An abnormal behavior early warning method and system based on RFID event graph and large model

Abstract

The application provides an abnormal behavior early warning method and system based on an RFID event graph and a large model, and the steps of the method comprise: acquiring RFID read-write event data and corresponding IoT state data of a whole supply chain in real time, constructing a standardized event sequence based on a business entity in the RFID read-write event data, and matching the IoT state data with the standardized event sequence; based on the standardized event sequence, taking the business entity as a node and the flow relationship of the business entity as an edge, a directed supply chain RFID event graph is constructed; based on a preset global verification rule, the directed supply chain RFID event graph is globally verified to construct an abnormal subgraph; a search vector is generated for the abnormal subgraph, and a matched evidence fragment is determined; the subgraph feature vector corresponding to the abnormal subgraph and the evidence vector of the matched evidence fragment are input into a pre-trained language model, and the language model outputs a risk reasoning result.

Description

Technical Field

[0001] This invention relates to the field of logistics supply chain technology, and in particular to an early warning method and system for abnormal behavior based on RFID event graphs and large models. Background Technology

[0002] High-value supply chains, such as pharmaceutical cold chain, hazardous chemicals, government and enterprise emergency supplies, and high-end consumer goods, have extremely high requirements for end-to-end safety management, compliance auditing, and risk early warning. Core control points include temperature control compliance, qualification verification, flow control, restricted area management, and end-to-end audit traceability. RFID and IoT technologies can realize real-time data collection of goods, vehicles, personnel, and warehouse locations throughout the entire supply chain, forming the core data foundation for supply chain risk control.

[0003] However, the risk control logic of existing technologies mostly stays at the level of single-point rule alarms, which can only cover threshold-type or single-node-type anomalies. They cannot identify complex chain risks that cross links and entities, and are easily bypassed by abnormal bypassing and forged scanning behaviors. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide an early warning method for abnormal behavior based on RFID event graphs and large models, in order to eliminate or improve one or more defects existing in the prior art.

[0005] One aspect of the present invention provides an early warning method for abnormal behavior based on RFID event graphs and large models, the method comprising the following steps: Real-time acquisition of RFID read / write event data and corresponding IoT status data across the entire supply chain; construction of standardized event sequences based on business entities in the RFID read / write event data; and matching of the IoT status data with the standardized event sequences. Based on the standardized event sequence, a directed supply chain RFID event graph is constructed, with the business entity as the node and the flow relationship of the business entity as the edge. The directed supply chain RFID event graph is globally verified based on preset global verification rules. Abnormal nodes and edges in the directed supply chain RFID event graph are determined based on the global verification and constructed as abnormal subgraphs. For the abnormal subgraph, a retrieval vector is generated, and the retrieval vector is matched with evidence fragments in the preset abnormal pattern knowledge base to determine the matching evidence fragments; The feature vector of the subgraph corresponding to the abnormal subgraph and the evidence vector of the matching evidence fragment are input into a pre-trained language model. The language model outputs a risk inference result, which includes a chain of evidence and a risk level.

[0006] The above-mentioned scheme first determines the standardized event sequence of physical goods in the circulation process by using RFID read and write event data and corresponding IoT status data throughout the entire supply chain. It then constructs a directed supply chain RFID event graph, builds anomaly subgraphs through global verification to narrow the monitoring scope, and further verifies the evidence chain by using a language model on the anomaly subgraphs to ensure effective traceability in subsequent processing. This scheme can cover threshold-type or single-node-type anomalies by gradually narrowing the monitoring scope from the global perspective, and can achieve the identification of complex chain risks across all links and entities.

[0007] In some embodiments of the present invention, in the step of constructing a standardized event sequence based on the business entities in the RFID read / write event data and matching the IoT status data with the standardized event sequence, the business entity corresponding to the target goods is determined based on the target goods in the RFID read / write event data, the IoT status data corresponding to the business entity is determined based on the processing time of the target goods in the business entity, the business entity is associated with the corresponding IoT status data, and a standardized event sequence is constructed based on the flow relationship of the target goods among the business entities.

[0008] In some embodiments of the present invention, in the step of constructing a directed supply chain RFID event graph based on the standardized event sequence, using the business entities as nodes and the flow relationships of the business entities as edges, the business entities include orders, goods batches, pallets, storage locations, and warehouses; the flow relationships of the business entities include warehousing, outbound, loading and unloading, and transshipment. Each business entity in the standardized event sequence is constructed as a node, and directed edges between nodes are constructed based on the flow order of the target goods in the business entities in the standardized event sequence.

[0009] In some embodiments of the present invention, in the steps of performing global verification on the directed supply chain RFID event graph based on preset global verification rules, determining abnormal nodes and edges in the directed supply chain RFID event graph based on the global verification, and constructing an abnormal subgraph, the global verification rules include spatiotemporal reachability verification, operation uniqueness verification, link integrity verification, path compliance verification, and state compliance verification. The spatiotemporal reachability verification calculates the predicted transfer time between nodes based on the geographical location of the nodes, and determines whether the spatiotemporal reachability verification is passed based on the actual transfer time and the predicted transfer time. The operation uniqueness verification is used to verify whether the same operator or the same device performs conflicting operations on different business entities within a preset time window. The link integrity check is used to verify whether the entire link event of the target goods is complete; The path compliance verification is used to verify whether the transfer path of the target goods is within the preset whitelist; The status compliance check is used to verify whether the IoT status data corresponding to each node is within a preset security range.

[0010] In some embodiments of the present invention, the global verification rules include cross-subgraph operation uniqueness verification, which verifies whether the same operator or the same device appears in the positions of different business entities within an overlapping time window based on the historical data of the business entity corresponding to the node.

[0011] In some embodiments of the present invention, in the steps of generating a retrieval vector for the abnormal subgraph, matching the retrieval vector with evidence fragments in a preset abnormal pattern knowledge base, and determining the matching evidence fragments, a graph structure subvector is constructed based on the graph structure of the abnormal subgraph, a spatiotemporal subvector is constructed based on the geographical coordinates of the abnormal nodes in the abnormal subgraph and the timestamps of the abnormality, a type subvector is determined based on the abnormality type determined by the global verification, the graph structure subvector, the spatiotemporal subvector, and the type subvector are concatenated, and the concatenated vector is mapped to a preset dimension to obtain the retrieval vector, the similarity between the retrieval vector and the evidence vector to be matched corresponding to each evidence fragment is calculated, and the evidence fragment corresponding to the abnormal subgraph is determined.

[0012] In some embodiments of the present invention, in the step of inputting the subgraph feature vector corresponding to the abnormal subgraph and the evidence vector of the matching evidence fragment into a pre-trained language model, and the language model outputting the risk reasoning result, the abnormal subgraph as a whole is input into a spatiotemporal graph convolutional network to obtain the subgraph feature vector, the subgraph feature vector is concatenated with the evidence vector of the matching evidence fragment, and then input into the pre-trained language model.

[0013] In some embodiments of the present invention, the language model includes a feature extraction core layer and a result output layer. The feature extraction core layer employs stacked multi-layer transformer decoding modules. The feature extraction core layer outputs a context feature sequence and an attention weight matrix. Each transformer decoding module includes a masked multi-head self-attention layer and multiple fully connected layers arranged in sequence. The result output layer outputs a risk level through a softmax layer using the context feature sequence. The output layer locates the position interval of each matched evidence fragment in the input vector of the pre-trained language model, and calculates the average weight value of each matched evidence fragment in the attention weight matrix, corresponding to the weight value of the position interval. The average weight value of each matched evidence fragment is normalized to obtain the contribution of each evidence fragment. The matched evidence fragments are sorted based on the contribution to obtain the evidence chain.

[0014] In some embodiments of the present invention, the method further includes determining a corresponding recommended action based on the risk level, and outputting a verifiable evidence field corresponding to the recommended action; and storing the anomaly subgraph, evidence chain, risk level, recommended action, and verifiable evidence field of the corresponding target goods using an SM3 hash chain structure.

[0015] In specific implementation, the verifiable evidence fields can be X-Audit-Trace-ID, graph_snapshot_hash, anomaly_subgraph_id, and evidence_snippet_id.

[0016] A second aspect of the present invention also provides an early warning system for abnormal behavior based on RFID event graphs and large models. The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0017] A third aspect of the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned method for early warning of abnormal behavior based on RFID event graphs and large models.

[0018] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the text, or may be learned by practice of the invention. The objects and other advantages of the invention will become apparent from the description and the accompanying drawings.

[0019] Those skilled in the art will understand that the objectives and advantages achievable with this invention are not limited to those specifically described above, and that the above and other objectives achievable with this invention will become clearer from the following detailed description. Attached Figure Description

[0020] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to limit the scope of the invention.

[0021] Figure 1 This is a schematic diagram of the first implementation method of the abnormal behavior early warning method based on RFID event graphs and large models in this solution; Figure 2 This is a schematic diagram of the second implementation method of the abnormal behavior early warning method based on RFID event graphs and large models in this solution; Figure 3 This is a schematic diagram of the overall architecture of this solution; Figure 4 This is a schematic diagram of the overall processing flow of this solution; Figure 5 This is a schematic diagram of the data processing structure for preventing tampering of audit records in this solution. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0023] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0024] The core drawbacks of existing technologies include: 1. Poor multi-source data fusion capability: RFID event data and IoT status data are from multiple sources and are heterogeneous, making it difficult to align timestamps and associate them with entities. The low degree of data standardization leads to poor stability of anomaly detection and a high false alarm rate. 2. Weak ability to identify complex anomalies: Relying solely on single-point rules or statistical models, it is unable to identify structural and chain-like complex anomalies such as cross-node spatiotemporal contradictions, impossible paths, hidden cross-selling, and detours and substitutions, resulting in a high false negative rate. 3. Lack of interpretability and traceability of results: Anomaly alarms only output results, lacking a complete chain of evidence and auditable explanations of causes, which cannot support compliance audits, responsibility determination, and accountability verification; 4. Warning output lacks verification capability: The warning interface lacks standardized verifiable and evidence-provable fields, making it impossible for third parties to reproduce and independently verify the violations. Violations cannot be quickly proven, and the risk control results lack compliance validity. 5. Large-scale model inference lacks factual constraints: Pure large-scale model inference suffers from the illusion problem, and the inference results lack factual support from regulatory rules and business events, making them unsuitable for rigid risk control scenarios in production environments; 6. Delayed early warning and lack of closed-loop capability: It is mostly based on post-event audits, which cannot achieve early warning. It also lacks a closed-loop learning mechanism, cannot adapt to new abnormal patterns, and has poor continuous iteration capability.

[0025] like Figure 1 As shown, this invention proposes an early warning method for abnormal behavior based on RFID event graphs and large models. The steps of the method include: Step S100: Real-time acquisition of RFID read / write event data and corresponding IoT status data across the entire supply chain; construction of standardized event sequences based on business entities in the RFID read / write event data; and matching the IoT status data with the standardized event sequences. like Figure 3 and 4 As shown, in the specific implementation process, the RFID read and write event data of the entire supply chain includes RFID read and write events of goods in and out of the warehouse, loading and unloading, transfer, in-transit transportation and last delivery; the IoT status data is the data of supporting IoT sensors such as temperature and humidity, positioning, door lock, vehicle status, etc.

[0026] Step S200: Based on the standardized event sequence, construct a directed supply chain RFID event graph using the business entity as a node and the flow relationship of the business entity as an edge; In the specific implementation process, the standardized event sequence is a sequence constructed by the flow relationship between business entities and goods between business entities. The business entities include orders, goods batches, pallets, storage locations and warehouses. When goods flow from a first business entity to a second business entity, an edge is constructed from the first business entity to the second business entity.

[0027] Step S300: Perform global verification on the directed supply chain RFID event graph based on preset global verification rules, determine abnormal nodes and edges in the directed supply chain RFID event graph based on global verification, and construct an abnormal subgraph. In the specific implementation process, the abnormal subgraph is also set with edge attribute values, including the bound device ID, operator and event status.

[0028] like Figure 3 and 4As shown, in the specific implementation process, in the step of determining abnormal nodes and edges in the directed supply chain RFID event graph based on global verification and constructing an abnormal subgraph, pruning is performed based on the abnormal nodes and edges in the directed supply chain RFID event graph. Specifically, the edge nodes of the directed supply chain RFID event graph are checked hop by hop inward. If the node and edge are not abnormal, the path is pruned. If the node and edge are abnormal, the pruning of the path is stopped. The same method is used for each path, and finally an abnormal subgraph is obtained.

[0029] Step S400: Generate a retrieval vector for the abnormal subgraph, and match the retrieval vector with evidence fragments in the preset abnormal pattern knowledge base to determine the matching evidence fragments; Specifically, the retrieval vector is used to characterize at least one of the graph structure features of the abnormal subgraph, the spatiotemporal distribution features of the abnormal nodes, and the abnormal type information, so as to retrieve factual evidence fragments corresponding to the current abnormal subgraph from the abnormal pattern knowledge base.

[0030] In the specific implementation process, the evidence fragments store supply chain supervision rules, corporate risk control systems, abnormal behavior pattern templates, historical risk cases and compliance handling SOPs. Each evidence fragment is specifically encoded to obtain a corresponding evidence vector.

[0031] Step S500: Input the feature vector of the subgraph corresponding to the abnormal subgraph and the evidence vector of the matching evidence fragment into the pre-trained language model. The language model outputs the risk reasoning result, which includes the evidence chain and the risk level.

[0032] Specifically, the pre-trained language model performs constrained risk reasoning based on the feature vector of the subgraph corresponding to the abnormal subgraph and the evidence vector of the matching evidence fragment, so that the output risk level and evidence chain correspond to RFID read and write events, IoT status data and global verification results.

[0033] In the specific implementation process, this solution uses anomaly subgraphs to determine the location of anomalies, uses risk levels to determine the urgency of the risk, and provides a corresponding chain of evidence. Technical personnel can analyze the evidence fragments in the chain of evidence to ensure the comprehensiveness of the analysis.

[0034] In the specific implementation process, the risk level is divided into four levels according to the severity of the risk: low, medium, high, and emergency. The handling suggestions include early warning, isolation, interception, review, and scheduling adjustment.

[0035] The above-mentioned scheme first determines the standardized event sequence of physical goods in the circulation process by using RFID read and write event data and corresponding IoT status data throughout the entire supply chain. It then constructs a directed supply chain RFID event graph, builds anomaly subgraphs through global verification to narrow the monitoring scope, and further verifies the evidence chain by using a language model on the anomaly subgraphs to ensure effective traceability in subsequent processing. This scheme can cover threshold-type or single-node-type anomalies by gradually narrowing the monitoring scope from the global perspective, and can achieve the identification of complex chain risks across all links and entities.

[0036] In some embodiments of the present invention, in the step of constructing a standardized event sequence based on the business entities in the RFID read / write event data and matching the IoT status data with the standardized event sequence, the business entity corresponding to the target goods is determined based on the target goods in the RFID read / write event data, the IoT status data corresponding to the business entity is determined based on the processing time of the target goods in the business entity, the business entity is associated with the corresponding IoT status data, and a standardized event sequence is constructed based on the flow relationship of the target goods among the business entities.

[0037] In some embodiments of the present invention, in the step of constructing a directed supply chain RFID event graph based on the standardized event sequence, using the business entities as nodes and the flow relationships of the business entities as edges, the business entities include orders, goods batches, pallets, storage locations, and warehouses; the flow relationships of the business entities include warehousing, outbound, loading and unloading, and transshipment. Each business entity in the standardized event sequence is constructed as a node, and directed edges between nodes are constructed based on the flow order of the target goods in the business entities in the standardized event sequence.

[0038] In the specific implementation process, the initial standardized event sequence is set to correspond one-to-one with each target cargo in the supply chain. The directed supply chain RFID event graph displays the standardized event sequence of all target cargoes in a unified manner, and in subsequent steps, it is trimmed according to the abnormal nodes and edges of each target cargo to obtain the corresponding abnormal subgraph.

[0039] In some embodiments of the present invention, in the steps of performing global verification on the directed supply chain RFID event graph based on preset global verification rules, determining abnormal nodes and edges in the directed supply chain RFID event graph based on the global verification, and constructing an abnormal subgraph, the global verification rules include spatiotemporal reachability verification, operation uniqueness verification, link integrity verification, path compliance verification, and state compliance verification. The spatiotemporal reachability verification calculates the predicted transfer time between nodes based on the geographical location of the nodes, and determines whether the spatiotemporal reachability verification is passed based on the actual transfer time and the predicted transfer time. The link integrity check is used to verify whether the entire link event of the target goods is complete; The path compliance verification is used to verify whether the transfer path of the target goods is within the preset whitelist; The status compliance check is used to verify whether the IoT status data corresponding to each node is within a preset security range.

[0040] In the specific implementation process, in the spatiotemporal reachability verification, the transportation speed is determined based on the transportation tools used between nodes, the predicted transit time is determined based on the geographical distance between nodes and the transportation speed, and a threshold time range is determined based on the predicted transit time. If the actual transit time is within the threshold time range, the spatiotemporal reachability verification is passed. The link integrity verification determines whether the flow of the target goods is missing intermediate transfers; if intermediate transfers are missing, it is determined to be incomplete. The path compliance check is used to verify whether the flow path of the target goods is within the preset whitelist. If it is not within the whitelist, the path compliance check is deemed to have failed. If the IoT status data is not within the preset security range during the status compliance verification, the status compliance verification is deemed to have failed.

[0041] In some embodiments of the present invention, the global verification rules include cross-subgraph operation uniqueness verification, which verifies whether the same operator or the same device appears in the positions of different business entities within an overlapping time window based on the historical data of the business entity corresponding to the node.

[0042] In the specific implementation process, this solution is equipped with uniqueness verification for cross-subgraph operations and separate verification for each abnormal subgraph, which can achieve effective verification from different dimensions and ensure verification accuracy.

[0043] In the specific implementation process, when any verification rule is not met, the abnormal subgraph is marked, and when finally feedback is given to the technical staff, the evidence chain and risk level are combined to provide the technical staff with a reference as the anomaly type.

[0044] In some embodiments of the present invention, in the steps of generating a retrieval vector for the abnormal subgraph, matching the retrieval vector with evidence fragments in a preset abnormal pattern knowledge base, and determining the matching evidence fragments, a graph structure subvector is constructed based on the graph structure of the abnormal subgraph, a spatiotemporal subvector is constructed based on the geographical coordinates of the abnormal nodes in the abnormal subgraph and the timestamps of the abnormality, a type subvector is determined based on the abnormality type determined by the global verification, the graph structure subvector, the spatiotemporal subvector, and the type subvector are concatenated, and the concatenated vector is mapped to a preset dimension to obtain the retrieval vector, the similarity between the retrieval vector and the evidence vector to be matched corresponding to each evidence fragment is calculated, and the evidence fragment corresponding to the abnormal subgraph is determined.

[0045] In the specific implementation process, in the calculation step of the graph structure sub-vector, the graph structure information in the abnormal subgraph is statistically analyzed. The graph structure information includes the total number of nodes, the total number of edges, the proportion of abnormal nodes, and the proportion of abnormal edges in the subgraph. The graph structure information is encoded to obtain the graph structure sub-vector. In the calculation step of the spatiotemporal sub-vector, the geographical coordinates of the abnormal nodes and the timestamp of the abnormality are encoded to obtain the spatiotemporal sub-vector. In the calculation step of the type sub-vector, the verification type of the verification that failed the global verification is encoded to obtain the type sub-vector.

[0046] In the specific implementation process, in the step of calculating the similarity between the retrieval vector and the matching evidence vector corresponding to each evidence fragment, and determining the evidence fragment corresponding to the abnormal subgraph, the cosine similarity between the two vectors is calculated. If it is greater than the preset similarity threshold, the evidence fragment is determined to be the evidence fragment corresponding to the abnormal subgraph.

[0047] In some embodiments of the present invention, in the step of inputting the subgraph feature vector corresponding to the abnormal subgraph and the evidence vector of the matching evidence fragment into a pre-trained language model, and the language model outputting the risk reasoning result, the abnormal subgraph as a whole is input into a spatiotemporal graph convolutional network to obtain the subgraph feature vector, the subgraph feature vector is concatenated with the evidence vector of the matching evidence fragment, and then input into the pre-trained language model.

[0048] like Figure 3 and 4As shown, in the specific implementation process, the Spatiotemporal Graph Convolutional Network (ST-GCN) includes an input layer, a spatial graph convolutional layer, a first temporally gated convolutional layer, an activation and normalization layer, a second temporally gated convolutional layer, and an output layer arranged sequentially. The spatial graph convolutional layer adopts a first-order approximate graph convolution based on Chebyshev polynomials, without pooling operations. The first and second temporally gated convolutional layers adopt the same structure, both of which are equipped with 1D causal convolution and gated linear units (GLUs), and the convolution kernel size is set to 9. The activation and normalization layer is equipped with a ReLU activation function and layer normalization (LayerNorm).

[0049] Specifically, in the spatiotemporal graph convolutional network, if the number of input channels is inconsistent with the number of output channels, the input features will be subjected to a 1×1 convolution transformation and then added to the output features.

[0050] In some embodiments of the present invention, the language model includes a feature extraction core layer and a result output layer. The feature extraction core layer employs stacked multi-layer transformer decoding modules. The feature extraction core layer outputs a context feature sequence and an attention weight matrix. Each transformer decoding module includes a masked multi-head self-attention layer and multiple fully connected layers arranged in sequence. The result output layer outputs a risk level through a softmax layer using the context feature sequence. Specifically, after 16 layers of Transformer decoder masked multi-head self-attention calculation, each output token automatically calculates its attention weight for all input tokens. The higher the weight, the greater the contribution of the input segment to the current output. The feature extraction core layer outputs a 4096×768-dimensional context feature sequence, and the last layer is the average attention weight matrix of all attention heads. The result output layer locates the position interval of each matched evidence segment in the input vector of the pre-trained language model, and calculates the average weight value of each matched evidence segment in the attention weight matrix, corresponding to the weight value of the position interval. The average weight value of each matched evidence segment is normalized to obtain the contribution of each evidence segment. Based on the contribution, the matched evidence segments are sorted to obtain the evidence chain.

[0051] In the specific implementation process, based on the position range of the evidence fragment recorded during preprocessing in the input vector of the pre-trained language model, the corresponding weight sub-vector is extracted from the row vector of the attention weight matrix, and the arithmetic mean of all elements in the weight sub-vector of the evidence fragment is calculated to obtain the average weight value of the evidence fragment to the risk level.

[0052] In the specific implementation process, the calculated average weight value can be directly used as the contribution of evidence, or the average weight of all evidence fragments can be normalized (summed to 1) to facilitate a direct comparison of the relative contributions of each piece of evidence. Specifically, let's assume the calculated average attention weights are: Evidence fragment EV00123: 0.0065; Evidence fragment EV00456: 0.0035; The normalized contribution is: Evidence fragment EV00123: 0.0065 / (0.0065+0.0035) = 0.65; Evidence fragment EV00456: 0.0035 / (0.0065+0.0035) = 0.35.

[0053] like Figure 2 As shown, in some embodiments of the present invention, the method further includes step S600, which further includes determining the corresponding recommended action based on the risk level and outputting the verifiable evidence field corresponding to the recommended action; storing the anomaly subgraph, evidence chain, risk level, recommended action and the verifiable evidence field of the corresponding target goods using an SM3 hash chain structure.

[0054] like Figure 5 As shown, in the specific implementation process, the disposal instructions are output through a standardized API interface. Before outputting the instructions, an operation permission check is performed to ensure that the disposal action is compliant. Verifiable evidence fields output: In the alert interface response packet / message body, return observable and verifiable evidence fields, including: X-Audit-Trace-ID, graph_snapshot_hash, anomaly_subgraph_id, evidence_snippet_id, risk_source, anomaly_score, alert_id, and timestamp; Anti-tampering audit record generation: Audit records are stored using the national cryptographic standard SM3 hash chain structure. The hash chain calculation formula is as follows: ,in Includes all the above-mentioned evidence storage fields and processing instruction information, and also... It uses the national cryptographic standard SM2 for signing to prevent tampering and supports post-event reproduction and independent verification by third parties; Uncertainty diversion and closed-loop learning: The uncertainty of the inference results is quantified by Monte Carlo Dropout ensemble learning method. The same input is inferred 10 times, and the variance of the output risk level is calculated. If the variance exceeds the preset threshold, it is judged as high uncertainty, and manual review is forcibly triggered. The review results are written back to the abnormal pattern knowledge base to update the confidence of the corresponding abnormal pattern or generate a new abnormal pattern template, so as to realize the continuous iterative optimization of the system.

[0055] The beneficial effects of this plan include: 1. By constructing a standardized RFID event graph, the unified integration of multi-source heterogeneous data across the entire supply chain is achieved, providing a structured spatiotemporal factual basis for anomaly detection; 2. By verifying the spatiotemporal consistency of the event graph, we can accurately identify structural and chain-like complex anomalies that cross nodes and links, reduce the false negative rate, and achieve early identification of abnormal behavior. 3. By using retrieval-enhanced reasoning technology, with regulatory rules and anomaly pattern knowledge base as factual constraints, the large model illusion problem is suppressed, and risk assessment results with a complete chain of evidence are output, ensuring that the reasoning process is interpretable and auditable; 4. By using standardized and verifiable evidence fields and tamper-proof audit hash chain design, the warning results can be independently reproduced and verified by third parties, meeting the requirements of compliance audit and liability determination; 5. By using uncertainty diversion and closed-loop learning mechanisms, the false alarm rate is reduced, while continuous iterative adaptation to new anomaly patterns is achieved, thereby improving the system's robustness and scenario adaptability.

[0056] This invention also provides an early warning system for abnormal behavior based on RFID event graphs and large models. The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0057] This invention also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the steps of the aforementioned early warning method for abnormal behavior based on RFID event graphs and large models. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0058] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0059] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0060] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0061] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for early warning of abnormal behavior based on RFID event graphs and large-scale models, characterized in that, The steps of the method include: Real-time acquisition of RFID read / write event data and corresponding IoT status data across the entire supply chain; construction of standardized event sequences based on business entities in the RFID read / write event data; matching the IoT status data with the standardized event sequences; determination of business entities corresponding to target goods based on target goods in the RFID read / write event data; determination of IoT status data corresponding to business entities based on the processing time of target goods in the business entities; association of business entities with corresponding IoT status data; and construction of standardized event sequences based on the flow relationship of target goods among business entities. Based on the standardized event sequence, a directed supply chain RFID event graph is constructed, with the business entity as the node and the flow relationship of the business entity as the edge. The directed supply chain RFID event graph is globally validated based on preset global validation rules. Abnormal nodes and edges in the graph are identified and constructed as abnormal subgraphs. These global validation rules include spatiotemporal reachability validation, operation uniqueness validation, link integrity validation, path compliance validation, and state compliance validation. The spatiotemporal reachability validation calculates the predicted transfer time between nodes based on their geographical location, and determines whether the validation passes based on the actual transfer time and the predicted transfer time. The operation uniqueness validation verifies whether the same operator or device performs conflicting operations on different business entities within a preset time window. The link integrity validation verifies the completeness of the entire link event for the target goods. The path compliance validation verifies whether the transfer path of the target goods is within a preset whitelist. The state compliance validation verifies whether the IoT state data corresponding to each node is within a preset security range. For the abnormal subgraph, a retrieval vector is generated, and the retrieval vector is matched with evidence fragments in the preset abnormal pattern knowledge base to determine the matching evidence fragments; The feature vector of the subgraph corresponding to the abnormal subgraph and the evidence vector of the matching evidence fragment are input into a pre-trained language model. The language model outputs a risk inference result, which includes a chain of evidence and a risk level.

2. The method for early warning of abnormal behavior based on RFID event graphs and large models according to claim 1, characterized in that, In the step of constructing a directed supply chain RFID event graph based on the standardized event sequence, using the business entities as nodes and the flow relationships of the business entities as edges, the business entities include orders, goods batches, pallets, storage locations, and warehouses; the flow relationships of the business entities include inbound, outbound, loading and unloading, and transshipment. Each business entity in the standardized event sequence is constructed as a node, and directed edges between nodes are constructed based on the flow order of the target goods in the business entities in the standardized event sequence.

3. The method for early warning of abnormal behavior based on RFID event graphs and large models according to claim 1 or 2, characterized in that, The global verification rules include cross-subgraph operation uniqueness verification. The cross-subgraph operation uniqueness verification is based on the historical data of the business entity corresponding to the node to verify whether the same operator or the same device appears in the positions of different business entities within the overlapping time window.

4. The method for early warning of abnormal behavior based on RFID event graphs and large models according to claim 1, characterized in that, In the steps of generating a retrieval vector for the abnormal subgraph, matching the retrieval vector with evidence fragments in a preset abnormal pattern knowledge base, and determining the matching evidence fragments, a graph structure subvector is constructed based on the graph structure of the abnormal subgraph; a spatiotemporal subvector is constructed based on the geographical coordinates of the abnormal nodes in the abnormal subgraph and the timestamps of the abnormality; a type subvector is determined based on the abnormality type determined by the global verification; the graph structure subvector, spatiotemporal subvector, and type subvector are concatenated; and the concatenated vector is mapped to a preset dimension to obtain the retrieval vector; the similarity between the retrieval vector and the evidence vector to be matched corresponding to each evidence fragment is calculated to determine the evidence fragment corresponding to the abnormal subgraph.

5. The method for early warning of abnormal behavior based on RFID event graphs and large models according to claim 1, characterized in that, In the step of inputting the subgraph feature vector corresponding to the abnormal subgraph and the evidence vector of the matching evidence fragment into the pre-trained language model, and the language model outputting the risk reasoning result, the abnormal subgraph as a whole is input into the spatiotemporal graph convolutional network to obtain the subgraph feature vector, the subgraph feature vector is concatenated with the evidence vector of the matching evidence fragment, and then input into the pre-trained language model.

6. The method for early warning of abnormal behavior based on RFID event graphs and large models according to claim 5, characterized in that, The language model includes a feature extraction core layer and a result output layer. The feature extraction core layer adopts stacked multi-layer transformer decoding modules. The feature extraction core layer outputs a context feature sequence and an attention weight matrix. Each transformer decoding module includes a masked multi-head self-attention layer and multiple fully connected layers arranged in sequence. The result output layer outputs the risk level through a softmax layer using the context feature sequence. The output layer locates the position interval of each matched evidence fragment in the input vector of the pre-trained language model, and calculates the average weight value of each matched evidence fragment in the attention weight matrix, corresponding to the weight value of the position interval. The average weight value of each matched evidence fragment is normalized to obtain the contribution of each evidence fragment. The matched evidence fragments are sorted based on the contribution to obtain the evidence chain.

7. The method for early warning of abnormal behavior based on RFID event graphs and large models according to claim 1, characterized in that, The method further includes determining the corresponding recommended action based on the risk level, and outputting a verifiable evidence field corresponding to the recommended action. The abnormal sub-graph, evidence chain, risk level, recommended handling actions, and verifiable evidence fields corresponding to the target goods are stored using an SM3 hash chain structure.

8. An early warning system for abnormal behavior based on RFID event graphs and large models, characterized in that, The system includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method as described in any one of claims 1 to 7.

Images