A power supply test data security analysis method based on machine learning

Abstract

The application discloses a kind of power supply test data security analysis methods based on machine learning, it is related to machine learning technical field, including: acquisition power supply test multi-source data, pre-processing generates test data load package;Fragment fingerprint matrix is constructed, and trusted check result is generated;Improved sparse mixed expert model is constructed, and risk discrimination conclusion set is obtained;Trajectory aggregation is carried out, and test data marshalling is obtained;Conditional independence test is executed, and factor correlation evidence record is output;Establish evidence connection index, generate risk conclusion object and anchor chain type storage data;Complete integrity check registration, and generate disposal instruction.The application realizes the safe abnormal accurate identification of power supply test data by combining improved sparse mixed expert model safety discrimination and conditional independence test.

Description

Technical Field

[0001] This invention relates to the field of machine learning technology, and in particular to a method for security analysis of power supply test data based on machine learning. Background Technology

[0002] During the R&D verification, mass production, and reliability testing of existing power supply products, a large amount of test data is generated, including voltage and current waveforms, ripple noise spectra, and transient responses. This data is accompanied by multi-source information related to workstations, instruments, formulations, batches, and operator permissions. Currently, this data typically originates from various devices and platforms, such as oscilloscopes, power analyzers, electronic loads, data acquisition cards, and test management systems. The data format includes both high-frequency sampled continuous waveforms and discrete test points and process logs recorded step by step. Due to the diverse test conditions, significant batch differences, and frequent changes in instrument and tooling status, the same indicator exhibits statistical fluctuations and temporal drift under different scenarios. Traditional methods relying on fixed rules, single-point verification, or manual sampling are insufficient to accurately distinguish between normal fluctuations and safety anomalies in the context of complex fluctuations. Power supply test data may be subject to anomalies such as tampering, forgery, replay, or unauthorized operations during the acquisition, transmission, storage, and retrieval stages. Existing methods often only perform partial checks on data content or single-stage logs, lacking cross-stage and cross-object consistency verification and mutual corroboration methods. As a result, once an anomaly occurs, it is difficult to quickly locate the stage where the anomaly occurred, the scope of impact, and the associated workstations, instruments, and accounts, thereby affecting the efficiency of production line handling and the accuracy of quality traceability.

[0003] While some machine learning-based anomaly detection methods can identify anomalies from the perspective of data distribution or feature patterns, they still have shortcomings in power supply testing scenarios. The models are sensitive to distribution drift across workstations, instruments, and batches, and are prone to problems such as unstable model routing, unreproducible or insufficiently interpretable discrimination results, making it difficult to meet the real-time requirements of production lines and engineering deployment. Existing solutions usually separate trusted verification from model discrimination, lacking a unified framework for structurally associating and solidifying the model output, operational evidence, and link verification results. This makes it difficult to support retesting, accountability tracking, and audit review, resulting in the inability to provide an auditable and traceable chain of evidence in quality disputes or safety incidents.

[0004] Therefore, how to provide a machine learning-based method for the safe analysis of power supply test data is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a machine learning-based method for power supply test data security analysis. This invention comprehensively utilizes multi-source data preprocessing for power supply testing, end-to-end reliable verification, and an improved sparse hybrid expert model for discrimination and conditional independence test evidence generation. It fully describes the process from multi-source data acquisition and payload encapsulation in power supply testing, fragment fingerprint matrix construction and circular cross-play comparison and verification, risk discrimination conclusion set generation, trajectory aggregation and hierarchical stripping to form test data groups, complementary frequency band decomposition and bidirectional test output factor correlation evidence, to multi-level frozen anchor zones and evidence linking index generation of anchor chains. The entire process of storing evidence data and outputting disposal instructions is demonstrated. In terms of model structure, it innovatively sets up an asynchronous shadow snapshot evaluation module, an instantaneous copy decoupling module, and a trusted watermark integration module. In terms of statistical evidence structure, it innovatively adopts staggered spectrum projection and bidirectional mirror verification chain to achieve accurate identification and interpretable output of security anomalies introduced by tampering, forgery, replay, and unauthorized introduction under multiple operating conditions, multiple batches, and cross-instrument fluctuation backgrounds. It forms a solidifiable, auditable, and traceable evidence chain closed loop. Compared with existing technologies, it has the advantages of high identification accuracy, strong resistance to scene drift, fine audit traceability granularity, and easy engineering deployment.

[0006] A power supply test data security analysis method based on machine learning according to an embodiment of the present invention includes: Collect multi-source power supply test data, preprocess the multi-source power supply test data, and generate test data payload packets; A fragment fingerprint matrix is ​​constructed and attached to the test data payload. A circular cross-playback mechanism is used for comparison and verification to generate a reliable verification result. An improved sparse hybrid expert model is constructed, and security judgment is made based on test data payload packets and trusted verification results. Silent evaluation is performed based on the asynchronous shadow snapshot evaluation module and the route availability set is corrected. An instantaneous replica decoupling module is introduced to perform expert reasoning. A trusted watermark integration module is used to generate associated watermarks and obtain a risk judgment conclusion set. Trajectory aggregation is performed on the risk assessment conclusion set, and the data is compressed step by step using a hierarchical stripping method to obtain the test data group; The test data are grouped and subjected to conditional independence tests. Complementary frequency bands are decomposed based on staggered spectrum projection pairs. Bi-directional tests are performed through a bi-directional mirror test chain, and evidence records of factor correlation are output. Based on the credible verification results and the evidence records related to the factors, the data is written into the multi-level frozen anchor area according to the risk level, an evidence link index is established, and risk conclusion objects and anchor chain-style evidence storage data are generated. Anchor chain-style evidence data is written into the audit storage, integrity verification registration is completed, and disposal instructions are generated based on the risk conclusion objects.

[0007] Optionally, the power supply test multi-source data includes voltage and current waveform data, ripple noise spectrum data, transient response process data, test station instrument metadata, test formula batch metadata, and account permission operation log data.

[0008] Optionally, the generation of the test data payload package includes: Acquire voltage and current waveform data, ripple noise spectrum data, transient response process data, test station instrument metadata, test formula batch metadata, and account permission operation log data corresponding to the same power supply test, and write a unified test task identifier and acquisition time stamp for each data item; Data preprocessing is performed on multi-source power supply test data. Data preprocessing includes missing value imputation, outlier removal, unit and dimension unification, sampling rate unification, time axis alignment, spectrum axis alignment, test step alignment, and feature extraction. Feature extraction includes segmenting voltage and current waveform data and transient response process data by time window and extracting time domain statistics and rate of change features; segmenting ripple noise spectrum data by frequency band and extracting frequency domain energy features and peak frequency features; and encoding test station instrument metadata, test formula batch metadata, and account permission operation log data into discrete identifier features and sequence event features. The preprocessed multi-source features are encapsulated according to the payload packet structure, which includes a signal feature area, a metadata feature area, a log feature area, and an index area. The index area records the test task identifier, acquisition time stamp, data source identifier, and feature area offset information to generate a test data payload packet.

[0009] Optionally, generating a trusted verification result includes: The test data payload is divided into data fragments according to the fragmentation rules. Each data fragment is written with a fragment number and a stage identifier. The stage identifier indicates the acquisition stage, transmission stage, storage stage, and retrieval stage. At each stage, a random number is generated on-site for the current stage. This number is then combined with the fragment number, stage identifier, and data fragment content to form a fragment fingerprint matrix. The fragment fingerprint matrix is ​​then attached to the test data payload. A circular cross-playback mechanism is used to compare and verify the fragment fingerprint matrix of adjacent steps. The fragment fingerprint matrix generated for each step is replayed and compared. A reliable verification result is generated based on the matching result of each comparison. The reliable verification result includes the step consistency identifier, the fragment consistency identifier and the replay comparison sequence number.

[0010] Optionally, the obtained risk discrimination conclusion set includes: An improved sparse hybrid expert model is constructed. The improved sparse hybrid expert model adds an asynchronous shadow snapshot evaluation module, an instantaneous replica decoupling module, and a trusted watermark integration module on the basis of the gated routing unit, expert inference unit, and aggregate output unit of the original sparse hybrid expert model. The asynchronous shadow snapshot evaluation module is set as an evaluation branch in parallel with the gated routing unit and establishes a route availability set interface with the gated routing unit. The instantaneous replica decoupling module is set in the scheduling layer of the expert inference unit and establishes a temporary replica creation interface with the expert inference unit. The trusted watermark integration module is set as the output side of the aggregate output unit and establishes a watermark writing interface with the aggregate output unit. The asynchronous shadow snapshot evaluation module generates parameter snapshot copies for each expert inference unit, calls the comparison evaluation subset in the asynchronous channel to perform silent evaluation, and generates expert validity identifiers and route availability sets based on the silent evaluation results; After receiving the available route set, the gated routing unit determines the selected expert set within the available route set based on the test data payload packet and the trusted verification result, and outputs the route trajectory. The instantaneous replica decoupling module creates a read-only shared weight temporary replica of the expert inference unit based on the selected expert set, executes expert inference in parallel, and obtains the expert output set corresponding to the route trajectory. After receiving the expert output set, the aggregation output unit aggregates and generates risk discrimination, and generates model output records. The trusted watermark integration module extracts the test task identifier, trusted verification result, route trajectory and selected expert set identifier from the model output records, concatenates them in order to form a watermark field sequence, generates a watermark code through a fixed-length mapping function, and writes it into the model output record to obtain a risk discrimination conclusion set containing risk discrimination output, route trajectory and watermark code. The improved sparse hybrid expert model is trained by constructing a training sample set, which is then divided into a training subset and a control evaluation subset. The training subset is used to perform iterative training on the gated routing unit, expert inference unit, and aggregation output unit, and the parameters of each expert inference unit are updated in each iteration. The control evaluation subset is used to perform silent evaluation on the asynchronous shadow snapshot evaluation module and update the available routing set. The training subset is used to perform temporary replica scheduling training on the instantaneous replica decoupling module and update the scheduling parameters. The training subset is used to perform watermark field sequence generation training on the trusted watermark integration module and solidify the field sequence and fixed-length mapping function.

[0011] Optionally, the process of obtaining the test data grouping includes: Extract the test task identifier, test data payload packet identifier, routing trajectory, anomaly type and risk score corresponding to high-risk conclusions from the risk judgment conclusion set. Group the high-risk conclusions according to the routing trajectory within the length time window to obtain a set of expert sequence fragments sorted by expert identifier. For each set of expert sequence segments, the adjacent differences are calculated to generate a conflict intensity vector. Based on the conflict intensity vector and the occurrence time difference corresponding to each adjacent difference, a priority queue of variables to be tested is generated. An initial condition set is constructed and a hierarchical stripping process is performed. The hierarchical stripping process involves removing one condition variable from the initial condition set one by one in the stripping order. After each removal, the corresponding variable and time index in the priority queue of the variable to be tested are retained until the final condition set is formed. Based on the final condition set and the priority queue of the variable to be tested, a test data group with time index is generated.

[0012] Optionally, the output factor correlation evidence record includes: From the test data grouping, determine the set of variables to be tested, the risk variables and the condition set, and align the set of variables to be tested, the risk variables and the condition set according to the same time index to form a test triplet sequence; Based on the interleaved spectrum projection, the test triplet sequence is decomposed into complementary frequency bands. The first projection mapping and the second projection mapping are performed on the feature sequences of the set of variables to be tested and the risk variables, respectively, to obtain the first projection pair and the second projection pair. Based on the bidirectional mirror test chain, bidirectional tests are performed on the first projection pair and the second projection pair respectively. The test statistic and the significance probability of the first direction are calculated under a given set of conditions, with the set of variables to be tested as the independent variable and the risk variable as the dependent variable. The test statistic and the significance probability of the second direction are calculated under a given set of conditions, with the risk variable as the independent variable and the set of variables to be tested as the dependent variable, and a directional consistency record is generated. Factor correlation evidence records are generated based on directional consistency records. These records include probability sequences, test statistic sequences, condition set identifiers, projection pair identifiers, and time indexes corresponding to each variable in the set of variables to be tested.

[0013] Optionally, the generated risk conclusion object and anchor-chain-style evidence storage data include: Obtain credible verification results, watermarked model output records, and factor correlation evidence records; extract test task identifiers, test data payload packet identifiers, test statistic sequences, condition set identifiers, projection pair identifiers, and time indexes; and generate a set of evidence entries. The evidence set is divided into multi-level evidence sets according to the risk level and written into the corresponding multi-level frozen anchor area. The multi-level frozen anchor areas are arranged in ascending order of anchor area number. Each frozen anchor area records the start number, end number and offset difference with the previous frozen anchor area of ​​the current level evidence set. In each frozen anchor area, an evidence link index is established according to the order in which the evidence items are generated, and the credible verification results, model output records and factor correlation evidence records under the same test task identifier are associated. Risk conclusion objects are generated based on multi-level frozen anchor zones and evidence linking indexes, and anchor chain-style evidence storage data is generated based on risk conclusion objects and multi-level frozen anchor zones.

[0014] Optionally, the completion of integrity verification registration and the generation of disposal instructions based on the risk conclusion object include: Receive anchor chain-style evidence data and write it into the audit storage area in the order of generation time. The audit storage area is indexed with the test task identifier as the primary key, and records the corresponding anchor area sequence number, evidence item sequence number range and evidence link index. Perform integrity verification registration on the anchor chain-style evidence data written to the audit storage area, read the start number, end number and offset difference of each frozen anchor area in the anchor chain-style evidence data and verify the incremental relationship of the anchor area number, read the evidence link index and verify the continuous relationship of the evidence item number under the same test task identifier, generate registration records and write them to the audit storage area. Based on the risk conclusion, disposal instructions are generated and output. The disposal instructions include retest instructions, data isolation instructions, permission disposal instructions, and traceability instructions. The retest instructions include test task identifier, retest workstation identifier, and retest recipe version identifier. The data isolation instructions include test data payload package identifier and isolation range identifier. The permission disposal instructions include account identifier, permission type identifier, and disposal time stamp. The traceability instructions include test task identifier, anchor zone sequence number, and evidence item sequence number range.

[0015] The beneficial effects of this invention are: This invention enhances the ability to identify anomalies such as test data tampering, forgery, replay, and unauthorized introduction under multi-condition, multi-batch, and cross-instrument fluctuation backgrounds by unifying the load encapsulation of multi-source power supply test data, performing full-process reliable verification through fragment fingerprint matrix and ring cross-playback comparison, and improving the security discrimination of sparse hybrid expert models. Compared with existing detection methods that rely on single-point verification or empirical rules, this invention uses an asynchronous shadow snapshot evaluation module to silently evaluate the expert state to correct the available route set, uses an instantaneous copy decoupling module to execute expert inference in parallel during the inference phase to ensure the real-time performance of the production line, and uses a reliable watermark integration module to associate the reliable verification results with the route trajectory and write them into the model output record, thereby improving the accuracy, stability, and interpretability of risk discrimination conclusions.

[0016] This invention forms test data groups through trajectory aggregation and layered stripping, and generates factor correlation evidence records through complementary frequency band decomposition of staggered spectrum projection and bidirectional verification of bidirectional mirror test chains. This transforms model discrimination results into verifiable statistical evidence to support anomaly attribution and accountability. The invention writes credible verification results, model output records, and factor correlation evidence records into multi-level frozen anchor zones according to risk level and establishes an evidence link index, generating anchor chain-style evidence storage data and completing integrity verification registration. This forms a closed-loop evidence chain that is solidifiable, auditable, and traceable, overcoming the problems of scattered evidence, difficulty in playback, and difficulty in coordinated handling in existing technologies. It improves the engineering feasibility and closed-loop management efficiency of retesting, data isolation, and access control. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a power supply test data security analysis method based on machine learning proposed in this invention; Figure 2 This is a block diagram of the improved sparse hybrid expert model for a power supply test data security analysis method based on machine learning proposed in this invention. Figure 3 This is a functional diagram illustrating the conditional independence test of a power supply test data security analysis method based on machine learning proposed in this invention. Detailed Implementation

[0018] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0019] refer to Figure 1 , Figure 2 and Figure 3 A machine learning-based method for security analysis of power supply test data includes: Collect multi-source power supply test data, preprocess the multi-source power supply test data, and generate test data payload packets; A fragment fingerprint matrix is ​​constructed and attached to the test data payload. A circular cross-playback mechanism is used for comparison and verification to generate a reliable verification result. An improved sparse hybrid expert model is constructed, and security judgment is made based on test data payload packets and trusted verification results. Silent evaluation is performed based on the asynchronous shadow snapshot evaluation module and the route availability set is corrected. An instantaneous replica decoupling module is introduced to perform expert reasoning. A trusted watermark integration module is used to generate associated watermarks and obtain a risk judgment conclusion set. Trajectory aggregation is performed on the risk assessment conclusion set, and the data is compressed step by step using a hierarchical stripping method to obtain the test data group; The test data are grouped and subjected to conditional independence tests. Complementary frequency bands are decomposed based on staggered spectrum projection pairs. Bi-directional tests are performed through a bi-directional mirror test chain, and evidence records of factor correlation are output. Based on the credible verification results and the evidence records related to the factors, the data is written into the multi-level frozen anchor area according to the risk level, an evidence link index is established, and risk conclusion objects and anchor chain-style evidence storage data are generated. Anchor chain-style evidence data is written into the audit storage, integrity verification registration is completed, and disposal instructions are generated based on the risk conclusion objects.

[0020] In this embodiment, the power supply test multi-source data includes voltage and current waveform data, ripple noise spectrum data, transient response process data, test station instrument metadata, test formula batch metadata, and account permission operation log data.

[0021] In this embodiment, generating the test data payload includes: Acquire voltage and current waveform data, ripple noise spectrum data, transient response process data, test station instrument metadata, test formula batch metadata, and account permission operation log data corresponding to the same power supply test, and write a unified test task identifier and acquisition time stamp for each data item; Data preprocessing is performed on multi-source power supply test data. This preprocessing includes missing value imputation, outlier removal, unit and dimension unification, sampling rate unification, time axis alignment, spectrum axis alignment, test step alignment, and feature extraction. Feature extraction includes segmenting voltage and current waveform data and transient response data by time windows and extracting time-domain statistics and rate of change features; segmenting ripple noise spectrum data by frequency bands and extracting frequency-domain energy features and peak frequency features; and encoding test station instrument metadata, test formula batch metadata, and account permission operation log data into discrete identifier features and sequential event features. The voltage and current waveform data and transient response data are segmented by time window, and time-domain statistics and rate of change features are extracted. Specifically, the voltage and current waveforms are sampled at a unified rate and sorted by time. A sliding time window is used for segmentation with a time window length of 10 milliseconds and a window shift of 5 milliseconds. For each window, the mean, standard deviation, maximum value, minimum value, peak-to-peak value, and root mean square value are calculated. The rate of change is obtained by dividing the difference between adjacent sampling points by the sampling interval to obtain the rate of change sequence. The maximum value, minimum value, and mean value are taken. The transient response is triggered at the moment when the current change amplitude is the largest. The segment before the trigger point and the segment after the trigger point are extracted. The steady-state value is the average value of the last 5 milliseconds. The overshoot amplitude, undershoot amplitude, rise time, and set time are calculated. The set bandwidth is ±2% of the steady-state value, and the set hold time is 5 milliseconds. The ripple noise spectrum data is segmented by frequency band and frequency domain energy features and peak frequency features are extracted. Specifically, the frequency axis of the spectrum is unified to a fixed resolution grid and missing frequency points are interpolated. The frequency bands are divided into 20 Hz to 200 Hz and 200 Hz to 2000 Hz. The energy of each frequency band is obtained by summing the squares of the amplitudes of each frequency point in the current segment and multiplying by the frequency resolution. The main peak frequency and main peak amplitude are extracted for each frequency band, and the top 3 local peak frequencies and amplitudes are extracted. The interval between adjacent local peaks is not less than 1% of the total bandwidth of the frequency band. The metadata of test station instruments, test formula batches, and account permission operation logs are encoded into discrete identifier features and sequence event features. Specifically, a field dictionary is created for station number, instrument number, tooling number, firmware version, and batch number and mapped to integer numbers. This is then converted into a 32-bit binary vector, padded with 0s if necessary. Calibration status and permission level are encoded using an 8-level system, mapped to 1 to 8. Operation logs are sorted by time, and event types include login, formula change, start, stop, and permission change. Each event is encoded as an event type number, the millisecond difference relative to the test start time, and an object identifier. The event sequence has a fixed length of 64 and is written into the test data payload. The preprocessed multi-source features are encapsulated according to the payload packet structure, which includes a signal feature area, a metadata feature area, a log feature area, and an index area. The index area records the test task identifier, acquisition time stamp, data source identifier, and feature area offset information to generate a test data payload packet.

[0022] In this embodiment, generating a reliable verification result includes: The test data payload is divided into data fragments according to fragmentation rules. Each data fragment is assigned a fragment number and a stage identifier. The stage identifier indicates the acquisition stage, transmission stage, storage stage, and retrieval stage. Specifically, the data fragmentation of the test data payload according to the fragmentation rules is as follows: The structure is divided into signal feature area, metadata feature area, log feature area and index area. Only the first three areas are fragmented. The index area is a separate index fragment. The signal feature area is divided into signal fragments by time windows. If the fragment length exceeds 4096 bytes, it is further divided in 4096-byte order. The metadata feature area is divided into metadata fragments by fields. Every 16 fields form a metadata fragment. If there are fewer than 16 fields, it is a separate fragment. The log feature area is divided into log fragments by events. Every 8 events form a log fragment. If there are fewer than 8 events, it is a separate fragment. The fragment number is written in ascending order from 1 according to the order of appearance. Each stage writes the current stage identifier to all fragments to indicate collection, transmission, storage or retrieval. At each stage, a random number is generated on-site for that stage. This number is then combined with the fragment number, stage identifier, and data fragment content to form a fragment fingerprint matrix. This fragment fingerprint matrix is ​​then appended to the test data payload. In each stage, a random number is generated on-site. Specifically, when each stage of acquisition, transmission, storage and retrieval enters processing, the stage identifier, test task identifier and processing start timestamp of this stage are read first. The unique identifier of the device on the stage side is read. A 32-byte random sequence is obtained from the random source of the operating system as the basic random source. The basic random source is concatenated with the test task identifier, device unique identifier, stage identifier and timestamp in a fixed order and then compressed and mapped to a fixed length. The output is a random number on-site with a length of 16 bytes. If the random number generated by the same test task identifier in the same stage is repeated, the basic random source is obtained again from the random source and regenerated. The fragment fingerprint matrix is ​​formed as follows: All data fragments in the same test data payload package within the stage are sorted by fragment number. For each data fragment, its content byte sequence is extracted and a fixed-length digest value is calculated. The digest value length is set to 32 bytes. The random number on site, fragment number, and stage identifier are encoded into fixed-length byte fields respectively. These fields are then concatenated with the fragment digest value in the field order to form a fingerprint row. All fingerprint rows corresponding to the fragments are stacked in ascending order of fragment number to form a fragment fingerprint matrix. The number of rows in the matrix is ​​equal to the number of fragments, and the column direction is the byte position of the fingerprint row. The fragment fingerprint matrix is ​​written into the test data payload package as additional data for this stage. The starting offset and length of the fragment fingerprint matrix are registered in the index area. A circular cross-playback mechanism is used to compare and verify the fragment fingerprint matrices of adjacent stages. The fragment fingerprint matrix generated for each stage is replayed and compared. A reliable verification result is generated based on the matching results of each comparison. The reliable verification result includes a stage consistency identifier, a fragment consistency identifier, and a replay comparison sequence number. Specifically, the circular cross-playback mechanism for comparing and verifying the fragment fingerprint matrices of adjacent stages is as follows: The four stages of acquisition, transmission, storage, and retrieval are arranged in sequence to form a playback loop. After generating the fragment fingerprint matrix for this stage, each stage reads the fragment fingerprint matrix of the adjacent previous stage and performs a row-by-row comparison. The row-by-row comparison includes three checks: checking whether the fragment sequence number is consistent with the row number. If they are inconsistent, the fragment consistency flag is recorded as inconsistent. When the sequence numbers are consistent, the fingerprint rows corresponding to the same fragment sequence number are compared byte by byte, and the proportion of inconsistent bytes to the total number of bytes in the fingerprint row is calculated as the row difference rate. If the row difference rate of any fingerprint row is greater than 0, the fragment consistency flag is recorded as inconsistent. When the row difference rate of all fingerprint rows is equal to 0, the fragment consistency flag is recorded as consistent. At the same time, it is checked whether the intra-loop adjacency relationship between the flag of the previous stage and the flag of the current stage satisfies the sequence of acquisition to transmission, transmission to storage, storage to retrieval, and retrieval to acquisition. If it satisfies the sequence, the stage consistency flag is recorded as consistent; otherwise, the stage consistency flag is recorded as inconsistent. The playback comparison sequence number is generated starting from 1 and incremented for each comparison and written into the trusted verification result.

[0023] In this embodiment, obtaining the risk discrimination conclusion set includes: An improved sparse hybrid expert model is constructed. The improved sparse hybrid expert model adds an asynchronous shadow snapshot evaluation module, an instantaneous replica decoupling module, and a trusted watermark integration module on the basis of the gated routing unit, expert inference unit, and aggregate output unit of the original sparse hybrid expert model. The asynchronous shadow snapshot evaluation module is set as an evaluation branch in parallel with the gated routing unit and establishes a route availability set interface with the gated routing unit. The instantaneous replica decoupling module is set in the scheduling layer of the expert inference unit and establishes a temporary replica creation interface with the expert inference unit. The trusted watermark integration module is set as the output side of the aggregate output unit and establishes a watermark writing interface with the aggregate output unit. The asynchronous shadow snapshot evaluation module generates parameter snapshot copies for each expert inference unit. A silent evaluation is performed by calling the control evaluation subset in the asynchronous channel. Based on the silent evaluation results, expert validity identifiers are generated, and a set of available routes is generated, where: Silent evaluation is performed by calling the control evaluation subset in the asynchronous channel. Specifically, an independent evaluation task queue and computation thread are created for each expert inference unit. The evaluation task is triggered once by the main training process after updating the parameters of every 200 training samples. When triggered, the current parameters of the expert inference unit are copied to form a parameter snapshot copy. The identifier of the parameter snapshot copy is written to the evaluation task queue. The evaluation thread evenly extracts 256 evaluation samples from the control evaluation subset according to the test task identifier. The test data payload and confidence verification result of each evaluation sample are input into the parameter snapshot copy for inference. The risk score and anomaly type in the inference output are recorded and compared with the labeled results of the evaluation samples. The entire evaluation process does not participate in the training gradient calculation and does not write back the expert parameters. It only outputs the evaluation statistics to the evaluation result buffer. Based on the silent evaluation results, expert validity identifiers are generated and a route availability set is generated. Specifically, a consistency score is calculated for the evaluation statistics obtained from each silent evaluation. The consistency score is the number of samples in the evaluation sample whose predicted anomaly type matches the labeled anomaly type divided by 256. At the same time, a stability score is calculated. The stability score is the average of the absolute values ​​of the difference in risk scores of the same evaluation sample in two consecutive silent evaluations, and the opposite number is taken as the stability index. Experts with a consistency score of not less than 0.9 and a stability index of not more than 0.05 are marked as valid, and their expert validity identifiers are generated as valid identifiers. Otherwise, they are generated as invalid identifiers. The set of expert numbers with valid identifiers is combined into a route availability set. The consistency score and stability index corresponding to each expert are appended to the route availability set. After receiving the available route set, the gated routing unit determines the selected expert set within the available route set based on the test data payload packet and the trust verification result, and outputs the route trajectory. The instantaneous replica decoupling module creates a read-only shared weight temporary replica of the expert inference unit based on the selected expert set, and performs expert inference in parallel to obtain the expert output set corresponding to the route trajectory. Specifically, the parallel execution of expert inference to obtain the expert output set corresponding to the route trajectory is as follows: The gated routing unit selects two experts for each test data payload packet within the available routing set to form a selected expert set, generating a routing trajectory. The routing trajectory records the test task identifier, the selected expert number, and the sequence number. The instantaneous replica decoupling module assigns an independent inference task to each expert inference unit in the selected expert set and submits it to the parallel execution queue. If the number of pending tasks for the same expert in the same time period reaches 64, a read-only shared weight temporary replica of the expert is created, and the tasks are diverted to the temporary replica. Each inference task takes the signal feature area, metadata feature area, log feature area, and trusted verification result of the test data payload packet as input, calls the corresponding expert to complete a forward inference, and outputs the expert's risk score vector and anomaly type vector. The instantaneous replica decoupling module collects the inference results according to the expert sequence number of the routing trajectory and aligns the sequence numbers to form an expert output set. The expert output set contains the expert number, expert output, and completion time stamp corresponding to each routing trajectory. After receiving the expert output set, the aggregation output unit aggregates and generates risk discrimination, and generates model output records. The trusted watermarking module extracts the test task identifier, trusted verification result, route trajectory, and selected expert set identifier from the model output records, concatenates them in order to form a watermark field sequence, generates a watermark code through a fixed-length mapping function, and writes it into the model output record, thus obtaining a risk discrimination conclusion set containing risk discrimination output, route trajectory, and watermark code, where: The process involves aggregating and generating risk assessment data, and then generating model output records. Specifically, the two expert outputs corresponding to each route trajectory are first standardized. The risk score vectors and anomaly type vectors of each expert output are aligned to a unified set of anomaly types. The aggregation output unit reads the two expert weight coefficients generated by the gated routing unit for the route trajectory. The risk score vectors of the two experts are then summed element-wise according to the weight coefficients to obtain the aggregated risk score vector. The anomaly type vectors of the two experts are then summed element-wise according to the weight coefficients to obtain the aggregated anomaly type vector. The anomaly type with the largest value in the aggregated anomaly type vector is used as the anomaly type for risk assessment. The maximum value of the aggregated risk score vector is used as the risk score for risk assessment. The risk score is mapped to a risk level, which is divided into three levels: a risk score less than 0.4 indicates low risk, a risk score not less than 0.4 and less than 0.7 indicates medium risk, and a risk score not less than 0.7 indicates high risk. The watermark field sequence is generated into a watermark code using a fixed-length mapping function. Specifically, the aggregation output unit creates model output record entries with the test task identifier as the index. The risk score, risk level, anomaly type, aggregated risk score vector, aggregated anomaly type vector, route trajectory, selected expert number, expert weight coefficient, completion time stamp of each expert's output, and link consistency identifier, fragment consistency identifier and playback comparison sequence number in the trusted verification results are written into the model output record entries. The model output record entries are written into the model output record set in the order of generation time. An incremental record number is assigned to each record. At the same time, the field position and writing position of the watermark field sequence are recorded in the record. An improved sparse hybrid expert model is trained by constructing a training sample set, which is then divided into a training subset and a control / evaluation subset. The training subset is used to iteratively train the gated routing unit, expert inference unit, and aggregation output unit, updating the parameters of each expert inference unit in each iteration. The control / evaluation subset is used to perform silent evaluation on the asynchronous shadow snapshot evaluation module, updating the available route set. The training subset is used to train the transient replica decoupling module for temporary replica scheduling, updating the scheduling parameters. The training subset is used to train the trusted watermark integration module for watermark field sequence generation, solidifying the field sequence and the fixed-length mapping function. Specifically, the improved sparse hybrid expert model is trained as follows: A training sample set is constructed, consisting of test data payloads, reliable verification results, and annotation information. The annotation information includes anomaly type annotations and risk score annotations. Anomaly type annotations are generated from confirmed tampering, forgery, replay, and unauthorized event records and retest conclusions. Risk score annotations are mapped to three levels: low, medium, and high, at 0.20, 0.55, and 0.85. The training samples are stratified by product model and batch and divided into training subsets and control evaluation subsets at a ratio of 7:3. Iterative training is performed using a batch size of 256. Each batch of samples is input into the gated routing unit to generate a set of selected experts and a routing trajectory. The instantaneous replica decoupling module is called to execute expert inference in parallel to obtain the expert output set. The aggregated output unit generates risk discrimination output and calculates the training loss with the annotations. The training loss is obtained by adding the squared error of the risk score and the cross-entropy of the anomaly type. The learning rate is set to 0.001 and backpropagation is performed to update the parameters of the gated routing unit, expert inference unit and aggregation output unit. The asynchronous shadow snapshot evaluation module is triggered every 200 samples. 256 samples are extracted from the comparison evaluation subset to perform silent evaluation and update the available routing set. The instantaneous replica decoupling module records the number of expert tasks and waiting time during training and fixes the temporary replica creation condition as the number of tasks reaches 64 and the waiting time reaches 20 milliseconds. The trusted watermarking integration module fixes the field order and fixes the fixed-length mapping output length to 16 bytes during training, resulting in the improved sparse hybrid expert model after training.

[0024] In this embodiment, obtaining the test data grouping includes: From the risk assessment conclusion set, extract the test task identifier, test data payload packet identifier, routing trajectory, anomaly type, and risk score corresponding to high-risk conclusions. Within a time window, group the high-risk conclusions according to the routing trajectory to obtain a set of expert sequence fragments sorted by expert identifier. Specifically, the grouping of high-risk conclusions according to the routing trajectory within the time window is as follows: The risk assessment conclusion sets are merged according to the test task identifier and sorted in ascending order by the generation time index. The time window length is set to 60 seconds, and the window start point is determined by looking back 60 seconds from the generation time index of the current conclusion. Within each time window, conclusions with a high risk level are selected. For each high-risk conclusion, the selected expert number sequence and expert sequence number are extracted from the routing trajectory. The selected expert number sequence is concatenated in order to form a routing key. At the same time, the anomaly type and test data payload packet identifier are used as auxiliary keys. The routing key is used as the primary grouping key to cluster and group the high-risk conclusions within the window. Conclusions with the same primary grouping key are grouped into the same group. If the primary grouping key is the same but the anomaly type is different, they are split into different subgroups. The conclusions in each group are sorted in ascending order by the generation time index. The selected expert number sequence of each conclusion is expanded into an expert identifier sequence by the expert sequence number to obtain a set of expert sequence fragments sorted by expert identifier. For each set of expert sequence segments, the adjacent differences are calculated to generate a conflict intensity vector. Based on the conflict intensity vector and the occurrence time difference corresponding to each adjacent difference, a priority queue of variables to be tested is generated. An initial condition set is constructed and a hierarchical stripping process is performed. The hierarchical stripping process involves removing one condition variable from the initial condition set one by one in the stripping order. After each removal, the corresponding variable and time index in the priority queue of the variable to be tested are retained until the final condition set is formed. Based on the final condition set and the priority queue of the variable to be tested, a test data group with time index is generated.

[0025] In this embodiment, the output factor correlation evidence record includes: From the test data grouping, determine the set of variables to be tested, the risk variables and the condition set, and align the set of variables to be tested, the risk variables and the condition set according to the same time index to form a test triplet sequence; Complementary frequency band decomposition of the test triplet sequence is performed based on staggered spectral projection. The first projection mapping and the second projection mapping are performed on the feature sequences of the set of variables to be tested and the hazard variables, respectively, to obtain the first projection pair and the second projection pair. Specifically, the complementary frequency band decomposition of the test triplet sequence is as follows: Align the feature sequences of the variable to be tested and the feature sequences of the risk variable according to the time index, and pad each sequence to a fixed length of 256. The discrete spectrum transformation is to multiply and sum the feature sequences with a fixed set of sine and cosine basis functions one by one to obtain frequency coefficient sequences of the same length, and number them in ascending order. The first projection mapping retains only the odd-order frequency coefficients and sets the even-order positions to 0. The second projection mapping retains only the even-order frequency coefficients and sets the odd-order positions to 0. The inverse transformation is to multiply and sum the projected frequency coefficients with the same set of sine and cosine basis functions one by one to reconstruct a time series sequence of length 256. Pair the first projection feature sequences of the variable to be tested and the risk variable under the same time index to form the first projection pair, and pair the second projection feature sequences to form the second projection pair. Factor correlation evidence records are generated based on directional consistency records. These records include probability sequences corresponding to each variable in the set of variables to be tested, corresponding test statistic sequences, corresponding condition set identifiers, corresponding projection pair identifiers, and corresponding time indices. Specifically, the generation of factor correlation evidence records based on directional consistency records involves: Sort the directional consistency records by time index, merge them one by one by the variables to be tested, read the first direction probability and the second direction probability under the same time index for each variable to be tested, take the larger value of the two as the probability of the time index and write it into the probability sequence. At the same time, read the first direction test statistic and the second direction test statistic, take the smaller value of the two as the test statistic of the time index and write it into the test statistic sequence. Write the probability sequence, the test statistic sequence, the condition set identifier, the projection pair identifier and the time index set corresponding to the variable into the same evidence entry. Write the test task identifier and the variable identifier into each evidence entry. Summarize the evidence entries of all variables to form the factor correlation evidence record.

[0026] In this embodiment, the generation of risk conclusion objects and anchor-chain-style evidence storage data includes: Obtain credible verification results, watermarked model output records, and factor correlation evidence records; extract test task identifiers, test data payload packet identifiers, test statistic sequences, condition set identifiers, projection pair identifiers, and time indexes; and generate a set of evidence entries. The evidence set is divided into multi-level evidence sets according to the risk level and written into the corresponding multi-level frozen anchor area. The multi-level frozen anchor areas are arranged in ascending order of anchor area number. Each frozen anchor area records the start number, end number and offset difference with the previous frozen anchor area of ​​the current level evidence set. In each frozen anchor area, an evidence link index is established according to the order in which the evidence items are generated, and the credible verification results, model output records and factor correlation evidence records under the same test task identifier are associated. Risk conclusion objects are generated based on multi-level frozen anchor zones and evidence linking indexes. Anchor-chain-style evidence storage data is then generated based on these risk conclusion objects and the multi-level frozen anchor zones. The risk conclusion object is generated based on multi-level frozen anchor zones and evidence linkage index. Specifically, it is as follows: Based on the evidence linkage index, it retrieves and aggregates the credible verification result entries, watermarked model output record entries, and factor correlation evidence entries under the test task identifier. It reads the anchor zone number, start number, end number, and offset difference of the frozen anchor zone and writes the anchor zone information into the anchor zone reference table of the same task. It extracts the risk score, risk level, anomaly type, and routing trajectory from the watermarked model output record entries. It extracts the link consistency identifier, fragment consistency identifier, and replay comparison sequence number from the credible verification result entries. It extracts the significance probability sequence and test statistic sequence from the factor correlation evidence entries. After aligning with the time index, it writes the results into the risk conclusion object and writes the evidence entry number range and anchor zone number sequence corresponding to the test task identifier to form a traceable risk conclusion object. Anchor chain-style evidence storage data is generated based on risk conclusion objects and multi-level frozen anchor zones. Specifically, the risk conclusion object is used as the main record. The corresponding multi-level frozen anchor zones are traversed in ascending order of anchor zone number sequence. The anchor zone number, start number, end number, and offset difference of each frozen anchor zone are concatenated in the field order to generate an anchor zone description segment. The anchor zone description segment and the evidence link index summary segment within the anchor zone are spliced ​​in a fixed order to form the anchor chain segment of the anchor zone. The anchor chain segments are concatenated in ascending order of anchor zone number. The length of the previous anchor chain segment and the offset position of the current anchor chain segment are written between adjacent anchor chain segments to obtain anchor chain-style evidence storage data that can be sequentially traversed and can be bounced back to the previous anchor chain segment.

[0027] In this embodiment, the step of completing the integrity verification registration and generating a disposal instruction based on the risk conclusion object includes: Receive anchor chain-style evidence data and write it into the audit storage area in the order of generation time. The audit storage area is indexed with the test task identifier as the primary key, and records the corresponding anchor area sequence number, evidence item sequence number range and evidence link index. Perform integrity verification registration on the anchor chain-style evidence data written to the audit storage area, read the start number, end number and offset difference of each frozen anchor area in the anchor chain-style evidence data and verify the incremental relationship of the anchor area number, read the evidence link index and verify the continuous relationship of the evidence item number under the same test task identifier, generate registration records and write them to the audit storage area. Based on the risk conclusion, disposal instructions are generated and output. The disposal instructions include retest instructions, data isolation instructions, permission disposal instructions, and traceability instructions. The retest instructions include test task identifier, retest workstation identifier, and retest recipe version identifier. The data isolation instructions include test data payload package identifier and isolation range identifier. The permission disposal instructions include account identifier, permission type identifier, and disposal time stamp. The traceability instructions include test task identifier, anchor zone sequence number, and evidence item sequence number range.

[0028] Example 1: To verify the feasibility of this invention in practice, it was applied to a continuous mass production testing cycle. The testing system received 2400 records of multi-source power supply testing data. Each record included voltage and current waveforms, ripple noise spectrum, transient response process, station instrument metadata, formula batch metadata, and account permission operation logs. The waveform sampling rate was either 1 Mbps or 500 kilosamples per second, with a unified resampling rate of 500 kilosamples per second. The spectrum covered 20 Hz to 2000 Hz, with resolutions of 10 Hz and 20 Hz, unified at 20 Hz and interpolated to fill in missing frequencies. There were 12 stations, 18 types of instruments, 6 types of formulas, 15 batches, and 42 accounts. Significant fluctuations were observed under various operating conditions. The standard deviation of full-load efficiency between batches was 0.82 percentage points, and the standard deviation of transient overshoot between stations was 18 millivolts.

[0029] After preprocessing, test data payload packets are generated and fragmented according to fragmentation rules. Signal feature regions are fragmented by time windows, with each fragment not exceeding 4096 bytes, averaging 96 signal fragments; metadata is fragmented in 16-field segments, averaging 2 metadata fragments; logs are fragmented in 8-event segments, averaging 4 log fragments. Random numbers are generated at each stage of acquisition, transmission, storage, and retrieval to form a fragment fingerprint matrix, averaging 103 rows per instance. A circular cross-playback compares the fingerprint matrices of adjacent stages line by line. The inconsistency rate of fragments in normal records is 0.6%, while the inconsistency rate of fragments in suspicious records is 9.4%, concentrated in log fragments and spectrum fragments. One suspicious record showed 17 mismatches in the transmission comparison, accounting for 16.5%.

[0030] An improved sparse hybrid expert model was used in the machine learning phase. The training sample set consisted of 1800 samples: 1260 normal samples, 180 tampered samples, 120 forged samples, 150 replay samples, and 90 samples with unauthorized access. Risk scores were labeled as low (0.2), medium (0.55), and high (0.85). The training subset and the control evaluation subset were hierarchically divided in a 7:3 ratio, with a batch size of 256 samples and a learning rate of 0.001. Asynchronous shadow snapshot silent evaluation extracted 256 samples each time to generate a usable routing set. Replay experts showed a consistency of 0.94 and stability of 0.04; forged experts showed a consistency of 0.91 and stability of 0.05; and unauthorized experts showed a consistency of 0.92 and stability of 0.03, all of which were usable. For each sample, two experts were selected for parallel inference. When a certain expert task reached 64 and the waiting time was 20 milliseconds, a temporary copy was activated. The peak inference latency decreased from 96 milliseconds to 41 milliseconds, and the average latency decreased from 32 milliseconds to 24 milliseconds. 126 high-risk conclusions were output, 54 were replayed, 38 were forged, 22 were unauthorized, and 12 were tampered with. The model output records were written with associated watermark codes for audit playback.

[0031] In the statistical evidence phase, high-risk conclusions are aggregated according to the routing trajectory within a 60-second window, and the condition set is peeled off layer by layer to obtain the test data group. After interleaved spectrum projection, the sequence is completed to 256, and then discrete spectrum transformation and inverse transformation are performed for reconstruction. A bidirectional mirror test chain generates a directional consistency record. The results show that data export and data modification events are still correlated with high-risk conclusions after controlling for model, batch, workstation, instrument, calibration status, and formula. The maximum bidirectional probability of 10 consecutive time indices is less than 0.01; the probability of workstation identification is mostly greater than 0.25. The system outputs factor correlation evidence records and writes them and the credible verification results into a multi-level frozen anchor area, establishes an evidence link index, generates risk conclusion objects and anchor chain-style evidence data, registers integrity verification, and triggers retesting, isolation, and access control.

[0032] The comparative experiment used traditional methods, employing rule-based thresholds and single-model classification, without circular replay or statistical evidence. Of the 126 high-risk conclusions, 109 were confirmed as genuine security anomalies through retesting and auditing. Traditional methods detected 78 anomalies but missed 31, while this invention detected 101 and missed 8. The security anomaly detection rate was 71.6% for traditional methods and 92.7% for this invention; the false alarm rate was 10.3% for traditional methods and 4.8% for this invention; the average time from alarm to the formation of an auditable evidence chain was 1480 seconds for traditional methods and 110 seconds for this invention. Taking a confirmed replay sample as an example, the main spectral peak was fixed at 980 Hz with repeated local peak combinations. The log contained one export and one modification. There were 17 mismatches in transmission and storage replay. The routing hit replay and unauthorized expert, with a maximum bidirectional probability of less than 0.01, ultimately triggering isolation and access control, proving the feasibility and effectiveness of this invention.

[0033] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for security analysis of power supply test data based on machine learning, characterized in that, include: Collect multi-source power supply test data, preprocess the multi-source power supply test data, and generate test data payload packets; A fragment fingerprint matrix is ​​constructed and attached to the test data payload. A circular cross-playback mechanism is used for comparison and verification to generate a reliable verification result. An improved sparse hybrid expert model is constructed, and security judgment is made based on test data payload packets and trusted verification results. Silent evaluation is performed based on the asynchronous shadow snapshot evaluation module and the route availability set is corrected. An instantaneous replica decoupling module is introduced to perform expert reasoning. A trusted watermark integration module is used to generate associated watermarks and obtain a risk judgment conclusion set. Trajectory aggregation is performed on the risk assessment conclusion set, and the data is compressed step by step using a hierarchical stripping method to obtain the test data group; The test data are grouped and subjected to conditional independence tests. Complementary frequency bands are decomposed based on staggered spectrum projection pairs. Bi-directional tests are performed through a bi-directional mirror test chain, and evidence records of factor correlation are output. Based on the credible verification results and the evidence records related to the factors, the data is written into the multi-level frozen anchor area according to the risk level, an evidence link index is established, and risk conclusion objects and anchor chain-style evidence storage data are generated. Anchor chain-style evidence data is written into the audit storage, integrity verification registration is completed, and disposal instructions are generated based on the risk conclusion objects.

2. The power supply test data security analysis method based on machine learning according to claim 1, characterized in that, The power supply test multi-source data includes voltage and current waveform data, ripple noise spectrum data, transient response process data, test station instrument metadata, test formula batch metadata, and account permission operation log data.

3. The power supply test data security analysis method based on machine learning according to claim 1, characterized in that, The generated test data payload package includes: Acquire voltage and current waveform data, ripple noise spectrum data, transient response process data, test station instrument metadata, test formula batch metadata, and account permission operation log data corresponding to the same power supply test, and write a unified test task identifier and acquisition time stamp for each data item; Data preprocessing is performed on multi-source power supply test data. Data preprocessing includes missing value imputation, outlier removal, unit and dimension unification, sampling rate unification, time axis alignment, spectrum axis alignment, test step alignment, and feature extraction. Feature extraction includes segmenting voltage and current waveform data and transient response process data by time window and extracting time domain statistics and rate of change features; segmenting ripple noise spectrum data by frequency band and extracting frequency domain energy features and peak frequency features; and encoding test station instrument metadata, test formula batch metadata, and account permission operation log data into discrete identifier features and sequence event features. The preprocessed multi-source features are encapsulated according to the payload packet structure, which includes a signal feature area, a metadata feature area, a log feature area, and an index area. The index area records the test task identifier, acquisition time stamp, data source identifier, and feature area offset information to generate a test data payload packet.

4. The power supply test data security analysis method based on machine learning according to claim 1, characterized in that, The generation of trusted verification results includes: The test data payload is divided into data fragments according to the fragmentation rules. Each data fragment is written with a fragment number and a stage identifier. The stage identifier indicates the acquisition stage, transmission stage, storage stage, and retrieval stage. At each stage, a random number is generated on-site for the current stage. This number is then combined with the fragment number, stage identifier, and data fragment content to form a fragment fingerprint matrix. The fragment fingerprint matrix is ​​then attached to the test data payload. A circular cross-playback mechanism is used to compare and verify the fragment fingerprint matrix of adjacent steps. The fragment fingerprint matrix generated in each step is replayed and compared. A reliable verification result is generated based on the matching result of each comparison. The reliable verification result includes the step consistency identifier, the fragment consistency identifier and the replay comparison sequence number.

5. The power supply test data security analysis method based on machine learning according to claim 1, characterized in that, The obtained risk discrimination conclusion set includes: An improved sparse hybrid expert model is constructed. The improved sparse hybrid expert model adds an asynchronous shadow snapshot evaluation module, an instantaneous replica decoupling module, and a trusted watermark integration module on the basis of the gated routing unit, expert inference unit, and aggregate output unit of the original sparse hybrid expert model. The asynchronous shadow snapshot evaluation module is set as an evaluation branch in parallel with the gated routing unit and establishes a route availability set interface with the gated routing unit. The instantaneous replica decoupling module is set in the scheduling layer of the expert inference unit and establishes a temporary replica creation interface with the expert inference unit. The trusted watermark integration module is set as the output side of the aggregate output unit and establishes a watermark writing interface with the aggregate output unit. The asynchronous shadow snapshot evaluation module generates parameter snapshot copies for each expert inference unit, calls the comparison evaluation subset in the asynchronous channel to perform silent evaluation, and generates expert validity identifiers and route availability sets based on the silent evaluation results; After receiving the available route set, the gated routing unit determines the selected expert set within the available route set based on the test data payload packet and the trusted verification result, and outputs the route trajectory. The instantaneous replica decoupling module creates a read-only shared weight temporary replica of the expert inference unit based on the selected expert set, executes expert inference in parallel, and obtains the expert output set corresponding to the route trajectory. After receiving the expert output set, the aggregation output unit aggregates and generates risk discrimination, and generates model output records. The trusted watermark integration module extracts the test task identifier, trusted verification result, route trajectory and selected expert set identifier from the model output records, concatenates them in order to form a watermark field sequence, generates a watermark code through a fixed-length mapping function, and writes it into the model output record to obtain a risk discrimination conclusion set containing risk discrimination output, route trajectory and watermark code. The improved sparse hybrid expert model is trained by constructing a training sample set, which is then divided into a training subset and a control evaluation subset. The training subset is used to perform iterative training on the gated routing unit, expert inference unit, and aggregation output unit, and the parameters of each expert inference unit are updated in each iteration. The control evaluation subset is used to perform silent evaluation on the asynchronous shadow snapshot evaluation module and update the available routing set. The training subset is used to perform temporary replica scheduling training on the instantaneous replica decoupling module and update the scheduling parameters. The training subset is used to perform watermark field sequence generation training on the trusted watermark integration module and solidify the field sequence and fixed-length mapping function.

6. The power supply test data security analysis method based on machine learning according to claim 1, characterized in that, The obtained test data grouping includes: Extract the test task identifier, test data payload packet identifier, routing trajectory, anomaly type and risk score corresponding to high-risk conclusions from the risk judgment conclusion set. Group the high-risk conclusions according to the routing trajectory within the length time window to obtain a set of expert sequence fragments sorted by expert identifier. For each set of expert sequence segments, the adjacent differences are calculated to generate a conflict intensity vector. Based on the conflict intensity vector and the occurrence time difference corresponding to each adjacent difference, a priority queue of variables to be tested is generated. An initial condition set is constructed and a hierarchical stripping process is performed. The hierarchical stripping process involves removing one condition variable from the initial condition set one by one in the stripping order. After each removal, the corresponding variable and time index in the priority queue of the variable to be tested are retained until the final condition set is formed. Based on the final condition set and the priority queue of the variable to be tested, a test data group with time index is generated.

7. The power supply test data security analysis method based on machine learning according to claim 1, characterized in that, The output factor correlation evidence records include: From the test data grouping, determine the set of variables to be tested, the risk variables and the condition set, and align the set of variables to be tested, the risk variables and the condition set according to the same time index to form a test triplet sequence; Based on the interleaved spectrum projection, the test triplet sequence is decomposed into complementary frequency bands. The first projection mapping and the second projection mapping are performed on the feature sequences of the set of variables to be tested and the risk variables, respectively, to obtain the first projection pair and the second projection pair. Based on the bidirectional mirror test chain, bidirectional tests are performed on the first projection pair and the second projection pair respectively. The test statistic and the significance probability of the first direction are calculated under a given set of conditions, with the set of variables to be tested as the independent variable and the risk variable as the dependent variable. The test statistic and the significance probability of the second direction are calculated under a given set of conditions, with the risk variable as the independent variable and the set of variables to be tested as the dependent variable, and a directional consistency record is generated. Factor correlation evidence records are generated based on directional consistency records. These records include probability sequences, test statistic sequences, condition set identifiers, projection pair identifiers, and time indexes corresponding to each variable in the set of variables to be tested.

8. The power supply test data security analysis method based on machine learning according to claim 1, characterized in that, The generated risk conclusion object and anchor-chain-style evidence storage data include: Obtain credible verification results, watermarked model output records, and factor correlation evidence records; extract test task identifiers, test data payload packet identifiers, test statistic sequences, condition set identifiers, projection pair identifiers, and time indexes; and generate a set of evidence entries. The evidence set is divided into multi-level evidence sets according to the risk level and written into the corresponding multi-level frozen anchor area. The multi-level frozen anchor areas are arranged in ascending order of anchor area number. Each frozen anchor area records the start number, end number and offset difference with the previous frozen anchor area of ​​the current level evidence set. In each frozen anchor area, an evidence link index is established according to the order in which the evidence items are generated, and the credible verification results, model output records and factor correlation evidence records under the same test task identifier are associated. Risk conclusion objects are generated based on multi-level frozen anchor zones and evidence linking indexes, and anchor chain-style evidence storage data is generated based on risk conclusion objects and multi-level frozen anchor zones.

9. The power supply test data security analysis method based on machine learning according to claim 1, characterized in that, The process of completing the integrity verification registration and generating a disposal instruction based on the risk conclusion includes: Receive anchor chain-style evidence data and write it into the audit storage area in the order of generation time. The audit storage area is indexed with the test task identifier as the primary key, and records the corresponding anchor area sequence number, evidence item sequence number range and evidence link index. Perform integrity verification registration on the anchor chain-style evidence data written to the audit storage area, read the start number, end number and offset difference of each frozen anchor area in the anchor chain-style evidence data and verify the incremental relationship of the anchor area number, read the evidence link index and verify the continuous relationship of the evidence item number under the same test task identifier, generate registration records and write them to the audit storage area. Based on the risk conclusion, disposal instructions are generated and output. The disposal instructions include retest instructions, data isolation instructions, permission disposal instructions, and traceability instructions. The retest instructions include test task identifier, retest workstation identifier, and retest recipe version identifier. The data isolation instructions include test data payload package identifier and isolation range identifier. The permission disposal instructions include account identifier, permission type identifier, and disposal time stamp. The traceability instructions include test task identifier, anchor zone sequence number, and evidence item sequence number range.

Images