276 results about "Event sequence" patented technology

The invention discloses a key place-oriented abnormal behavior intelligent identification and pre-processing system, which is characterized in that a preliminary abnormal event sequence is generated by collecting multi-modal environment data, the preliminary abnormal event sequence and a preset scene knowledge graph are subjected to semantic fusion to form composite abnormal event description information, and then a dynamic processing plan is generated based on large language model reasoning; the central scheduling agent is decomposed into a cooperative control instruction set to drive the video analysis agent, the broadcast grooming agent and the security and disinfection linkage agent to execute cooperative processing operation, situation evolution information is generated in a shared event canvas through environment feedback data, and dynamic optimization and adjustment of a processing strategy are achieved. According to the system, the whole process intelligence of the abnormal event from identification to disposal is realized, the semantic understanding ability of the system to a complex scene and the multi-agent collaborative response efficiency are improved, and the pertinence and the adaptive adjustment ability of a disposal plan are enhanced.

The invention provides an event-driven sparse attention optimization method and system based on a brain-like computing chip, and belongs to the technical field of computers.The method comprises the steps that semantic analysis and feature extraction are conducted on input data and text information, and an input event sequence and a text event sequence are generated; calculating semantic relevancy between the input event sequence and the text event sequence, and generating an event importance evaluation matrix; calculating a sparseness parameter based on the complexity of the input data and the load of a brain-like calculation chip calculation node, and strengthening the sparseness parameter to obtain a target sparseness parameter; based on the target sparseness parameter and the event importance evaluation matrix, generating a sparse attention mask matrix; a sparse attention calculation task based on the sparse attention mask matrix is allocated to calculation nodes of the brain-like calculation chip for execution; and the output results of the calculation nodes are fused to generate a target output result. According to the invention, the accuracy and efficiency of the query result are improved.

The invention provides a dual-network collaborative event sequence automatic testing method and device and a storage medium. The method comprises the following steps: generating a trigger identifier associated with a first pulse as a time reference; slave station logs are collected on the secondary backboard bus side, and communication messages are collected on the primary communication network side; correcting time offset and time drift of the primary communication network and the secondary backplane bus to generate a primary event sequence and a secondary event sequence; performing consistency comparison on the primary event sequence and the secondary event sequence under a unified time base to obtain a consistency comparison result; calculating an interval between adjacent events, comparing the interval with an expected interval to obtain a time scale precision checking result, and calculating an event resolution result; and calculating the time delay between the request and the response and counting the pairing rate to obtain a redundant pairing statistical result. According to the invention, end-to-end automatic testing, unified time base alignment, dual-network consistency verification, redundant request, response quantification and millisecond-level event resolution can be realized.

The invention relates to the technical field of network security, in particular to a network security operation and maintenance automatic analysis and response system based on artificial intelligence, which comprises an operation sensing module for acquiring a server state, extracting a security log, monitoring a network protocol and a transmission direction, identifying a performance bottleneck, sorting event data and generating a sensing summary sheet, the path offset identification module tracks a cross-domain path, identifies an abnormal path and generates an offset list; the behavior chain construction module sorts an event sequence and generates a behavior chain graph; the response processing module arranges processing steps, records a response process, generates an operation and maintenance execution sequence, synthesizes an output module to complete a process and generates an analysis result. According to the invention, by comparing the server resources with the historical reference, the abnormity is identified, and the event behavior basis is provided. And tracking cross-domain path lag and abnormity, and positioning threats. Arranging event data, and constructing an attack chain. The automatic response improves the speed and accuracy, shortens the response time, and enhances the attack handling capability.

The invention relates to the technical field of log analysis, and discloses a log association analysis method and system for a network abnormal operation behavior, and the method comprises the steps: carrying out the normalized element analysis of a multi-source heterogeneous log of a target network environment, and obtaining a standardized event of the multi-source heterogeneous log; performing time sequence dependence mining on the standardized event to obtain a potential threat mode of the standardized event; performing active traversal matching on the standardized events to obtain a candidate associated event sequence of the standardized events; performing reverse deduction on a subsequent evolution stage of the target network environment to obtain a verification probe strategy of the subsequent evolution stage; applying the verification probe strategy to the target network environment, and performing data acquisition on the target network environment to obtain verification feedback data of the target network environment; performing threat degree evaluation on the candidate associated event sequence to obtain a research and judgment report of the target network environment; according to the invention, the efficiency of log association analysis of network abnormal operation behaviors can be improved.

The invention relates to the technical field of computers, in particular to a block chain power abnormal data tracing method. The method comprises the following steps: acquiring operation data and system logs of a power system, extracting model input, identifying exceptions and completing event source classification; for the abnormal generation differential change records, timestamps are extracted to construct chain records, and the chain records are serialized into traceable paths; performing cross-source alignment and sequence correction to form a consistent event sequence, classifying and sorting to obtain an event sequence structure, and verifying to generate a cross-system traceability path; and finally verifying a conclusion through a consensus mechanism, extracting a traceability report, and updating the anomaly detection model according to the traceability report. According to the method, the cross-source time sequence consistency and the evidence playback performance are improved, the conclusion credibility and the closed-loop iteration capability are enhanced, and the method is suitable for scenes such as data metering and equipment monitoring.

A method for performing attribute constrained queries for event sequence visualization may include receiving an event sequence dataset including event sequences. The method further includes determining singleton events in the dataset, where each singleton event is associated with an attribute. The method also includes generating event pattern sets corresponding to different distinct singleton events and that maintain a fixed positional order for each event sequence. The event pattern sets include pattern occurrence data for each event sequence positioned according to the fixed positional order. The method also includes identifying the fixed positional order maintained by each event pattern set, and generating an attribute constraint search structure, such as a B-tree, B+tree, or table, that includes keys and pointer values. The method may also include searching the search structure to identify key values satisfying a received attribute constraint, and outputting the sequence identifiers corresponding to the identified key values.

The invention provides a log data-oriented system fault mining method, which belongs to the technical field of information, and comprises the following steps: collecting original log data of a system, and preprocessing original system logs, including analysis, key information extraction, vectorization and generation of a structured log event sequence; processing the log event sequence by adopting a two-stage model fusing anomaly detection and mode clustering so as to distinguish accidental anomaly and a real fault mode; and for each candidate fault mode cluster, analyzing a time sequence causal relationship between internal events, and positioning a root cause event according to the causal flow score of the node. The method has the advantages that dependence on artificial experience is reduced through full-process automatic modeling and analysis; according to the method, log analysis, feature extraction, anomaly detection and root cause positioning are all automatically completed by adopting a preset algorithm process, and the detection effect is maintained through self-adjustment of the model, so that the flexibility and sustainability of fault mining are improved.

The micro-service processing system provided by the embodiment of the invention comprises an event identification module which is used for defining a business domain event type and registering an event attribute structure; the event bus module constructs a distributed communication network containing a dual-channel message queue, and the event bus module implements partition routing according to event types; the event processing module is composed of an event producer and a consumer which are executed asynchronously, the event producer packages service actions into a standardized event data packet, and the consumer processes subscription events through a thread pool; the event storage module adopts a hierarchical log database for persistence of an event sequence and supports reestablishment of a service state according to a timestamp; and the security control module is used for implementing service authentication and event content encryption on a transmission layer. Through event bus dual-channel design, sender box transaction binding and hierarchical storage optimization, millisecond-level event processing delay is realized while the reliability of distributed transactions is ensured, and second-level state recovery can be realized based on a complete event log when a service fault occurs.

The invention belongs to the technical field of computer man-machine interaction and automatic control, and particularly relates to an RPA mouse and keyboard control method and system for a Wayland desktop. The method comprises the following steps: S1, creating and registering a virtual input device supporting mouse and keyboard functions in a user space by accessing a virtual input device interface provided by an operating system kernel; s2, current activity display output is detected, and screen resolution information is obtained; s3, the server program monitors a preset local Unix domain socket path for receiving a control instruction from the client; s4, the client sends a control request to the local Unix domain socket path in a structured format, and the server receives and analyzes the control request; s5, the server side maps the analyzed control request into a corresponding kernel input event sequence according to the operation type; meanwhile, by writing event data into the virtual input device, an input event is injected into the system so as to simulate a control operation on the graphic desktop.

The invention relates to the technical field of computer software, provides a visual flow arrangement method for e-commerce marketing, and aims to solve the problem of insufficient system processing performance and expansibility when an existing flow arrangement technology is applied to an e-commerce marketing scene. Generating and storing a state transition rule set; obtaining a user behavior event, obtaining a historical state transition event sequence according to the user behavior event, and then dynamically calculating a current user journey state; acquiring a corresponding state transition rule set, and performing matching query by taking the current user journey state and the user behavior event as input; if matching succeeds, a corresponding marketing action command is executed, and a new state transition event is generated and persisted to an event log so as to update a user journey state, so that efficient and accurate state-driven rule matching and automatic execution are realized, and the processing efficiency, expandability and state traceability of a system in a high-concurrency scene are improved.

A method for generating an inverted search index for event sequence visualization may include determining, from an event sequence dataset containing event sequences and events, event pair combinations based on identified unique singleton events. The method may further include establishing a positional ordering for each singleton event and each event pair combination and generating a respective event sequence set for each event sequence. The method may also include determining whether each unique singleton event and each event pair combination exists or does not exist within each event sequence, and populating, for each respective event sequence set and according to the positional ordering, data indicative of whether each unique singleton event and each event pair combination exists or does not exist within the event sequence for the respective event sequence set. The method may also include generating the inverted search index including each respective event sequence set for each event sequence.

The invention belongs to the technical field of network attack and defense simulation, and discloses a network attack and defense simulation engine system based on discrete event driving, which comprises an event scheduling module, a simulation network construction module, an attack and defense simulation module, a simulation kernel module and a panoramic situation awareness module, the event scheduling module is in the form of MITRE ATTamp; the CK is constructed as a theoretical base and is used for converting all network activities into a dispatchable discrete event sequence; the network activities comprise data packet sending, protocol timeout and attack triggering; and the simulation network construction module can construct a simulation network containing complete service logic. According to the application, the MITRE ATTamp is scheduled by the event scheduling module; the CK tactical intention is converted into an ordered event stream, a hierarchical task network planner in the attack and defense simulation module dynamically decomposes and re-plans a high-level target, and ATTamp can be utilized; and the CK technology ID reconstructs an attack chain in real time.

The invention discloses a multifunctional safety box and a safety management system, and relates to the technical field of safety access. A multifunctional safety box safety management system comprises a multi-dimensional access verification module, a real-time joint scoring module, a risk reevaluation module, an event sequence analysis module, a linkage control module and an evolution management module. According to the method, the behavior-environment collaborative vector between the access behavior characteristics and the environment state is constructed, initial risk scoring is performed based on state deviation degree modeling, and a coupling strength judgment mechanism is introduced on the basis, so that the sensitivity and recognition accuracy of behavior and environment co-occurrence anomalies can be remarkably improved; the coupling strength is calculated through the abnormal co-occurrence frequency, the similarity and the information interaction degree in the behavior-environment vector, and the coupling strength exceeding a threshold value is used for dynamically adjusting the initial scoring level, so that the recognition capability of the composite potential attack behavior is effectively enhanced.

The invention relates to a dynamic health record automatic updating and management method based on a cloud platform. The method comprises the following steps: acquiring multi-source heterogeneous data and performing event packaging to generate a standard health event stream; performing cross-modal time sequence alignment processing on the standard health event stream to form a time sequence event sequence; an event-state double-layer time sequence knowledge graph is constructed, and real-time updating of health state vectors is achieved by means of the dynamic reasoning ability of a graph neural network in combination with a time sequence event sequence; and dynamic updating of the archive is completed through vectorization archiving. By the adoption of the method, the defects of traditional health archives in the aspects of data fusion depth, updating timeliness and state characterization precision can be effectively overcome, an accurate and real-time data basis is provided for chronic disease management and other long-term health intervention scenes, and the initiative and individuation level of health management is remarkably improved.

The invention discloses a laboratory inspection method based on semantic enhancement and related equipment. The method comprises the following steps: acquiring received first text information; the first text information comprises key event information actively fed back to a system inquiry experimenter in a current inspection process stage and natural voice description information of the experimenter collected in real time; performing forward semantic prediction and backward semantic verification on the first text information to obtain an event representation vector of the laboratory; the event representation vector is used for representing a laboratory event extracted from the first text information; determining event boundaries of the laboratory events and performing multi-level classification and attribute extraction on the laboratory events to obtain processed laboratory events; and performing event sequence continuity verification on the processed laboratory event, and if the verification is passed, generating a laboratory log corresponding to the processed laboratory event. The method can be widely applied to the technical field of natural language processing.

The invention discloses a URL (Uniform Resource Locator) security analysis method and device for an end-side large language model and a medium, and belongs to the field of network and information security. The method comprises the steps of collecting multi-modal data such as a URL analysis structure, DNS / certificate metadata, front-end code sampling, an OCR text and a dynamic behavior event sequence; performing exponential decay weighted aggregation on the dynamic events in the sliding time window; generating a static structure feature, a text semantic feature and a threat intelligence similarity based on the multi-modal data; fusing the multi-modal features by adopting a gating attention mechanism; inputting the fusion features and the readable context into an end-side large language model, and calling a security analysis tool set under limited decoding; a risk score and a minimum sufficient evidence are obtained through two-stage scoring; and executing an end-side security policy according to the scoring threshold value and leaving a trace by using a JSONL structure. According to the method, in-end closed-loop analysis is realized, the detection accuracy is remarkably improved, and the method is suitable for various deployment scenes such as mobile terminals and edge gateways.

The invention provides an intelligent Internet of Things safety monitoring method and system, and the method comprises the steps: obtaining an equipment operation record and a behavior operation record, carrying out the event serialization coding of the equipment operation record, obtaining a sensor event sequence vector, carrying out the behavior mode vectorization processing of the behavior operation record, obtaining a behavior event sequence vector, and carrying out the monitoring of the behavior event sequence vector. Inputting the sensor event sequence vector and the behavior event sequence vector into a pre-trained association analysis model, carrying out cross-sequence causal relationship mining processing, generating an abnormal event association graph, and based on event node attributes and association edge weight values in the abnormal event association graph, executing risk conduction path analysis to obtain a risk conduction path; and obtaining a key conduction path set and a risk accumulation intensity value of the house safety risk, and generating a safety monitoring result containing the risk level identifier and the risk source positioning information according to the key conduction path set and the risk accumulation intensity value. According to the invention, the accuracy and comprehensiveness of intelligent internet-of-things safety monitoring are effectively improved.

A method for reducing noise for event sequence visualization according to an embodiment includes identifying patterns of events from an event sequence dataset, wherein the event sequence dataset includes data for a plurality of event sequences, and wherein each event sequence of the plurality of events sequences includes at least one event, encoding each event sequence of the plurality of event sequences into a respective vector embedding based on the identified patterns of events to generate a plurality of vectors, executing a clustering algorithm on the plurality of vectors to generate a plurality of clusters, assigning each event sequence of the plurality of event sequences to a respective cluster of the plurality of clusters, generating a reduced dataset based on the assignment of the plurality of event sequences to the plurality of clusters, and building a data structure for event sequence visualization based on the reduced dataset.

The invention discloses a GUI program directional fuzzy test method and system based on a large model agent, and the method comprises the steps: receiving a to-be-tested GUI program source code, constructing an event flow graph for the GUI program source code through static analysis, and carrying out the directional fuzzy test on the GUI program source code based on the event flow graph and a target code region specified by a user, a target association and dependency chain is obtained through reverse event flow analysis; based on the GUI real-time state and constraint information, an initial event sequence conforming to interaction logic is generated through a multi-mode large model; and on the basis of the initial event sequence, taking the event constraint relationship as a core, and carrying out directed evolution on the initial event sequence to obtain a test result. According to the method, deep fusion of the target driving capability of the directional fuzzy test and the complex interaction adaptation capability of the environment perception test is realized, and the problems of insufficient depth and low efficiency in deep vulnerability detection of the GUI program in the prior art are solved.

The invention discloses an order anomaly detection and compensation method based on a message queue, and relates to the technical field of order processing, and the method comprises the steps: obtaining the operation time sequence data of a target downstream service associated with an abnormal order; generating order processing success probability distribution of the target downstream service through a time sequence prediction model; calculating the optimal retry time of the abnormal order through a target function in combination with a preset business constraint condition; delivering to a message queue for delayed retry; key events and corresponding attributes in the abnormal order processing process are obtained, and an abnormal track event sequence is constructed; mapping the abnormal trajectory event sequence into an abnormal trajectory fingerprint vector with a fixed dimension in response to the abnormal order reaching a compensation triggering condition; and performing matching in a preset abnormal mode library, and executing a corresponding compensation strategy according to a matching result. According to the invention, through prediction driving scheduling of the order abnormity retry time and automatic selection of the compensation strategy, the accuracy and stability of order abnormity processing are improved.

The invention provides a vulnerability discovery method and system based on symbol-semantic hybrid reasoning, and belongs to the technical field of software security. The method comprises the steps that a target program is analyzed, and an event sequence is extracted; converting the event into a symbol with a time sequence label and confidence, and constructing a symbol dependency graph; reasoning based on the dependency graph, calling a large language model to generate a semantic reasoning action when the certainty is insufficient, and updating the state after symbol verification; new rules are extracted from the inference chain passing verification through reinforcement learning, and self-evolution is achieved; and outputting a vulnerability report containing the reasoning path and the confidence coefficient. The system correspondingly comprises a time sequence probability symbol module, a symbol-semantic bidirectional coupling reasoning module, a reinforcement learning self-evolution module and a report generation module. According to the method, the preciseness of symbol logic and the generalization ability of a semantic model are fused, the accuracy, interpretability and adaptive ability of vulnerability detection are effectively improved, and the method is suitable for security audit and code review of a complex software system.

A method for performing time constrained queries for event sequence visualization may include receiving an event sequence dataset including event sequences. Each event sequence includes at least two sequentially occurring events. The method further includes generating a forward index having event pattern sets that include pattern occurrence data for each event sequence positioned according to a fixed positional order. The method includes generating a time constraint search structure, such as a B−tree, B+tree, or table, that includes keys and pointer values. The method also includes inserting, into the search structure, a sequence identifier corresponding to each event sequence based on the fixed positional order and time interval data for the at least two sequentially occurring events of each event sequence. The method may also include searching the search structure to identify key values satisfying a received time interval constraint, and outputting the sequence identifiers corresponding to the identified key values.

The invention relates to the technical field of server management, and discloses an AI-based server health prediction system, which is characterized in that a data processing unit collects server operation index data and abnormal event data, generates an index sequence and an event sequence, performs consistency verification, and finally obtains a monitoring credibility score. A health prediction unit generates a configuration fingerprint, constructs a component coupling graph, and updates edge weights within a sliding time window. And when the monitoring credibility score is not lower than a consistency verification threshold value, the input graph time sequence prediction model outputs a health prediction result. And the operation and maintenance decision-making unit generates a maintenance work order, a maintenance schedule and spare part scheduling according to the health prediction result and in combination with confidence information, and performs complementary sampling diagnosis and delays maintenance work order issuing when the confidence information is lower than a maintenance threshold value. The calibration unit is used for updating calibration parameters and gating parameters of the graph timing prediction model based on the maintenance execution backfill data. According to the invention, the risks of false report, false maintenance and non-planned shutdown are reduced, and the operation and maintenance scheduling efficiency is improved.

The invention provides a multi-scene target detection and behavior recognition method and system based on deep learning, and relates to the technical field of software development behavior analysis, and the method comprises the steps: obtaining a code editing operation sequence, an interface interaction event sequence and a file access record sequence in a software development environment, and forming a multi-modal development behavior data flow; performing development scene identification on the multi-modal development behavior data flow to obtain a scene state identifier; constructing a semantic perception feature extractor, performing syntax structure analysis and semantic dependency modeling on the code editing operation sequence, extracting an abstract syntax tree structure and a program execution path diagram, and combining to obtain code structured features; performing code mode matching and abnormal mode positioning to obtain a target code segment detection result; extracting operation time sequence features and carrying out cross-modal feature alignment on the operation time sequence features and the code structured features to obtain a unified behavior vector; and performing time sequence dependence reasoning and behavior pattern classification to obtain a behavior recognition result.

The invention discloses a retrieval question and answer method and system combined with a time sequence context, a medium and equipment, and belongs to the crossing field of artificial intelligence and intelligent operation and maintenance of an electric power system. Extracting time sequence semantic elements in the event sequence, and retrieving a corresponding event sub-graph in a time sequence directed graph constructed based on an event sequence, a time sequence and a logic link of the power equipment; performing feature aggregation on the sub-graph nodes to obtain context vectors; performing weighted fusion on the query semantic vector and the context vector to obtain a joint vector; calculating the similarity between the knowledge fragment vector set and each knowledge fragment in the knowledge fragment vector set, and screening out a plurality of most relevant knowledge fragments; and inputting the original query and the knowledge fragments into a text generation model, outputting answers, and completing questions and answers. By implementing the method and the device, the technical problem that an intelligent question and answer retrieval method in the prior art lacks pertinence and professional traceability of retrieval results in a complex event sequence scene in the power field can be solved.

The invention discloses a file system event processing method and device based on an intelligent filtering rule, and the method comprises the steps: obtaining a file system original event of a monitoring directory, carrying out the cross-platform standardization processing, and extracting event feature vectors of four dimensions: time, a file, a process and a path; the method comprises the following steps: constructing a rule base containing software operation modes such as an editor, a compiler and a version control tool, performing mode matching on an event sequence, calculating confidence, determining a filtering strategy type based on a matching result, executing corresponding processing, and dynamically optimizing system parameters through statistical analysis. The technical problems that an existing file monitoring system is serious in event redundancy and frequent in false triggering are solved, effective file operation and temporary intermediate operation can be intelligently distinguished, invalid synchronous triggering is greatly reduced, the accuracy is improved to 95% or above from 60-70% of a traditional scheme, and invalid event processing is reduced by 90% or above.

The invention provides a multi-modal data real-time analysis and feedback method and system, and the method comprises the steps: collecting a video frame and an audio frame, reading a count value of the same monotonic timer when the collection of the video frame and the audio frame is completed, and generating an audio and video sequence; calculating the behavior popularity of each region in each time slice based on the sequence, and generating a region set for multi-modal event analysis in combination with a preset threshold and a quantity upper limit; scheduling the corresponding video sub-blocks to a visual computing power unit for target positioning and action classification, and executing voice activity detection and keyword category judgment on the time-aligned audio clips at the same time; visual and audio results are fused, and a structured event sequence is generated according to time slice and region compression; and constructing a classroom teaching chain through the sequence, identifying a key event, and finally generating a teaching event description. According to the invention, under the condition of domestic chip combination, cost, time delay, multi-modal consistency and data security controllability are considered, and real-time perception and feedback of teaching behaviors are effectively supported.

Systems and methods for generating explainability for user classifications using motif embeddings. In some aspects, the system generates a first set of embeddings in an embedding space by inputting, to a motif encoder model, a set of event motifs associated with a set of labels. The system generates a second set of embeddings for a first user by providing, to the motif encoder model, an event sequence of the first user. The system selects a set of search anchor embeddings by determining a first set of distances between the second set of embeddings and the first set of embeddings. The system queries the embedding space to select a candidate profile for association with the first user and concurrently presents the explanatory label and a profile title associated with the candidate profile.

The application relates to an excitation system fault recording and event record analysis and diagnosis method and system, belonging to the field of excitation systems. The method comprises collecting recording files and event sequence records of the excitation system; performing multi-domain feature extraction based on the recording files to obtain a multi-domain feature tensor; performing space-time causal structure learning based on the multi-domain feature tensor and the event sequence records to output a causal adjacency matrix, a causal diagram and a time delay matrix; performing double-channel interpretable fault classification based on the multi-domain feature tensor, the causal diagram and an event time tag list E in the event sequence records to output a fault type label M and an attention space-time heat map; performing counterfactual causal tracing to obtain a root cause variable set and a causal propagation path, and outputting a diagnosis report. The application realizes intelligent diagnosis of the excitation system with signal analysis capability, causal reasoning capability and diagnosis interpretability.