1014 results about "Behavioral analysis" patented technology

The invention relates to a risk management and control method and system based on real-time behavior analysis, and the method comprises the steps: carrying out the structural processing of multi-source behavior data through lightweight protocol decoding and behavior label embedding, and constructing an original behavior data set of a user and an entity; extracting multi-dimensional behavior characteristics by using a sliding window analysis and sparse representation mechanism, and constructing a user behavior graph by combining graph embedding learning; constructing a time-sensitive behavior trend model through streaming modeling and an incremental learning strategy, identifying an abnormal evolution trajectory in real time, and introducing a dynamic risk threshold regulation and control mechanism; adopting a high-throughput flow data processing and fast similarity matching algorithm to construct a fusion discrimination model, giving risk levels to abnormal behaviors and classifying the abnormal behaviors; and finally, performing closed-loop optimization in combination with a historical treatment effect. The system has the advantages of high real-time performance, high calculation efficiency, adaptability to complex network environments and the like, and the network security protection capability can be effectively improved.

The invention provides an enterprise employee behavior analysis and safety risk early warning monitoring method and system, and relates to the technical field of enterprise risk management, and the method comprises the steps: collecting employee terminal operation behavior data, building an activity thermal distribution diagram based on office area grid behavior association intensity, and training a behavior evaluation model. And inputting the behavior scoring matrix into a deep neural network to extract target behavior characteristics, calculating an abnormal behavior risk weight coefficient in combination with a department security policy, performing classification and analyzing a risk diffusion probability, and generating a risk situation index to determine an early warning level. Starting a response strategy according to the early warning level, blocking high-risk early warning in real time, tracking associated accounts, establishing a risk association map, identifying potential risk propagation nodes and performing active protection, finally generating an early warning report and feeding back effective protection rules to a behavior baseline model, and realizing continuous optimization of a risk early warning mechanism. And the accuracy and effectiveness of safety risk early warning in the enterprise are improved.

A distributed intelligent authentication method based on dynamic multi-modal fusion relates to the field of network security, and adopts an alliance chain + DAG hybrid block chain architecture, combines a threshold signature to realize secret key fragment management, and switches among PBFT, Raft and probabilistic algorithms through a dynamic consensus mechanism to improve authentication efficiency. The multi-mode authentication module is based on a dynamic weight distribution algorithm, integrates biological characteristics, behavior analysis, equipment fingerprints and environmental factors, and combines an LSTM-GAN model and a quantum random number driven challenge-response mechanism to realize zero-trust verification under environmental perception. The session management module generates a session key by using a chaotic mapping algorithm. In the aspect of privacy protection, CKKS homomorphic encryption, zero-knowledge proof and attribute-based encryption are fused. According to the method, the block chain technology, the secure multi-party computing technology, the machine learning technology and the quantum cryptography technology are fused, and a high-performance, high-security and strong-privacy-protection distributed authentication solution is provided.

The invention provides an industrial control network security service security guarantee system based on behavior analysis, which belongs to the technical field of industrial control network security, and comprises a multi-source data fusion acquisition module, a dynamic behavior modeling engine, a federal learning analysis cluster, an attack chain prediction module, a self-adaptive protection strategy executor and a model evolution feedback ring, wherein the multi-source data fusion acquisition module synchronously acquires industrial control network flow (including OPC UA / Modbus / DNP3 protocol analysis), equipment operation logs, user operation behavior fingerprints and physical interface state data, and the physical interface state data comprises electrical characteristic fluctuation monitoring of USB / network interfaces. According to the scheme, through multi-technology fusion and closed-loop design, the problems of static performance, single-dimension analysis defects and response lag of a traditional industrial control security scheme are effectively solved, a comprehensive protection system with dynamic modeling, intelligent decision making, privacy protection and continuous optimization is constructed, and the security and service reliability of an industrial control network are remarkably improved.

The invention discloses a log abnormal behavior analysis method and system based on sorting learning and an attention mechanism, and relates to the technical field of system operation and maintenance. The method comprises the following steps: performing structured analysis on original log data and constructing a log sequence; extracting a periodic component, a trend component and a residual component through periodic neural decomposition; generating a running phase label based on the service calling relation and labeling a log sequence; modeling an association structure between log events by using a multi-head attention mechanism of phase perception, and outputting an abnormal score in combination with a sorting learning strategy; fusing the periodic stability index and the abnormal score to construct a health measurement value, and executing abnormal judgment and alarm strategy control based on a joint result; a structure-limited confrontation sample mechanism and structure deviation detection are introduced in the training and reasoning process, and the robustness of the model to structure disturbance is enhanced. The method has the technical advantages of being high in periodic modeling adaptability, high in anomaly detection precision, excellent in structure defense capability and the like.

The invention relates to the technical field of computer security, and discloses a computer remote login identification device based on artificial intelligence, which comprises a user side device module used for collecting biological identification data and input behavior data of a user; the authentication and verification module is used for executing multi-mode identity authentication and dynamically adjusting an authentication strategy; the behavior analysis and risk assessment module is used for analyzing a behavior mode and a login environment of the user; the database and storage module is used for storing user identity information, behavior characteristic data and authentication logs; and the security monitoring and alarming module is used for monitoring the login activity of the user in real time and detecting potential security threats. According to the invention, the design based on multi-modal authentication greatly improves the security of remote login. By combining a plurality of authentication means such as face recognition, fingerprint recognition and voice recognition, the system can effectively prevent security vulnerabilities such as password stealing, fingerprint counterfeiting or facial image attack.

The invention provides a driving behavior analysis method and system based on multi-modal sensor fusion, and the method comprises the steps: firstly obtaining a multi-source sensor data set of a target vehicle containing at least two different sensor source driving environment perception data, and carrying out the time-space alignment processing of the multi-source sensor data set, and generating a multi-source fusion data set; then, through a feature extraction layer of a preset behavior analysis network, a driving behavior feature set containing vehicle operation, environment interaction and behavior continuity features is extracted from the multi-source fusion data set, an anomaly recognition layer is used for carrying out anomaly recognition on the driving behavior feature set, and an anomaly recognition result is generated; and finally, generating driving strategy optimization data according to an abnormal recognition result, and feeding back the driving strategy optimization data to a vehicle control system to adjust a driving strategy. According to the method, driving behaviors can be comprehensively analyzed, abnormity can be timely found, the driving strategy is optimized, and the driving safety and efficiency are improved.

The invention discloses a multi-agent collaborative reasoning system for intelligent teaching intervention, and relates to the technical field of artificial intelligence and education, and the system comprises a data collection and convergence module which collects data of learning behaviors, emotional states, academic scores and knowledge point mastering conditions of students by means of a classroom behavior analysis system, a camera, a microphone and a learning management system; according to the intelligent teaching intervention-oriented multi-agent collaborative reasoning system, the precision and individuation of teaching intervention are realized by constructing the intelligent teaching intervention-oriented multi-agent collaborative reasoning system, the system collects multi-dimensional data of students through the data acquisition and convergence module, and through the processing of the data conversion and cleaning module, the accuracy and availability of the data are ensured; the teaching strategy planning module generates a dynamic decision model by means of a large language model, a customized intervention strategy can be generated according to the learning condition and problem root of students, and the multi-agent collaborative reasoning module further improves the intelligent level of the system.

The invention relates to a model for evaluating and predicting mild cognitive impairment risk of old people in a pension institution. The model sequentially comprises a behavior analysis module, a language recognition module, a social modeling module, a toughness calculation module, a feature fusion module, a risk reasoning module and the like. Behavior deviation characteristics and abnormal time periods are extracted by collecting behavior data of daily life, diet, social contact and the like of old people and comparing the behavior data with an institution work and rest template; in combination with nursing records, extracting language anomaly features; analyzing social frequency and structure changes in the abnormal time period, and extracting social variation features; a cognitive toughness index is calculated by integrating the health archive and the recovery ability to the health event; and performing toughness weighting on the multi-dimensional features to construct a time sequence tensor, and inputting the time sequence tensor into a recursive model to predict a cognitive impairment risk value. And if the risk value suddenly changes, the system automatically backtracks the feature trajectory of nearly 7 days, constructs and screens a prediction path with the strongest interpretation force, outputs a dominant prediction result and a key factor sequence, and realizes high-interpretability and high-reliability early recognition and intervention reference.

The invention relates to the technical field of laboratory safety management. The experimenter monitoring method based on behavior analysis comprises the steps of performing human body detection and tracking on video information through an RCNN algorithm to obtain experimenter position information in a laboratory, performing face recognition verification on the experimenter information through a DLIB library to obtain experimenter identity information, and performing face recognition verification on the experimenter identity information through a DLIB library. If the identity information of the experimenter is successfully matched, carrying out behavior analysis on the experimenter in the laboratory through a behavior analysis model to obtain behavior state information, and judging whether the operation behavior of the experimenter accords with a preset laboratory safety management rule or not based on the behavior state information of the experimenter; and if the operation behavior of the experimenter does not conform to the preset laboratory safety management rule, safety early warning information is generated, and early warning levels are divided according to the safety early warning information. The method has the effect of improving the safety management of the laboratory.

The invention discloses a behavior analysis camera monitoring method and system based on deep learning, and the method comprises the following steps: S1, collecting an image sequence and environment parameters of a target object in a scene through a multi-modal sensor, the environment parameters comprising illumination intensity and background noise level; s2, performing priority division on the image sequence by using a dynamic region-of-interest weight calculation module, and generating a region-of-interest mask based on the movement track and posture change of the target object; s4, generating an abnormal behavior index according to an output result of the classifier; and S5, when the comprehensive abnormal index exceeds a preset threshold value, a cross-camera cooperative tracking mechanism is triggered, an alarm signal is generated, and meanwhile, high-risk behavior fragment marks are stored to a priority queue, and accurate perception of human body behaviors in a complex environment is realized through an innovative architecture combining multi-modal data fusion and dynamic weight adjustment.

The invention provides a classroom behavior analysis method and system, electronic equipment and a storage medium, and relates to the technical field of educational informationization, and the method comprises the steps: collecting videos and audios, carrying out image enhancement, noise filtering and frame segmentation on the videos, carrying out noise reduction, sound source positioning and voice segmentation on the audios, and generating standardized images and voice sequences; an improved MTCNN cascade network is combined with a posture estimation technology, facial key points of students are extracted from videos, class arrival states, head postures and facial micro-expressions are recognized, audios are analyzed through a bidirectional LSTM network, and speaking duration and frequency are obtained; constructing individual behavior indexes according to attendance, head actions and expressions of the students; constructing an interaction index according to the teacher and student speaking data; the individual and interaction indexes are summarized to generate the multi-dimensional classroom behavior portrait, and the relation between the portrait and the teaching effect is analyzed, so that the classroom behavior analysis precision can be improved, the data processing capability can be enhanced, and the multi-dimensional classroom behavior comprehensive evaluation can be realized.

The invention discloses an online resource adaptive recommendation method based on multi-modal learning behavior analysis, and relates to the technical field of resource recommendation. The method comprises the following steps: firstly, dynamically collecting multi-modal data by using a heterogeneous sensor array, and carrying out noise reduction, probability distribution matching normalization and time-space alignment preprocessing; features are extracted through a hierarchical network, modeling learning behaviors such as a variational auto-encoder are combined, and the learning state is evaluated from multiple dimensions; recommendation decisions are generated based on reinforcement learning, recommendation is optimized in combination with personalized presentation and multi-source feedback analysis, meanwhile, the system has the functions of dynamic strategy adjustment, intelligent resource creation, cross-scene migration recommendation and the like, and accurate self-adaptive recommendation is achieved. According to the method, multi-modal data are comprehensively collected and deeply processed, learning behaviors and evaluation states are accurately analyzed, personalized resource recommendation is provided through intelligent recommendation and dynamic optimization strategies, recommendation accuracy and learning effects can be improved, user experience can be enhanced, and the utilization rate and competitiveness of platform resources can be improved.

The invention relates to the field of man-machine interaction training, virtual reality and intelligent evaluation, and particularly discloses a psychological exercise ability training method and system based on mixed reality and behavior analysis. The method comprises the steps that a multi-scene psychological training environment is constructed and presented in mixed reality equipment, action behavior data, eye movement path data and operation response time data of a pilot in the training process are collected, multi-modal original behavior characteristics are constructed, and then a psychological exercise ability label set is constructed; and realizing capability-task modeling through matching of a capability label and a task structure, generating a personalized training path and a capability difference atlas based on difference analysis with a preset capability standard, adjusting task parameter configuration data, dynamically updating a training scene, generating a capability evolution trajectory, and outputting a training analysis result. In this way, accurate ability modeling, task dynamic adaptation and visual tracking of the training effect can be achieved, and the individuation and intelligence level of psychological exercise ability training is remarkably improved.

The invention discloses a behavior analysis early warning method and system based on AI situation awareness, and relates to the technical field of data recognition. The method comprises the following steps: collecting multi-source sensing data and extracting a numeralization feature vector; an edge correlation degree dynamic threshold self-learning algorithm is adopted to screen effective edges to construct a dynamic space-time diagram, and space-time correlation features are extracted; a modal weight coefficient is calculated based on historical detection accuracy, data integrity and scene adaptation degree, and multi-modal features are weighted and fused; inputting the deep reinforcement learning model, outputting a threat risk value and a safety response strategy, and executing; and updating the dynamic weight, the threshold value and the strategy parameter according to the early warning accuracy and the threat interception success rate to realize closed-loop optimization. The method solves the technical problems that multi-source heterogeneous data lacks uniform feature representation, cross-modal relevance is lost, a space-time association relationship cannot be dynamically updated, multi-modal feature fusion weight is fixed, fusion effectiveness is affected, threat assessment lacks adaptability, and performance is degraded due to model parameter updating lag.

The invention provides a sensitive data security compliance processing system and method. The sensitive data security compliance processing method comprises the steps of obtaining sensitive data to be accessed; setting a plurality of sensitivity levels through semantic relevance; determining the information sensitivity of each piece of text information in each sensitivity level, and extracting a privacy risk value when a user accesses the text information in different sensitivity levels through all the information sensitivity; acquiring a historical access record, generating a behavior deviation mode of a user through the historical access record, and determining behavior credibility when the user accesses text information in different sensitivity levels according to the behavior deviation mode; and performing dynamic risk assessment according to all the behavior credibility and all the privacy risk values to obtain a plurality of risk situation values, and adjusting a security processing strategy when the user accesses the sensitive data in real time through all the risk situation values. By adopting the scheme of the invention, the sensitive data can be dynamically processed based on the behavior analysis of the user.

The invention relates to the technical field of network security, in particular to a network intrusion detection method and system based on behavior analysis, and the method comprises the steps: collecting real-time data of a target network, the real-time data comprising network flow data, user access logs, equipment state parameters, inter-user interaction logs and trust relationship data; performing space-time correlation analysis on the real-time data to generate a dynamic behavior graph; performing anomaly detection on the dynamic behavior map to generate an abnormal node list; and executing attack blocking based on the abnormal node list. According to the invention, the recognition and defense capabilities of abnormal behaviors are effectively improved.

The invention relates to the technical field of Internet of Things, and discloses a multi-factor dynamic authentication Internet of Things network security access platform, which adopts a multi-factor authentication mechanism, combines biological characteristics, behavior characteristics and environment characteristics of equipment, performs identity verification through biological recognition, equipment fingerprints and behavior analysis, and utilizes a dynamic authentication strategy. Detecting an abnormal IP behavior and triggering a security policy by adopting a dynamic IP binding technology, combining with equipment fingerprint identification and learning and analyzing an equipment network behavior mode; a dynamic key management mechanism is adopted, and keys are automatically generated, distributed and updated according to different devices, application scenes and communication requirements; machine learning and artificial intelligence technologies are utilized to comprehensively analyze historical access data, abnormal behavior modes, environment security states and the like of equipment, and the security risk of equipment access is automatically evaluated if suspicious equipment is detected. The method has the advantage of improving the security of the Internet of Things.

The invention discloses an AI-driven real-time customer behavior analysis response method and system, and relates to the technical field of behavior analysis, and the method comprises the steps: collecting multi-channel user behavior data in real time, and constructing dynamic customer portrait information; performing multi-dimensional prediction based on the dynamic customer portrait information to generate a user behavior prediction result; driving the user behavior prediction result to automatically adjust a promotion strategy according to the AI, and generating personalized recommendation; the personalized recommendation is executed for real-time tracking, user feedback data is generated, updating response is conducted on the personalized recommendation according to the user feedback data, and a behavior analysis result is obtained. The technical problem that the promotion strategy matching degree is low due to inaccurate user behavior prediction in the prior art is solved, and the technical effect of improving the precision of the promotion strategy is achieved by collecting multi-channel user behavior data in real time, constructing a dynamic customer portrait, performing multi-dimensional prediction based on AI and automatically adjusting the promotion strategy.

The invention discloses a pumped storage power station safety construction monitoring method based on image recognition, and relates to the technical field of pumped storage power station safety construction monitoring, and the method comprises the steps: carrying out the intelligent monitoring of a construction site through a high-definition camera, an unmanned plane, and a multispectral imaging device, and optimizing the target capturing capability through an environment adaptive adjustment strategy. And in combination with a deep learning and behavior analysis model, identifying construction personnel, equipment and environment states, detecting behaviors such as no safety helmet wearing, illegal retention, equipment abnormity and the like, and performing real-time tracking and updating. Based on a risk level calculation model, a multi-level alarm mechanism is constructed, acousto-optic early warning, remote alarm and task scheduling are triggered, and construction safety is optimized in combination with cloud collaborative management. And self-supervised learning and cross-scene transfer learning are adopted, so that the recognition precision and the system adaptability in a complex environment are improved. According to the method, better effects are achieved in the aspects of real-time performance and accuracy.

An approach is provided for organizational transformation from a current state to a target state. Common language model(s) can dynamically perform interviews with stakeholders as part of a cooperative game to use disparate stakeholder insights to define the target state, projects, milestones, tasks, and resource use / availability. Lookalike Models can be used to model the organization as a dissipative system and calculate an organizational entropy score. A Markov model identifies possible task completion pathways between current and target state. An optimal project completion path through the Markov model may be identified using Decision Tree Models to identify magnitude of contribution to organizational transformation towards target state for each project and likelihood of successful project completion for each project using Fault Tree Models. Project completion resource allocation plans can be generated based on optimal Markov path. Bayesian Priors can be calculated based on performance measured using micro-behaviors analysis.

The invention discloses a driver state sensing system based on physiological indexes and external behavior analysis, which relates to the technical field of vehicle active safety control, and comprises a sensor group integrated in a driver contact or close area and a vehicle control part and used for collecting physiological signals and behavior characteristic signals of a driver in real time, the physiological signals at least comprise heart rate and skin electric signals, and the behavior characteristic signals at least comprise eyelid movement, head posture and steering wheel operation signals. According to the driver state sensing system, the comprehensiveness and accuracy of driver state sensing are remarkably improved by integrating physiological indexes and external behavior analysis, the limitation of single signal judgment is effectively overcome through a multi-source signal fusion mechanism, the reliability of state evaluation is ensured, and the advanced signal preprocessing technology adopted by the system is high in reliability. The data anti-interference capability is enhanced, the feature extraction precision is improved, and the robustness of the model is enhanced.

The invention relates to the technical field of data management, in particular to a data center abnormal behavior analysis system based on artificial intelligence, and the system comprises the steps: obtaining an operation efficiency index of each monitoring node in a data center environment; constructing a comprehensive evaluation and analysis architecture to analyze the operation efficiency indexes, wherein the comprehensive evaluation and analysis architecture comprises a deviation mode recognition model and an influence weight evaluation model; the deviation mode recognition model analyzes the operation efficiency index to obtain an operation deviation mode; the influence weight evaluation model analyzes the operation efficiency index and generates a deviation mode influence weight; constructing a risk probability calculation model to analyze an operation deviation mode and a deviation mode influence weight, generating a potential risk probability score, and determining an association influence confidence coefficient; and when the potential risk probability score and / or the association influence confidence coefficient meet a preset management attention triggering threshold value, obtaining a business influence description of the risk event, generating a management response strategy of an alarm, and further generating an operation risk management notification.

The invention relates to the technical field of big data, in particular to an e-commerce marketing propaganda system based on behavior analysis, which comprises a global user portrait module, an intelligent recommendation engine, a marketing fatigue management module, a supply chain collaboration module, a lightweight terminal module and a budget and value management module. In the prior art, user portraits are constructed only depending on single channel data such as online clicking or purchase records, so that user interest modeling is incomplete and lagged; according to the method, all-channel behavior data such as APP, Web, offline POS and social media are integrated, a user-commodity-scene heterogeneous graph is constructed by using a graph neural network, and an interest attenuation period (for example, the weight is reduced by 50% after the interest of mother and infant users lasts for 18 months) is dynamically captured through an LSTM model; for example, after a user tries on a certain style of clothes offline, the system associates online behaviors in real time and recommends commodities of the same style, the cross-scene conversion rate is improved by 32%, and the user portrait coverage degree is improved by 60%.

The invention discloses a dynamic access control strategy system based on behaviors, comprising: A, a behavior acquisition module for acquiring user behavior data in real time, the behavior data comprising login information, operation records, access resources, access time, access frequency and equipment information; b, the behavior analysis module is used for carrying out preprocessing, behavior pattern recognition and anomaly detection on the collected behavior data to generate a behavior analysis result; c, an access decision module which dynamically generates an access control decision in combination with user identity information, a behavior analysis result and a resource authority requirement; and D, a strategy updating module which updates the access control strategy in real time according to the security audit result, the user feedback and the new threat information. Compared with the prior art, the method has the advantages that a dynamic access control strategy based on behaviors is provided, the access authority of the user is dynamically adjusted by collecting and analyzing the user behavior data in real time, and finer, more flexible and safer access control is achieved.

The invention relates to the technical field of classroom behavior analysis, and discloses a classroom behavior analysis system based on an adaptive algorithm, which comprises a detection module, a parameter extraction module, a feature integration module and a decision generation module. The detection module collects classroom multi-modal behavior data and identifies active student terminals; the parameter extraction module obtains a real-time posture vector, a voice spectrum feature, an interaction response time delay and a teaching content semantic tag of a target student; the feature integration module performs cross-modal fusion on the data to generate attitude, voice, interactive fusion features and semantic association features; and the decision generation module performs hierarchical association modeling and dynamic priority ranking through a multi-head attention mechanism, generates a behavior matching degree and determines a target analysis object. The system realizes multi-modal data fusion by means of algorithms such as space-time decomposition and dynamic density clustering, improves the accuracy and real-time performance of classroom behavior analysis, and provides support for teaching optimization.

The invention provides an active defense system and method based on multi-protocol dynamic simulation and distributed trapping. The active defense method based on multi-protocol dynamic simulation and distributed trapping comprises the following sub-steps: S1, constructing a multi-protocol dynamic simulation environment; s2, deploying distributed trapping nodes; s3, deep trapping of attack behaviors; s4, attack chain reconstruction and behavior analysis; s5, performing adaptive confusion and adversarial enhancement; s6, automatic threat intelligence production and feedback; by loading the protocol template library and initializing the state machine, the response can be dynamically generated according to the real-time session context, and dynamic simulation of various service protocols is adopted, so that the detection capability on network attacks is improved, potential threats can be captured more quickly, and the risks of missing report and false report are reduced; and through an automatic threat intelligence generation and feedback mechanism, in combination with IOC index identification, structured output and real-time response, a defense strategy can be quickly responded and adjusted.

An intelligent attack vector analysis and mitigation system incorporates an intelligent process to analyze potential attack vectors from a suspicious attacker. The intelligent attack vector analysis and mitigation system leverages a generative artificial intelligence (AI)-enabled simulation environment to isolate and / or simulate attackers using federated identity and a hypermedia application programming interface (API). The system analyzes actual and / or potential attack vectors by leveraging the generative AI simulation and provides behavioral analysis with a specific focus on federated identity and / or hypermedia API components. As such, the system provides insights into novel attack vectors, vulnerabilities, and effective mitigation strategies that may then be automatically incorporated and / or implemented on the enterprise network by the intelligent attack vector analysis and mitigation system. The process utilizes continuous improvement, adaptation to evolving threats, and a holistic understanding of the system's security posture to improve and enable the enterprise organization's network security system.

The invention relates to the crossing field of industrial control system (ICS) safety and artificial intelligence, and particularly discloses a PLC high-interaction honeypot system based on multi-agent task splitting and RAG enhancement, which adopts a localized multi-agent collaborative architecture based on edge computing and is composed of a high-simulation equipment layer and an intelligent decision-making layer. The high-simulation equipment layer comprises a PLC dynamic mirror image, an HMI interface and a sensor data generator, and an active trapping environment is constructed through protocol fingerprint confusion and virtual and real data fusion technologies. The decision-making layer deploys a multi-agent task scheduling engine, integrates four kinds of agents including protocol analysis, behavior analysis, threat assessment and response generation, and realizes attack context perception and strategy dynamic generation based on a local RAG knowledge base. The load balancing agent dynamically allocates tasks according to equipment resources, and cooperates with offline knowledge update (USB flash disk encryption synchronization threat features) to form a closed-loop defense system, thereby ensuring physical isolation of an industrial network and realizing high-fidelity active defense.