An unsupervised abnormal event risk assessment method and system for smart city

Abstract

The present application relates to the technical field of smart city, and particularly relates to a method and system for unsupervised abnormal event risk assessment of smart city. The present application constructs a city-wide dynamic space-time propagation topology with propagation resistance attribute based on abnormal space diffusion attenuation law, performs space-time topology constraint on sample clusters based on the space-time topology structure, and recursively constructs propagation constraint isolation forest based on the bisection rule of maximum interface constraint of propagation resistance, so as to fully consider the space-time correlation, effectively improve the identification ability of multi-dimensional space-time anomaly, divide the space-time propagation connected domain and construct the training set of the associated sample cluster of the propagation constraint, so that the training set can reflect the space-time correlation between nodes in the smart city, significantly improve the accuracy of risk assessment, and based on the comprehensive evaluation mechanism of cluster-level space-time correlation anomaly degree and node-level local deviation degree, the abnormal events across nodes can be more accurately identified and located, the missed detection rate is reduced, and the detection ability of abnormal events is improved.

Description

Technical Field

[0001] This invention relates to the field of smart city technology, and in particular to a method and system for unsupervised anomaly risk assessment in smart cities. Background Technology

[0002] Unsupervised anomalies in smart city scenarios refer to events that significantly deviate from the established normal operating rules, behavioral patterns, or data distribution in multi-source heterogeneous data collected from the smart city's full-domain perception system (such as video surveillance, IoT sensors, traffic checkpoints, etc.), possess potential security risks and social harms, and cannot be identified through supervised learning paradigms due to extremely scarce samples, inexhaustible patterns, and extremely high annotation costs.

[0003] Current technologies primarily utilize the Isolation Forest algorithm for risk assessment of unsupervised anomalies in smart cities. This involves constructing multiple isolated trees based on samples of normal city operations, randomly selecting feature dimensions and split values ​​to bipartitely divide the sample space until each sample is isolated. The average path length of the sample under assessment is calculated; shorter paths indicate lower isolation difficulty and higher anomaly probability. Finally, a standardized anomaly score is calculated to quantify the risk level, thus completing the unsupervised anomaly risk assessment. However, since the core risks of smart cities are often spatiotemporally correlated anomalies across nodes and dimensions (such as synchronous abnormal clustering of people in multiple areas or pipeline leaks linked by multiple sensors), the Isolation Forest algorithm, based on random feature partitioning, cannot effectively capture the spatiotemporal relationships between features, resulting in a very high false negative rate for aggregate anomalies and contextual anomalies. Summary of the Invention

[0004] The main objective of this invention is to provide an unsupervised risk assessment method for abnormal events in smart cities, aiming to solve the technical problems in the prior art.

[0005] This invention proposes an unsupervised anomaly event risk assessment method for smart cities, comprising: The time-series sensing data, geospatial data, and system affiliation data of the smart city's full-domain sensing terminals are acquired to construct a dynamic spatiotemporal propagation topology map of the entire city with propagation resistance attributes based on the abnormal spatial diffusion attenuation law. The city-wide dynamic spatiotemporal propagation topology map is divided into multiple spatiotemporal propagation connected domains according to propagation reachability, and a training set of related sample clusters for propagation constraints is constructed based on the temporal sensing data in each spatiotemporal propagation connected domain. A propagation constraint isolation forest is constructed based on the training set of the associated sample clusters, wherein the isolated trees of the propagation constraint isolation forest are recursively constructed based on the binary partitioning rule of the maximum propagation resistance interface constraint. Acquire the real-time global perception data to be evaluated, and convert the real-time global perception data to be evaluated into a sample cluster to be evaluated based on the city-wide dynamic spatiotemporal propagation topology map and spatiotemporal propagation connected components. The average isolation path length of the sample clusters to be evaluated is obtained based on the propagation constraint isolation forest, and the corresponding cluster-level spatiotemporal correlation anomaly degree is obtained based on the average isolation path length. Based on the cluster-level spatiotemporal correlation anomaly degree and the sample cluster to be evaluated, the corresponding node-level local deviation degree is obtained, and the risk classification assessment and location of unsupervised abnormal events in smart cities are completed based on the cluster-level spatiotemporal correlation anomaly degree and the node-level local deviation degree.

[0006] This application also provides an unsupervised anomaly risk assessment system for smart cities, including: The first construction module is used to acquire the time-series sensing data, geospatial data and system affiliation data of the smart city's full-domain sensing terminals to construct a dynamic spatiotemporal propagation topology map of the city with propagation resistance attributes based on the abnormal spatial diffusion attenuation law. The second construction module is used to divide the city-wide dynamic spatiotemporal propagation topology map into multiple spatiotemporal propagation connected domains according to propagation reachability, and to construct a training set of related sample clusters of propagation constraints based on the temporal sensing data in each spatiotemporal propagation connected domain. The third construction module is used to construct a propagation constraint isolation forest based on the training set of the associated sample clusters, wherein the isolated trees of the propagation constraint isolation forest are recursively constructed based on the binary partitioning rule of the maximum propagation resistance interface constraint. The conversion module is used to acquire the real-time global perception data to be evaluated, and convert the real-time global perception data to be evaluated into a sample cluster to be evaluated based on the city's dynamic spatiotemporal propagation topology map and spatiotemporal propagation connected components. The acquisition module is used to obtain the average isolation path length of the sample clusters to be evaluated based on the propagation constraint isolation forest, and to obtain the corresponding cluster-level spatiotemporal correlation anomaly degree based on the average isolation path length. The assessment and positioning module is used to obtain the corresponding node-level local deviation based on the cluster-level spatiotemporal correlation anomaly degree and the sample cluster to be assessed, and to complete the risk classification assessment and positioning of unsupervised abnormal events in smart cities based on the cluster-level spatiotemporal correlation anomaly degree and the node-level local deviation degree.

[0007] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method for unsupervised anomaly risk assessment for smart cities.

[0008] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method for unsupervised anomaly risk assessment for smart cities.

[0009] The beneficial effects of this invention are as follows: Targeting the characteristics of cross-node and cross-dimensional anomaly detection, this invention constructs a dynamic spatiotemporal propagation topology map of the entire city with propagation resistance attributes based on the anomaly spatial diffusion attenuation law. Spatiotemporal topological constraints are applied to sample clusters based on the spatiotemporal topology structure, thereby fully considering spatiotemporal correlations, enhancing the contextual information of anomaly detection, and effectively improving the ability to identify multi-dimensional spatiotemporal anomalies. Furthermore, a propagation constraint isolation forest is recursively constructed based on the bipartition rule of the maximum propagation resistance interface constraint. By introducing the bipartition rule of the maximum propagation resistance interface constraint, the problem of excessive reliance on feature independence in traditional isolated forest methods is solved, making anomaly detection more consistent with the real-world scenarios of urban operations. By dividing the spatiotemporal propagation connected domain and constructing a training set of related sample clusters with propagation constraints, the training set can reflect the spatiotemporal correlations between nodes in a smart city, significantly improving the accuracy of risk assessment. Based on a comprehensive evaluation mechanism of cluster-level spatiotemporal correlation anomaly degree and node-level local deviation degree, cross-node anomaly events can be identified and located more accurately, reducing the false negative rate and improving the detection capability of anomaly events. Attached Figure Description

[0010] Figure 1 This is a schematic diagram of a method flow according to an embodiment of the present invention.

[0011] Figure 2 This is a schematic diagram of the system structure according to an embodiment of the present invention.

[0012] Figure 3 This is a schematic diagram of the internal structure of a computer device according to an embodiment of this application.

[0013] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0014] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0015] like Figure 1 As shown, this application provides a method for unsupervised anomaly event risk assessment in smart cities, including: S1. Obtain the time-series sensing data, geospatial data, and system attribution data of the smart city's full-domain sensing terminal, and construct a dynamic spatiotemporal propagation topology map of the entire city with propagation resistance attributes based on the abnormal spatial diffusion attenuation law according to the time-series sensing data, geospatial data, and system attribution data. S2. Divide the city-wide dynamic spatiotemporal propagation topology map into multiple spatiotemporal propagation connected domains according to propagation reachability, and construct a training set of related sample clusters of propagation constraints based on the temporal sensing data in each spatiotemporal propagation connected domain. S3. Construct a propagation constraint isolation forest based on the training set of the associated sample clusters, wherein the isolated trees of the propagation constraint isolation forest are recursively constructed based on the binary partitioning rule of the interface constraint with the maximum propagation resistance. S4. Obtain the real-time global perception data to be evaluated, and convert the real-time global perception data to be evaluated into a sample cluster to be evaluated based on the city-wide dynamic spatiotemporal propagation topology map and spatiotemporal propagation connected domain. S5. Obtain the average isolation path length of the sample clusters to be evaluated based on the propagation constraint isolation forest, and obtain the corresponding cluster-level spatiotemporal correlation anomaly degree based on the average isolation path length; S6. Obtain the corresponding node-level local deviation based on the cluster-level spatiotemporal correlation anomaly degree and the sample cluster to be evaluated, and complete the risk classification assessment and location of unsupervised abnormal events in smart cities based on the cluster-level spatiotemporal correlation anomaly degree and the node-level local deviation degree.

[0016] As described in steps S1-S6 above, this invention acquires temporal sensing data, geospatial data, and system attribution data from smart city-wide sensing terminals to construct a dynamic spatiotemporal propagation topology map of the entire city with propagation resistance attributes based on the anomaly spatial diffusion attenuation law. This maps the originally isolated single-node sensing data into a unified spatiotemporal topology structure, achieving the fusion of spatial, temporal, and system attribution data. This explicitly reflects the spatiotemporal dependencies between nodes, enabling subsequent anomaly detection to capture spatiotemporal correlation anomalies across nodes and regions. By dividing the dynamic spatiotemporal propagation topology map of the entire city into multiple spatiotemporal propagation connected domains according to propagation reachability, and constructing propagation constraints within each connected domain based on temporal sensing data... The linked sample cluster training set can combine nodes and their features with spatiotemporal correlation into a whole unit for analysis. This allows the isolated forest to no longer rely on random feature independent partitioning during training. Instead, it can learn potential synchronous or linkage anomaly patterns between nodes based on spatiotemporal topological constraints, thereby significantly reducing the false negative rate of set anomalies and cross-dimensional anomalies. By constructing a propagation constraint isolated forest on the basis of the linked sample cluster training set, the topological structure of the spatiotemporal propagation connected domain and the spatiotemporal correlation between nodes can be embedded into the splitting logic of the tree while maintaining the efficiency of the isolated forest. This ensures that the spatial proximity, system affiliation and temporal correlation between nodes are considered during the anomaly event detection process, and enhances the model's sensitivity to cross-node, cross-region and cross-dimensional anomalies. By acquiring real-time, full-domain perception data and converting it into sample clusters to be evaluated based on the city-wide dynamic spatiotemporal propagation topology and spatiotemporal propagation connected domains, the multi-source information of the nodes to be evaluated under actual operating conditions can be mapped to a unified spatiotemporal topology. By maintaining consistency between the training and evaluation phases, the isolated forest can accurately match the spatiotemporal association patterns learned during training, thereby effectively capturing multi-node linkage anomaly events in real-time anomaly detection and avoiding missed detections caused by random independent feature partitioning. By obtaining the average isolation path length of the sample clusters to be evaluated through propagation constraint isolation forest and calculating the cluster-level spatiotemporal association anomaly degree, the degree of anomaly within the entire spatiotemporal propagation connected domain can be quantified. Anomaly degree not only considers the deviation of single-node features, but also embeds the spatiotemporal topological relationship between nodes, thereby realizing cross-node and cross-dimensional anomaly perception and improving the ability to identify aggregate anomalies and contextual anomalies. By combining cluster-level spatiotemporal correlation anomaly degree with the node-level local deviation degree calculated by the cluster of samples to be evaluated, the core anomaly nodes and anomaly feature dimensions can be further refined to achieve hierarchical analysis from overall cluster-level anomalies to single-node anomalies. By combining node-level deviation degree with spatiotemporal topological correlation, the model can reveal the specific source and propagation path of anomalies, solving the problem that existing methods lack accurate localization ability in complex spatiotemporal anomaly events. At the same time, it provides a scientific basis for risk classification and enhances the operability and accuracy of unsupervised anomaly event assessment.

[0017] In one embodiment, step S1, which involves acquiring temporal sensing data, geospatial data, and system affiliation data from smart city-wide sensing terminals to construct a dynamic spatiotemporal propagation topology map of the entire city with propagation resistance attributes based on anomaly spatial diffusion attenuation laws, includes: S11. Obtain the spatial coordinates and geographic barrier factor of each sensing terminal based on the geospatial data, and obtain the system affiliation level and cross-system interaction impedance coefficient of each sensing terminal based on the system affiliation data. S12. Obtain the normalized Euclidean spatial distance between adjacent sensing terminals based on the spatial coordinates, and obtain the corresponding spatial barrier attenuation coefficient based on the geographical barrier factor. Obtain the spatial propagation resistance component between adjacent sensing terminals based on the normalized Euclidean spatial distance and the spatial barrier attenuation coefficient. Obtain the system hierarchy difference and same-system affiliation identifier between terminals based on the system membership level. Obtain the corresponding cross-domain impedance reference value based on the cross-system interaction impedance coefficient. Obtain the cross-terminal system propagation resistance component based on the system hierarchy difference, same-system affiliation identifier and cross-domain impedance reference value. S13. Extract the temporal evolution rate of abnormal events based on the temporal sensing data, and calculate the comprehensive propagation resistance value between adjacent nodes based on the spatial propagation resistance component, the system propagation resistance component, and the temporal evolution rate of abnormal events, wherein the calculation formula is: ; in, This represents the combined propagation resistance value between adjacent nodes. Represents the component of spatial propagation resistance. This represents the propagation drag component of the system. Indicates the temporal evolution rate of abnormal events. This represents the synergistic enhancement factor, used to reflect the coupling gain between spatial barrier and system impedance driven by temporal evolution. Indicates the weight of spatial propagation resistance. Indicates the system propagation resistance weight; S14. Construct an initial static propagation topology graph with each sensing terminal as a topology node and the corresponding comprehensive propagation resistance value as the connecting edge. Then, dynamically adjust the comprehensive propagation resistance value of each connecting edge in the initial static propagation topology graph according to the real-time updated temporal sensing data to obtain a dynamic spatiotemporal propagation topology graph of the entire city with propagation resistance attributes.

[0018] As described in steps S11-S14 above, this invention improves the ability to identify the spatial distribution characteristics of sensing terminals by combining geospatial data and system affiliation data to obtain the spatial coordinates and geographical barrier factors of each sensing terminal. This allows for the quantitative assessment of geographical obstacles in the urban environment. By introducing the concept of geographical barrier factors, the system can truly reflect the physical limitations in urban airspace, thus providing more accurate location-based parameters for anomaly risk assessment. The spatial propagation resistance component between sensing terminals is obtained by calculating the normalized Euclidean spatial distance and spatial barrier attenuation coefficient between adjacent sensing terminals. The system propagation resistance component is obtained by using the system membership level and cross-system interaction impedance coefficient. This enables in-depth analysis of complex interactions between regions and systems, allowing the system to effectively cope with multi-dimensional anomalies. Compared with the shortcomings of the isolated forest algorithm in independently evaluating samples, the mechanism of this invention can effectively integrate the joint effects between sensors, thereby reducing the false negative rate and improving the ability to capture multi-dimensional anomalies. This allows the system to more accurately analyze and predict the risk of anomalies in cross-node interactions. By combining spatial propagation resistance components, system propagation resistance components, and the temporal evolution rate of abnormal events, and based on the calculation of comprehensive propagation resistance values, the analytical capability of spatiotemporal propagation characteristics across the entire city is effectively improved. This allows for a deeper understanding of the dynamic relationships between events and their environments at different times, enabling the system to go beyond static feature assessment. Utilizing synergistic enhancement coefficients, it can provide a more accurate and flexible risk assessment model for abnormal events in urban environments. By treating each sensing terminal as a topology node and constructing an initial static propagation topology based on comprehensive propagation resistance values, and then dynamically adjusting the comprehensive propagation resistance values ​​of the edges in this topology using temporal sensing data, a dynamic urban-wide propagation model is established. This model accurately reflects the propagation path and intensity of sudden events in the city, forming a timely and adaptive dynamic assessment system. This enhances the system's responsiveness to timeliness and environmental changes, effectively solving the problem of real-time monitoring and assessment of cross-node, cross-dimensional abnormal events in complex urban environments.

[0019] In one embodiment, step S2, which involves dividing the city-wide dynamic spatiotemporal propagation topology map into multiple spatiotemporal propagation connected domains according to propagation reachability, and constructing a training set of related sample clusters for propagation constraints based on the temporal sensing data within each spatiotemporal propagation connected domain, includes: S21. Obtain the set of topological nodes and the set of connecting edges based on the dynamic spatiotemporal propagation topology map of the entire city, and obtain the propagation activity coefficient of the corresponding topological node based on the time-series sensing data corresponding to each topological node in the set of topological nodes. S22. Obtain the propagation reachability coefficient of the corresponding edge based on the comprehensive propagation resistance value of each edge in the dynamic spatiotemporal propagation topology map of the entire city and the propagation activity coefficient of the nodes at both ends of the corresponding edge. S2,3. Based on the propagation reachability coefficient and the preset reachability threshold, filter the set of edges, remove the edges whose propagation reachability coefficient is lower than the preset reachability threshold, and obtain the propagation reachability subgraph. Extract the maximal connected components from the propagation reachability subgraph, and determine each maximal connected subgraph as a spatiotemporal propagation connected domain, thereby obtaining multiple spatiotemporal propagation connected domains. S24. Obtain the node identifiers of all nodes within each of the spatiotemporal propagation connected domains, and extract the multidimensional sensing feature sequence of each node within a preset time window from the time-series sensing data based on each node identifier. S25. Obtain the temporal statistical feature vector of the corresponding node according to each of the multidimensional sensing feature sequences, and construct the sensing feature matrix of the corresponding spatiotemporal propagation connected domain according to the temporal statistical feature vector; S26. Obtain the graph distance between nodes in each of the spatiotemporal propagation connected domains, and generate a spatial constraint matrix based on the graph distance, wherein the graph distance is obtained based on the shortest path length between nodes in the pruned topology graph; S27. Using the perceptual feature matrix as input and the spatial constraint matrix as topological regularization constraint, a restricted clustering algorithm is used to cluster the nodes in the spatiotemporal propagation connected domain to obtain multiple internal sample clusters. S28. Merge multiple internal sample clusters and use the spatiotemporal propagation connected component identifier of each internal sample cluster as a cluster label to form a training set of associated sample clusters with spatiotemporal topological constraints.

[0020] As described in steps S21-S28 above, this invention obtains the set of topological nodes and the set of edges in the dynamic spatiotemporal propagation topology map of the entire city, and calculates the propagation activity coefficient of each node using time-series sensing data. This makes it possible to quantify the spatiotemporal activity of different areas in the city, which helps to identify key nodes and thus better understand urban dynamics and its changes. By obtaining the propagation reachability coefficient, which integrates the propagation activity of the nodes at both ends of the edge, the model can more accurately reflect the association and interaction between nodes, enhancing the understanding of spatiotemporal propagation characteristics. By effectively quantifying propagation reachability, more accurate basic data is provided for subsequent anomaly detection. By filtering the propagation reachability coefficient, removing edges below the preset reachability threshold and extracting the maximum connected components, it ensures that only spatiotemporal propagation connected domains with high correlation are retained, which can significantly reduce noise and invalid data, thereby improving the effectiveness of the model. By extracting multidimensional feature sequences of time-series sensing data from node identifiers within each spatiotemporal propagation connected domain, the temporal evolution of nodes can be accurately captured, providing a comprehensive spatiotemporal feature description for each node. This ensures a deep understanding of node dynamic behavior, enabling the effective capture of dynamic anomalies that change over time. By converting the statistical feature vectors of time-series sensing data into sensing feature matrices of spatiotemporal propagation connected domains, structured input data is provided for subsequent clustering and analysis. This systematically organizes and characterizes node features within each spatiotemporal propagation connected domain, enhancing data consistency and comparability during anomaly detection. The feature matrix can better reflect the correlation characteristics of multi-dimensional, cross-temporal and spatial nodes, thus enabling subsequent clustering and anomaly assessment to be jointly analyzed at a higher level, effectively improving the comprehensiveness and accuracy of anomaly detection. By obtaining the graph distance between nodes in the spatiotemporal propagation connected domain and generating a spatial constraint matrix based on the shortest path length between nodes in the pruned topology graph, the role of spatial adjacency and inter-system relationships in anomaly detection is further strengthened. The spatial constraint matrix makes the relative position and spatiotemporal adjacency of each node explicitly included in the anomaly detection framework, thereby overcoming the problem that the isolated forest algorithm cannot effectively handle spatial and temporal linkage. By using the perceptual feature matrix and spatial constraint matrix as input, a restricted clustering algorithm is used to cluster nodes within the spatiotemporal propagation connected domain. By introducing spatiotemporal topological constraints into the clustering process, it is ensured that the clustering results not only consider the feature similarity of nodes but also integrate the constraints between space and the system. Restricted clustering can accurately segment anomaly clusters with similar spatiotemporal features based on spatiotemporal structure, thereby improving the recognition accuracy of cross-dimensional and cross-node anomalies. By merging multiple internal sample clusters and labeling them with spatiotemporal propagation connected domain labels, a training set of associated sample clusters with spatiotemporal topological constraints is generated, providing high-quality training data for subsequent anomaly recognition. By merging sample clusters with similar spatiotemporal features, the representativeness and accuracy of the training set can be effectively improved, avoiding the problem of training samples lacking spatiotemporal structured features in the isolated forest algorithm, and ensuring that the anomaly detection model has better generalization ability in the context of complex spatiotemporal relationships.

[0021] In one embodiment, step S3, which involves constructing a propagation-constrained isolation forest based on the training set of the associated sample clusters, includes: S31. Based on the training set of the associated sample cluster, obtain the spatiotemporal feature vector of the sample, the comprehensive propagation resistance value of the binding edges of each sample, and the preset maximum propagation resistance interface constraint threshold. Based on the spatiotemporal feature vector of the sample, obtain the dispersion of each feature dimension to filter the candidate partitioning dimension of the maximum propagation resistance interface in combination with the comprehensive propagation resistance value. S32. Perform recursive binary partitioning on the training set of the associated sample clusters according to the preset maximum propagation resistance interface constraint threshold, the candidate partitioning dimension of the maximum propagation resistance interface, and the binary partitioning rule of the maximum propagation resistance interface constraint to obtain a single isolated tree. The binary partitioning rule of the maximum propagation resistance interface constraint limits the partitioning surface to the feature interface with the maximum mean comprehensive propagation resistance in the training set of the associated sample clusters, and the difference in comprehensive propagation resistance between the two types of sub-samples across the interface after partitioning is not lower than the propagation resistance interface partitioning threshold. S33. Obtain the sample isolation path and topological constraint label for each isolated tree, and obtain the average isolation path length and average topological association strength according to the sample isolation path and topological constraint label respectively. Calculate the confidence score of the isolated tree based on the average isolation path length and average topological association strength, wherein the calculation formula is: ; in, Indicates the confidence level of the isolated tree. Indicates the average isolation path length. Indicates the average strength of topological association. Indicates the preset path coefficient. Indicates the preset topological correlation coefficient. This represents the preset co-enhancement coefficient, used to enhance the spatiotemporal and topological coupling gain; S34. Combine and integrate multiple isolated trees with confidence scores for each isolated tree to generate a spatiotemporal topological isolated forest.

[0022] As described in steps S31-S34 above, this invention obtains the spatiotemporal feature vectors of samples, the comprehensive propagation resistance value, and the set maximum propagation resistance interface constraint threshold. Through spatiotemporal feature vector analysis, it can effectively capture the spatiotemporal correlation between samples. Unlike the traditional isolated forest model, which relies solely on the independent partitioning of random features, this invention selects the most suitable candidate dimension for partitioning by combining the propagation resistance value and the dispersion of feature dimensions. This solves the dilemma that traditional models cannot identify spatiotemporal correlation anomalies, thereby reducing the false negative rate and making it more accurate in detecting anomalies across regions and nodes. By introducing a binary partitioning rule with the maximum propagation resistance interface constraint, this rule ensures that the average comprehensive propagation resistance value can be maximized when partitioning samples. Unlike the purely random partitioning of conventional isolated forests, the constraint rule in this step ensures the effectiveness and accuracy of the partitioning, and can better capture the mutual influence and spatiotemporal variation characteristics between samples. This effectively improves the model's ability to detect anomalies in complex urban environments and enhances the sensitivity and accuracy of anomaly detection. By acquiring the sample isolation paths and topological constraint labels of each isolated tree, the average isolation path length and average topological association strength are calculated. Furthermore, the confidence of a single isolated tree is calculated using a collaborative enhancement formula. This achieves the quantification of coupling gain between spatiotemporal features and topological structure. It can not only assess the isolation difficulty of samples but also comprehensively consider their correlation in spatiotemporal topology. This makes the response of each isolated tree to cross-node and cross-dimensional anomalies more accurate, thereby significantly reducing the false negative rate of set anomalies and context anomalies. By integrating multiple single isolated trees with confidence scores to form a propagation constraint isolation forest, it not only integrates the isolation capabilities of each tree but also integrates the topological constraint confidence scores of each tree. This allows the entire model to comprehensively reflect the spatiotemporal features and topological dependencies of the samples. This strengthens the ability to identify cross-node and cross-dimensional anomalies at the integration level, enabling the smart city risk assessment system to accurately capture multi-regional synchronous anomalies and multi-sensor linkage anomalies, achieving high accuracy and robustness in unsupervised anomaly risk assessment.

[0023] In one embodiment, step S4, which converts the real-time global sensing data to be evaluated into a sample cluster to be evaluated based on the city-wide dynamic spatiotemporal propagation topology map and spatiotemporal propagation connected components, includes: S41. Extract the real-time sensing feature vector of each sensing terminal at each sampling time based on the real-time global sensing data. S42. Obtain the mapping relationship between the topology graph nodes and the sensing terminals in the dynamic spatiotemporal propagation topology graph of the entire city, and associate each real-time sensing feature vector with the corresponding topology graph node according to the node member list of each spatiotemporal propagation connected domain based on the mapping relationship, so as to obtain the corresponding real-time node feature set. S43. Construct a corresponding real-time perception feature matrix based on the feature set of each real-time node, and obtain the real-time feature mean vector of each node in the corresponding spatiotemporal propagation connected domain based on each real-time perception feature matrix, as the domain centroid feature. S44. Obtain the cluster centroid features of each sample cluster in the training set of the associated sample clusters, and calculate the spatiotemporal alignment similarity between each cluster centroid feature and the domain centroid feature, wherein the calculation formula is: ; in, Indicates spatiotemporal alignment similarity. Indicates the first The domain centroid eigenvectors of a spatiotemporally propagating connected domain. Indicates the first training set The cluster centroid feature vector of each sample cluster, This represents the preset topology attenuation coefficient. This represents the shortest path length between the graph center node of the spatiotemporal propagation connected domain in the dynamic spatiotemporal propagation topology graph of the entire city and the graph center node of the training spatiotemporal propagation connected domain associated with the sample cluster; S45. Select the sample cluster that best matches the spatiotemporal alignment similarity as the belonging cluster, and jointly encode the feature vectors of all real-time nodes in the spatiotemporal propagation connected domain with the cluster member features of the belonging cluster to generate a sample cluster to be evaluated that integrates the topological association of the global perception dynamic spatiotemporal ontology and the spatiotemporal propagation connected domain constraints.

[0024] As described in steps S41-S45 above, the joint encoding step is as follows: obtain real-time feature components and real-time feature magnitudes based on real-time node feature vectors; obtain cluster center feature vectors and intra-cluster feature dispersion based on cluster member features of the belonging cluster; obtain feature adaptation coefficients based on real-time feature components, real-time feature magnitudes, cluster center feature vectors, and intra-cluster feature dispersion; obtain topological association weights between real-time nodes and belonging clusters based on the city-wide dynamic spatiotemporal propagation topology map; and perform topological constraint weighted fusion encoding on real-time node feature vectors and belonging cluster member features based on feature adaptation coefficients and topological association weights to generate sample clusters to be evaluated. This invention achieves comprehensive acquisition and standardization of sensing data by extracting real-time sensing feature vectors from each sensing terminal at each sampling time. Extracting feature vectors at each sampling time ensures the temporal sequence and dynamic spatiotemporal changes of the data, laying the foundation for subsequent spatiotemporal correlation modeling. By obtaining the mapping relationship between topological nodes and sensing terminals in the dynamic spatiotemporal propagation topology map of the entire city, each real-time sensing feature vector is associated with a corresponding topology map node based on the mapping relationship. By introducing the node structure of the topology map, the sensing data is explicitly coupled with the spatiotemporal topology, thereby realizing the spatial correlation of sensing data across the entire city. Layout mapping can directly reflect the spatiotemporal relationship between each sensing terminal and other nodes. By constructing a real-time sensing feature matrix based on the real-time node feature set, the mean vector of real-time features of each node in the spatiotemporal propagation connectivity domain is further calculated. By calculating the centroid features of the spatiotemporal domain, the spatiotemporal information of urban sensing data is effectively abstracted and summarized, representing the overall spatiotemporal characteristics of nodes in the entire domain. Through spatiotemporal aggregation and simplification, the low detection rate of spatiotemporal anomalies in isolated forests is overcome, and the ability to identify regional and synchronous anomalies is improved, providing a more accurate and comprehensive assessment basis for the risk assessment of spatiotemporal anomalies in smart cities. By calculating the spatiotemporal alignment similarity between the domain centroid features of each spatiotemporally propagated connected domain and the cluster centroid features of the training set sample clusters, the classification and matching of samples are further optimized. By introducing the topological decay coefficient and the shortest path calculation formula, the topological structure of the topological graph is taken into account. This ensures that the calculation of spatiotemporal alignment similarity not only depends on the similarity between feature vectors but also incorporates the connections of the spatiotemporal topological structure, thereby enhancing the ability to identify complex spatiotemporal relationships. This avoids the problem of neglecting spatiotemporal relationships caused by random splitting of feature dimensions in traditional isolated forest algorithms, ensuring the model's efficiency and effectiveness when facing multi-dimensional spatiotemporal anomalies. Accuracy is improved by selecting the sample clusters with the best spatiotemporal alignment similarity and jointly encoding the real-time node feature vectors and cluster member features within the spatiotemporal propagation connected domain. This generates a sample cluster to be evaluated that integrates the topological association of the dynamic spatiotemporal ontology with global perception and the constraints of the spatiotemporal propagation connected domain. By organically combining the topological constraints of spatiotemporal data with the semantic association of features, the model's ability to identify spatiotemporal anomalies is greatly improved. It can accurately capture spatiotemporal correlation anomalies such as synchronous abnormal aggregation of people in multiple areas and pipeline leakage linked by multiple sensors in smart cities, which are cross-node and cross-dimensional, and significantly improve the accuracy of risk assessment of unsupervised anomalies.

[0025] In one embodiment, step S5, which involves obtaining the average isolation path length of the sample clusters to be evaluated based on the propagation constraint isolation forest and obtaining the corresponding cluster-level spatiotemporal correlation anomaly degree based on the average isolation path length, includes: S51. Obtain the single-tree isolation path length of each node in the sample cluster based on the sample cluster to be evaluated and the single isolated tree in the propagation constraint isolation forest, and obtain the average path length of the single-tree cluster based on the single-tree isolation path length. S52. Obtain the comprehensive spatiotemporal coupling strength between each node in the spatiotemporal propagation connected domain, and obtain the intra-cluster spatiotemporal coupling density of the sample cluster to be evaluated based on the comprehensive spatiotemporal coupling strength, wherein the intra-cluster spatiotemporal coupling density is the ratio of the sum of the comprehensive spatiotemporal coupling strength of all node pairs in the sample cluster to be evaluated to the number of node pairs. S53. Calculate the cluster-level spatiotemporal correlation anomaly degree of the sample cluster to be evaluated based on the average isolation path length and intra-cluster spatiotemporal coupling density, wherein the calculation formula is: ; in, Indicates the degree of spatiotemporal correlation anomaly at the cluster level. Indicates the average isolation path length. This represents the spatiotemporal coupling density within the cluster.

[0026] As described in steps S51-S53 above, the step of obtaining the isolation path length of a single tree is to input the sample cluster to be evaluated into each isolated tree in the propagation constraint isolation forest, starting from the root node, and recursively descending along the bisection path of the interface constraint with the maximum propagation resistance of the isolated tree according to the comparison result of the value of each node in the corresponding feature dimension and the node partitioning threshold, until it falls into a leaf node, and obtain the path length from the leaf node to the root node, thus obtaining the isolation path length of a single tree. This invention achieves a deep understanding of the internal structure of the sample cluster by accurately calculating the isolation path length of each node based on the sample cluster to be evaluated and the isolated trees in the propagation constraint isolation forest, and obtaining the average path length of the cluster through aggregation. By applying spatiotemporal topology, the spatiotemporal correlation between nodes is considered during calculation, thereby effectively reducing the probability of the isolated forest algorithm missing spatiotemporal anomalies. The invention also calculates the comprehensive spatiotemporal coupling strength between nodes within the spatiotemporal propagation connectivity domain and obtains the intra-cluster spatiotemporal coupling density of the sample cluster to be evaluated. By introducing spatiotemporal coupling strength and intra-cluster spatiotemporal coupling density, the spatiotemporal relationships between nodes are effectively addressed. By incorporating the relationship into the algorithm, the problem of isolated forests being unable to effectively capture multi-dimensional spatiotemporal correlation anomalies is solved. By calculating the spatiotemporal coupling density, the accuracy of the algorithm in identifying cross-regional and cross-sensor joint anomalies is enhanced. It can identify set anomalies and contextual anomalies caused by multi-dimensional factors, significantly reducing the false negative rate. By combining the isolation path length of the propagation constraint isolated forest with the spatiotemporal coupling density, the spatiotemporal correlation structure within the sample cluster can be fully considered, enhancing the detection capability of spatiotemporal correlation anomaly events. It avoids the limitation of isolated forest algorithms based on random feature partitioning and can more accurately identify complex spatiotemporal correlation anomalies such as cross-node and cross-regional anomalies.

[0027] In one embodiment, step S6, which involves obtaining the corresponding node-level local deviation based on the cluster-level spatiotemporal correlation anomaly degree and the sample cluster to be evaluated, and completing the risk classification assessment and location of unsupervised anomaly events in the smart city based on the cluster-level spatiotemporal correlation anomaly degree and the node-level local deviation, includes: S61. Obtain the real-time perceived feature vector of each node in the sample cluster to be evaluated and the mean node feature vector of the corresponding normal cluster in the training set of the associated sample cluster. S62. Obtain the feature deviation norm of the corresponding node based on each real-time perceived feature vector and the node feature mean vector, and obtain the corresponding initial local deviation based on each feature deviation norm; S63. The initial local deviation is weighted and adjusted according to the spatiotemporal correlation anomaly degree of each cluster to obtain the corresponding node-level local deviation, wherein the calculation formula is: ; in, Indicates the first Node-level local deviation of each node Indicates the first Real-time perceived feature vectors of each node Represents a node The mean vector of node features in a normal cluster Indicates the degree of spatiotemporal correlation anomaly at the cluster level; S64. When the cluster-level spatiotemporal correlation anomaly degree is greater than the first preset risk threshold and the node-level local deviation degree of at least one node is greater than the second preset risk threshold, the risk level of the anomaly event is determined to be high risk and the location of the spatiotemporal propagation connectivity domain where the deviating node is located is located. When the cluster-level spatiotemporal correlation anomaly degree is greater than the first preset risk threshold, but the node-level local deviation degree of all nodes is not greater than the second preset risk threshold, the risk level of the anomaly event is determined to be medium risk and the entire spatiotemporal propagation connected domain is marked. When the cluster-level spatiotemporal correlation anomaly degree is not greater than the first preset risk threshold, the risk level of the anomaly event is determined to be low risk.

[0028] As described in steps S61-S64 above, this invention introduces the real-time perceived features of each node and compares them with the mean vector of node features in a normal cluster. This allows for precise capture of behavioral differences among nodes, reflecting the dynamic feature changes of each node. By comparing the feature vectors of each node, the shortcomings of isolated forests in handling cross-node spatiotemporal anomalies are eliminated. The feature deviation norm quantifies the degree of deviation of each node from its normal behavior, providing a refined measure of local anomalies for subsequent risk assessment. When evaluating local deviation, this invention incorporates the spatiotemporal correlation of node features, further enhancing the algorithm's sensitivity to cross-node and cross-regional anomalies in smart cities and improving the overall accuracy of the assessment. By introducing cluster-level spatiotemporal correlation anomalies into the node-level local deviation calculation formula, the global and local correlations can be effectively combined. By combining information from various departments, a comprehensive evaluation of multi-dimensional spatiotemporal information is achieved, thereby more accurately identifying cross-node and cross-regional anomalies. Through weighted adjustments, the correlation between node and cluster-level overall anomalies can be more accurately assessed, reducing the spatiotemporal information loss caused by the random feature segmentation of isolated forests. This further enhances the application effect of the algorithm in smart city environments. By comprehensively considering cluster-level anomaly degree and node-level deviation, multi-level risk classification can be provided for unsupervised anomalies in smart cities, which helps to quickly determine the risk level. Through precise positioning, the source of the anomaly can be further clarified, and high-risk events can be located to specific spatiotemporal propagation connectivity domains, greatly enhancing the traceability of anomalies. Through weighted adjustments to node-level deviation, the performance of the algorithm in cross-node spatiotemporal anomalies is effectively enhanced, and the control of false negative and false positive rates can be significantly improved.

[0029] like Figure 2 As shown, this application also provides an unsupervised anomaly event risk assessment system for smart cities, comprising: The first construction module is used to acquire the time-series sensing data, geospatial data and system affiliation data of the smart city's full-domain sensing terminals to construct a dynamic spatiotemporal propagation topology map of the city with propagation resistance attributes based on the abnormal spatial diffusion attenuation law. The second construction module is used to divide the city-wide dynamic spatiotemporal propagation topology map into multiple spatiotemporal propagation connected domains according to propagation reachability, and to construct a training set of related sample clusters of propagation constraints based on the temporal sensing data in each spatiotemporal propagation connected domain. The third construction module is used to construct a propagation constraint isolation forest based on the training set of the associated sample clusters, wherein the isolated trees of the propagation constraint isolation forest are recursively constructed based on the binary partitioning rule of the maximum propagation resistance interface constraint. The conversion module is used to acquire the real-time global perception data to be evaluated, and convert the real-time global perception data to be evaluated into a sample cluster to be evaluated based on the city's dynamic spatiotemporal propagation topology map and spatiotemporal propagation connected components. The acquisition module is used to obtain the average isolation path length of the sample clusters to be evaluated based on the propagation constraint isolation forest, and to obtain the corresponding cluster-level spatiotemporal correlation anomaly degree based on the average isolation path length. The assessment and positioning module is used to obtain the corresponding node-level local deviation based on the cluster-level spatiotemporal correlation anomaly degree and the sample cluster to be assessed, and to complete the risk classification assessment and positioning of unsupervised abnormal events in smart cities based on the cluster-level spatiotemporal correlation anomaly degree and the node-level local deviation degree.

[0030] It should be noted that each module and unit in the unsupervised anomaly risk assessment system for smart cities corresponds one-to-one with the steps in the unsupervised anomaly risk assessment method for smart cities.

[0031] like Figure 3 As shown, this application also provides a computer device, which can be a server, and its internal structure can be as follows: Figure 3 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores all data required for the process of an unsupervised anomaly risk assessment method for smart cities. The network interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the unsupervised anomaly risk assessment method for smart cities.

[0032] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer equipment on which the present application is applied.

[0033] An embodiment of this application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements any of the above-described unsupervised anomaly risk assessment methods for smart cities.

[0034] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in this application and in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual-speed SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0035] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, apparatus, article, or method. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0036] The above description is merely a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for unsupervised anomaly event risk assessment in smart cities, characterized in that, include: The time-series sensing data, geospatial data, and system affiliation data of the smart city's full-domain sensing terminals are acquired to construct a dynamic spatiotemporal propagation topology map of the entire city with propagation resistance attributes based on the abnormal spatial diffusion attenuation law. The city-wide dynamic spatiotemporal propagation topology map is divided into multiple spatiotemporal propagation connected domains according to propagation reachability, and a training set of related sample clusters for propagation constraints is constructed based on the temporal sensing data in each spatiotemporal propagation connected domain. A propagation constraint isolation forest is constructed based on the training set of the associated sample clusters, wherein the isolated trees of the propagation constraint isolation forest are recursively constructed based on the binary partitioning rule of the maximum propagation resistance interface constraint. Acquire the real-time global perception data to be evaluated, and convert the real-time global perception data to be evaluated into a sample cluster to be evaluated based on the city-wide dynamic spatiotemporal propagation topology map and spatiotemporal propagation connected components. The average isolation path length of the sample clusters to be evaluated is obtained based on the propagation constraint isolation forest, and the corresponding cluster-level spatiotemporal correlation anomaly degree is obtained based on the average isolation path length. Based on the cluster-level spatiotemporal correlation anomaly degree and the sample cluster to be evaluated, the corresponding node-level local deviation degree is obtained, and the risk classification assessment and location of unsupervised abnormal events in smart cities are completed based on the cluster-level spatiotemporal correlation anomaly degree and the node-level local deviation degree.

2. The method for unsupervised anomaly event risk assessment in smart cities according to claim 1, characterized in that, The step of acquiring time-series sensing data, geospatial data, and system attribution data from smart city-wide sensing terminals to construct a dynamic spatiotemporal propagation topology map of the entire city with propagation resistance attributes based on the anomaly spatial diffusion attenuation law includes: Based on the geospatial data, obtain the spatial coordinates and geographic barrier factor of each sensing terminal, and based on the system affiliation data, obtain the system affiliation level and cross-system interaction impedance coefficient of each sensing terminal. The spatial propagation resistance component between adjacent sensing terminals is obtained based on the spatial coordinates and geographical barrier factor, and the system propagation resistance component across terminals is obtained based on the system membership level and cross-system interaction impedance coefficient. The temporal evolution rate of abnormal events is extracted based on the temporal sensing data, and the comprehensive propagation resistance value between adjacent nodes is obtained based on the spatial propagation resistance component, the system propagation resistance component, and the temporal evolution rate of abnormal events. An initial static propagation topology is constructed by connecting each sensing terminal as a topology node and the corresponding comprehensive propagation resistance value as an edge. The comprehensive propagation resistance value of each edge in the initial static propagation topology is dynamically adjusted according to the real-time updated temporal sensing data to obtain a dynamic spatiotemporal propagation topology map of the entire city with propagation resistance attributes.

3. The method for unsupervised anomaly event risk assessment in smart cities according to claim 1, characterized in that, The step of dividing the city-wide dynamic spatiotemporal propagation topology map into multiple spatiotemporal propagation connected domains according to propagation reachability, and constructing a training set of related sample clusters for propagation constraints based on the temporal sensing data within each spatiotemporal propagation connected domain, includes: The set of topological nodes and the set of connected edges are obtained based on the dynamic spatiotemporal propagation topology map of the entire city, and the propagation activity coefficient of the corresponding topological node is obtained based on the temporal sensing data corresponding to each topological node in the set of topological nodes. The propagation reachability coefficient of the corresponding edge is obtained by using the comprehensive propagation resistance value of each edge in the dynamic spatiotemporal propagation topology map of the entire city and the propagation activity coefficient of the nodes at both ends of the corresponding edge. The set of edges is filtered based on the propagation reachability coefficient and the preset reachability threshold, and edges with propagation reachability coefficients lower than the preset reachability threshold are removed to obtain a propagation reachability subgraph. Maximal connected component extraction is performed on the propagation reachability subgraph, and each maximal connected subgraph is determined as a spatiotemporal propagation connected domain, resulting in multiple spatiotemporal propagation connected domains. The node identifiers of all nodes in each spatiotemporal propagation connected domain are obtained to extract multidimensional sensing feature sequences from the time-series sensing data. Based on each of the multidimensional sensing feature sequences, the temporal statistical feature vector of the corresponding node is obtained to construct the sensing feature matrix of the corresponding spatiotemporal propagation connected domain; Obtain the graph distance between nodes within each of the spatiotemporal propagation connected domains to generate a spatial constraint matrix; Using the perceptual feature matrix as input and the spatial constraint matrix as topological regularization constraint, a restricted clustering algorithm is used to cluster nodes in the spatiotemporal propagation connected domain to obtain multiple internal sample clusters. Multiple internal sample clusters are merged, and the spatiotemporal propagation connected component identifier of each internal sample cluster is used as the cluster label to form a training set of associated sample clusters with spatiotemporal topological constraints.

4. The method for unsupervised anomaly event risk assessment in smart cities according to claim 1, characterized in that, The step of constructing a propagation-constrained isolation forest based on the training set of the associated sample clusters includes: Based on the training set of the associated sample cluster, obtain the spatiotemporal feature vector of the sample, the comprehensive propagation resistance value of the bound edges of each sample, and the preset maximum propagation resistance interface constraint threshold. Based on the spatiotemporal feature vector of the sample, obtain the dispersion of each feature dimension to filter the candidate partitioning dimension of the maximum propagation resistance interface in combination with the comprehensive propagation resistance value. According to the preset maximum propagation resistance interface constraint threshold, the candidate partitioning dimension of the maximum propagation resistance interface, and the bipartitioning rule of the maximum propagation resistance interface constraint, a recursive bipartitioning is performed on the training set of the associated sample cluster to obtain a single isolated tree. The bipartitioning rule of the maximum propagation resistance interface constraint limits the partitioning surface to the feature interface with the maximum mean comprehensive propagation resistance within the training set of the associated sample cluster, and the difference in comprehensive propagation resistance between the two types of sub-samples across the interface after partitioning is not lower than the propagation resistance interface partitioning threshold. Obtain the sample isolation path and topological constraint label for each isolated tree, and obtain the confidence level of the isolated tree based on the sample isolation path and topological constraint label; Multiple isolated trees with individual tree confidence scores are combined and integrated to generate a propagation-constrained isolated forest.

5. The method for unsupervised anomaly event risk assessment in smart cities according to claim 1, characterized in that, The step of converting the real-time global sensing data to be evaluated into a sample cluster to be evaluated based on the city-wide dynamic spatiotemporal propagation topology map and spatiotemporal propagation connected components includes: Based on the real-time global perception data, extract the real-time perception feature vector of each perception terminal at each sampling time; Obtain the mapping relationship between the topology graph nodes and the sensing terminals in the dynamic spatiotemporal propagation topology graph of the entire city, and associate each real-time sensing feature vector with the corresponding topology graph node according to the node member list of each spatiotemporal propagation connected domain based on the mapping relationship, to obtain the corresponding real-time node feature set; Construct a corresponding real-time perception feature matrix based on the feature set of each real-time node, and obtain the real-time feature mean vector of each node in the corresponding spatiotemporal propagation connected domain based on each real-time perception feature matrix, as the domain centroid feature. Obtain the cluster centroid features of each sample cluster in the training set of the associated sample clusters, and obtain the spatiotemporal alignment similarity between each cluster centroid feature and the domain centroid feature; The sample cluster that best matches the spatiotemporal alignment similarity is selected as the belonging cluster, and the feature vectors of all real-time nodes in the spatiotemporal propagation connected domain are jointly encoded with the cluster member features of the belonging cluster to generate the sample cluster to be evaluated.

6. The method for unsupervised anomaly event risk assessment in smart cities according to claim 1, characterized in that, The steps of obtaining the average isolation path length of the sample clusters to be evaluated based on the propagation constraint isolation forest, and obtaining the corresponding cluster-level spatiotemporal correlation anomaly degree based on the average isolation path length, include: Based on the sample cluster to be evaluated and the isolated trees in the propagation constraint isolated forest, the single-tree isolation path length of each node in the sample cluster is obtained, and the average path length of the single-tree cluster is obtained based on the single-tree isolation path length. The comprehensive spatiotemporal coupling strength between nodes within the spatiotemporal propagation connectivity domain is obtained, and the intra-cluster spatiotemporal coupling density of the sample cluster to be evaluated is obtained based on the comprehensive spatiotemporal coupling strength. The cluster-level spatiotemporal correlation anomaly degree of the sample cluster to be evaluated is obtained based on the average isolation path length and the intra-cluster spatiotemporal coupling density.

7. The method for unsupervised anomaly event risk assessment in smart cities according to claim 1, characterized in that, The steps of obtaining the corresponding node-level local deviation based on the cluster-level spatiotemporal correlation anomaly degree and the sample cluster to be evaluated, and completing the risk classification assessment and location of unsupervised anomaly events in smart cities based on the cluster-level spatiotemporal correlation anomaly degree and the node-level local deviation degree, include: Obtain the real-time perceived feature vector of each node in the sample cluster to be evaluated and the mean node feature vector of the corresponding normal cluster in the training set of the associated sample cluster. The feature deviation norm of the corresponding node is obtained based on each real-time perceived feature vector and the node feature mean vector, and the corresponding initial local deviation is obtained based on each feature deviation norm. The corresponding initial local deviation is weighted and adjusted according to the spatiotemporal correlation anomaly degree of each cluster level to obtain the corresponding node level local deviation. When the cluster-level spatiotemporal correlation anomaly degree is greater than the first preset risk threshold and the node-level local deviation degree of at least one node is greater than the second preset risk threshold, the risk level of the anomaly event is determined to be high risk and the location of the spatiotemporal propagation connectivity domain where the deviating node is located is located. When the cluster-level spatiotemporal correlation anomaly degree is greater than the first preset risk threshold, but the node-level local deviation degree of all nodes is not greater than the second preset risk threshold, the risk level of the anomaly event is determined to be medium risk and the entire spatiotemporal propagation connected domain is marked. When the cluster-level spatiotemporal correlation anomaly degree is not greater than the first preset risk threshold, the risk level of the anomaly event is determined to be low risk.

8. An unsupervised anomaly event risk assessment system for smart cities, characterized in that, include: The first construction module is used to acquire the time-series sensing data, geospatial data and system affiliation data of the smart city's full-domain sensing terminals to construct a dynamic spatiotemporal propagation topology map of the city with propagation resistance attributes based on the abnormal spatial diffusion attenuation law. The second construction module is used to divide the city-wide dynamic spatiotemporal propagation topology map into multiple spatiotemporal propagation connected domains according to propagation reachability, and to construct a training set of related sample clusters of propagation constraints based on the temporal sensing data in each spatiotemporal propagation connected domain. The third construction module is used to construct a propagation constraint isolation forest based on the training set of the associated sample clusters, wherein the isolated trees of the propagation constraint isolation forest are recursively constructed based on the binary partitioning rule of the maximum propagation resistance interface constraint. The conversion module is used to acquire the real-time global perception data to be evaluated, and convert the real-time global perception data to be evaluated into a sample cluster to be evaluated based on the city's dynamic spatiotemporal propagation topology map and spatiotemporal propagation connected components. The acquisition module is used to obtain the average isolation path length of the sample clusters to be evaluated based on the propagation constraint isolation forest, and to obtain the corresponding cluster-level spatiotemporal correlation anomaly degree based on the average isolation path length. The assessment and positioning module is used to obtain the corresponding node-level local deviation based on the cluster-level spatiotemporal correlation anomaly degree and the sample cluster to be assessed, and to complete the risk classification assessment and positioning of unsupervised abnormal events in smart cities based on the cluster-level spatiotemporal correlation anomaly degree and the node-level local deviation degree.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images