The command action sequence is sent to the linkage platform for execution, execution receipts and status change data are collected, and the execution receipts and status change data are written back to the knowledge graph to update the entity status and relationship records.

[0020] In this embodiment, the multi-source monitoring data includes video stream data, IoT alarm data, device status data, and business event data.

[0021] In this embodiment, generating a multi-source event data stream includes: Collect multi-source monitoring data from the monitoring center and write a data source identifier, collection timestamp, and spatial identifier for each piece of collected data. Time alignment and spatial identification unification processing are performed on multi-source monitoring data. The collection timestamps of each data source are converted into a unified time reference, resampling is performed according to time resolution, and camera location identifiers, sensor location identifiers and business area identifiers are mapped to a unified area identifier. After time alignment and spatial identification unification, the multi-source monitoring data is subjected to field standardization and data cleaning. The alarm type field, object identifier field, status field and numerical field are mapped to a unified field set, the numerical field is converted to a unified unit of measurement, data records with missing key fields are removed and duplicate data records are merged, and a multi-source event data stream containing event identifier, data source identifier, unified timestamp, unified area identifier, event type, object identifier and event payload is generated.

[0022] In this embodiment, the step of aggregating multi-source event data streams into synchronous event segments according to the same time window includes: Video data is extracted from multi-source monitoring data, and the video data is split into channels according to camera identifiers. Each channel of video data is written with the corresponding camera identifier, area identifier, and unified timestamp. Each video data stream is sliced ​​into video segments according to a time window. The time window is determined by the start time and length of the time window. The start time of the time window increases with the step size. The generated video segment contains the continuous frame sequence within the current time window and the corresponding frame timestamp sequence. The multi-source event data streams are aggregated according to the start time and length of the time window, which are consistent with the time window. Event records with a unified timestamp falling into the current time window are filtered and merged according to the camera identifier or area identifier to obtain the synchronized event segments corresponding to the video segments at the start time and area identifier of the time window.

[0023] In this embodiment, the calculation of counterfactual discrepancy evidence includes: An improved LSKNet network is constructed, comprising a backbone feature extraction network, an event graph generation head, a differentiable graph query layer, and a counterfactual branch. Video segments are input into the backbone feature extraction network to obtain feature tensors representing the video segments, where: An improved LSKNet network is constructed as follows: The backbone feature extraction network serves as a shared backbone, adopting a staged convolutional backbone structure. After outputting the feature tensor, it enters the event graph generation head. The event graph generation head generates nodes and edges from the feature tensor to obtain an initial event graph. The initial event graph enters the differentiable graph query layer. The differentiable graph query layer extracts event nodes and region nodes from the initial event graph to generate query vectors. Based on the query vectors, it reads subgraph summaries from the knowledge graph. After linear mapping, the subgraph summaries are back-injected into the feature tensor or the initial event graph to obtain the updated event graph. The counterfactual dual branch consists of a fact branch and a counterfactual branch. The two branches share the backbone feature tensor and output fact event graphs and counterfactual event graphs respectively. The video clips are input into the backbone feature extraction network to obtain the feature tensor representing the video clips. Specifically, sixteen frames are extracted from each video clip, the sampling interval is the time window length divided by sixteen, the size of each frame is normalized to 640 x 640, and the input tensor is obtained by subtracting the channel mean and then dividing by the channel standard deviation for each pixel channel. The sixteen frames are then input into the backbone feature extraction network in sequence to obtain the final stage feature map of each frame. The sixteen values ​​of the same channel and the same spatial location are summed and then divided by sixteen to obtain the temporally aggregated feature tensor. An event graph generation head is used to perform node and edge generation on the feature tensor, outputting an initial event graph. This initial event graph contains a set of object nodes, a set of event nodes, a set of region nodes, and a set of relation edges. The relation edge set includes object-region relation edges, event-object relation edges, and event-region relation edges. Specifically, the event graph generation head is used to perform node and edge generation on the feature tensor as follows: After receiving the feature tensor, the event graph generation head generates a node embedding feature map through a one-to-one convolution. At each spatial location, it outputs the object category score and the event category score. The confidence of the object node is the maximum value of the object category score, and the confidence of the event node is the maximum value of the event category score. Object nodes and event nodes are generated and written to the node set at positions with a confidence of not less than 0.5. Region nodes are generated by the camera coverage area identifier and written to the region node set. The embedding vector dot product is calculated for object nodes and region nodes, event nodes and object nodes, and event nodes and region nodes to obtain the association score. The association score is converted into an existence probability between zero and one through a logical function. When the existence probability is not less than 0.5, the corresponding relationship edge is generated and written to the relationship edge set, and the initial event graph is output. A differentiable graph query layer is used to perform query vector generation, subgraph summary reading, and back-injection update on the initial event graph. Query vector generation is based on event nodes and region nodes to generate query vectors. Subgraph summary reading reads matching subgraph summaries from the knowledge graph based on the query vectors. Back-injection update maps the subgraph summaries to update vectors and injects them into the initial event graph to obtain the updated event graph. The query vector generation is based on event nodes and region nodes. Specifically, for each event node, the node embedding vector and node confidence are taken. The node confidence is normalized into weights by dividing the node confidence by the sum of the confidences of all event nodes. The event node embedding vectors are summed according to the weights to obtain the event summary vector. For the region node embedding vectors, the region embedding vectors are taken directly or the region nodes are summed in the same way to obtain the region summary vector. The event summary vector and the region summary vector are concatenated and then input into a fully connected layer to obtain the query vector. Event nodes with a confidence of less than 0.5 are not included in the summation calculation. The subgraph summary reading is based on the query vector and reads the matching subgraph summary from the knowledge graph. Specifically, the candidate subgraph set is filtered according to the region identifier and time window condition. The time window condition is set to the period from 24 hours before the current time window to the end of the current time window. The cosine similarity between each candidate subgraph and the query vector is calculated. The cosine similarity is calculated by dividing the dot product by the product of the moduli of the two. The top five candidate subgraphs with the highest similarity are selected as matching subgraphs. The entity set, relation set, risk level field, contingency plan template identifier and resource availability status field are extracted from the matching subgraphs to form the subgraph summary. Candidate subgraphs with a similarity of less than 0.3 are not included in the matching subgraph. The back-injection update maps the subgraph summary to an update vector and injects it into the initial event graph to obtain the updated event graph. Specifically, the entity set embedding vector in the subgraph summary is averaged to obtain the entity summary vector, and the relation set embedding vector is averaged to obtain the relation summary vector. The risk level field, contingency plan template identifier, and resource availability status field are encoded into fixed-length vectors and concatenated with the entity summary vector and relation summary vector. The updated vector is then input into a fully connected layer to obtain the update vector. The updated vector is added element-wise to the event node embedding vector and the region node embedding vector to obtain the updated node embedding. The increment obtained by linear mapping of the update vector is added to the existence probability of the relation edge and truncated to between zero and one. Relation edges with an existence probability lower than 0.5 after the update are deleted from the relation edge set to obtain the updated event graph. A counterfactual dual-branch approach is introduced to perform factual branch reasoning and counterfactual branch reasoning on the updated event graph. Factual branch reasoning outputs a factual event graph, and counterfactual branch reasoning outputs a counterfactual event graph. Specifically, the factual branch reasoning and counterfactual branch reasoning are performed on the updated event graph as follows: For each event node, the fact branch calculates the event category score and obtains the event confidence score through a logical function. At the same time, the existence probability of the event-object relationship edge and the event-region relationship edge is directly used as the edge confidence score. Event nodes with an event node confidence score of not less than 0.5 and an edge confidence score of not less than 0.5 are written into the fact event graph. The counterfactual branch calculates the reverse score of the non-current event category for the same event node. After taking the inverse of the event category score, the counterfactual confidence is obtained through a logical function. The existence probability of the event-object relationship edge and the event-region relationship edge is subtracted by one to obtain the counterfactual edge confidence. Event nodes with a counterfactual confidence of not less than 0.5 and with a counterfactual edge confidence of not less than 0.5 are written into the counterfactual event graph. Perform a difference calculation on the fact event graph and the counterfactual event graph to obtain counterfactual difference evidence. The difference calculation includes calculating the differences between the two in terms of event node confidence values, relation edge existence labels, and region node association strength values, and outputs the updated event graph and counterfactual difference evidence.

[0024] In this embodiment, the construction of the knowledge graph to form the current alarm association subgraph includes: Establish a knowledge graph schema and initialize the knowledge graph. The knowledge graph schema includes a set of entity types and a set of relationship types. The set of entity types includes object entities, event entities, region entities, and device entities. The set of relationship types includes object-region relationships, event-object relationships, event-region relationships, and device-region relationships. Specifically, establishing the knowledge graph schema and initializing the knowledge graph involves: Define a set of entity types and a set of relationship types. The set of entity types includes object entities, event entities, region entities, and device entities. The set of relationship types includes object-region relationships, event-object relationships, event-region relationships, and device-region relationships. Define a set of fields and a primary key for each type of entity and relationship. Entity fields include an identifier field, a category field, a unified timestamp field, and a region identifier field. Relationship fields include a start identifier field, an end identifier field, a relationship timestamp field, and a relationship confidence field. Initializing the knowledge graph includes creating entity storage tables and relation storage tables, establishing indexes with entity identifiers as keys and region identifiers plus timestamps as keys, setting the write threshold to 0.5, writing to the entity storage table when the entity confidence is not lower than 0.5, and writing to the relation storage table when the relation confidence is not lower than 0.5. Perform entity alignment on the synchronized event fragments and the updated event graph and write them to the entity set. Entity alignment includes generating entity keys for object nodes, event nodes, region nodes and device entries, and matching them with knowledge graph entity keys. If the match is successful, update the entity attributes. If the match fails, create a new entity and write it to the corresponding entity type set. Based on the entity alignment results, a relation set is generated and written. Object-region relations, event-object relations, event-region relations and device-region relations are generated and written into the corresponding relation type set to complete the knowledge graph construction. Adjacent entities and relation edges are extracted with the event entity in the current time window as the center to form the current alarm association subgraph.

[0025] In this embodiment, the step of constructing a two-dimensional simplex and generating an evidence surface using a simplex walk, and generating an evidence chain through a non-backtracking random walk with directed edges as the state, includes: In the current alarm association subgraph, a set of ternary relationships is extracted and a two-dimensional simplex set is constructed. The set of ternary relationships includes the ternary relationship between object entity, region entity, and event entity, and the ternary relationship between event entity, contingency plan entity, and resource entity. The two-dimensional simplex set consists of a vertex set, an edge set, and a face set. The vertex set contains all entity nodes involved in the ternary relationship. The edge set contains a relationship edge from the set of relationship types between any two entity nodes. The face set contains triangular faces formed by the closure of three edges corresponding to the same ternary relationship. Specifically, the extraction of the ternary relationship set and the construction of the two-dimensional simplex set in the current alarm association subgraph are as follows: From the subgraph, filter relation edges with a relation confidence of not less than 0.5. Enumerate ternary closed structures by entity type. For the object entity-region entity-event entity ternary relation, retrieve entity triples that satisfy the existence of object-region relation edges, event-region relation edges and event-object relation edges. Record each triple as a ternary relation record. For the event entity-plan entity-resource entity ternary relation, retrieve entity triples that satisfy the existence of event-plan relation edges, plan-resource relation edges and event-resource relation edges. Record each triple as a ternary relation record. When constructing a two-dimensional simplex set, the entity nodes appearing in all ternary relation records are deduplicated and used as the vertex set. Each pair of entity nodes involved in the ternary relation record and the corresponding relation edge are used as the edge set. The triangular face formed by the three closed edges corresponding to each ternary relation record is used as the face set. Each triangular face is written with a face identifier, a three-vertex identifier, and a three-edge identifier to obtain the two-dimensional simplex set. The simplex complex walk is used to perform walks on a set of two-dimensional simplexes to generate evidence surfaces. The simplex complex walk includes selecting a starting vertex from the vertex set, executing a step sequence between vertex, edge, and face and recording the set of faces traversed. Each step of the step sequence selects the next simplex from the set of adjacent simplexes of the current simplex. The set of adjacent simplexes is defined as the set of simplexes that share a vertex or an edge with the current simplex. A non-backtracking random walk is used to perform a walk on the current alarm association subgraph to generate an evidence chain. The non-backtracking random walk uses directed edges as states, and the state consists of the starting entity identifier and the ending entity identifier. In the first step, a directed edge is selected from the set of outgoing edges of the starting entity node as the initial state. In each subsequent step, the next directed edge is selected from the set of outgoing edges of the ending entity node, and the ending entity identifier of the next directed edge is not equal to the starting entity identifier of the current directed edge. The directed edge sequence is recorded to obtain the evidence chain. Output the evidence surface set and the evidence chain set. The evidence surface set includes surface identifiers, entity identifiers within the surface, and relation identifiers within the surface. The evidence chain set includes chain identifiers, directed edge sequences, and entity identifier sequences corresponding to the sequences.

[0026] In this embodiment, the step of generating the assessment result and command action sequence based on the chain of evidence, the evidence surface, and counterfactual discrepancy evidence includes: A set of analytical elements is generated based on the evidence chain set, evidence surface set, and counterfactual difference evidence. This set includes event entity identifiers, event categories, regional entity identifiers, object entity identifiers, equipment entity identifiers, evidence chain identifiers, evidence surface identifiers, event node confidence difference values, and relationship edge existence difference markers. Specifically, the set of analytical elements generated based on the evidence chain set, evidence surface set, and counterfactual difference evidence is as follows: The evidence chain set is analyzed to obtain the chain identifier and entity identifier sequence. Event entity identifier, region entity identifier, object entity identifier and equipment entity identifier are extracted from the entity identifier sequence to form a chain-level record. The evidence surface set is analyzed to obtain the surface identifier and surface entity identifier. Event entity identifier, region entity identifier and object entity identifier are extracted from the surface entity identifier to form a surface-level record. The chain-level record and surface-level record are merged with the event entity identifier to obtain the evidence chain identifier and evidence surface identifier. The confidence difference value of event nodes is calculated from the counterfactual difference evidence as the factual confidence value minus the counterfactual confidence value. Relationship edge existence difference markers are generated according to the 0.5 threshold. If the factual confidence value is not less than 0.5 and the counterfactual confidence value is less than 0.5, it is marked as 1. If the factual confidence value is less than 0.5 and the counterfactual confidence value is not less than 0.5, it is marked as negative 1. Event categories and all fields are summarized to form a set of judgment elements. The analysis results are generated based on the set of analysis elements. The analysis results include the event type field, risk level field, scope of impact field and evidence set field. The event type field is determined by the event category. The risk level field is determined by the difference in confidence level of event nodes and the length of the evidence chain. The scope of impact field is determined by the regional entity identifier, the object entity identifier and the equipment entity identifier. The evidence set field includes the evidence chain identifier, the evidence surface identifier and the counterfactual difference evidence identifier. In the knowledge graph, the judgment results are used as search conditions to obtain a set of candidate contingency plan templates and a set of candidate available resources. Based on the set of candidate contingency plan templates and the set of candidate available resources, a sequence of command actions is generated.

[0027] In this embodiment, the step of sending the command action sequence to the linkage platform for execution and collecting execution receipts and status change data includes: The command action sequence is sent to the linkage platform for execution. The linkage platform calls the corresponding interface according to the action type sequence to complete the notification, dispatch and equipment linkage, and generates an execution status identifier and execution timestamp for each action identifier. Collect execution receipts and status change data corresponding to action identifiers. Execution receipts include action identifiers, a set of receipt fields, and a receipt timestamp. Status change data includes device status fields, object status fields, and area status fields, as well as corresponding timestamps. Merge execution receipts and status change data according to action identifiers to generate a receipt record set. Write the receipt record set back to the knowledge graph to update the entity status and relationship records, update the disposal status field of the event entity, update the occupancy status field of the resource entity, and update the running status field of the device entity. Update the relationship records, including the execution relationship between the write action entity and the event entity, the occupancy relationship between the write action entity and the resource entity, and the linkage relationship between the write action entity and the device entity.

[0028] Example 1: To verify the feasibility of this invention in practice, it was applied to a multi-point monitoring center scenario. The platform accesses multi-source monitoring data, including multiple video streams, IoT alarms such as access control and fire alarms, key equipment operating status, and business event logs. The data sources are inconsistent in terms of time base, spatial identifier, and event fields. Traditionally, operators need to repeatedly switch between alarm lists, video playback, and equipment status pages to complete analysis and dispatch, and different shifts have inconsistent handling standards for similar alarms. In the current scenario, the monitoring area is divided into several logical areas, and each area is mapped to cameras, sensors, equipment, contingency plans, and resources. Multi-source event streams are aggregated with a fixed time window, and the analysis output must include verifiable evidence for the shift leader to review and for post-event traceability.

[0029] The method of this invention is deployed as a closed-loop process: data acquisition and preprocessing—video slicing—improved model output of event graph—construction of knowledge graph and alarm association subgraph—hierarchical random walk reasoning—generation of command action sequence—linked execution and feedback write-back. After video segments enter the improved LSKNet network, a structured event graph is output. The nodes and edges of the event graph are directly mapped to objects, events, regions, and relationships in the knowledge graph. Graph query results are used to update the event graph. A counterfactual branch simultaneously generates a contrasting event graph to produce discrepancy evidence, facilitating the downgrading of weak evidence alarms to review rather than direct triggering of action. After forming the alarm association subgraph, a simple complex walk generates an evidence surface from the ternary structure of object—region—event and event—plan—resource. A non-backtracking random walk generates a stable evidence chain in the directed edge state space. The evidence surface, evidence chain, and counterfactual discrepancy evidence are merged to output the judgment result. Plans and resources are retrieved from the graph to automatically generate action sequences, which are then sent to the linkage platform for execution. Execution feedback and equipment status changes are written back to the graph to trigger re-judgment conditions, achieving dynamic adjustment during the handling process.

[0030] To verify the beneficial effects, a business cycle of continuous operation in the current scenario was selected for statistical analysis. The input side accumulated 36 video channels and over 120 IoT and device status data points. Business events originated from three types of system logs. Operating within fixed time windows, hundreds of thousands of video segments were processed, and the number of entity additions and updates to the data map exceeded one million. The construction frequency of alarm-related sub-graphs was synchronized with the video time windows. On the linkage side, three types of interfaces were used: work orders, intercom notifications, and device linkage. Tens of thousands of command action sequences were automatically generated, and tens of thousands of feedback records were written back, forming a closed-loop trajectory of alarm—analysis—issuance—feedback—re-analysis. Statistics show that the number of times on-duty personnel manually reviewed videos under the same alarm volume significantly decreased, the number of cross-platform switching decreased, and the handling actions shifted from manual, item-by-item issuance to serialized, automatic issuance. Furthermore, each analysis outputted alarm-related sub-graphs. Figure 1 The evidence presented and the chain of evidence are used for review, thereby supporting consistent handling by the work team and subsequent auditing.

[0031] Table 1 Comparison Indicators of Intelligent Command and Control Effect in Monitoring Centers

[0032] As shown in Table 1, in terms of judgment efficiency, the average judgment latency of the method of this invention is 7.8s, which is significantly lower than the rule engine solution's 31.6s, single video analysis's 18.9s, and multi-source fusion without graphs' 15.2s. It is also better than the graph without counterfactual's 10.6s and the graph + conventional walk's 9.4s. This indicates that under the same input intensity, it can complete alarm association and judgment output faster, reducing the waiting time for on-duty personnel and the cost of cross-platform switching.

[0033] In terms of assessment quality and interpretability, the false alarm rate of this invention is 3.6% and the false negative rate is 4.2%, which are lower than the 14.8% and 12.5% ​​of the rule engine solution and the 10.9% and 9.6% of the single video analysis solution. Meanwhile, the alarm deduplication and merging rate reaches 68.4%, higher than the 52.6% of multi-source fusion without graph and the 63.5% of graph + regular walk. The evidence output coverage rate reaches 92.1%, a further improvement compared to the 79.4% of graph without counterfactual evidence and the 81.6% of graph + regular walk, demonstrating more complete evidence organization and easier verification.

[0034] In terms of command implementation and closed-loop effectiveness, the automatic action generation rate of this invention is 87.6%, significantly higher than the 35.8% of the rule engine solution, 22.4% of single video analysis, and 54.1% of multi-source fusion without graph; the linkage execution success rate is 98.3%, higher than the 92.7% of the rule engine solution and 90.4% of single video analysis. The five-minute response rate reaches 89.8%, better than the 84.7% of graph without counterfactual and the 83.5% of graph + conventional walk, indicating that the response collection and graph writing after linkage execution are more stable and the closed-loop update is more timely.

[0035] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A knowledge graph-based intelligent command and control method for monitoring centers, characterized in that, include: Collect multi-source monitoring data from the monitoring center, preprocess the multi-source monitoring data, and generate multi-source event data streams; Video data is extracted from multi-source monitoring data, and video segments are obtained by slicing the data according to time windows. At the same time, multi-source event data streams are aggregated according to the same time window to obtain synchronous event segments. An improved LSKNet network is constructed. Based on the event graph generation head, features are extracted from video segments to generate event graphs. A differentiable graph query layer is used to generate query vectors with event nodes and region nodes to update the event graphs. A counterfactual dual branch is introduced to generate fact event graphs and counterfactual event graphs respectively, and counterfactual discrepancy evidence is calculated. Synchronous event fragments are aligned with event graphs to generate entities and relationships, and a knowledge graph is constructed to form a subgraph associated with the current alarm. Based on hierarchical random walk, reasoning is performed on the current alarm association subgraph. A two-dimensional simplex is constructed using simplex walk and evidence surface is generated. An evidence chain is generated by walking with directed edges as the state through non-backtracking random walk. Based on the chain of evidence, the evidence presented, and counterfactual discrepancies, an assessment result and a sequence of command actions are generated. The command action sequence is sent to the linkage platform for execution, execution receipts and status change data are collected, and the execution receipts and status change data are written back to the knowledge graph to update the entity status and relationship records.

2. The intelligent command and control method for a monitoring center based on knowledge graphs according to claim 1, characterized in that, The multi-source monitoring data includes video stream data, IoT alarm data, device status data, and business event data.

3. The intelligent command and control method for a monitoring center based on knowledge graphs according to claim 1, characterized in that, The generation of multi-source event data streams includes: Collect multi-source monitoring data from the monitoring center and write a data source identifier, collection timestamp, and spatial identifier for each piece of collected data. Time alignment and spatial identification unification processing are performed on multi-source monitoring data. The collection timestamps of each data source are converted into a unified time reference, resampling is performed according to time resolution, and camera location identifiers, sensor location identifiers and business area identifiers are mapped to a unified area identifier. After time alignment and spatial identification unification, the multi-source monitoring data is subjected to field standardization and data cleaning. The alarm type field, object identifier field, status field and numerical field are mapped to a unified field set, the numerical field is converted to a unified unit of measurement, data records with missing key fields are removed and duplicate data records are merged, and a multi-source event data stream containing event identifier, data source identifier, unified timestamp, unified area identifier, event type, object identifier and event payload is generated.

4. The intelligent command and control method for a monitoring center based on knowledge graphs according to claim 1, characterized in that, The process of aggregating multi-source event data streams into synchronized event segments according to the same time window includes: Video data is extracted from multi-source monitoring data, and the video data is split into channels according to camera identifiers. Each channel of video data is written with the corresponding camera identifier, area identifier, and unified timestamp. Each video data stream is sliced ​​into video segments according to a time window. The time window is determined by the start time and length of the time window. The start time of the time window increases with the step size. The generated video segment contains the continuous frame sequence within the current time window and the corresponding frame timestamp sequence. The multi-source event data streams are aggregated according to the start time and length of the time window, which are consistent with the time window. Event records with a unified timestamp falling into the current time window are filtered and merged according to the camera identifier or area identifier to obtain the synchronized event segments corresponding to the video segments at the start time and area identifier of the time window.

5. The intelligent command and control method for a monitoring center based on knowledge graphs according to claim 1, characterized in that, The calculation yields counterfactual discrepancy evidence, including: An improved LSKNet network is constructed, which includes a backbone feature extraction network, an event graph generation head, a differentiable graph query layer, and a counterfactual dual branch. Video segments are input into the backbone feature extraction network to obtain feature tensors representing the video segments. An event graph generation head is used to perform node and edge generation on the feature tensor, and outputs an initial event graph. The initial event graph contains a set of object nodes, a set of event nodes, a set of region nodes, and a set of relation edges. The set of relation edges contains object-region relation edges, event-object relation edges, and event-region relation edges. A differentiable graph query layer is used to perform query vector generation, subgraph summary reading and back-injection update on the initial event graph. Query vector generation is based on event nodes and region nodes to generate query vectors. Subgraph summary reading reads the matching subgraph summary from the knowledge graph based on the query vector. Back-injection update maps the subgraph summary to an update vector and injects it into the initial event graph to obtain the updated event graph. A counterfactual dual-branch approach is introduced to perform factual branch reasoning and counterfactual branch reasoning on the updated event graph. Factual branch reasoning outputs a fact event graph, and counterfactual branch reasoning outputs a counterfactual event graph. Perform a difference calculation on the fact event graph and the counterfactual event graph to obtain counterfactual difference evidence. The difference calculation includes calculating the differences between the two in terms of event node confidence values, relation edge existence labels, and region node association strength values, and outputs the updated event graph and counterfactual difference evidence.

6. The intelligent command and control method for a monitoring center based on knowledge graphs according to claim 1, characterized in that, The construction of the knowledge graph, forming the current alarm association subgraph, includes: Establish a knowledge graph schema and initialize the knowledge graph. The knowledge graph schema includes a set of entity types and a set of relationship types. The set of entity types includes object entities, event entities, region entities, and device entities. The set of relationship types includes object-region relationships, event-object relationships, event-region relationships, and device-region relationships. Perform entity alignment on the synchronized event fragments and the updated event graph and write them to the entity set. Entity alignment includes generating entity keys for object nodes, event nodes, region nodes and device entries, and matching them with knowledge graph entity keys. If the match is successful, update the entity attributes. If the match fails, create a new entity and write it to the corresponding entity type set. Based on the entity alignment results, a relation set is generated and written. Object-region relations, event-object relations, event-region relations and device-region relations are generated and written into the corresponding relation type set to complete the knowledge graph construction. Adjacent entities and relation edges are extracted with the event entity in the current time window as the center to form the current alarm association subgraph.

7. The intelligent command and control method for a monitoring center based on knowledge graphs according to claim 1, characterized in that, The method involves constructing a two-dimensional simplex using simplex walks and generating evidence surfaces. Evidence chains are generated through non-backtracking random walks with directed edges as states, including: Extract a set of ternary relationships from the current alarm association subgraph and construct a two-dimensional simplex set. The set of ternary relationships includes the ternary relationship between object entity, region entity, and event entity, and the ternary relationship between event entity, contingency plan entity, and resource entity. The two-dimensional simplex set consists of a vertex set, an edge set, and a face set. The vertex set contains all entity nodes involved in the ternary relationship. The edge set contains a relationship edge from the set of relationship types between any two entity nodes. The face set contains a triangular face formed by the closure of three edges corresponding to the same ternary relationship. The simplex complex walk is used to perform walks on a set of two-dimensional simplexes to generate evidence surfaces. The simplex complex walk includes selecting a starting vertex from the vertex set, executing a step sequence between vertex, edge, and face and recording the set of faces traversed. Each step of the step sequence selects the next simplex from the set of adjacent simplexes of the current simplex. The set of adjacent simplexes is defined as the set of simplexes that share a vertex or an edge with the current simplex. A non-backtracking random walk is used to perform a walk on the current alarm association subgraph to generate an evidence chain. The non-backtracking random walk uses directed edges as states, and the state consists of the starting entity identifier and the ending entity identifier. In the first step, a directed edge is selected from the set of outgoing edges of the starting entity node as the initial state. In each subsequent step, the next directed edge is selected from the set of outgoing edges of the ending entity node, and the ending entity identifier of the next directed edge is not equal to the starting entity identifier of the current directed edge. The directed edge sequence is recorded to obtain the evidence chain. Output the evidence surface set and the evidence chain set. The evidence surface set includes surface identifiers, entity identifiers within the surface, and relation identifiers within the surface. The evidence chain set includes chain identifiers, directed edge sequences, and entity identifier sequences corresponding to the sequences.

8. The intelligent command and control method for a monitoring center based on knowledge graphs according to claim 1, characterized in that, The process of generating assessment results and command action sequences based on the chain of evidence, evidentiary aspects, and counterfactual discrepancies includes: Based on the evidence chain set, evidence surface set, and counterfactual difference evidence, a set of judgment elements is generated. The set of judgment elements includes event entity identifier, event category, regional entity identifier, object entity identifier, equipment entity identifier, evidence chain identifier, evidence surface identifier, event node confidence difference value, and relationship edge existence difference mark. The analysis results are generated based on the set of analysis elements. The analysis results include the event type field, risk level field, scope of impact field and evidence set field. The event type field is determined by the event category. The risk level field is determined by the difference in confidence level of event nodes and the length of the evidence chain. The scope of impact field is determined by the regional entity identifier, the object entity identifier and the equipment entity identifier. The evidence set field includes the evidence chain identifier, the evidence surface identifier and the counterfactual difference evidence identifier. In the knowledge graph, the judgment results are used as search conditions to obtain a set of candidate contingency plan templates and a set of candidate available resources. Based on the set of candidate contingency plan templates and the set of candidate available resources, a sequence of command actions is generated.

9. The intelligent command and control method for a monitoring center based on knowledge graphs according to claim 1, characterized in that, The process of sending the command action sequence to the linkage platform for execution and collecting execution receipts and status change data includes: The command action sequence is sent to the linkage platform for execution. The linkage platform calls the corresponding interface according to the action type sequence to complete the notification, dispatch and equipment linkage, and generates an execution status identifier and execution timestamp for each action identifier. Collect execution receipts and status change data corresponding to action identifiers. Execution receipts include action identifiers, a set of receipt fields, and a receipt timestamp. Status change data includes device status fields, object status fields, and area status fields, as well as corresponding timestamps. Merge execution receipts and status change data according to action identifiers to generate a receipt record set. Write the receipt record set back to the knowledge graph to update the entity status and relationship records, update the disposal status field of the event entity, update the occupancy status field of the resource entity, and update the running status field of the device entity. Update the relationship records, including the execution relationship between the write action entity and the event entity, the occupancy relationship between the write action entity and the resource entity, and the linkage relationship between the write action entity and the device entity.

Images