An artificial intelligence-based power grid infrastructure safety management system and method

Abstract

This invention belongs to the technical field of computer-aided management and relates to an artificial intelligence-based power grid infrastructure safety management system and method. The system includes: a multi-source data acquisition and cross-modal detection module to generate multi-dimensional state trigger signal packets; a causal matching and risk assessment module to output initial risk assessment values; a state feature vector encoding module to merge and output safety event state feature vectors; a graph mutation execution module to generate updated graphs; a local subgraph activation module to construct locally diffused activation subgraphs; a risk trend reasoning module to output risk evolution trend vectors; and a risk decoding and intervention decision module to generate forward-looking risk control intervention strategies. This invention solves the problem of how to deeply integrate multi-source heterogeneous data and dynamically construct a risk causal framework to achieve forward-looking risk evolution trend prediction and intervention.

Description

Technical Field

[0001] This invention belongs to the technical field of computer-aided management and relates to an artificial intelligence-based power grid infrastructure safety management system and method. Background Technology

[0002] Power grid infrastructure construction sites are characterized by wide work areas, multiple trades involved, and dynamically changing environments. Safety management typically requires a coordinated approach to address the interactive effects of personnel violations, equipment status changes, and environmental risk factors. Currently, the industry widely adopts video analytics-based electronic fence systems, threshold-based IoT sensor alarm systems, and electronic work order systems, attempting to monitor on-site operations safely by acquiring multi-source data.

[0003] Chinese Patent Publication No. CN112132528A discloses an artificial intelligence-based power grid infrastructure safety management system. The system uses a hardware layer, a data acquisition layer, a data transmission layer, and an application layer architecture to collect parameters of relevant equipment at the work site and transmit and store them. After receiving the data, the application layer compares the on-site data with the pre-stored risks. When the risk reaches the warning range, it issues a preliminary risk warning and issues corresponding safety management information.

[0004] The aforementioned existing technologies mainly rely on simply comparing the collected discrete parameters from the field with preset static risks to trigger early warnings. This processing method, based on the superposition of independent rules, makes it difficult for the management system to construct a dynamic causal relationship map between multiple abnormal events. When faced with complex and intertwined field conditions, it is difficult to accurately and quantitatively assess the subsequent chain risks that the current abnormal state may cause. As a result, field safety control measures are mainly limited to passive response and lack the ability to predict the direction of the risk chain in advance.

[0005] Therefore, how to deeply integrate multi-source heterogeneous data and dynamically construct a risk causal framework to achieve forward-looking risk evolution trend prediction and intervention is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0006] To address the aforementioned problems, this invention provides an artificial intelligence-based power grid infrastructure safety management system and method.

[0007] An artificial intelligence-based power grid infrastructure safety management system includes: The multi-source data acquisition and cross-modal detection module acquires multi-source heterogeneous state data streams, uses a preset multi-modal signal differential threshold matrix to detect state transitions, and generates multi-dimensional state trigger signal packets. The causal matching and risk assessment module will trigger the signal packet input to the causal knowledge fragment library in the security field for matching calculation, extract the causal association rule chain, and output the initial risk assessment value by combining the risk multiplication algorithm; The state feature vector encoding module writes the interoperability commands contained in the causal association rule chain into the first preset length control channel bit segment of the floating-point array, converts the initial risk assessment value into encrypted initial activation energy data, writes it into the second preset length data channel bit segment of the array, and merges and outputs the security event state feature vector. The graph mutation execution module parses the interoperability commands within the control channel bit segment and performs topological mutation operations on the pre-configured dynamic spatiotemporal knowledge graph accordingly to generate an updated graph. The local subgraph activation module identifies the core affected relationship edges in the updated graph, extracts neighbor network elements that meet the preset hop count limit as the starting point, and splices them to construct a local diffusion activation subgraph. The risk trend inference module extracts the initial activation energy data from the data channel segment and injects it into the local diffusion activation subgraph, triggering the pre-trained graph neural network inference engine to perform calculations and extract the output risk evolution trend vector from the edge free nodes. The risk decoding and intervention decision-making module decodes the risk evolution trend vector to generate a sequence of predicted nodes for subsequent state transitions, filters target dangerous nodes through probability calculations, and then generates forward-looking intervention strategies for risk management.

[0008] A further aspect of this invention uses a preset multimodal signal differential threshold matrix for state transition detection to generate a multidimensional state trigger signal packet, comprising the following steps: Separate continuously sampled discrete IoT sensor data, unstructured continuous video frame data, and semi-structured electronic work order change records from multi-source heterogeneous state data streams. The difference between continuous signal changes reflecting the trajectory of a person's limbs crossing the boundary and the wearing status of protective equipment in unstructured continuous video frame data is extracted using a multimodal signal differential threshold matrix. When the difference in continuous signal changes exceeds the corresponding set threshold in the multimodal signal differential threshold matrix and the continuously sampled discrete IoT sensor data undergoes a jump, the abnormal subject identifier, state transition parameters, and environmental context pointer are extracted, encapsulated and replaced, and then merged and assembled to output a multidimensional state trigger signal packet.

[0009] A further aspect of this invention involves inputting the trigger signal packet into a causal knowledge fragment library in the security domain for matching and calculation, and extracting a causal association rule chain, including the following steps: Extract the abnormal subject identifier and state transition parameters recorded inside the trigger signal packet to construct a retrieval key value; By using search keys, subsequent state transition rule chains pointing to potential security vulnerabilities are matched in a causal knowledge fragmentation database in the security domain; Extract the subsequent state transition rule chain and define the transformation to generate the causal association rule chain.

[0010] A further aspect of this invention, combining a risk product algorithm to output an initial risk assessment value, includes the following steps: The environmental context pointer carried inside the multi-dimensional state trigger signal packet is obtained and spatially mapped and transformed to extract the personnel qualification and experience registration data and the environmental severity index of the spatial construction operation corresponding to the on-site operation. The pre-set risk product algorithm is invoked to calculate the comprehensive weighted product of the inherent severity of the accident, personnel qualification and experience registration data, and the harshness index of the spatial construction operation environment contained in the causal association rule chain; The output of the weighted product serves as the initial risk assessment value used to characterize the degree of danger.

[0011] A further aspect of the present invention involves writing the interoperability commands contained in the causal association rule chain into a first preset length control channel bit field of a floating-point array, comprising the following steps: Extract the semantics of all entity interoperability relationships covered within the causal association rule chain; The semantics of entity interoperability relationships are converted into a set of add, delete, and modify control instructions for structural modification of the underlying database, and the set of add, delete, and modify control instructions is extracted to serve as interoperability commands. The interoperability command execution serialization encoding mapping is written into the first preset length control channel bit segment of a floating-point array constructed in a fixed-size memory space.

[0012] A further aspect of the present invention involves performing a topological mutation operation on a pre-configured dynamic spatiotemporal knowledge graph to generate an updated graph, comprising the following steps: The opcodes contained in the interoperation commands are analyzed and the preset mapping table is consulted to accurately locate the target entity node within the dynamic spatiotemporal knowledge graph that is undergoing connection attribute changes. The control of the outer underlying graph database performs atomic operations such as physical disconnection or cross-level penetration and direct connection creation on the target entity node and the surrounding network, which act as topology mutation operations. Listen for and control the write-back instructions of structural change data after the outer bottom-level graph database completes the topological change operation, and generate an updated graph according to the structural change data.

[0013] A further aspect of this invention involves constructing a locally diffused activation subgraph by splicing together the following steps: The graph structure entity connecting both ends of the core affected relationship edge serves as the starting node for subgraph search; Within the updated graph, based on the traversal depth controlled by a preset hop count limit, all associated entity nodes and associated physical relationship edges within the reachable range of the subgraph search starting node are extracted and summarized into neighbor network elements. By reconstructing the topological connectivity state using neighbor network elements, a locally diffused activation subgraph with feedforward inference boundary settings is constructed.

[0014] A further aspect of this invention involves triggering a pre-trained graph neural network inference engine to perform computation, including the following steps: The initial activation energy data is captured, decrypted, and reverse-engineered to release the original scalar floating-point value. The function is used to force the release of scalar floating-point values ​​to be assigned to the internal initial connection weights of the affected relation edges inside the local diffusion activation subgraph. The pre-trained graph neural network inference engine is launched within the topological space limited to the local diffusion activation subgraph, and the pre-trained graph neural network inference engine is used to drive multi-round graph node message passing interaction operations.

[0015] A further aspect of this invention involves screening target hazardous nodes through probability calculations, thereby generating a proactive risk management intervention strategy, including the following steps: By using a safety category decoder with time-series autoregressive properties, the risk evolution trend vector is decoded and translated into a semantic text structure, and the reconstructed and combined data is used to generate a sequence of subsequent state transition prediction nodes containing a multi-level causal transmission chain of hazard occurrence. For dangerous event nodes that are consecutively mapped within the subsequent state transition prediction node sequence, a probabilistic statistical micro-model is attached to perform conditional calculations to obtain the estimated probability results and the shortest time occurrence window flag. Nodes that exceed the threshold of the red line of the pre-prevention key prevention rules are screened and identified as target dangerous nodes. The target dangerous nodes are then integrated with spatial positioning to derive a risk management and proactive intervention strategy carrying visualized and overlaid alarm data.

[0016] This invention provides an artificial intelligence-based method for power grid infrastructure safety management, comprising the following steps: S1. Acquire multi-source heterogeneous state data streams, use a preset multi-modal signal differential threshold matrix to detect state transitions, and generate multi-dimensional state trigger signal packets. S2. Input the trigger signal packet into the causal knowledge fragment library in the security domain for matching and calculation, extract the causal association rule chain, and output the initial risk assessment value by combining it with the risk product algorithm; S3. Write the interoperation commands contained in the causal association rule chain into the first preset length control channel bit segment of the floating-point array, and convert the initial risk assessment value into encrypted initial activation energy data, write it into the second preset length data channel bit segment of the array, and merge and output the security event state feature vector. S4. Parse the interoperation commands within the control channel bit segment, and perform a topological mutation operation on the pre-configured dynamic spatiotemporal knowledge graph accordingly to generate an updated graph; S5. Identify the core affected relationship edges in the updated graph, and extract the neighbor network elements that meet the preset hop count limit as the starting point, and splice them to construct a local diffusion activation subgraph. S6. Extract the initial activation energy data from the data channel segment and inject it into the local diffusion activation subgraph to trigger the pre-trained graph neural network inference engine to perform calculations and extract the output risk evolution trend vector from the edge free nodes. S7. Decode the risk evolution trend vector to generate the subsequent state transition prediction node sequence, screen the target dangerous nodes through probability calculation, and then generate a forward-looking intervention strategy for risk management.

[0017] In summary, the present invention has the following beneficial technical effects: 1. A pre-set multimodal signal differential threshold matrix is ​​used to detect state transitions in multi-source heterogeneous state data streams. Cross-modal collaborative triggering is achieved by extracting the rate of change of consecutive video frames, sensor data jumps, and work order anomaly records within the same time window. This changes the traditional independent alarm method that relies on the absolute threshold of a single signal source, allowing the identification of risk clues to move beyond superficial logical superposition. This facilitates the capture of hidden risks caused by slow state drift in the field environment, thereby improving the sensitivity and accuracy of early safety event detection.

[0018] 2. A causal knowledge fragment library and risk multiplication algorithm in the security domain are introduced to match the extracted state transition parameters into a causal association rule chain containing potential evolution paths, and the initial risk assessment value is quantitatively calculated. This is encapsulated as a security event state feature vector containing graph topology control commands and energy data, driving real-time topological mutations in a dynamic spatiotemporal knowledge graph. This design transforms discrete anomaly alarms into a structured network with causal logical relationships and a quantitative energy scalar, overcoming the limitation of existing technologies that can only output isolated event labels, and providing a reliable spatiotemporal model foundation for assessing the cascading effects of anomaly events.

[0019] 3. A localized diffusion activation subgraph is constructed on the updated graph where topological mutations occur. The initial risk assessment value is forcibly used as the connection weight of the core affected relationship edges, triggering a graph neural network to perform multiple rounds of restricted message passing operations to generate a risk evolution trend vector, and decoding and outputting a forward-looking intervention strategy. This process simulates the propagation and evolution of risk energy corresponding to the risk assessment value among on-site physical entities, enabling the system to quantitatively predict the probability of dangerous events and the shortest time window, thus promoting the transformation of power grid infrastructure safety management from passive single-point alarm response to proactive forward-looking intervention based on causal relationships. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. The drawings are used to provide a further understanding of the present invention.

[0021] Figure 1 This application discloses a schematic diagram of the security management system in an embodiment of the present application.

[0022] Figure 2 This is a schematic diagram showing the trend of changes in the distance a person's limbs crosses the boundary in the embodiments of this application.

[0023] Figure 3 This is a data diagram illustrating the distribution of target hazardous nodes in the embodiments of this application.

[0024] Figure 4 The flowchart of the security management method in the embodiments of this application is disclosed. Detailed Implementation

[0025] The following is in conjunction with the appendix Figure 1 - Figure 4 A preferred description of the present invention is provided below.

[0026] See attached document Figure 1 This invention proposes an artificial intelligence-based power grid infrastructure safety management system, comprising the following modules: The multi-source data acquisition and cross-modal detection module acquires multi-source heterogeneous state data streams, uses a preset multi-modal signal differential threshold matrix to detect state transitions, and generates multi-dimensional state trigger signal packets. The causal matching and risk assessment module will trigger the signal packet input to the causal knowledge fragment library in the security field for matching calculation, extract the causal association rule chain, and output the initial risk assessment value by combining the risk multiplication algorithm; The state feature vector encoding module writes the interoperability commands contained in the causal association rule chain into the first preset length control channel bit segment of the floating-point array, converts the initial risk assessment value into encrypted initial activation energy data, writes it into the second preset length data channel bit segment of the array, and merges and outputs the security event state feature vector. The graph mutation execution module parses the interoperability commands within the control channel bit segment and performs topological mutation operations on the pre-configured dynamic spatiotemporal knowledge graph accordingly to generate an updated graph. The local subgraph activation module identifies the core affected relationship edges in the updated graph, extracts neighbor network elements that meet the preset hop count limit as the starting point, and splices them to construct a local diffusion activation subgraph. The risk trend inference module extracts the initial activation energy data from the data channel segment and injects it into the local diffusion activation subgraph, triggering the pre-trained graph neural network inference engine to perform calculations and extract the output risk evolution trend vector from the edge free nodes. The risk decoding and intervention decision-making module decodes the risk evolution trend vector to generate a sequence of predicted nodes for subsequent state transitions, filters target dangerous nodes through probability calculations, and then generates forward-looking intervention strategies for risk management.

[0027] In one embodiment of the present invention, the multi-source data acquisition and cross-modal detection module is used to perform the following steps: Separate continuously sampled discrete IoT sensor data, unstructured continuous video frame data, and semi-structured electronic work order change records from multi-source heterogeneous state data streams. The difference between continuous signal changes reflecting the trajectory of a person's limbs crossing the boundary and the wearing status of protective equipment in unstructured continuous video frame data is extracted using a multimodal signal differential threshold matrix. When the difference in continuous signal changes exceeds the corresponding set threshold in the multimodal signal differential threshold matrix and the continuously sampled discrete IoT sensor data undergoes a jump, the abnormal subject identifier, state transition parameters, and environmental context pointer are extracted, encapsulated and replaced, and then merged and assembled to output a multidimensional state trigger signal packet.

[0028] Specifically, this embodiment describes the execution process of the multi-source data acquisition and cross-modal detection module. The data acquisition interface service deployed on the edge server at the power grid infrastructure site runs continuously, acquiring multi-source heterogeneous state data streams in parallel through multiple preset communication protocol ports. The multi-source heterogeneous state data stream refers to a set of data collected and aggregated under a unified time reference, containing at least three types of data: discrete IoT sensor data from continuous sampling by environmental monitoring sensors such as temperature, humidity, and gas concentration, typically in key-value pair format; unstructured continuous video frame data from on-site monitoring cameras, in the form of raw image matrix sequences; and semi-structured electronic work order change records from the construction management information system, including fields such as work order number, personnel ID, task status, and work area.

[0029] The data acquisition interface service uses the Message Queuing Telemetry Transport Protocol (MQTT) to... The sampling frequency is subscribed to and received continuous discrete environmental status data from IoT sensors at various locations on site, such as JSON format data packets containing temperature, humidity and harmful gas concentrations.

[0030] Simultaneously, unstructured continuous video frame data is pulled from multiple surveillance cameras via the Real-time Streaming Protocol (RTSP). The video stream format is High-Level Video H.264 encoded, and the frame rate is [missing information]. In addition, the business management system's database is queried in a polling manner via an Open Database Connectivity (ODBC) interface to obtain semi-structured electronic work order change records that represent changes in personnel task status. All acquired data is appended with a unified Coordinated Universal Time (UTC) timestamp and sent to a cross-modal data processing pipeline.

[0031] Within the cross-modal data processing pipeline, unstructured continuous video frame data is fed into a parallel processing unit. This unit includes a pose estimation algorithm module based on a convolutional neural network, used to parse each frame in real time and output time-series data describing the two-dimensional coordinates of key points on the body of personnel on site; it also includes a target detection algorithm module to identify whether personnel are wearing protective equipment such as helmets and safety ropes, outputting a Boolean sequence reflecting the wearing status of this equipment.

[0032] The processing pipeline utilizes a pre-configured multimodal signal differential threshold matrix to detect state transitions in all input data streams. This multimodal signal differential threshold matrix is ​​a pre-configured parameter lookup table used to store the criteria for judging state transitions of different signal types. For example, for a limb boundary crossing trajectory, its signal differential threshold... It can be set to 100 to 150 pixels / s. Pixel / s is pixels per second. This value is based on statistical analysis of a large number of normal and illegal operation videos and is set to effectively distinguish between unintentional slow movement and intentional fast-reaching actions.

[0033] Assuming the application scenario is high-precision internal operation in a substation, the signal differential threshold... A smaller value of 100 pixels / s can be selected. For time-series data of two-dimensional coordinates of key body points, the system uses a sliding time window method to calculate the rate of change of distance between specific key points, such as the wrist, and the preset virtual safety boundary. This is the difference in continuous signal changes reflecting the trajectory of a person's limb crossing the boundary.

[0034] Specifically, the difference in continuous signal changes reflecting the trajectory of a person's limbs crossing the boundary is calculated using the following formula: In the formula, It represents the difference in continuous signal changes, and its physical meaning is the speed at which key points of a person's body approach or move away from the safety boundary; and These represent the points in time. and At the same time, specific key body points of a person are identified from video frames, such as the two-dimensional pixel coordinates of the wrist; This represents the virtual safety boundary marked in the video frame coordinate system; it can be a straight line or a polygonal area. It is a distance function used to calculate points. to the border The shortest Euclidean distance; and The timestamp is assigned to the video frame by the system's data acquisition interface service. This formula quantifies the dynamic trend of personnel crossing the boundary by calculating the change in distance from key points to the safety boundary per unit time. A negative value indicates that the key point is approaching the boundary.

[0035] For a Boolean sequence of protective equipment wearing states, any transition from "true" to "false" is considered a state transition. This is achieved when a continuous signal change difference is detected, such as the absolute value of the speed at which the wrist approaches the hazardous equipment. It exceeds the signal difference threshold set in the multimodal signal difference threshold matrix. And in the same time window Within this context, a coordinated trigger condition is met when the value of continuously sampled discrete IoT sensor data experiences a jump exceeding a preset safety threshold. This could be caused by factors such as an ambient temperature transient rate exceeding 0.5℃ / s, a sudden increase in hazardous gas concentration exceeding 10% of the safety specification limit, or a change in the task status field of a specific personnel in a semi-structured electronic work order change record. This represents the preset time tolerance range used to correlate multi-source asynchronous events. Its unit is seconds (s). The specific value of the tolerance range is calibrated based on the least common multiple of the heartbeat reporting frequency and video frame rate of the field sensor network.

[0036] At this point, the system performs an encapsulation operation to extract the unique identity of the person associated with the limb's boundary-crossing trajectory from the video analysis results, namely, the anomaly entity identifier. This anomaly entity identifier is the unique employee number parsed from facial recognition results in the video footage or from the RFID signal of the employee badge associated with the movement trajectory.

[0037] Simultaneously, the system records the specific values ​​that triggered the trigger, such as the exact speed at which the wrist approached the hazardous equipment and the state before and after the electronic work order change, as state transition parameters. State transition parameters are a set of data describing how the state changes; for example, for limb crossing the boundary, the parameter is the calculated speed value; for work order state changes, the parameter is the two state strings before and after the change.

[0038] The system also records information such as the timestamp, camera ID, and geographic coordinates of the triggered event as an environmental context pointer. The environmental context pointer is a data structure containing metadata, used to provide a spatiotemporal reference system for subsequent risk analysis. Its content includes at least the UTC timestamp of the event, the camera ID that triggered the event, and the GPS coordinates of the area covered by that camera.

[0039] The system organizes the abnormal subject identifier, state transition parameters, and environmental context pointer into a standardized data structure, generates and outputs a multi-dimensional state trigger signal packet to subsequent processing steps.

[0040] For example, suppose at a power grid infrastructure construction site, see... Figure 2 The figure illustrates the trajectory of a person's wrist key point to the virtual safety boundary in two scenarios, with a baseline of distance = 0, as a function of relative time. The solid line, representing scenario 1, indicates the person's limb moving from 60 pixels to 90 pixels from the boundary, signifying a safe departure. The lower solid line, also representing scenario 1, indicates the person's limb rapidly moving from 20 pixels to 10 pixels from the boundary in 0.1 seconds. The calculated speed -100 pixels / s exceeds the set threshold, and because it continuously approaches the virtual boundary, it is ultimately identified by the system as a dangerous boundary crossing trend, triggering an alarm.

[0041] The processing system received the following data stream at 14:30:05.000 UTC. From the video frame of camera CAM01, the system used a pose estimation algorithm to identify the key points of worker W012's wrist. Coordinates are (540) 320 pixels. A vertical virtual security boundary is preset in the video frame. Its equation is At this point, the distance from the key point on the wrist to the boundary... for pixels. At 14:30:05:200 UTC, in a new frame of video from camera CAM01, key points of the wrist of worker W012 are visible. If the coordinates become (510, 325) pixels, then the distance is... for pixels.

[0042] Meanwhile, the business system database found that the status field of electronic work order E789 associated with worker W012 changed from "Preparing" to "Working" at UTC time 14:30:05:150, constituting a sudden status change of the electronic work order. The system calculates the difference in continuous signal changes according to the formula. pixels / s. A positive value here indicates that the limb is moving away from the boundary, which is a safe behavior, and its absolute value does not exceed the preset threshold for limb boundary crossing trajectory.

[0043] Suppose in another scenario, at UTC time 15:00:10.000, the wrist point... The wrist point is located at coordinates (580, 400) pixels, a distance of 20 pixels, at UTC time 15:00:10.100. The coordinates are (610, 405) pixels, the distance is 10 pixels, and the boundary has been crossed. Simultaneously, the work order status associated with this worker changes to "in operation." The system calculates the speed as follows: pixels / s. Its absolute value is 100 pixels / s, assuming the out-of-bounds velocity threshold in this scene. Set to 80 pixels / s, because Furthermore, a work order status transition occurred, and the collaborative triggering condition was met. The system then generated a multi-dimensional status trigger signal packet, the contents of which are: the anomaly entity identifier is "W012"; the status transition parameters are {limb_trajectory_velocity: -100.0, work_order_status:{from: "Preparing", to: "Working"}}; and the environment context pointer is {timestamp: "15:00:10.100Z", camera_id: "CAM01", location: "39.9°N, 116.3°E"}. This signal packet is sent to the next step for processing.

[0044] In one embodiment of the present invention, the causal matching and risk assessment module is used to perform the following steps: Extract the abnormal subject identifier and state transition parameters recorded inside the trigger signal packet to construct a retrieval key value; By using search keys, subsequent state transition rule chains pointing to potential security vulnerabilities are matched in a causal knowledge fragmentation database in the security domain; Extract the subsequent state transition rule chain and define the transformation to generate the causal association rule chain.

[0045] Specifically, upon receiving the multi-dimensional state trigger signal packet generated by the multi-source data acquisition and cross-modal detection module, the system's internal causal matching and risk assessment module begins processing. This module parses the multi-dimensional state trigger signal packet, extracting the anomaly entity identifier and state transition parameters.

[0046] The type of the abnormal entity identifier, such as workers or construction machinery, is combined with the event type described by the state transition parameters, such as limb crossing boundaries or changes in the state of protective equipment, into a structured retrieval key. Using this retrieval key, the causal matching and risk assessment module initiates a query request to a pre-defined causal knowledge fragment database for the security domain.

[0047] The Safety Domain Causal Knowledge Fragment Repository is a structured knowledge storage system that formally represents safety regulations, expert experience, and historical accident cases in the field of power grid infrastructure. Each fragment in the repository is a knowledge entry, containing a triggering condition defined by the subject type and event type, as well as one or more subsequent state transition rule chains that may be triggered under this condition and their corresponding inherent severity scores. .

[0048] Subsequent state transition rule chains are ordered sequences that define the evolution path of potential accidents, such as ["person out of control" - "fall from height" - "contact with a live conductor"]. This knowledge base internally uses a hash-indexed key-value pair storage structure, capable of matching and returning one or more predefined subsequent state transition rule chains within microseconds based on the retrieved key.

[0049] Meanwhile, another processing thread in this module parses the environment context pointer in the multi-dimensional state trigger signal packet in parallel. Using the anomaly entity identifier as a foreign key, it performs a query operation on the personnel management database to extract the personnel qualification and experience registration data associated with the anomaly entity. This personnel qualification and experience registration data typically includes quantitative indicators such as the employee's technical level and years of service, used to describe each employee's operational capabilities and proficiency.

[0050] Simultaneously, utilizing the geographic coordinate information in the environmental context pointer, spatial queries are performed within a digital twin scenario built on a geographic information system to extract the spatial construction operation environment severity index corresponding to the work site. The spatial construction operation environment severity index is a pre-assessed value stored in a spatial database, which associates specific geographic coordinates with a comprehensive environmental hazard level. The comprehensive environment includes multi-dimensional environmental factors such as the area's altitude, electromagnetic interference intensity, and historical weather data, and is pre-calculated accordingly.

[0051] After successfully acquiring the subsequent state transition rule chain, personnel qualification and experience registration data, and the severity index of the space construction operation environment, the module calls a pre-built risk product algorithm for comprehensive calculation. The risk product algorithm is a mathematical model that integrates multiple risk factors. Its core idea is that the final risk is not a simple summation of the factors, but rather a product effect that mutually reinforces each other.

[0052] The risk product algorithm weights and fuses the inherent severity of subsequent state transition rule chains, the personnel risk correction factor derived from personnel qualification and experience registration data, and the severity index of the spatial construction operation environment to calculate a scalar value. This scalar value is defined as the initial risk assessment value used to characterize the degree of danger of the abnormal state trigger. Specifically, the initial risk assessment value is calculated using the risk product algorithm, and its specific mathematical expression is as follows: And the personnel risk correction factor The following exponential decay formula is used to calculate the output, ensuring that it is strictly constrained within the (0,1] interval: In the formula, The initial risk assessment value for the final output is a dimensionless scalar whose range is normalized to between 0 and 1. The inherent severity score represents the subsequent state transition rule chain matched from the causal knowledge fragment library in the safety domain. This score is a preset constant between 0 and 1, and its setting is based on the severity level classification of different accident types in the State Grid Safety Production Regulations and the statistical analysis results of historical accident data. This is a personnel risk correction factor calculated based on personnel qualification and experience registration data, and its value is inversely proportional to the personnel's qualification and experience level. To obtain the environmental severity index of the space construction operation; and These are preset weighting coefficients used to adjust the relative importance of human factors and environmental factors in the overall risk assessment. Both are positive real numbers and satisfy the following conditions: ; The qualification level of the representative is a positive integer; The effective working years of an employee are a positive real number. and It is an adjustment coefficient with corresponding dimensions and reciprocals that makes the exponential term dimensionless. It is used to adjust the contribution of qualification level and years of service. Specifically, its value is determined by collecting past records of violations and accidents involving infrastructure personnel, extracting the qualification and years of service data of the personnel involved, and using a logistic regression model to fit and train the accident probability.

[0053] The module formally names the retrieved subsequent state transition rule chain as the causal association rule chain. The causal association rule chain is the formal name used in this embodiment to emphasize its role as the topological foundation for subsequent graph evolution and reasoning. Subsequently, the module packages this causal association rule chain along with the calculated initial risk assessment value as the final output of this step and passes it to subsequent processing flows.

[0054] For example, following the example from the previous step, the causal matching and risk assessment module receives a multi-dimensional state trigger signal packet containing the identifier of the abnormal subject as W012. The system combines the subject type "employee" and the event type "limb out of bounds" into a retrieval key value to query the causal knowledge fragment library in the security domain.

[0055] Suppose a query hits a rule, and the returned subsequent state transition rule chain is ["person loses balance", "falls from height", "causes short circuit in the line below"]. This rule chain has a pre-defined inherent severity score. The value is 0.85. Taking the system using W012 as the identifier to query the personnel database and retrieve personnel qualification and experience registration data as an example: Qualification Level Level 2, valid working years It takes 1.5 years.

[0056] The system then uses the geographic coordinates "39.9°N, 116.3°E" in the context pointer to retrieve the environmental severity index of the high-altitude work site from the environmental risk map. The value is 0.7. Assume the system's preset weighting coefficient is... , adjustment coefficient , Calculate the risk adjustment factor for personnel. Next, the initial risk assessment value is calculated by substituting it into the risk product algorithm formula. This module outputs the following to the next module: a causal relationship rule chain of ["person loses balance", "falls from height", "causes short circuit in the line below"], and an initial risk assessment value of .

[0057] In one embodiment of the present invention, the state feature vector encoding module is configured to perform the following steps: Extract the semantics of all entity interoperability relationships covered within the causal association rule chain; The semantics of entity interoperability relationships are converted into a set of add, delete, and modify control instructions for structural modification of the underlying database, and the set of add, delete, and modify control instructions is extracted to serve as interoperability commands. The interoperability command execution serialization encoding mapping is written into the first preset length control channel bit segment of a floating-point array constructed in a fixed-size memory space.

[0058] Specifically, this embodiment describes the execution process of the state feature vector encoding module. In an event vector encoding service, the system receives and caches the causal association rule chain and initial risk assessment value output by the causal matching and risk assessment module. This service initiates a dual-channel encoding process to generate a fixed-dimensional floating-point array. The fixed-dimensional floating-point array is a contiguous, fixed-length storage space in memory, such as a one-dimensional array containing 256 floating-point numbers.

[0059] In the first channel, a semantic parsing and instruction generation unit is responsible for processing the causal association rule chain. This unit extracts the entity interoperability relation semantics recorded in the causal association rule chain one by one. The entity interoperability relation semantics refers to the textual description of the physical actions or state changes contained in each node in the causal association rule chain, such as a person losing balance or falling from a height.

[0060] For each extracted semantic fragment, the unit queries a pre-configured semantic-to-instruction mapping rule base to convert the text semantics into one or more atomic operation instructions targeting the underlying graph database. All the converted instructions are aggregated to form an ordered set of insert, delete, and update control instructions. This set of insert, delete, and update control instructions is a series of commands following a specific format, such as (COMMAND_CODE, SUBJECT_ID, OBJECT_ID, ATTRIBUTES), used to drive database state updates.

[0061] A control channel encoder serializes the set of add, delete, and modify control commands and maps them to a pre-declared address with a total length of [missing information]. The initial part of the fixed-dimensional floating-point array, i.e., the first preset length control channel bit segment. Wherein, This represents the total number of floating-point numbers that a fixed-dimensional floating-point array can hold. The first preset length control channel segment is the first... These elements, for example, the first 64 elements, are used to carry control commands. This represents the upper limit of the preset truncation length used to store topology control sequences.

[0062] In the second channel, the data channel encoder processes the overall semantics of the initial risk assessment value and the causal association rule chain in parallel. The initial risk assessment value itself, as a floating-point number, is adopted as the initial activation energy data required for the neural network feedforward computation without additional transformation. The initial activation energy data, a floating-point number derived from the initial risk assessment value, will be used as the initial strength for message passing in the graph neural network.

[0063] Secondly, a pre-trained sentence embedding model, such as the transformer-based bidirectional encoder-based sentence vector model Sentence-BERT, is invoked to process the complete text sequence of causal association rule chains, transforming it into a high-dimensional semantic representation vector. Here, semantic representation maps natural language text into numerical vectors that express its inherent meaning through a deep learning model. These numerical vectors capture the overall danger evolution logic of the causal association rule chains.

[0064] The initial activation energy data is concatenated to the header of the semantic representation vector, forming a composite data vector that integrates energy and semantics. To ensure the integrity and confidentiality of data transmission, this composite data vector undergoes lightweight encryption.

[0065] The encrypted composite data vector is written into the region immediately following the first preset length control channel segment of a fixed-dimensional floating-point array, specifically into the second preset length data channel segment. There are elements, among which The remaining available space of the array representing the energy data used for risk calculation, and satisfying the mathematical relationship. For example, the last 192 elements are used to carry risk calculation data.

[0066] To avoid exponent overflow or invalid states in the underlying floating-point numbers caused by direct algebraic operations, the system employs an XOR operation on the mantissa bits of the underlying floating-point memory structure. Specifically, the system uses pointer type casting or union mapping mechanisms to map the 32-bit floating-point numbers to the memory address of the fixed-dimensional floating-point array. The data is temporarily parsed into 32-bit unsigned integers. The pre-shared key vector K, also a 32-bit integer, is extracted and used for a bitwise XOR operation. To ensure the floating-point number's canonical structure is not corrupted, this XOR operation uses a binary security mask, only flipping and obfuscating the underlying 23-bit mantissa while retaining the 1-bit sign bit and 8-bit exponent region. After the operation, the memory structure is restored and parsed back into a floating-point type, generating ciphertext data. And write it into the region immediately following the first preset length control channel segment in the fixed-dimensional floating-point array, that is, the second preset length data channel segment.

[0067] After encoding and writing to both channels, the fixed-dimensional floating-point array of the full-loaded data is formally defined as the security event state feature vector and output as the product of this module. The security event state feature vector is the core data structure. Through structured design, graph topology modification instructions and risk evolution computation energy are encapsulated in the same transmittable data unit.

[0068] For example, following the output of the previous step, the causal relationship rule chain received by this module is ["person loses balance", "falls from height", "causes short circuit in the line below"], and the initial risk assessment value is 0.3576. The semantic parsing and instruction generation unit processes the causal relationship rule chain and queries the mapping rule base to generate the following set of add, delete, and modify control instructions: The first instruction for "person loses balance" is converted to (2.1, 12.0, 1.0, 5.0), where 2.1 represents the instruction code for updating node attributes, 12.0 represents the floating-point ID of person W012, 1.0 represents the status attribute code, and 5.0 represents the status code for losing balance; the second instruction for "falls from height" is converted to (3.1, 12.0, 99.0, 1.0), where 3.1 represents the instruction code for creating an edge, 99.0 represents the preset ground danger zone node ID, and 1.0 represents the edge type as a fall trajectory.

[0069] Assuming the first preset length control channel segment length is 16, the floating-point sequence [2.1, 12.0, 1.0, 5.0, 3.1, 12.0, 99.0, 1.0] encoded by the above two instructions is written into the first 8 positions of the array, and the remaining positions are filled with 0.0. Secondly, the initial risk assessment value of 0.3576 is used as the initial activation energy data.

[0070] Simultaneously, the sentence embedding model processes the entire causal association rule chain text and outputs a semantic representation vector, hypothetically 7-dimensional [0.21, -0.55, 0.13, 0.87, -0.32, 0.44, 0.09]. These vectors are then concatenated to form a composite data vector. The values ​​are [0.3576, 0.21, -0.55, 0.13, 0.87, -0.32, 0.44, 0.09]. Assume a pre-shared key vector. This is a pre-defined integer mask sequence. Based on the aforementioned mantissa bit XOR mechanism, for example, the first floating-point element 0.3576 is memory-mapped and then XORed with its corresponding key mask, changing the mantissa arrangement. Performing this operation on the entire vector yields the encrypted vector. The encryption vector is written into the second preset length data channel bit field. This is controlled by the [2.1, 12.0, ...] bits of the control channel and the data channel. The complete fixed-dimensional floating-point array that together forms the generated security event state feature vector.

[0071] In one embodiment of the present invention, the map mutation execution module is configured to perform the following steps: The opcodes contained in the interoperation commands are analyzed and the preset mapping table is consulted to accurately locate the target entity node within the dynamic spatiotemporal knowledge graph that is undergoing connection attribute changes. The control of the outer underlying graph database performs atomic operations such as physical disconnection or cross-level penetration and direct connection creation on the target entity node and the surrounding network, which act as topology mutation operations. Listen for and control the instructions to write back structural change data after the underlying graph database completes the topological mutation operation, and generate an updated graph based on the structural change data.

[0072] Specifically, this embodiment describes the execution process of the graph mutation execution module. The graph evolution service deployed on the server side runs continuously in daemon mode to listen for and process the state feature vector encoding module. The generated security event state feature vector. Once a new security event state feature vector is received, the graph evolution service places it into a processing queue. The queue processor segments a first preset length control channel bit segment from this vector.

[0073] Before processing this bit field, the system performs a simple check, such as checking if the data length conforms to a preset value, to ensure data integrity. After successful check, the instruction parser starts working, decoding and restoring the floating-point sequence within the first preset-length control channel bit field according to a predefined instruction structure, such as grouping four floating-point numbers together. This results in a set of add, delete, and modify control instructions containing multiple commands. The add, delete, and modify control instruction set is the logical representation of the encoded information within the first preset-length control channel bit field; it is an ordered list of machine-executable commands.

[0074] The set of add, delete, and modify control instructions is passed to the instruction dispatcher. The instruction dispatcher queries a pre-defined mapping table based on the first floating-point value of each instruction, i.e., the instruction opcode. The pre-defined mapping table is an in-memory hash table or dictionary structure that decouples the system's control logic from the underlying database implementation. The pre-defined mapping table maps numerical opcodes to specific graph database operation functions; for example, it maps opcode 2.1 to a function to update node attributes, and opcode 3.1 to a function to create relation edges.

[0075] The instruction dispatcher calls the corresponding function, passing the subsequent floating-point values ​​from the instruction, such as the entity ID and attribute values, as parameters. The called function dynamically constructs a query statement conforming to a graph database query language, such as the graph query language Cypher or the graph traversal language Gremlin, based on these parameters. The goal of the query statement is to locate one or more target entity nodes undergoing connection attribute changes within a pre-configured dynamic spatiotemporal knowledge graph.

[0076] Specifically, the dynamic spatiotemporal knowledge graph is a data structure built using an attribute graph model and stored in a high-performance graph database, such as the Neo4j database engine. This graph uses entity nodes to represent physical or logical entities such as personnel, equipment, and areas on-site, and relationship edges to represent dynamic or static relationships between entities, such as "located," "in use," and "prohibited." The graph stores entity status information, timestamps, and spatial coordinates through node and edge attributes. A target entity node is a graph node object uniquely designated by the ID parameter in a specific instruction when executing that instruction.

[0077] The underlying executor module encapsulates the connection driver to the graph database, responsible for submitting and executing the constructed query statement as an atomic transaction. The execution process performs microsecond-level operations on the target entity node and its adjacent relation edges, including but not limited to attribute modification, physical severing operations to delete the target relation edge, or cross-level penetrating direct connection creation operations to establish new relation edges between non-adjacent nodes.

[0078] The series of operations described above that instantaneously and discontinuously change the connectivity or node states of the graph can be collectively referred to as topological mutation operations. After a transaction is successfully committed, the data structure of the dynamic spatiotemporal knowledge graph is immediately written back and updated, resulting in an updated graph whose structure has undergone evolution. The updated graph is not a new copy of the graph, but rather refers to the latest state of the dynamic spatiotemporal knowledge graph after successfully executing a topological mutation operation.

[0079] For example, following the example from the previous step, the graph evolution service receives the security event state feature vector and extracts the content of its first preset length control channel segment, namely the floating-point sequence [2.1, 12.0, 1.0, 5.0, 3.1, 12.0, 99.0, 1.0, 0.0, ...]. The instruction parser first reads the first four non-zero floating-point numbers [2.1, 12.0, 1.0, 5.0] to form the first instruction. The instruction dispatcher queries the preset mapping table and finds that opcode 2.1 corresponds to the update node attribute operation.

[0080] The system constructs a Cypher query: MATCH (p:Worker {id: 12.0}) SET p.status = 5.0. The underlying executor sends this statement to the graph database. The database locates the target entity node representing worker W012 and updates its status attribute value to 5.0, which represents an unbalanced state in the system.

[0081] The instruction parser reads the last four non-zero floating-point numbers [3.1, 12.0, 99.0, 1.0] and forms the second instruction. The dispatcher queries the mapping table, maps opcode 3.1 to a relation edge creation operation, and constructs the query statement: MATCH (p:Worker{id: 12.0}), (z:Zone {id: 99.0}) CREATE (p)-[r:FALLING_PATH {timestamp: "15:00:10.100Z"}]->(z).

[0082] The underlying executor executes this statement, creating a new directed edge of type FALLING_PATH between the node representing worker W012 and the node representing the ground danger zone, as a cross-level penetration direct connection creation operation. These two commands are encapsulated in a transaction and committed. After successful commit, the state of the dynamic spatiotemporal knowledge graph is changed, forming an updated graph containing the new state of node W012 and the new fall path relationship.

[0083] In one embodiment of the present invention, the local subgraph activation module is configured to perform the following steps: The graph structure entity connecting both ends of the core affected relationship edge serves as the starting node for subgraph search; Within the updated graph, based on the traversal depth controlled by a preset hop count limit, all associated entity nodes and associated physical relationship edges within the reachable range of the subgraph search starting node are extracted and summarized into neighbor network elements. By reconstructing the topological connectivity state using neighbor network elements, a locally diffused activation subgraph with feedforward inference boundary settings is constructed.

[0084] Specifically, this embodiment describes the execution process of the local subgraph activation module. After the topology mutation operation in the graph mutation execution module is successfully executed, the subgraph activation module is triggered. The subgraph activation module determines and analyzes the specific implementation record trajectory of the topology mutation operation. The specific implementation record trajectory is a log entry generated by the graph database after executing a write transaction, which provides a description of the graph structure change.

[0085] The implementation log, returned by the underlying executor, details which nodes or edges were created, deleted, or modified. The subgraph activation module parses this log to identify and pinpoint the relation edge that fundamentally changes the graph's topological connectivity—for example, a newly created or deleted edge—and uniquely designates it as the core affected relation edge. The core affected relation edge is the directly manipulated relation edge that best represents the causal relationship of the event in a topological mutation operation. For example, when the event is "enter," it's the newly created "located" relation edge; when the event is "decouple," it's the deleted "attached" relation edge.

[0086] After identifying the core affected relationship edges, the system uses the two entity nodes connected by that edge as the starting node for subgraph search. The subgraph search starting node is the starting node for graph traversal; for a relationship edge, it includes both the source and target nodes. The system initiates a breadth-first search-based topology traversal algorithm to explore connections within the updated graph structure. This traversal process is constrained by a preset neighbor node hop count limit depth. This limit is a preset integer, such as 2 or 3, used to control the size of the local subgraph and prevent computational resources from being consumed by unrelated, distant nodes. This hop count limit depth is set based on domain knowledge, meaning that the impact of a local security event is typically physically or logically limited.

[0087] The traversal begins with the starting node of the subgraph search and expands outwards layer by layer, collecting all related entity nodes reachable within a specified number of hops, as well as all related physical relationship edges connecting these nodes. The related entity nodes and related physical relationship edges are the set of all graph elements discovered during the traversal process that satisfies the hop count limit.

[0088] Once the topology traversal process reaches the preset hop count limit and terminates, the system collects all the associated entity nodes and associated physical relationship edges extracted during the process. A subgraph builder is then invoked, using these extracted graph elements to reconstruct a smaller graph data structure. This newly generated subgraph fully preserves the original connection relationships and attribute information between its internal nodes, but its boundaries are strictly limited within the hop count limit, effectively isolating the potential risk propagation range. The subgraph is ultimately formally named the Local Diffusion Activation Subgraph, used to define the boundaries of feedforward inference, and is passed as the output of this module to the next step. The Local Diffusion Activation Subgraph is a bounded subgraph structure dynamically extracted from the updated graph, centered on the event core, defining the computational space for the upcoming graph neural network inference computation.

[0089] For example, continuing from the previous step, the most critical change in the topology mutation operation is identified as the creation of a new relationship edge, namely the FALLING_PATH relationship established between worker node W012 and the ground danger zone node. Therefore, this newly created edge is uniquely designated as the core affected relationship edge. The system uses both endpoints of this edge, namely node W012 and the ground danger zone node, as the starting nodes for subgraph search.

[0090] Assuming a preset hop count limit of 2 for neighbor nodes, a breadth-first search is performed starting from these two nodes. In the first hop, the traverser finds that the nodes directly connected to node W012 include the safety helmet node (with the relationship of wearing it) and the work group node (with the relationship of belonging to it); the node directly connected to the ground danger zone node is the lower line A node (with the relationship of covering it). In the second hop, the traverser starts from the work group node and finds the team leader node L03; starting from the lower line A node, it finds the main transformer node T1. The traversal reaches the 2-hop depth limit and the search stops.

[0091] The system collects all visited associated entity nodes, including W012, the ground hazard zone, the safety helmet, the work team, the line below A, the team leader L03, the main transformer T1, and all connected physical relationship edges. The system concatenates these nodes and edges to construct a locally diffused activation subgraph containing 7 nodes and related edges, and then passes it to the next step.

[0092] In one embodiment of the present invention, the risk trend inference module is configured to perform the following steps: The initial activation energy data is captured, decrypted, and reverse-engineered to release the original scalar floating-point value. The function is used to force the release of scalar floating-point values ​​to be assigned to the internal initial connection weights of the affected relation edges inside the local diffusion activation subgraph. The pre-trained graph neural network inference engine is launched within the topological space limited to the local diffusion activation subgraph, and the pre-trained graph neural network inference engine is used to drive multi-round graph node message passing interaction operations.

[0093] Specifically, this embodiment describes the execution process of the risk trend inference module. A pre-built graph neural network inference service, upon receiving the locally diffused activation subgraph output by the local subgraph activation module and the security event state feature vector generated by the state feature vector encoding module, initiates a constrained feedforward inference calculation. The inference service parses the security event state feature vector and extracts its second preset length data channel bit segment.

[0094] By performing the decryption operation, which is the inverse of the encryption operation in the state feature vector encoding module, the XOR operation is reflexive. The inference service uses the same memory mapping mechanism to perform a bitwise XOR operation on the corresponding mask bits of the pre-shared key vector, thus losslessly decoding and releasing the original composite data vector. The first element of this composite data vector is the initial activation energy data. This initial activation energy data is a floating-point representation of the initial risk assessment value calculated by the causal matching and risk assessment module, and it is injected into the calculation process as a driving source of risk evolution.

[0095] The inference service locates the core affected relation edge, uniquely identified by the local subgraph activation module, within the data structure of the locally diffused activation subgraph. The internal initial connection weight attribute of this relation edge is then directly assigned to the decoded initial activation energy data. The internal initial connection weight is a specific attribute field of the core affected relation edge in the graph data structure, used to represent the message passing capability of that edge in the graph neural network (GNN) computation.

[0096] After energy injection, the inference service activates and runs the pre-trained graph neural network inference engine. This pre-trained graph neural network inference engine is a graph-based deep learning model. Before deployment, it undergoes offline supervised training using a graph dataset converted from historical power grid safety accident investigation reports. During training, the cross-entropy loss between the predicted risk evolution trend vector and the evolution path marker vectors of real historical accidents is used as the objective function. Gradient descent is used for backpropagation to update the weight matrix parameters in the network. After multiple iterations until the loss function converges, the network parameters are solidified, enabling it to learn complex patterns from the graph structure and node features.

[0097] The computational scope of the neural network inference engine is limited to the topology of the locally diffused activation subgraph, meaning that only this subgraph is used as input to the computation graph, thus ensuring the locality of computation. Based on the newly injected internal initial connection weights, the inference engine initiates multi-round graph node message passing interaction computation. Multi-round graph node message passing interaction computation is the core mechanism of GNNs. Through this mechanism, nodes can perceive information about their multi-hop neighbors, thereby achieving global information propagation and aggregation. Specifically, the core process of multi-round graph node message passing interaction computation can be represented by the following formula for updating the normalized hierarchical random walk adapted to the directed graph structure: In the formula, It is the local diffusion activation subgraph where all nodes are in the th... The feature matrix during round computation, where These are the initial input features of the nodes; It is the adjacency matrix of the locally diffused activation subgraph, with self-loops added, i.e. ,in This is the original adjacency matrix. It is an identity matrix. Crucially, in the matrix... In this context, the element value corresponding to the core affected relation edge is set to the internal initial connection weight assigned by the initial activation energy data, instead of the traditional 1; yes The out-degree diagonal matrix; Used to normalize the propagation of asymmetric directed information; It is a pre-trained graph neural network inference engine in the first... The trainable weight matrix of the layer has its parameters learned offline using historical data; It is a non-linear activation function, such as the linear rectified ReLU function. It is a node feature matrix that has been updated after a round of message passing and aggregation, representing the new distribution of risk features after propagation on the graph.

[0098] In each round of computation, each node aggregates the feature representations of its neighbors and updates its own feature representation through a non-linear transformation. Since the weights of the core affected edges are set by the initial activation energy data, their message strength is initially higher than other edges, thus guiding the initial diffusion direction of risk energy. After several rounds of iterative aggregation until convergence, the inference engine prompts the hidden dimension features within the locally diffused activation subgraph to complete the physical diffusion of spatial risk energy. This diffusion process may exhibit attenuation or multi-way cross-enhancement due to the inhibitory or reinforcing properties of nodes in the graph. The physical diffusion, attenuation, or multi-way cross-enhancement of spatial risk energy is a visual description of the message transmission process; the enhancement or attenuation of energy depends on the attributes of other nodes on the path and the weights of the edges.

[0099] Starting from the outermost free edge nodes of the locally diffused activation subgraph (i.e., nodes located on the hop count limit depth boundary of neighboring nodes during subgraph construction), the final hidden state feature vectors are extracted. These vectors are then concatenated into a new higher-dimensional vector, which is output as the risk evolution trend vector. Furthermore, the outermost free edge node refers to a node in the locally diffused activation subgraph that is exactly at the preset hop count limit depth from the subgraph search starting node. The risk evolution trend vector is the final output of this module; it is a high-dimensional floating-point vector whose internal numerical patterns encode the direction, intensity, and ultimate potential impact range of risk evolution from the center outwards.

[0100] For example, following the example from the previous step, the inference service receives a locally diffused activation subgraph containing 7 nodes and a security event state feature vector. The inference service decodes the initial activation energy data of 0.3576 from the data channel of the vector.

[0101] In the locally diffused activation subgraph, the core affected relationship edge FALLING_PATH connecting node W012 and the ground danger zone node is located, and its initial connection weight is set to 0.3576. Next, this subgraph is fed into a pre-trained graph neural network inference engine with a preset 3 layers. In the first round of computation, because the weight of the FALLING_PATH edge is much larger than the default weight of 1 for other edges, the feature vectors of node W012 and the ground danger zone node will carry the strongest risk signal after the update.

[0102] In the second round of calculation, strong risk signals are propagated from the ground danger zone node to the line A node below its one-hop neighbor through the message passing mechanism, and at the same time from the W012 node to the corresponding work group node.

[0103] In the third round of calculations, the risk signal further propagated from line A below to the main transformer T1 node, and from the corresponding work team to the team leader L03 node. After the calculations were completed, the system identified the main transformer T1 and the team leader L03 as the outermost free edge nodes.

[0104] The system extracts the final hidden state vectors of these two nodes, assuming they are [0.85, 0.12, -0.45] and [-0.22, 0.91, 0.05], respectively. The system concatenates these two vectors to generate the final 6-dimensional risk evolution trend vector: [0.85, 0.12, -0.45, -0.22, 0.91, 0.05], and outputs it to the next stage.

[0105] In one embodiment of the present invention, the risk decoding and intervention decision-making module is used to perform the following steps: By using a safety category decoder with time-series autoregressive properties, the risk evolution trend vector is decoded and translated into a semantic text structure, and the reconstructed and combined data is used to generate a sequence of subsequent state transition prediction nodes containing a multi-level causal transmission chain of hazard occurrence. For dangerous event nodes that are consecutively mapped within the subsequent state transition prediction node sequence, a probabilistic statistical micro-model is attached to perform conditional calculations to obtain the estimated probability results and the shortest time occurrence window flag. Nodes that exceed the threshold of the red line of the pre-prevention key prevention rules are screened and identified as target dangerous nodes. The target dangerous nodes are then integrated with spatial positioning to derive a risk management and proactive intervention strategy carrying visualized and overlaid alarm data.

[0106] Specifically, this embodiment describes the execution process of the risk decoding and intervention decision-making module. After receiving the risk evolution trend vector output by the risk trend inference module, the risk decision generation service initiates the safety category decoder to parse it. The safety category decoder is a decoding model that forms a dual relationship with the graph neural network encoder. Its function is to restore the abstract vector encoded in the latent space into structured sequence data.

[0107] The security category decoder is a recurrent neural network model, such as a Long Short-Term Memory (LSTM) network, that is pre-paired and jointly trained with a pre-trained graph neural network inference engine during the design phase. During joint training, an encoder-decoder architecture is employed, using the graph embedding features extracted by the graph neural network as the initial hidden state input to the LSTM decoder. Furthermore, a Teacher Forcing mechanism is used, employing historical security event sequence text as truth labels to guide decoder generation, thereby achieving cross-modal mapping from spatial graph features to temporal sequence features.

[0108] The decoder, following a pre-defined temporal decoding process, gradually translates the risk evolution trend vector (a high-dimensional floating-point matrix) into readable text semantics with clear causal logic.

[0109] The decoding process is autoregressive, meaning that the text terms generated in the previous step serve as input for the next step, until a specific terminator is generated. The decoder concatenates all generated text terms to reconstruct a sequence of subsequent state transition prediction nodes containing at least a three-level causal chain leading to the occurrence of a hazard. This sequence of subsequent state transition prediction nodes is a natural language text describing the risk evolution path, typically structured as event A leading to event B, which in turn triggers event C.

[0110] After generating the subsequent state transition prediction node sequence, the system performs node-by-node analysis. For the first danger occurrence node in the sequence and all subsequent derived danger occurrence nodes, the system calls independent probabilistic statistical micro-models for each. These probabilistic statistical micro-models are a series of lightweight machine learning models that rapidly assess the probability of a specific risk node. For example, a simple Bayesian classifier, based on the node's own attribute features and its position in the sequence, quickly calculates the estimated probability of the danger node occurring in the future. The estimated probability is a value between 0 and 1, output by the micro-model, representing the likelihood of a specific dangerous event occurring.

[0111] Simultaneously, based on the historical data and statistical analysis of the evolution time distribution of similar events, the system establishes a countdown-style shortest-time occurrence window flag for each dangerous node. This flag indicates the earliest time that the dangerous event is expected to occur. Specifically, the shortest-time occurrence window flag is a quantitative indicator used to represent the time interval between the predicted dangerous event and the current time point.

[0112] The decision-making and intervention instruction generation module comprehensively judges the estimated probability results of all dangerous nodes and the shortest occurrence window indicator. This module compares these values ​​with a preset pre-emptive key prevention rule red line threshold. For example, intervention is triggered when the estimated probability is greater than 0.8 and the shortest occurrence window is less than 30 seconds. The pre-set pre-emptive key prevention rule red line threshold is calibrated by inputting historical power grid safety exercise and real accident data into a kernel density estimation model, extracting the 95th percentile of the accident evolution probability leading to irreversible serious consequences and the 5th percentile of the shortest response time as benchmarks.

[0113] All hazardous nodes that meet the red line threshold conditions are selected as target hazardous nodes requiring immediate intervention. For each target hazardous node, the system generates a risk management proactive intervention strategy with corresponding spatial coordinate system 3D visualization enhancement display overlaid with alarm instruction data. The risk management proactive intervention strategy is the final output, a set of instructions that can be executed by the computer system, designed to prevent the predicted risk chain from becoming a reality through information warnings or physical controls.

[0114] The strategy is concretized into a single instruction. For example, the physical entities involved in the target hazardous node are highlighted with a red box on the large screen in the monitoring center, and an alarm containing text, voice, and vibration prompts is simultaneously sent to the handheld terminals of on-site management personnel. These instruction data are transmitted via the network to the physical control equipment or management personnel terminals on-site, initiating actual intervention actions and forming a closed loop for risk control execution.

[0115] For example, following the example from the previous step, the risk decision generation service receives the risk evolution trend vector [0.85, 0.12, -0.45, -0.22, 0.91, 0.05]. The safety category decoder uses this vector as the initial hidden state input and generates the following text sequence in sequence: The trajectory of worker W012's fall will cause it to collide with line A below, then the collision will cause line A to short-circuit to ground, and finally the short circuit will trace back to cause the main transformer T1 to overload and trip. After concatenation, a subsequent state transition prediction node sequence is formed.

[0116] The system uses a probabilistic statistical micro-model to evaluate the three dangerous nodes in the sequence: impact on line A below, short circuit to ground on line A, and overload tripping of main transformer T1. The evaluation results are as follows: the estimated probability of impact on line A below is 0.92, with a minimum occurrence window of 5 seconds; the estimated probability of a short circuit to ground on line A is 0.88, with a minimum occurrence window of 6 seconds; and the estimated probability of overload tripping of main transformer T1 is 0.75, with a minimum occurrence window of 15 seconds.

[0117] Assume the system's pre-emptive prevention rule threshold is a probability greater than 0.85 and a time window less than 10 seconds. By comparison, the two nodes that collide with line A below and those that short-circuit line A to ground meet this condition and are selected as target hazardous nodes. The system generates two proactive risk management intervention strategies.

[0118] See Figure 3 As shown in the figure, the shortest occurrence window is marked on the horizontal axis, and the estimated probability of the hazardous event is marked on the vertical axis, intuitively displaying the risk level of each predicted node. The figure uses dashed and dotted lines to delineate the target area for triggering the forward-looking intervention strategy, defined by the estimated probability red line threshold of 0.85 and the shortest time red line threshold of 10s (the light gray area in the upper left corner). It can be seen that both the impact on line A below and the short circuit between line A and ground fall within this high-risk target area, while the overload tripping node of the main transformer T1, due to its longer time window and relatively lower probability, is outside the target area. Based on this, the system accurately locates the target hazardous nodes and generates intervention strategies.

[0119] The first strategy is as follows: In the 3D monitoring interface, the current position of worker W012 (entity ID 12.0) and the line A directly below him (entity ID 25.0) will be highlighted with a flashing red light, and a fall impact warning text label will be displayed over it.

[0120] The second strategy is to send a high-level voice alert ("Warning! W012 is about to fall and touch a high-voltage line!") along with a vibration alert to the handheld device (device ID H789) of the on-site area manager, L03. These two strategies are then packaged into a JSON data packet and distributed wirelessly to the monitoring system and the manager's handheld terminal for execution.

[0121] See appendix Figure 4 This invention proposes an artificial intelligence-based method for power grid infrastructure safety management, comprising the following steps: S1. Acquire multi-source heterogeneous state data streams, use a preset multi-modal signal differential threshold matrix to detect state transitions, and generate multi-dimensional state trigger signal packets. S2. Input the trigger signal packet into the causal knowledge fragment library in the security domain for matching and calculation, extract the causal association rule chain, and output the initial risk assessment value by combining it with the risk product algorithm; S3. Write the interoperation commands contained in the causal association rule chain into the first preset length control channel bit segment of the floating-point array, and convert the initial risk assessment value into encrypted initial activation energy data, write it into the second preset length data channel bit segment of the array, and merge and output the security event state feature vector. S4. Parse the interoperation commands within the control channel bit segment, and perform a topological mutation operation on the pre-configured dynamic spatiotemporal knowledge graph accordingly to generate an updated graph; S5. Identify the core affected relationship edges in the updated graph, and extract the neighbor network elements that meet the preset hop count limit as the starting point, and splice them to construct a local diffusion activation subgraph. S6. Extract the initial activation energy data from the data channel segment and inject it into the local diffusion activation subgraph to trigger the pre-trained graph neural network inference engine to perform calculations and extract the output risk evolution trend vector from the edge free nodes. S7. Decode the risk evolution trend vector to generate the subsequent state transition prediction node sequence, screen the target dangerous nodes through probability calculation, and then generate a forward-looking intervention strategy for risk management.

[0122] Each of the modules can be implemented in whole or in part through software, hardware, or a combination thereof. It supports hardware embedded in or independent of the processor in the computer device, and also supports software stored in the memory of the computer device, so that the processor can call and execute the operations corresponding to each of the above modules.

[0123] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. An artificial intelligence-based power grid infrastructure safety management system, characterized in that, include: The multi-source data acquisition and cross-modal detection module acquires multi-source heterogeneous state data streams, uses a preset multi-modal signal differential threshold matrix to detect state transitions, and generates multi-dimensional state trigger signal packets. The causal matching and risk assessment module will trigger the signal packet input to the causal knowledge fragment library in the security field for matching calculation, extract the causal association rule chain, and output the initial risk assessment value by combining the risk multiplication algorithm; The state feature vector encoding module writes the interoperability commands contained in the causal association rule chain into the first preset length control channel bit segment of the floating-point array, converts the initial risk assessment value into encrypted initial activation energy data, writes it into the second preset length data channel bit segment of the array, and merges and outputs the security event state feature vector. The graph mutation execution module parses the interoperability commands within the control channel bit segment and performs topological mutation operations on the pre-configured dynamic spatiotemporal knowledge graph accordingly to generate an updated graph. The local subgraph activation module identifies the core affected relationship edges in the updated graph, extracts neighbor network elements that meet the preset hop count limit as the starting point, and splices them to construct a local diffusion activation subgraph. The risk trend inference module extracts the initial activation energy data from the data channel segment and injects it into the local diffusion activation subgraph, triggering the pre-trained graph neural network inference engine to perform calculations and extract the output risk evolution trend vector from the edge free nodes. The risk decoding and intervention decision-making module decodes the risk evolution trend vector to generate a sequence of predicted nodes for subsequent state transitions, filters target dangerous nodes through probability calculations, and then generates forward-looking intervention strategies for risk management.

2. The power grid infrastructure safety management system based on artificial intelligence according to claim 1, characterized in that, State transition detection is performed using a preset multimodal signal differential threshold matrix to generate a multidimensional state trigger signal packet, including the following steps: Separate continuously sampled discrete IoT sensor data, unstructured continuous video frame data, and semi-structured electronic work order change records from multi-source heterogeneous state data streams. The difference between continuous signal changes reflecting the trajectory of a person's limbs crossing the boundary and the wearing status of protective equipment in unstructured continuous video frame data is extracted using a multimodal signal differential threshold matrix. When the difference in continuous signal changes exceeds the corresponding set threshold in the multimodal signal differential threshold matrix and the continuously sampled discrete IoT sensor data undergoes a jump, the abnormal subject identifier, state transition parameters, and environmental context pointer are extracted, encapsulated and replaced, and then merged and assembled to output a multidimensional state trigger signal packet.

3. The power grid infrastructure safety management system based on artificial intelligence according to claim 1, characterized in that, The trigger signal packet is input into the causal knowledge fragment library in the security domain for matching and calculation, and the causal association rule chain is extracted, including the following steps: Extract the abnormal subject identifier and state transition parameters recorded inside the multidimensional trigger signal packet to construct a retrieval key value; By using search keys, subsequent state transition rule chains pointing to potential security vulnerabilities are matched in a causal knowledge fragmentation database in the security domain; Extract the subsequent state transition rule chain and define the transformation to generate the causal association rule chain.

4. The power grid infrastructure safety management system based on artificial intelligence according to claim 1, characterized in that, The initial risk assessment value is output using the risk product algorithm, including the following steps: The environmental context pointer carried inside the multi-dimensional state trigger signal packet is obtained and spatially mapped and transformed to extract the personnel qualification and experience registration data and the environmental severity index of the spatial construction operation corresponding to the on-site operation. The pre-set risk product algorithm is invoked to calculate the comprehensive weighted product of the inherent severity of the accident, personnel qualification and experience registration data, and the harshness index of the spatial construction operation environment contained in the causal association rule chain; The output of the weighted product serves as the initial risk assessment value used to characterize the degree of danger.

5. The power grid infrastructure safety management system based on artificial intelligence according to claim 1, characterized in that, Writing the interoperation commands contained in the causal association rule chain into the first preset length control channel bit field of the floating-point array includes the following steps: Extract the semantics of all entity interoperability relationships covered within the causal association rule chain; The semantics of entity interoperability relationships are converted into a set of add, delete, and modify control instructions for structural modification of the underlying database, and the set of add, delete, and modify control instructions is extracted to serve as interoperability commands. The interoperability command execution serialization encoding mapping is written into the first preset length control channel bit segment of a floating-point array constructed in a fixed-size memory space.

6. The power grid infrastructure safety management system based on artificial intelligence according to claim 1, characterized in that, Based on this, a topological mutation operation is performed on the pre-configured dynamic spatiotemporal knowledge graph to generate an updated graph, including the following steps: The opcodes contained in the interoperation commands are analyzed and the preset mapping table is consulted to accurately locate the target entity node within the dynamic spatiotemporal knowledge graph that is undergoing connection attribute changes. The control of the outer underlying graph database performs atomic operations such as physical disconnection or cross-level penetration and direct connection creation on the target entity node and the surrounding network, which act as topology mutation operations. Listen for and control the write-back instructions of structural change data after the outer bottom-level graph database completes the topological change operation, and generate an updated graph according to the structural change data.

7. The power grid infrastructure safety management system based on artificial intelligence according to claim 1, characterized in that, Constructing a locally diffused activation subgraph by splicing together the data includes the following steps: The graph structure entity connecting both ends of the core affected relationship edge serves as the starting node for subgraph search; Within the updated graph, based on the traversal depth controlled by a preset hop count limit, all associated entity nodes and associated physical relationship edges within the reachable range of the subgraph search starting node are extracted and summarized into neighbor network elements. By reconstructing the topological connectivity state using neighbor network elements, a locally diffused activation subgraph with feedforward inference boundary settings is constructed.

8. The power grid infrastructure safety management system based on artificial intelligence according to claim 1, characterized in that, Triggering the pre-trained graph neural network inference engine to perform calculations includes the following steps: The initial activation energy data is captured, decrypted, and reverse-engineered to release the original scalar floating-point value. The function is used to force the release of scalar floating-point values ​​to be assigned to the internal initial connection weights of the affected relation edges inside the local diffusion activation subgraph. The pre-trained graph neural network inference engine is launched within the topological space limited to the local diffusion activation subgraph, and the pre-trained graph neural network inference engine is used to drive multi-round graph node message passing interaction operations.

9. The power grid infrastructure safety management system based on artificial intelligence according to claim 1, characterized in that, Targeted high-risk nodes are screened through probability calculations, and then proactive risk management intervention strategies are generated, including the following steps: By using a safety category decoder with time-series autoregressive properties, the risk evolution trend vector is decoded and translated into a semantic text structure, and the reconstructed and combined data is used to generate a sequence of subsequent state transition prediction nodes containing a multi-level causal transmission chain of hazard occurrence. For dangerous event nodes that are consecutively mapped within the subsequent state transition prediction node sequence, a probabilistic statistical micro-model is attached to perform conditional calculations to obtain the estimated probability results and the shortest time occurrence window flag. Nodes that exceed the threshold of the red line of the pre-prevention key prevention rules are screened and identified as target dangerous nodes. The target dangerous nodes are then integrated with spatial positioning to derive a risk management and proactive intervention strategy carrying visualized and overlaid alarm data.

10. A power grid infrastructure safety management method based on artificial intelligence, characterized in that, Includes the following steps: S1. Acquire multi-source heterogeneous state data streams, use a preset multi-modal signal differential threshold matrix to detect state transitions, and generate multi-dimensional state trigger signal packets. S2. Input the trigger signal packet into the causal knowledge fragment library in the security domain for matching and calculation, extract the causal association rule chain, and output the initial risk assessment value by combining it with the risk product algorithm; S3. Write the interoperation commands contained in the causal association rule chain into the first preset length control channel bit segment of the floating-point array, and convert the initial risk assessment value into encrypted initial activation energy data, write it into the second preset length data channel bit segment of the array, and merge and output the security event state feature vector. S4. Parse the interoperation commands within the control channel bit segment, and perform a topological mutation operation on the pre-configured dynamic spatiotemporal knowledge graph accordingly to generate an updated graph; S5. Identify the core affected relationship edges in the updated graph, and extract the neighbor network elements that meet the preset hop count limit as the starting point, and splice them to construct a local diffusion activation subgraph. S6. Extract the initial activation energy data from the data channel segment and inject it into the local diffusion activation subgraph to trigger the pre-trained graph neural network inference engine to perform calculations and extract the output risk evolution trend vector from the edge free nodes. S7. Decode the risk evolution trend vector to generate the subsequent state transition prediction node sequence, screen the target dangerous nodes through probability calculation, and then generate a forward-looking intervention strategy for risk management.

Images