A smart security comprehensive management platform full-link risk assessment method and system

Abstract

This invention relates to the field of smart security technology, specifically disclosing a method and system for end-to-end risk assessment of a smart security integrated management platform. This method generates an ordered execution scheduling chain by parsing linkage scheduling rules, collects and normalizes equipment operating indicators, and takes the maximum value to obtain a basic risk value. It then calculates scheduling health based on historical scheduling data and maps it to obtain a scheduling correction factor. The actual risk value of each device is calculated level by level along the scheduling chain. The first device is calculated based on the basic risk and the correction factor, while subsequent devices take the maximum value of their own basic risk and the amplified risk from the upstream. Finally, the overall failure probability of the link is calculated through a serial system model. When a threshold is exceeded, a warning message containing the risk source is output. This invention can achieve full-process quantification of linkage link risks, fill the blind spot in scheduling performance evaluation, has low computational overhead, can accurately predict linkage failures, quickly locate risk sources, and significantly improve the operational reliability and maintenance efficiency of security systems.

Description

Technical Field

[0001] This invention relates to the field of smart security technology, and in particular to a method and system for end-to-end risk assessment of a smart security integrated management platform. Background Technology

[0002] Intelligent security integrated management platforms are widely used in security scenarios such as parks and buildings. These platforms achieve coordinated responses from multiple devices through configured linkage scheduling rules. For example, after a camera detects an intrusion, it sequentially triggers video analytics server decoding, access control locks, and audible and visual alarms, forming a linked chain of execution across multiple devices. Current mainstream security platforms only perform independent risk monitoring on individual devices, assessing their health status by collecting operational metrics such as CPU utilization, network packet loss rate, memory usage, and encoding latency, without considering the execution logic of the linkage chain or the dependencies between devices.

[0003] In actual security operations, the reliability of the linkage link is determined by the collaborative status of all devices in the link. While low-level anomalies in upstream devices may not cause their individual risks to exceed limits, they can propagate downstream along the linkage execution chain and accumulate, eventually causing the entire linkage rule to fail. For example, a minor packet loss at an edge switch, with a low risk rating for a single device, can lead to decoding failures by the video analytics server, resulting in access control systems failing to lock according to rules and creating a security vulnerability. Furthermore, current technologies do not consider the historical scheduling performance of devices, creating blind spots in assessment where basic device indicators are normal but scheduling failures are frequent or responses are slow. This makes it impossible to quantify the overall failure probability of the linkage link or automatically locate the source of risk, leading to low efficiency in maintenance and troubleshooting, inability to predict security linkage failures in advance, and an inability to guarantee the stable and reliable operation of the security system.

[0004] Therefore, there is an urgent need for a comprehensive risk assessment method and system for intelligent security management platforms to solve the above problems. Summary of the Invention

[0005] The purpose of this invention is to provide a full-chain risk assessment method for a smart security integrated management platform, comprising the following steps: The system analyzes the configured linkage scheduling rules in the intelligent security integrated management platform and generates an ordered scheduling chain arranged in the execution order based on the dependency relationship between the event triggering device and the action execution device in the rules. Collect the operational status data of each device in the scheduling chain, and determine the current basic risk value of each device based on the operational status data; Obtain the scheduling execution record of each device within the historical time window, and determine the scheduling correction factor for each device based on the scheduling execution record; The actual risk value of each device is calculated step by step along the scheduling chain from the first device to the last device. For the first device, the actual risk value is calculated based on its basic risk value and scheduling correction factor. For subsequent devices, the actual risk value is determined by comprehensively considering its own basic risk value, the actual risk value of the upstream device, and its own scheduling correction factor. Based on the actual risk values ​​of all devices in the scheduling chain, the overall failure probability of the scheduling chain is calculated. When the overall failure probability exceeds a preset threshold, a warning message containing the identifier of the risk source device is output.

[0006] Furthermore, this invention also discloses a full-chain risk assessment system for a smart security integrated management platform, comprising: The parsing module is used to parse the linkage scheduling rules configured in the smart security integrated management platform, and generate an ordered scheduling chain arranged in the execution order based on the dependency relationship between the event triggering device and the action execution device in the rule; The data acquisition module is used to collect the operating status data of each device in the scheduling chain and determine the current basic risk value of each device based on the operating status data. The acquisition module is used to acquire the scheduling execution records of each device within a historical time window, and determine the scheduling correction factor for each device based on the scheduling execution records; The calculation module is used to calculate the actual risk value of each device level by level along the scheduling chain from the first device to the last device. For the first device, the actual risk value is calculated based on its basic risk value and scheduling correction factor. For subsequent devices, the actual risk value is determined by comprehensively considering its own basic risk value, the actual risk value of the upstream device, and its own scheduling correction factor. The output module is used to calculate the overall failure probability of the scheduling chain based on the actual risk value of all devices on the scheduling chain, and output a warning message containing the identifier of the risk source device when the overall failure probability exceeds a preset threshold.

[0007] Furthermore, the acquisition module includes: The data acquisition unit is used to acquire the set of basic operating indicators of each device in the scheduling chain in the most recent data acquisition period through the platform monitoring interface according to a preset data acquisition period. The set of basic operating indicators is set with corresponding differentiated indicators according to the device type. The processing unit is used to normalize each basic operating indicator, so that the values ​​of each indicator are unified within a preset standard range. The comparison unit is used to compare all normalized index values ​​and take the maximum value as the basic risk value of the device. The lower limit of the basic risk value corresponds to the device being completely healthy, and the upper limit corresponds to the device being completely unhealthy.

[0008] This application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described intelligent security integrated management platform full-link risk assessment method.

[0009] This application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method for end-to-end risk assessment of a smart security integrated management platform.

[0010] The beneficial effects of this application are as follows: Firstly, this invention generates an ordered scheduling chain that is completely consistent with the actual execution path based on the linkage scheduling rules, upgrading risk assessment from independent monitoring of a single device to full-link chain propagation assessment, accurately quantifying the cumulative effect of upstream device anomalies propagating along the chain, and solving the core problem that existing technologies cannot assess the risk propagation of linkage links.

[0011] Secondly, this invention transforms the historical scheduling performance of equipment into a scheduling correction factor, and combines it with the basic risk value to achieve two-dimensional risk quantification. This fills the assessment blind spot where the basic indicators of the equipment are normal but the scheduling fails or the response is slow. The risk assessment results are more in line with the actual operating status of security linkage.

[0012] Third, this invention adopts the calculation logic of taking the maximum value along the chain, which fits the physical characteristic that the weakest link in the linkage determines the overall reliability. Combined with the serial system model, it calculates the overall failure probability, realizes the quantitative prediction of security linkage failure risk, and can trigger early warning to avoid security vulnerabilities. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of a method flow proposed in an embodiment of this application.

[0014] Figure 2 This is a schematic diagram of the system structure proposed in an embodiment of the present invention.

[0015] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0016] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0017] like Figure 1 As shown, this application provides a full-chain risk assessment method for a smart security integrated management platform, including the following steps: S1. Analyze the configured linkage scheduling rules in the smart security integrated management platform, and generate an ordered scheduling chain consisting of triggering devices, intermediate processing devices and execution devices in the execution order according to the dependency relationship between event triggering devices and action execution devices in the linkage scheduling rules; S2. Collect the basic operating indicators of each device in the scheduling chain in real time, normalize the basic operating indicators, and select the maximum value from the normalized indicator values ​​as the current basic risk value of each device. S3. Calculate the total number of scheduling attempts, the number of scheduling failures, and the number of slow responses for each device within a preset historical time window from the platform scheduling log. Calculate the scheduling health of each device based on the total number of scheduling attempts, the number of scheduling failures, and the number of slow responses. Determine the scheduling correction factor for each device according to the preset segmented mapping rules based on the scheduling health. S4. Calculate the actual risk value of each device step by step from the first device to the last device along the scheduling chain: For the first device, multiply its basic risk value by an amplification factor to obtain the actual risk value. The amplification factor is equal to 1 plus the scheduling correction factor of the device. For each subsequent device, first calculate the upstream actual risk value by multiplying it by its own amplification factor to obtain a candidate risk value. Then compare the candidate risk value with its own basic risk value and take the larger value of the two as the actual risk value of the device. S5. Calculate the actual risk value of all devices on the scheduling chain according to the serial system failure probability model to obtain the overall failure probability of the scheduling chain. When the overall failure probability exceeds the preset alarm threshold, output the warning information containing the identifier of the risk source device.

[0018] As described in steps S1-S5 above, the linkage scheduling rules of the intelligent security integrated management platform consist of sensing devices, processing devices, and execution devices connected in series to form an execution link. An anomaly in any link will propagate along the link, ultimately causing the entire linkage rule to fail. The basic health status of the device itself and its historical scheduling performance jointly determine the risk level of the link. Monitoring only the independent status of a single device cannot reflect the cumulative risk of chain transmission. It is necessary to establish a full-link risk assessment method consistent with the actual execution path to quantify the risk propagation effect and predict the overall failure probability.

[0019] Existing security platforms only perform independent health monitoring on individual devices, do not construct risk propagation paths based on linkage scheduling rules, do not adjust risk values ​​based on the historical scheduling performance of devices, cannot calculate the overall failure probability of linkage links, and cannot automatically locate the source of risk. There are blind spots in the assessment of devices with normal basic indicators but failed scheduling execution, which can easily lead to security linkage failure accidents.

[0020] This invention provides a complete risk assessment method for the entire chain of a smart security integrated management platform. Through the steps of generating a linkage scheduling chain, calculating basic equipment risks, determining scheduling correction factors, calculating actual risks level by level along the chain, calculating the overall failure probability, and outputting early warnings, it can realize the full-process quantitative assessment of security linkage scheduling links, accurately predict the failure probability of linkage rules, and locate the source of risks, thus solving the technical problem that traditional security platforms cannot assess the risk propagation effect of linkage links.

[0021] This invention uses the actual execution process of intelligent security linkage scheduling rules as the risk propagation carrier. First, the linkage rules are parsed into a device scheduling chain arranged in the execution order. Then, the basic risk value is obtained by collecting the device's own operating indicators. At the same time, the scheduling performance is statistically analyzed based on historical scheduling logs and transformed into scheduling correction factors. The actual risk value of each device is calculated level by level along the scheduling chain according to the logic of the weakest link constraint. The entire scheduling chain is regarded as a serial system to calculate the overall failure probability. When the probability exceeds the preset threshold, the device with the highest risk on the link is automatically identified as the risk source and structured early warning information is output, forming a closed-loop evaluation mechanism from risk path construction, multi-dimensional risk quantification, chain propagation calculation to early warning location.

[0022] In one embodiment, step S1, which involves parsing the linkage scheduling rules to generate an ordered scheduling chain, specifically includes: S11. Read all activated linkage scheduling rules from the rule configuration database of the smart security integrated management platform. Each linkage scheduling rule contains at least one event triggering condition and one action execution sequence. The event triggering condition is associated with the event output of at least one sensing device. The action execution sequence contains action instructions of at least one control device or execution device arranged in logical order. S12. For each linkage scheduling rule, the sensing device associated with the event triggering condition is taken as the first node of the scheduling chain, and the device corresponding to the first action instruction in the action execution sequence is taken as the second node. According to the order of instructions in the action execution sequence, the device corresponding to each action instruction is added to the scheduling chain in turn until the execution device corresponding to the last action instruction is taken as the end node of the scheduling chain, thereby forming a node sequence. S13. For each pair of adjacent nodes in the node sequence, mark the transmission link type according to the signal transmission method and control dependency relationship between the two nodes. The transmission link type includes direct control link, network data link and shared resource link. Store the node sequence and its link mark together as a scheduling chain template for subsequent risk propagation calculation.

[0023] As described in steps S11-S13 above, by refining the specific process of parsing the linkage scheduling rules and generating the orderly scheduling chain, by reading the activated linkage rules on the platform, constructing the device node sequence according to the execution logic, marking the node transmission link type and storing it as a scheduling chain template, the generated scheduling chain is completely consistent with the actual execution path of the smart security linkage rules, providing a standardized and reusable path carrier for subsequent full-link risk propagation calculation.

[0024] The linkage scheduling rules of the intelligent security integrated management platform are triggered by sensing devices, which then drive intermediate processing devices and end-point execution devices to complete linkage actions according to fixed logic. There are clear signal transmission and control dependencies between devices. Anomalies in upstream devices can propagate downstream along the execution chain, ultimately causing the entire linkage rule to fail. Current technologies do not treat the linkage execution process as a fixed path for risk propagation and cannot quantify the cumulative risk generated by the chain-like propagation of low-level upstream anomalies. Therefore, it is necessary to construct an ordered scheduling chain that perfectly matches the actual execution process as the basic path for risk propagation calculation.

[0025] Existing security platforms only perform independent health monitoring for individual devices, failing to construct an orderly execution link for coordinated scheduling rules. Risk assessment lacks a fixed propagation path, making it impossible to identify downstream device failures caused by low-risk anomalies transmitted through the link. By reading activated linkage rules from the platform, generating device node sequences according to execution logic, marking transmission link types, and storing them in a templated manner, the risk propagation path is precisely matched with the actual execution path of security linkage, solving the technical problem of the lack of a fixed assessment path for risks in linkage links.

[0026] Step S11 reads all activated linkage scheduling rules from the rule configuration database of the smart security integrated management platform. Each linkage scheduling rule contains at least one event trigger condition and one action execution sequence. The event trigger condition is associated with the event output of at least one sensing device, and the action execution sequence contains action instructions from at least one control device or execution device arranged in logical order. In the park security scenario, the intrusion linkage rule stored in the rule configuration database is associated with the intrusion detection event output of camera C1. The action execution sequence sequentially includes the decoding and analysis instructions of video analysis server S1, the locking instructions of access controller AC1, and the execution instructions of electromagnetic lock L1. This allows the acquisition of the raw data of all valid linkage rules, providing a basis for the subsequent generation of scheduling chains.

[0027] Step S12, for each linkage scheduling rule, uses the sensing device associated with the event triggering condition as the first node of the scheduling chain, and the device corresponding to the first action command in the action execution sequence as the second node. Following the order of the commands in the action execution sequence, the devices corresponding to each action command are added to the scheduling chain sequentially until the execution device corresponding to the last action command becomes the last node of the scheduling chain, thus forming a node sequence. For the aforementioned park intrusion linkage rule, camera C1 is used as the first node, and video analysis server S1, access controller AC1, and electromagnetic lock L1 are added to the node sequence sequentially, ultimately forming an ordered node sequence of C1, S1, AC1, and L1. This sequence is completely consistent with the actual execution flow of the linkage rule, avoiding evaluation distortion caused by a disconnect between the risk propagation path and the execution path.

[0028] Step S13 marks the transmission link type for each pair of adjacent nodes in the node sequence based on the signal transmission method and control dependency relationship between the two nodes. The transmission link types include direct control links, network data links, and shared resource links. The node sequence and its link markings are then stored as a scheduling chain template for subsequent risk propagation calculations. In the above node sequence, the link between camera C1 and video analysis server S1 is a network data link, the link between video analysis server S1 and access controller AC1 is a network data link, and the link between access controller AC1 and electromagnetic lock L1 is a direct control link. After marking, the sequence and link information are stored as a scheduling chain template, eliminating the need to repeatedly parse rules in each evaluation cycle, reducing platform computing power overhead, and providing accurate link dependency basis for risk propagation calculations.

[0029] In one embodiment, step S2, calculating the current baseline risk value for each device, specifically includes: S21. For each device in the scheduling chain, according to a preset collection period, obtain the set of basic operating indicators for that device in the most recent collection period through the platform monitoring interface. The set of basic operating indicators includes differentiated indicators for different types of devices: For network switching equipment, at least port packet loss rate and port error count should be included; For computing server devices, at least CPU utilization, memory utilization, and number of process crashes should be included; For video capture equipment, at least encoding latency and image loss frame rate are included; For access control devices, at least the number of command response timeouts and the number of communication reconnections should be included; S22. Normalize each basic operational indicator separately. The normalization method is as follows: Divide the actual collected value of the indicator by the preset warning threshold of the indicator. If the result of the division is greater than 1, the normalization result is 1; otherwise, the result of the division is taken. When the actual collected value is lower than the warning threshold, the normalization value is less than 1. When the actual collected value is equal to or exceeds the warning threshold, the normalization value is equal to 1, indicating that the indicator has reached a completely invalid state. S23. Compare all normalized index values ​​and select the largest value. Use the largest value as the basic risk value of the equipment. The basic risk value ranges from 0 to 1, where 0 indicates that the equipment is completely healthy and 1 indicates that the equipment is completely unhealthy.

[0030] As described in steps S21-S23 above, by refining the calculation process of the basic risk value of the equipment, by collecting differentiated operating indicators according to equipment type, completing the normalization of indicators according to unified rules, and selecting the maximum value of the normalized indicators to determine the basic risk value, a basic risk value with standardized values ​​that can reflect the worst operating state of the equipment is obtained, providing an accurate risk benchmark for the equipment itself for subsequent risk propagation calculations.

[0031] The intelligent security integrated management platform includes various types of equipment such as network switching equipment, computing server equipment, video acquisition equipment, and access control equipment. The operating status of different equipment depends on different core indicators. An abnormality in a single indicator of a device can trigger a linkage execution failure. The basic risk value needs to objectively reflect the weakest operating status of the equipment. Therefore, it is necessary to collect exclusive indicators for different devices and obtain a unified quantitative risk benchmark value through standardized processing.

[0032] Existing security platforms only display basic equipment metrics without setting differentiated metrics for different equipment types or achieving unified quantification through normalization. This makes it impossible to directly convert equipment operating metrics into standardized values ​​usable for risk assessment, hindering the support of link-level risk calculations. By collecting core operating metrics from different equipment types, performing unified normalization, and selecting the maximum value to determine the base risk value, standardized quantification of risks across multiple equipment types can be achieved, providing a unified risk input benchmark for end-to-end risk assessment.

[0033] Step S21 involves acquiring the set of basic operating indicators for each device in the scheduling chain according to a preset collection period, via the platform monitoring interface. These basic operating indicators are differentiated for different types of devices. For network switching devices, the set includes port packet loss rate and port error count. For server devices, it includes CPU utilization, memory utilization, and process crash counts. For video acquisition devices, it includes encoding latency and image frame loss rate. For access control devices, it includes command response timeouts and communication reconnection counts. In a campus security scenario, specific operating indicators are collected for each type of device within the scheduling chain—network switching device, video analytics server S1, camera C1, and access controller AC1—to obtain real-time operating status data and provide raw input for basic risk calculations.

[0034] Step S22 performs normalization processing on each basic operating indicator. The normalization method is to divide the actual collected value of the indicator by the preset warning threshold of the indicator. If the division result is greater than 1, the normalization result is 1; otherwise, the division result itself is taken. When the actual collected value is lower than the warning threshold, the normalization value is less than 1; when it is equal to or exceeds the warning threshold, the normalization value is equal to 1. This value indicates that the indicator has reached a completely failed state. Taking camera C1 as an example, its encoding delay warning threshold is set to 100 milliseconds, the actual collected value is 80 milliseconds, and the normalization result is 0.8. The image loss frame rate warning threshold is set to 10 frames, the actual collected value is 12 frames, and the normalization result is 1. Through this processing, indicators with different dimensions are converted into standardized values ​​in the range of 0 to 1, realizing the comparability of multiple indicators.

[0035] Step S23 compares all normalized indicator values ​​and selects the maximum value as the basic risk value for the device. The basic risk value ranges from 0 to 1, where 0 indicates the device is completely healthy and 1 indicates the device is completely unhealthy. Taking camera C1 as an example, the encoding latency normalization value is 0.8 and the image loss frame rate normalization value is 1. The maximum value of 1 is selected as the basic risk value for the device. This method can accurately capture the most severe abnormal state of the device, ensuring that the basic risk value truly reflects the device's current minimum health level and provides a reliable self-risk benchmark for subsequent risk propagation calculations.

[0036] In one embodiment, step S3, which calculates the scheduling health of each device and maps it to obtain a scheduling correction factor, specifically includes: S31. From the platform scheduling log, maintain a sliding time window for each device. The length of the sliding time window is preset to 3600 seconds. At the beginning of each evaluation cycle, read the scheduling log records of the device being called by all linkage scheduling rules within the time window, and calculate three cumulative values: Total number of scheduling attempts, number of scheduling failures, and number of slow response attempts. The number of scheduling failures refers to the number of times the device returns an execution error code or times out without responding. The number of slow response attempts refers to the number of times the device's delay from receiving an instruction to returning an acknowledgment exceeds a preset delay threshold of 500 milliseconds. S32. If the total number of scheduling attempts is 0, then the scheduling correction factor of the device is set to 0 directly, and subsequent calculation steps are skipped. If the total number of scheduling attempts is greater than 0, the scheduling health is calculated as follows: Subtract the number of scheduling failures and slow response times from the total number of scheduling attempts to obtain a difference. Then divide this difference by the sum of the total number of scheduling attempts plus 1. The quotient is the scheduling health. In this calculation method, adding 1 to the denominator is used to prevent division by zero errors and to ensure that the health value is between 0 and 1 (excluding 1). S33. Based on the calculated scheduling health value, determine the scheduling correction factor according to the following segmented mapping rules: If the scheduling health is greater than or equal to 0.9, the scheduling correction factor is 0. If the scheduling health is greater than or equal to 0.5 but less than 0.9, the scheduling correction factor is 0.2. If the scheduling health is less than 0.5, the scheduling correction factor is set to 0.5. The scheduling correction factor is used to characterize the degree to which the historical scheduling performance of the equipment amplifies the current risk level. The larger the scheduling correction factor, the worse the historical scheduling performance of the equipment, and the stronger the amplification effect on risk propagation.

[0037] As described in steps S31-S33 above, by refining the segmented mapping process of scheduling health calculation and scheduling correction factor, the scheduling health is calculated by statistically analyzing the number of scheduling-related events within the preset historical time window of the equipment, and the scheduling correction factor is determined according to fixed segmentation rules. This transforms the historical scheduling performance of the equipment into a standardized risk amplification coefficient, providing a dynamic correction basis for subsequent risk propagation calculations.

[0038] During the execution of intelligent security linkage scheduling, some devices may have their basic operating indicators within the normal range, but they may frequently experience scheduling execution failures or slow responses. Such problems can directly disrupt the linkage process. The historical scheduling performance of the devices directly determines the amplification intensity of risk propagation. It is necessary to quantify the scheduling execution effect into a calculable correction factor to reflect the degree of impact of scheduling performance on link risks.

[0039] Existing security platforms only record dispatch logs, failing to statistically analyze and quantify dispatch failures and slow responses. This makes it impossible to correlate dispatch performance with equipment risk, creating a blind spot in assessment where equipment is healthy but dispatch performance is poor. By using a sliding time window to statistically analyze core dispatch data, calculate standardized dispatch health, and map correction factors according to segmented rules, historical dispatch performance is transformed into a risk amplification coefficient, accurately filling the assessment blind spots of existing technologies.

[0040] Step S31 maintains a 3600-second sliding time window for each device from the platform's scheduling log. At the beginning of each evaluation cycle, it reads the scheduling log records within this time window and calculates three values: total scheduling times, scheduling failures, and slow response times. Scheduling failures are the number of times the device returns an execution error code or times out without responding. Slow response times are the number of times the device receives a command and returns an acknowledgment with a latency exceeding 500 milliseconds. In a campus security scenario, the video analytics server S1 is scheduled 120 times within the 3600-second time window, with 10 scheduling failures and 40 slow response times (with a response latency exceeding 500 milliseconds). This allows for accurate statistics of core historical scheduling data, providing raw data for health assessment.

[0041] Step S32 first determines the total number of scheduling attempts. If the total number of scheduling attempts is 0, the scheduling correction factor is directly set to 0. If the total number of scheduling attempts is greater than 0, the scheduling health is calculated. The calculation method is to subtract the difference between the number of scheduling failures and the number of slow responses from the total number of scheduling attempts, and then divide by the sum of the total number of scheduling attempts plus 1. The denominator is added by 1 to avoid division by zero error, so that the health value is between 0 and 1. The formula for calculating the scheduling health is: ; Among them, the This represents the health of the equipment scheduling, with a value range of [0,1), and is used to characterize the quality of the equipment's historical scheduling execution. This indicates the total number of times the device is scheduled within the preset sliding time window. This indicates the number of device scheduling failures within a preset sliding time window. This represents the number of slow responses from the device within the preset sliding time window. By using the statistical data from the video analysis server S1, the scheduling health score is calculated as 120 minus the difference between 10 and 40, and then divided by the sum of 120 and 1. The result is approximately 0.579. This transforms the historical scheduling data into a standardized health score value, achieving a unified quantification of scheduling performance.

[0042] Step S33 determines the scheduling correction factor according to a fixed segmentation rule based on the scheduling health value. When the scheduling health value is greater than or equal to 0.9, the scheduling correction factor is 0; when the scheduling health value is greater than or equal to 0.5 but less than 0.9, the scheduling correction factor is 0.2; and when the scheduling health value is less than 0.5, the scheduling correction factor is 0.5. A larger scheduling correction factor value indicates worse historical scheduling performance of the device and a stronger amplification effect on risk propagation. The scheduling health value of video analysis server S1 is approximately 0.579, falling within the range of 0.5 to 0.9. Its scheduling correction factor is determined to be 0.2, transforming the abstract scheduling performance into a specific risk amplification coefficient, providing a core correction parameter for subsequent calculation of actual risk values.

[0043] In one embodiment, step S4, which calculates the actual risk value of each device level by level along the scheduling chain, specifically includes: S41. Obtain the sequence of scheduling chain nodes generated in step S1, which is denoted as device 1, device 2, ..., device m, where m is the total length of the scheduling chain. Also obtain the basic risk value corresponding to each node calculated in step S2 and the scheduling correction factor corresponding to each node calculated in step S3. S42. For the first device in the scheduling chain, i.e. the first device, calculate its actual risk value as follows: multiply the basic risk value of the device by an amplification factor, which is equal to 1 plus the scheduling correction factor of the device. Since the possible values ​​of the scheduling correction factor are 0, 0.2 or 0.5, the possible values ​​of the amplification factor are 1, 1.2 or 1.5. S43. For each subsequent device in the scheduling chain starting from the second device, let the current device be the j-th device, where the value of j ranges from 2 to m. Calculate its actual risk value as follows: First, obtain the actual risk value of the previous device, i.e., the (j-1)th device, and multiply this value by the amplification factor of the current device to obtain a candidate risk value; Then, the basic risk value of the current device itself is taken as another candidate value; Finally, the two candidate values ​​are compared, and the larger one is taken as the actual risk value of the current device. The meaning of this calculation method is that the final risk of the downstream device is determined by the larger of its own health status and the risk transmitted from the upstream and corrected by the scheduling performance of this device, so as to reflect the engineering principle that "the weakest link determines the reliability of the link" in the security linkage link.

[0044] As described in steps S41-S43 above, the core objective is to refine the specific process for calculating the actual risk value of equipment level by level along the scheduling chain. By directly amplifying the risk of the first equipment and taking the maximum value of the amplified values ​​of its own basic risk and the upstream transmitted risk for subsequent equipment, the actual risk value that fits the short-board effect of the security linkage link is obtained, providing accurate single-equipment risk data for the calculation of the overall failure probability of the entire scheduling chain.

[0045] The intelligent security linkage scheduling chain is a serial execution structure. The risk of upstream equipment will be transmitted to downstream along the execution chain. The final risk of downstream equipment is not only determined by its own basic operating status, but also by the amplified effect of the upstream risk after being modified by its own scheduling factor. The reliability of the security linkage chain is determined by the weakest link, and the actual risk value of the equipment needs to be calculated according to the real logic of risk transmission along the chain.

[0046] Existing security platforms only calculate the basic risks of the devices themselves, without considering the chain-like transmission effect of upstream risks or incorporating scheduling correction factors to amplify risks. This fails to reflect the physical characteristic that the weakness in the linkage determines reliability, resulting in significant discrepancies between risk assessment results and actual linkage failure risks. By employing a step-by-step calculation method where the first device directly calculates the amplified risk and subsequent devices take the maximum value, the true patterns of risk propagation along the chain and the constraints of weak links are revealed, accurately obtaining the actual risk values ​​of each device.

[0047] Step S41 obtains the scheduling chain node sequence generated in step S1, denoted as device 1 to device m, where m is the total length of the scheduling chain. Simultaneously, it obtains the basic risk value of each device calculated in step S2 and the scheduling correction factor of each device calculated in step S3. In the park security intrusion linkage scenario, the scheduling chain node sequence is camera C1, video analysis server S1, access controller AC1, and electromagnetic lock L1, with a total length m of 4. The basic risk value and scheduling correction factor corresponding to the four devices are obtained simultaneously, providing all input data for the calculation of the actual risk value.

[0048] Step S42 calculates the actual risk value of the first device in the scheduling chain (the first device) by multiplying its base risk value by 1 and adding the amplification factor of its scheduling correction factor. The scheduling correction factor has values ​​of 0, 0.2, and 0.5, and the corresponding amplification factors have values ​​of 1, 1.2, and 1.5. In the above scenario, camera C1 is the first device in the scheduling chain, with a base risk value of 0.05, a scheduling correction factor of 0, and an amplification factor of 1. The calculated actual risk value is 0.05, thus completing the initial calculation of the actual risk of the first device.

[0049] Step S43, for devices 2 through m in the scheduling chain, first obtains the actual risk value of the upstream device and multiplies it by the amplification factor of the current device to obtain the candidate risk value. Then, it compares the candidate risk value with the basic risk value of the current device and takes the larger value as the actual risk value of the current device. This calculation method reflects the engineering principle that the weakest link determines the reliability of the link. In the above scenario, the video analysis server S1 is the 2nd device, with a basic risk value of 0.05, a scheduling correction factor of 0.2, and an amplification factor of 1.2. The upstream C1 has an actual risk value of 0.05 and a candidate risk value of 0.06. After taking the maximum value, the actual risk value of S1 is 0.06. The access controller AC1 and the electromagnetic lock L1 have a scheduling correction factor of 0 and an amplification factor of 1. The upstream transmitted risk value is 0.06, and their own basic risk value is 0.05. Finally, the actual risk value is 0.06 for all of them, completely restoring the calculation process of risk transmission along the chain and constraint by the weakest link.

[0050] In one embodiment, step S5, which calculates the overall failure probability of the scheduling chain and outputs early warning information, specifically includes: S51. Obtain the actual risk value of each device in the scheduling chain calculated in step S4. These actual risk values ​​correspond to the 1st device, the 2nd device, ..., the mth device, and the value range of each actual risk value is between 0 and 1. S52. The scheduling chain is regarded as a serial system, that is, the failure of any device in the chain will cause the entire linkage scheduling rule to fail. According to the serial system failure probability model, the overall failure probability of the scheduling chain is calculated in the following way: First, for each device, subtract the actual risk value of the device from 1 to get the probability that the device will not fail. Then, multiply the failure probabilities of all devices to get a product. Finally, subtract the product from 1. The result is the overall failure probability of the entire scheduling chain. The probability that all devices will not fail at the same time is equal to the product of the failure probabilities of each device, and the overall failure probability is equal to 1 minus the probability that all devices will not fail. S53. Compare the calculated overall failure probability with a preset alarm threshold. The alarm threshold ranges from 0.5 to 0.7, with a default value of 0.6. If the overall failure probability is greater than or equal to the alarm threshold, an alarm is triggered. S54. When an early warning is triggered, the actual risk values ​​of all devices in the scheduling chain are traversed, the device with the largest actual risk value is identified as the risk source device, and the device identifier and location information of the device are extracted. Then, a structured early warning information is generated. The structured early warning information includes: the linkage scheduling rule identifier that triggered the early warning, the calculated overall failure probability value, the identifier of the risk source device, and the actual risk value of the risk source device. S55. Push the structured early warning information to the alarm interface of the smart security integrated management platform, and highlight the topology location of the risk source device in the alarm interface. At the same time, generate an operation and maintenance prompt containing suggested inspection items. The suggested inspection items are determined according to the type of risk source device: for network devices, it is recommended to check the link quality. For server devices, it is recommended to check resource usage and process status; For access control devices, it is recommended to check the communication status.

[0051] As described in steps S51-S55 above, by limiting the overall failure probability calculation of the scheduling chain, judging the alarm threshold, locating the risk source and outputting the early warning information, the overall risk of the link is obtained by integrating the actual risk value of the equipment through the serial system failure probability model. When the threshold is exceeded, the device with the highest risk is located and structured early warning information is output, providing accurate risk warning and investigation guidance for the operation and maintenance of the security platform.

[0052] The intelligent security linkage dispatch chain adopts a serial execution structure. The failure of any device in the chain will directly lead to the failure of the entire linkage dispatch rule and the inability to complete the security linkage action. It is necessary to integrate the actual risk value of a single device into the overall failure probability of the entire chain, so as to quantify and evaluate the execution reliability of the linkage rule. When the failure probability exceeds the safe range, timely warnings are issued and the source of risk is located to avoid security linkage failures from causing security accidents.

[0053] Existing security platforms can only display the independent risk values ​​of a single device, failing to calculate the overall failure probability of the entire coordinated scheduling chain, predict the overall execution risk of coordinated rules in advance, and automatically locate the risk source device in the chain, resulting in low efficiency for maintenance personnel in troubleshooting. This solution calculates the overall failure probability using a serial system model, triggers alarms based on preset thresholds, traverses and locates the device with the highest risk, and outputs structured warnings and targeted maintenance tips, thus solving the technical problems of unquantifiable early warning of risks in coordinated chains and difficulty in quickly locating risk sources.

[0054] Step S51 obtains the actual risk values ​​of all devices in the scheduling chain calculated in step S4. The actual risk values ​​of all devices are between 0 and 1. In the park security intrusion linkage scenario, the scheduling chain includes four devices: camera C1, video analysis server S1, access control controller AC1, and electromagnetic lock L1. The corresponding actual risk values ​​are 0.05, 0.06, 0.06, and 0.06, respectively, providing complete device risk data for the overall failure probability calculation.

[0055] Step S52 treats the scheduling chain as a serial system and uses a serial system failure probability model to calculate the overall failure probability. First, it calculates the probability of each device not failing (1 minus the actual risk value). Then, it multiplies all the non-failure probabilities and finally subtracts this product from 1 to obtain the overall failure probability. This calculation method conforms to the physical logic that the normal operation of all devices in a serial system is necessary to ensure the normal operation of the link. Using the example data above, the overall failure probability is 1 minus the product of 0.95, 0.94, 0.94, and 0.94, resulting in approximately 0.211, thus completing the quantitative calculation of the overall risk of the linked link.

[0056] Step S53 compares the calculated overall failure probability with a preset alarm threshold. The default alarm threshold is 0.6, with a range between 0.5 and 0.7. An alarm is triggered when the overall failure probability is greater than or equal to the alarm threshold. In the example above, the overall failure probability of 0.211 is less than 0.6, so no alarm is triggered. If the basic risk value of the video analytics server S1 rises to 0.4, the calculated overall failure probability is 0.795, which is greater than 0.6, and the system immediately triggers an alarm.

[0057] After triggering the early warning in step S54, the actual risk values ​​of all devices in the scheduling chain are traversed. The device with the highest actual risk value is identified as the risk source device. The linkage rule identifier, overall failure probability, risk source device identifier, and actual risk value are extracted to generate structured early warning information. In the scenario where the basic risk value in step S1 is 0.4, the actual risk value in step S1 is 0.4, which is the highest value on the link. Therefore, step S1 is identified as the risk source device, and corresponding structured early warning information is generated.

[0058] Step S55 pushes the structured early warning information to the alarm interface of the intelligent security integrated management platform, highlighting the topological location of the risk source device, and generating corresponding maintenance prompts according to the type of risk source device. For the risk source video analysis server, maintenance prompts are generated to check resource usage and process status; if it is a network device, the prompt is to check link quality; if it is an access control controller, the prompt is to check communication status, providing maintenance personnel with precise troubleshooting directions.

[0059] like Figure 2 As shown, this invention also discloses a full-chain risk assessment system for a smart security integrated management platform, comprising: The parsing module is used to parse the linkage scheduling rules configured in the smart security integrated management platform, and generate an ordered scheduling chain arranged in the execution order based on the dependency relationship between the event triggering device and the action execution device in the rule; The data acquisition module is used to collect the operating status data of each device in the scheduling chain and determine the current basic risk value of each device based on the operating status data. The acquisition module is used to acquire the scheduling execution records of each device within a historical time window, and determine the scheduling correction factor for each device based on the scheduling execution records; The calculation module is used to calculate the actual risk value of each device level by level along the scheduling chain from the first device to the last device. For the first device, the actual risk value is calculated based on its basic risk value and scheduling correction factor. For subsequent devices, the actual risk value is determined by comprehensively considering its own basic risk value, the actual risk value of the upstream device, and its own scheduling correction factor. The output module is used to calculate the overall failure probability of the scheduling chain based on the actual risk value of all devices on the scheduling chain, and output a warning message containing the identifier of the risk source device when the overall failure probability exceeds a preset threshold.

[0060] In one embodiment, the acquisition module includes: The data acquisition unit is used to acquire the set of basic operating indicators of each device in the scheduling chain in the most recent data acquisition period through the platform monitoring interface according to a preset data acquisition period. The set of basic operating indicators is set with corresponding differentiated indicators according to the device type. The processing unit is used to normalize each basic operating indicator, so that the values ​​of each indicator are unified within a preset standard range. The comparison unit is used to compare all normalized index values ​​and take the maximum value as the basic risk value of the device. The lower limit of the basic risk value corresponds to the device being completely healthy, and the upper limit corresponds to the device being completely unhealthy.

[0061] This application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described intelligent security integrated management platform full-link risk assessment method.

[0062] This application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method for end-to-end risk assessment of a smart security integrated management platform.

[0063] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in this application and in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0064] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, apparatus, article, or method. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0065] The above description is merely a preferred embodiment of the present invention and does not limit the scope of this application. Any equivalent results or equivalent process transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the scope of protection of this application.

Claims

1. A method for full-link risk assessment of an intelligent security comprehensive management platform, characterized in that, Includes the following steps: The system analyzes the configured linkage scheduling rules in the intelligent security integrated management platform and generates an ordered scheduling chain arranged in the execution order based on the dependency relationship between the event triggering device and the action execution device in the rules. Collect the operational status data of each device in the scheduling chain, and determine the current basic risk value of each device based on the operational status data; Obtain the scheduling execution record of each device within the historical time window, and determine the scheduling correction factor for each device based on the scheduling execution record; The actual risk value of each device is calculated step by step along the scheduling chain from the first device to the last device. For the first device, the actual risk value is calculated based on its basic risk value and scheduling correction factor. For subsequent devices, the actual risk value is determined by comprehensively considering its own basic risk value, the actual risk value of the upstream device, and its own scheduling correction factor. Based on the actual risk values ​​of all devices in the scheduling chain, the overall failure probability of the scheduling chain is calculated. When the overall failure probability exceeds a preset threshold, a warning message containing the identifier of the risk source device is output. 2.The method of claim 1, wherein, The step of generating an ordered scheduling chain arranged in execution order specifically includes: Read the activated linkage scheduling rules from the platform. Each linkage scheduling rule contains at least one trigger condition and one action sequence. For each linkage scheduling rule, the device associated with the triggering condition is taken as the starting node of the scheduling chain, and the devices in the action sequence are added to the scheduling chain in the order of execution to form a node sequence; Based on the signal transmission or control dependencies between nodes, the link type between adjacent nodes is marked, and the node sequence and link markings are stored as a scheduling chain template. 3.The method of claim 1, wherein, The step of determining the current basic risk value of each device based on the operating status data specifically includes: For each device in the scheduling chain, according to a preset collection period, the basic operating indicators of the device in the most recent collection period are obtained through the platform monitoring interface. The basic operating indicators are set with corresponding differentiated indicators according to the device type. Each basic operational indicator is normalized to ensure that the values ​​of each indicator are uniform within a preset standard range. All normalized index values ​​are compared, and the maximum value is taken as the basic risk value of the device. The lower limit of the basic risk value corresponds to the device being completely healthy, and the upper limit corresponds to the device being completely unsuccessful.

4. The full-chain risk assessment method for the intelligent security integrated management platform according to claim 1, characterized in that, The step of determining the scheduling correction factor for each device based on the scheduling execution record specifically includes: From the platform scheduling logs, a preset time window is maintained for each device. At the beginning of each evaluation cycle, the scheduling log records of the device being called by all linkage scheduling rules within the time window are read, and the total number of scheduling, the number of scheduling failures, and the number of slow responses are counted. When the total number of scheduling attempts is 0, the scheduling correction factor is set to zero. When the total number of scheduling attempts is greater than 0, the scheduling health score is calculated based on the numerical relationship between the total number of scheduling attempts, the number of scheduling failures, and the number of slow responses. The scheduling health score is used to characterize the quality of the equipment's historical scheduling execution. According to the preset segmented mapping rules, based on the numerical range of the scheduling health, a corresponding scheduling correction factor is assigned to the device. The value of the scheduling correction factor is negatively correlated with the scheduling health and is used to characterize the degree to which the device's historical scheduling performance amplifies the current risk level.

5. The full-chain risk assessment method for the intelligent security integrated management platform according to claim 1, characterized in that, The step of calculating the actual risk value of each device level by level along the scheduling chain from the first device to the last device specifically includes: Obtain the generated sequence of scheduling chain nodes and the basic risk value and scheduling correction factor for each node; For the first device in the scheduling chain, its basic risk value is multiplied by an amplification factor to obtain the actual risk value. The amplification factor is equal to 1 plus the scheduling correction factor of the device. For each subsequent device in the scheduling chain, first obtain the actual risk value of the upstream device, multiply the value by its own amplification factor to obtain a candidate risk value, then compare the candidate risk value with its own basic risk value, and take the larger value of the two as the actual risk value of the device.

6. The full-chain risk assessment method for the intelligent security integrated management platform according to claim 1, characterized in that, The step of outputting warning information containing the identifier of the risk source device specifically includes: Obtain the actual risk value of each device in the scheduling chain; The scheduling chain is regarded as a series system. According to the failure probability model of a series system, the overall failure probability of the entire scheduling chain is calculated based on the actual risk value of each device. The overall failure probability is used to characterize the possibility of the linkage scheduling rule failing to be executed. The calculated overall failure probability is compared with a preset alarm threshold, and an alarm is triggered when the overall failure probability reaches or exceeds the threshold. When an early warning is triggered, the device with the highest actual risk value is identified from the scheduling chain as the risk source device, and a structured early warning message containing the linkage scheduling rule identifier, the overall failure probability value, and the risk source device identifier is generated. The structured early warning information is pushed to the alarm interface of the smart security integrated management platform, and the location information of the risk source device is marked.

7. A full-chain risk assessment system for a smart security integrated management platform, characterized in that, include: The parsing module is used to parse the linkage scheduling rules configured in the smart security integrated management platform, and generate an ordered scheduling chain arranged in the execution order based on the dependency relationship between the event triggering device and the action execution device in the rule; The data acquisition module is used to collect the operating status data of each device in the scheduling chain and determine the current basic risk value of each device based on the operating status data. The acquisition module is used to acquire the scheduling execution records of each device within a historical time window, and determine the scheduling correction factor for each device based on the scheduling execution records; The calculation module is used to calculate the actual risk value of each device level by level along the scheduling chain from the first device to the last device. For the first device, the actual risk value is calculated based on its basic risk value and scheduling correction factor. For subsequent devices, the actual risk value is determined by comprehensively considering its own basic risk value, the actual risk value of the upstream device, and its own scheduling correction factor. The output module is used to calculate the overall failure probability of the scheduling chain based on the actual risk value of all devices on the scheduling chain, and output a warning message containing the identifier of the risk source device when the overall failure probability exceeds a preset threshold.

8. The end-to-end risk assessment system for the intelligent security integrated management platform according to claim 7, characterized in that, The acquisition module includes: The data acquisition unit is used to acquire the set of basic operating indicators of each device in the scheduling chain in the most recent data acquisition period through the platform monitoring interface according to a preset data acquisition period. The set of basic operating indicators is set with corresponding differentiated indicators according to the device type. The processing unit is used to normalize each basic operating indicator, so that the values ​​of each indicator are unified within a preset standard range. The comparison unit is used to compare all normalized index values ​​and take the maximum value as the basic risk value of the device. The lower limit of the basic risk value corresponds to the device being completely healthy, and the upper limit corresponds to the device being completely unhealthy.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images