CN-121984838-A - Sequential alarm dynamic association system for multi-source heterogeneous sensing gateway

CN121984838ACN 121984838 ACN121984838 ACN 121984838ACN-121984838-A

Abstract

The invention relates to the technical field of edge calculation and data processing of the Internet of things and discloses a time sequence alarm dynamic association system for a multi-source heterogeneous sensing gateway, which comprises the steps of firstly analyzing a received double-source original alarm message into a fidelity event sequence with a life cycle, and mapping a gateway time axis into an event progress axis; the method comprises the steps of carrying out cross-source unidirectional matching on an event progress axis to generate a matching path, calculating time difference variation according to the time difference variation, extracting a double-source time delay turn-back index, carrying out bidirectional compensation on the observed time difference and the registration time in the matching path by utilizing the index to obtain a corrected matching path, finally aggregating alarm tag pairs on the corrected matching path to generate a cross-source dynamic association weight, converting the cross-source dynamic association weight into a directed acyclic graph, solving a maximum weight chain, and outputting an active dynamic association chain. The invention effectively solves the problem of causal inversion caused by the difference between the multi-time base and the gateway internal path, and realizes accurate and stable cross-source alarm dynamic association.

Inventors

WANG JINGYU
CAO JINGANG

Assignees

圣麦克思智能科技(江苏)有限公司

Dates

Publication Date: 20260505
Application Date: 20260408

Claims (8)

1. The time sequence alarm dynamic association system for the multi-source heterogeneous sensing gateway is characterized by comprising the following components: the event analysis module is used for receiving the double-source original notice alarm message and converting the double-source original notice alarm message into a fidelity event sequence with a life cycle identifier; the rhythm mapping module is used for calculating the intra-source reporting rhythm of the fidelity event sequence and mapping a gateway time axis into an event progress axis; The cross-source matching module is used for performing cross-source unidirectional matching on the fidelity event sequence on the event progress axis to generate a cross-source matching path; The deviation analysis module is used for calculating the cross-source time difference variation on the cross-source matching path and extracting a double-source time delay turn-back index according to the cross-source time difference variation; The time scale correction module is used for performing bidirectional compensation on the observation time difference and the gateway record time stamp extracted from the cross-source matching path according to the double-source time delay turn-back index to obtain a corrected matching path; the association diagram generation module is used for aggregating alarm tag pairs on the corrected matching paths based on the abnormal category tags contained in the fidelity event sequence so as to inhibit errors and generate cross-source dynamic association weights; and the link output module is used for converting the cross-source dynamic association weight into a directed acyclic graph, solving the maximum weight chain in the directed acyclic graph and outputting an active dynamic association chain.
2. The multi-source heterogeneous sensing gateway-oriented time series alarm dynamic association system of claim 1, wherein receiving a dual source original notification alarm message and converting the dual source original notification alarm message into a sequence of fidelity events with lifecycle identification comprises: respectively extracting a source node identifier, an abnormal category label, a gateway record timestamp and a life cycle identifier in the double-source original alarm message, and combining to generate a plurality of normalized alarm events; under the condition of not carrying out cross-source data merging, independently sequencing the plurality of normalized alarm events based on the source node identification to form the fidelity event sequence with independent state reserved; Selecting current normalized alarm events one by one from the fidelity event sequence, and searching homologous pre-events corresponding to the current normalized alarm events in the fidelity event sequence; and calculating the difference value between the gateway record time stamp of the current normalized alarm event and the gateway record time stamp of the homologous pre-event to obtain a homologous adjacent trigger interval.
3. The multi-source heterogeneous sensing gateway-oriented time series alarm dynamic association system of claim 2, wherein calculating the in-source reporting rhythm of the fidelity event sequence and mapping the gateway timeline to an event progress axis comprises: extracting all homologous adjacent trigger intervals from the fidelity event sequence; calculating the median of all the homologous adjacent triggering intervals to obtain a self-adaptive rhythm adjustment scale; calculating the intra-source local rhythm intensity of the fidelity event sequence at each current normalized alarm event based on the adaptive rhythm adjustment scale, the homologous adjacent trigger interval and the corresponding gateway record timestamp; Calculating the median of all the local rhythm intensities in the source to obtain the median of the local rhythm intensities in the source; Accumulating the products of the local intra-source rhythm intensities corresponding to the current normalized alarm events and the homologous adjacent triggering intervals to obtain intra-source event progress coordinates; Mapping a gateway timeline to the event progress axis is accomplished based on the in-source event progress coordinates.
4. The multi-source heterogeneous sensing gateway-oriented time series alarm dynamic association system of claim 3, wherein cross-source unidirectional matching is performed on the event progress axis for the fidelity event sequence, and generating a cross-source matching path comprises: Constructing an intra-source normalized morphology vector based on the homologous adjacent trigger interval, the adaptive rhythm adjustment scale, the intra-source local rhythm intensity median, and the lifecycle identification; calculating absolute difference values of the event progress coordinates in the sources between the double sources and Euclidean distances of the normalized morphology vectors in the sources between the double sources, and taking the sum of calculation results of the absolute difference values and the Euclidean distances as cross-source event matching cost; Calculating accumulated matching cost by utilizing a unidirectional dynamic programming algorithm based on the cross-source event matching cost; And carrying out path backtracking according to the minimum value of the accumulated matching cost, obtaining an optimal unidirectional matching node sequence, and generating the cross-source matching path.
5. The multi-source heterogeneous sensing gateway-oriented timing alert dynamic correlation system of claim 4, wherein calculating a cross-source time difference variation on the cross-source matching path and extracting a dual-source time delay foldback indicator according to the cross-source time difference variation comprises: Calculating the difference value between the gateway record time stamps of the matched nodes on the optimal unidirectional matching node sequence to obtain a matching node source-crossing time record difference value, and taking the matching node source-crossing time record difference value as the observation time difference; Calculating the average value of the event progress coordinates in the source of the matched node to obtain the average progress coordinates of the matched node; Calculating the square root of the product of the local rhythm intensities in the source of the matched node to obtain the local rhythm weight of the matched node; Based on the difference value of the cross-source time records of the matching nodes and the average progress coordinates of the matching nodes, respectively calculating a first-order change rate of the cross-source time difference and a second-order change rate of the cross-source time difference; Weighting, summarizing and calculating the first-order change rate of the cross-source time difference and the second-order change rate of the cross-source time difference by using the local rhythm weight of the matching node to respectively obtain the evolution bending degree of the cross-source time difference and the symbol turnover density of the change rate; And performing associated calculation on the cross-source time difference evolution bending degree and the change rate symbol flip density, and extracting the double-source time delay turn-back index.
6. The multi-source heterogeneous sensing gateway-oriented time sequence alarm dynamic association system according to claim 5, wherein according to the dual-source delay turn-back index, bidirectional compensation is performed on the observed time difference and the registration time in the cross-source matching path, so as to obtain a corrected matching path, and the method comprises the following steps: combining the cross-source time record difference value of the matching node and the local rhythm weight of the matching node into a cross-source record difference vector and a local rhythm weight diagonal matrix respectively; constructing a discrete second-order differential matrix based on the node length of the optimal unidirectional matching node sequence; Calculating a self-adaptive smooth adjustment coefficient based on the double-source time delay turn-back index, the absolute value median of the difference value of the cross-source time record of the matching node and the absolute value median of the first-order change rate of the cross-source time difference; carrying out smooth solving on the cross-source record difference vector by utilizing the local rhythm weight diagonal matrix, the self-adaptive smooth adjustment coefficient and the discrete second-order difference matrix to obtain a rebound delay compensation vector; And taking each component in the rebound delay compensation vector as rebound delay compensation quantity, executing symmetrical increase and decrease half-amplitude correction on the gateway record timestamp by utilizing the rebound delay compensation quantity to obtain a bidirectional compensated record timestamp, and generating the corrected matching path according to the bidirectional compensated record timestamp.
7. The multi-source heterogeneous sensing gateway-oriented time series alarm dynamic correlation system of claim 6, wherein aggregating alarm tag pairs on the corrected matching path to suppress errors and generate cross-source dynamic correlation weights comprises: extracting the abnormal category labels corresponding to the matching nodes on the corrected matching paths, and constructing a label pair matching index set by using the abnormal category labels; based on the difference value between the bidirectional compensated record timestamps of each node in the label pair matching index set, respectively calculating a label pair center lag time difference and a label pair lag discrete scale; performing aggregation index weighting calculation by using the local rhythm weight of the matching node, the tag-to-center lag time difference and the tag-to-lag discrete scale to obtain tag-to-aggregate association strength; Calculating the ratio of the tag pair lag discrete scale to the absolute value of the tag pair center lag time difference to obtain a relative discrete ratio; and performing exponential decay penalty calculation on the tag pair aggregation association strength by using the dual-source time delay turn-back index and the relative discrete ratio to generate the cross-source dynamic association weight.
8. The multi-source heterogeneous sensing gateway-oriented time sequence alarm dynamic association system of claim 7, wherein converting the cross-source dynamic association weights into a directed acyclic graph, and solving a maximum weight chain in the directed acyclic graph, outputting an active state association chain, comprises: calculating the median of the bidirectional compensated record time stamp under each abnormal category label to obtain the central time of the abnormal category label; determining the pointing relation between the abnormal category labels according to the positive and negative signs of the delay time difference of the labels to the center, and constructing the directed acyclic graph by taking the cross-source dynamic association weight as the weight of the connecting edge; In the directed acyclic graph, calculating the maximum accumulated weight of each node based on the cross-source dynamic association weight, and synchronously recording the optimal precursor node of each node; Selecting a node corresponding to the maximum value in the maximum accumulated weight as a main chain termination node; And starting from the main chain termination node, performing reverse backtracking extraction along the optimal precursor node to obtain the active state association chain.

Description

Sequential alarm dynamic association system for multi-source heterogeneous sensing gateway Technical Field The invention relates to the technical field of edge calculation and data processing of the Internet of things, in particular to a time sequence alarm dynamic association system oriented to a multi-source heterogeneous sensing gateway. Background With the deep evolution of the internet of things and edge computing, gateway equipment is not only a simple protocol conversion hub, but also a core node which is used for simultaneously bearing compound tasks such as multi-protocol access, unified data management, edge reasoning, time-space registration and the like. In complex scenarios such as industrial continuous processes or infrastructure edge stations, the same edge gateway typically needs to access sensing sources of different systems simultaneously. For example, access to both an industrial bus-aware network with a preference for rhythms that are continuous and dense and a wireless environment-aware network with a preference for sparse and bursty forms. The existing asynchronous multi-sensor research shows that different sensing sources naturally have different and variable sampling periods, unknown deviation exists between time stamps and objective real measurement moments, and clock offset and skew can continuously influence event sequencing in a system. At the same time, current industrial alarm research is mainly focused on correlation pattern mining, sequence realignment under random time delays, and local hysteresis analysis. The prior art generally has the technical scheme that the original alarm logs converged to the gateway are directly subjected to time scale alignment, so that correlation, similarity or causal modeling is developed. However, in a dual source heterogeneous scenario, alarms from different sensing sources, even though they correspond to the same objective anomaly's front propagation, experience quite different protocol conversion links, buffer queuing mechanisms, and task scheduling paths after they enter the gateway. In the alarm flooding or abnormal burst stage, factors such as shared computation preemption, queue emptying and wireless side compensation transmission in the gateway are mutually overlapped, so that a very hidden phenomenon is caused, namely, two adjacent groups of cross-source related alarms which keep approximately stable time difference have local overturning of the precedence relationship on the gateway record time axis. This phenomenon is not a generic pure data delay or static clock dyssynchrony, but a cross-source phase rollback alarm causal inversion. The existing time sequence alarm processing scheme can not identify and process local sequencing disorder caused by the dual-path queuing difference in the gateway, when a system tries to answer the front-back association triggered by abnormality, the local overturn can directly pollute the association edge, the propagation chain and the final main alarm identification result, so that abnormal tracing misalignment under the complex working condition is caused. Therefore, how to eliminate the hidden causal inversion phenomenon and realize the reliable cross-source time sequence alarm dynamic association becomes a technical bottleneck to be solved currently. Disclosure of Invention The invention provides a time sequence alarm dynamic association system for a multi-source heterogeneous sensing gateway, which solves the technical problems in the background technology. The invention provides a time sequence alarm dynamic association system oriented to a multi-source heterogeneous sensing gateway, which comprises the following components: the event analysis module is used for receiving the double-source original notice alarm message and converting the double-source original notice alarm message into a fidelity event sequence with a life cycle identifier; the rhythm mapping module is used for calculating the intra-source reporting rhythm of the fidelity event sequence and mapping a gateway time axis into an event progress axis; The cross-source matching module is used for performing cross-source unidirectional matching on the fidelity event sequence on the event progress axis to generate a cross-source matching path; The deviation analysis module is used for calculating the cross-source time difference variation on the cross-source matching path and extracting a double-source time delay turn-back index according to the cross-source time difference variation; The time scale correction module is used for performing bidirectional compensation on the observation time difference and the gateway record time stamp extracted from the cross-source matching path according to the double-source time delay turn-back index to obtain a corrected matching path; the association diagram generation module is used for aggregating alarm tag pairs on the corrected matching paths based on the abnormal category tags contained in the f