An air traffic control alerting data visualization method, platform, and medium
Patent Information
- Application Number
- CN202611136045.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-29
- Publication Date
- 2026-09-15
Smart Images
Figure CN122761663A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of air traffic control technology, and in particular to a method, platform and medium for visualizing air traffic control alarm data. Background Technology
[0002] Air traffic control (hereinafter referred to as "Air Traffic Control") systems generate a large amount of alarm log data during daily operations, including various types such as low altitude alarms, short-term conflict alarms, air pressure inconsistency alarms, and similar flight number alarms. This alarm data records various safety events during aircraft operations and is an important source of basic data for Air Traffic Control safety operation analysis.
[0003] However, existing technologies still have shortcomings in utilizing this alarm data. First, a large number of alarm logs are simply saved without in-depth processing, and the operational patterns and security risk information contained within them cannot be effectively extracted and utilized. Second, data analysis efficiency is low; alarm pattern analysis and security report compilation are mostly done manually, which is inefficient when dealing with massive amounts of log data and makes systematic in-depth analysis difficult. Finally, the correlation between different alarms is difficult to identify; various alarms are usually stored and analyzed independently, making it impossible to effectively discover the deeper security situation reflected when different alarms occur simultaneously or sequentially in time and space.
[0004] Therefore, existing technologies suffer from problems such as insufficient utilization of alarm data, low analysis efficiency, and difficulty in discovering the correlation between different alarms, making it impossible to effectively uncover the deep-seated security risks hidden in massive alarm data. Summary of the Invention
[0005] To overcome the technical problems of insufficient utilization of air traffic control alarm data, low analysis efficiency, and difficulty in discovering the correlation between different alarms in the existing technology, this application provides an air traffic control alarm data visualization method, platform, and storage medium.
[0006] According to a first aspect of the present disclosure, this application provides a method for visualizing air traffic control alarm data, employing the following technical solution: A method for visualizing air traffic control alarm data includes the following steps: Data cleaning steps: Obtain the original air traffic control alarm logs, sort the alarm records of the same aircraft by time, identify the flight stage corresponding to each alarm record, determine the adaptive deduplication time window based on the flight stage, perform deduplication processing on the alarm records based on the adaptive deduplication time window, and output the deduplicated alarm records. The identification of the flight phase corresponding to each alarm record includes: extracting the aircraft's altitude, vertical speed and ground speed information from the alarm record; and determining, based on the comparison relationship between the altitude and preset altitude thresholds for each flight phase and the comparison relationship between the vertical speed and preset speed thresholds, whether the flight phase corresponding to the alarm record is one of the takeoff phase, climb phase, cruise phase, approach phase or landing phase. Association analysis steps: Convert all types of alarm records after deduplication into event objects. Each event object contains at least the event type, occurrence time, and spatial location information. Within a preset time and space window, event objects are matched pairwise. When the matched event objects meet the preset association rules, an associated event record is generated. The association rules include: when the same aircraft simultaneously generates a low altitude alarm and a pressure inconsistency alarm within a first time threshold, a high-risk association event for instrument reference failure is generated; and / or, when the number of pressure inconsistency alarms occurring at the same airport within a second time threshold reaches a first quantity threshold and the pressure deviation direction of each alarm is consistent, a meteorological data source abnormality association event is generated. Decision suggestion generation steps: Perform multi-dimensional aggregation statistics on the deduplicated alarm records and the associated event records, detect abnormal patterns in the aggregation results, and when the detected abnormal pattern matches the preset decision template, generate decision suggestions based on the decision template; Visualization output steps: The deduplicated alarm records, the associated event records, and the decision suggestions are visualized through the front-end interface. The visualization includes rendering the spatial location of low-altitude alarms into a heat map based on an offline tile map.
[0007] Optionally, determining the adaptive deduplication time window based on the flight phase specifically includes: The basic time window is allocated according to the flight phase: the takeoff and landing phases are the first basic window value, the climb and approach phases are the second basic window value, and the cruise phase is the third basic window value; the first basic window value is greater than the second basic window value, and the second basic window value is greater than the third basic window value; The number of alarms issued by the aircraft within a preset time period is counted, and the basic time window is reduced based on the number of alarms. The higher the number of alarms, the greater the reduction ratio. A lower limit value for the adaptive deduplication time window is also set. When the aircraft is in the flight phase transition period, the adaptive deduplication time window takes the larger value between the base time windows of the pre-transition phase and the post-transition phase.
[0008] Optionally, the deduplication process for alarm records based on the adaptive deduplication time window specifically includes: The time difference between the current alarm record and the previous retained alarm record is compared with the adaptive deduplication time window, and the height difference between the current alarm record and the previous retained alarm record is calculated. When the time difference is less than or equal to the adaptive deduplication time window and the height difference is less than or equal to the height difference threshold, the current alarm record is determined to be a duplicate alarm and discarded; otherwise, the current alarm record is retained.
[0009] Optionally, the step of matching event objects pairwise within a preset time-space window specifically includes: Sort all event objects by time, and use a two-pointer sliding window to traverse the event pairs within the preset time-space window; For each pair of events within the window, determine whether the time difference is less than or equal to the time threshold, and determine whether the spatial distance is less than or equal to the spatial threshold; The association rule is matched only for event pairs that simultaneously satisfy the time threshold and the spatial threshold.
[0010] Optionally, the association rule also includes at least one of the following: Third rule: When the same aircraft simultaneously generates low altitude alarm and short-term conflict alarm within a preset spatial radius and a third time threshold, a dual risk-related event of terrain and conflict is generated. Fourth rule: When either of a pair of similar flight numbers triggers a low altitude alarm or a short-term conflict alarm within the fourth time threshold, an operational risk association event induced by confusion is generated.
[0011] Optionally, the multi-dimensional aggregation statistics include spatial, temporal, flight, and correlation dimensions; the spatial dimension involves dividing the airspace into grids and counting the number of alarms and the average altitude within each grid; the temporal dimension involves counting alarm frequencies by hour and / or week to identify peak alarm periods; the flight dimension involves counting the alarm frequency for each flight number or flight pair and comparing it with the average of all flights; and the correlation dimension involves counting the occurrence frequency of each correlation rule.
[0012] Optionally, the abnormal patterns detected in the aggregation results specifically include at least one of the following: Spatial hotspot detection: Density clustering algorithm is used to identify spatial clusters with dense alarms. When the number of alarm points in a cluster exceeds the second quantity threshold and the difference between the average alarm height and the preset alarm threshold is less than the difference threshold, it is determined to be a candidate hotspot. Time-period anomaly detection: The alarm frequency of the current time period is compared with the mean and standard deviation of the same period in history. When the current alarm frequency exceeds the sum of the multiples of the mean and standard deviation, it is judged as an abnormal peak. Flight anomaly detection: When the frequency of flight alarms exceeds a multiple threshold of the average frequency of all flights, or when the alarm frequency increases by more than a percentage threshold after the seasonal change compared to before the seasonal change, it is judged as a flight anomaly. Frequent occurrence detection of associated events: Identify association rules that are significantly higher than historical levels using the chi-square test.
[0013] Optionally, the decision template includes at least one of the following: First template: When a spatial hotspot is detected and the average alarm height is close to the preset alarm threshold, generate parameter adjustment suggestions including the hotspot area range, alarm count, average height, and recommended alarm height adjustment value; Second template: When the frequency of alarms for similar flight number pairs exceeds the third quantity threshold during a specific time period, generate an early warning suggestion that includes flight number, time period, number of alarms and time period adjustment suggestions; The third template: When the percentage of approach pressure inconsistency alarms exceeds the percentage threshold and the deviation direction is consistent, generate sensor calibration suggestions that include the approach name, percentage, and calibration recommendations. Fourth template: When the alarm frequency increases beyond the percentage threshold after the flight seasonal change, generate flight plan adjustment suggestions including flight number, growth rate and operational parameter adjustment suggestions; It also includes a suggestion priority ranking step: calculate a comprehensive score for each generated decision suggestion. The comprehensive score is calculated based on the risk level weight, alarm frequency and the number of affected flights. The decision suggestions with the highest scores are displayed first.
[0014] According to a second aspect of the embodiments of this disclosure, this application provides an air traffic control alarm data visualization platform, which adopts the following technical solution: An air traffic control alarm data visualization platform includes: The data cleaning module is used to acquire the original air traffic control alarm logs, sort the alarm records of the same aircraft by time, identify the flight stage corresponding to each alarm record, determine the adaptive deduplication time window based on the flight stage, perform deduplication processing on the alarm records based on the adaptive deduplication time window, and output the deduplicated alarm records. The correlation analysis module is used to convert all types of alarm records after deduplication into event objects. The event objects contain at least event type, occurrence time and spatial location information. The module performs pairwise matching of event objects within a preset spatiotemporal window. When the matched event pairs meet the preset correlation rules, a correlation event record is generated. The decision suggestion generation module is used to perform multi-dimensional aggregation statistics on the deduplicated alarm records and the associated event records, detect abnormal patterns in the aggregation results, and generate decision suggestions based on the decision template when the detected abnormal pattern matches the preset decision template. The visualization module is used to visualize the deduplicated alarm records, the associated event records, and the decision suggestions through the front-end interface. The visualization module includes an offline map heatmap unit and a decision suggestion display unit. The offline map heatmap unit is used to render the spatial location of low-height alarms into a heatmap based on an offline tile map. The decision suggestion display unit is used to display a list of decision suggestions sorted by priority.
[0015] According to a third aspect of the present disclosure, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the air traffic control alarm data visualization method according to any one of the first aspects of the present disclosure.
[0016] In summary, this invention provides a method, platform, and medium for visualizing air traffic control alarm data; compared with the prior art, this invention has the following beneficial effects: (1) By identifying the flight phase and determining the adaptive deduplication time window, the original alarm logs can be accurately deduplicated according to the dynamic characteristics of different flight phases. Compared with fixed time window deduplication, it can effectively filter out redundant alarms and avoid missing key safety events, thus improving the data quality of subsequent analysis.
[0017] (2) By converting different types of alarms into event objects and using preset association rules for spatiotemporal matching, it is possible to discover the complex risk patterns hidden between isolated alarm events, such as instrument reference failure and meteorological data source anomalies, thereby realizing in-depth exploration of the security situation.
[0018] (3) By performing multi-dimensional anomaly pattern detection on aggregated data and matching decision templates to automatically generate structured and quantifiable decision recommendations, complex analysis results are directly transformed into actionable specific measures, thereby improving the decision-making efficiency and scientific nature of safety management.
[0019] (4) By visualizing the analysis results on the offline tile map through heat map rendering, the high-incidence areas and risk patterns of alarms are clearly visible, making it easy for users to understand and respond quickly; at the same time, the use of offline maps meets the air traffic control industry's requirements for the confidentiality of geographic information.
[0020] Other features and advantages disclosed in this invention will be described in detail in the following detailed description section. Attached Figure Description
[0021] The accompanying drawings are provided to further illustrate the present disclosure and form part of the specification. They are used together with the following detailed description to explain the present disclosure, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating an air traffic control alarm data visualization method according to an exemplary embodiment.
[0022] Figure 2 This is a structural block diagram of an air traffic control alarm data visualization platform according to an exemplary embodiment.
[0023] Figure 3 This is a structural block diagram of a visualization module illustrated according to an exemplary embodiment.
[0024] Figure 4 This is an overview of the interface of an air traffic control alarm data visualization platform, according to an exemplary embodiment.
[0025] Figure 5 This is a schematic diagram of an offline tile map stored in a local map server, according to an exemplary embodiment.
[0026] Figure 6 This is a schematic diagram of a heat map according to an exemplary embodiment.
[0027] Figure Labels 10. Data Cleaning Module; 20. Correlation Analysis Module; 30. Decision Recommendation Generation Module; 40. Visualization Module; 41. Offline Map Heatmap Unit; 42. Related Event Display Unit; 43. Decision Recommendation Display Unit. Detailed Implementation
[0028] The specific embodiments disclosed in this application will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of this disclosure.
[0029] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.
[0030] (1) Flight phase: refers to the operational state of an aircraft determined by comparing its altitude, vertical speed and ground speed information with preset thresholds, such as takeoff phase, climb phase, cruise phase, approach phase or landing phase.
[0031] (2) Adaptive deduplication time window: This refers to a dynamically calculated time threshold used to determine whether consecutive alarms within a short period of time are duplicate alarms. Its value is set based on the flight phase of the aircraft and dynamically adjusted according to the alarm density of the aircraft over a past period of time.
[0032] (3) Event object: refers to converting different types of original alarm records (such as low altitude alarm, air pressure inconsistency alarm, etc.) into a standardized data structure. This structure should at least include event type, occurrence time and spatial location information to facilitate unified correlation analysis.
[0033] (4) Association rules: These are pre-defined logical conditions used to identify potential connections between different alarm events. When two or more event objects meet these conditions within a specific time and space window, they are considered to be associated, thus generating an associated event record.
[0034] (5) Decision template: refers to a pre-set structured suggestion format that corresponds to a specific anomaly pattern. When a certain anomaly pattern is detected, the system will automatically call the corresponding template and fill in the specific detection data (such as region, frequency, flight number, etc.) to generate standardized and actionable decision suggestions.
[0035] (6) Offline tile map: This refers to map data that is pre-downloaded and stored on a local server. It divides geographic information into small images (tiles) for storage and retrieval. The system can still load and display geographic information without connecting to the public Internet, thus meeting the requirements of industries such as air traffic control for the confidentiality of geographic information.
[0036] Please see Figure 1 This application provides a method for visualizing air traffic control alarm data, aiming to solve the problems in existing technologies such as incomplete processing of air traffic control alarm log data, low analysis efficiency, and difficulty in identifying correlations between alarms. This method constructs a complete data processing chain from data cleaning, correlation analysis, decision generation to visualization output, enabling in-depth mining and intelligent decision support of massive alarm data.
[0037] In a basic implementation, the method first performs a data cleaning step 101. This step obtains raw air traffic control alarm logs, typically in text format, from data sources such as the air traffic control system's log server. These logs contain a large amount of redundancy and noise, and direct analysis would severely affect the accuracy of the results. Therefore, the core purpose of this step is to purify and refine this raw data. Specifically, for each aircraft, the system sorts its relevant alarm records according to their occurrence time, forming a time series. Through this sorting, the alarm evolution of a single aircraft during a flight can be clearly displayed.
[0038] In data cleaning step 101, a key step is identifying the flight phase corresponding to each alarm record. Accurate identification of the flight phase is a prerequisite for subsequent adaptive processing. The system analyzes key flight parameters in the alarm records, such as the aircraft's altitude, vertical speed, and ground speed, and classifies the alarm events into predefined flight phases based on these parameters, such as takeoff, climb, cruise, approach, or landing.
[0039] Next, in data cleaning step 101, an adaptive deduplication time window is determined for each alarm record based on the identified flight phase. Different flight phases have different operational characteristics and risk levels, thus requiring different deduplication strategies. For example, during critical phases such as takeoff and landing, alarm information is more sensitive, and the deduplication window should be relatively conservative; while during the stable cruise phase, a more aggressive deduplication strategy can be adopted. This adaptive mechanism aims to retain as many valid alarms as possible while filtering out redundant information generated by the continuous triggering of the same event, thereby solving the misjudgment problem that may occur when using a fixed window for deduplication.
[0040] After determining the adaptive deduplication time window, data cleaning step 101 performs deduplication on the sorted alarm records based on this window. The system iterates through the alarms in the time series, determining whether adjacent or similar alarms are repeated triggers of the same event. By applying the adaptive time window, truly duplicate alarms can be effectively filtered out, ultimately outputting a high-quality, low-redundancy deduplicated alarm record.
[0041] After data cleaning, the method proceeds to step 102, which involves correlation analysis. This step aims to uncover the deep-seated connections between different alarm events, addressing the problem in existing technologies where alarms are analyzed in isolation, failing to identify compound risks. First, this step transforms the deduplicated alarm records output from data cleaning step 101 into standardized event objects. Regardless of whether the original alarm is a low-altitude alarm, a pressure inconsistency alarm, or a short-term conflict alarm, they are all mapped into a unified data structure containing core elements such as event type, occurrence time, and spatial location information. This abstraction and unification is the technical prerequisite for achieving cross-type alarm correlation analysis.
[0042] Subsequently, in the association analysis step 102, the system performs pairwise matching of these event objects within a preset spatiotemporal window. This means that the system is concerned not only with the chronological order of events but also with their geographical proximity. By setting a time threshold and a spatial distance threshold, the system can filter out event objects that are potentially related in time and space. This joint spatiotemporal constraint effectively focuses the analysis on events most likely to interact, avoiding unnecessary global computations.
[0043] Once an event object is matched spatiotemporally, the association analysis step 102 further determines whether it meets preset association rules. These association rules are logical judgment conditions that incorporate expert knowledge in the air traffic control field. For example, a rule can be defined as "when type A alarms and type B alarms occur simultaneously under a specific spatiotemporal relationship, it may mean the existence of a composite risk of type C." When a matched event object satisfies a certain association rule, the system generates an associated event record. This record is no longer an isolated alarm, but represents a composite risk event with higher information value discovered through logical reasoning and knowledge mining.
[0044] After generating deduplicated alarm records and related event records, the method proceeds to step 103, which involves generating decision recommendations. The goal of this step is to transform the analysis results into decision recommendations that can guide practical operations, addressing the problem in existing technologies where analysis results are difficult to directly apply in practice. The system first performs multi-dimensional aggregation and statistics on the alarm records output from data cleaning step 101 and the related event records output from correlation analysis step 102. Aggregation dimensions can include space, time, flights, etc., and through statistical analysis, it reveals the distribution patterns and trends of alarms and risks at a macro level.
[0045] Based on multi-dimensional aggregated statistics, step 103 of the decision suggestion generation process detects abnormal patterns in the aggregated results. Abnormal patterns refer to noteworthy phenomena that deviate from the normal baseline, such as frequent alarms forming a "hotspot" in a certain area, or an abnormal peak in the number of alarms during a certain period. The system employs a series of algorithms to automatically identify these patterns, achieving the extraction of information from "data".
[0046] When a detected anomaly pattern matches a preset decision template, step 103 generates specific decision recommendations based on that template. The decision template structurally associates the anomaly pattern with corresponding handling measures. Once triggered, the system automatically extracts key parameters (such as area range, alarm count, affected flights, etc.) from the anomaly pattern analysis results, populates them into the template, and generates specific, standardized, and highly actionable decision recommendations. In this way, the automated transformation from "information" to "decision" is achieved.
[0047] Finally, the method executes step 104, which involves visualizing the output. This step aims to present all the aforementioned analysis results to air traffic control users in an intuitive and easy-to-understand manner. The system will integrate and visualize the deduplicated alarm records, related event records, and generated decision recommendations through a single front-end interface. This one-stop presentation allows users to comprehensively grasp the air traffic control safety situation from different levels and granularities.
[0048] Specifically, in visualization output step 104, the visualization display includes rendering the spatial location of low-altitude alarms into a heatmap based on offline tile maps. The heatmap can very intuitively show the geographic areas where low-altitude alarms are concentrated, helping users quickly identify high-incidence areas. Simultaneously, the use of offline tile maps meets the special requirements of the air traffic control industry for the confidentiality of geographic information, ensuring the system's security and compliance. Through this series of steps, this method progressively transforms raw, messy alarm logs into an intuitive risk map and clear action guidelines, realizing the transformation of air traffic control safety data from passive recording to proactive intervention in risk prevention and control.
[0049] Furthermore, in a preferred embodiment, the flight phase corresponding to each alarm record identified in the data cleaning step 101 is refined. Specifically, the system extracts the aircraft's current altitude, vertical rate, and ground speed information from each alarm record. In some cases, the original log may not directly provide the vertical rate. In this case, the system can estimate the approximate vertical rate by using the altitude difference and time difference between two consecutive records of the same aircraft. After obtaining these key parameters, the system makes a judgment based on a set of preset rules, which include: comparing the aircraft's altitude with preset altitude thresholds for each flight phase (e.g., the upper limit of altitude for the takeoff phase, the lower limit of altitude for the cruise phase, etc.), and comparing its vertical rate with preset rate thresholds (e.g., the minimum rate of climb for the climb phase, the stable rate range for the cruise phase, etc.), and after comprehensive judgment, determining the flight phase corresponding to the alarm record as one of the takeoff phase, climb phase, cruise phase, approach phase, or landing phase.
[0050] In another preferred embodiment, the process of determining the adaptive deduplication time window based on the flight phase is refined. First, a base time window value is allocated based on the flight phase. Considering the operational risks and dynamic characteristics of different phases, a longer first base window value (e.g., 15 seconds) is allocated to the two most critical phases, takeoff and landing; a medium-sized second base window value (e.g., 10 seconds) is allocated to the climb and approach phases; and a shorter third base window value (e.g., 5 seconds) is allocated to the relatively stable cruise phase. The first base window value is greater than the second base window value, and the second base window value is greater than the third base window value. Second, to address situations where a specific aircraft experiences frequent short-term alarms, the system counts the total number of alarms for that aircraft within a preset time period (e.g., 30 minutes) and dynamically reduces the base time window based on the number of alarms. The higher the number of alarms, the greater the reduction ratio, but a lower limit for the time window (e.g., 3 seconds) is set to prevent excessive reduction. Furthermore, when an aircraft is in the transition period between two flight phases, in order to ensure a smooth transition, its adaptive deduplication time window will take the larger value from the base time windows of the pre-transition and post-transition phases. The technical effect of this multi-adjustment mechanism is that it enables the deduplication window to adapt to the characteristics of different flight phases macroscopically, and to respond to the real-time status of individual aircraft microscopically, achieving a high degree of adaptability and improving the accuracy of deduplication processing.
[0051] Furthermore, based on the aforementioned adaptive deduplication time window, the specific method for deduplicating alarm records includes: the system traverses alarm records belonging to the same aircraft in chronological order, and for the current alarm record to be processed, it is compared with the previous retained alarm record. First, the time difference between the two is calculated and compared with the adaptive deduplication time window corresponding to the current alarm record. Then, the altitude difference between the two is calculated. The deduplication rule is: only when the time difference is less than or equal to the adaptive deduplication time window, and the altitude difference is less than or equal to a preset altitude difference threshold (e.g., 200 meters), is the current alarm record judged as a duplicate alarm and discarded; otherwise, even if the time difference is very short, as long as the altitude has changed significantly, it should be retained as a new event. This design introduces altitude change as an exception judgment condition. Its technical effect is that it can effectively prevent critical alarms generated by drastic altitude changes of the aircraft (such as emergency descent, crossing the wrong altitude layer) from being mistakenly filtered out as duplicate information, thereby greatly improving security while ensuring data simplicity and avoiding the omission of critical safety events.
[0052] In one optional implementation, the process of pairwise matching of event objects within a preset spatiotemporal window in the association analysis step 102 is optimized. To improve matching efficiency, the system first globally sorts all event objects to be analyzed by occurrence time. Then, a two-pointer sliding window algorithm is used to traverse all possible event pairs. Specifically, a left pointer and a right pointer are set. The right pointer moves backward to include new events in the window. When the time difference between the earliest event (pointed to by the left pointer) and the latest event in the window exceeds the preset time threshold in the spatiotemporal window, the left pointer moves forward to remove the outdated event from the window. For each pair of events in the window, the system determines whether their time difference is less than or equal to the time threshold and whether their spatial distance is less than or equal to the spatial threshold. Only event objects that simultaneously meet the time and spatial proximity conditions are sent to the subsequent association rule matching stage. The technical advantage of using the two-pointer sliding window algorithm is that it optimizes the original O(n^2) complexity problem, which required pairwise comparison of all event objects, into an approximately linear O(n^2) complexity problem. The k) complexity (k is the average number of events within the window) greatly improves the processing efficiency of correlation analysis, enabling the system to process large-scale alarm data in near real-time.
[0053] Furthermore, the association rule base in this application embodiment can contain richer rules to identify more types of compound risks. In addition to basic association rules, it may also include at least one of the following: A third rule: When the same aircraft simultaneously triggers a Low Altitude Warning (MSAW) and a Short-Term Conflict Warning (STCA) within a preset spatial radius (e.g., 10 km) and within a third time threshold (e.g., 120 seconds), the system generates a "Dual Risk of Terrain and Conflict" association event. This rule aims to identify an aircraft facing both the risk of being too close to terrain and the risk of conflict with other aircraft, which is an extremely dangerous emergency. A fourth rule: When a pair of aircraft with similar flight numbers (e.g., "CES123" and "CES128") trigger a Low Altitude Warning or a Short-Term Conflict Warning within a fourth time threshold (e.g., 60 seconds), the system generates a "Confusion-Induced Operational Risk" association event. This rule aims to identify the potential risk of controller or pilot confusion due to similar flight numbers, leading to dangerous operations. The technical effect of these new rules is that they solidify in-depth safety knowledge and operational experience in the air traffic control field into algorithmic logic, enabling the system to automatically and accurately identify more complex risk patterns that were previously only discoverable through human experience, which are highly concealed and dangerous, thus significantly enhancing the system's risk warning capabilities.
[0054] In another preferred embodiment, the multi-dimensional aggregation statistics in step 103 of the decision suggestion generation are described in detail. The aggregation dimensions may include: a spatial dimension, which involves dividing the entire airspace into fixed-size geographical grids (e.g., 0.05° × 0.05°), and then counting the total number of alarms, the number of specific types of alarms (e.g., MSAW), and the average alarm height within each grid; a temporal dimension, which involves counting the frequency of various alarms according to time units such as hours and days of the week to identify peak periods or periodic patterns of alarm occurrences; a flight dimension, which involves counting the alarm frequency of each independent flight number or similar flight number pairs and comparing it with the average alarm level of all flights to identify abnormal performance of specific flights; and a correlation dimension, which involves counting the occurrence frequency of each correlation rule generated by step 102 of the correlation analysis to monitor the frequency of occurrence of specific composite risks. The technical effect of this multi-dimensional aggregation is that it systematically sorts and quantifies massive amounts of data from different perspectives, providing a structured and quantifiable data foundation for subsequent anomaly pattern detection, making it possible to gain insights into the security situation from a macro perspective.
[0055] Furthermore, based on the above multi-dimensional aggregation results, specific methods for detecting abnormal patterns can include at least one of the following: Spatial hotspot detection, using an equal-density clustering algorithm such as DBSCAN to identify spatially dense clusters of alarm events. When the number of alarm points within a cluster exceeds a preset second threshold (e.g., 50 times / week), and the difference between the average alarm height within the cluster and the minimum alarm threshold specified for the area is less than a specific difference threshold (e.g., 150 meters), the area is determined to be a candidate hotspot requiring attention. Temporal anomaly detection, comparing the alarm frequency of the current analysis period (e.g., 10 AM this Tuesday) with the mean and standard deviation of alarm frequencies for the same historical period (e.g., 10 AM on Tuesdays over the past four weeks). When the condition is met: alarm frequency of the current period > mean + 2 × standard deviation, it is determined to be a significant abnormal peak. Flight anomaly detection identifies a flight as having an anomaly when its alarm frequency exceeds a multiple threshold (e.g., 3 times) of the average frequency of all flights, or when its alarm frequency increases by more than a significant percentage threshold (e.g., 200%) after a seasonal change compared to before the change. Frequent occurrence detection of associated events uses statistical methods such as the chi-square test to identify association rules whose frequency is significantly higher than the historical average (e.g., p < 0.05). These quantitative and automated anomaly detection methods replace the inefficient traditional methods relying on manual observation and experience, enabling rapid, objective, and accurate identification of safety risks.
[0056] In one optional implementation, the decision template in step 103 of the decision suggestion generation can include multiple specific types to address different anomaly patterns. For example, the first template generates a parameter adjustment suggestion when a spatial hotspot is detected and its average alarm altitude is very close to a preset alarm threshold. This suggestion includes the specific range of the hotspot area, the total number of alarms, the average alarm altitude, and a recommended alarm altitude adjustment value. The second template generates a warning suggestion when the alarm frequency of a pair of similar flight numbers exceeds a third quantity threshold during a specific time period. This suggestion includes the pair of flight numbers, the abnormal time period, the number of alarms, and a suggestion for airlines to coordinate and adjust their timetables. The third template generates a sensor calibration suggestion when the proportion of QNH (Quality Inconsistency of Atmosphere) alarms at an approach point exceeds a significant percentage threshold and the deviation direction is consistent. This suggestion includes the name of the approach point, the alarm proportion, and a suggestion to calibrate the relevant barometric pressure sensor. The fourth template generates a flight plan adjustment suggestion when the alarm frequency of a flight increases beyond a preset percentage threshold after a seasonal change. This suggestion includes the flight number, the alarm growth rate, and a suggestion to coordinate and adjust its approach altitude or speed and other operating parameters. Furthermore, to help users focus on the most critical risks, a priority ranking step is included. For each generated decision suggestion, the system calculates a comprehensive score based on factors such as its risk level weight, the frequency of alarms involved, and the number of affected flights. The system then prioritizes displaying a pre-defined number of decision suggestions with the highest scores (e.g., the top 5). This template-based and priority-ranking-based decision suggestion generation method effectively transforms complex analysis results into specific, quantifiable, actionable, and prioritized action items, significantly improving the efficiency and scientific rigor of air traffic control safety management decisions.
[0057] Please see Figure 2 This application also provides an air traffic control alarm data visualization platform. This platform is a concrete physical implementation of the above-described method. In one specific embodiment, the platform can be a B / S architecture software system deployed on a server within an air traffic control center. The server hardware can be configured as a high-performance computing server, for example, equipped with a multi-core CPU, large-capacity memory, and a high-speed solid-state drive, running a Linux operating system. At the software level, the backend service can be implemented using a mature web development framework, and the database can use a relational database for data storage. The frontend interface can be built based on standard web technologies and utilize map and chart libraries for data visualization.
[0058] like Figure 2As shown, the platform logically includes a data cleaning module 10, a correlation analysis module 20, a decision suggestion generation module 30, and a visualization module 40. The data cleaning module 10 is responsible for executing the aforementioned data cleaning steps. It obtains data from the original air traffic control alarm log server, processes it through sorting, flight phase identification, and adaptive deduplication, and outputs the cleaned structured alarm records to the database. The correlation analysis module 20 periodically or on demand reads the cleaned alarm records from the database, performs unified event object transformation, spatiotemporal window matching, and correlation rule judgment, generates correlated event records, and stores them in the database. The decision suggestion generation module 30 comprehensively utilizes the cleaned alarm records and correlated event records, performs multi-dimensional aggregation and anomaly pattern detection, generates decision suggestions based on decision templates, and finally stores a priority-based suggestion list in the database.
[0059] The visualization module 40 serves as the interface for user interaction with the system. It retrieves and integrates all analysis results from the database and presents them visually. Specifically, for example... Figure 3 As shown, the visualization module 40 may include an offline map heatmap unit 41. This unit calls the map engine to load the offline tile map stored on the local server and renders the spatial location information of the cleaned low-height alarm records into a heatmap, visually displaying high-incidence areas of alarms. The visualization module 40 may also include a related event display unit 42, which displays the related event records generated by the correlation analysis module 20 in the form of a list or dashboard, and provides filtering and sorting functions based on risk level, time range, rule type, and other conditions. In addition, the visualization module 40 also includes a decision suggestion display unit 43, which is used to display a list of decision suggestions generated by the decision suggestion generation module 30 and sorted by priority in prominent positions such as the platform homepage. Each unit interacts with the backend through a RESTful API, realizing a front-end and back-end separation architecture, which facilitates system maintenance and expansion.
[0060] To more clearly illustrate a specific embodiment of the present invention, a specific application scenario will be described below. Suppose the system needs to analyze all alarm logs from an airport over the past week. First, the raw text logs are sent to the data cleaning module 10. For a record of flight "CDE456", the system identifies it as being in the approach phase and allocates a 10-second base time window according to the rules. Since this flight has had few recent alarms, the window is not shortened. The system finds that this alarm is similar in type and location to the previous alarm 3 seconds ago, and the altitude difference is only 30 meters, less than the 200-meter altitude difference threshold, therefore it is judged as a duplicate alarm and discarded. For flight "FGH789", although the time difference between its two alarms is only 8 seconds (less than its corresponding 15-second takeoff phase window), the altitude difference reaches 250 meters. According to the exception rule, the system retains this alarm. After this processing, high-quality cleaned structured alarm records are output.
[0061] Next, some of these records are directly sent to the offline map heatmap unit 41 of the visualization module 40 to generate a low-altitude alarm heatmap; the other part, along with all other alarm records, is sent to the correlation analysis module 20. In this module, the system uses a dual-pointer sliding window to efficiently match events. It was found that the low-altitude alarm for flight "JKL901" at 10:05:10 and its barometric pressure inconsistency alarm at 10:05:45 had a time difference of less than 60 seconds and belonged to the same flight, satisfying the correlation rule of "high risk of instrument reference failure". The system then generates a high-risk correlation event record.
[0062] Simultaneously, the cleaned alarm records and generated related event records are sent to the decision suggestion generation module 30. This module performs multi-dimensional aggregation and, using the DBSCAN algorithm, discovers a dense cluster of low-altitude alarms near point A in the spatial dimension, with the average alarm height very close to the minimum safe height of the area, satisfying the triggering conditions of the first template. The system automatically generates a suggestion: "In the area of point A, 62 low-altitude alarms occurred in the past week, with an average alarm height only 80 meters higher than the threshold. It is recommended to raise the minimum alarm height in this area to XXX meters." Meanwhile, in the correlation dimension, the system uses a chi-square test to find that the frequency of the "abnormal meteorological data source" related event is significantly higher than historical levels, triggering the third template and generating another suggestion. Finally, the system prioritizes these two suggestions, calculates a comprehensive score based on risk level, alarm frequency, etc., and places the parameter adjustment suggestion with the higher score first, forming the final decision suggestion list.
[0063] Finally, all results are presented to the user in the visualization module 40. In the decision suggestion display unit 43, the user first sees parameter adjustment suggestions for area A. Clicking on these suggestions links to the offline map heatmap unit 41, where the user can view the detailed spatial distribution of the hotspot and the list of related alarms. The user can also filter and view all related events for "high risk of instrument reference failure" in the associated event display unit 42. Through this complete processing flow, this embodiment transforms the raw logs into a comprehensive security situation view, from macro to micro, from phenomena to countermeasures, achieving the synergistic effect of various technical features.
[0064] To more clearly illustrate the overall technical solution of the present invention and its workflow in practical applications, the following uses a typical operating scenario of an air traffic control unit after deploying the visualization platform described in this application as an example to fully describe the combined use of the method, platform, and storage medium.
[0065] The air traffic control alarm data visualization platform described in this application is deployed within the internal network of an air traffic control center. The platform adopts a B / S architecture, with the backend server equipped with a data cleaning module, a correlation analysis module, and a decision suggestion generation module, and configured with a MySQL database for data storage; the frontend visualization module is deployed on the control center's monitoring screen and the controllers' terminal devices. The platform interfaces with the log server of the air traffic control automation system through the internal network to obtain raw alarm log files in batches. Simultaneously, the platform pre-loads offline tile map data (WGS-84 coordinate system) from Gaode Maps, such as... Figure 5 As shown, the data is stored on a local map server, ensuring that geographic information can be fully displayed even without a connection to the public internet, thus meeting the air traffic control industry's confidentiality requirements for sensitive geographic data.
[0066] Taking flight "CCA123" operating from Beijing to Guangzhou on a certain day as an example, during the approach of this flight at Guangzhou Baiyun Airport, the air traffic control automation system triggered 6 low-altitude alarm records within 30 seconds. These 6 records in the original log were at similar altitudes and locations, and direct analysis would result in data redundancy.
[0067] After the platform's data cleaning module obtains all the original alarm records for the flight, it sorts them in ascending order by time. For each alarm record, the module extracts altitude, vertical rate, and ground speed information. Taking the third alarm record as an example, its altitude is 800 meters and its vertical descent rate is 3.2 meters per second. Based on the preset flight phase determination rules (altitude below 3000 meters and descent rate greater than 2 meters per second), the module identifies it as an "approach phase".
[0068] After determining the flight phase, the module assigns a base time window of 10 seconds to the alarm (the second base window corresponding to the approach phase). Subsequently, the module counts that the total number of alarms for "CCA123" in the past 30 minutes is 8, which exceeds the preset threshold of 6. Therefore, the base window is reduced to 0.6 times, resulting in 6 seconds. Since 6 seconds is higher than the preset lower limit of 3 seconds, the final adaptive deduplication time window is determined to be 6 seconds.
[0069] Next, the module performs a deduplication check on the third alarm record: its time difference with the previous retained alarm record is 4 seconds, less than the adaptive window of 6 seconds; simultaneously, the altitude difference is 80 meters, less than the preset altitude difference threshold of 200 meters. Both the time difference and altitude difference meet the merging conditions, therefore the third alarm is determined to be a duplicate alarm and discarded. For the fifth alarm record of this flight, its time difference with the previous retained alarm is 7 seconds (slightly greater than the 6-second window), therefore it is retained. Furthermore, if an alarm, although its time difference is less than the window, has an altitude difference exceeding 200 meters (e.g., due to a sudden change in altitude caused by a go-around or emergency descent), this alarm is also retained to ensure that no critical safety events are missed.
[0070] After the adaptive deduplication process described above, the six original alarms from "CCA123" during the approach were merged into two representative alarm records, achieving a data compression rate of 67%, while retaining critical safety events such as rapid height changes. The deduplicated structured alarm records were stored in a MySQL database, with a unique index combining "time + flight number" to prevent duplicate writes.
[0071] After data cleaning is completed, the correlation analysis module periodically (e.g., every 30 minutes) reads the newly added cleaned alarm records from the database and performs cross-type alarm correlation analysis.
[0072] Specifically, the module converts different types of alarm records, such as Low Altitude Altitude Alarm (MSAW), Short-Term Conflict Alarm (STCA), QNPH (QNH), and Similar Flight Number Alarm, into standardized event objects. Each event object contains core attributes such as event type, occurrence time, latitude and longitude (or sector center point), and involved flight numbers.
[0073] Taking a scenario from a specific day as an example: Within the same airspace, flight "CES456" triggered both a low altitude alarm and a barometric pressure inconsistency alarm within 15 seconds. The correlation analysis module uses a dual-pointer sliding window to sort all event objects by time and then traverses them. The window includes these two events in the matching range, determining that their time difference is 15 seconds, meeting the first time threshold (60 seconds); spatially, they belong to the same flight, meeting the spatial proximity condition. Subsequently, the module matches this event pair with preset correlation rules—according to the first rule, when the same aircraft simultaneously triggers a low altitude alarm and a barometric pressure inconsistency alarm within 60 seconds, a "high risk of instrument reference failure" correlation event is generated. The system then generates a high-risk correlation event record and writes it to a dedicated data table.
[0074] For example, the correlation analysis module detects that an airport has issued four consecutive air pressure inconsistency alarms within four minutes, and the air pressure deviation direction of each alarm is higher than normal. The module determines that this situation meets the second rule (≥3 QNH alarms at the same airport within 5 minutes with consistent deviation directions), and then generates a "meteorological data source anomaly" correlation event.
[0075] In addition, when the module detects that the same flight simultaneously generates a low altitude alarm and a short-term conflict alarm within a radius of 10 kilometers and within 120 seconds, it generates a "dual risk of terrain and conflict" associated event according to the third rule; when it detects that similar flight numbers "CES123" and "CES128" trigger a low altitude alarm within 60 seconds, it generates a "confusion-induced operational risk" associated event according to the fourth rule.
[0076] Through the above correlation analysis, the module transforms the originally isolated and scattered alarm records into high-dimensional correlated events with clear security semantics, revealing hidden complex risks to security managers.
[0077] Based on the cleaned alarm records and related event records, the decision suggestion generation module performs multi-dimensional aggregation and statistics on the data of the past 30 days on a weekly basis.
[0078] In terms of spatial dimension, the module divides the airspace into a 0.05°×0.05° grid and counts the number of MSAW alarms within each grid. The DBSCAN density clustering algorithm is used to identify spatial clusters with dense alarms. For example, assuming a cluster containing 62 alarms approximately 20 kilometers south of Guangzhou Baiyun Airport, with an average alarm height of 280 meters, and the preset minimum alarm threshold for this area is 300 meters, the difference between the average height and the threshold is only 20 meters, less than the preset difference threshold of 150 meters. The module identifies this area as a candidate hotspot.
[0079] In terms of time, the module counts the frequency of alarms for similar flight numbers by hour and finds that the similar flight number pair "CES123 / CES128" has an average of 7 alarms every Friday afternoon from 15:00 to 16:00, while the average for other time periods is only 1.2 alarms. Compared with the same period in history, the current frequency significantly exceeds the judgment standard of "mean + 2 standard deviations", which constitutes an abnormal peak.
[0080] At the flight level, the module statistics showed that the alarm frequency for flight "HNA789" was 15 times per cycle, while the average frequency for all flights was 4.2 times, which exceeded the threshold by 3 times and was judged as a flight anomaly.
[0081] In terms of correlation, the module found through chi-square test that the "high risk of instrument reference failure" associated event occurred 8 times in this period, while the historical weekly average was 2.5 times. The p-value was less than 0.05, which was judged as a significant anomaly.
[0082] Based on the detected abnormal patterns, the module automatically generates decision suggestions by matching them with a preset decision template: Based on the spatial hotspots, the first template is matched, and the following suggestion is generated: "In the area approximately 20 kilometers south of Guangzhou Baiyun Airport (22.8°–22.9°N, 113.2°–113.3°E), 62 MSAW alarms occurred in the past week, with an average alarm height of 280 meters. The current minimum alarm height threshold is 300 meters. It is recommended to raise the minimum alarm height to 350 meters (equivalent to the average height of 280 meters plus 50 meters, rounded up to the nearest hundred), or to re-verify the terrain database."
[0083] Regarding the anomalies in similar flight numbers during the same time period, the second template was matched to generate the following suggestion: "Similar flight number pair CES123 / CES128 has an average of 7 alarms during the 15:00-16:00 time period every Friday, accounting for 35% of the total alarms for this flight pair. Suggestions: 1) Add channel instructors during this time period; 2) Coordinate with the airline to adjust the time of one of the flights, staggering it by more than 15 minutes; 3) Temporarily increase the alarm sensitivity of similar flight numbers in the air traffic control automation system."
[0084] In response to the QNH sensor anomaly, the third template was matched to generate the following suggestion: "At the approach point DOTMI, QNH inconsistency alarms account for 45% of the total alarms, with 82% of them being too high. It is recommended to check the barometer at this point or check the QNH transition altitude value on the approach chart."
[0085] In response to flight anomalies following the seasonal change, the fourth template was used to generate the following suggestion: "Since March 27, 2026 (the date of the summer / autumn seasonal change), the number of MSAW alarms for flight HNA789 has increased by 267% (from 6 to 22). The approach time for this flight is concentrated between 07:30 and 08:30. It is recommended to coordinate with the airline to appropriately increase the approach altitude or adjust the approach speed to avoid frequently triggering low-altitude alarms."
[0086] After generating the above suggestions, the module calculates a comprehensive score for each suggestion. Taking the first suggestion as an example: the risk level weight is 3 points (high risk), the normalized alarm frequency score is 62 / historical highest frequency 85≈0.73, the number of affected flights score is the number of flights involved 1×0.1=0.1, the total base score is 3.83, after subtracting the estimated implementation difficulty score of 0.5 points, the final score is 3.33 points. After sorting, this suggestion has the highest score and is pushed to the first position in the decision suggestion display area on the platform's homepage.
[0087] Finally, all analysis results are presented to the user through a visualization module.
[0088] Figure 4 This provides an overview of the air traffic control alarm data visualization platform interface. In the offline map heatmap unit 41, the platform renders the latitude and longitude points of all MSAW alarms into a heatmap based on locally stored offline tile maps. For example... Figure 6 As shown, controllers can visually observe a dark red heat signature in an area approximately 20 kilometers south of Guangzhou Baiyun Airport, consistent with the hotspot location identified in the first decision recommendation. Users can click on this hotspot area to drill down and view the detailed list of alerts, their time distribution, and the flight information involved.
[0089] In the related event display unit, the platform presents all generated related event records in a list format. Safety managers can filter by risk level (high / medium / low), time range, and rule type. For example, after filtering for "high risk," all related events such as "high risk of instrument reference failure" and "dual risk of terrain and conflict" are displayed together for easy prioritization.
[0090] In the decision-making suggestions display section, the platform prominently displays a list of decision-making suggestions sorted by priority on the homepage, with each suggestion accompanied by detailed data support and specific actionable measures.
[0091] The air traffic control alarm data visualization method and platform provided by this invention can be widely applied to air traffic management departments, airport operation monitoring centers, and airline safety supervision departments in the civil aviation field. For air traffic control safety management personnel, this application can automatically generate periodic safety analysis reports, quantitatively assess airspace operation risks, and optimize control procedures and sector parameters based on system-generated decision recommendations. For airport operation control centers, this application can be used to focus on monitoring alarms in key arrival and departure areas, particularly identifying systemic risks caused by meteorological equipment, navigation facilities, etc., through correlation analysis, and promptly performing maintenance and calibration. For airline safety management departments, this invention can be used to conduct in-depth analysis of alarm data from their fleets, identify abnormal alarm patterns for specific aircraft types, routes, or personnel, and thus conduct targeted training or optimize operation manuals.
[0092] Furthermore, the application scenarios of this application can be extended to the field of Flight Quality Assurance (FOQA). By applying the method of this invention to out-of-limit events recorded in flight data recorders, adaptive cleaning of massive amounts of flight data, risk event correlation analysis, and intelligent early warning of operational risks can also be achieved. For example, "unstable approach" events can be correlated with "hard landing" events to uncover the causal relationship between the two and provide data support for pilot training. The core idea of this invention is to construct a complete data value chain of "data cleansing - knowledge discovery - decision support," which has good versatility and scalability, and can provide strong technical support for improving the safety management level and operational efficiency in fields such as transportation.
[0093] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method as described in any of the above embodiments. The computer-readable storage medium can be any physical device capable of storing program code, such as a server hard drive, solid-state drive (SSD), USB flash drive, or optical disc.
[0094] The preferred embodiments of this disclosure have been described in detail above with reference to the accompanying drawings. However, this disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this disclosure, various simple modifications can be made to the technical solutions of this disclosure, and these simple modifications all fall within the protection scope of this disclosure.
[0095] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, this disclosure will not describe the various possible combinations separately.
[0096] Furthermore, various different embodiments of this disclosure can be combined in any way, as long as they do not violate the spirit of this disclosure, they should also be regarded as the content disclosed in this disclosure.
Claims
1. An air traffic control alerting data visualization method, characterized by, Includes the following steps: Data cleaning steps: Obtain the original air traffic control alarm logs, sort the alarm records of the same aircraft by time, identify the flight stage corresponding to each alarm record, determine the adaptive deduplication time window based on the flight stage, perform deduplication processing on the alarm records based on the adaptive deduplication time window, and output the deduplicated alarm records. The identification of the flight phase corresponding to each alarm record includes: extracting the aircraft's altitude, vertical speed and ground speed information from the alarm record; and determining, based on the comparison relationship between the altitude and preset altitude thresholds for each flight phase and the comparison relationship between the vertical speed and preset speed thresholds, whether the flight phase corresponding to the alarm record is one of the takeoff phase, climb phase, cruise phase, approach phase or landing phase. Association analysis steps: Convert all types of alarm records after deduplication into event objects. Each event object contains at least the event type, occurrence time, and spatial location information. Within a preset time and space window, event objects are matched pairwise. When the matched event objects meet the preset association rules, an associated event record is generated. The association rules include: when the same aircraft simultaneously generates a low altitude alarm and a pressure inconsistency alarm within a first time threshold, a high-risk association event for instrument reference failure is generated; and / or, when the number of pressure inconsistency alarms occurring at the same airport within a second time threshold reaches a first quantity threshold and the pressure deviation direction of each alarm is consistent, a meteorological data source abnormality association event is generated. Decision suggestion generation steps: Perform multi-dimensional aggregation statistics on the deduplicated alarm records and the associated event records, detect abnormal patterns in the aggregation results, and when the detected abnormal pattern matches the preset decision template, generate decision suggestions based on the decision template; Visualization output steps: The deduplicated alarm records, the associated event records, and the decision suggestions are visualized through the front-end interface. The visualization includes rendering the spatial location of low-altitude alarms into a heat map based on an offline tile map.
2. The method according to claim 1, characterized in that, The determination of the adaptive deduplication time window based on the flight phase specifically includes: The basic time window is allocated according to the flight phase: the takeoff and landing phases are the first basic window value, the climb and approach phases are the second basic window value, and the cruise phase is the third basic window value; the first basic window value is greater than the second basic window value, and the second basic window value is greater than the third basic window value; The number of alarms issued by the aircraft within a preset time period is counted, and the basic time window is reduced based on the number of alarms. The higher the number of alarms, the greater the reduction ratio. A lower limit value for the adaptive deduplication time window is also set. When the aircraft is in the flight phase transition period, the adaptive deduplication time window takes the larger value between the base time windows of the pre-transition phase and the post-transition phase.
3. The method according to claim 2, characterized in that, The deduplication process for alarm records based on the adaptive deduplication time window specifically includes: The time difference between the current alarm record and the previous retained alarm record is compared with the adaptive deduplication time window, and the height difference between the current alarm record and the previous retained alarm record is calculated. When the time difference is less than or equal to the adaptive deduplication time window and the height difference is less than or equal to the height difference threshold, the current alarm record is determined to be a duplicate alarm and discarded; otherwise, the current alarm record is retained.
4. The method according to claim 1, characterized in that, The step of matching event objects pairwise within a preset time-space window specifically includes: Sort all event objects by time, and use a two-pointer sliding window to traverse the event pairs within the preset time-space window; For each pair of events within the window, determine whether the time difference is less than or equal to the time threshold, and determine whether the spatial distance is less than or equal to the spatial threshold; The association rule is matched only for event pairs that simultaneously satisfy the time threshold and the spatial threshold.
5. The method according to claim 1, characterized in that, The association rules also include at least one of the following: Third rule: When the same aircraft simultaneously generates low altitude alarm and short-term conflict alarm within a preset spatial radius and a third time threshold, a dual risk-related event of terrain and conflict is generated. Fourth rule: When either of a pair of similar flight numbers triggers a low altitude alarm or a short-term conflict alarm within the fourth time threshold, an operational risk association event induced by confusion is generated.
6. The method according to claim 1, characterized in that, The multi-dimensional aggregated statistics include spatial, temporal, flight, and correlation dimensions. The spatial dimension involves dividing the airspace into grids and counting the number of alarms and the average altitude within each grid. The temporal dimension counts alarm frequencies by hour and / or week to identify peak alarm periods. The flight dimension counts the alarm frequency for each flight number or flight pair and compares it with the average of all flights. The correlation dimension counts the occurrence frequency of each correlation rule.
7. The method according to claim 6, characterized in that, The abnormal patterns in the detected aggregation results specifically include at least one of the following: Spatial hotspot detection: Density clustering algorithm is used to identify spatial clusters with dense alarms. When the number of alarm points in a cluster exceeds the second quantity threshold and the difference between the average alarm height and the preset alarm threshold is less than the difference threshold, it is determined to be a candidate hotspot. Time-period anomaly detection: The alarm frequency of the current time period is compared with the mean and standard deviation of the same period in history. When the current alarm frequency exceeds the sum of the multiples of the mean and standard deviation, it is judged as an abnormal peak. Flight anomaly detection: When the frequency of flight alarms exceeds a multiple threshold of the average frequency of all flights, or when the alarm frequency increases by more than a percentage threshold after the seasonal change compared to before the seasonal change, it is judged as a flight anomaly. Frequent occurrence detection of associated events: Identify association rules that are significantly higher than historical levels using the chi-square test.
8. The method according to claim 1, characterized in that, The decision template includes at least one of the following: First template: When a spatial hotspot is detected and the average alarm height is close to the preset alarm threshold, generate parameter adjustment suggestions including the hotspot area range, alarm count, average height, and recommended alarm height adjustment value; Second template: When the frequency of alarms for similar flight number pairs exceeds the third quantity threshold during a specific time period, generate an early warning suggestion that includes flight number, time period, number of alarms and time period adjustment suggestions; The third template: When the percentage of approach pressure inconsistency alarms exceeds the percentage threshold and the deviation direction is consistent, generate sensor calibration suggestions that include the approach name, percentage, and calibration recommendations. Fourth template: When the alarm frequency increases beyond the percentage threshold after the flight seasonal change, generate flight plan adjustment suggestions including flight number, growth rate and operational parameter adjustment suggestions; It also includes a suggestion priority ranking step: calculate a comprehensive score for each generated decision suggestion. The comprehensive score is calculated based on the risk level weight, alarm frequency and the number of affected flights. The decision suggestions with the highest scores are displayed first.
9. An air traffic control alarm data visualization platform, characterized in that, include: The data cleaning module is used to acquire the original air traffic control alarm logs, sort the alarm records of the same aircraft by time, identify the flight stage corresponding to each alarm record, determine the adaptive deduplication time window based on the flight stage, perform deduplication processing on the alarm records based on the adaptive deduplication time window, and output the deduplicated alarm records. The correlation analysis module is used to convert all types of alarm records after deduplication into event objects. The event objects contain at least event type, occurrence time and spatial location information. The module performs pairwise matching of event objects within a preset spatiotemporal window. When the matched event pairs meet the preset correlation rules, a correlation event record is generated. The decision suggestion generation module is used to perform multi-dimensional aggregation statistics on the deduplicated alarm records and the associated event records, detect abnormal patterns in the aggregation results, and generate decision suggestions based on the decision template when the detected abnormal pattern matches the preset decision template. The visualization module is used to visualize the deduplicated alarm records, the associated event records, and the decision suggestions through the front-end interface. The visualization module includes an offline map heatmap unit and a decision suggestion display unit. The offline map heatmap unit is used to render the spatial location of low-height alarms into a heatmap based on an offline tile map. The decision suggestion display unit is used to display a list of decision suggestions sorted by priority.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the air traffic control alarm data visualization method as described in any one of claims 1 to 8.