An intrusion identification method and device based on a distributed optical fiber sensing system, an electronic device, and a storage medium

Abstract

This application discloses an intrusion identification method based on a distributed fiber optic sensing system. It determines the node state of each phase point in the distributed fiber optic sensing system using a time-continuous intrusion identification model. Based on the spatial distribution location and node state of each phase point, a node state space sequence is constructed. Several abnormal segments of the node state space sequence are selected from this sequence, and the intrusion identification result corresponding to each abnormal segment is output using a spatially continuous intrusion identification model. This application combines time and spatial continuity to achieve intrusion identification, effectively addressing situations of node ambiguity and anomalies, improving the accuracy and efficiency of intrusion identification, and can be widely applied in the field of security technology.

Description

Technical Field

[0001] This application relates to the field of security technology, and in particular to an intrusion identification method, device, electronic device and storage medium based on a distributed optical fiber sensing system. Background Technology

[0002] Distributed fiber optic sensing technology, based on optical fibers as sensing units, features full distribution, high sensitivity, and wide dynamic range. This gives it unparalleled advantages over traditional technologies in large-scale monitoring and accurate identification of environmental disturbances.

[0003] An intrusion detection system based on distributed fiber optic sensing technology can continuously monitor the inside and outside of utility tunnels, enabling real-time responses to dynamic changes. Once an intrusion event occurs, the signal in the fiber optic cable will change significantly. By acquiring and analyzing the signal in real time, intrusion behaviors such as damage to the utility tunnel, theft, construction work, or other abnormal activities can be identified promptly.

[0004] However, in practical applications, intrusion detection based on distributed fiber optic sensing systems also faces a series of technical challenges. Most existing methods collect fiber optic sensing data and then feed it into a deep learning network model for intrusion detection and event identification. However, the deep learning network models in existing methods have the following drawbacks: 1) When processing long sequence data, there are gradient vanishing or gradient exploding problems. Machine learning becomes difficult to learn new knowledge in the later stages, and it is difficult to take into account information from further back when processing data. This makes it easy to miss anomalies when judging long intervals. 2) The data was analyzed and processed only from the perspective of temporal continuity, ignoring the spatial continuity of the propagation of the earthquake data. This resulted in the model's poor performance in judging the edge state of the event and a narrow division of the abnormal interval.

[0005] Therefore, the above technical problems urgently need to be solved. Summary of the Invention

[0006] The main objective of this application is to propose an intrusion identification method, device, electronic device, and storage medium based on a distributed optical fiber sensing system, which can improve the accuracy and efficiency of intrusion identification.

[0007] On the one hand, embodiments of this application propose an intrusion identification method based on a distributed optical fiber sensing system, the method comprising the following steps: Collect time-series data corresponding to each phase point in a distributed fiber optic sensing system; Acquire temporally continuous intrusion detection models and spatially continuous intrusion detection models; The time-continuous intrusion identification model is used to determine the node status of each phase point based on the time series data corresponding to each phase point. The node status includes node abnormality and node normality. Obtain the spatial distribution position corresponding to each phase point, and construct a node state space sequence composed of all the phase points based on the spatial distribution position corresponding to each phase point and the node state. Several abnormal segments of the node state space sequence are selected from the node state space sequence, wherein the abnormal segments of the node state space sequence include multiple abnormal nodes that appear consecutively more than or equal to a preset abnormal identification threshold, and the abnormal nodes are the phase points in which the node state is abnormal. The abnormal segments of the state space sequence of each node and the time series data corresponding to each phase point are input into the spatial continuous intrusion identification model, and the intrusion identification results corresponding to the abnormal segments of the state space sequence of each node are output using the spatial continuous intrusion identification model.

[0008] In some embodiments, the acquisition of time-series data corresponding to each phase point in the distributed optical fiber sensing system specifically includes: According to a preset time interval, the fiber optic sensing signals corresponding to each phase point are dynamically acquired, each fiber optic sensing signal is converted into an electrical signal, and the signal acquisition time node of each electrical signal is determined. Perform signal preprocessing on each of the electrical signals to obtain two-dimensional information corresponding to each of the electrical signals; For each phase point, the time series data corresponding to the phase point is determined based on the two-dimensional information and the signal acquisition time node corresponding to each two-dimensional information.

[0009] In some embodiments, the temporally continuous intrusion detection model includes a training layer and a fully connected classification layer. The step of using the temporally continuous intrusion detection model to determine the node state of each phase point based on the time-series data corresponding to each phase point specifically includes: The time series data corresponding to each phase point is input into the training layer to capture the long-term dependencies of the time series and output the feature representation information corresponding to the time series data. The feature representation information is input into the fully connected classification layer for feature recognition, and the feature recognition result corresponding to each phase point is determined. The feature recognition result includes the node state and the probability value of each preset intrusion event category.

[0010] In some embodiments, obtaining the spatial distribution position corresponding to each phase point, and constructing a node state space sequence composed of all the phase points based on the spatial distribution position corresponding to each phase point and the node state, specifically includes: Based on the spatial distribution positions corresponding to each phase point, the positions are sorted to determine the sequence positions corresponding to each phase point; The node state space sequence is constructed based on the sequence position corresponding to each phase point and the node state.

[0011] In some embodiments, the step of filtering out a plurality of abnormal segments of the node state space sequence from the node state space sequence specifically includes: Construct a sliding window with a window width corresponding to the anomaly detection threshold; The sliding window is used to slide in the node state space sequence to filter out multiple abnormal node segments, wherein there are no overlapping abnormal nodes between the abnormal node segments, and the abnormal node segment is a sequence segment in the node state space sequence composed of multiple consecutively occurring abnormal nodes with a number equal to the abnormal identification threshold. Based on the node state space sequence and the preset segment expansion rules, each abnormal node segment is expanded and truncated to determine the abnormal node expansion segment corresponding to each abnormal node segment. The multiple abnormal node extension segments are deduplicated to identify the abnormal segments of the state space sequence of each node.

[0012] In some embodiments, the spatially continuous intrusion detection model includes a first detection module and a second detection module. The step of inputting the abnormal segments of the state space sequence of each node and the time series data corresponding to each phase point into the spatially continuous intrusion detection model, and using the spatially continuous intrusion detection model to output the intrusion detection results corresponding to the abnormal segments of the state space sequence of each node, specifically includes: Based on the time series data corresponding to each phase point, determine the abnormal control segment corresponding to each time node for the abnormal segment of the state space sequence of each node; The abnormal fragments of the state space sequence of each node are input into the first identification module, and the target intrusion event corresponding to each abnormal fragment of the state space sequence of the node is output. For each abnormal segment of the state space sequence of the nodes, the target intrusion identification event and the corresponding abnormal comparison segment are input to the second identification module to perform intrusion event identification verification, and the intrusion identification result is output. The intrusion identification result includes the probability value of the target intrusion event and the identification judgment result.

[0013] In some embodiments, the step of expanding and truncating each abnormal node segment according to the node state space sequence and a preset segment expansion rule, and determining the abnormal node expansion segment corresponding to each abnormal node segment, specifically includes: Determine the start node and end node of the segment from the abnormal node segment; Based on the segment start node, the segment is extended forward, and a first target node is determined from the node state space sequence. The first target node is the phase point in the node state space sequence that is located before the segment start node and is closest to the segment start node, and whose node state is normal. Based on the segment termination node, the segment is extended backward, and a second target node is determined from the node state space sequence. The second target node is the phase point in the node state space sequence that is located after the segment termination node and is closest to the segment termination node, and the node state is normal. Based on the first target node and the second target node, the node state space sequence is segmented to obtain the extended segment of the abnormal node.

[0014] On the other hand, embodiments of this application propose an intrusion detection device based on a distributed optical fiber sensing system, the device comprising: The first module is used to collect time series data corresponding to each phase point in the distributed optical fiber sensing system. The second module is used to acquire the temporally continuous intrusion detection model and the spatially continuous intrusion detection model; The third module is used to determine the node status of each phase point based on the time series data corresponding to each phase point using the time-continuous intrusion identification model. The node status includes node abnormality and node normality. The fourth module is used to obtain the spatial distribution position corresponding to each phase point, and construct a node state spatial sequence composed of all the phase points based on the spatial distribution position corresponding to each phase point and the node state. The fifth module is used to filter out several abnormal segments of the node state space sequence from the node state space sequence, wherein the abnormal segments of the node state space sequence include multiple abnormal nodes that appear consecutively more than or equal to a preset abnormal identification threshold, and the abnormal nodes are the phase points where the node state is abnormal. The sixth module is used to input the abnormal segments of the state space sequence of each node and the time series data corresponding to each phase point into the spatial continuous intrusion identification model, and use the spatial continuous intrusion identification model to output the intrusion identification results corresponding to the abnormal segments of the state space sequence of each node.

[0015] On the other hand, embodiments of this application propose an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the intrusion identification method described above.

[0016] On the other hand, embodiments of this application propose a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned intrusion identification method.

[0017] The embodiments of this application include at least the following beneficial effects: This application provides an intrusion identification method based on a distributed optical fiber sensing system. It determines the node state of each phase point in the distributed optical fiber sensing system using a time-continuous intrusion identification model. Based on the spatial distribution location and node state corresponding to each phase point, a node state space sequence is constructed. Several abnormal segments of the node state space sequence are selected from the sequence. The intrusion identification result corresponding to each abnormal segment of the node state space sequence is output using a spatially continuous intrusion identification model. This application combines time continuity and spatial continuity to achieve intrusion identification, effectively addressing the situation of fuzzy and abnormal nodes, and improving the accuracy and efficiency of intrusion identification. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of an intrusion identification method based on a distributed optical fiber sensing system provided in an embodiment of this application; Figure 2 This is a flowchart of step S101 in the embodiments of this application; Figure 3 This is a schematic diagram of the node state space sequence in an embodiment of this application; Figure 4 This is a flowchart of step S105 in the embodiments of this application; Figure 5 This is a flowchart of step S403 in the embodiments of this application; Figure 6 This is a schematic diagram of an abnormal node expansion segment in an embodiment of this application; Figure 7 This is a flowchart of step S106 in the embodiments of this application; Figure 8 This is a schematic diagram of the abnormal control segment in the embodiments of this application; Figure 9 This is a schematic diagram of the structure of an intrusion detection device based on a distributed optical fiber sensing system provided in an embodiment of this application; Figure 10 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0022] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0023] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0025] Before providing a detailed description of the embodiments of this application, some of the nouns and terms involved in the embodiments of this application will be explained first. The nouns and terms involved in the embodiments of this application are subject to the following interpretations.

[0026] 1) DAS (Direct Attached Storage): This is a storage technology that directly connects storage devices to computers or servers. It connects directly to the host via a SCSI interface or Fibre Channel and is typically used to expand local storage space.

[0027] 2) An FTP (File Transfer Protocol Server) is a computer system based on the FTP protocol, specifically designed to provide file storage and access services over a network. It allows users to interact with the server through an FTP client or web browser to upload, download, and manage files.

[0028] 3) Φ-OTDR Distributed Fiber Optic Sensing System: This is a sensing system based on the principle of phase-sensitive optical time-domain reflectometry (Φ-OTDR), primarily used to monitor vibration and strain changes in optical fibers. This system achieves precise location and monitoring of vibration events along the fiber by analyzing the interference effect of backscattered Rayleigh light in the fiber.

[0029] Distributed fiber optic sensing technology, based on optical fibers as sensing units, features full distribution, high sensitivity, and a wide dynamic range. This gives it unparalleled advantages over traditional technologies in large-scale monitoring and precise identification of environmental disturbances. In particular, phase-sensitive optical time-domain reflectometry (Φ-OTDR) technology, by detecting Rayleigh backscattered signals in optical fibers, can perform long-distance, real-time monitoring of acoustic and vibration signals in the external environment, greatly enhancing the ability to detect intrusion events. Therefore, Φ-OTDR technology has significant application prospects in the security field, especially for monitoring special areas such as underground utility tunnels.

[0030] In practical applications, underground utility tunnels, as an important urban infrastructure, are typically located underground, making direct monitoring difficult. Due to complex environmental factors, including poor lighting, humidity, structural vibration, temperature variations, and environmental noise, traditional intrusion detection methods struggle to meet the demands for long-term, efficient, and accurate monitoring. However, current fiber optic protection technology possesses advantages such as high and low temperature resistance, corrosion resistance, compact structure, easy installation, and low maintenance costs. Intrusion detection systems based on distributed fiber optic sensing technology can achieve real-time response to dynamic changes inside and outside the utility tunnel through continuous fiber optic monitoring. Once an intrusion event occurs, the signal in the fiber optic cable will change significantly. Real-time acquisition and analysis of this signal can promptly identify intrusion behaviors, such as tunnel damage, theft, construction work, or other abnormal activities.

[0031] However, in practical applications, intrusion detection based on distributed fiber optic sensing systems also faces a series of technical challenges. Most existing methods collect fiber optic sensing data and then feed it into deep learning network models for intrusion detection and event identification. While most existing deep learning methods can automatically learn features from large amounts of data and handle more complex nonlinear problems, such as residual networks and convolutional neural networks, they suffer from the following drawbacks: 1) When processing long sequence data, there are gradient vanishing or gradient exploding problems. Machine learning becomes difficult to learn new knowledge in the later stages, and it is difficult to take into account information from further back when processing data. This makes it easy to miss anomalies when judging long intervals. 2) The data was analyzed and processed only from the perspective of temporal continuity, ignoring the spatial continuity of the propagation of the earthquake data. This resulted in the model's poor performance in judging the edge state of the event and a narrow division of the abnormal interval.

[0032] Based on this, this application proposes an intrusion identification method, device, electronic device, and storage medium based on a distributed optical fiber sensing system. When identifying external intrusion behavior into optical cables, it combines temporal and spatial continuity, and uses temporally continuous and spatially continuous intrusion identification models to infer the temporal and spatial situations before and after the occurrence of an anomaly. This improves the accuracy of judging the range of anomalies and the determination of ambiguous node situations. Furthermore, the temporally continuous and spatially continuous intrusion identification models effectively alleviate the gradient vanishing problem and improve the accuracy of intrusion identification.

[0033] Reference Figure 1 , Figure 1 This is an optional flowchart of an intrusion detection method based on a distributed optical fiber sensing system provided in an embodiment of this application. The method may include, but is not limited to, steps S101 to S106: Step S101: Collect time series data corresponding to each phase point in the distributed optical fiber sensing system; Step S102: Obtain the temporally continuous intrusion detection model and the spatially continuous intrusion detection model; Step S103: Using a time-continuous intrusion identification model, determine the node status of each phase point based on the time series data corresponding to each phase point. The node status includes abnormal node and normal node. Step S104: Obtain the spatial distribution position corresponding to each phase point, and construct a node state space sequence composed of all phase points based on the spatial distribution position and node state corresponding to each phase point. Step S105: Select several abnormal segments of the node state space sequence from the node state space sequence. The abnormal segments of the node state space sequence include multiple abnormal nodes that appear consecutively more than or equal to a preset abnormal identification threshold. The abnormal nodes are the phase points where the node state is abnormal. Step S106: Input the abnormal segments of the state space sequence of each node and the time series data corresponding to each phase point into the spatial continuous intrusion identification model, and use the spatial continuous intrusion identification model to output the intrusion identification results corresponding to the abnormal segments of the state space sequence of each node.

[0034] In some embodiments, the distributed fiber optic sensing system may include, but is not limited to, narrow-linewidth lasers, couplers, acousto-optic modulators, erbium-doped fiber amplifiers, function generators, filters, circulators, polarization controllers, data acquisition devices, photodetectors, and polarization beam splitters.

[0035] Specifically, a narrow-linewidth laser is activated, and a stable continuous optical signal is output from the narrow-linewidth laser as the light source input. The continuous optical signal is sent to an acousto-optic modulator through a coupler. At the same time, a pulse signal with a spatial resolution of 8m and a repetition frequency of 2.5kHz generated by a function generator is sent to the acousto-optic modulator. The acousto-optic modulator pulses the optical signal and outputs a pulsed optical signal. Then, the pulsed optical signal is sent to an erbium-doped fiber amplifier (EDFA) for power amplification, so that the signal strength of the pulsed optical signal meets the requirements of long-distance transmission. The amplified pulsed optical signal is introduced into the sensing fiber through a circulator, and the polarization state of the optical signal is adjusted by a polarization controller to improve the stability of the pulsed optical signal during transmission in the fiber.

[0036] When the sensing fiber is disturbed by external forces, the backscattered Rayleigh light in the fiber carries the disturbance information back and is guided back to the receiver by a circulator. After the noise is removed by a filter, the returned Rayleigh scattered light enters a polarization beam splitter to separate optical signals with different polarization states, thereby improving the sensitivity of the distributed fiber optic sensing system. The separated optical signals are then converted into electrical signals by a photodetector.

[0037] In some embodiments, refer to Figure 2 , Figure 2 This is an optional flowchart of step S101 in the embodiments of this application. Step S101 may include, but is not limited to, steps S201 to S203: Step S201: According to the preset time interval, dynamically collect the fiber optic sensing signals corresponding to each phase point, convert each fiber optic sensing signal into an electrical signal, and determine the signal acquisition time node of each electrical signal. Step S202: Perform signal preprocessing on each electrical signal to obtain the two-dimensional information corresponding to each electrical signal; Step S203: For each phase point, determine the time series data corresponding to the phase point based on each two-dimensional information and the signal acquisition time node corresponding to each two-dimensional information.

[0038] In some embodiments, optical cables are laid out in underground utility tunnels using methods such as bending and winding or straight laying, and connected to a distributed optical cable sensing system to complete data acquisition at each phase point.

[0039] Alternatively, assuming that intrusion events in the underground utility tunnel include biological intrusion, theft, excavator intrusion, traffic noise interference, and normal conditions, since the optical cables in the tunnel are suspended or placed, data collection is generally achieved through sound vibration propagation or by directly touching the optical cables to cause vibration, thereby generating abnormal data.

[0040] Next, the fiber optic cable layout route is obtained. Multiple phase points are determined along the route according to a preset distance interval. The fiber optic sensing signals of each phase point are collected and analyzed by a distributed fiber optic sensing system. Since the fiber optic cable is sensitive to vibration, in order to avoid data interference or the influence of road traffic noise, the data acquisition time interval is preset. According to the preset time interval, the fiber optic sensing signals of each phase point are collected at regular intervals. The photodetectors in the distributed fiber optic sensing system convert the fiber optic sensing signals of each phase point into electrical signals.

[0041] In some embodiments, the electrical signals at each phase point are preprocessed, including data classification and labeling, adaptive noise reduction based on empirical mode decomposition, signal compression, and signal conversion.

[0042] Optionally, the data classification and labeling includes temporal continuity labeling and spatial continuity labeling. For fiber optic sensing signals collected at different time nodes at the same phase point, temporal continuity labeling is performed to determine the signal acquisition time node of the fiber optic sensing signal. For electrical signals collected at different phase points, spatial continuity labeling is performed to determine the acquisition location of the electrical signal.

[0043] Adaptive noise reduction based on empirical mode decomposition includes the following steps: 1) The original phase signal (the electrical signal mentioned above) is decomposed into a set of intrinsic mode functions (IMFs) and a residual using Empirical Mode Decomposition (EMD). EMD is an adaptive signal decomposition method that can decompose the signal into IMF components in different frequency ranges, with the components arranged from high to low frequencies. The decomposed signal can be represented as: ; in, It is the original phase signal. It is the first i One eigenmode function It is the total number of IMFs. It is the residual term. It is a time variable; 2) For each IMF component, calculate the root mean square error (RMSE) and smoothness (r) of the IMF component to determine whether it is mainly composed of noise. The formulas for calculating the root mean square error (RMSE) and smoothness (r) are as follows: ; ; in, for The root mean square error, For the original phase signal in time The value, The length of the signal, i.e., the total number of data points. for Smoothness; 3) Denoising each IMF component based on the soft thresholding method: By setting a threshold λ, coefficients smaller than the threshold are set to zero, thereby effectively removing high-frequency noise. At the same time, the RMSE and r of each IMF component are normalized. The formulas for denoising and normalization are as follows: ; ; in, for The normalized root mean square error, It is the minimum RMSE among all IMFs. The maximum value among all IMF RMSEs. for Normalized smoothness, The minimum value of r among all IMFs. The maximum value of r among all IMFs; 4) To comprehensively consider both RMSE and r, a coefficient of variation weighting algorithm is used to calculate the fusion index for each IMF component based on RMSE and r. Integration indicators The calculation formula is as follows: ; ; ; in, and To normalize the weights, The standard deviation of the normalized smoothness for all IMFs. The standard deviation of the normalized root mean square error for all IMFs; 5) By calculating the fusion index of each IMF component Find the smallest The IMF components are selected, relevant components are retained for signal reconstruction, and other components are discarded. The final denoised signal is composed of the selected IMF components and the residual. The formula for calculating the denoised signal, obtained by superposition, is as follows: ; Where S represents the set of retained IMFs, Original phase signal The denoised signal.

[0044] While uncompressed signals retain all detailed information, their massive data volume leads to high storage and computation costs, hindering real-time processing and resource-constrained applications. To avoid these problems, signal compression methods are used to significantly reduce data volume through downsampling and other techniques. This not only improves processing efficiency but also reduces hardware requirements, while preserving the main characteristics of the signal and enhancing the reliability of analysis results. The specific steps of signal compression are as follows: a) Initial length judgment: If the signal length L is less than or equal to the target length M, no processing is required, and the original signal is directly saved as the output result to improve the integrity of the signal. If the signal length L is greater than the target length M, the signal length needs to be adjusted to the target value through downsampling.

[0045] b) Downsampling rule: Calculate the downsampling factor when the signal length L is divisible by the target length M. Then, every Take one data point from each point to generate a compressed signal of length M. When the signal length L is not divisible by M, round down the result of L / M to obtain the sampling interval. Using the sampling interval Downsampling is performed to obtain a signal slightly longer than M. In this case, the first M points are truncated as the final result, and the downsampling factor is [missing value]. and sampling interval The calculation formula is as follows: ; ; c) Optimization and Feature Preservation: To preserve signal characteristics to the greatest extent, the following optimizations are introduced: Boundary smoothing: Interpolate or filter points at signal boundaries to avoid boundary discontinuities caused by downsampling; Feature point priority selection: During downsampling, priority is given to retaining important feature points such as extreme points and inflection points of the signal in order to preserve key information.

[0046] Signal conversion of compressed electrical signals can accurately reveal their frequency characteristics and extract their amplitude and phase information, thus more comprehensively reflecting the intrinsic properties of the data and better revealing the frequency components and their amplitude and phase information. This provides precise support for subsequent signal analysis and processing. The specific steps of signal conversion include: 1) Amplitude Normalization: The amplitude of actual signals may vary significantly due to acquisition conditions and environmental factors. Directly processing unnormalized signals may lead to feature extraction biases and even make it difficult to achieve uniform image generation. Amplitude normalization unifies the signal amplitude range to the standardized interval [0,1][0,1][0,1], eliminating the interference of the absolute magnitude of the signal amplitude on subsequent processing, thereby improving the robustness and comparability of the Fourier transform results. The formula for amplitude normalization is:

[0047] in, Represents a time series signal. For signal The normalized value of the amplitude, For signal The minimum value, For signal The maximum value; 2) Discrete Fourier Transform: The main characteristics of perturbation signals are usually more pronounced in the frequency domain. Analyzing only time-domain features may lead to information loss or an inability to distinguish different types of perturbation signals. The Fourier transform can effectively capture the frequency domain characteristics of a signal, mapping time-series information to the frequency domain, laying the foundation for subsequent spectrum analysis and image coding. The calculation method is as follows:

[0048] in, Represents a complex signal in the frequency domain. It is a length signal. For frequency index, =0, 1, ..., ; 3) Spectral Feature Extraction: Directly using complex frequency domain signals as features can lead to high-dimensional complexity and difficulty in mapping to an image. Amplitude extraction makes the features easier to interpret and facilitates the generation of clear spectral images. By calculating the amplitude, the energy distribution and main components of the signal are clearly displayed, eliminating the redundant influence of phase information in feature analysis and simplifying the complexity of subsequent processing. The formula for calculating the amplitude is: ; in, for The real part, for The imaginary part.

[0049] Introducing kurtosis factor, skewness, and impulse factor as spectral features significantly enriches the understanding of signal morphology. Kurtosis factor, a statistical measure, describes the sharpness of a signal distribution. It can reveal the tail characteristics of a signal distribution, particularly the intensity of extreme values ​​or sudden changes. In spectral analysis, kurtosis factor can help identify sharp impulses or anomalous fluctuations in a signal. Kurtosis factor is generally calculated using the higher-order moments of the signal, and its formula is as follows: ; in, It is the kurtosis factor. It is the amplitude The mean, Indicates the expected value. The amplitude is a factor; a larger kurtosis factor indicates that the signal has sharp changes and may contain sudden events. Skewness describes the asymmetry of a signal distribution. Specifically, skewness reflects the degree to which the signal distribution deviates from its mean, helping to analyze the skewness characteristics of the signal. In spectral analysis, skewness can reveal whether there are offset or asymmetrical components in the signal. The calculation formula is as follows: ; Among them, skewness value It can reveal the frequency shift of a signal; positive skewness indicates a longer right tail and negative skewness indicates a longer left tail. Frequency domain signal The amplitude; The impulse factor (PF) is a measure of the degree of instantaneous change in a signal. It assesses the impulsiveness of a signal by comparing its maximum value and root mean square (RMS) value. The impulse factor effectively identifies rapidly changing transient events in a signal, such as sudden noise or high-frequency impulses. The formula for calculating the impulse factor PF is: ; in, It is a frequency domain signal Maximum amplitude, yes The root mean square error, The specific calculation formula is as follows: ; in, In frequency The amplitude of the frequency domain signal at that location. Indicates the first At a given frequency point, a higher pulse factor (PF) indicates that there is a strong instantaneous change or pulse component in the signal.

[0050] Finally, by combining amplitude features, kurtosis factor, skewness, and impulse factor, a two-dimensional amplitude matrix is ​​constructed. Each column of this matrix represents the characteristic value of the signal at a certain frequency, and each row represents the performance of different features (amplitude, kurtosis, skewness, impulse factor, etc.) at different frequencies. The two-dimensional amplitude matrix is ​​specifically represented by the following formula: ; Among them, the two-dimensional amplitude matrix Each element in the spectrum represents the performance of the frequency domain signal at different frequencies and feature dimensions. Combining these features with amplitude information can generate a clear spectrum image, providing comprehensive information about the signal's time-frequency characteristics, energy distribution, and anomalous fluctuations. 4) The frequency domain matrix itself is not suitable for direct use in model training. Image encoding can preserve feature information and map it to a unified format, which can meet the input requirements of deep learning models. By mapping the above two-dimensional amplitude matrix to a pseudo-color image, complex frequency features are visualized as an intuitive two-dimensional image, i.e., the above two-dimensional information, which is easy to observe and use as input for machine learning models.

[0051] In some embodiments, step S103 may include, but is not limited to, steps S301 to S302: Step S301: Input the time series data corresponding to each phase point into the training layer to capture the long-term dependency relationship of the time series and output the feature representation information corresponding to the time series data. Step S302: Input the feature representation information into the fully connected classification layer to perform feature recognition, and determine the feature recognition result corresponding to each phase point. The feature recognition result includes the node status and the probability value of each preset intrusion event category.

[0052] In some embodiments, the temporally continuous intrusion detection model is a Long Short-Term Memory (LSTM50) network model, including a training layer and a fully connected classification layer. The input is time series data at each phase point, and the dimension of the input data is T×D, where T represents the number of time steps and D represents the feature dimension of each time step.

[0053] Optionally, the training layer contains 50 hidden units, and its structure includes a forget gate, an input gate, an output gate, and a memory unit. This effectively captures long-term dependencies in the time series, avoids the vanishing gradient problem, and improves the model's ability to capture dynamic perturbation signals. The hidden state at the last time step of the training layer outputs... As a high-dimensional feature representation of the time series, it is input into a fully connected classification layer for classification.

[0054] A fully connected (FC) classification layer consists of a linear transformation layer and an activation function (Sigmoid) to map high-dimensional features to the target class probability space. Finally, the classifier outputs the corresponding probability values ​​of the perturbation event class, thus obtaining the recognition result.

[0055] Time series data is input into the memory unit of the temporally continuous intrusion detection model. The temporally continuous intrusion detection model extracts and dynamically adjusts time series features through its forget gate, input gate, and output gate structure. Since the cumulative nature of time series data can make the input information in subsequent time steps very complex, the temporally continuous intrusion detection model filters and compresses information through the synergistic effect of the forget gate and input gate in each time step, thereby reducing redundant calculations and improving computational efficiency.

[0056] The node state of each phase point is determined using the time-continuous intrusion detection model based on the time-series data corresponding to each phase point. The specific steps are as follows: 1) Obtain the time series data of the phase points. The time series data is shown below: ; Where the sequence length is T, t∈[1,T], The fiber optic sensing data for the phase point corresponding to the t-th time step is the input feature of the t-th time step. 2) When time series data is input into the training layer, the forget gate mechanism in the training layer first determines the input features based on the current time step. The hidden state of the previous time step The forgetting gate dynamically determines which historical information to forget. The formula for calculating the forgetting gate is as follows:

[0057] in, This is the output value of the forget gate, ranging from 0 to 1, representing the proportion of information retained or forgotten. The forget gate acts as a bottleneck mechanism, effectively reducing the interference of historical information on the current calculation, thereby improving the computational efficiency of the model. It is the weight matrix of the forget gate. It is the bias term of the forget gate; Then, assuming the current time step is t, the input features for the current time step are filtered through the input gate in the training layer. To update the model's memory state, the input gate first generates a candidate memory state. , Specifically, it can be expressed by the following formula: ; in, Representing candidate memory states The weight matrix is ​​used to weight the input features. The hidden state of the previous time step Mapped to candidate memory units, Candidate memory state The bias term, tanh, is the hyperbolic tangent activation function, which determines the candidate memory state. The value is compressed to [ Within the range of [1,1]; Then, combine the input features of the current time step. Importance weight Update the input features at the current time step. The memory state is specifically represented by the following formula: ; ; in, This represents the memory state at the current time step. It is the sigmoid activation function. It is the weight matrix of the input gate. b It is the bias term of the input gate. It is the output value of the forget gate, which controls the memory state of the previous moment. The degree of preservation, It is an importance weight that controls the candidate memory state. Contributions; At each time step, a bottleneck layer (forget gate + input gate) is used to compress and filter effective information, enabling subsequent time steps to utilize these features more efficiently.

[0058] By combining the dynamic adjustment mechanism of the output gate in the training layer, the model can focus on important information at key time steps. Furthermore, the model's gating mechanisms (forget gate, input gate, and output gate) work together to dynamically learn and adjust the weights of input features at each time step, further improving the model's generalization ability. The LSTM50's output gate learns the importance weights of features at each time step, dynamically adjusting which memory state information should be output as the hidden state at the current time step, thus passing important information to the input features at the current time step. Hidden state :

[0059]

[0060] in, It is the output value of the output gate, which controls the memory state. Contribution to the hidden state, It is the weight matrix of the output gate. It is the bias term of the output gate, assuming the current time step t is the last time step of the time series. Its corresponding hidden state It is a global representation of the entire sequence features, containing comprehensive information from all time steps in the sequence; 3) Set the time step of the last output of the training layer. Hidden state As input to the fully connected classification layer, it is mapped to the output space of the classification task. The mapping operation of the fully connected classification layer is expressed as follows: ; in, It is the weight matrix of the fully connected classification layer. It is a bias term of the fully connected classification layer. It is a linear output; this mapping operation can be viewed as a linear transformation that changes the hidden state. The high-dimensional features are mapped to the number of classification categories, and then the linear output is converted into probabilities using the Sigmoid activation function to obtain the node state of the phase point and the probability value of each preset intrusion event category.

[0061] In some embodiments, step S104 may optionally involve sorting the positions according to the spatial distribution positions corresponding to each phase point, determining the sequence positions corresponding to each phase point, and then constructing a node state spatial sequence based on the sequence positions corresponding to each phase point and the node state.

[0062] In some embodiments, exemplarily, reference Figure 3 , Figure 3 This is an optional schematic diagram of the node state space sequence in an embodiment of this application. Assuming a total of 10 phase points of time-series data are collected, phase points 1 to 10 are determined based on their spatial distribution positions. Phase point 1 represents its sequence position 1 in the spatial sequence, and so on. The system collects fiber optic sensing data from each phase point every second and uses a time-continuous intrusion detection model to determine the node status of each phase point at different time nodes. These time nodes include... to The symbol in each box represents the node state of the phase point at different time nodes. √ in the box indicates that the node is normal, and × in the box indicates that the node is abnormal. Based on the node state and sequence position of each phase point at different time nodes, the corresponding node state space sequence L1 to L5 is constructed.

[0063] In some embodiments, refer to Figure 4 , Figure 4This is an optional flowchart of step S105 in the embodiments of this application. Step S105 may include, but is not limited to, steps S401 to S404: Step S401: Construct a sliding window with a window width corresponding to the anomaly detection threshold; Step S402: Use a sliding window to slide in the node state space sequence to filter out multiple abnormal node segments. Among them, there are no overlapping abnormal nodes between the abnormal node segments. An abnormal node segment is a sequence segment in the node state space sequence composed of multiple consecutively occurring abnormal nodes with a number equal to the abnormal identification threshold. Step S403: Based on the node state space sequence and the preset segment expansion rules, perform segment expansion and truncation on each abnormal node segment to determine the abnormal node expansion segment corresponding to each abnormal node segment. Step S404: Perform deduplication on the extended segments of multiple abnormal nodes to determine the abnormal segments of the state space sequence of each node.

[0064] In some embodiments, refer to Figure 5 , Figure 5 This is an optional flowchart of step S403 in the embodiments of this application. Step S403 may include, but is not limited to, steps S501 to S504: Step S501: Determine the start node and end node of the segment from the abnormal node segments; Step S502: Based on the segment start node, extend the segment forward and determine the first target node from the node state space sequence. The first target node is the node state that is located before the segment start node and is closest to the segment start node in the node state space sequence and is the normal phase point of the node. Step S503: Based on the segment termination node, extend the segment backward and determine the second target node from the node state space sequence. The second target node is the node state that is located after the segment termination node and is closest to the segment termination node in the node state space sequence, and the node state is the normal phase point of the node. Step S504: Based on the first target node and the second target node, segment the node state space sequence to obtain the extended segment of the abnormal node.

[0065] In some embodiments, refer to Figure 6 , Figure 6This is an optional schematic diagram of an abnormal node expansion segment in an embodiment of this application. Assuming the anomaly identification threshold is 3, meaning that when three consecutive abnormal phase points appear in a sequence segment, the sequence segment is identified as an abnormal node segment, the window width of the sliding window C is determined to be 3. The sliding window C slides through the node state space sequence L to filter out abnormal node segments A and B. Abnormal node segment A consists of phase points 2 to 4, and abnormal node segment B consists of phase points 5 to 7. Segment expansion is performed on abnormal node segment A, determining phase point 2 as the segment start node and phase point 4 as the segment end node. Based on the segment start node, the segment is expanded forward to determine the first target node from the node state space sequence L. The first target node is phase point 1. Based on the segment termination node, the segment is extended backward. The second target node is determined from the node state space sequence L. The second target node is phase point 8. The segment start node is updated to phase point 1, and the segment termination node is updated to phase point 8. Based on the updated segment start node and segment termination node, the node state space sequence is segmented to obtain the abnormal node extension segment LM1. The abnormal node extension segment LM1 is composed of phase points 1 to 8. Similarly, the abnormal node extension segment corresponding to the abnormal node segment B is also determined to be the abnormal node extension segment LM1. After deduplication, the abnormal node extension segment LM1 is retained. The abnormal node extension segment LM1 is determined as the abnormal segment of the node state space sequence L.

[0066] In some embodiments, refer to Figure 7 , Figure 7 This is an optional flowchart of step S106 in the embodiments of this application. Step S106 may include, but is not limited to, steps S601 to S603: Step S601: Based on the time series data corresponding to each phase point, determine the abnormal control segment corresponding to each time node for the abnormal segment of the state space sequence at each node. Step S602: Input the abnormal fragments of the state space sequence of each node into the first identification module, and output the target intrusion event corresponding to the abnormal fragments of the state space sequence of each node. Step S603: For the abnormal segments of the state space sequence of each node, the target intrusion identification event and the corresponding abnormal comparison segments are input into the second identification module to perform intrusion event identification verification and output the intrusion identification result. The intrusion identification result includes the probability value of the target intrusion event and the identification judgment result.

[0067] In some embodiments, the spatially continuous intrusion identification model is also a Long Short-Term Memory (LSTM50) network model, which includes a first identification module and a second identification module.

[0068] Alternatively, the working principle of the spatially continuous intrusion detection model is as follows: 1) Using the first identification module, output the target intrusion event corresponding to the abnormal segment of the node state space sequence based on the abnormal segment of the node state space sequence; 2) The second identification module obtains sufficient contextual information from the abnormal comparison segments corresponding to the abnormal segments of the node state space sequence at different time nodes. Using the weight model contained in the second identification module, it identifies and verifies the target intrusion event output by the first identification module, determines the probability value of the target intrusion event and the identification judgment result. When the probability value of the target intrusion event is greater than the preset threshold, the identification judgment result is that multiple abnormal nodes contained in the abnormal segment of the node state space sequence have experienced a target intrusion event. Otherwise, the identification judgment result is that multiple abnormal nodes contained in the abnormal segment of the node state space sequence have not experienced a target intrusion event.

[0069] In some embodiments, refer to Figure 8 , Figure 8 This is an optional schematic diagram of an abnormal control segment in an embodiment of this application. It assumes phase points 1 to 10, and time nodes include... to Each time point has a corresponding node state space sequence, time point Given the node state space sequence LQ5, the node state space sequence anomalous segment Y5 is determined to be from phase point 3 to 7 at time node 7. It consists of node state and fiber optic sensing data. Then, the node state space sequence anomaly segment Y5 is obtained at time node. to The corresponding anomalous control segments, namely anomalous control segments Y1 to Y4, with anomalous control segment Y1 ranging from phase point 3 to 7 at time node 7. It consists of node status and fiber optic sensing data, and so on.

[0070] Reference Figure 9 , Figure 9 This is an optional structural diagram of an intrusion detection device based on a distributed optical fiber sensing system provided in an embodiment of this application. The device is used to implement the aforementioned intrusion detection method and may include: The first module is used to collect time series data corresponding to each phase point in the distributed optical fiber sensing system. The second module is used to acquire the temporally continuous intrusion detection model and the spatially continuous intrusion detection model; The third module is used to determine the node status of each phase point based on the time series data corresponding to each phase point using a time-continuous intrusion identification model. The node status includes node abnormality and node normality. The fourth module is used to obtain the spatial distribution location corresponding to each phase point, and to construct a node state space sequence composed of all phase points based on the spatial distribution location and node state of each phase point. The fifth module is used to filter out several abnormal segments of the node state space sequence from the node state space sequence. The abnormal segments of the node state space sequence include multiple abnormal nodes that appear consecutively more than or equal to a preset abnormal identification threshold. The abnormal nodes are the phase points where the node state is abnormal. The sixth module is used to input the abnormal segments of the state space sequence of each node and the time series data corresponding to each phase point into the spatial continuous intrusion identification model, and use the spatial continuous intrusion identification model to output the intrusion identification results corresponding to the abnormal segments of the state space sequence of each node.

[0071] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0072] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned intrusion detection method. This electronic device can be any smart terminal, including a tablet computer.

[0073] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0074] Please see Figure 10 , Figure 10 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 902 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the intrusion identification method of the embodiments of this application. The input / output interface 903 is used to implement information input and output; The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904); The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0075] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described intrusion identification method.

[0076] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0077] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0078] The embodiments of this application provide an intrusion identification method, device, electronic device, and storage medium based on a distributed optical fiber sensing system, which can combine temporal and spatial continuity to achieve intrusion identification, effectively deal with node ambiguity and anomalies, and improve the accuracy and efficiency of intrusion identification.

[0079] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0080] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0081] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0082] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0083] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0084] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0085] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0086] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0087] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0088] It should be recognized that embodiments of the present invention can be implemented or carried out by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable storage medium. The method can be implemented in a computer program using standard programming techniques, including a non-transitory computer-readable storage medium configured with a computer program, wherein the storage medium is configured such that the computer operates in a specific and predefined manner—according to the methods and drawings described in the specific embodiments. Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with the computer system. However, if desired, the program can be implemented in assembly or machine language. In any case, the language can be a compiled or interpreted language. Furthermore, for this purpose, the program can run on a programmed application-specific integrated circuit (ASIC).

[0089] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0090] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. An intrusion detection method based on a distributed optical fiber sensing system, characterized in that, The method includes the following steps: Collect time-series data corresponding to each phase point in a distributed fiber optic sensing system; Acquire temporally continuous intrusion detection models and spatially continuous intrusion detection models; The time-continuous intrusion identification model is used to determine the node status of each phase point based on the time series data corresponding to each phase point. The node status includes node abnormality and node normality. Obtain the spatial distribution position corresponding to each phase point, and construct a node state space sequence composed of all the phase points based on the spatial distribution position corresponding to each phase point and the node state. Several abnormal segments of the node state space sequence are selected from the node state space sequence, wherein the abnormal segments of the node state space sequence include multiple abnormal nodes that appear consecutively more than or equal to a preset abnormal identification threshold, and the abnormal nodes are the phase points in which the node state is abnormal. The abnormal segments of the state space sequence of each node and the time series data corresponding to each phase point are input into the spatial continuous intrusion identification model, and the intrusion identification results corresponding to the abnormal segments of the state space sequence of each node are output using the spatial continuous intrusion identification model.

2. The intrusion detection method according to claim 1, characterized in that, The acquisition of time-series data corresponding to each phase point in the distributed optical fiber sensing system specifically includes: According to a preset time interval, the fiber optic sensing signals corresponding to each phase point are dynamically acquired, each fiber optic sensing signal is converted into an electrical signal, and the signal acquisition time node of each electrical signal is determined. Perform signal preprocessing on each of the electrical signals to obtain two-dimensional information corresponding to each of the electrical signals; For each phase point, the time series data corresponding to the phase point is determined based on the two-dimensional information and the signal acquisition time node corresponding to each two-dimensional information.

3. The intrusion detection method according to claim 1, characterized in that, The time-continuous intrusion detection model includes a training layer and a fully connected classification layer. The step of using the time-continuous intrusion detection model to determine the node state of each phase point based on the time-series data corresponding to each phase point specifically includes: The time series data corresponding to each phase point is input into the training layer to capture the long-term dependencies of the time series and output the feature representation information corresponding to the time series data. The feature representation information is input into the fully connected classification layer for feature recognition, and the feature recognition result corresponding to each phase point is determined. The feature recognition result includes the node state and the probability value of each preset intrusion event category.

4. The intrusion detection method according to claim 1, characterized in that, The step of obtaining the spatial distribution position corresponding to each phase point, and constructing a node state space sequence composed of all the phase points based on the spatial distribution position corresponding to each phase point and the node state, specifically includes: Based on the spatial distribution positions corresponding to each phase point, the positions are sorted to determine the sequence positions corresponding to each phase point; The node state space sequence is constructed based on the sequence position corresponding to each phase point and the node state.

5. The intrusion detection method according to claim 1, characterized in that, The step of filtering out several abnormal segments of the node state space sequence specifically includes: Construct a sliding window with a window width corresponding to the anomaly detection threshold; The sliding window is used to slide in the node state space sequence to filter out multiple abnormal node segments, wherein there are no overlapping abnormal nodes between the abnormal node segments, and the abnormal node segment is a sequence segment in the node state space sequence composed of multiple consecutively occurring abnormal nodes with a number equal to the abnormal identification threshold. Based on the node state space sequence and the preset segment expansion rules, each abnormal node segment is expanded and truncated to determine the abnormal node expansion segment corresponding to each abnormal node segment. The multiple abnormal node extension segments are deduplicated to identify the abnormal segments of the state space sequence of each node.

6. The intrusion detection method according to claim 1, characterized in that, The spatially continuous intrusion detection model includes a first detection module and a second detection module. Specifically, it involves inputting the abnormal segments of the state space sequence of each node and the time series data corresponding to each phase point into the spatially continuous intrusion detection model, and then using the spatially continuous intrusion detection model to output the intrusion detection results corresponding to the abnormal segments of the state space sequence of each node. Based on the time series data corresponding to each phase point, determine the abnormal control segment corresponding to each time node for the abnormal segment of the state space sequence of each node; The abnormal fragments of the state space sequence of each node are input into the first identification module, and the target intrusion event corresponding to each abnormal fragment of the state space sequence of the node is output. For each abnormal segment of the state space sequence of the nodes, the target intrusion identification event and the corresponding abnormal comparison segment are input to the second identification module to perform intrusion event identification verification, and the intrusion identification result is output. The intrusion identification result includes the probability value of the target intrusion event and the identification judgment result.

7. The intrusion detection method according to claim 5, characterized in that, The step of expanding and truncating each abnormal node segment according to the node state space sequence and preset segment expansion rules, and determining the abnormal node expansion segment corresponding to each abnormal node segment, specifically includes: Determine the start node and end node of the segment from the abnormal node segment; Based on the segment start node, the segment is extended forward, and a first target node is determined from the node state space sequence. The first target node is the phase point in the node state space sequence that is located before the segment start node and is closest to the segment start node, and whose node state is normal. Based on the segment termination node, the segment is extended backward, and a second target node is determined from the node state space sequence. The second target node is the phase point in the node state space sequence that is located after the segment termination node and is closest to the segment termination node, and the node state is normal. Based on the first target node and the second target node, the node state space sequence is segmented to obtain the extended segment of the abnormal node.

8. An intrusion detection device based on a distributed optical fiber sensing system, characterized in that, The device includes: The first module is used to collect time series data corresponding to each phase point in the distributed optical fiber sensing system. The second module is used to acquire the temporally continuous intrusion detection model and the spatially continuous intrusion detection model; The third module is used to determine the node status of each phase point based on the time series data corresponding to each phase point using the time-continuous intrusion identification model. The node status includes node abnormality and node normality. The fourth module is used to obtain the spatial distribution position corresponding to each phase point, and construct a node state spatial sequence composed of all the phase points based on the spatial distribution position corresponding to each phase point and the node state. The fifth module is used to filter out several abnormal segments of the node state space sequence from the node state space sequence, wherein the abnormal segments of the node state space sequence include multiple abnormal nodes that appear consecutively more than or equal to a preset abnormal identification threshold, and the abnormal nodes are the phase points where the node state is abnormal. The sixth module is used to input the abnormal segments of the state space sequence of each node and the time series data corresponding to each phase point into the spatial continuous intrusion identification model, and use the spatial continuous intrusion identification model to output the intrusion identification results corresponding to the abnormal segments of the state space sequence of each node.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the intrusion identification method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the intrusion identification method according to any one of claims 1 to 7.

Images