A factory security multi-event alarm root cause analysis method and system

Abstract

This invention belongs to the technical field of alarm root cause analysis methods, and particularly relates to a method and system for multi-event alarm root cause analysis in factory security. It constructs a dynamic coupling calibration system for the environment and sensors, achieving source separation of environmental interference and equipment fault data through online adaptive weight allocation and temporal drift detection. Based on the factory layout, a sensor-related topology network is constructed, and combined with spatiotemporal constraints and an improved temporal clustering algorithm, alarm data simplification and instantaneous false alarm elimination are achieved. Differentiated identification logic is designed for three scenarios: perimeter, workshop, and video, accurately filtering non-safety trigger sources through models and algorithms. Relying on a knowledge graph of multi-dimensional nodes and association rules, combined with real-time operating data and causal reasoning algorithms, high-confidence root causes and a visual verification chain are output. An edge and private cloud collaborative system is deployed, with the edge preprocessing alarm data and the private cloud optimizing the model through incremental learning and transfer learning.

Description

Technical Field

[0001] This invention belongs to the technical field of alarm root cause analysis methods, and particularly relates to a method and system for multi-event alarm root cause analysis in factory security. Background Technology

[0002] Existing factory security systems mostly employ a decentralized deployment approach with independent sensor monitoring and single video detection. The recognition logic for perimeter, workshop, and video scenarios is fragmented, lacking dedicated filtering solutions for typical non-safety triggers in industrial environments such as birds, windblown debris, dust, and water mist. Environmental interference signals and sensor malfunction data cannot be accurately separated at the source, resulting in a large number of instantaneous false alarms and duplicate alarms being uploaded directly without simplification, leading to a proliferation of redundant alarm information. Furthermore, the system lacks a sensor interconnection topology network based on the factory layout, and lacks spatiotemporal constraints and multi-sensor cross-validation mechanisms. False triggers from isolated sensors are easily interpreted as valid alarms, making it difficult to adapt to complex on-site environments with day-night cycles, weather changes, and fluctuating production conditions.

[0003] Current root cause analysis of security alarms largely relies on fixed rule matching or simple data statistics, failing to construct a multi-dimensional knowledge graph covering equipment, sensors, processes, faults, environment, and personnel operations. Causal inference algorithms cannot effectively eliminate false associations or quantify the strength of true causal relationships, making it difficult to output high-confidence root causes and visualized verification chains. Furthermore, the system lacks an edge-cloud collaborative architecture, preventing local models from achieving iterative optimization through cloud-based incremental and transfer learning. Feature weights, judgment thresholds, and inference parameters are all statically configured, unable to dynamically adjust with changing scenarios. Ultimately, this results in low root cause localization accuracy, significant false positives and false negatives, and maintenance personnel's inability to quickly locate the source of faults, drastically reducing the response efficiency and reliability of factory security management. Summary of the Invention

[0004] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a method for root cause analysis of multi-event alarms in factory security, the method comprising: Construct a dynamic coupling calibration system for environment and sensors, and achieve source separation of environmental interference and equipment fault data through online adaptive weight allocation and time-series drift detection; Based on the factory layout, a sensor association topology network is constructed. By combining spatiotemporal constraints and an improved temporal clustering algorithm, alarm data simplification and instantaneous false alarm elimination are achieved. Differentiated recognition logic is designed for three types of scenarios: perimeter, workshop, and video, and non-safety trigger sources are accurately filtered through models and algorithms; Based on a knowledge graph with multi-dimensional nodes and association rules, combined with real-time working condition data and causal reasoning algorithms, it outputs high-confidence root causes and visual verification chains. Deploy a collaborative system between the edge and private cloud. The edge device preprocesses alarm data, while the private cloud optimizes the model through incremental learning and transfer learning.

[0005] Furthermore, embodiments of the present invention also provide a factory security multi-event alarm root cause analysis system, characterized in that it includes: A processor; a machine-readable storage medium for storing machine-executable instructions of the processor; wherein the processor is configured to execute the above-described factory security multi-event alarm root cause analysis method by executing the machine-executable instructions.

[0006] In another aspect, embodiments of the present invention also provide a computer program product, the computer program product including machine-executable instructions, the machine-executable instructions being stored in a computer-readable storage medium, a processor of a computer device reading the machine-executable instructions from the computer-readable storage medium, the processor executing the machine-executable instructions, causing the computer device to execute the above-described factory security multi-event alarm root cause analysis method.

[0007] Based on the above, through dynamic coupling calibration of environment and sensors, construction of sensor-related topology networks, and differentiated identification logic for three types of scenarios, accurate separation of environmental interference and equipment failure can be achieved at the data source. Combined with spatiotemporal constraints and improved clustering algorithms, instantaneous false alarms are significantly eliminated and redundant alarms are merged, significantly reducing the number of invalid alarms. Precise filtering is achieved for non-safety triggering sources such as perimeter birds and debris, workshop dust and water mist, and video light and shadow materials. Multi-sensor cross-validation and dynamic threshold adaptation greatly improve the target recognition accuracy under complex working conditions, ensuring the stability and reliability of security detection under different time periods, weather conditions, and production states.

[0008] This invention relies on multi-dimensional knowledge graphs and causal reasoning algorithms to quickly output high-confidence alarm root causes and generate visual verification chains. Root cause location is accurate and the reasoning process is traceable, significantly shortening fault diagnosis and handling time. The edge-cloud collaborative architecture enables real-time preprocessing of alarm data and cloud-based iterative optimization of the model. Incremental learning and transfer learning allow the system to continuously adapt to scene changes and dynamically update rules and thresholds. Overall, it achieves precise alarm filtering, intelligent root cause analysis, and adaptive system operation, effectively reducing operation and maintenance costs and comprehensively improving the response efficiency and security assurance capabilities of factory security management. Attached Figure Description

[0009] Figure 1 This is a schematic diagram of the execution flow of the multi-event alarm root cause analysis method for factory security provided in an embodiment of the present invention.

[0010] Figure 2 This is a schematic diagram of exemplary hardware and software components of the factory security multi-event alarm root cause analysis system provided in an embodiment of the present invention. Detailed Implementation

[0011] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating a root cause analysis method for multi-event alarms in factory security provided by an embodiment of the present invention. The following is a detailed description of this root cause analysis method for multi-event alarms in factory security.

[0012] Step S110: Construct an environment and sensor dynamic coupling calibration system, and achieve source separation of environmental interference and equipment fault data through online adaptive weight allocation and time drift detection; When constructing an environment and sensor dynamic coupling calibration system, an industrial-grade environmental sensing module (including temperature, humidity, dust concentration, and air pressure sensors) and a sensor calibration module are deployed and integrated into an edge gateway. Online adaptive weight allocation dynamically adjusts the influence weights of these two types of data by collecting real-time environmental parameter fluctuation data and sensor data stability indicators. Temporal drift detection employs a combination of LSTM and CUSUM algorithms. The system is deployed at edge nodes in various workshops of the factory, connecting to nearby security sensors (smoke detectors, infrared sensors) and environmental sensing devices. Data interaction is achieved through real-time edge computing, separating environmental interference from equipment faults at the data acquisition source to prevent interference data from being misinterpreted as fault signals and ensuring the accuracy of input data for subsequent processing modules.

[0013] Step S111: Build a multi-source data synchronous acquisition architecture, deploy an acquisition gateway compatible with industrial bus and wireless transmission, and simultaneously access real-time monitoring data from security sensors and multi-dimensional parameters from environmental sensing devices. Achieve time alignment of the two types of data through the NTP timestamp synchronization mechanism. When building a multi-source data synchronous acquisition architecture, an industrial-grade edge gateway (model DG-200) was selected. This gateway is compatible with Modbus RTU / TCP, Profinet IO industrial bus protocols, and 5G SA and LoRaWAN 1.0.2 wireless transmission protocols. It can simultaneously connect to security sensors (smoke detectors, infrared sensors, vibration sensors) and environmental sensors (temperature, humidity, dust, wind speed). It connects to the factory's intranet NTP server to control time synchronization accuracy within 1ms, achieving time alignment between the two types of data. Deployment units are divided according to workshop areas, with one edge gateway configured in each area as a data aggregation node. It connects to the nearest terminal devices within the area, reducing data transmission latency and ensuring that when an alarm is triggered, security data and corresponding environmental parameters can be accurately matched, providing synchronous data support for subsequent coupling calibration.

[0014] Step S112: Through the 3σ criterion, Min-Max normalization, linear interpolation and sliding window smoothing, the sensor data is preprocessed to remove anomalies, unify dimensions, align sampling rates and weaken fluctuations, so as to output stable and usable standardized data. In the data preprocessing stage, the 3σ criterion is used to remove abnormal sensor data: the mean and standard deviation of historical sensor operating data are statistically analyzed, and instantaneous jump values ​​exceeding 3 times the standard deviation (such as sudden peak values ​​in smoke sensors) are identified as abnormal and removed; Min-Max normalization is used to uniformly map data of different dimensions (temperature, concentration, pressure) to the [0,1] interval, and the normalization threshold is determined based on the sensor range; when the data missing duration is ≤5s, linear interpolation of adjacent valid data is used to complete the data; a sliding window of 10 sampling periods (1s sampling period, 10s window duration) is set to smooth the data and weaken high-frequency fluctuations. After processing, a local verification algorithm at the edge is used to ensure that the fluctuation amplitude of the output data is ≤5%, providing stable and standardized data for subsequent feature extraction.

[0015] Step S113: Extract the dynamic features of environmental parameters and the stability features of sensor data, and establish a feature vector set, in which environmental features are used to determine the interference intensity and sensor features are used to evaluate the data reliability, providing a quantitative basis for weight allocation; During feature extraction, dynamic features of environmental parameters include fluctuation amplitude (the amount of parameter change within 1 minute), fluctuation frequency (the number of fluctuations per hour), and duration (the continuous time of abnormal fluctuations), such as a change in dust concentration ≥ 5 mg / m³ within 1 minute. 3 The data was deemed to have high volatility. Sensor data stability characteristics include coefficient of variation (ratio of standard deviation to mean of 20 consecutive sampling points), response delay (time difference between trigger signal and data output), and repeatability (deviation of 5 measurements under the same conditions). A coefficient of variation ≤ 0.05 was considered highly stable. After quantification of all features, a structured feature vector set was formed, stored in an edge-end memory database, and updated in real time and synchronized to the weight decision model. This provided a clear quantitative basis for weight allocation, ensuring the objectivity and accuracy of weight decisions.

[0016] Step S114: Construct a weighted decision model based on a fuzzy logic system, taking the environmental parameter fluctuation level and sensor data stability level as input variables, mapping them to fuzzy sets through a membership function, formulating fuzzy inference rules, outputting real-time weight coefficients after defuzzification, and embedding a reinforcement learning mechanism with data separation accuracy as the reward function. Environmental parameter fluctuations are low (≤2mg / m³). 3 ), medium (2-5mg / m 3 High (≥5mg / m³) 3The sensor stability is categorized into three levels: high (coefficient of variation ≤ 0.05), medium (0.05-0.1), and low (≥ 0.1). A triangular membership function is constructed, with vertices set according to the hierarchical thresholds to ensure smooth mapping of input values ​​to membership degrees. Nine if-then fuzzy inference rules are formulated, with an initial confidence level of 0.8. A reinforcement learning mechanism is integrated, with the reward function set according to the separation accuracy (≥90%+10, <80%-5). The Q-table is initially set to 0, and the update cycle is synchronized with the 1-second sampling cycle. Through iterative training, the model adapts to the dynamic changes of the environment and sensor in real time, outputting accurate weight coefficients.

[0017] Step S1141: Standardize and classify input variables. Based on the statistical distribution of historical environmental parameters and sensor data of the factory, the fluctuation level of environmental parameters is divided into three levels: low fluctuation, medium fluctuation, and high fluctuation. The stability level of sensor data is divided into three levels: high stability, medium stability, and low stability. The thresholds for each level are determined by the percentile method to achieve the standardization and classification of input variables. When implementing standardized grading of input variables, environmental parameters (temperature, humidity, dust concentration) and security sensor data (smoke detectors, infrared sensors) from the factory over the past year are collected. After removing invalid data, three threshold levels are defined using the 75th and 90th percentiles. Environmental parameter fluctuation levels are: low fluctuation ≤ 75th percentile, medium fluctuation 75th-90th percentile, and high fluctuation ≥ 90th percentile. Sensor data stability levels are: high stability coefficient of variation ≤ 75th percentile, medium stability 75th-90th percentile, and low stability ≥ 90th percentile. Thresholds are stored in edge configuration files, supporting manual fine-tuning according to workshop scenarios (dust-filled workshops, assembly workshops), ensuring that the grading standards fit the actual conditions of different areas, achieving standardized processing of input variables, and providing a unified input format for fuzzy inference.

[0018] Step S1142: For the three-level division of environmental parameter fluctuation level and sensor data stability level, construct triangular membership functions respectively. Define the domain of the function as the quantization interval of the corresponding input variable. By adjusting the position of the vertex and the slope of the function, make the membership value smoothly transition in the interval [0,1] to ensure that the accurate input value can be reasonably mapped to the membership degree of the fuzzy set. Based on the three-level partitioning of input variables, a triangular membership function is constructed, with its domain covering the actual quantification range of each variable. For example, the domain for dust concentration fluctuation is set to 0-10 mg / m³. 3 The peak of the low-fluctuation function is at 1 mg / m 3 Fluctuations within 3 mg / m³ 3 High fluctuations at 6 mg / m³ 3 The slope of the function is determined by fitting actual data. When the input value is at the threshold boundary (e.g., dust concentration 2 mg / m³),... 3The membership degrees are set to 0.5 for low-fluctuation and 0.5 for medium-fluctuation, ensuring a smooth transition without abrupt changes. The Python scikit-fuzzy library is used for function modeling, and the serialized values ​​are stored at the edge for direct inference. This ensures that input values ​​are reasonably mapped to the membership degrees of fuzzy sets, providing a reliable foundation for subsequent inference.

[0019] Step S1143: Based on practical experience in factory security scenarios, formulate comprehensive if-then fuzzy inference rules, covering all input level combinations, assign initial confidence to each rule, and ensure that the rule logic is consistent with the actual data separation requirements. Based on experience in factory security scenarios, nine comprehensive if-then fuzzy inference rules were developed, covering all combinations of input levels. For example, "If environmental parameters have low fluctuations and sensors are highly stable, then the weight coefficient is high," and "If environmental parameters have high fluctuations and sensors are lowly stable, then the weight coefficient is low." Each rule has an initial confidence level of 0.8. For special areas such as hazardous chemical warehouses, a new rule was added: "If environmental parameters are moderately fluctuating and sensors are moderately stable, then the weight coefficient is moderately high." Rules are stored in an editable rule library. The validity of initial rules is verified using historical data, invalid rules are removed, and the consistency between rule logic and data separation requirements is ensured, providing an accurate basis for fuzzy inference.

[0020] Step S1144: Using the Mamdani inference method, first calculate the membership degree of each input variable to the corresponding fuzzy set, then obtain the trigger strength of each rule through the minimum operation, and aggregate the conclusion fuzzy sets of each rule based on the trigger strength to form the total fuzzy output set. When using the Mamdani inference method, the edge-end inference engine first calculates the membership degree of the input variables to the fuzzy set, such as the dust concentration at a certain moment being 4 mg / m³. 3 The corresponding membership degrees are 0.6 for medium fluctuation and 0.4 for high fluctuation; the sensor's coefficient of variation is 0.08, corresponding to a membership degree of 0.7 for medium stability and 0.3 for low stability. The trigger strength is obtained by performing a minimum operation on each rule, such as min(0.6,0.7)=0.6 for "medium fluctuation + medium stability → medium weight". Then, the maximum aggregation operation is performed on the fuzzy sets of conclusions for all rules to form the total fuzzy output set. Parallel computing is used to optimize the inference speed, ensuring that the time for a single inference is ≤10ms, meeting the requirements of real-time data processing.

[0021] Step S1145: Defuzzify the aggregated fuzzy output set using the centroid method, calculate the centroid coordinates of the fuzzy set as the precise weight coefficient output, and set the weight adjustment step size at the same time. Deblurring employs the centroid method. For the aggregated fuzzy output set, it iterates through 17 discrete points within the interval [0.1, 0.9] (step size 0.05), calculating the membership value of each point. A weighted average is then used to obtain the precise weight coefficients. A weight adjustment step size of 0.05 is set to avoid abrupt changes in weights affecting the separation effect. For example, if the peak membership value after aggregation is around 0.6, the output weight is 0.6 ± 0.05. The deblurring process is executed in real-time at the edge, and the output results are directly used for subsequent data classification, ensuring accurate and stable weight coefficients and supporting the accurate separation of environmental interference and equipment malfunctions.

[0022] Step S1146: Use the fuzzy logic weighted decision model as an intelligent agent, define the environmental state as the level combination of the current input variables, define the action space as the weight coefficient range of the defuzzified output, set the reward function as the data separation accuracy, and give positive rewards or negative penalties based on the comparison results of the data separation accuracy and the historical average. When integrating reinforcement learning mechanisms, the fuzzy logic model is used as the agent. The environment state is defined as a combination of 9 input levels (e.g., "high volatility + low stability"), and the action space consists of 17 weight values ​​in the range [0.1, 0.9] (with a step size of 0.05). The reward function is set as follows: a +10 reward is given for separation accuracy ≥ 90%, a +5 reward for 80%-90%, a -5 penalty for < 80%, and a -10 penalty for three consecutive times < 75%. Each round consists of processing 100 data points, collecting state, action, reward, and next state to update the Q-table. The initial Q-table value is set to 0, and the initial learning rate is 0.1, gradually decreasing to 0.01 with each training round to ensure model convergence and improve the state-action value corresponding to high separation accuracy.

[0023] Step S1147: Initialize the Q-table for reinforcement learning, map the combination of state and action to the initial Q value. After each round of data separation, collect the current state, the weighted action executed, the reward value obtained, and the next state. Update the Q-table using the Q-learning algorithm, and optimize the value evaluation of state and action through iterative training. The Q-table is initialized using a 17×9 two-dimensional array (17 actions, 9 states), with all initial Q-values ​​set to 0, and stored in an edge-side in-memory database (Redis). After each round of data processing, the Q-table is updated according to the Q-learning algorithm: current Q-value = original Q-value + learning rate × (reward + discount factor × maximum Q-value for the next state - original Q-value), with the discount factor set to 0.9. The Q-table update is performed via a scheduled task at the edge (every 100 data points), running in parallel with real-time data processing without consuming additional processing time. The learning rate is adjusted every 10 rounds to avoid later oscillations, ensuring stable convergence of the Q-table and providing data support for rule adjustments.

[0024] Step S1148: Based on the Q-value update results of reinforcement learning, dynamically adjust the confidence of fuzzy inference rules, increase the confidence of rules with higher Q-values, decrease the confidence of rules with lower Q-values ​​or optimize the rule description, and add rules corresponding to frequently occurring states and actions with good separation effects. Based on the Q-table update results, fuzzy inference rules are dynamically adjusted: rules with a Q-value ≥ 5 have their confidence increased by 0.1 (upper limit 1.0), rules with a Q-value ≤ -3 have their confidence decreased by 0.1 (lower limit 0.5), and rules with a confidence value ≤ 0.5 are marked as needing optimization and will be adjusted or deleted after manual review. High-frequency (≥ 5 times per hour) state-action combinations with a Q-value ≥ 3 are statistically analyzed, and corresponding rules are added. For example, if the state of "medium fluctuation + high stability" occurs frequently and the action separation effect is good (0.8), a new rule is added: "If environmental parameters are medium fluctuation and sensors are highly stable, the weight coefficient is 0.8." A rule optimization report is generated weekly, supporting manual intervention to ensure the rule base dynamically adapts to changes in the actual scenario.

[0025] Step S1149: Set the model update cycle synchronized with the sensor sampling cycle. Each update calculates the data separation accuracy based on the latest data stream, triggers the reward calculation and Q-table update of reinforcement learning, and then links the fine-tuning of the fuzzy inference rule base and membership function parameters to enable the weighted decision model to adapt to the dynamic changes of the factory environment and sensor status in real time. The model update cycle is synchronized with the sensor's 1-second sampling cycle. During each update, the edge computes the separation accuracy of the past 100 data points, triggering reinforcement learning reward calculation and Q-table updates, thereby fine-tuning the membership function vertex position (adjustment magnitude ≤ 0.05) and rule confidence (adjustment magnitude ≤ 0.1). An update switch is configured to pause updates when CPU utilization is ≥ 85% to avoid impacting system stability. Each update logs parameter changes (including update time, accuracy, and parameter adjustment values) for easy backtracking of optimization effects. High-frequency, small-amplitude updates ensure the model adapts in real-time to dynamic changes in the environment and sensor status.

[0026] Step S11410: Periodically analyze the weight allocation effect and data separation accuracy within a certain period, and fine-tune the vertex position of the membership function, the initial confidence of the fuzzy inference rule, and the learning rate and discount factor of reinforcement learning based on the statistical results.

[0027] Regularly analyze the weight allocation effect and data separation accuracy over 72 hours: maintain current parameters when the average separation accuracy is ≥92%; fine-tune the membership function vertex position ±0.03 and the initial rule confidence ±0.05 when the accuracy is 85%-92%; adjust the reinforcement learning learning rate to 0.08 and the discount factor to 0.95 when the accuracy is <85%. Real-time statistics are collected via the edge monitoring module (Prometheus), and fine-tuning is automatically performed weekly, generating a fine-tuning report (including indicator changes and parameter adjustment suggestions), which takes effect after manual confirmation. This ensures that model parameters remain optimal over the long term, adapting to changes in the operating environment.

[0028] Step S115: Use the sliding window method to divide historical data segments, learn the temporal variation pattern of the sensor under interference-free and fault-free conditions through the LSTM model, output the normal behavior prediction curve based on historical data, and form a dynamically updated temporal baseline. When constructing the LSTM time-series baseline model, a sliding window method was used to divide historical data segments, with the window size set to 3600 sampling points (corresponding to 1 hour of data). The LSTM model contains 3 hidden layers (128 neurons per layer), with the input being the feature vector of the sensor's historical data and the output being a normal behavior prediction curve. The training data uses sensor data from the past 3 months that is free from interference and faults, trained using the TensorFlow Lite framework at the edge, with the model size optimized to ≤50MB. After deployment, the time-series baseline is updated hourly, using incremental training to supplement the latest anomaly-free data, ensuring that the baseline closely matches the current operating state of the sensor and providing an accurate benchmark for drift detection.

[0029] Step S116: Using a combination of residual analysis and CUSUM algorithm, calculate the residual sequence between the sensor real-time data and the time-series baseline. Accumulate the residual deviation through CUSUM algorithm. When the accumulated value exceeds a preset threshold and the duration reaches a set threshold, it is determined to be a persistent drift. At the same time, decompose the residual sequence through wavelet transform to distinguish between low-frequency trend terms caused by equipment aging / drift and high-frequency fluctuation terms caused by environmental interference. When residual analysis is combined with the CUSUM algorithm, the residual sequence between real-time sensor data and the time-series baseline is calculated. The CUSUM algorithm's cumulative window is set to 50 sampling points, and the threshold is determined based on the 95th percentile of historical residuals. The residual sequence is decomposed into three layers using the db4 wavelet basis. The low-frequency trend term corresponds to the decomposed cA3 component (equipment aging / drift), and the high-frequency fluctuation term corresponds to the cD1-cD3 components (environmental interference). The residual and cumulative deviation are calculated in real time at the edge. When the cumulative value exceeds the threshold and persists for ≥5 sampling points, it is determined to be persistent drift. At the same time, wavelet transform is used to clarify the residual type, providing a feature basis for subsequent data classification.

[0030] Step S117: When environmental parameter fluctuations trigger weight reduction and the sensor data residual is a high-frequency fluctuation term, it is determined to be environmental interference data. When the CUSUM algorithm detects continuous drift and the residual is a low-frequency trend term, it is determined to be equipment fault data. When both types of features exist at the same time, the final classification result is output through a weighted voting mechanism. Highly fluctuating environmental parameters with weight coefficients ≤ 0.3 and residuals showing high-frequency fluctuations indicate environmental interference data; persistent drift detected by CUSUM and residuals showing low-frequency trends indicate equipment failure data. When both types of features exist simultaneously, a weighted voting method is used (environmental feature weight 0.4, failure feature weight 0.6). Data with a score ≥ 0.55 is classified as failure data, and data with a score < 0.55 is classified as interference data. The edge processing unit compares the two types of features in real time and outputs classification labels ("environmental interference" and "equipment failure"). These labels are bound to the original data for storage, ensuring accurate data classification and providing clearly labeled data for subsequent processing modules.

[0031] Step S118: Collect feedback information after data separation in real time, use incremental learning algorithm to periodically update the parameters of LSTM time series baseline model and fuzzy logic weight decision model, and dynamically adjust the threshold of CUSUM algorithm based on the separation accuracy within the sliding window. During incremental model updates, feedback information after data separation (manual verification of labels, equipment maintenance records) is collected in real time to construct an incremental learning dataset, which is then executed every 24 hours. Mini-batch gradient descent (batch size 64) is used to update the hidden layer weights of the LSTM model and the membership function parameters of the fuzzy logic model, preventing the model from forgetting historical knowledge. The CUSUM algorithm threshold is dynamically adjusted based on the separation accuracy over the past 24 hours: the threshold is increased by 10% for accuracy ≥90% and decreased by 10% for accuracy <80%. Incremental learning continuously optimizes model performance, ensuring the model adapts to changes in data distribution over long-term operation.

[0032] Step S119: Output the separated security sensor data, environmental interference tags, and equipment fault tags in a standardized format and store them synchronously in the local database at the edge. This provides structured input for subsequent processing modules and reserves a fault warning interface to automatically trigger maintenance reminders when equipment fault data occurs continuously.

[0033] The separated data is output in JSON format, including sensor ID, acquisition timestamp, data value, interference tag, and fault tag, and stored in an edge SQLite database. It supports querying and exporting by time range and tag type. A RESTful API fault warning interface is reserved. When a device fault tag appears consecutively ≥3 times (with an interval ≤5 minutes), an HTTP request is automatically sent to the operation and maintenance management platform, including the sensor ID, fault type, and suggested maintenance time. The database is backed up to the cloud daily, and the interface has access restrictions (username + password authentication) to ensure data security and timely fault response, providing structured input for subsequent processing modules.

[0034] Step S120: Construct a sensor association topology network based on the factory layout, and combine spatiotemporal constraints with an improved temporal clustering algorithm to complete alarm data simplification and instantaneous false alarm elimination; The system utilizes digitized factory CAD drawings to import layout information, dividing physical areas such as workshops and warehouses. Edge computing nodes (model EC-300) are deployed to construct a sensor-related topology network. Within the spatiotemporal constraints, the time window is set to 5 minutes based on statistical analysis of historical alarm data from the past 6 months, and an improved temporal clustering algorithm is used, based on the DBSCAN framework. Alarm data simplification follows the principle of "merging events from the same source," and instantaneous false alarms are eliminated under two conditions: alarm duration < 30 seconds and triggered by only a single sensor. The system receives real-time data from security sensors such as smoke detectors, infrared sensors, and vibration sensors. Based on the topology network relationships and clustering results, valid alarms verified by multi-sensor cross-validation are retained, while isolated instantaneous interference signals are eliminated.

[0035] Step S121: Collect sensor basic information and factory space information. The sensor basic information includes the installation location, monitoring range, function type, communication address and device number of each security sensor. The factory space information includes the factory physical zoning, wall layout and equipment distribution. Establish a sensor basic information database. Sensor basic information acquisition adopts an "automatic acquisition + manual supplementation" mode: installation location is recorded using GPS positioning combined with the factory's internal coordinate system (accuracy ±0.1 meters); monitoring range is entered according to sensor model parameters (e.g., 10-meter monitoring distance and 120° detection angle for infrared sensors); and communication address is bound to the IP address assigned by the industrial bus. Factory spatial information is extracted from CAD drawings, including physical partition boundaries, wall coordinates, and equipment installation points. This information is then digitized and stored in a PostgreSQL database, constructing a structured sensor basic information database. The database supports retrieval by region and equipment type and is updated daily in sync with the factory equipment management system to ensure data timeliness.

[0036] Step S122: Divide sensors whose spatial distance is within a set range, whose monitoring areas overlap, or whose functions are coordinated into the same associated group to ensure that each group of sensors can verify abnormal events in the same area from multiple dimensions. Sensors with a spatial distance of ≤5 meters, an overlap of monitoring areas of ≥30%, or functional synergy (such as smoke and heat sensors, infrared and vibration sensors) are grouped into the same associated group. The GeoPandas geospatial computing library is used to automatically calculate the spatial relationships and monitoring range overlap of the sensors, generating initial grouping results. These results are then manually reviewed and adjusted by maintenance personnel (excluding invalid associations due to wall obstructions). Each group is assigned a unique identifier (format: “Area Number-Group Number”, e.g., A01-02) to ensure that sensors within the group cover the same physical area, forming a multi-dimensional complementary monitoring matrix and enabling cross-verification of abnormal events in the same area.

[0037] Step S123: Graph structure modeling is adopted, with sensors as nodes. The node attributes include sensor type, location and associated group identifier. The relationship between sensors is used as edges. The weight of the edges is calculated by combining spatial distance correlation degree and functional complementarity degree to form a weighted undirected graph. A weighted undirected graph was constructed using the Neo4j graph database. Node attributes included: sensor type (e.g., "smoke sensor" or "temperature sensor"), plant coordinate system location (X=118.3m, Y=42.5m), associated group identifier, and equipment operating status (normal / faulty). Edge weights were calculated using a weighted summation: spatial distance correlation was quantified as "1 - actual distance / maximum correlation distance (5 meters)," and functional complementarity was scored according to preset rules (smoke sensor - temperature sensor 0.8, infrared sensor - vibration sensor 0.7, same type 0.3). The final edge weight = 0.6 × spatial correlation + 0.4 × functional complementarity (result rounded to two decimal places). The graph data was synchronized with sensor operating status in real time; edge weights corresponding to faulty sensors were set to 0 and not included in the correlation calculation.

[0038] Step S124: Define a reasonable time window based on the statistical analysis of historical alarm data of the factory in the time dimension, and set constraints in the spatial dimension that at least two or more sensors in the same association group are triggered and the alarm type matches the common anomaly type in the area, determine the preliminary valid alarm, and mark the alarm triggered by isolated sensor as a suspicious alarm. The time window length is determined based on historical alarm data from the past year, taking the maximum time interval of 90% of alarms originating from the same source, initially set to 5 minutes. Spatial constraints are clearly defined: at least two sensors must trigger within the same association group, and the alarm type must match common anomalies in the area (e.g., workshops match smoke and heat alarms, warehouses match infrared and vibration alarms). Judgment logic is configured in the edge-side rule engine to monitor sensor alarm signals in real time: alarms meeting the spatiotemporal constraints are marked as "preliminary valid alarms," ​​while isolated sensor triggers are marked as "suspected alarms." Suspected alarms are temporarily stored in the local edge database for further verification using subsequent clustering algorithms and are not immediately pushed to the operations and maintenance platform.

[0039] Step S125: Extract the trigger time, sensor identifier, associated group number, alarm type, and alarm intensity features of the alarm event, remove duplicate records and data with incorrect format, and form a standardized alarm feature dataset; The trigger time is accurate to milliseconds (e.g., 2024-06-10 09:25:18.456), sensor identifier (device number S-A01-003), associated group number, alarm type (e.g., "smoke concentration exceeds the standard"), and alarm intensity (divided into 1-3 levels based on the ratio of measured value to threshold). Data cleaning is performed using Python scripts: duplicate trigger records of the same type from the same sensor within one minute are removed, and data with missing trigger times, sensor identifiers, or other format errors is deleted. A standardized alarm feature dataset in JSON format is generated and stored in a Redis cache at the edge for quick access by clustering algorithms.

[0040] Step S126: Based on the DBSCAN algorithm, the edge weights of the sensor association topology network are incorporated into the distance metric formula to construct a comprehensive distance index that combines time difference and spatial correlation, replacing the traditional Euclidean distance. At the same time, an alarm intensity threshold is introduced to filter low-intensity instantaneous alarms before clustering. Based on the DBSCAN algorithm, this paper improves upon it by incorporating the edge weights of the sensor association topology into the distance metric, constructing a comprehensive distance index (integrating alarm time difference and spatial correlation). Before clustering, an alarm intensity threshold of level 2 (corresponding to 50% exceeding the threshold) is set; instantaneous low-intensity alarms below this threshold (such as level 1 signals from sensor false triggers) are directly filtered out. The algorithm is deployed on an edge CPU (i5-1240P), optimized and compiled using C++ to improve processing speed. Initial clustering parameters are set as follows: minimum number of samples = 2 (at least 2 sensors triggering the same event), comprehensive distance threshold = 0.3 (calibrated based on historical valid alarm data), ensuring effective clustering of alarms originating from the same source.

[0041] Step S127: Using the standardized alarm feature dataset as input, set the clustering parameters, and aggregate alarm events within the same time window, the same association group, and with a comprehensive distance less than the threshold into clusters. Each cluster represents a set of related alarms that may be caused by the same root cause. Using a standardized alarm feature dataset as input, the clustering parameters are set in step S126 (minimum number of samples = 2, comprehensive distance threshold = 0.3). The algorithm automatically aggregates alarm events within the same 5-minute time window, within the same association group, and with a comprehensive distance less than the threshold into clusters. Each cluster corresponds to a group of related alarms that may be triggered by the same root cause. For example, in the G-A01 group of area A01 in workshop, alarms triggered successively by smoke and heat sensors within 3 minutes are clustered into one cluster, clarifying the attribution relationship of related events and providing a basis for subsequent false alarm elimination.

[0042] Step S128: Analyze the characteristics of each cluster, and determine the clusters with alarm duration below the set threshold, involving only 1 sensor, or with total alarm intensity below the minimum threshold as instantaneous false alarm clusters and remove them, while retaining the valid alarm clusters that meet the requirements of duration, number of sensors, and alarm intensity. Alarm duration ≥ 30 seconds, number of sensors involved ≥ 2, total alarm intensity ≥ 5 levels (e.g., 2 level 2 + 1 level 1 = 5 levels). For each cluster, features such as start time, end time, sensor list, and total intensity are extracted and compared against thresholds: if any condition is not met, it is determined to be an instantaneous false alarm cluster, marked "invalid," and archived; if all conditions are met, it is retained as a valid alarm cluster and marked "pending processing." The filtering process is executed in conjunction with the clustering algorithm, with a single batch data processing time ≤ 100ms, ensuring real-time performance.

[0043] Step S129: Merge alarm clusters with overlapping time windows, highly overlapping sensors, and consistent alarm types, extract the start time, involved sensors, alarm type, and peak intensity information of each valid event cluster, and generate a simplified list of valid alarm events. The time window overlap ratio is ≥60%, the sensor overlap ratio is ≥80%, and the alarm type is consistent. A set operation is used to compare the time range of valid clusters with the sensor list. After merging, the earliest start time, latest end time, complete sensor list, alarm type, and peak intensity (highest intensity value within the cluster) are retained. A unique event ID is generated for each valid event cluster (format "E-Date-Serial Number", e.g., E-20240610-008). Core information is extracted to form a simplified list, which is then pushed to the operation and maintenance management platform in chronological order. Export to Excel format for traceability is supported.

[0044] Step S1210: Periodically collect factory layout change information and sensor working status data, update the node and edge weights of the sensor associated topology network, and optimize the time window length of spatiotemporal constraints, the comprehensive distance threshold of the clustering algorithm, and the cluster screening threshold based on the historical alarm processing results reviewed by manual verification.

[0045] Monthly data collection on factory layout changes (such as new equipment or area adjustments) is used to synchronously update node locations via CAD drawings. Hourly data collection on sensor operating status (online / offline, fault / normal) is used to automatically update node status and edge weights. Parameters are optimized based on manual review results from the past three months: if the false alarm rate is >5%, the time window is narrowed to 4 minutes; if the false alarm rate is >3%, the overall distance threshold is lowered to 0.25. Cluster filtering thresholds are fine-tuned by region (e.g., the duration threshold for hazardous chemical warehouses is set to 15 seconds). The optimization process is automatically triggered monthly, generating a parameter adjustment report that takes effect after manual confirmation, adapting to dynamic changes in the factory environment.

[0046] Step S130: Design differentiated recognition logic for three types of scenarios: perimeter, workshop, and video, and accurately filter non-safety trigger sources through models and algorithms; Deploy edge computing nodes (model EC-500), dividing the deployment into units based on perimeter, workshop, and video scenarios. Each unit is configured with a scene recognition and switching module. The recognition logic automatically switches based on edge GPS positioning and device type identification: the perimeter area is linked to infrared cameras and vibration sensors; the workshop area connects to multiple sensors and process data; and the video scenario focuses on the AI ​​camera video stream. A scene adaptation management platform is built, pre-setting scene switching trigger conditions (such as device location and data type), supporting manual intervention and adjustment to ensure that the three types of scene recognition logic are flexibly activated as needed, accurately filtering out unsafe trigger sources for corresponding scenarios.

[0047] Step S131: By constructing a target dataset, improving the lightweight detection model, introducing a trajectory fitting algorithm, and establishing a dynamic threshold library, the system can accurately distinguish and filter alarms for safe targets such as people / vehicles and non-safe triggering sources such as birds / debris in the perimeter area. High-definition infrared cameras (model IPC-8200) were deployed at 12 monitoring points along the factory perimeter to collect video and alarm logs in the morning, noon, and evening, under sunny, rainy, and foggy weather. Valid segments were filtered and labeled with categories and attributes using LabelMe. Blurred samples were removed after cleaning, and the sample size was expanded to 20,000 samples through flipping and scaling. The training and validation sets were divided in an 8:2 ratio. YOLOv8-nano was used as the base model, with a new biological feature branch containing 3 convolutional layers and 2 max-pooling layers. ReLU6 was used as the activation function. After feature concatenation, the model was classified through a fully connected layer. After pruning and quantization, the model size was ≤30MB and the frame rate ≥25FPS. Kalman filtering was introduced, noise covariance parameters were initialized, target trajectories were fitted, and deviations were analyzed. A dynamic threshold library (set according to a 95% confidence interval) was used to integrate the three-class discrimination results through weighted voting.

[0048] Step S1311: Data acquisition and annotation processing. Traverse all monitoring points around the factory perimeter, collect historical monitoring videos and alarm logs under different time periods and weather conditions, filter out effective segments containing birds, fallen leaves, wind-blown debris, personnel, and vehicles, label them with category tags according to target type, and label the outline size, movement speed, trajectory features, and movement duration attributes of each type of target to form a structured annotation file. Clean the dataset, remove invalid samples, use data augmentation techniques to expand the sample size, and divide the dataset into training and validation sets. Covering all 12 monitoring points along the perimeter, the system utilizes IPC-8200 high-definition infrared cameras to collect historical monitoring videos and alarm logs from 6:00 AM to 10:00 PM under four weather conditions: sunny, rainy, foggy, and snowy. 5000 valid segments containing targets such as birds, fallen leaves, people, and vehicles were selected. Using the LabelMe annotation tool, category labels were created for "people," "vehicles," "birds," and "objects," simultaneously annotating attributes such as outline size (cm), movement speed (m / s), trajectory characteristics (straight line / curve), and movement duration (s), generating a structured annotation file in JSON format. Invalid samples with ≥70% occlusion were removed. The sample size was expanded to 20,000 samples by horizontal flipping, scaling, and brightness adjustments. The training and validation sets were randomly divided in an 8:2 ratio to ensure balanced sample distribution.

[0049] Step S1312: Select a lightweight YOLO model as the base model, and add a biometric feature extraction branch after its backbone network. This branch consists of convolutional layers and max pooling layers, and adopts an activation function that is adapted to edge deployment. Through this branch, extract the target's contour aspect ratio, wingspan / body length ratio, and differential biometric features of the relative positions of limb joints, and output a feature vector. This feature vector is then concatenated and fused with the target category features and position features output by the original detection head of the base model, and input into a fully connected layer to optimize the classification results. Channel pruning and quantization are used to optimize the model. YOLOv8-nano was selected as the base model, and a biometric feature extraction branch was added after the C2f module of the backbone network. This branch contains 3 convolutional layers (3×3 kernel size) and 2 max pooling layers (2×2 kernel size). The activation function is ReLU6 adapted for edge detection to avoid gradient vanishing. This branch extracts differential features such as the aspect ratio of the target contour, wingspan / body length ratio, and relative positions of limb joints, outputting a 128-dimensional feature vector. This vector is concatenated with the category and position features output by the original detection head of the base model to form a 256-dimensional fused feature vector, which is then input into 2 fully connected layers to optimize the classification results. Channel pruning was used to remove redundant channels (pruning rate 40%). After INT8 quantization, the model size was compressed to 28MB, and the inference frame rate at the edge was ≥25FPS.

[0050] Step S1313: Introduce the Kalman filter algorithm. Based on the target inter-frame coordinate sequence output by the improved target detection model, initialize the state equation and observation equation of the Kalman filter, set the process noise covariance and observation noise covariance, output the predicted position of the target at the next moment through the prediction and update iteration process, calculate the deviation between the predicted position and the actual detection position, statistically analyze the deviation sequence of multiple consecutive frames, analyze the trajectory pattern, and distinguish potential safe targets from unsafe trigger sources based on deviation characteristics, trajectory fluctuations and motion duration. A Kalman filter algorithm is introduced. Based on the target inter-frame (30 FPS) coordinate sequence output by the improved YOLO model, the state equation is initialized as a position-velocity model, and the observation equation is pixel coordinate observation. The initial value of the process noise covariance is set to 0.01, and the initial value of the observation noise covariance is set to 0.1. The predicted position of the target at the next moment is output through a "prediction-update" iterative process. The deviation between the predicted position and the actual detected position is calculated, and the deviation sequence of 20 consecutive frames is statistically analyzed. A deviation threshold is set: ≤5 pixels is considered a stable trajectory, and ≥15 pixels is considered a fluctuating trajectory. Combined with the motion duration (≥3 seconds is considered continuous motion), people / vehicles (stable trajectory, continuous motion) and birds / objects (fluctuating trajectory, short-term motion) are distinguished.

[0051] Step S1314: Based on the valid samples in the validation set, statistically analyze the distribution range of the characteristic parameters of various targets, use the probability density estimation method to fit the probability distribution curve of each characteristic parameter, determine the confidence interval of the characteristics of various targets, and set a dynamic judgment threshold based on this. The threshold library supports real-time updates. When a new target type is added or the environment changes, causing feature drift, the threshold interval is re-statistically analyzed and adjusted based on the latest collected sample data. Based on 10,000 valid samples in the validation set, the distribution of feature parameters such as the aspect ratio, movement speed, and trajectory fluctuation of various targets was statistically analyzed. The probability distribution curves of each parameter were fitted using kernel density estimation. Threshold ranges for various target features were determined based on 95% confidence intervals; for example, the aspect ratio of human figures was 0.3-0.8, and the movement speed was 0.5-5 m / s. A dynamic threshold library (stored in Redis) was constructed to support real-time updates: when a new target type (such as a drone) is added or environmental changes (such as prolonged heavy rain) cause feature drift, the system automatically collects nearly 1,000 of the latest sample data, re-statistically analyzes the feature distribution, and adjusts the threshold range to ensure that the thresholds adapt to data changes.

[0052] Step S1315: For targets detected by the improved target detection model, the category is initially determined by the biometric fusion results, then input into the trajectory fitting and discrimination module to obtain trajectory patterns and deviation features, and finally query the dynamic target feature threshold library to verify whether the target feature parameters fall within the corresponding category threshold range. The above three discrimination results are integrated by a weighted voting mechanism, and the alarm handling method is determined based on the comprehensive score. After the improved target detection model detects a target, it first makes a preliminary determination of the category based on the biometric feature fusion results (confidence ≥ 0.7 is considered a valid preliminary determination); then it inputs the results into the trajectory fitting module to obtain features such as trajectory stability and movement duration (stable trajectory with movement ≥ 3 seconds is considered a valid trajectory determination); finally, it queries the dynamic threshold library to verify whether the target feature parameters fall within the corresponding category threshold range (matching degree ≥ 80% is considered a valid threshold determination). A weighted voting mechanism is adopted: biometric feature determination weight 0.4, trajectory determination weight 0.3, threshold determination weight 0.3. A comprehensive score ≥ 0.65 is determined as a safe target and triggers an alarm; < 0.5 is determined as an unsafe trigger source and filtered; and 0.5-0.65 is marked as suspicious and requires manual review.

[0053] Step S1316: Deploy the trained improved model to the edge, connect to the perimeter real-time monitoring video stream, test the model's detection accuracy, false detection rate, and false negative rate in different scenarios, analyze the model's ability to distinguish various targets through confusion matrix analysis, supplement corresponding samples for easily confused categories and retrain, optimize the parameters of the biometric extraction branch, adjust the relevant parameters of the Kalman filter, reduce false judgments caused by target occlusion and rapid movement, and statistically analyze the alarm filtering accuracy based on actual operating data. When the accuracy does not reach the set standard, trigger incremental training of the model and update the dynamic target feature threshold library and model parameters.

[0054] The trained, improved model (INT8 quantization format) was deployed to a perimeter edge gateway (model DG-638) and connected to a 1080P real-time monitoring video stream. Test scenarios covered morning, noon, and evening, and sunny, rainy, and foggy weather. The model's detection accuracy (≥95%), false positive rate (≤3%), and false negative rate (≤2%) were statistically analyzed. Confusion matrix analysis was used to identify birds and distant people, and 500 additional corresponding samples were added for retraining. The convolution kernel parameters of the biometric extraction branch were optimized, and the process noise covariance of the Kalman filter was adjusted to 0.008 to reduce false positives caused by target occlusion and rapid movement. An alarm filtering accuracy of ≥96% was set as the standard; if this standard was not met, incremental training was triggered, and the dynamic threshold library and model parameters were updated synchronously.

[0055] Step S132: Construct a dataset based on multi-dimensional sensor and process data, and filter false alarms caused by dust / water mist through multi-sensor feature fusion modeling, dynamic threshold adjustment and cross-validation mechanism to accurately identify real safety events; An edge computing node (model EC-400) was deployed in the workshop, connecting to data from smoke detectors (GS500), temperature sensors (WT200), dust concentration sensors (FC300), humidity sensors (HD100), and production process PLCs. Samples were labeled with four categories: "Normal Operating Conditions," "Dust Interference," "Water Mist Interference," and "Real Safety Events," constructing a structured dataset of 100,000 records. After anomaly removal and missing value completion, the training and test sets were divided in an 8:2 ratio. Response features and process status features of each sensor were extracted, standardized, and then dimensionality reduced using PCA. A feature-level fusion model combining logistic regression and random forest was constructed to dynamically adjust the smoke alarm threshold. A multi-sensor cross-validation mechanism was established, and the judgment results were output in real time after deployment. The model was periodically optimized through incremental learning.

[0056] Step S1321: Collect real-time data from various sensors in the workshop, production process parameters, and historical alarm records, covering diverse scenarios. Label the samples with four types of tags and record the sensor response and timing, as well as the process correlation status, to form a structured dataset. After anomaly removal and missing value processing, divide the dataset into training and test sets. Real-time sampling data (1-second sampling period) from GS500 smoke detectors, WT200 temperature detectors, FC300 dust concentration sensors, and HD100 humidity sensors in the workshop were collected synchronously. This data was combined with production process parameters (material type, production load, ventilation system status) and one year of historical alarm processing records, covering normal production, dust-affected environments, water mist spraying, and fire / gas leak scenarios. 100,000 data samples were labeled with four categories, recording the sensor response timing, parameter fluctuation range, and process-related status for each scenario, forming a CSV-formatted structured dataset. The 3σ criterion was used to remove abnormal sensor jump data, and linear interpolation was used to complete missing values ​​(missing values ​​≤ 5 seconds). The training and test sets were randomly divided in an 8:2 ratio to ensure a balanced distribution of samples across different scenarios.

[0057] Step S1322: Design feature extraction rules for different sensor data types and process parameters, extract the response features of smoke sensors, temperature sensors, and dust concentration sensors, as well as the state features of process parameters, and standardize all extracted features. Use principal component analysis algorithm to reduce dimensionality. Feature extraction rules were designed for different sensors and process parameters: smoke sensors extracted response rate, peak intensity, and duration; temperature sensors extracted heating slope, peak temperature, and duration of the stabilization phase; dust concentration sensors extracted exceedance magnitude, trend, and duration of exceedance; and process parameters extracted production load level (levels 1-3), dust-generating process identifier (0 = not running, 1 = running), and ventilation efficiency parameters. All extracted 28-dimensional features were Z-score standardized to eliminate the influence of dimensions. Dimensionality reduction was achieved using PCA, retaining the 12-dimensional core feature vectors with a cumulative contribution rate ≥90%, thus reducing the computational complexity of the model.

[0058] Step S1323: Using a feature-level fusion strategy, the dimensionality-reduced sensor features and process features are spliced ​​together to form a unified high-dimensional feature input vector. An integrated learning model of logistic regression and random forest is constructed. The linear correlation between features is learned through the logistic regression model, and the nonlinear interaction law between features is captured through the random forest model. The model is trained with training set data, the model hyperparameters are optimized, and the model performance is verified using the test set to achieve accurate classification of scene categories. A feature-level fusion strategy is employed, concatenating a 12-dimensional core feature vector with 3-dimensional process status features to form a unified 15-dimensional high-dimensional input vector. An ensemble learning model combining logistic regression and random forest is constructed: the logistic regression model (regularization coefficient 0.1) learns linear correlations, while the random forest model (100 decision trees, maximum depth 8) captures non-linear interaction patterns. The model is trained using the training set data, and hyperparameters are optimized through grid search. Performance is validated using the test set: recall rate ≥95% for "real security events" and accuracy rate ≥90% for "interference scenarios". The model is implemented using the Python sklearn framework and stored locally on the edge device after serialization.

[0059] Step S1324: Based on the interference scenario data in the training set, analyze the correlation between dust concentration, humidity and smoke detector false alarm probability, and establish a mapping relationship model among the three; collect workshop dust concentration and humidity data in real time, substitute them into the mapping relationship model to calculate the smoke detector false alarm risk coefficient in the current environment, dynamically adjust the smoke detector alarm threshold according to the false alarm risk coefficient, and set the upper limit of threshold adjustment, which is positively correlated with the intensity of environmental interference. Based on dust and water mist interference scenario data in the training set, the correlation between dust concentration, humidity, and smoke detector false alarm probability is analyzed. A mapping relationship model among the three is established through multinomial fitting. Real-time collection of workshop dust concentration (unit: mg / m³) is performed. 3 The smoke detector alarm threshold is calculated using the smoke and humidity (%RH) data, substituted into the model to determine the current false alarm risk coefficient (0-1). The higher the risk coefficient, the greater the increase in the smoke alarm threshold (the threshold range is 50%-90% of the sensor's range). An upper limit for threshold adjustment is set: determined based on the lowest trigger threshold of historical real safety events, ensuring that no real safety events are missed after the threshold is increased. The threshold adjustment result is synchronized to the sensor control module in real time.

[0060] Step S1325: Establish sensor association verification rules. When the smoke sensor triggers an alarm, the associated sensor data verification process is triggered simultaneously to verify whether the temperature data change trend and dust concentration meet the characteristics of the corresponding scenario and the operating status of the dust-generating process. Set verification judgment conditions. When at least two types of associated sensor data meet the characteristics of a real safety event and the process parameters have no obvious interference causes, it is judged as a valid alarm. When only the smoke sensor alarms and the data of other associated sensors are normal and the process is in a dust / water mist generation process, it is judged as environmental interference and automatically filtered. When a single sensor has a strong signal alarm and the data of other sensors are critical, it is marked as a suspicious alarm and a manual confirmation process is triggered. When a smoke detector triggers an alarm, the system simultaneously verifies temperature sensor data (rapid temperature rise is defined as ≥5°C per minute), dust concentration (whether it exceeds the process threshold by 1.2 times and the time difference with the smoke detector alarm is ≤3 seconds), and the operating status of the dust-generating process (judged via PLC signals). Verification criteria are set as follows: if at least two related sensor data points meet the characteristics of a "real safety event" (e.g., continuous smoke detector alarm + rapid temperature rise), and there are no interfering factors in the process parameters (dust-generating process not running), it is considered a valid alarm; if only the smoke detector alarms, other sensor data are normal, and the dust / water mist process is running, it is considered environmental interference and automatically filtered; if a single sensor sends a strong signal alarm (smoke detector exceeds the threshold by 1.5 times), and other sensor data are at the critical point (temperature detector is close to the threshold), it is marked as a suspicious alarm and pushed to the maintenance platform for manual confirmation.

[0061] Step S1326: Deploy the model to the edge computing node in the workshop, connect to the sensor and process data stream in real time, output scene classification results and alarm judgment conclusions, collect actual operation data and manual review results regularly, construct an incremental learning dataset, update the parameters of the integrated learning model using an online incremental learning algorithm, supplement new interference scene samples and optimize feature weight allocation, refit the dynamic threshold mapping relationship model regularly, adjust the mapping parameters, establish a model performance monitoring mechanism, and automatically trigger the full data retraining process when the false negative rate of real safety events or the false judgment rate of interference scenes reaches the set standard.

[0062] The ensemble learning model is deployed to the workshop edge computing node (CPU model i7-12700H), and connects to sensor and process data streams in real time via the Modbus protocol, outputting scenario classification results and alarm judgment conclusions. Actual operational data and manual review results (false alarms and missed alarms) are collected weekly to build an incremental learning dataset (≥500 new entries each time). An online incremental learning algorithm (mini-batch gradient descent, batch size 64) is used to update model parameters, supplement new interference scenario samples (such as special dust interference caused by new materials), and optimize feature weights. The dynamic threshold mapping model is refitted quarterly, and mapping parameters are adjusted. A performance monitoring mechanism is established: when the missed alarm rate of "real safety events" > 1% or the false alarm rate of "interference scenarios" > 8%, full data retraining is automatically triggered.

[0063] Step S133: Construct an industrial scene video semantic segmentation dataset, improve the segmentation model and combine temporal correlation discrimination and morphological optimization to distinguish between production materials / equipment and intrusion targets, and filter out false triggers from non-security videos; Covering core areas such as factory workshops, warehouses, and passageways, AI cameras (model IPC-AI600) were deployed to collect video data under different time periods and working conditions. The data was pixel-level labeled using LabelStudio according to five categories. After cleaning and enhancement, the data was divided into training, validation, and test sets (ratio 7:2:1) to form a structured semantic segmentation dataset. Based on U-Net, a CBAM module was introduced to optimize the upsampling structure. A hybrid loss function and depthwise separable convolution were used, and the model size after pruning and quantization was ≤50MB. Morphological optimization was performed on the segmentation results, and motion and trajectory features were extracted through inter-frame difference. A comprehensive discrimination mechanism was constructed by combining regional permissions, and the model was deployed to edge devices. The model was periodically optimized through incremental learning.

[0064] Step S1331: Collect video data from different time periods and working conditions in the factory area, covering multiple targets and scenes. Label the video frames at the pixel level according to five categories of labels. After data cleaning and enhancement processing, divide the data into training set, validation set and test set to form a structured semantic segmentation dataset. Covering four core areas—factory workshops, warehouses, passageways, and hazardous chemical storage areas—20 IPC-AI600 AI cameras were deployed to collect video data during morning, noon, and evening shift changes, capturing production operations, equipment maintenance, and material transfer conditions. This ensured the data included production materials, equipment, personnel, intrusion targets, and any abnormal scenarios. Video frames were pixel-level labeled using LabelStudio with five categories of tags, focusing on material stacking boundaries, equipment outlines, and the boundaries between authorized and unauthorized areas. Invalid frames with blurriness or occlusion ≥60% were removed. The sample size was expanded to 80,000 frames through data augmentation techniques such as brightness adjustment, Gaussian noise addition, and random cropping. The training, validation, and test sets were then divided in a 7:2:1 ratio to form a structured semantic segmentation dataset.

[0065] Step S1332: Based on the U-Net model framework, CBAM is introduced in the encoder part to enhance the extraction of class features and suppress the interference of background class features. In the decoder part, transposed convolution and bilinear interpolation are combined to optimize the upsampling structure and improve the segmentation accuracy of small targets. The weighted sum of Dice loss function and cross-entropy loss function is selected as the model loss function. Depthwise separable convolution is used to replace some ordinary convolution. The model is optimized by combining model pruning and quantization techniques to adapt to the real-time processing requirements of edge devices. Based on the U-Net model framework, a CBAM module is introduced after each convolutional layer in the encoder to enhance the extraction of features of personnel and intrusive targets and suppress background interference through channel attention and spatial attention mechanisms. The decoder employs an upsampling structure combining transposed convolution (3×3 kernels) and bilinear interpolation to improve the segmentation accuracy of small targets. A weighted sum of Dice loss and cross-entropy loss (weight ratio 0.4:0.6) is used as the model loss function to alleviate class imbalance. 30% of ordinary convolutions are replaced with depthwise separable convolutions, combined with channel pruning (35% pruning rate) and INT8 quantization, resulting in a model size compressed to 45MB and an edge-side inference frame rate ≥15FPS, adapting to the local inference requirements of AI cameras.

[0066] Step S1333: Perform morphological filtering on the pixel-level segmentation results output by the improved semantic segmentation model. First, remove small noise points through erosion, then fill the holes and breaks in the target region through dilation. Calculate the bounding rectangle and area of ​​the segmented target region, set a minimum threshold for the target area, filter out mis-segmented regions with areas smaller than the threshold, and retain the effective region. Erosion operations are performed using 3×3 rectangular structural elements to remove minute noise points caused by dust and lighting. Then, dilation operations are performed using 5×5 rectangular structural elements to fill voids and breaks within the target area. The bounding rectangle and area of ​​the segmented target area are calculated, and a minimum target area threshold of 20 pixels is set to filter out mis-segmented small areas caused by light reflection and sensor noise. Effective areas that match the actual target size (e.g., personnel ≥ 100 pixels, small intruders ≥ 30 pixels) are retained, providing accurate contour information for subsequent temporal discrimination.

[0067] Step S1334: After morphological optimization of the segmentation results of continuous video frames, the inter-frame difference algorithm is used to calculate the pixel change of the target region between adjacent frames, extract the target motion information, distinguish between dynamic targets and static targets, fit the motion trajectory based on the inter-frame coordinate sequence of dynamic targets, analyze the continuity and integrity of the trajectory, distinguish between continuously moving targets and instantaneous interference targets, associate the area permission information, determine whether the dynamic target has entered the unauthorized area and record the dwell time. After morphological optimization and segmentation of continuous video frames (25 FPS), the inter-frame difference algorithm is used to calculate the pixel change in the target region between adjacent frames. A threshold of 10 pixels is set; targets exceeding the threshold are identified as dynamic targets, while those below the threshold are identified as static targets (production materials, equipment). Based on the inter-frame coordinate sequence of dynamic targets, the least squares method is used to fit the motion trajectory. The continuity (≥5 consecutive frames without interruption) and integrity (contour integrity ≥80%) of the trajectory are analyzed to distinguish between continuously moving targets (personnel, intrusion targets) and transient interference targets (falling debris, flickering light). Associated area permission information (preset via the factory's electronic map) is used to determine whether a dynamic target enters an unauthorized area and records the duration of its stay (accurate to the second).

[0068] Step S1335: Combine segmentation category, morphological characteristics, temporal trajectory and area permissions to make a judgment. When the target category is an external intrusion target, dynamic, continuous trajectory, enters an unauthorized area and stays for a specified time, it is judged as a valid alarm. When the target category is production material, equipment body, or dynamic but discontinuous trajectory, and is in an authorized area, it is judged as a non-safety trigger source and automatically filtered. When the target category is ambiguous, the trajectory is critically continuous, or it is active at the area boundary, it is marked as a suspicious alarm and triggers the manual review process. The system comprehensively judges targets based on segmentation category, morphological characteristics, temporal trajectory, and area permissions: if the target category is "external intrusion target," and it is dynamic, has a continuous trajectory (≥5 frames), enters an unauthorized area, and stays for ≥30 seconds, it is determined as a valid alarm and triggers an audible and visual warning; if the target category is "production material" or "equipment body," or if it is dynamic but has a discontinuous trajectory (<5 frames) and is located in an authorized area, it is determined as a non-security trigger source and is automatically filtered; if the target category is ambiguous (confidence level 0.5-0.7), the trajectory is critically continuous (interrupted once every 5 frames), or it is active at the boundary between authorized and unauthorized areas (staying for 10-30 seconds), it is marked as a suspicious alarm and pushed to the operation and maintenance platform, triggering a manual review process.

[0069] Step S1336: Deploy the improved semantic segmentation model, morphological processing module, and time-series correlation discrimination module to the edge computing device, access the industrial scene video stream in real time and output the results, collect actual operation data and manual review results regularly, construct an incremental learning dataset, update the model parameters using an online incremental learning algorithm, supplement new interference samples and scene change samples, optimize the relevant modules and parameters of the model, establish a model performance monitoring mechanism, and statistically analyze the false alarm rate, false negative rate, and segmentation accuracy in real time. When the indicators exceed the set threshold, trigger the full retraining process of the model.

[0070] An improved semantic segmentation model, morphological processing module, and time-series correlation discrimination module are packaged and deployed to an IPC-AI600 AI camera (with a built-in edge computing unit). The camera accesses the industrial scene video stream in real time via the RTSP protocol, outputting segmentation results and alarm judgment conclusions. Monthly collection of actual operational data and manual review results (false positives and false negatives) is used to construct an incremental learning dataset (≥800 new entries each time). Online incremental learning algorithms are employed to update model parameters, supplementing new interference samples (such as missegmentation caused by new materials) and scene change samples (such as equipment layout adjustments), and optimizing the CBAM module and loss function weights. A performance monitoring mechanism is established to statistically analyze the false positive rate (≤5%), false negative rate (≤3%), and segmentation accuracy (≥92%) in real time. When these indicators exceed the thresholds, a full model retraining is triggered.

[0071] Step S134: Through scene adaptive switching, incremental learning model iteration, and the construction of a dynamic update library for interference types, flexible adaptation and continuous optimization of the recognition logic for the three types of scenes are achieved.

[0072] A scene adaptive switching module is built and deployed on the edge gateway. Based on sensor ID and device location information, it automatically identifies the current scene (perimeter / workshop / video) and switches the corresponding recognition logic accordingly, with a switching response time of ≤100ms. An incremental learning scheduling platform is established to trigger incremental training of the three scene models once a month, integrating the latest collected sample data to optimize model parameters. A dynamic interference type update library (stored in a MySQL database) is built to classify and record interference types under various scenes (such as birds at the perimeter, dust in the workshop, and light and shadow in the video). New interference types are added and the recognition logic is updated quarterly. This mechanism enables flexible adaptation of the three scene recognition logics, ensuring continuous optimization of the filtering effect during long-term system operation.

[0073] Step S140: Based on the knowledge graph of multi-dimensional nodes and association rules, combined with real-time working condition data and causal reasoning algorithms, output high-confidence root causes and visual verification chains; A multi-dimensional knowledge graph is stored using the Neo4j graph database, and edge computing nodes (EC-600) are deployed to collaborate with cloud-based distributed servers to run causal inference algorithms. Real-time operational data is accessed at the edge, triggering inference and traversing potential causal paths through the knowledge graph. The cloud uses a Bayesian network to calculate confidence scores (threshold ≥ 0.8), outputting the top 3 high-confidence root causes. A visual verification chain is constructed using ECharts, with nodes color-coded by type (abnormal red, middle yellow, root cause orange), edge thickness mapping to confidence scores, and linked to real-time data screenshots, historical cases, and other evidence. Node details can be viewed and paths filtered, ensuring that root causes are traceable and verifiable.

[0074] Step S141: Analyze the entire production process of the factory, define six types of nodes, extract four types of association rules from multi-source data and ensure their effectiveness through algorithm mining and manual correction, integrate structured and unstructured data, and transform them into graph nodes and association edges through entity recognition and relationship extraction technologies to form an initial multi-dimensional knowledge graph; The entire factory production process was analyzed, defining six types of nodes: equipment, sensors, processes, faults, environment, and personnel operations. Node attributes include specific information such as equipment age and sensor accuracy. Four types of association rules (deployment, triggering, inducing, and constraint) were extracted from 100,000 historical fault records, equipment manuals, and expert manuals. These rules were then mined using the Apriori algorithm and reviewed and corrected by three industry experts (with over 10 years of experience) (efficiency ≥95%). Structured data (process parameter tables) and unstructured data (maintenance logs) were integrated, and entity recognition and relationship extraction were performed using the spaCy tool, transforming the data into graph nodes and associated edges to form an initial knowledge graph (containing 5000+ nodes and 8000+ edges).

[0075] Step S142: Use a graph database to store the knowledge graph and define node and edge attributes. Collect new information and incrementally supplement nodes and relationships through an update mechanism. Regularly verify and correct rules to ensure that the graph is synchronized with the production scenario. Deploy a collection gateway compatible with multiple transmission methods, access multiple types of real-time data and align them in time. After anomaly removal, standardization, completion and resampling preprocessing, output a structured real-time working condition data matrix. The knowledge graph is stored using the Neo4j graph database. Node attributes include equipment operating years and sensor accuracy, while edge attributes include association confidence (based on historical data statistics). A monthly graph update mechanism is established, adding equipment and faulty nodes through incremental entity extraction technology, and periodically validating rules (removing ≥5% of invalid rules per month). A DG-200 data acquisition gateway is deployed, compatible with Modbus and 5G protocols, to access sensor, process, and environmental data, aligned with NTP timestamps (1ms accuracy). The 3σ criterion is used to remove outlier data, Z-score standardization is used to unify dimensions, and linear interpolation is used to complete missing values. Data is resampled to 1 second / sample, outputting a structured process condition data matrix (20×1000 dimensions).

[0076] Step S143: Based on the causal structure of the knowledge graph, construct a causal reasoning framework that integrates rule-based reasoning and probabilistic reasoning. The rule-based reasoning module filters potential factors related to real-time abnormal data according to the graph association rules. The probabilistic reasoning module adopts a Bayesian network model, maps graph nodes to network variables, and uses edge attributes as conditional probabilities between variables. Combined with causal inference methods, it eliminates false associations and quantifies causal strength. Using abnormal phenomena and root cause pairing data in historical failure cases as training sets, it optimizes the Bayesian network conditional probability table and rule-based reasoning trigger threshold. A fusion framework of "rule-based reasoning + probabilistic reasoning" is constructed. The rule-based reasoning module is deployed at the edge, filtering anomalous correlation factors (e.g., excessive temperature → equipment overheating failure) according to graph rules. The probabilistic reasoning module is deployed in the cloud, using PyMC3 to build a Bayesian network, mapping graph nodes to network variables, and edge attributes as conditional probabilities. The Do-Calculus method is combined to eliminate spurious associations. Using 10,000 historical "abnormal phenomenon-root cause" data points as a training set, the conditional probability table and inference threshold are optimized (false positive rate ≤3%). Gradient descent is used to minimize inference error, ensuring accurate quantification of causal strength and improving the accuracy of root cause determination.

[0077] Step S144: Set inference trigger conditions. When a sensor abnormality, process parameter exceeding the standard, or safety event alarm is detected, extract abnormal features and input them into the causal inference model. The model traverses and associates potential paths based on the knowledge graph, filters candidate causal chains through rule inference, calculates the causal confidence of each candidate chain through probabilistic inference, eliminates low-confidence candidate chains, and traces the starting point of the high-confidence causal path as the root cause of the abnormality. Sensor data exceeding limits by ≥10%, process parameters exceeding thresholds, or safety events triggering alarms for ≥5 seconds. The edge processing automatically extracts abnormal features (sensor ID, exceeding value, occurrence time) and inputs them into a causal inference model. The model traverses related paths based on a knowledge graph (e.g., excessive dust → false smoke alarm → alarm), uses rule-based reasoning to filter candidate causal chains (retaining ≥3), and calculates confidence scores using probabilistic reasoning (weighted summation). Candidate chains with confidence scores <0.8 are eliminated, and the starting point of the remaining path is traced back to the root cause of the anomaly. The entire inference process takes ≤200ms, ensuring real-time response.

[0078] Step S145: Construct a multi-dimensional evaluation index system based on the scope of influence, frequency of occurrence, and cost of resolution of the root cause. Use the analytic hierarchy process to determine the weight of each index. Combine the confidence of causal inference to calculate the comprehensive score of the root cause. Rank the root causes by score and output the Top-N high-confidence root causes, and label the root cause information. The impact scope (weight 0.4, e.g., production line downtime is considered high impact), occurrence frequency (weight 0.3, number of historical failures), and resolution cost (weight 0.3, maintenance man-hours + material consumption) are considered. The weights are determined using the analytic hierarchy process (AHP) implemented with Yaahp tools, and a comprehensive score is calculated based on the confidence level of causal inference (score = confidence level × 0.6 + indicator score × 0.4). The top 3 high-confidence root causes are output in descending order of score, labeled with root cause type (equipment / process / environment), impact level (level 1-3), and suggested solutions (e.g., equipment bearing replacement, process parameter adjustment), providing direct basis for operation and maintenance decisions.

[0079] Step S146: Extract the causal path corresponding to the high-confidence root cause, and visualize the verification chain in the form of a graph. Different colors are used to distinguish the node type and the thickness of the edges represents the association confidence. Real-time working condition data, historical matching cases, association rule basis, and inference process log evidence are associated in the verification chain. Interactive operations such as viewing node details, expanding / collapsed association path, and filtering confidence interval are supported. Extract the causal path corresponding to the high-confidence root cause and construct a visual verification chain using ECharts. Nodes are color-coded by type (abnormal red, middle yellow, root cause orange), and edge thickness corresponds to confidence level (≥0.9 is thick edge, 0.8-0.9 is medium edge). Supporting evidence includes: real-time operating data screenshots (abnormal curves), historical matching cases (case number + processing result), association rule basis (such as process manual clauses), and inference logs (steps + parameters). Interactive operation is supported: click on a node to view attributes (such as equipment operating years), expand / collapse the path, and filter verification chains with confidence level ≥0.8, making the inference process traceable and verifiable, and adaptable to the operating habits of maintenance personnel.

[0080] Step S147: Collect root cause verification feedback data, including manual review results and solution implementation effects. Adjust causal inference model parameters based on feedback data, optimize Bayesian network conditional probability table and rule inference threshold, update knowledge graph edge attributes, improve confidence of effective association rules, eliminate or correct erroneous association rules, add new root cause nodes and association relationships, and perform full-process optimization at a fixed frequency.

[0081] Manual review of results (correct / incorrect / missed cases), and evaluation of solution implementation effectiveness (whether anomalies have been resolved). Based on feedback data, the Bayesian network conditional probability table and rule inference thresholds are adjusted using mini-batch gradient descent (adjustment range ±0.05). Knowledge graph edge attributes are updated: correct rules are increased in confidence by 0.1, incorrect rules are decreased by 0.1 or removed, and new root cause nodes (e.g., ≥2 new faults per month) and their associated relationships are added. A full-process optimization is performed monthly to ensure the model and knowledge graph adapt to dynamic changes in the production scenario.

[0082] Step S150: Deploy the edge and private cloud collaborative system. The edge device preprocesses alarm data, and the private cloud optimizes the model through incremental learning and transfer learning.

[0083] A layered collaborative system integrating edge computing and a private cloud is constructed. The edge computing nodes, EC-500, are deployed in workshops and perimeter areas to handle real-time data preprocessing and local inference. The private cloud utilizes a self-built private ECS distributed server cluster in a local data center, handling data storage, model training, and global scheduling, without relying on any public cloud platform. The edge computing nodes are natively compatible with industrial communication protocols such as Modbus, Profinet, 5G, and LoRa. The private cloud is equipped with the time-series database InfluxDB, the graph database Neo4j, and the relational database MySQL to meet various industrial data storage and computing needs. The system establishes a stable bidirectional communication link via a 1000M industrial fiber optic network. The edge computing nodes perform preprocessing tasks such as alarm data filtering, standardization, and feature extraction, effectively filtering redundant data and reducing transmission pressure. The private cloud uses incremental learning and transfer learning algorithms to iteratively optimize the model. The optimized high-precision model is then sent back to the edge devices, achieving a closed-loop collaboration across the entire process of edge inference, cloud optimization, and model iteration.

[0084] Step S151: Construct a layered collaborative architecture between the edge and the cloud. The edge is responsible for real-time data processing and local inference, deploying lightweight hardware adapted to industrial scenarios and compatible with industrial buses and wireless transmission protocols. The cloud is responsible for data storage, model training optimization and global scheduling functions, using distributed server clusters and multiple types of cloud databases to complete data management, and establishing bidirectional communication between the edge and the cloud through a high-bandwidth network. A layered collaborative architecture is constructed between the edge and cloud. EC-500 lightweight edge computing nodes are deployed at the edge, adaptable to industrial deployment scenarios and compatible with Modbus, Profinet industrial buses, and 5G and LoRa wireless transmission protocols. The cloud utilizes a distributed cluster of eight ECS servers, configured with an InfluxDB time-series database (for storing operational data), OSS object storage (for storing videos / files), and a MySQL relational database (for storing model parameters). Two-way communication is established via a 1000M fiber optic network, and a closed-loop process of "edge preprocessing - cloud optimization - edge deployment" is designed: the edge processes data and uploads features in real time, the cloud trains and optimizes the model before deployment, ensuring efficient collaboration and meeting the real-time requirements of industrial security.

[0085] Step S152: Configure the edge gateway as the regional aggregation node according to the factory area distribution, monitoring points, and data volume, connect the sensor and camera terminals nearby, install a lightweight operating system and industrial acquisition software on the edge device, integrate the inference framework and optimize the allocation of computing resources to meet the performance requirements of real-time data processing and local model inference. Based on the factory's regional distribution (3 workshops, 2 warehouses, and 1 perimeter), DG-638 edge gateways are configured as regional aggregation nodes according to the monitoring point density (1 unit per 10 monitoring points), connecting to sensors and camera terminals as close as possible. The edge devices are pre-installed with the lightweight Ubuntu Core operating system and Kepware industrial data acquisition software, integrating the TensorRT inference framework and optimizing computing power allocation (40% CPU, 60% GPU). Resource scheduling algorithms ensure real-time data processing latency ≤50ms and local model inference frame rate ≥15FPS, meeting the parallel processing needs of multiple data types such as smoke detection, infrared, and video, and adapting to the continuous operation requirements of industrial scenarios.

[0086] Step S153: Real-time access to multiple types of monitoring data, filter and retain alarm-related time period data and remove redundant information, complete standardization processing through outlier removal, missing value completion, normalization, video encoding and key frame extraction, extract alarm core features to generate lightweight feature vectors, store key data locally and upload features and anomaly labels to the cloud; The edge gateway receives sensor alarm data, video frame data, and process parameter data in real time, filtering and retaining relevant data from 10 seconds before and 30 seconds after the alarm, while removing irrelevant and redundant information (compressing the data volume to 30% of the original). Standardized preprocessing is performed: the 3σ criterion removes instantaneous abnormal jump values ​​from sensors, linear interpolation completes missing data ≤5 seconds, and Min-Max normalization maps data of different dimensions to the [0,1] interval; video frames are compressed using H.265 encoding, and key frames of moving targets are extracted based on the inter-frame difference method. 128-dimensional core features (sensor abnormal amplitude, target contour features, etc.) are extracted to generate lightweight feature vectors. Key raw data is stored locally on an SSD, and only the feature vectors and abnormal labels (false alarm / valid / suspicious) are uploaded to the cloud via the MQTT protocol.

[0087] Step S154: Deploy the cloud-optimized lightweight model at the edge to complete local inference and data filtering. Classify alarms according to the inference confidence threshold. High-confidence alarms are responded to directly locally. Low-confidence suspicious and false alarm data are uploaded to the cloud in batches on a periodic basis. Inference logs are recorded synchronously to provide a basis for model optimization. Deploy lightweight models optimized for cloud computing (pruned and quantized YOLOv8, U-Net, and ensemble learning classifiers) at the edge, with a model size ≤30MB and an inference frame rate ≥15FPS. Set a local inference confidence threshold of 0.85: alarms with a confidence level ≥0.85 are considered valid, triggering a local audible and visual alarm (model SB-200) and linking it to the access control system; alarms with a confidence level <0.6 are considered suspicious or false alarms, and associated feature vectors, abnormal video frames, sensor curves, and other data are uploaded to the cloud in batches at 5-minute intervals. Synchronously record inference logs (including inference results, device CPU / memory usage, and network bandwidth) to provide complete data support for cloud model optimization.

[0088] Step S155: Based on timestamps, complete the classification and archiving of multi-source data, construct a multi-dimensional storage system that combines time-series databases, object storage and relational databases, and establish a data access control mechanism to ensure data security; A cloud-based MQTT data receiving service is deployed to receive feature vectors, raw data fragments, and inference logs uploaded from edge devices. Multi-source data is categorized and archived by region, device ID, and alarm type using timestamps (1ms accuracy). A multi-dimensional storage system is constructed: InfluxDB time-series database stores sensor alarm time-series data (supporting 1000 concurrent writes per second); OSS object storage service stores video clips and raw data files (10TB capacity); and MySQL relational database stores model version information, training parameters, and edge device status data. A three-level data access permission system is established: administrator (full permissions), operations and maintenance personnel (view / process permissions), and visitors (read-only permissions), employing AES-256 encryption to ensure data transmission and storage security.

[0089] Step S156: Integrate historical data and balance the sample distribution. Perform incremental training on the basic model by freezing the bottom parameters and fine-tuning the top parameters. Introduce regularization to suppress catastrophic forgetting. Automatically trigger training according to the preset data volume or accuracy threshold and retain the better performing model. The cloud-based incremental learning dataset is constructed based on labeled data (false alarm / valid alarm labels) uploaded from the edge. Subsets are created by region and scene type and fused with 100,000 historical training data points. A balanced strategy of oversampling the minority class and undersampling the majority class is employed to ensure a balanced dataset distribution (each class sample percentage ±5%). Based on the existing model, a "freeze backbone network - fine-tune classification head" strategy is used, freezing 80% of the underlying parameters and training only the classification head and feature fusion layer. L2 regularization is introduced to mitigate catastrophic forgetting. Triggering conditions are set: incremental training automatically starts when ≥1000 new labeled data points are added in a single iteration or the edge inference accuracy is <90%. Accuracy, recall, and F1 score are calculated, and only models with performance superior to the previous version are retained.

[0090] Step S157: Initialize the target scene model by calling the weights of the mature source scene model, freeze the general feature layer and train the classification layer using a small amount of labeled data, and combine the domain adaptation algorithm to reduce the data distribution difference; For situations where there is insufficient data (≥200 labeled data points) for newly added areas of the factory (such as the newly built Workshop 3) or new scenarios (new material production lines), a maturely trained source scenario model (such as the existing Workshop 1 scenario classification model) is invoked from the cloud. The weights of the common feature extraction layer in the source model are extracted as initialization parameters, and this portion of the weights (70%) is frozen. A dedicated classification layer is trained based on 200 labeled data points for the target scenario. A Domain Adversarial Neural Network (DANN) adaptive algorithm is adopted to reduce the data distribution differences between the source and target scenarios, reducing the generalization error to ≤5%. Transfer learning is used to quickly adapt to the target scenario, shortening the model deployment cycle to 30% of the original and reducing data labeling costs.

[0091] Step S158: Perform channel pruning, quantization and compression on the optimized model in the cloud to generate a model format adapted to edge hardware. Send the model to the corresponding edge terminal through an encryption protocol. The edge terminal completes model replacement, configuration update and loading test to form a closed loop of model iteration. Channel pruning removes 40% of redundant convolutional channels, INT8 quantization maps weights and activation values ​​to integer ranges, and LZMA compression reduces the model size to less than 30% of its original size. A model format adapted for edge devices (TensorRT engine file, ONNX format) is generated and distributed to the corresponding edge devices via HTTPS+AES-256 encrypted transmission protocol. Upon receiving the model, the edge device automatically replaces the old version, updates the TensorRT inference framework configuration, and performs model loading tests (verifying integrity and inference speed ≥15FPS). After passing the tests, the new version is activated, and deployment results are sent back to the cloud via HTTP requests, forming an iterative closed loop of "training-optimization-deployment".

[0092] Step S159: Monitor the operating status and data processing of edge devices in real time, display the collaborative status through a visual interface, formulate dynamic collaborative strategies to achieve flexible allocation of computing power and training resources, and provide real-time alerts for abnormal edge status in the cloud. A Prometheus+Grafana global scheduling platform is deployed in the cloud to monitor the real-time operating status of all edge devices (CPU / memory / disk utilization, network bandwidth, model inference accuracy), and a visual dashboard displays the global collaborative status. Dynamic collaborative strategies are set: when the edge device's CPU utilization is consistently ≥80%, the cloud temporarily shares non-real-time tasks such as historical data backtracking analysis; when the false positive rate of the edge device model in a certain area is consistently ≥5%, the cloud prioritizes allocating incremental training resources. The edge devices report their health status and model operation logs to the cloud every 5 minutes. The cloud triggers SMS and platform alarms for abnormal states such as device offline or model inference failure, notifying operations and maintenance personnel to respond and handle the situation within 10 minutes.

[0093] Step S1510: Reduce bandwidth usage by using encryption and compression methods, alleviate concurrent upload pressure through load balancing, set up a network disconnection caching mechanism at the edge to ensure data is not lost, and continuously optimize the preprocessing and inference engines; Communication between the edge and cloud terminals uses HTTPS+AES-256 encrypted transmission protocol. Data is compressed before transmission: sensor data uses JSON compression (compression ratio 1:5), and video data uses segmented compression (10 seconds per segment, compression ratio 1:10). An Nginx load balancer is deployed in the cloud to distribute the concurrent upload pressure across multiple edge terminals (supporting 500 concurrent requests per second). Each edge terminal is configured with a 128GB SSD + 32GB SD card for local caching. Data awaiting upload is temporarily stored during network interruptions, and automatically uploaded in batches after network recovery (data loss rate ≤0.1%). Preprocessing algorithms (e.g., adjusting the 3σ threshold) and inference engine parameters are optimized monthly to improve edge data processing efficiency and reduce hardware resource consumption (CPU utilization reduced by 10%).

[0094] Step S1511: Verify the real-time performance, inference accuracy, and data caching capabilities at the edge, test the effectiveness of incremental learning and transfer learning in the cloud, and adjust parameter configurations and continuously optimize system performance based on actual operational data statistics.

[0095] Test edge data preprocessing latency (≤50ms), local inference accuracy (≥92%), and data caching and recovery capabilities after a 1-hour network outage (100% recovery rate). Test the optimization effects of cloud-based incremental learning (accuracy improvement ≥3% after training with 1000 new data points) and transfer learning (generalization error of the model in new scenarios ≤5%), and verify the performance loss after model lightweighting (inference speed decrease ≤10%). Collect 3 months of actual operation data, and statistically analyze edge real-time indicators, cloud model optimization cycle (≤7 days), and collaborative scheduling response speed (≤100ms). Address issues such as excessive inference latency and insignificant optimization effects by adjusting preprocessing thresholds, model training hyperparameters, and collaborative scheduling rules, continuously iterating and optimizing system performance.

[0096] Based on the same inventive concept, please refer to Figure 2 This paper shows a schematic block diagram of a factory security multi-event alarm root cause analysis system 100 provided in an embodiment of this application for performing the above-described factory security multi-event alarm root cause analysis method. The factory security multi-event alarm root cause analysis system 100 may include a communication unit 110, a machine-readable storage medium 120, and a processor 130.

[0097] In this embodiment, both the machine-readable storage medium 120 and the processor 130 are located within the factory security multi-event alarm root cause analysis system 100 and are separately configured. However, it should be understood that the machine-readable storage medium 120 may also be independent of the factory security multi-event alarm root cause analysis system 100 and may be accessed by the processor 130 via a bus interface. Alternatively, the machine-readable storage medium 120 may also be integrated into the processor 130 and may communicate with external systems via the communication unit 110.

[0098] The processor 130 is the control center of the factory security multi-event alarm root cause analysis system 100. It connects to various parts of the system via various interfaces and lines. By running or executing software programs and / or modules stored in the machine-readable storage medium 120, and by calling data stored in the machine-readable storage medium 120, it performs various functions and processes data of the factory security multi-event alarm root cause analysis system 100, thereby providing overall monitoring of the system. Optionally, the processor 130 may include one or more processing cores; for example, the processor 130 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. The machine-readable storage medium 120 is used to store machine-executable instructions for executing the scheme of this application, and the processor 130 is used to execute the machine-executable instructions stored in the machine-readable storage medium 120 to implement the factory security multi-event alarm root cause analysis method provided in the aforementioned method embodiment.

[0099] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

[0100] The embodiments of this application have been described above with reference to the accompanying drawings. Unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other. This application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A root cause analysis method for multi-event alarms in factory security systems, characterized in that: Includes the following steps: Construct a dynamic coupling calibration system for environment and sensors, and achieve source separation of environmental interference and equipment fault data through online adaptive weight allocation and time-series drift detection; Based on the factory layout, a sensor association topology network is constructed. By combining spatiotemporal constraints and an improved temporal clustering algorithm, alarm data simplification and instantaneous false alarm elimination are achieved. Differentiated recognition logic is designed for three types of scenarios: perimeter, workshop, and video, and non-safety trigger sources are accurately filtered through models and algorithms; Based on a knowledge graph with multi-dimensional nodes and association rules, combined with real-time working condition data and causal reasoning algorithms, it outputs high-confidence root causes and visual verification chains. Deploy a collaborative system between the edge and private cloud. The edge device preprocesses alarm data, while the private cloud optimizes the model through incremental learning and transfer learning.

2. The root cause analysis method for multi-event alarms in factory security according to claim 1, characterized in that: The constructed environment and sensor dynamic coupling calibration system, through online adaptive weight allocation and temporal drift detection, achieves source separation of environmental interference and equipment fault data, including: A multi-source data synchronous acquisition architecture is built, and an acquisition gateway compatible with industrial bus and wireless transmission is deployed. At the same time, real-time monitoring data from security sensors and multi-dimensional parameters from environmental sensing devices are accessed, and the time alignment of the two types of data is achieved through the NTP timestamp synchronization mechanism. By employing the 3σ criterion, Min-Max normalization, linear interpolation, and sliding window smoothing, the system completes the anomaly removal, dimension unification, sampling rate alignment, and fluctuation reduction of sensor data, thereby achieving data preprocessing to output stable and usable standardized data. The dynamic features of environmental parameters and the stability features of sensor data are extracted to establish a feature vector set. The environmental features are used to determine the interference intensity, and the sensor features are used to evaluate the data reliability, providing a quantitative basis for weight allocation. A weighted decision-making model is constructed based on a fuzzy logic system. The fluctuation level of environmental parameters and the stability level of sensor data are used as input variables. The model is mapped to a fuzzy set through a membership function, and fuzzy inference rules are formulated. After defuzzification, real-time weight coefficients are output. At the same time, a reinforcement learning mechanism is embedded, with the data separation accuracy as the reward function. The sliding window method is used to divide historical data into segments. The LSTM model is used to learn the temporal variation pattern of the sensor under interference-free and fault-free conditions, and outputs a normal behavior prediction curve based on historical data to form a dynamically updated temporal baseline. The residual analysis and CUSUM algorithm are combined to calculate the residual sequence between the real-time sensor data and the time-series baseline. The residual deviation is accumulated by the CUSUM algorithm. When the accumulated value exceeds the preset threshold and the duration reaches the set threshold, it is determined to be a persistent drift. At the same time, the residual sequence is decomposed by wavelet transform to distinguish between low-frequency trend terms caused by equipment aging / drift and high-frequency fluctuation terms caused by environmental interference. When environmental parameter fluctuations trigger a weight reduction and the sensor data residual is a high-frequency fluctuation term, it is determined to be environmental interference data. When the CUSUM algorithm detects a persistent drift and the residual is a low-frequency trend term, it is determined to be equipment fault data. When both types of features exist simultaneously, the final classification result is output through a weighted voting mechanism. Real-time acquisition of feedback information after data separation; use incremental learning algorithm to periodically update the parameters of LSTM time-series baseline model and fuzzy logic weight decision model; and dynamically adjust the threshold of CUSUM algorithm based on the separation accuracy within the sliding window. The separated security sensor data, environmental interference tags, and equipment fault tags are output in a standardized format and synchronously stored in the local database at the edge, providing structured input for subsequent processing modules. At the same time, a fault early warning interface is reserved so that maintenance reminders are automatically triggered when equipment fault data occurs continuously.

3. The root cause analysis method for multi-event alarms in factory security according to claim 2, characterized in that: The weighted decision model constructed based on the fuzzy logic system takes the environmental parameter fluctuation level and the sensor data stability level as input variables, maps them to fuzzy sets through a membership function, formulates fuzzy inference rules, and outputs real-time weight coefficients after defuzzification. Simultaneously, it embeds a reinforcement learning mechanism, using data separation accuracy as the reward function, including: The input variable standardization classification is based on the statistical distribution of historical environmental parameters and sensor data of the factory. The fluctuation level of environmental parameters is divided into three levels: low fluctuation, medium fluctuation and high fluctuation. The stability level of sensor data is divided into three levels: high stability, medium stability and low stability. The threshold of each level is determined by the percentile method to achieve the standardization classification of input variables. Based on the three-level classification of environmental parameter fluctuation level and sensor data stability level, triangular membership functions are constructed respectively. The domain of the function is defined as the quantization interval of the corresponding input variable. By adjusting the position of the vertex and the slope of the function, the membership value is smoothly transitioned in the interval [0,1], ensuring that the precise input value can be reasonably mapped to the membership degree of the fuzzy set. Based on practical experience in factory security scenarios, we have developed comprehensive if-then fuzzy reasoning rules that cover all combinations of input levels. We have assigned an initial confidence level to each rule to ensure that the rule logic is consistent with the actual data separation requirements. The Mamdani inference method is adopted. First, the membership degree of each input variable to the corresponding fuzzy set is calculated. Then, the trigger strength of each rule is obtained by taking the smaller value. Based on the trigger strength, the conclusion fuzzy sets of each rule are aggregated by taking the larger value to form the total fuzzy output set. The centroid method is used to defuzzify the aggregated fuzzy output set, and the centroid coordinates of the fuzzy set are calculated as the precise weight coefficients output. At the same time, the weight adjustment step size is set. The fuzzy logic weighted decision model is used as the intelligent agent. The environmental state is defined as the level combination of the current input variables. The action space is the weight coefficient range of the defuzzified output. The reward function is set as the data separation accuracy. Positive rewards or negative penalties are given based on the comparison between the data separation accuracy and the historical average. Initialize the Q-table for reinforcement learning, mapping the combination of state and action to the initial Q value. After each round of data separation, collect the current state, the weighted action executed, the reward value obtained, and the next state. Update the Q-table using the Q-learning algorithm, and optimize the value evaluation of state and action through iterative training. Based on the Q-value update results of reinforcement learning, the confidence of fuzzy inference rules is dynamically adjusted. The confidence of rules with higher Q-values ​​is increased, while the confidence of rules with lower Q-values ​​is decreased or the rule description is optimized. At the same time, rules corresponding to frequently occurring states and actions with good separation effects are added. Set a model update cycle that is synchronized with the sensor sampling cycle. Each update calculates the data separation accuracy based on the latest data stream, triggers the reward calculation and Q-table update of reinforcement learning, and then links the fine-tuning of the fuzzy inference rule base and membership function parameters, so that the weight decision model can adapt to the dynamic changes of the factory environment and sensor status in real time. Regularly analyze the weight allocation effect and data separation accuracy within a certain period, and fine-tune the vertex position of the membership function, the initial confidence of the fuzzy inference rule, and the learning rate and discount factor of reinforcement learning based on the statistical results.

4. The root cause analysis method for multi-event alarms in factory security according to claim 1, characterized in that: The process involves constructing a sensor-related topology network based on the factory layout, combining spatiotemporal constraints with an improved temporal clustering algorithm to simplify alarm data and eliminate instantaneous false alarms, including: Collect basic sensor information and factory space information. The basic sensor information includes the installation location, monitoring range, function type, communication address and device number of each security sensor. The factory space information includes the factory physical zoning, wall layout and equipment distribution. Establish a basic sensor information database. Sensors that are within a set spatial distance, have overlapping monitoring areas, or have complementary functions are grouped into the same associated group to ensure that each group of sensors can verify abnormal events in the same area from multiple dimensions. A graph structure model is adopted, with sensors as nodes. The node attributes include sensor type, location and associated group identifier. The relationships between sensors are used as edges. The weight of the edges is calculated by combining spatial distance correlation degree and functional complementarity degree, forming a weighted undirected graph. In the time dimension, a reasonable time window is defined based on the statistical analysis of historical alarm data in the factory. In the spatial dimension, constraints are set for at least two or more sensors to trigger alarms within the same associated group and for alarm types to match common anomaly types in the area. Preliminary valid alarms are determined, and alarms triggered by isolated sensors are marked as suspicious alarms. Extract the alarm event's trigger time, sensor identifier, associated group number, alarm type, and alarm intensity characteristics, remove duplicate records and data with format errors, and form a standardized alarm feature dataset; Based on the DBSCAN algorithm, the edge weights of the sensor association topology network are incorporated into the distance metric formula to construct a comprehensive distance index that combines time difference and spatial correlation, replacing the traditional Euclidean distance. At the same time, an alarm intensity threshold is introduced to filter low-intensity instantaneous alarms before clustering. Using a standardized alarm feature dataset as input, clustering parameters are set to aggregate alarm events within the same time window, the same association group, and with a comprehensive distance less than a threshold into clusters. Each cluster represents a set of related alarms that may be caused by the same root cause. Analyze the characteristics of each cluster, and determine the clusters with alarm durations below the set threshold, involving only 1 sensor, or with total alarm intensities below the minimum threshold as instantaneous false alarm clusters and remove them, while retaining the valid alarm clusters that meet the requirements of duration, number of sensors, and alarm intensity. Merge alarm clusters with overlapping time windows, highly overlapping sensors, and the same alarm type, extract the start time, involved sensors, alarm type, and intensity peak information of each valid event cluster, and generate a simplified list of valid alarm events; Regularly collect information on factory layout changes and sensor operating status data, update the node and edge weights of the sensor-related topology network, and optimize the time window length of spatiotemporal constraints, the comprehensive distance threshold of the clustering algorithm, and the cluster selection threshold based on the historical alarm processing results reviewed by manual verification.

5. The root cause analysis method for multi-event alarms in factory security according to claim 1, characterized in that: The design of differentiated recognition logic for three types of scenarios—perimeter, workshop, and video—accurately filters non-security trigger sources through models and algorithms, including: By constructing a target dataset, improving a lightweight detection model, introducing a trajectory fitting algorithm, and establishing a dynamic threshold library, the system can accurately distinguish and filter alarms for safe targets such as people / vehicles and non-safe triggering sources such as birds / debris in the perimeter area. A dataset is built based on multi-dimensional sensor and process data. Through multi-sensor feature fusion modeling, dynamic threshold adjustment and cross-validation mechanism, false alarms caused by dust / water mist are filtered out and real safety events are accurately identified. We construct a semantic segmentation dataset for industrial scene videos, improve the segmentation model and combine temporal correlation discrimination and morphological optimization to distinguish between production materials / equipment and intrusion targets, and filter out false triggers from non-security videos. By implementing scene adaptive switching, incremental learning model iteration, and dynamic update library for interference types, flexible adaptation and continuous optimization of the recognition logic for the three types of scenes can be achieved.

6. The root cause analysis method for multi-event alarms in factory security according to claim 5, characterized in that: The method involves constructing a target dataset, improving a lightweight detection model, introducing a trajectory fitting algorithm, and establishing a dynamic threshold library to accurately distinguish and filter safe targets such as people / vehicles from unsafe triggering sources such as birds / debris in the perimeter area, including: Data acquisition and annotation processing: Traversing all monitoring points around the factory perimeter, collecting historical monitoring videos and alarm logs under different time periods and weather conditions, filtering out valid segments containing birds, fallen leaves, wind-blown debris, personnel, and vehicles, labeling them with category tags according to target type, and simultaneously labeling the outline size, movement speed, trajectory features, and movement duration attributes of each type of target to form a structured annotation file, cleaning the dataset, removing invalid samples, using data augmentation techniques to expand the sample size, and dividing it into training and validation sets; A lightweight YOLO model was selected as the base model, and a biometric feature extraction branch was added after its backbone network. This branch consists of convolutional layers and max pooling layers, and adopts an activation function that is adapted to edge deployment. This branch extracts the target's contour aspect ratio, wingspan / body length ratio, and differential biometric features of the relative positions of limb joints, and outputs a feature vector. This feature vector is then concatenated and fused with the target category features and position features output by the original detection head of the base model, and input into a fully connected layer to optimize the classification results. Channel pruning and quantization techniques are used to optimize the model. The Kalman filter algorithm is introduced. Based on the target inter-frame coordinate sequence output by the improved target detection model, the state equation and observation equation of the Kalman filter are initialized, the process noise covariance and observation noise covariance are set, and the predicted position of the target at the next moment is output through the prediction and update iteration process. The deviation between the predicted position and the actual detection position is calculated, the deviation sequence of multiple consecutive frames is statistically analyzed, the trajectory pattern is analyzed, and potential safe targets and unsafe trigger sources are distinguished according to the deviation characteristics, trajectory fluctuation and motion duration. Based on the statistical analysis of the distribution range of characteristic parameters of various targets using effective samples in the validation set, the probability distribution curve of each characteristic parameter is fitted using the probability density estimation method to determine the confidence interval of the characteristics of various targets. Based on this, a dynamic judgment threshold is set. The threshold library supports real-time updates. When a new target type is added or the environment changes, causing feature drift, the threshold interval is re-statistically analyzed and adjusted based on the latest collected sample data. For targets detected by the improved target detection model, the category is first preliminarily determined by the biometric feature fusion results, then input into the trajectory fitting and discrimination module to obtain trajectory patterns and deviation features, and finally query the dynamic target feature threshold library to verify whether the target feature parameters fall within the corresponding category threshold range. The above three discrimination results are integrated by a weighted voting mechanism, and the alarm handling method is determined based on the comprehensive score. The trained and improved model is deployed to the edge and connected to the perimeter real-time monitoring video stream. The detection accuracy, false positive rate, and false negative rate of the model are tested in different scenarios. The confusion matrix is ​​used to analyze the model's ability to distinguish various targets. For easily confused categories, corresponding samples are added and the model is retrained. The parameters of the biometric extraction branch are optimized, and the relevant parameters of the Kalman filter are adjusted to reduce false positives caused by target occlusion and rapid movement. The accuracy of alarm filtering is statistically analyzed based on actual operating data. When the accuracy does not reach the set standard, incremental training of the model is triggered to update the dynamic target feature threshold library and model parameters.

7. The root cause analysis method for multi-event alarms in factory security according to claim 5, characterized in that: The dataset, constructed based on multi-dimensional sensor and process data, filters false alarms caused by dust / water mist through multi-sensor feature fusion modeling, dynamic threshold adjustment, and cross-validation mechanisms, accurately identifying real safety events, including: Real-time data from various sensors in the workshop, production process parameters, and historical alarm records are collected, covering diverse scenarios. Samples are labeled with four categories, and sensor responses and timings, as well as process-related states, are recorded to form a structured dataset. After anomaly removal and missing value processing, the dataset is divided into training and test sets. Feature extraction rules were designed for different sensor data types and process parameters. The response features of smoke sensors, temperature sensors, and dust concentration sensors, as well as the state features of process parameters, were extracted respectively. All extracted features were standardized and dimensionality was reduced using principal component analysis algorithm. A feature-level fusion strategy is adopted to combine the dimensionality-reduced sensor features with the process features to form a unified high-dimensional feature input vector. An integrated learning model of logistic regression and random forest is constructed. The logistic regression model learns the linear correlation between features, and the random forest model captures the nonlinear interaction between features. The model is trained with training set data, the model hyperparameters are optimized, and the model performance is verified with test set to achieve accurate classification of scene categories. Based on the interference scenario data in the training set, the correlation between dust concentration, humidity and smoke detector false alarm probability is analyzed, a mapping relationship model among the three is established, dust concentration and humidity data in the workshop are collected in real time, and the smoke detector false alarm risk coefficient in the current environment is calculated by substituting them into the mapping relationship model. The smoke detector alarm threshold is dynamically adjusted according to the false alarm risk coefficient, and the threshold is positively correlated with the intensity of environmental interference. An upper limit for threshold adjustment is set. Establish sensor association verification rules. When a smoke sensor triggers an alarm, the associated sensor data verification process is triggered simultaneously to verify whether the temperature data change trend and dust concentration meet the characteristics of the corresponding scenario and the operating status of the dust-generating process. Set verification judgment conditions: when at least two types of associated sensor data meet the characteristics of a real safety event and the process parameters have no obvious interference causes, it is judged as a valid alarm. When only the smoke sensor alarms and the data of other associated sensors are normal, and the process is in a dust / water mist generation process, it is judged as environmental interference and automatically filtered. When a single sensor has a strong signal alarm and the data of other sensors are critical, it is marked as a suspicious alarm and a manual confirmation process is triggered. The model is deployed to edge computing nodes in the workshop, and accesses sensor and process data streams in real time. It outputs scene classification results and alarm judgment conclusions, collects actual operation data and manual review results regularly, builds an incremental learning dataset, updates the parameters of the ensemble learning model using an online incremental learning algorithm, supplements new interference scene samples and optimizes feature weight allocation, refits the dynamic threshold mapping relationship model regularly, adjusts the mapping parameters, and establishes a model performance monitoring mechanism. When the false negative rate of real safety events or the false judgment rate of interference scenes reaches the set standard, the full data retraining process is automatically triggered.

8. The root cause analysis method for multi-event alarms in factory security according to claim 5, characterized in that: The process involves constructing an industrial scene video semantic segmentation dataset, improving the segmentation model, and combining temporal correlation discrimination and morphological optimization to distinguish between production materials / equipment and intrusion targets, and filtering out false triggers from non-security videos. This includes: Video data from different time periods and operating conditions in the factory area were collected, covering multiple targets and scenes. Video frames were labeled at the pixel level according to five categories of tags. After data cleaning and enhancement processing, the data was divided into training set, validation set and test set to form a structured semantic segmentation dataset. Based on the U-Net model framework, CBAM is introduced in the encoder to enhance category feature extraction and suppress background category feature interference. In the decoder, transposed convolution and bilinear interpolation are combined to optimize the upsampling structure and improve the segmentation accuracy of small targets. The weighted sum of Dice loss function and cross-entropy loss function is selected as the model loss function. Depthwise separable convolution is used to replace some ordinary convolution. The model is optimized by combining model pruning and quantization techniques to adapt to the real-time processing requirements of edge devices. Morphological filtering is performed on the pixel-level segmentation results output by the improved semantic segmentation model. First, erosion is used to remove small noise points, and then dilation is used to fill the holes and breaks in the target region. The bounding rectangle and area of ​​the segmented target region are calculated, a minimum threshold for the target area is set, and mis-segmented regions with areas smaller than the threshold are filtered out, while the effective regions are retained. After morphological optimization of the segmentation results of continuous video frames, the inter-frame difference algorithm is used to calculate the pixel change of the target region between adjacent frames, extract the target motion information, distinguish between dynamic and static targets, fit the motion trajectory based on the inter-frame coordinate sequence of dynamic targets, analyze the continuity and integrity of the trajectory, distinguish between continuously moving targets and instantaneous interference targets, associate the area permission information, determine whether the dynamic target has entered the unauthorized area and record the dwell time. The system combines segmentation categories, morphological features, temporal trajectories, and area permissions for judgment. When the target category is an external intrusion target, is dynamic, has a continuous trajectory, enters an unauthorized area, and stays for a specified period, it is determined to be a valid alarm. When the target category is production materials, equipment body, or is dynamic but has a discontinuous trajectory and is in an authorized area, it is determined to be a non-safety trigger source and is automatically filtered. When the target category is ambiguous, the trajectory is critically continuous, or the target is active at the area boundary, it is marked as a suspicious alarm and a manual review process is triggered. The improved semantic segmentation model, morphological processing module, and time-series correlation discrimination module are deployed to edge computing devices. The system receives and outputs results from industrial scene video streams in real time, collects actual operation data and manual review results regularly, constructs an incremental learning dataset, updates model parameters using online incremental learning algorithms, supplements new interference samples and scene change samples, optimizes relevant model modules and parameters, establishes a model performance monitoring mechanism, and calculates false positive rate, false negative rate, and segmentation accuracy in real time. When the indicators exceed the set threshold, the system triggers a full retraining process for the model.

9. The root cause analysis method for multi-event alarms in factory security according to claim 1, characterized in that: The knowledge graph, based on multi-dimensional nodes and association rules, combined with real-time operating data and causal reasoning algorithms, outputs high-confidence root causes and visual verification chains, including: By analyzing the entire factory production process, six types of nodes are defined. Four types of association rules are extracted from multi-source data and their effectiveness is ensured through algorithm mining and manual correction. Structured and unstructured data are integrated and transformed into graph nodes and association edges through entity recognition and relationship extraction technologies, forming an initial multi-dimensional knowledge graph. A graph database is used to store the knowledge graph and define node and edge attributes. New information is collected and nodes and relationships are incrementally supplemented through an update mechanism. Rules are periodically verified and corrected to ensure that the graph is synchronized with the production scenario. A collection gateway compatible with multiple transmission methods is deployed to access multiple types of real-time data and align them in time. After anomaly removal, standardization, completion, and resampling preprocessing, a structured real-time working condition data matrix is ​​output. Based on the causal structure of knowledge graphs, a causal reasoning framework integrating rule-based reasoning and probabilistic reasoning is constructed. The rule-based reasoning module filters potential factors related to real-time abnormal data according to graph association rules, while the probabilistic reasoning module adopts a Bayesian network model, mapping graph nodes to network variables and edge attributes as conditional probabilities between variables. Combined with causal inference methods, false associations are eliminated and causal strength is quantified. Abnormal phenomena and root cause pairing data in historical failure cases are used as training sets to optimize the Bayesian network conditional probability table and rule-based reasoning trigger threshold. Set inference trigger conditions. When a sensor anomaly, process parameter exceeding the standard, or safety event alarm is detected, extract the abnormal features and input them into the causal inference model. The model traverses and associates potential paths based on the knowledge graph, filters candidate causal chains through rule inference, calculates the causal confidence of each candidate chain through probabilistic inference, eliminates low-confidence candidate chains, and traces the starting point of the high-confidence causal path as the root cause of the anomaly. A multi-dimensional evaluation index system is constructed based on the scope of influence, frequency of occurrence, and cost of resolution of root causes. The weight of each index is determined by the analytic hierarchy process. The comprehensive score of root causes is calculated by combining the confidence of causal inference. The top-N high-confidence root causes are output according to the scores and the root cause information is labeled. Extract the causal path corresponding to the high-confidence root cause and visualize the verification chain in the form of a graph. Different colors are used to distinguish the node type and the thickness of the edges represents the association confidence. Real-time working condition data, historical matching cases, association rule basis, and inference process log evidence are associated in the verification chain. Interactive operations such as viewing node details, expanding / collapsed association path, and filtering confidence interval are supported. Collect root cause verification feedback data, including manual review results and solution implementation effects. Adjust causal inference model parameters based on feedback data, optimize Bayesian network conditional probability table and rule inference threshold, update knowledge graph edge attributes, improve confidence of effective association rules, eliminate or correct erroneous association rules, add new root cause nodes and association relationships, and perform full-process optimization at a fixed frequency.

10. A multi-event alarm root cause analysis system for factory security, characterized in that, include: processor; A machine-readable storage medium for storing machine-executable instructions of the processor; The processor is configured to execute the factory security multi-event alarm root cause analysis method according to any one of claims 1 to 9 by executing the machine-executable instructions.

Images