378 results about "Event sequence" patented technology

The invention discloses a key place-oriented abnormal behavior intelligent identification and pre-processing system, which is characterized in that a preliminary abnormal event sequence is generated by collecting multi-modal environment data, the preliminary abnormal event sequence and a preset scene knowledge graph are subjected to semantic fusion to form composite abnormal event description information, and then a dynamic processing plan is generated based on large language model reasoning; the central scheduling agent is decomposed into a cooperative control instruction set to drive the video analysis agent, the broadcast grooming agent and the security and disinfection linkage agent to execute cooperative processing operation, situation evolution information is generated in a shared event canvas through environment feedback data, and dynamic optimization and adjustment of a processing strategy are achieved. According to the system, the whole process intelligence of the abnormal event from identification to disposal is realized, the semantic understanding ability of the system to a complex scene and the multi-agent collaborative response efficiency are improved, and the pertinence and the adaptive adjustment ability of a disposal plan are enhanced.

A training data set which includes event sequences representing actions of respective users of an application, properties of the users, and dynamic attributes associated with events such as the elapsed time between successive events, is prepared. A machine learning model which provides probabilistic predictions of next events of input event sequences is trained using the training data set. A trained version of the model is stored.

The present disclosure provides a fault prediction method, a fault prediction model training method, a computing device, a storage medium, and a computer program product. The fault prediction method comprises: obtaining abnormal log data and unit attribute information of a service processing unit; determining an abnormal event sequence on the basis of the abnormal log data; and inputting the unit attribute information and the abnormal event sequence into a fault prediction model to obtain a fault prediction result of the service processing unit, wherein the fault prediction model is obtained by performing training on the basis of a positive sample, a first sample label corresponding to the positive sample, a negative sample, and a second sample label corresponding to the negative sample, the positive sample comprises a positive sample abnormal event sequence and sample unit attribute information, and the negative sample comprises a negative sample abnormal event sequence and sample unit attribute information. The training data of the fault prediction model is richer, so that the accuracy of prediction results of the fault prediction model during applications is improved.

The invention discloses a depth time sequence prediction method and system based on an event gating mechanism, and belongs to the technical field of artificial intelligence, and the method comprises the steps: obtaining time sequence data and corresponding event sequence data; mapping the time sequence data and the corresponding event sequence data to a low-dimensional potential vector space to obtain a time sequence feature representation and an event sequence feature representation; according to the time step sequence, inputting the time sequence feature representation and the event sequence feature representation into an improved recurrent neural network for processing to obtain a hidden state sequence; performing attention calculation based on the hidden state sequence to obtain final vector representation; and obtaining a prediction result according to the final vector representation. According to the invention, the prediction capability of the time sequence containing the non-periodic event interference can be improved.

The invention provides an event-driven sparse attention optimization method and system based on a brain-like computing chip, and belongs to the technical field of computers.The method comprises the steps that semantic analysis and feature extraction are conducted on input data and text information, and an input event sequence and a text event sequence are generated; calculating semantic relevancy between the input event sequence and the text event sequence, and generating an event importance evaluation matrix; calculating a sparseness parameter based on the complexity of the input data and the load of a brain-like calculation chip calculation node, and strengthening the sparseness parameter to obtain a target sparseness parameter; based on the target sparseness parameter and the event importance evaluation matrix, generating a sparse attention mask matrix; a sparse attention calculation task based on the sparse attention mask matrix is allocated to calculation nodes of the brain-like calculation chip for execution; and the output results of the calculation nodes are fused to generate a target output result. According to the invention, the accuracy and efficiency of the query result are improved.

The invention discloses a natural language driven situation awareness control method and system based on task intention and a medium. Relates to the technical field of artificial intelligence and man-machine interaction. Generating a natural language template library and a task intention field table based on the three-table knowledge; constructing an interface-data double-mapping knowledge graph by taking three-table knowledge as a construction basis and taking a natural language template library and a task intention field table as retrieval rearrangement tools, and then performing semantic retrieval and anaphora resolution to generate structured intention data; on the premise of not depending on a fixed layout, a user instruction is analyzed into a task intention, stable anchoring of an interface object is achieved through semantic positioning, and the task intention is automatically compiled into a system API call or interface event sequence; and meanwhile, the availability and compliance of execution are guaranteed through a closed-loop mechanism of credible execution scoring and minimization clarification, so that the operation complexity is effectively reduced, and the response efficiency and intelligent interaction level of the situation awareness system are improved.

The invention discloses a laboratory risk control method based on a graph neural network, and the method comprises the following steps: S1, constructing a dynamically updated interaction event graph based on an interaction event sequence of laboratory equipment, personnel and environment; s2, dynamically updating the state space of each node according to the event preorder relation, and generating a synchronous node state sequence; s3, generating an early warning feature set of a node state change trend by adopting a graph convolution operation; s4, constructing an inter-node risk incidence matrix according to the early warning feature set, and generating an updated risk propagation path; s5, evaluating the probability of transition from the node state to the abnormal state, and generating a state risk prediction value; and S6, inputting a wolf pack optimization algorithm, and optimizing a parameter combination to obtain a laboratory risk prediction result. According to the invention, the real-time performance and accuracy of laboratory risk prediction are improved.

The invention provides a dual-network collaborative event sequence automatic testing method and device and a storage medium. The method comprises the following steps: generating a trigger identifier associated with a first pulse as a time reference; slave station logs are collected on the secondary backboard bus side, and communication messages are collected on the primary communication network side; correcting time offset and time drift of the primary communication network and the secondary backplane bus to generate a primary event sequence and a secondary event sequence; performing consistency comparison on the primary event sequence and the secondary event sequence under a unified time base to obtain a consistency comparison result; calculating an interval between adjacent events, comparing the interval with an expected interval to obtain a time scale precision checking result, and calculating an event resolution result; and calculating the time delay between the request and the response and counting the pairing rate to obtain a redundant pairing statistical result. According to the invention, end-to-end automatic testing, unified time base alignment, dual-network consistency verification, redundant request, response quantification and millisecond-level event resolution can be realized.

The invention relates to the technical field of network security, in particular to a network security operation and maintenance automatic analysis and response system based on artificial intelligence, which comprises an operation sensing module for acquiring a server state, extracting a security log, monitoring a network protocol and a transmission direction, identifying a performance bottleneck, sorting event data and generating a sensing summary sheet, the path offset identification module tracks a cross-domain path, identifies an abnormal path and generates an offset list; the behavior chain construction module sorts an event sequence and generates a behavior chain graph; the response processing module arranges processing steps, records a response process, generates an operation and maintenance execution sequence, synthesizes an output module to complete a process and generates an analysis result. According to the invention, by comparing the server resources with the historical reference, the abnormity is identified, and the event behavior basis is provided. And tracking cross-domain path lag and abnormity, and positioning threats. Arranging event data, and constructing an attack chain. The automatic response improves the speed and accuracy, shortens the response time, and enhances the attack handling capability.

The invention relates to the technical field of informatization, in particular to a workflow engine implementation method based on event traceability and decentralized monitoring, which is based on the design of recording node operation and deducing a process state on the basis of an immutable event sequence, thoroughly relieves the constraint of traditional state table storage on dynamic adjustment, and improves the working efficiency. Operation such as node insertion, skipping or rollback can take effect in real time through runtime metadata reconstruction, meanwhile, a completely stored operation event chain naturally supports full-process audit tracing, and a log system does not need to be additionally developed; a power proportion algorithm decomposes distributed node decisions into three layers of logics of role allocation, predefined result verification and secondary monitoring triggering, cross-service consistency is guaranteed through a post weight adjustment and historical behavior voting dual mechanism, and an online voting mechanism dynamically calculates and processes human weights by using event logs, so that the decision accuracy is improved. Therefore, the technical bottlenecks of rigidity, redundancy and weak consistency of the traditional scheme are overcome.

A method and related system for efficiently capturing relationships between event feature values in embeddings includes flattening an event sequence into a feature sequence including a first event prefix, a second event prefix, and a first set of feature values. The method includes generating an attention mask including first mask indicators to associate the first set of feature values with each other and second mask indicator to associate a first feature value of the first set of feature values with the second event prefix. The method includes providing the feature sequence and the attention mask to a self-attention neural network model to generate an embedding.

The invention relates to the technical field of log analysis, and discloses a log association analysis method and system for a network abnormal operation behavior, and the method comprises the steps: carrying out the normalized element analysis of a multi-source heterogeneous log of a target network environment, and obtaining a standardized event of the multi-source heterogeneous log; performing time sequence dependence mining on the standardized event to obtain a potential threat mode of the standardized event; performing active traversal matching on the standardized events to obtain a candidate associated event sequence of the standardized events; performing reverse deduction on a subsequent evolution stage of the target network environment to obtain a verification probe strategy of the subsequent evolution stage; applying the verification probe strategy to the target network environment, and performing data acquisition on the target network environment to obtain verification feedback data of the target network environment; performing threat degree evaluation on the candidate associated event sequence to obtain a research and judgment report of the target network environment; according to the invention, the efficiency of log association analysis of network abnormal operation behaviors can be improved.

The invention relates to the technical field of computers, in particular to a block chain power abnormal data tracing method. The method comprises the following steps: acquiring operation data and system logs of a power system, extracting model input, identifying exceptions and completing event source classification; for the abnormal generation differential change records, timestamps are extracted to construct chain records, and the chain records are serialized into traceable paths; performing cross-source alignment and sequence correction to form a consistent event sequence, classifying and sorting to obtain an event sequence structure, and verifying to generate a cross-system traceability path; and finally verifying a conclusion through a consensus mechanism, extracting a traceability report, and updating the anomaly detection model according to the traceability report. According to the method, the cross-source time sequence consistency and the evidence playback performance are improved, the conclusion credibility and the closed-loop iteration capability are enhanced, and the method is suitable for scenes such as data metering and equipment monitoring.

A method for performing attribute constrained queries for event sequence visualization may include receiving an event sequence dataset including event sequences. The method further includes determining singleton events in the dataset, where each singleton event is associated with an attribute. The method also includes generating event pattern sets corresponding to different distinct singleton events and that maintain a fixed positional order for each event sequence. The event pattern sets include pattern occurrence data for each event sequence positioned according to the fixed positional order. The method also includes identifying the fixed positional order maintained by each event pattern set, and generating an attribute constraint search structure, such as a B-tree, B+tree, or table, that includes keys and pointer values. The method may also include searching the search structure to identify key values satisfying a received attribute constraint, and outputting the sequence identifiers corresponding to the identified key values.

Provided in the present disclosure are a fault prediction method and apparatus, a fault prediction model training method and apparatus, and a computing device, a computer storage medium and a computer program product. The fault prediction method is applied to a cloud computing system, wherein the cloud computing system comprises a service processing unit. The fault prediction method comprises: acquiring anomaly log data of a service processing unit and a log acquisition time of the anomaly log data; on the basis of the anomaly log data and the log acquisition time, determining an anomaly event sequence and an anomaly timestamp sequence; on the basis of a time interval threshold and anomaly occurrence times corresponding to anomaly events in the anomaly event sequence, grouping the anomaly events to obtain an anomaly group sequence; and on the basis of the anomaly event sequence, the anomaly timestamp sequence, and the anomaly group sequence, using a fault prediction model to obtain a fault prediction result of the service processing unit. Anomaly log data is analyzed from multiple dimensions, thereby improving the prediction accuracy of a fault prediction model, and improving the stability of a cloud computing system.

The invention provides a log data-oriented system fault mining method, which belongs to the technical field of information, and comprises the following steps: collecting original log data of a system, and preprocessing original system logs, including analysis, key information extraction, vectorization and generation of a structured log event sequence; processing the log event sequence by adopting a two-stage model fusing anomaly detection and mode clustering so as to distinguish accidental anomaly and a real fault mode; and for each candidate fault mode cluster, analyzing a time sequence causal relationship between internal events, and positioning a root cause event according to the causal flow score of the node. The method has the advantages that dependence on artificial experience is reduced through full-process automatic modeling and analysis; according to the method, log analysis, feature extraction, anomaly detection and root cause positioning are all automatically completed by adopting a preset algorithm process, and the detection effect is maintained through self-adjustment of the model, so that the flexibility and sustainability of fault mining are improved.

The micro-service processing system provided by the embodiment of the invention comprises an event identification module which is used for defining a business domain event type and registering an event attribute structure; the event bus module constructs a distributed communication network containing a dual-channel message queue, and the event bus module implements partition routing according to event types; the event processing module is composed of an event producer and a consumer which are executed asynchronously, the event producer packages service actions into a standardized event data packet, and the consumer processes subscription events through a thread pool; the event storage module adopts a hierarchical log database for persistence of an event sequence and supports reestablishment of a service state according to a timestamp; and the security control module is used for implementing service authentication and event content encryption on a transmission layer. Through event bus dual-channel design, sender box transaction binding and hierarchical storage optimization, millisecond-level event processing delay is realized while the reliability of distributed transactions is ensured, and second-level state recovery can be realized based on a complete event log when a service fault occurs.

The invention belongs to the technical field of computer man-machine interaction and automatic control, and particularly relates to an RPA mouse and keyboard control method and system for a Wayland desktop. The method comprises the following steps: S1, creating and registering a virtual input device supporting mouse and keyboard functions in a user space by accessing a virtual input device interface provided by an operating system kernel; s2, current activity display output is detected, and screen resolution information is obtained; s3, the server program monitors a preset local Unix domain socket path for receiving a control instruction from the client; s4, the client sends a control request to the local Unix domain socket path in a structured format, and the server receives and analyzes the control request; s5, the server side maps the analyzed control request into a corresponding kernel input event sequence according to the operation type; meanwhile, by writing event data into the virtual input device, an input event is injected into the system so as to simulate a control operation on the graphic desktop.

The invention relates to the technical field of computer software, provides a visual flow arrangement method for e-commerce marketing, and aims to solve the problem of insufficient system processing performance and expansibility when an existing flow arrangement technology is applied to an e-commerce marketing scene. Generating and storing a state transition rule set; obtaining a user behavior event, obtaining a historical state transition event sequence according to the user behavior event, and then dynamically calculating a current user journey state; acquiring a corresponding state transition rule set, and performing matching query by taking the current user journey state and the user behavior event as input; if matching succeeds, a corresponding marketing action command is executed, and a new state transition event is generated and persisted to an event log so as to update a user journey state, so that efficient and accurate state-driven rule matching and automatic execution are realized, and the processing efficiency, expandability and state traceability of a system in a high-concurrency scene are improved.

The invention discloses an intelligent test generation method, system and device for an H5 page and a medium, and the method specifically comprises the steps: collecting a user operation event sequence of the H5 page, and building an operation log stream with a timestamp through the user operation event sequence; collecting equipment fingerprint data and a network delay index, and performing space-time correlation coding on the equipment fingerprint data and the network delay index to generate an enhanced operation track data set; inputting the enhanced operation track data set into a pre-trained depth time sequence neural network to obtain an anomaly detection result; sending out safety early warning based on an abnormal detection result, extracting boundary condition features in the operation log stream, and automatically generating a boundary test case set; and fusing the boundary test case set with the user operation reproduction case, constructing a hybrid test suite, and triggering an automatic test assembly line through a CI / CD integrated interface. According to the method, the comprehensiveness, the accuracy and the efficiency of H5 page testing are remarkably improved, and the performance and the safety of the H5 page are effectively guaranteed.

A method for generating an inverted search index for event sequence visualization may include determining, from an event sequence dataset containing event sequences and events, event pair combinations based on identified unique singleton events. The method may further include establishing a positional ordering for each singleton event and each event pair combination and generating a respective event sequence set for each event sequence. The method may also include determining whether each unique singleton event and each event pair combination exists or does not exist within each event sequence, and populating, for each respective event sequence set and according to the positional ordering, data indicative of whether each unique singleton event and each event pair combination exists or does not exist within the event sequence for the respective event sequence set. The method may also include generating the inverted search index including each respective event sequence set for each event sequence.

The invention belongs to the technical field of network attack and defense simulation, and discloses a network attack and defense simulation engine system based on discrete event driving, which comprises an event scheduling module, a simulation network construction module, an attack and defense simulation module, a simulation kernel module and a panoramic situation awareness module, the event scheduling module is in the form of MITRE ATTamp; the CK is constructed as a theoretical base and is used for converting all network activities into a dispatchable discrete event sequence; the network activities comprise data packet sending, protocol timeout and attack triggering; and the simulation network construction module can construct a simulation network containing complete service logic. According to the application, the MITRE ATTamp is scheduled by the event scheduling module; the CK tactical intention is converted into an ordered event stream, a hierarchical task network planner in the attack and defense simulation module dynamically decomposes and re-plans a high-level target, and ATTamp can be utilized; and the CK technology ID reconstructs an attack chain in real time.

The invention discloses a multifunctional safety box and a safety management system, and relates to the technical field of safety access. A multifunctional safety box safety management system comprises a multi-dimensional access verification module, a real-time joint scoring module, a risk reevaluation module, an event sequence analysis module, a linkage control module and an evolution management module. According to the method, the behavior-environment collaborative vector between the access behavior characteristics and the environment state is constructed, initial risk scoring is performed based on state deviation degree modeling, and a coupling strength judgment mechanism is introduced on the basis, so that the sensitivity and recognition accuracy of behavior and environment co-occurrence anomalies can be remarkably improved; the coupling strength is calculated through the abnormal co-occurrence frequency, the similarity and the information interaction degree in the behavior-environment vector, and the coupling strength exceeding a threshold value is used for dynamically adjusting the initial scoring level, so that the recognition capability of the composite potential attack behavior is effectively enhanced.

A system and method for secure and efficient automated workflows includes two complementary components. A digest embedding system verifies the integrity of workflow event sequences using a rolling SHA-256 digest salted with microsecond-precision timestamps. A template-caching extractor adaptively processes heterogeneous electronic documents. The digest system enables decentralized verification without querying centralized audit logs. The extractor uses a layout hash derived from document structure to route documents through either a low-latency, rule-based extraction path or a fallback artificial intelligence model path. New templates are generated for previously unseen layouts exceeding a confidence threshold. The disclosed methods improve latency, resource utilization, energy utilization and scalability in sectors including finance, healthcare, and logistics, offering advantages over existing prior art in terms of integration, specific mechanisms for timestamp salting, hardware security module utilization for workflow events, layout-based template caching, and adaptive learning.

The invention relates to a dynamic health record automatic updating and management method based on a cloud platform. The method comprises the following steps: acquiring multi-source heterogeneous data and performing event packaging to generate a standard health event stream; performing cross-modal time sequence alignment processing on the standard health event stream to form a time sequence event sequence; an event-state double-layer time sequence knowledge graph is constructed, and real-time updating of health state vectors is achieved by means of the dynamic reasoning ability of a graph neural network in combination with a time sequence event sequence; and dynamic updating of the archive is completed through vectorization archiving. By the adoption of the method, the defects of traditional health archives in the aspects of data fusion depth, updating timeliness and state characterization precision can be effectively overcome, an accurate and real-time data basis is provided for chronic disease management and other long-term health intervention scenes, and the initiative and individuation level of health management is remarkably improved.

The invention discloses an operation and maintenance log self-learning analysis system and method based on a large language model, and relates to the field of information technology operation and maintenance management. Comprising the steps of 1, creating an operation and maintenance log self-learning analysis system based on a large language model, 2, obtaining original operation and maintenance log data from servers, devices or application programs in real time through a log collection module, 3, format standardization, noise filtering and necessary sensitive information desensitization are conducted on the collected original operation and maintenance log data through a preprocessing module, and a standardized log event sequence is formed; 4, semantic understanding and intelligent analysis are conducted on the log event sequence through a large language model analysis module by means of a pre-trained large language model, and abnormal modes, error reasons or important event abstracts are recognized; 5, a readable analysis report or warning notification is generated through a result output module according to output of the analysis module, and a result is provided for operation and maintenance personnel through a local interface or an operation and maintenance warning system; and step 6, receiving the feedback of the operation and maintenance personnel on the analysis result through a feedback learning module.

The invention provides a real-time monitoring and root cause positioning method and system for software defects. The method comprises the following steps: collecting real-time monitoring data of a software processing thread, and generating a thread competition thermodynamic diagram for identifying a shared resource contention point through time sequence association processing; triggering a server memory bus embedded hardware detection device based on a contention point to dynamically capture a locking state transition signal, and converting the locking state transition signal into a locking event sequence; constructing a locking contention track diagram according to timestamp sorting, and completely displaying a process path of a locking mechanism from obtaining to releasing; constructing a dependency topological structure of the thread and the lock based on the trajectory graph, and identifying a resource contention chain; and mapping the contention chain into an unsynchronized shared variable access path in the source code, and triggering a real-time alarm signal. According to the method, the access path of the unsynchronized shared variable is accurately positioned, the lock competition diagnosis efficiency is improved, and the system deadlock risk is zeroed.

The invention discloses a laboratory inspection method based on semantic enhancement and related equipment. The method comprises the following steps: acquiring received first text information; the first text information comprises key event information actively fed back to a system inquiry experimenter in a current inspection process stage and natural voice description information of the experimenter collected in real time; performing forward semantic prediction and backward semantic verification on the first text information to obtain an event representation vector of the laboratory; the event representation vector is used for representing a laboratory event extracted from the first text information; determining event boundaries of the laboratory events and performing multi-level classification and attribute extraction on the laboratory events to obtain processed laboratory events; and performing event sequence continuity verification on the processed laboratory event, and if the verification is passed, generating a laboratory log corresponding to the processed laboratory event. The method can be widely applied to the technical field of natural language processing.

The invention discloses a URL (Uniform Resource Locator) security analysis method and device for an end-side large language model and a medium, and belongs to the field of network and information security. The method comprises the steps of collecting multi-modal data such as a URL analysis structure, DNS / certificate metadata, front-end code sampling, an OCR text and a dynamic behavior event sequence; performing exponential decay weighted aggregation on the dynamic events in the sliding time window; generating a static structure feature, a text semantic feature and a threat intelligence similarity based on the multi-modal data; fusing the multi-modal features by adopting a gating attention mechanism; inputting the fusion features and the readable context into an end-side large language model, and calling a security analysis tool set under limited decoding; a risk score and a minimum sufficient evidence are obtained through two-stage scoring; and executing an end-side security policy according to the scoring threshold value and leaving a trace by using a JSONL structure. According to the method, in-end closed-loop analysis is realized, the detection accuracy is remarkably improved, and the method is suitable for various deployment scenes such as mobile terminals and edge gateways.

The invention provides an intelligent Internet of Things safety monitoring method and system, and the method comprises the steps: obtaining an equipment operation record and a behavior operation record, carrying out the event serialization coding of the equipment operation record, obtaining a sensor event sequence vector, carrying out the behavior mode vectorization processing of the behavior operation record, obtaining a behavior event sequence vector, and carrying out the monitoring of the behavior event sequence vector. Inputting the sensor event sequence vector and the behavior event sequence vector into a pre-trained association analysis model, carrying out cross-sequence causal relationship mining processing, generating an abnormal event association graph, and based on event node attributes and association edge weight values in the abnormal event association graph, executing risk conduction path analysis to obtain a risk conduction path; and obtaining a key conduction path set and a risk accumulation intensity value of the house safety risk, and generating a safety monitoring result containing the risk level identifier and the risk source positioning information according to the key conduction path set and the risk accumulation intensity value. According to the invention, the accuracy and comprehensiveness of intelligent internet-of-things safety monitoring are effectively improved.