9844 results about "Record" patented technology

The present invention discloses a system and method for performing artificial intelligence (AI) safety red-teaming with integrated policy fuzzing and adversarial prompting to systematically identify, characterize, and mitigate unsafe or non-compliant behaviors in AI models. The disclosed invention automates the process of generating, executing, and analyzing adversarial test cases through coordinated functional units comprising a policy fuzzing unit, an adversarial prompting unit, an execution sandbox, a telemetry processing unit, a scoring and triage processor, and a cryptographic provenance processor. The system applies grammar-driven and reinforcement-based fuzzing techniques to vary policy descriptors, model configuration parameters, and instruction hierarchies, while a learned adversarial prompt generator synthesizes contextually coherent adversarial prompts optimized for maximum policy violation likelihood. The generated prompts and policy vectors are executed in an isolated, instrumented sandbox that records input-output interactions, timing characteristics, and intermediate representations.

The invention relates to the technical field of network security and data protection, and discloses a data leakage prevention method and system based on user behavior perception, and the method comprises the steps: obtaining historical operation data, and constructing a personalized behavior reference library; monitoring a current access behavior in real time by sliding a time window, calculating a deviation degree and triggering anomaly detection; performing multi-level feature analysis on the abnormal behavior and calculating a comprehensive abnormal score; dynamically adjusting the access authority according to the score, recording an abnormal behavior and carrying out relevance matching; optimizing the reference model through feedback learning; and evaluating the credibility and the risk level based on an accurate modeling result, and adaptively adjusting permission configuration. According to the method, the user behavior rule can be accurately captured, the data leakage risk can be efficiently identified, the access permission can be dynamically adjusted, the false alarm rate can be reduced, adaptive protection can be realized, and data security and business smoothness can be guaranteed.

The invention relates to the technical field of artificial intelligence, can be applied to business scenes of financial science and technology, medical health and the like, and discloses a task scheduling execution method, device, equipment and medium based on intention recognition, and the method comprises the steps: fusing an interaction request and a dialogue history library to generate a session context, and carrying out the analysis to obtain an intention recognition result; task planning is carried out based on the intention recognition result and a knowledge base, and a task subitem set and an execution sequence are generated; matching the task subitem set with a resource directory to generate an execution resource list; scheduling the task subitem set by using the execution sequence to generate an ordered task sequence; generating an execution plan in combination with the ordered task sequence and the execution resource list; and triggering execution based on the execution plan, and aggregating output to generate an execution result and a process tracking record. According to the method, automatic connection of session analysis, task planning, resource matching, sequential scheduling and execution triggering is achieved, manual operation splitting among multiple systems is eliminated, and task processing efficiency and execution accuracy are improved.

Systems for explainable large language model routing with immutable audit trails are disclosed. The system receives a query and determines its characteristics including complexity, domain, regulatory constraints, and performance requirements. It retrieves profiles for multiple LLMs from a model matrix containing performance attributes, resource consumption, and compliance parameters. The system selects a particular LLM by balancing resource consumption with performance requirements, evaluating regulatory compliance, ranking LLMs based on these factors, and prioritizing models with successful processing history. The system generates a human-readable explanation of the selection including decision factors, rationale, and alternatives considered. Finally, it records the selection and explanation in a tamper-evident, immutable audit trail data structure.

The invention relates to the technical field of network communication, and discloses a vehicle-mounted edge computing data recording system and method based on protocol adaptive analysis, and the system comprises a multi-protocol network access controller which is used for capturing an original data frame and extracting a physical feature triple; the identification analysis engine is used for executing hash operation on the triple to generate a physical feature code and retrieving a physical logic address mapping table; the direct memory access controller is used for responding to a target memory address pointer hit by retrieval and directly writing a data load into an input buffer area of the functional operation module, and by constructing a direct addressing mechanism based on Hash mapping, thorough decoupling of vehicle-mounted heterogeneous network physical topology and edge computing logic is achieved.

The invention discloses a big data risk control decision support system based on multi-modal data, and the system comprises a data access module which is used for accessing and analyzing multi-source entity information, building a grouping calibration rule base, and generating a compliance multi-modal data set; the preprocessing and characterization module is used for preprocessing the data, generating basic characterization of each modal and establishing a micro verifier library; the causal hypergraph module is used for constructing a causal hypergraph and outputting a stable causal structure and a gating mask; the fusion and anti-fact module is used for executing cross-modal fusion to generate a risk representation, generating and verifying a minimum change anti-fact sample, and outputting a reachable identifier and an adjustment representation; the evidence chain module is used for calculating a shortest evidence overpass, generating a structured evidence chain and outputting an evidence index; and the strategy module is used for generating and correcting scores, triggering strategy actions and recording execution information. Through multi-modal data fusion and causal reasoning, high-precision, low-delay and interpretable big data risk control decision support is realized.

The invention relates to the technical field of intelligent processing of document information, discloses a method and a system for extracting RAG type data items and checking consistency for engineering technology documents, and solves the problem that an existing scheme is difficult to consider high-accuracy extraction, cross-document consistency, strong traceability and structured landing in engineering technology document data processing. The scheme comprises the following steps of: performing layout analysis and necessary OCR (Optical Character Recognition) processing on a received document, and dividing the document into multiple levels of text blocks; carrying out vectorization processing on the multi-level text blocks by adopting an embedding model subjected to two-stage fine adjustment, establishing a vector index and recalling candidate fragments to form a candidate fragment set; a cross encoder with efficient fine tuning of parameters is adopted to screen out high-correlation fragments; performing standardization processing by extracting a target variable to form a structured record; consistency checking is conducted on the target variables, and finally structured records and checking results are bound with minimum evidence fragments and corresponding position information to be exported through a format list.

The invention discloses a logistics data credible evidence storage and tracing method based on a block chain, and the method comprises the following steps: collecting original logistics data, and executing data standardization processing; constructing a layered Merkle mountain structure, and calculating to obtain a main root commitment of the layered Merkle mountain; dividing a layered Merkle mountain range structure, and calculating to obtain a windowed subtree root set; configuring a revision branch record structure, generating a collision pair by using chameleon hash, and generating a revision proof record; a multi-index root structure is constructed, a cross-root sharing mechanism is established, and a multi-dimensional tracing index set is generated; and based on the hierarchical Merkle mountain range main root commitment, the windowed subtree root set, the multi-dimensional traceability index set and the revision proof record, executing anchoring consistency verification, and outputting a credible evidence storage result and a traceability verification result. According to the invention, the logistics data evidence storage integrity and the multi-dimensional tracing efficiency are improved.

The systems and methods disclosed herein monitor application (e.g., artificial intelligence (AI) model) operations using interactions between the application and a kernel. The systems and methods disclosed herein intercept, using a kernel interface, one or more function invocations transmitted from the application (e.g., an AI model without model modification). Event record(s) are generated for one or more functions to define process identifiers, resource interaction types, timestamps, and / or resource identifiers. Observed pattern(s) for the application are identified by comparing current event record(s) with previous record(s), and the identified observed pattern(s) are evaluated against reference pattern(s) to generate score(s). Data packet(s) that indicate observed pattern(s), corresponding score(s), and / or cryptographic digital fingerprint(s) of the one or more functions are generated. The data packet(s) are transmitted to distributed ledgers for immutable storage.

The invention provides a cement equipment maintenance decision-making method and device based on a knowledge graph and large model reasoning, relates to the field of cement industry intelligent operation and maintenance, and solves the technical problem of decision-making response delay caused by knowledge fragmentation. The method comprises the following steps: extracting real-time characteristics from vibration spectrum signals, temperature curves and torque waveform data collected by an edge gateway, and extracting a work order entity triple from a natural language work order text of an EAM system; based on an equipment BOM list, a historical maintenance record and an FMEA analysis table, physical assembly constraint conditions are defined through ontology modeling to generate a cement equipment topological relation and a fault rule chain, and a knowledge graph is created to output a fault rule base with confidence coefficient weights. And inputting the real-time feature vector and the work order entity triple into a multi-modal collaborative inference engine, triggering a matched fault rule chain by combining real-time features and semantic features, outputting a fault root cause and an associated maintenance strategy ID, and labeling a logic chain. And activating the associated maintenance strategy ID and obtaining the real-time characteristic deviation degree of the maintenance strategy ID, quantifying the decision credibility through a tracing rule matching path, obtaining an executable maintenance instruction packet with a logic chain, executing the maintenance instruction packet and dynamically updating the knowledge graph based on a maintenance result. The method is used in the maintenance decision-making process of the cement equipment.

The invention discloses a natural language-to-SQL (Structured Query Language) method and system based on RAG (Random Access Gateway) enhancement, and the method comprises the steps: constructing a query intention graph through dependency syntax analysis, recognizing and complementing semantic missing components, and forming complete semantic representation; vector representation is carried out on the business term segments by adopting vectorization coding, accurate definitions of business terms are obtained from a factory structured knowledge base, and an enhanced context set is formed through expansion retrieval in a low-confidence region; an SQL template mapping network is established based on historical query records, a mapping relation matrix is generated through field candidate matching, mapping conflict positions are identified, and multiple SQL candidate sequences are generated; grammar verification is carried out on the candidate sequence to identify grammar errors, semantic consistency verification is carried out to calculate the intention alignment degree, and an optimal SQL statement is selected through a deviation correction factor; and performing formatting processing and statistical abstract on an execution result, and providing data query capability for scenes such as factory quality management and equipment maintenance.

The invention relates to the technical field of data processing, and discloses a knowledge graph incremental updating and consistency checking method and system. The method and the device are used for solving the problem of low incremental updating and consistency checking efficiency of a large-scale knowledge graph. The method comprises the following steps: collecting a to-be-updated data source, sorting and separately storing data, and marking priority labels; performing change detection on the marked data source, identifying change items by comparing entities and relationships, and generating a log; incremental updating is executed based on the log, and nodes and edges are processed in a hierarchical fusion mode; preliminary consistency verification is carried out, and attribute uniqueness and relation directivity are checked; expanding a verification range, traversing an association path through cascade check, and recording problems; and optimizing storage according to the record, merging the update area, updating the index and cleaning the log. The method solves the problem of low efficiency of incremental updating and consistency verification of the large-scale knowledge graph, improves the response speed and the data accuracy of the system, and is suitable for a high-frequency dynamic data environment.

The invention belongs to the technical field of data analysis, and provides a multi-source operation and maintenance data anomaly analysis method and device, equipment, a medium and a product, the method comprises the steps that multi-source operation and maintenance data is acquired, and the multi-source operation and maintenance data comprises at least two of index time sequence data, application logs, call link tracking data, configuration change records, alarm events and work orders; carrying out joint anomaly modeling on the preprocessed multi-source operation and maintenance data based on a multi-model fusion architecture to identify an abnormal event in the multi-source operation and maintenance data; based on the operation and maintenance knowledge graph and the structured causal model, fault influence path tracing and root cause positioning are carried out on the abnormal event, a root cause analysis result is obtained, and the root cause analysis result is used for indicating a fault root cause node and a fault propagation path in the abnormal event. Therefore, the accuracy of anomaly analysis of the multi-source operation and maintenance data is remarkably improved.

The invention discloses a park management method based on digital twinning, particularly relates to the field of park operation, and is used for solving the problem that a multi-source event is difficult to stably chain under the conditions of compensation delay and evidence gap and causes misalignment of disposal triggering. Comprising the following steps of: registering an event in a pool to generate an event number and writing the event number into a platform arrival moment; screening and mapping an anchor point event to a park object identifier and a process stage identifier to generate a management token; checking a stage sequence and an evidence item requirement set according to an event chain rule table in event chain construction and generating a conflict point list; the delay portrait library generates a credible mark when a source is generated and forms a reverse sequence violation spectrum; the digital twin object relation graph forms an influence domain span mark; the closed table is returned to obtain a disposal convergence guarantee level; the cost-sensitive decision tree outputs a disposal template identifier, and the disposal template table generates a management action instruction and a trigger voucher and records an instruction acceptance identifier; and returning, comparing and freezing the exception management token, and updating the event chain rule table and the delay portrait library.

The invention relates to the technical field of application state diagnosis, in particular to an application state dynamic diagnosis and automatic repair method and system.The method comprises the steps that multi-source heterogeneous logs are collected and standardized in real time, key fields are extracted, context information is injected, and structured log data are generated; inputting the structured log data into a dynamic anomaly detection model, constructing a dual-path detection mechanism based on LSTM time sequence analysis and a graph neural network, identifying an abnormal mode and positioning a fault root cause; according to the output of the anomaly detection model, a repair action is triggered in a grading manner through an intelligent repair strategy engine; in the repairing process, system state changes are stored and recorded through a pre-writing type redundancy log, automatic rollback during abnormity is achieved on the basis of check point information, and data consistency and system stability are guaranteed. The problem of service interruption or data inconsistency possibly caused by traditional automatic repair is avoided, and the reliability of automatic operation and maintenance is improved.

The invention relates to the technical field of pipeline monitoring and artificial intelligence, in particular to a multi-source data fusion pipeline monitoring method and system. The method comprises the steps of performing field sorting, structure unification and risk segmentation processing by obtaining pipeline line data, historical operation archives and strategy update configuration records, and generating a session primary key configuration table; a multi-source acquisition time window is configured, an acquisition task is issued, time anchor point registration and field aperture unification are completed, and a multi-source session data packet set is generated; performing session and risk unit association, performing multi-modal feature extraction and cleaning aggregation based on artificial intelligence, and constructing a pipe network risk map structure by using a map structure data model; and calling a multi-task reasoning model and a rule component based on the atlas, and performing risk type reasoning and grade judgment to obtain a risk assessment result and a strategy updating record. According to the invention, intelligent fusion of multi-source data and closed-loop optimization based on machine learning can be realized, and intelligence and reliability of pipeline safety management are effectively enhanced.

The invention relates to the technical field of artificial intelligence, can be applied to business scenes of financial science and technology, medical health and the like, and discloses a multi-modal content compliance auditing method, device, equipment and medium, and the method comprises the steps: receiving a multi-modal content set, and generating to-be-audited content; converting the multi-source content into unified semantic representation through an analysis unit; calling the judgment model based on the auditing strategy library and the configured auditing engine to perform semantic comparison, and generating an auditing processing result; outputting an abnormal level result according to the processing result; a rectification suggestion is generated and pushed based on the abnormal level result, and feedback data is received at the same time; recording feedback data and auditing tracking records, and generating a compliance data view and an auditing conclusion; and updating the auditing strategy library and the configured auditing engine according to the feedback data. According to the method, cross-modal check is realized through unified semantic representation, the check flexibility is improved in combination with a strategy library and a configuration engine, rectification and feedback are driven by using an abnormal level result, and the accuracy and efficiency of compliance check are improved.

The invention provides a context compression method based on multi-round dialogue intention graph construction, which comprises the following steps: S1, dialogue data acquisition and preprocessing: carrying out natural language processing on each dialogue unit; s2, intention atlas construction is achieved through node design and edge design, and each node comprises original text content and structured semantic information; s3, carrying out context compression and graph structure cutting, and only retaining sub-graphs forming a core semantic link; s4, dynamic context management and topic jump processing: in a multi-topic dialogue, when a user jumps or switches to a new topic, a system records a sub-graph of a current active topic, and contextual nodes of an inactive topic are frozen; s5, context sequence generation and model input: linearizing node contents in the cut sub-graph according to a dependent link sequence to generate a compressed context sequence, and transmitting the context sequence and current user input to a large language model for reasoning; and S6, continuous updating and feedback optimization are carried out.

The invention relates to the technical field of base frame operation and maintenance, can be applied to business scenes such as financial science and technology and medical health, and discloses a context object-driven patch processing method, device, equipment and medium, and the method comprises the steps: extracting an equipment attribute identifier, an operation state identifier and a routing path identifier from an operation environment of target equipment to generate a context object, creating a patch definition, verifying the patch definition in a security sandbox, submitting and approving the patch definition to form a patch version identifier, configuring an environment isolation condition in combination with an effective range, issuing a patch execution instruction carrying the patch version identifier, the environment isolation condition and a hook definition, triggering patch script application repair logic, and calling a cache cleaning tool to process a resource cache. And collecting logs and indexes to generate a monitoring record, and executing rollback or off-shelf operation based on the monitoring record to finish the patch task. Through combination of dynamic patch definition, instruction issuing and version management, safe distribution of front-end patches is realized, and the stability and maintainability of the system are improved.

A computer-implemented method for automated review of quality records is disclosed as including the steps of operating a computer to access a plurality of electronic quality records; normalizing at least one electronic quality record of the plurality of electronic quality records to facilitate computer analysis thereof; sorting all electronic quality records into a predefined plurality of electronic quality record categories; operating the computer to automatically review at least some of the electronic quality records in at least some of the plurality of electronic quality record categories using a plurality of predefined sets of quality rules and logic, wherein each electronic quality record category is associated with a corresponding set of quality rules and logic; and classifying every reviewed electronic quality record as acceptable or not acceptable.

The embodiment of the invention relates to the technical field of data analysis, in particular to a national secret log auditing system which is characterized in that firstly, an operation behavior record sequence generated in the running process of a national secret application system is collected by the national secret log auditing system, and the sequence is composed of log entries containing identity verification information, resource access path information and state transition description information; performing context semantic association analysis on the operation behavior record sequence to obtain a semantic element extraction result and a semantic dependency relationship; then performing multi-level compliance verification based on a national secret security audit rule system, and generating a compliance judgment conclusion of a log entry level and a cross-entry-level abnormal behavior pattern recognition report; and finally, according to the judgment conclusion and the identification report, constructing a national secret log security auditing result set which comprises a risk level evaluation result, a violation evidence chain association graph and a security reinforcement strategy suggestion list, thereby effectively improving the accuracy and comprehensiveness of national secret log auditing.

The invention relates to the technical field of equipment full-life-cycle management, in particular to an equipment full-life-cycle tracing and management and control system based on digital threads. Comprising a digital thread generation unit which is used for generating a dynamic digital thread penetrating through the whole life cycle of technical improvement purchasing, operation maintenance and decommissioning of equipment; a full life cycle data integration unit; and a business process management and control unit. According to the method, a dynamic digital thread which runs through the whole life cycle of technical improvement purchasing, operation overhaul and decommissioning of equipment is constructed, and a multi-dimensional data anchoring algorithm fused with weighted Bayesian estimation is combined, so that probabilistic association matching between heterogeneous physical data in each stage and a corresponding physical scene is realized; and a unique device identifier is bound to form dynamic association of physical state-data record-time node, so that the problems of fragmentation of data in the whole life cycle of the device and lack of association between the data and a physical scene in the prior art are solved.

The invention belongs to the field of data processing, and particularly discloses a method and system for automatically generating a document according to a template and structured data, and the method comprises the steps: processing an archive template file according to a document object model analysis method, extracting the position, the type and the associated tag of a placeholder, and obtaining a placeholder metadata set; according to the placeholder metadata set, traversing a document hierarchical nesting relationship by adopting a depth-first search algorithm to obtain a hierarchical placeholder mapping table; obtaining the structured data of the document repair record through an external data source, judging whether the structured data field corresponds to the tag in the mapping table according to the hierarchical placeholder mapping table, and if so, generating a matching pair list from the field to the placeholder to obtain a preliminary matching data set; the objective of the invention is to solve the problem of a business scene in which complex nested data and file template placeholders cannot be accurately matched in a document repair record in the prior art.

The invention discloses a product full-life-cycle traceability after-sales service system based on multi-source heterogeneous data, and relates to the technical field of product traceability after-sales management. Manufacturing resumes, work orders, spare part warehouse-in and warehouse-out and equipment logs are accessed, mapping of product instances, parts and software primary keys is established, and the product traceability after-sales service system is established. And normalizing the configuration change event into a configuration change event containing double time axes of effective time and warehousing time, and writing the configuration change event carrying differential operation, an evidence packet and an idempotent event identifier into an immutable event library. And constructing a conflict set for the same configuration target, executing uniqueness, causality and compatibility constraint verification, determining an effective event based on evidence packet arbitration, and outputting an arbitration record and confidence. And deriving a configuration version chain according to the effective event and generating a snapshot, performing incremental playback on the late or error correction event and generating an influence propagation list. And when any time point configuration is queried, playback restoration is performed, an evidence chain and confidence are output, an active verification backflow error correction event is triggered if the confidence is insufficient, and the accuracy of quality guarantee judgment and spare part matching is improved.

The invention relates to the technical field of computers, and discloses a chip mounter material tracing management method and system based on a knowledge graph. The method comprises the following steps: constructing a dynamic knowledge graph covering the whole process of a patch; injecting multi-source data in real time to drive dynamic updating of the atlas; when the materials are abnormal, reverse tracing and forward influence double-path reasoning are started; isolation, rework and reset instructions are automatically generated and pushed to a manufacturing execution system; and synchronously updating the atlas state to form an auditable record. The system comprises a dynamic knowledge graph construction module, a real-time data injection module, a bidirectional inference engine module, an automatic processing instruction generation module and a graph state synchronization module. According to the scheme, millisecond-level error positioning and closed-loop processing are realized, and the tracing efficiency and the quality guarantee capability are improved.

The invention discloses an intelligent data query system and method based on natural language processing, and relates to the technical field of natural language processing and database query. According to the method, natural language input and database mode information are received, a historical query log is combined to construct mode knowledge representation, a query skeleton is generated on the basis, a fine-tuned large language model is called to generate candidate SQL statements, error detection and ambiguity recognition are carried out on the candidate statements, and the query result is obtained. And if necessary, triggering interaction clarification and updating a query result according to user feedback. And meanwhile, the wrong clauses are locally repaired through a gating mechanism, and the clauses are returned and regenerated when multiple times of repair fails, so that the correctness of the query statement is ensured. And finally, after the SQL is executed in the database, a result is fed back to the user. Besides, the system records generation and repair tracks in the operation process, and continuously optimizes the model based on reward shaping, comparative learning and self-game training, so as to improve the generalization ability in different business scenes.

The invention relates to a man-machine interaction dialogue method, system and device based on a natural language and a medium. The method comprises the steps that firstly, multi-modal interaction data is acquired and preprocessed, and segmented words and syntax are analyzed through a natural language processing technology to construct intention feature vectors; combining the intention feature vector with a historical dialogue record, and using a pre-trained language model to generate context semantic elements containing a semantic relationship; if the context semantic elements are matched with the preset scene feature library information, predicting a user intention change trend by adopting a reinforcement learning model to obtain an intention prediction result; and finally, evaluating user intention change based on an intention prediction result, extracting associated domain knowledge by utilizing a knowledge graph if significant change occurs, and inputting the associated domain knowledge into a dialogue generation model to obtain a natural language reply sequence. According to the method, the understanding precision of the user intention is improved, the dynamic prediction of the intention change is realized, the relativity and coherence of reply are guaranteed, and a more efficient processing path is provided for natural language man-machine interaction.

System and methods are disclosed for providing unforgeable telemetry on computer platforms. Mathematical modeling and theorem proving are utilized to guarantee the integrity of telemetry probe execution flow and trigger, thereby preventing circumvention and tampering of logged probe data. In contrast to current state-of-the-art solutions that rely implicitly on the operating environment, this approach provides a sound and complete assurance of telemetry output. The system enables organizations to map unforgeable telemetry probe data to industry and government cybersecurity regulatory controls, ensuring compliance therewith. This invention addresses the shortcomings of existing solutions, including their vulnerability to sophisticated attacks, operational complexity, and inability to provide unforgeable telemetry data, thereby providing a reliable and accurate monitoring output in the presence of cyberattacks on computer platforms.

The invention belongs to the technical field of artificial intelligence and information retrieval, and provides a multi-modal retrieval method and system based on a lightweight knowledge graph and an index table, and the method comprises the steps: obtaining multi-modal source data, and extracting a structured semantic tag set; constructing a lightweight knowledge graph and a metadata index table; analyzing a natural language query input by a user to obtain a semantic query vector and a keyword set, executing semantic retrieval in the knowledge graph to obtain a text candidate result, and executing keyword matching in the metadata index table to obtain a non-text candidate result; for each non-text meta record, fusing the cross-modal similarity between the non-text meta record and the text candidate result, performing index matching on an original score and a graph semantic evidence score, calculating a comprehensive correlation score, and performing reordering; and generating a natural language answer containing a non-text record link according to a reordering result. The method is suitable for efficient cross-modal knowledge retrieval in a high-security and low-resource scene.

The invention relates to the technical field of communication, and discloses a communication state monitoring management method and system. The method comprises the following steps: acquiring a transmission data packet in a communication network in real time, extracting protocol header information and load content of the data packet, and generating an original monitoring data sequence containing a protocol type, a timestamp and load characteristics; and performing multi-dimensional correlation analysis on the original monitoring data sequence, identifying a logical relationship between protocol header information and load content, detecting an abnormal correlation mode, and generating an abnormal event mark set with a confidence score. And constructing an adaptive behavior model based on the original monitoring data sequence and the abnormal event mark set, and capturing normal behavior characteristics of the communication network by dynamically updating model parameters. Transmitting data packets collected in real time are input into the self-adaptive behavior model for deviation degree calculation, abnormal data packets exceeding a deviation threshold value are screened out, and historical abnormal event mark sets are associated to generate abnormal context records.