513 results about "Baseline model" patented technology

The invention relates to the technical field of line arc abnormity monitoring, in particular to a data center operation and maintenance service environment monitoring system which comprises a multi-mode sensing unit, a dynamic baseline modeling unit, a transition state abnormity extraction unit and a grading early warning unit. The dynamic baseline modeling unit builds a three-layer safety baseline model, the base layer builds harmonic references in a segmented mode according to the load rate, the environment layer generates voiceprint feature template libraries of different temperature and humidity intervals, the time layer fits a 24-hour change trend envelope line, and the transition state anomaly extraction unit separates and decouples an arc voiceprint feature frequency band through a blind source and calculates the energy ratio. The harmonic abrupt change phase deviation amplitude is analyzed in combination with window sliding correlation, the abnormal evolution index is generated through fusion, the graded early warning unit triggers response according to the index, transition state abnormity is accurately recognized, the perspectiveness and reliability of operation and maintenance early warning are improved, and the method is suitable for safe operation and maintenance of data center equipment.

The invention relates to the technical field of network security and data protection, and discloses a data leakage prevention method and system based on user behavior perception, and the method comprises the steps: obtaining historical operation data, and constructing a personalized behavior reference library; monitoring a current access behavior in real time by sliding a time window, calculating a deviation degree and triggering anomaly detection; performing multi-level feature analysis on the abnormal behavior and calculating a comprehensive abnormal score; dynamically adjusting the access authority according to the score, recording an abnormal behavior and carrying out relevance matching; optimizing the reference model through feedback learning; and evaluating the credibility and the risk level based on an accurate modeling result, and adaptively adjusting permission configuration. According to the method, the user behavior rule can be accurately captured, the data leakage risk can be efficiently identified, the access permission can be dynamically adjusted, the false alarm rate can be reduced, adaptive protection can be realized, and data security and business smoothness can be guaranteed.

The invention provides a patient vital sign anomaly detection method based on an artificial intelligence technology, and relates to the technical field of data processing, and the method comprises the steps: collecting original sign data of a patient; calculating multi-dimensional characteristic parameters; establishing an individual baseline model, and determining a comprehensive reference interval in the model; the vital sign features monitored in real time are constructed into multi-dimensional feature vectors, the multi-dimensional feature vectors are input into the individual baseline model, and the deviation degree of the real-time multi-dimensional feature vectors in the comprehensive reference interval is calculated; performing a clustering analysis to identify an anomalous aggregation region; performing trend analysis, calculating change direction consistency and continuous change amplitude of the multi-dimensional feature vector, and generating a trend analysis result; calculating an accumulated change index in a continuous time window according to a trend analysis result to obtain a dynamic confidence score; when the dynamic confidence score continuously exceeds an adaptive threshold value, determining that a vital sign abnormal event exists; the autonomy and accuracy of the method for detecting the vital sign abnormity of the patient are improved.

The invention provides a leasing equipment full life cycle monitoring method and system based on the Internet of Things, and belongs to the technical field of equipment operation and maintenance monitoring, and the method comprises the steps: obtaining real-time state data of leasing equipment in an operation process through a multi-source sensor; performing feature extraction on the real-time state data to obtain various feature vectors, and constructing a multi-dimensional feature vector set; inputting the multi-dimensional feature vector set into a random forest model, and judging whether the leasing equipment is in an abnormal state or not in combination with a space-time clustering algorithm; if yes, fault prediction is carried out on the leasing equipment in combination with an abnormal detection result, historical operation data and a baseline model, and a fault probability value of the leasing equipment is obtained; the future position of the leasing equipment is predicted based on the position data, an electronic fence boundary is set for the leasing equipment, if the future position exceeds the electronic fence boundary, an early warning notification of trajectory deviation is generated, and the system finally realizes trajectory and fault visual presentation in a thermodynamic diagram mode, so that the equipment operation and maintenance intelligence and management precision are improved.

The invention discloses an urban occupational health risk real-time supervision method and system based on data analysis, and the method comprises the steps: continuously collecting the behavior data flow of a target employee and the physical environment dynamic data flow of an associated working region, and generating an individual-environment dynamic data sequence; detecting a behavior abnormal signal based on the historical behavior mode of the target employee; in combination with the physical environment dynamic data flow at the current moment, the association strength between the physical environment dynamic data flow and the occupational health risk is evaluated, and a personalized micro-intervention instruction is generated and triggered; capturing the instant feedback response of the employee to the micro-intervention instruction in real time, updating the personal behavior baseline model of the target employee in real time, and calibrating the evaluation rule of the association strength; and dynamically generating a real-time occupational health risk portrait of the employee based on the individual behavior baseline model, the association strength evaluation rule and the individual-environment dynamic data sequence. According to the embodiment of the invention, accurate early warning and personalized intervention of occupational health risks can be realized.

The invention relates to the technical field of heat transmission, in particular to a heat transmission data storage and management system based on an industrial big data platform, and the system comprises a self-adaptive acoustic baseline modeling module which generates a self-adaptive baseline model library for storing the mapping relation between a working condition area and a model; the abnormal deviation degree calculation module is used for calculating and generating an abnormal deviation degree; the health state evaluation module is used for generating a comprehensive health index representing the long-term service performance of the pipe network; and the closed-loop correction and scheduling module is used for determining a comprehensive risk level according to the comprehensive health index and the change trend thereof, generating an operation and maintenance scheduling instruction for dynamically adjusting an abnormal deviation degree calculation process and pipe network operation parameters, and realizing closed-loop feedback control. According to the invention, accurate identification and positioning of abnormal events such as leakage, third-party damage and the like are realized.

The invention discloses a building equipment maintenance demand linkage detection and evaluation system and method, and relates to the technical field of intelligent operation and maintenance of building equipment, and the system comprises an isomorphic equipment cluster division module, a group data flow collection module, a group behavior baseline learning module, an individual deviation degree calculation module, and a maintenance decision generation module. Equipment with consistent function attributes and operation environments is classified into the same cluster, data are classified according to different working conditions on the basis of historical operation data provided by a group data flow acquisition module, group average operation parameters, parameter fluctuation ranges and probability distribution characteristics under each working condition are calculated, a dynamic group behavior baseline model is generated, and the dynamic group behavior baseline model is established. With the continuous updating of new data, the normal behavior mode change of the equipment under different working conditions can be reflected in real time, and when the individual deviation degree calculation module calculates the individual equipment deviation degree according to the model, the accuracy and timeliness of the calculation result can be ensured.

The invention relates to the technical field of multi-modal behavior anomaly detection scheme design, in particular to a multi-modal behavior anomaly detection method and system under the condition that encrypted traffic is not decrypted. The method comprises the following steps: capturing a network encrypted traffic data packet in real time; on the premise that decryption is not carried out, multi-mode non-decryption features such as flow layer statistics, time sequence interaction, encryption handshake and context association are extracted in parallel; establishing a dynamic normal behavior baseline model of each feature based on historical data; the real-time features are compared with the baseline model, comprehensive judgment is carried out through a multi-mode correlation analysis algorithm, and an anomaly detection result is output; and when the abnormal condition is judged, the network control equipment is automatically linked for blocking. The method thoroughly gets rid of dependence on traffic decryption, realizes high-precision and self-adaptive detection and rapid automatic response to abnormal behaviors in encrypted traffic through multi-dimensional feature fusion and dynamic baseline technologies, and effectively solves the problem of failure of a traditional detection technology in an encrypted environment.

The invention belongs to the technical field of image processing, and particularly relates to a graphite ore grade detection method based on an improved YOLO11 model, C3k2-CAS and Detect-SEAM modules are introduced, the feature extraction capability is enhanced, the expression of different scales of ore textures is optimized, and the perception capability of the model for grade difference is improved, so that the detection precision is remarkably improved; the attention mechanism of the CAS module is adopted to replace the traditional multiplication operation, the calculation complexity and the model parameter quantity are greatly reduced while the detection performance is maintained, and the improved model is more efficient than a baseline model and is more suitable for edge device deployment; a plurality of data enhancement strategies are combined, so that the model can maintain high robustness and stable detection capability in a complex industrial environment; the trained optimization model can be efficiently deployed to graphite ore grade detection intelligent equipment, real-time and accurate industrial field detection is achieved, the mineral separation efficiency is greatly improved, and an efficient and reliable computer vision solution is provided for the intelligent mining industry.

The invention discloses an oil and gas storage and transportation oil leakage detection system based on multi-source data analysis, and relates to the technical field of oil leakage detection. An original sensing data set is constructed, the original sensing data set is preprocessed, an alignment data set is generated, a pipeline digital twin baseline model in a leakage-free state is established, and a baseline feature set is generated; according to the method, micro-disturbance active detection and dynamic compliance inversion are implemented, an active feature set is generated, the diffusion trend of potential leakage liquid and an earth surface exposure time window are predicted, earth surface evidence features are generated, multi-modal features are fused, and a leakage event and a response scheme are output. A diffusion closed loop from the underground to the earth surface is realized through multiphase seepage and remote sensing verification, the detection precision is improved by utilizing adaptive fusion and dynamic threshold control, self-learning updating is realized through model recharge, and the method has the advantages of high real-time performance, strong anti-interference and adaptive optimization.

The invention relates to the technical field of big data security analysis and network information security, in particular to a communication data intelligent security supervision system based on big data, which comprises a data acquisition module used for extracting standardized entity behavior feature vectors from multi-source heterogeneous communication data; the baseline modeling module is used for dynamically generating a multi-dimensional behavior baseline portrait based on the historical sequence of the entity behavior feature vectors; the anomaly detection module is used for comparing the real-time entity behavior feature vector with the multi-dimensional behavior baseline portrait so as to calculate a micro anomaly score; the atlas construction module is used for screening the micro-anomaly events according to whether the micro-anomaly score exceeds a preset threshold value or not, and quantifying association confidence among the screened events so as to construct an attack chain atlas; the risk quantification module is used for aggregating the characteristics of the attack chain atlas to determine a systematic risk score; according to the method, the discovery capability and response efficiency of complex attacks such as advanced persistent threats and the like are greatly improved.

The invention relates to the technical field of information flow intelligent recommendation, and discloses a real-time interactive feedback information flow content adaptive optimization method and system.The real-time interactive feedback information flow content adaptive optimization method comprises the steps that user interaction data are collected and subjected to robust preprocessing to obtain standardized interaction feature vectors; constructing a user personalized interaction baseline model to obtain a multi-level behavior reference basis, identifying a real-time interest signal of a user and updating an interest state, dynamically adjusting a recall strategy and executing multi-path recall to obtain a candidate content set, adaptively adjusting a sorting feature weight and executing sorting, and dynamically controlling diversity to execute rearrangement to obtain a final recommendation list, and meanwhile, obtaining an interest prediction score in a sorting stage by adopting a hierarchical reasoning architecture and a model distillation technology. The interest change of the user can be captured in real time, the matching degree of the recommended content and the instant interest of the user is improved, and the user experience and the recommendation effect are improved.

The invention relates to the field of electric power monitoring, in particular to an electric power monitoring system intrusion detection method and system based on flow analysis. The method comprises the following steps: collecting network traffic, analyzing and recombining to obtain structured session data; time sequence behavior features and function code distribution features are extracted to construct a multi-dimensional feature set; inputting the feature set into a compliance rule base and a behavior baseline model in parallel, and respectively outputting a rule matching result and an abnormal deviation degree score; generating a comprehensive threat index by adopting a weighted decision fusion strategy; and when the index exceeds a dynamic threshold value, intrusion is determined and an alarm is given. According to the invention, the problem of insufficient precision and adaptability caused by single feature dimension and isolated detection mechanism is solved.

The invention discloses a catalyst process design and optimization method and device, and belongs to the field of machine learning. The method comprises the steps of obtaining original process data in a catalyst production process, performing data cleaning and feature engineering processing, and generating a preprocessing data set capable of being used for modeling; screening a plurality of candidate machine learning models by using an AutoML technology, and performing hyper-parameter optimization on the baseline model; an incremental learning technology is adopted to update the optimized model online in real time so as to adapt to data fluctuation in the production process; and finally, the online updated model is applied to quality prediction and process parameter adjustment, so that closed-loop optimization of the production process is realized, and the product consistency and the production efficiency are improved. According to the method, the automation level and the intelligent quality control capability in catalyst production can be effectively improved.

The invention provides a BIM-based 3D building digital monitoring method and system, and belongs to the technical field of building engineering monitoring, and the method comprises the steps: carrying out the digital conversion and processing of a building design drawing of a target building, extracting the geometric and attribute information of the target building, and generating a standard BIM model; verifying and calibrating the basic multi-dimensional data and the standard BIM model when the target building is completed, and generating a reference BIM model; performing spatial registration and association mapping on the acquired multi-dimensional monitoring data and the reference BIM model to generate an association data set; comparing based on the associated data set to generate a comparison result; obtaining a potential risk type and a risk evolution trend of the target building through a risk prediction model based on a comparison result, historical monitoring data and a component static attribute in the reference BIM model; and generating a target monitoring strategy based on the potential risk type and the risk evolution trend. The building operation and maintenance efficiency is improved, and the service life of the building is prolonged.

The invention discloses a data security risk analysis method and device, equipment and a storage medium, and the method comprises the steps: obtaining data access behavior information of a business system, the data access behavior information comprising business attributes; establishing a dynamic detection rule set based on the service attributes, wherein the dynamic detection rule set comprises risk judgment thresholds associated with the service attributes; constructing a service behavior baseline model associated with the service attributes according to the user historical behavior data; and performing association analysis on the data access behavior information, the dynamic detection rule set and the business behavior baseline model to obtain risk early warning information. According to the invention, the business behavior baseline model associated with the business attribute is constructed according to the historical behavior data of the user; the data access behavior information, the dynamic detection rule set and the business behavior baseline model are subjected to correlation analysis, the risk early warning information is obtained, compared with the prior art, the accuracy of data security risk detection is improved, and then the risk early warning false alarm rate is reduced.

The invention discloses a data center dynamic air-conditioning load rapid calculation method, which comprises the following steps of: 1, summarizing data center cold load influence factors as an input condition of a calculation model; 2, constructing a standardized data center reference model based on building energy consumption simulation software; 3, based on the building geometrical characteristics and thermal performance of the target data center, correcting the enclosing structure load of the reference model by adopting an area correction method, and constructing an enclosing structure load rapid calculation model; 4, automatically resetting an internal heat source load calculation result, and constructing an internal heat source load rapid calculation model; 5, correcting the fresh air load of the reference model by adopting a volume correction method based on the geometric characteristics of the target data center building, and constructing a fresh air load rapid calculation model; and step 6, forming a target data center dynamic air-conditioning load rapid calculation method, and obtaining a hourly cooling load prediction result required for covering the whole year or a design stage.

The invention relates to the technical field of elevator safety monitoring, and discloses an elevator guide rail abrasion online monitoring and deep learning early warning system. The system comprises an active excitation multi-mode sensing end and a causal inference residual network analysis engine, and the analysis engine compares multi-physical field response data collected in real time with a theoretical health response signal under a current working condition based on a health response baseline model trained under a health state; the method comprises the steps that firstly, a multi-dimensional residual signal capable of separating working condition interference is generated, then, a system executes online self-calibration of a cross-modal sensor through physical constraints contained in a model, the effectiveness of the signal is judged, finally, the effective residual signal is input into a causal inference network, and the specific reason of guide rail abrasion is recognized and traced. The technical problem that the monitoring result is unreliable due to working condition interference, unknown abrasion reasons and sensor faults is solved, and high-precision, traceable and high-reliability online monitoring and early warning of elevator guide rail abrasion are achieved.

The invention discloses a financial behavior anomaly detection system based on big data, and relates to the field of financial behavior anomaly detection. Multi-source data such as customer transaction, account operation and basic information are collected and formats are unified; processing numeric data by using an isolated forest, extracting text features by using TF-IDF, and constructing a composite feature vector; constructing a customer behavior baseline model based on an LSTM network, and dynamically updating and triggering early warning; carrying out anomaly detection by combining ensemble learning and a graph neural network; and triggering a multi-level response mechanism according to the abnormal confidence coefficient, and feeding back an optimization model. According to the invention, multi-source data and an advanced algorithm are fused, a dynamic behavior baseline is constructed, millisecond-level anomaly detection is realized, complex abnormal behaviors are accurately identified, and the rate of missing report and false report is reduced; federal learning is adopted to guarantee data security, systematic risks are predicted and prevented through risk propagation, the response efficiency is improved through automatic grading disposal, and fund security is comprehensively guaranteed.

The invention relates to the technical field of power system equipment state monitoring and fault diagnosis, in particular to a GIS basin-type insulator operation state evaluation method and system, and the system comprises an asset information and baseline modeling module which is used for building a high-fidelity multi-physics field finite element reference model and generating a defect state-external representation mapping data set; the physical information driven agent model generation module is used for constructing a neural network agent model fusing physical law constraints; the real-time data acquisition and feature extraction module is used for acquiring and processing online monitoring data such as UHF, gas, temperature and vibration; the state inversion and digital twinning calibration module is used for inverting internal defect parameters by adopting a Bayesian inference and MCMC method so as to realize real-time calibration of the model; and the evaluation diagnosis and life prediction module carries out fault mode identification and residual life prediction based on the calibration model.

The invention discloses a pumped storage power station model construction method based on digital twinning, relates to the technical field of power system modeling and intelligent control, and is used for solving the problem of low modeling precision of a unit operation state. According to the method, uniform space-time criterion and asset semantic graph driven twinborn observation frames are constructed, consistent mapping of multi-source heterogeneous data and a pumped storage unit structure is established, fine modeling of a working condition state and a safety boundary is realized, on the basis, an online assimilation mechanism and a sub-scene baseline model set are fused, and the working condition state and safety boundary of the pumped storage unit are improved. Continuous self-correction of hydraulic, electromechanical and control parameters under disturbance of different working conditions is achieved, then a time delay budget-driven hierarchical assembly mechanism is introduced, a high-fidelity model and a data-driven model are dynamically called according to scenes, the prediction precision and response efficiency are improved, the out-of-limit risk is avoided through linkage of uncertainty labeling and a conservative mode, and the reliability of the system is improved. And closed-loop iterative updating is formed based on simulation verification and gray rollback, so that synchronous improvement of model credibility, strategy robustness and power station operation economy is realized.

The invention provides an RV reducer online fault diagnosis method, and belongs to the technical field of reducer fault diagnosis based on computer data processing. The method comprises the following steps: firstly, constructing a fault data set covering multi-modal signals and multiple working conditions, and integrating vibration, current and high-frequency elastic stress wave data; performing segmentation, time-frequency conversion and multi-modal feature fusion on the original time series data to generate a three-channel time-frequency feature map, and strengthening visual expression of fault features; then constructing a domain adversarial attention neural network, and realizing cross-working-condition fault feature migration and accurate classification through adversarial training of a feature extractor, a fault classifier and a domain classifier; and finally, deploying an online diagnosis model, generating a health indicator in combination with the health state baseline model, predicting the remaining service life through a long short-term memory network, and completing fault early warning and life evaluation. According to the method, accurate fault identification and residual service life prediction under complex working conditions are realized, and reliable technical support is provided for the RV speed reducer.

The invention relates to the technical field of payment security, and particularly discloses a security payment system and method based on biological recognition. The method is characterized by comprising the following steps: synchronously acquiring fingerprint, finger vein and pressure behavior characteristics through a coaxial integrated sensor; a dynamic encryption engine is adopted to bind the biological characteristics with the transaction parameters to generate a one-time payment token; living body verification is realized based on physiological synchronism of vein pulsation and pressure fluctuation; and establishing a user pressing behavior baseline model to identify abnormal operation. The terminal equipment is provided with a sapphire microlens array and a dynamic pressure-sensitive array. The problems of biological feature forgery, replay attack and living body cheating are solved, the forgery detection rate reaches 99.6%, and the false identification rate is smaller than or equal to 0.0001%.

The invention relates to the technical field of intelligent control, particularly discloses an air conditioner energy consumption real-time optimization method based on environment perception, and aims to solve the problems that an existing air conditioner energy consumption model is insufficient in real-time control precision and delayed in instantaneous disturbance response in a dynamic environment. The method is characterized in that a double-model prediction control framework is adopted and comprises a physical-empirical hybrid baseline model for macroscopic trend prediction and a real-time deviation correction model for microscopic instantaneous deviation correction, and the physical-empirical hybrid baseline model and the real-time deviation correction model are coupled through a model parameter self-correction unit to form a closed-loop control loop with adaptive learning ability. By the adoption of the technical scheme, the energy consumption of the air conditioning system can be remarkably reduced, meanwhile, the stability and comfort of the indoor environment are improved, and high precision and high timeliness of a control strategy are ensured.

The invention discloses a construction progress real-time early warning system and method based on deep learning, and relates to the technical field of intelligent monitoring. Multi-modal video data streams of a construction site are collected, and a pre-trained multi-modal large model is utilized to carry out zero sample identification on video clips; analyzing the construction activity labels and the timestamps in combination with a universal prompt word bank preset in a construction stage, and constructing a real-time task sequence; accumulating historical task sequence features based on a self-supervised learning mechanism, and establishing a baseline model of a dynamic construction rhythm to generate a prediction task plan; through dynamic alignment analysis of a real-time task sequence and a prediction plan, a task density deviation value is calculated, and a multi-stage early warning signal is triggered; and finally, automatically generating a structured report. According to the technology, all-weather non-inductive monitoring and intelligent decision support of the abnormal construction progress are achieved, and the supervision response speed and decision reliability in a complex construction scene are remarkably improved.

The invention relates to an artificial intelligence technology, in particular to a task adaptive parameter adjusting method and system for a weather and climate basic model. The adjusting method comprises the steps that a weather and climate basic model is initialized, the weather and climate basic model comprises an encoder, a main body network and a decoder, and the main body network comprises a parameter efficient fine adjustment framework model provided with a task self-adaptive dynamic prompt module and a random snow-consuming guided self-adaptive selection module which work cooperatively; performing task self-adaptive dynamic prompt through a task self-adaptive dynamic prompt module, generating soft prompt lexical elements, and fusing the input weather data with the soft prompt lexical elements to obtain an enhanced lexical element sequence; and through a random snow-consuming guided adaptive selection module, random snow-consuming guided adaptive selection is carried out, and parameter fine tuning of the weather and climate basic model is realized. Model parameters can be dynamically, selectively and finely adjusted according to downstream tasks, a very small number of trainable parameters are used, and the calculation and storage cost is remarkably reduced.

The invention discloses an industrial network fault intelligent diagnosis method and system based on multi-source data, and the method comprises the steps: synchronously collecting data from a plurality of data sources of an industrial network, and extracting a time sequence statistical feature, a flow entropy feature and a protocol conformity feature to form a multi-dimensional feature vector; establishing a dynamic baseline model by adopting a sliding window online learning method, and calculating a comprehensive anomaly score for anomaly detection; the fault suspicion degree is calculated based on the equipment incidence matrix and the fault propagation model to realize fault source positioning; carrying out fault type identification and root cause analysis by adopting Bayesian reasoning and a knowledge rule base; and outputting a structured diagnosis report containing the fault source, the type, the root cause and the disposal suggestion. According to the invention, early warning, accurate positioning and intelligent diagnosis of industrial network faults are realized, and the operation and maintenance efficiency, safety and reliability of the industrial control network are significantly improved.

The invention discloses an abnormal operation behavior detection method, system and device applied to power network data security and protection and a medium, and belongs to the technical field of power network data security and protection, and the method comprises the steps: collecting multi-source heterogeneous data in a power network operation process; constructing a dynamic baseline model for representing normal behavior characteristics of the power system in different time periods, and periodically updating model parameters based on a distributed training mode; performing normalization processing on the multi-source heterogeneous data, constructing a heterogeneous graph structure representing the relationship between equipment nodes and communication, and extracting association feature representation between equipment through a graph neural network model; inputting the current multi-source heterogeneous data into the dynamic baseline model, and determining whether the current operation behavior is abnormal in combination with model output and a set adaptive threshold judgment rule; and executing a security defense response operation related to the current behavior. According to the method, the feature weight is optimized through federal learning and meta learning, and the problem that a traditional static baseline cannot adapt to the dynamic load of the power network is solved.

The invention relates to the technical field of adaptive control systems, in particular to a sofa posture adaptive adjustment system based on multi-modal sensing fusion, which comprises a baseline modeling module, a monitoring diagnosis module and an intervention decision module. According to the invention, a personalized dynamic characteristic parameter baseline is established for a user through the baseline modeling module, and unconscious attitude deviation and conscious task-oriented actions are accurately distinguished by a micro intention recognition program unit in the monitoring and diagnosis module; and the intervention decision-making module starts adaptive deviation suppression adjustment only when the former is identified. According to the invention, the technical problem that the existing control system cannot distinguish the state change reasons to cause frequent false triggering of the adjusting action is solved, and personalized and intelligent closed-loop control under the condition of avoiding invalid interference is realized.

The invention relates to the technical field of network security threat detection and attack traceability, and discloses an encrypted traffic behavior and protocol multi-dimensional analysis traceability method, and establishes an encrypted traffic multi-dimensional analysis traceability system. The system is internally provided with a traceability knowledge base, a multi-dimensional data source acquisition module, a multi-dimensional feature extraction module, a multi-dimensional analysis traceability module, a dynamic baseline modeling module, an adversarial training module, an intelligent association study and judgment module and a feedback optimization module, the traceability knowledge base provides knowledge support for the follow-up process, and the multi-dimensional data source acquisition module outputs standardized time sequence data; the multi-dimensional feature extraction module generates a feature vector, a traceability result of the multi-dimensional analysis traceability module, an abnormal identifier of the dynamic baseline modeling module and an adversarial sample feature of the adversarial training module jointly serve as input of the intelligent association study and judgment module, and the intelligent association study and judgment module summarizes a study and judgment report. Models and parameters of all the modules are fed back through the feedback optimization module, and a closed loop of collection, analysis, study and judgment and optimization is formed.