TSCM-combined remote steal audio-visual equipment detection method and system

Abstract

The invention discloses a TSCM-combined remote steal audio-visual equipment detection method and system, and relates to the related field of steal audio-visual equipment detection, and the method comprises the steps: carrying out the multi-band scanning of a target region through an RF scanner, and obtaining a first capture signal set; performing adaptive interference compensation according to the multi-band scanning scene feature data to obtain a second capture signal set; performing spectrum analysis according to a plurality of spectrum analyzers, and constructing a characteristic curve of a captured signal of each frequency band; carrying out credible signal feature mining on the target area, constructing a credible signal feature space, inputting the capture signal feature curve of each frequency band, and determining a first result; performing infrared detection compensation according to the first result to obtain a second result; and performing risk evaluation on the second result according to the real-time network traffic log of the target area to obtain a suspicious equipment detection report. The technical problems of low detection accuracy and poor reliability of the existing steal audio-visual equipment are solved, and the technical effect of improving the detection accuracy and reliability is achieved.

Description

Technical Field

[0001] The present application relates to the field of eavesdropping audiovisual equipment detection, and in particular to a remote eavesdropping audiovisual equipment detection method and system in combination with TSCM. Background Art

[0002] TSCM (Technical Reconnaissance Countermeasures) is an important means to ensure information security and prevent illegal surveillance. In many fields such as government and business, the security protection of sensitive information is crucial. Once remote audiovisual equipment illegally steals information, it may lead to serious confidentiality leakage, loss of interests and other consequences. Therefore, it is of great significance to accurately and efficiently detect remote audiovisual equipment. At present, the problem of remote audiovisual equipment detection is mainly solved by the traditional single signal detection method, such as relying only on RF (radio frequency) scanners for simple frequency band scanning detection, or simply using spectrum analyzers to analyze signals. There are many limitations in the single signal detection method. When only using RF scanners for multi-band scanning, due to the complex and changeable detection scenes and the presence of various interference factors, the signals captured by the scan will be inaccurate, resulting in missed detection or false detection; and the use of spectrum analyzers alone for analysis lacks effective identification of credible signals, making it difficult to accurately distinguish normal signals from suspicious signals, and it is impossible to comprehensively evaluate the detection results in combination with the actual network environment, resulting in low accuracy and reliability of the detection results.

[0003] In the current related technologies, remote eavesdropping audiovisual equipment detection has technical problems of low accuracy and poor reliability. Summary of the invention

[0004] The present application provides a remote eavesdropping audiovisual device detection method and system combined with TSCM, which first uses an RF scanner to scan multiple frequency bands of a target area to obtain a first captured signal set, then adaptively compensates for interference based on scene feature data to obtain a second captured signal set, then uses multiple spectrum analyzers to analyze and construct signal feature curves for each frequency band, then mines the target area's credible signal feature construction space and inputs the feature curve to determine a first result of suspicious device detection, then performs infrared detection compensation based on this result to obtain a second result, and finally evaluates the risk of the second result based on a real-time network traffic log to obtain a detection report and other technical means, thereby achieving a technical effect of improving the accuracy and reliability of remote eavesdropping audiovisual device detection.

[0005] The present application provides a method for detecting remote eavesdropping and surveillance devices in combination with TSCM, including: performing multi-band scanning on a target area through an RF scanner to obtain a first capture signal set, where the first capture signal set includes multi-band capture signals; performing adaptive interference compensation on the first capture signal set according to multi-band scanning scenario feature data to obtain a second capture signal set; performing spectrum analysis on the second capture signal set by multiple spectrum analyzers to construct characteristic curves of capture signals for each frequency band; mining characteristic features of trusted signals in the target area to construct a trusted signal feature space, and inputting the characteristic curves of capture signals for each frequency band into the trusted signal feature space to determine a first result of detecting suspicious devices; performing infrared detection compensation according to the first result of detecting suspicious devices to obtain a second result of detecting suspicious devices; and performing risk assessment on the second result of detecting suspicious devices according to the real-time network traffic log of the target area to obtain a detection report of suspicious devices.

[0006] In a possible implementation, when performing adaptive interference compensation on the first capture signal set according to the multi-band scanning scenario feature data to obtain a second capture signal set, the following processing is performed: extracting a first frequency band capture signal and the first frequency band scanning scenario feature data corresponding to the first frequency band capture signal according to the first capture signal set and the multi-band scanning scenario feature data; collecting the state parameters of the RF scanner corresponding to the first frequency band capture signal to obtain first scanning device state information; performing interference coupling analysis on the first frequency band capture signal according to the first frequency band scanning scenario feature data and the first scanning device state information to determine a first interference compensation factor; performing interference compensation on the first frequency band capture signal according to the first interference compensation factor to obtain a first optimized capture signal, and adding the first optimized capture signal to the second capture signal set.

[0007] In a possible implementation, when performing interference coupling analysis on the first frequency band capture signal according to the first frequency band scanning scenario feature data and the first scanning device state information to determine a first interference compensation factor, the following processing is performed: performing anomaly detection on the first frequency band scanning scenario feature data to obtain a first scanning scenario anomaly detection result, and performing interference identification on the first frequency band capture signal according to the first scanning scenario anomaly detection result to obtain a first signal interference identification result; performing anomaly detection on the first scanning device state information to obtain a first scanning device anomaly detection result, and performing interference identification on the first frequency band capture signal according to the first scanning device anomaly detection result to obtain a second signal interference identification result; and performing fusion analysis according to the first signal interference identification result and the second signal interference identification result to generate the first interference compensation factor.

[0008] In a possible implementation manner, spectrum analysis is performed on the second capture signal set by multiple spectrum analyzers to construct capture signal feature curves for each frequency band, and the following processing is performed: spectrum analysis is performed on the first optimized capture signal by the multiple spectrum analyzers to obtain multiple sets of signal spectrum analysis results; credible filtering is performed according to the multiple sets of signal spectrum analysis results to establish a first credible space for spectrum analysis; data fusion is performed according to the first credible space for spectrum analysis to obtain a first credible result for spectrum analysis; according to the first credible result for spectrum analysis, a capture signal feature curve for the first frequency band is constructed, and the capture signal feature curve for the first frequency band is added to the capture signal feature curves for each frequency band.

[0009] In a possible implementation manner, credible filtering is performed according to the multiple sets of signal spectrum analysis results to establish a first credible space for spectrum analysis, and the following processing is performed: when the multiple spectrum analyzers perform spectrum analysis on the first optimized capture signal, state parameters of the multiple spectrum analyzers are collected in real time to obtain multiple analyzer monitoring sequences; anomaly detection is performed according to the multiple analyzer monitoring sequences to determine multiple analyzer state anomaly coefficients; it is determined whether the multiple analyzer state anomaly coefficients are less than a predetermined state anomaly coefficient to obtain multiple analyzer state judgment results; filtering and cleaning are performed on the multiple sets of signal spectrum analysis results according to the multiple analyzer state judgment results to generate the first credible space for spectrum analysis.

[0010] In a possible implementation manner, credible signal feature mining is performed on the target area to construct a credible signal feature space, and the following processing is performed: signal feature sample retrieval is performed on each credible device in the target area to obtain multiple device signal feature sample sets; according to the multiple device signal feature sample sets, a first device signal feature sample set is extracted; confidence evaluation is performed on each signal feature sample in the first device signal feature sample set to obtain each feature sample confidence coefficient; optimization screening is performed on the first device signal feature sample set according to the each feature sample confidence coefficient to generate a first confidence signal feature sample set that meets a predetermined confidence coefficient; according to the first confidence signal feature sample set, a first credible signal feature curve is constructed, and the first credible signal feature curve is added to the credible signal feature space.

[0011] In a possible implementation, input the captured signal feature curves of each frequency band into the credible signal feature space to determine the first result of suspicious device detection, and perform the following processing: According to each credible signal feature curve in the credible signal feature space, perform a twin comparison on the captured signal feature curve of the first frequency band respectively to obtain the first captured signal feature twin evaluation matrix; perform a maximum value screening on the first captured signal feature twin evaluation matrix to determine the first captured signal credibility coefficient; determine whether the first captured signal credibility coefficient is less than the captured signal credibility threshold; if the first captured signal credibility coefficient is less than the captured signal credibility threshold, trace the device for the captured signal feature curve of the first frequency band to determine the first suspicious device, and add the first suspicious device to the first result of suspicious device detection.

[0012] In a possible implementation, perform infrared detection compensation according to the first result of suspicious device detection to obtain the second result of suspicious device detection, and perform the following processing: Scan the target area with an infrared thermal imager to obtain the regional infrared thermal image; identify suspicious devices in the regional infrared thermal image according to the reference thermal image of the credible devices in the target area to obtain the infrared suspicious device detection result; compensate the first result of suspicious device detection according to the infrared suspicious device detection result to generate the second result of suspicious device detection.

[0013] In a possible implementation, perform a risk assessment on the second result of suspicious device detection according to the real-time network traffic log of the target area to obtain a suspicious device detection report, and perform the following processing: Perform an associated capture on the real-time network traffic log according to the second result of suspicious device detection to obtain the associated logs of each suspicious device; input the associated logs of each suspicious device into a risk assessment model to obtain the risk coefficients of each suspicious device; organize the second result of suspicious device detection, the associated logs of each suspicious device, and the risk coefficients of each suspicious device to generate the suspicious device detection report.

[0014] The present application also provides a remote eavesdropping and video surveillance device detection system combined with TSCM, including: a multi-band scanning module for performing multi-band scanning on a target area through an RF scanner to obtain a first capture signal set, the first capture signal set including multi-band capture signals; an adaptive interference compensation module for adaptively compensating the first capture signal set according to multi-band scanning scenario feature data to obtain a second capture signal set; a spectrum analysis module for performing spectrum analysis on the second capture signal set according to multiple spectrum analyzers to construct capture signal feature curves for each band; a suspicious device detection module for mining trusted signal features in the target area, constructing a trusted signal feature space, and inputting the capture signal feature curves for each band into the trusted signal feature space to determine a first suspicious device detection result; an infrared detection compensation module for performing infrared detection compensation according to the first suspicious device detection result to obtain a second suspicious device detection result; and a risk assessment module for performing risk assessment on the second suspicious device detection result according to the real-time network traffic log of the target area to obtain a suspicious device detection report.

[0015] It is intended to first perform multi-band scanning on a target area through an RF scanner by the remote eavesdropping and video surveillance device detection method and system combined with TSCM proposed in the present application to obtain a first capture signal set, the first capture signal set including multi-band capture signals, then adaptively compensate the first capture signal set according to multi-band scanning scenario feature data to obtain a second capture signal set, then perform spectrum analysis on the second capture signal set according to multiple spectrum analyzers to construct capture signal feature curves for each band, then mine trusted signal features in the target area, construct a trusted signal feature space, and input the capture signal feature curves for each band into the trusted signal feature space to determine a first suspicious device detection result, then perform infrared detection compensation according to the first suspicious device detection result to obtain a second suspicious device detection result, and finally perform risk assessment on the second suspicious device detection result according to the real-time network traffic log of the target area to obtain a suspicious device detection report. The technical effect of improving the accuracy and reliability of remote eavesdropping and video surveillance device detection is achieved. Brief Description of the Drawings

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings of the embodiments of the present invention will be briefly introduced below. Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the operations before or below do not necessarily need to be executed precisely in sequence. On the contrary, according to needs, they can be executed in reverse order or simultaneously. At the same time, other operations can also be added to these processes, or one or several operations can be removed from these processes.

[0017] Figure 1Schematic flowchart of the remote eavesdropping and video surveillance device detection method combined with TSCM provided by an embodiment of the present application.

[0018] Figure 2 Schematic structural diagram of the remote eavesdropping and video surveillance device detection system combined with TSCM provided by an embodiment of the present application.

[0019] Description of reference numerals: multi-band scanning module 10, adaptive interference compensation module 20, spectrum analysis module 30, suspicious device detection module 40, infrared detection compensation module 50, risk assessment module 60. Detailed implementation manners

[0020] The above description is only an overview of the technical solution of the present application. In order to understand the technical means of the present application more clearly, it can be implemented according to the content of the description. And in order to make the above and other purposes, features and advantages of the present application more obvious and understandable, the following specifically gives the detailed implementation manners of the present application.

[0021] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations of the present application. All other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the protection scope of the present application.

[0022] In the following description, "some embodiments" are involved, which describe a subset of all possible embodiments. However, it can be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. The terms "first\second" involved are only used to distinguish similar objects and do not represent a specific order for the objects. The terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or server including a series of steps or units does not necessarily have to be limited to those clearly listed steps or units, but may include other steps or modules not clearly listed or inherent to these processes, methods, products or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application.

[0023] An embodiment of the present application provides a remote eavesdropping and video surveillance device detection method combined with TSCM, as Figure 1 shown, the method includes: Step S100, performing multi-band scanning on a target area through an RF scanner to obtain a first capture signal set, where the first capture signal set includes multi-band capture signals.

[0024] Specifically, an RF scanner, that is, a radio frequency scanner, is a device used to detect and analyze radio signals. By transmitting and receiving radio frequency signals, it scans a target area to obtain characteristic information such as the frequency, intensity, and phase of the signals. This device can cover a wide frequency range, from low frequencies (such as dozens of kHz) to high frequencies (such as the GHz level). The RF scanner scans the target area by transmitting and receiving radio frequency signals. During the scanning process, the scanner gradually changes the transmission frequency according to a preset frequency step value, and at the same time records the signal intensity and characteristics at each frequency point. The RF scanner is equipped with a highly sensitive antenna for receiving radio signals within the target area. The signal processing unit inside the scanner performs a fast Fourier transform (FFT) on the received signals, converting the time-domain signals into frequency-domain signals, thereby obtaining the signal intensity and phase information at different frequency points. These signal data are stored as the first captured signal set for subsequent processing.

[0025] For example, the RF scanner can be set to scan within the frequency band range of 100 MHz to 3 GHz, with a frequency step of 1 MHz. The scanner stays at each frequency point for a certain period of time (such as 10 ms) and records the signal intensity and phase information at that frequency point. Finally, the first captured signal set contains one signal intensity and phase data point every 1 MHz within the range from 100 MHz to 3 GHz.

[0026] Step S200, perform adaptive interference compensation on the first captured signal set according to the multi-band scanning scenario characteristic data to obtain a second captured signal set.

[0027] Specifically, adaptive interference compensation is a signal processing technique used to eliminate or reduce the influence of background interference signals on the target signal. This technique is based on an adaptive filter and adjusts the parameters of the filter in real time to adapt to different interference environments. First, the system collects the characteristic data of the multi-band scanning scenario, including the background noise level, the frequency distribution and intensity of the interference signals, etc. Then, using these characteristic data, the weights of the filter are adjusted through an adaptive algorithm (such as the least mean square error algorithm LMS or the recursive least squares algorithm RLS) to minimize the influence of the interference signals. In specific implementation, each signal component in the first captured signal set can be processed through the adaptive filter to obtain the compensated signal component, and finally form the second captured signal set.

[0028] For example, assume that during the scanning process, a strong interference signal is found in the background, with a frequency of 1.5 GHz and an intensity of -30 dBm. Through the adaptive interference compensation algorithm, the system will adjust the filter parameters so that the signal components near 1.5 GHz are appropriately attenuated, thereby reducing the influence of the interference signal. After compensation, the signal intensity near 1.5 GHz in the second captured signal set will be closer to the true target signal intensity.

[0029] In a possible implementation, adaptive interference compensation is performed on the first capture signal set according to the multi-band scanning scenario feature data to obtain a second capture signal set. Step S200 further includes step S210 of extracting a first-band capture signal and the corresponding first-band scanning scenario feature data according to the first capture signal set and the multi-band scanning scenario feature data. Specifically, signals in a specific frequency band (such as 1.4 GHz to 1.6 GHz) are screened out from the first capture signal set, and at the same time, the scanning scenario feature data corresponding to this frequency band is extracted, including background noise level, interference signal distribution, etc. For example, the first capture signal set covers a frequency band from 100 MHz to 3 GHz, and through signal processing algorithms, signals in the 1.4 GHz to 1.6 GHz frequency band and their feature data are extracted.

[0030] Step S220: Collect the state parameters of the RF scanner corresponding to the first-band capture signal to obtain the first scanning device state information. Specifically, record the working state parameters of the RF scanner when scanning the first frequency band, such as antenna gain, scanning step, scanning speed, etc. For example, when the RF scanner scans the 1.4 GHz to 1.6 GHz frequency band, the antenna gain is 20 dB, the scanning step is 100 kHz, and the scanning speed is 100 MHz per second.

[0031] Step S230: Perform interference coupling analysis on the first-band capture signal according to the first-band scanning scenario feature data and the first scanning device state information to determine a first interference compensation factor. Specifically, use an adaptive filter algorithm (such as the LMS algorithm), combine the scanning scenario feature data and the device state information, and calculate the interference compensation factor. This factor is used to adjust the weights of the filter to minimize the influence of interference signals. For example, through the LMS algorithm, according to the background noise level and the antenna gain of the RF scanner, the first interference compensation factor is calculated to be 0.0002.

[0032] Step S240: Perform interference compensation on the first-band capture signal according to the first interference compensation factor to obtain a first optimized capture signal, and add the first optimized capture signal to the second capture signal set. Specifically, pass the first-band capture signal through an adaptive filter, use the first interference compensation factor to adjust the signal, remove the interference components, and obtain an optimized signal. For example, after being processed by the adaptive filter, the signal interference in the 1.4 GHz to 1.6 GHz frequency band is effectively reduced, the signal quality is significantly improved, and the optimized signal is added to the second capture signal set. Through adaptive interference compensation, the influence of background noise and interference signals on the target signal is effectively reduced, making the detection of suspicious devices more accurate.

[0033] In a possible implementation, interference coupling analysis is performed on the first-band capture signal according to the first-band scanning scenario feature data and the first scanning device status information to determine a first interference compensation factor. Step S230 further includes step S231 of performing anomaly detection on the first-band scanning scenario feature data to obtain a first scanning scenario anomaly detection result, and performing interference identification on the first-band capture signal according to the first scanning scenario anomaly detection result to obtain a first interference identification result of the signal. Specifically, statistical analysis or machine learning methods, such as clustering analysis, support vector machines, etc., are used to analyze the first-band scanning scenario feature data to detect whether there are abnormal features. According to the anomaly detection result, the characteristics of the interference signal, such as frequency, intensity, phase, etc., are identified. For example, assuming that in the first-band scanning scenario feature data, the background noise level suddenly increases, and this anomaly is discovered through the anomaly detection algorithm, and then the frequency of the interference signal is identified as 1.5 GHz and the intensity is -20 dBm.

[0034] Step S232: Perform anomaly detection on the first scanning device status information to obtain a first scanning device anomaly detection result, and perform interference identification on the first-band capture signal according to the first scanning device anomaly detection result to obtain a second interference identification result of the signal. Specifically, the status parameters of the RF scanner (such as antenna gain, scanning step, scanning speed, etc.) are monitored in real time to detect whether there are anomalies. According to the anomaly detection result, the interference signal caused by the abnormal device status is identified. For example, assuming that the antenna gain of the RF scanner suddenly drops, and this anomaly is discovered through the anomaly detection algorithm, and then the characteristics of the interference signal caused thereby are identified.

[0035] Step S233: Perform fusion analysis according to the first interference identification result of the signal and the second interference identification result of the signal to generate the first interference compensation factor. Specifically, the two interference identification results are fused to comprehensively consider the influence of the scanning scenario and the device status on the interference. Through an adaptive filter algorithm (such as the LMS algorithm), the first interference compensation factor is calculated according to the fused interference characteristics. For example, assuming that the first interference identification result of the signal is a frequency of 1.5 GHz and an intensity of -20 dBm, and the second interference identification result of the signal is the interference caused by the drop in antenna gain, the first interference compensation factor generated after fusion analysis is 0.0002. By separately performing anomaly detection and interference identification on the scanning scenario feature data and the scanning device status information, the sources and characteristics of the interference signal can be more comprehensively identified, thereby improving the reliability of the detection system.

[0036] Step S300: Perform spectrum analysis on the second capture signal set according to multiple spectrum analyzers to construct the characteristic curves of the capture signals in each frequency band.

[0037] Specifically, a spectrum analyzer is used to measure the spectral characteristics of a signal, decompose the signal into different frequency components, and display its amplitude and phase information. Multiple spectrum analyzers are used to analyze the second captured signal set, with each spectrum analyzer focusing on a different frequency band to improve the analysis accuracy and efficiency. The spectrum analyzer scans the spectrum of the input signal and records the signal amplitude and phase information at each frequency point. These data points are connected to form the characteristic curves of the captured signals in each frequency band. For example, three spectrum analyzers are used to analyze the signals in the frequency bands of 0 - 1 GHz, 1 - 2 GHz, and 2 - 3 GHz respectively. During the scanning process of each spectrum analyzer, with a step of 100 kHz, the signal amplitude at each frequency point is recorded. Finally, three characteristic curves are obtained, representing the amplitude distribution of the signals in the frequency bands of 0 - 1 GHz, 1 - 2 GHz, and 2 - 3 GHz respectively.

[0038] In a possible implementation, according to the spectral analysis of the second captured signal set by multiple spectrum analyzers to construct the characteristic curves of the captured signals in each frequency band, step S300 further includes step S310 of obtaining multiple sets of signal spectral analysis results according to the spectral analysis of the first optimized captured signal by the multiple spectrum analyzers. Specifically, the second captured signal set contains multiple optimized frequency band signals. For the signals in each frequency band, multiple spectrum analyzers are used to perform spectral analysis simultaneously to improve the accuracy and reliability of the analysis. Each spectrum analyzer performs spectral analysis on the first optimized captured signal, converts the time-domain signal into a frequency-domain signal through algorithms such as FFT, and records the signal amplitude and phase information at each frequency point. Due to hardware differences or measurement errors in different spectrum analyzers, multiple different sets of spectral analysis results will be obtained. For example, assume that three spectrum analyzers simultaneously analyze the signals in the frequency band of 1.4 GHz to 1.6 GHz. During the scanning process of each spectrum analyzer, with a step of 100 kHz, the signal amplitude and phase information at each frequency point are recorded. Finally, three different sets of spectral analysis results are obtained.

[0039] Step S320 is to perform credible filtering according to the multiple sets of signal spectral analysis results to establish the first spectral analysis credible space. Specifically, credible filtering is performed on each set of spectral analysis results to remove noise and abnormal data. Credible filtering can be achieved by setting thresholds or using statistical methods (such as mean filtering, median filtering). The filtered results are stored as the first spectral analysis credible space. For example, assume that in the spectral analysis results, the signal amplitude at some frequency points is significantly higher than that at other frequency points, which may be noise or abnormal signals. Through credible filtering, these abnormal data are removed, and the reliable signal spectral data are retained.

[0040] Step S330: Perform data fusion based on the first spectrum analysis credible space to obtain a first spectrum analysis credible result. Specifically, fuse the credible spectrum data of multiple spectrum analyzers. Data fusion can be achieved through methods such as weighted average and maximum value selection to obtain a more accurate spectrum analysis result. For example, assume that the spectrum data obtained by three spectrum analyzers are different at certain frequency points. By using the weighted average method, these data are fused to obtain a more accurate spectrum analysis result. For example, if the signal amplitudes of the three spectrum analyzers at the 1.5 GHz frequency point are -20 dBm, -21 dBm, and -22 dBm respectively, through the weighted average method, the finally obtained signal amplitude is -21 dBm.

[0041] Step S340: Construct a first frequency band capture signal characteristic curve based on the first spectrum analysis credible result, and add the first frequency band capture signal characteristic curve to each of the frequency band capture signal characteristic curves. Specifically, construct a characteristic curve of the first frequency band capture signal according to the first spectrum analysis credible result. The characteristic curve can be represented by plotting a graph of the relationship between frequency and signal amplitude. Add the constructed characteristic curve to each of the frequency band capture signal characteristic curves. For example, assume that the first frequency band is from 1.4 GHz to 1.6 GHz. According to the spectrum analysis credible result, plot the curve of the signal amplitude changing with frequency in this frequency band. Finally, add this curve to each of the frequency band capture signal characteristic curves to form a complete set of frequency band characteristic curves. By simultaneously analyzing the signals in the same frequency band with multiple spectrum analyzers and combining credible filtering and data fusion techniques, noise and abnormal data can be effectively removed, and the accuracy of spectrum analysis can be improved.

[0042] In a possible implementation manner, when performing credible filtering based on the multiple groups of signal spectrum analysis results to establish a first spectrum analysis credible space, step S320 further includes step S321: when the multiple spectrum analyzers perform spectrum analysis on the first optimized capture signal, collect the state parameters of the multiple spectrum analyzers in real time to obtain multiple analyzer monitoring sequences. Specifically, during the spectrum analysis process, collect the state parameters of each spectrum analyzer in real time, such as antenna gain, scan step, scan speed, device temperature, etc. The changes in these parameters may affect the accuracy of the spectrum analysis result. Record the collected state parameters in chronological order to form multiple analyzer monitoring sequences. For example, assume there are three spectrum analyzers, and record their antenna gain, scan step, and device temperature respectively. The state parameters of each spectrum analyzer are recorded in chronological order to form three monitoring sequences.

[0043] Step S322: Perform anomaly detection based on the multiple analyzer monitoring sequences to determine the anomaly coefficients of the multiple analyzers. Specifically, use a statistics-based method (such as Z-Score) or a machine learning-based method (such as KNN) to perform anomaly detection on the monitoring sequences. According to the anomaly detection results, calculate the anomaly coefficients of the status of each spectrum analyzer. The anomaly coefficient can represent the degree of deviation of each data point from the normal state. For example, use the Z-Score method to perform anomaly detection on the monitoring sequences. Suppose in the antenna gain monitoring sequence of a certain spectrum analyzer, the gain value at a certain time point significantly deviates from the normal range, and the calculated Z-Score value is greater than 3, then it is considered that the anomaly coefficient of the status at this time point is relatively high.

[0044] Step S323: Determine whether the anomaly coefficients of the multiple analyzers are less than a predetermined anomaly coefficient to obtain the status judgment results of the multiple analyzers. Specifically, set a predetermined anomaly coefficient threshold for judging whether the status of the spectrum analyzer is normal. Compare the anomaly coefficient of each spectrum analyzer with the threshold. If it is less than the threshold, it is considered that the status of this spectrum analyzer is normal; otherwise, it is considered that the status is abnormal. For example, set the anomaly coefficient threshold to 0.5. Suppose the anomaly coefficients of three spectrum analyzers are 0.3, 0.4, and 0.6 respectively. The status judgment results of the first two spectrum analyzers are normal, and the third one is abnormal.

[0045] Step S324: Filter and clean the multi-group signal spectrum analysis results according to the status judgment results of the multiple analyzers to generate the first credible space for spectrum analysis. Specifically, according to the status judgment results, retain the spectrum analysis results corresponding to the spectrum analyzers with normal status, and eliminate or correct the spectrum analysis results corresponding to the spectrum analyzers with abnormal status. Store the spectrum analysis results after filtering and cleaning as the first credible space for spectrum analysis. For example, the statuses of the first two spectrum analyzers are normal, and their corresponding spectrum analysis results are retained; the status of the third spectrum analyzer is abnormal, and its corresponding spectrum analysis result is eliminated. Finally, generate the first credible space for spectrum analysis. By real-time monitoring the status parameters of the spectrum analyzer and performing anomaly detection and filtering and cleaning, it is possible to effectively remove the noise and incorrect data caused by the abnormal status of the equipment and improve the reliability of the spectrum analysis results.

[0046] Step S400: Mine the credible signal features of the target area, construct a credible signal feature space, and input the captured signal feature curves of each frequency band into the credible signal feature space to determine the first result of suspicious device detection.

[0047] Specifically, through data mining techniques, credible signal features are extracted from the signal data of the target area to construct a credible signal feature space. Machine learning algorithms (such as clustering analysis, support vector machines, etc.) are used to analyze the signal data of the target area to extract credible signal features. The extracted credible signal features are stored as a feature space for subsequent signal comparison and analysis. The captured signal feature curves of each frequency band are input into the credible signal feature space, and the first detection result of suspicious devices is determined through comparison and analysis. For example, the clustering analysis algorithm is used to analyze the signal data of the target area to extract the features of normal signals. These normal signal features are stored as a credible signal feature space. The captured signal feature curves of each frequency band are input into the credible signal feature space, and after comparison and analysis, it is found that the signal amplitude in some frequency bands increases abnormally, which may indicate the existence of suspicious devices.

[0048] In a possible implementation, credible signal feature mining is performed on the target area to construct a credible signal feature space. Step S400 further includes step S410 of retrieving signal feature samples for each credible device in the target area to obtain multiple device signal feature sample sets. Specifically, signal feature samples are extracted from each credible device in the target area. These samples can include time-domain features (such as mean, standard deviation, peak value, etc.) and frequency-domain features (such as spectral mean, frequency centroid, root mean square frequency, etc.). For example, assume there are three credible devices in the target area, and their signal feature samples are extracted respectively to obtain three device signal feature sample sets.

[0049] Step S420, according to the multiple device signal feature sample sets, extract the first device signal feature sample set. Specifically, any one of the sample sets is extracted from the multiple device signal feature sample sets as the first device signal feature sample set. For example, a signal feature sample set of a credible device is selected as the first device signal feature sample set through a traversal algorithm.

[0050] Step S430, perform confidence evaluation on each signal feature sample in the first device signal feature sample set to obtain the confidence coefficients of each feature sample. Specifically, statistical methods or machine learning models are used to perform confidence evaluation on each signal feature sample. The confidence coefficient can be expressed as the similarity between each sample and the known credible signal features.

[0051] Step S440, perform optimization screening on the first device signal feature sample set according to the confidence coefficients of each feature sample to generate a first confidence signal feature sample set that meets a predetermined confidence coefficient. Specifically, a predetermined confidence coefficient threshold is set, and the signal feature samples with confidence coefficients higher than the threshold are screened out. This can be achieved through threshold comparison or sorting methods. For example, the confidence coefficient threshold is set to 0.8, and the signal feature samples with confidence coefficients higher than 0.8 are screened out to generate a first confidence signal feature sample set.

[0052] Step S450: Construct a first credible signal feature curve based on the first confidence signal feature sample set and add the first credible signal feature curve to the credible signal feature space. Specifically, construct a first credible signal feature curve according to the first confidence signal feature sample set. The feature curve can be represented by plotting a graph of frequency versus signal amplitude. Add the constructed feature curve to the credible signal feature space to form a complete credible signal feature space. By retrieving and screening the signal feature samples of legitimate devices, the credible signal features can be extracted more accurately, reducing false alarms. Through confidence evaluation and optimization screening, the signal feature samples with high confidence are selected, further improving the reliability of the system.

[0053] In a possible implementation, input the feature curves of the captured signals in each frequency band into the credible signal feature space to determine the first detection result of the suspicious device. Step S400 further includes step S460: Perform a twin comparison on the feature curve of the captured signal in the first frequency band respectively according to each credible signal feature curve in the credible signal feature space to obtain a first captured signal feature twin evaluation matrix. Specifically, use a twin network or other similarity measurement methods to calculate the similarity between the feature curve of the captured signal in the first frequency band and each credible signal feature curve in the credible signal feature space. The twin network can learn the similarity between signal features and output a similarity score. For example, assume there are 5 credible signal feature curves, calculate the similarity between the feature curve of the captured signal in the first frequency band and these 5 credible signal feature curves respectively to obtain 5 twin coefficients, forming a first captured signal feature twin evaluation matrix.

[0054] Step S470: Perform a maximum value screening on the first captured signal feature twin evaluation matrix to determine the first captured signal credible coefficient. Specifically, select the maximum value from the twin evaluation matrix, that is, the twin coefficient corresponding to the most similar credible signal feature curve, as the first captured signal credible coefficient. For example, in the twin evaluation matrix, the 5 twin coefficients are 0.7, 0.8, 0.6, 0.5, 0.9 respectively, and the maximum value is 0.9. Therefore, the first captured signal credible coefficient is 0.9.

[0055] Step S480: Determine whether the first captured signal credible coefficient is less than the captured signal credible threshold. Specifically, set a predetermined captured signal credible threshold, such as 0.8. If the first captured signal credible coefficient is less than this threshold, it is considered that the signal is not credible and may be the signal of a suspicious device. For example, set the captured signal credible threshold to 0.8, and the first captured signal credible coefficient is 0.9, which is greater than the threshold. Therefore, it is considered that the signal is credible.

[0056] Step S490: If the credibility coefficient of the first capture signal is less than the capture signal credibility threshold, trace the device for the first frequency band capture signal feature curve, determine the first suspicious device, and add the first suspicious device to the first detection result of the suspicious device. Specifically, if the credibility coefficient of the first capture signal is less than the threshold, the device corresponding to the signal is determined through signal tracing technology. This can be achieved by analyzing information such as the signal propagation path and signal strength. For example, assume that the credibility coefficient of the first capture signal is 0.7, which is less than the threshold of 0.8. Through device tracing, it is determined that the signal comes from a specific device, which is marked as the first suspicious device and added to the first detection result of the suspicious device. Through twin comparison and maximum value screening, the similarity between the capture signal and the credible signal can be accurately evaluated, thereby effectively identifying suspicious devices.

[0057] Step S500: Perform infrared detection compensation based on the first detection result of the suspicious device to obtain the second detection result of the suspicious device.

[0058] Specifically, the infrared detection technology is used to further detect the suspicious device, and compensation is performed in combination with the first detection result of the suspicious device. Specifically, an infrared detector is used to scan the target area to detect the infrared radiation characteristics of the device. According to the first detection result of the suspicious device, the infrared detection result is compensated, that is, the infrared detection result is fused with the first detection result of the suspicious device to obtain the second detection result of the suspicious device. For example, an infrared detector is used to scan the target area and detect the infrared radiation characteristics of a certain device. According to the first detection result of the suspicious device, the infrared detection result is compensated to exclude background interference. Finally, the infrared detection result is fused with the first detection result of the suspicious device to determine the location and characteristics of the suspicious device.

[0059] In a possible implementation, performing infrared detection compensation based on the first detection result of the suspicious device to obtain the second detection result of the suspicious device, step S500 further includes step S510: Scan the target area with an infrared thermal imager to obtain a regional infrared thermal image. Specifically, an infrared thermal imager is used to scan the target area to capture the infrared radiation signal in the target area. The infrared thermal imager collects the infrared radiation energy of the target through an optical system and converts it into an electrical signal to generate a regional infrared thermal image. For example, assume that the target area is a meeting room. After scanning with an infrared thermal imager, an infrared thermal image of the area is generated, which shows the thermal distribution of different devices and objects.

[0060] Step S520: Identify suspicious devices in the area infrared thermal image based on the reference thermal image of trusted devices in the target area, and obtain the infrared suspicious device detection result. Specifically, use the reference thermal image of known trusted devices in the target area to compare with the area infrared thermal image. By analyzing features such as temperature distribution and shape in the thermal image, identify areas that do not match the reference thermal image, and these areas may correspond to suspicious devices. For example, assume the reference thermal image of the air conditioning device in a meeting room is known. By comparison, it is found that there is an area in the thermal image with a temperature distribution that does not match the reference thermal image and an abnormal shape. It is preliminarily judged that there may be a suspicious device in this area.

[0061] Step S530: Compensate the first suspicious device detection result according to the infrared suspicious device detection result to generate the second suspicious device detection result. Specifically, fuse the infrared suspicious device detection result with the first suspicious device detection result. If the infrared detection result is consistent or similar to the first result, enhance the confidence of the suspicious device; if the infrared detection result is inconsistent with the first result, correct or supplement the first result. For example, assume that the position of a suspicious device in the first suspicious device detection result is consistent with the position in the infrared suspicious device detection result, and the thermal image shows that the temperature of this device is abnormally high. Further confirm that this device is a suspicious device and add it to the second suspicious device detection result. By scanning with an infrared thermal imager and comparing with the reference thermal image, suspicious devices can be identified from the perspective of thermal distribution. Combined with the first detection result, the accuracy of detection is further improved.

[0062] Step S600: Conduct a risk assessment on the second suspicious device detection result based on the real-time network traffic log of the target area to obtain a suspicious device detection report.

[0063] Specifically, conduct a risk assessment on the second suspicious device detection result by analyzing the real-time network traffic log of the target area. Specifically, use a network traffic analysis tool to monitor the network traffic in the target area in real time and record the traffic log. According to the abnormal traffic characteristics in the network traffic log, conduct a risk assessment on the second suspicious device detection result to generate a suspicious device detection report, which details the characteristics, location, and risk level of the suspicious device. In the embodiment of the present application, first use an RF scanner to perform multi-band scanning on the target area to obtain the first capture signal set, then adaptively compensate for interference according to the scene feature data to obtain the second capture signal set, then use multiple spectrum analyzers to analyze and construct the signal feature curves of each frequency band, then mine the trusted signal features in the target area to construct a space and input the feature curves to determine the first suspicious device detection result, then perform infrared detection compensation based on this result to obtain the second result, and finally conduct a risk assessment on the second result according to the real-time network traffic log to obtain the detection report and other technical means, achieving the technical effect of improving the accuracy and reliability of remote eavesdropping and surveillance device detection.

[0064] In a possible implementation, a risk assessment is performed on the second result of the suspicious device detection based on the real-time network traffic log of the target area to obtain a suspicious device detection report. Step S600 further includes step S610 of associatively capturing the real-time network traffic log according to the second result of the suspicious device detection to obtain the associated logs of each suspicious device. Specifically, according to the device information (such as IP address, device type, etc.) recorded in the second result of the suspicious device detection, the log records related to these suspicious devices are extracted from the real-time network traffic log. For example, assume that there is a suspicious device with an IP address of 192.168.1.100 in the second result of the suspicious device detection, and all the log records related to this IP address are extracted from the real-time network traffic log as the associated log of this suspicious device.

[0065] Step S620: Input the associated logs of each suspicious device into a risk assessment model to obtain the risk coefficients of each suspicious device. Specifically, use a pre-trained risk assessment model to analyze the associated logs of each suspicious device and calculate the risk coefficient of each suspicious device. The risk assessment model can be based on machine learning algorithms such as random forest, support vector machine, etc., or it can be a rule-based model. For example, input the extracted associated logs into the risk assessment model, and the model calculates the risk coefficient of the suspicious device according to the traffic characteristics (such as traffic volume, connection frequency, abnormal behavior, etc.) in the logs. For example, 0.8 indicates high risk and 0.3 indicates low risk.

[0066] Step S630: Organize the second result of the suspicious device detection, the associated logs of each suspicious device, and the risk coefficients of each suspicious device to generate the suspicious device detection report. Specifically, integrate the second result of the suspicious device detection, the associated logs, and the risk coefficients to generate a detailed suspicious device detection report. The report includes the basic information of the suspicious device, the summary of the associated logs, the risk coefficient, and the recommended countermeasures. For example, in the generated suspicious device detection report, list the IP addresses, device types, summary of the associated logs, and risk coefficients of all suspicious devices. For high-risk devices, it is recommended to conduct further investigations or take security measures.

[0067] In the above, the method for detecting remote eavesdropping and surveillance devices combined with TSCM according to the embodiments of the present invention has been described in detail. Next, the system for detecting remote eavesdropping and surveillance devices combined with TSCM according to the embodiments of the present invention will be described with reference to Figure 1 In the above, the method for detecting remote eavesdropping and surveillance devices combined with TSCM according to the embodiments of the present invention has been described in detail. Next, the system for detecting remote eavesdropping and surveillance devices combined with TSCM according to the embodiments of the present invention will be described with reference to Figure 2 Describe the system for detecting remote eavesdropping and surveillance devices combined with TSCM according to the embodiments of the present invention.

[0068] The remote eavesdropping and video surveillance device detection system combined with TSCM according to an embodiment of the present invention is used to solve the technical problems of low accuracy and poor reliability existing in the detection of existing remote eavesdropping and video surveillance devices, and achieves the technical effect of improving the accuracy and reliability of the detection of remote eavesdropping and video surveillance devices. The remote eavesdropping and video surveillance device detection system combined with TSCM includes: a multi-band scanning module 10, an adaptive interference compensation module 20, a spectrum analysis module 30, a suspicious device detection module 40, an infrared detection compensation module 50, and a risk assessment module 60.

[0069] The multi-band scanning module 10 is configured to perform multi-band scanning on a target area through an RF scanner to obtain a first capture signal set, where the first capture signal set includes multi-band capture signals; the adaptive interference compensation module 20 is configured to perform adaptive interference compensation on the first capture signal set according to multi-band scanning scenario feature data to obtain a second capture signal set; the spectrum analysis module 30 is configured to perform spectrum analysis on the second capture signal set according to multiple spectrum analyzers to construct capture signal feature curves for each frequency band; the suspicious device detection module 40 is configured to mine the feature of trustworthy signals in the target area, construct a trustworthy signal feature space, and input the capture signal feature curves for each frequency band into the trustworthy signal feature space to determine a first suspicious device detection result; the infrared detection compensation module 50 is configured to perform infrared detection compensation according to the first suspicious device detection result to obtain a second suspicious device detection result; the risk assessment module 60 is configured to perform a risk assessment on the second suspicious device detection result according to the real-time network traffic log of the target area to obtain a suspicious device detection report.

[0070] Next, the specific configuration of the adaptive interference compensation module 20 will be described in detail. As described above, the first capture signal set is subjected to adaptive interference compensation according to the multi-band scanning scenario feature data to obtain a second capture signal set. The adaptive interference compensation module 20 may further include: a data extraction unit configured to extract a first frequency band capture signal and first frequency band scanning scenario feature data corresponding to the first frequency band capture signal according to the first capture signal set and the multi-band scanning scenario feature data; a first scanning device status information acquisition unit configured to acquire RF scanner status parameters corresponding to the first frequency band capture signal to obtain first scanning device status information; an interference coupling analysis unit configured to perform interference coupling analysis on the first frequency band capture signal according to the first frequency band scanning scenario feature data and the first scanning device status information to determine a first interference compensation factor; and an interference compensation unit configured to perform interference compensation on the first frequency band capture signal according to the first interference compensation factor to obtain a first optimized capture signal, and add the first optimized capture signal to the second capture signal set.

[0071] Among them, interference coupling analysis is performed on the first frequency band capture signal according to the first frequency band scanning scenario feature data and the first scanning device status information to determine a first interference compensation factor. The interference coupling analysis unit may further include: a first interference identification subunit for performing anomaly detection on the first frequency band scanning scenario feature data to obtain a first scanning scenario anomaly detection result, and performing interference identification on the first frequency band capture signal according to the first scanning scenario anomaly detection result to obtain a first signal interference identification result; a second interference identification subunit for performing anomaly detection on the first scanning device status information to obtain a first scanning device anomaly detection result, and performing interference identification on the first frequency band capture signal according to the first scanning device anomaly detection result to obtain a second signal interference identification result; a fusion analysis subunit for performing fusion analysis according to the first signal interference identification result and the second signal interference identification result to generate the first interference compensation factor.

[0072] Next, the specific configuration of the spectrum analysis module 30 will be described in detail. As described above, according to the spectrum analysis of the second capture signal set by multiple spectrum analyzers, characteristic curves of capture signals in each frequency band are constructed. The spectrum analysis module 30 may further include: a spectrum analysis unit for performing spectrum analysis on the first optimized capture signal according to the multiple spectrum analyzers to obtain multiple sets of signal spectrum analysis results; a reliable filtering unit for performing reliable filtering according to the multiple sets of signal spectrum analysis results to establish a first spectrum analysis reliable space; a data fusion unit for performing data fusion according to the first spectrum analysis reliable space to obtain a first spectrum analysis reliable result; a first frequency band capture signal characteristic curve construction unit for constructing a first frequency band capture signal characteristic curve according to the first spectrum analysis reliable result, and adding the first frequency band capture signal characteristic curve to the characteristic curves of capture signals in each frequency band.

[0073] Among them, reliable filtering is performed according to the multiple sets of signal spectrum analysis results to establish a first spectrum analysis reliable space. The reliable filtering unit may further include: a plurality of analyzer monitoring sequence acquisition subunits for collecting the status parameters of the multiple spectrum analyzers in real time when the multiple spectrum analyzers perform spectrum analysis on the first optimized capture signal to obtain a plurality of analyzer monitoring sequences; an anomaly detection subunit for performing anomaly detection according to the plurality of analyzer monitoring sequences to determine a plurality of analyzer status anomaly coefficients; a judgment subunit for judging whether the plurality of analyzer status anomaly coefficients are less than a predetermined status anomaly coefficient to obtain a plurality of analyzer status judgment results; a filtering and cleaning subunit for performing filtering and cleaning on the multiple sets of signal spectrum analysis results according to the plurality of analyzer status judgment results to generate the first spectrum analysis reliable space.

[0074] Next, the specific configuration of the suspicious device detection module 40 will be described in detail. As described above, by mining the trusted signal features of the target area and constructing a trusted signal feature space, the suspicious device detection module 40 may further include: a signal feature sample retrieval unit for retrieving signal feature samples of each trusted device in the target area to obtain a plurality of device signal feature sample sets; a first device signal feature sample set extraction unit for extracting a first device signal feature sample set according to the plurality of device signal feature sample sets; a confidence evaluation unit for performing confidence evaluation on each signal feature sample in the first device signal feature sample set to obtain the confidence coefficients of each feature sample; an optimization and screening unit for performing optimization and screening on the first device signal feature sample set according to the confidence coefficients of each feature sample to generate a first confidence signal feature sample set that meets a predetermined confidence coefficient; a first trusted signal feature curve construction unit for constructing a first trusted signal feature curve according to the first confidence signal feature sample set and adding the first trusted signal feature curve to the trusted signal feature space.

[0075] Among them, by inputting the captured signal feature curves of each frequency band into the trusted signal feature space to determine the first result of suspicious device detection, the suspicious device detection module 40 may further include: a twin comparison unit for respectively performing twin comparison on the captured signal feature curve of the first frequency band according to each trusted signal feature curve in the trusted signal feature space to obtain a first captured signal feature twin evaluation matrix; a maximum value screening unit for performing maximum value screening on the first captured signal feature twin evaluation matrix to determine the first captured signal trust coefficient; a judgment unit for judging whether the first captured signal trust coefficient is less than the captured signal trust threshold; a device tracing unit for, if the first captured signal trust coefficient is less than the captured signal trust threshold, tracing the device of the captured signal feature curve of the first frequency band to determine a first suspicious device and adding the first suspicious device to the first result of suspicious device detection.

[0076] Next, the specific configuration of the infrared detection compensation module 50 will be described in detail. As described above, by performing infrared detection compensation according to the first result of suspicious device detection to obtain the second result of suspicious device detection, the infrared detection compensation module 50 may further include: a regional infrared thermal image acquisition unit for scanning the target area with an infrared thermal imager to obtain a regional infrared thermal image; a suspicious device identification unit for identifying suspicious devices in the regional infrared thermal image according to the trusted device reference thermal image of the target area to obtain an infrared suspicious device detection result; a compensation unit for compensating the first result of suspicious device detection according to the infrared suspicious device detection result to generate the second result of suspicious device detection.

[0077] Next, the specific configuration of the risk assessment module 60 will be described in detail. As described above, according to the real-time network traffic logs of the target area, a risk assessment is performed on the second detection result of the suspicious device to obtain a suspicious device detection report. The risk assessment module 60 may further include: an associated capture unit for performing an associated capture on the real-time network traffic logs according to the second detection result of the suspicious device to obtain the associated logs of each suspicious device; a risk assessment unit for inputting the associated logs of each suspicious device into a risk assessment model to obtain the risk coefficients of each suspicious device; and a suspicious device detection report generation unit for sorting out the second detection result of the suspicious device, the associated logs of each suspicious device, and the risk coefficients of each suspicious device to generate the suspicious device detection report.

[0078] The remote eavesdropping and surveillance device detection system combined with TSCM provided by the embodiments of the present invention can execute the remote eavesdropping and surveillance device detection method combined with TSCM provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the method.

[0079] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, however, any number of different modules can be used and run on the user terminal and / or the server. The various units and modules included are only divided according to the functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of mutual distinction and do not limit the protection scope of the present invention.

[0080] The above specific implementation manners do not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principle of the present application shall be included within the protection scope of the present application. In some cases, the actions or steps recorded in the present application can be executed in a different order from that in the embodiments and still achieve the desired results. Additionally, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired result. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A remote eavesdropping audiovisual device detection method in combination with TSCM, characterized in that: include: Performing a multi-band scanning of the target area by using an RF scanner to obtain a first capture signal set, wherein the first capture signal set includes multi-band capture signals; Performing adaptive interference compensation on the first captured signal set according to the multi-band scanning scene feature data to obtain a second captured signal set; Performing spectrum analysis on the second captured signal set using multiple spectrum analyzers to construct characteristic curves of captured signals in each frequency band; Performing credible signal feature mining on the target area to construct a credible signal feature space, and inputting the signal feature curves captured in each frequency band into the credible signal feature space to determine a first suspicious device detection result; Perform infrared detection compensation according to the first suspicious device detection result to obtain a second suspicious device detection result; A risk assessment is performed on the second result of the suspicious device detection according to the real-time network traffic log of the target area to obtain a suspicious device detection report.

2. The remote eavesdropping audiovisual device detection method combined with TSCM as claimed in claim 1, characterized in that: Performing adaptive interference compensation on the first captured signal set according to the multi-band scanning scene feature data to obtain a second captured signal set includes: Extracting a first frequency band capture signal and first frequency band scanning scene feature data corresponding to the first frequency band capture signal according to the first capture signal set and the multi-frequency band scanning scene feature data; Collecting the RF scanner state parameters corresponding to the first frequency band capture signal to obtain the first scanning device state information; Perform interference coupling analysis on the first frequency band captured signal according to the first frequency band scanning scene feature data and the first scanning device state information to determine a first interference compensation factor; Interference compensation is performed on the first frequency band capture signal according to the first interference compensation factor to obtain a first optimized capture signal, and the first optimized capture signal is added to the second capture signal set.

3. The remote eavesdropping audiovisual device detection method combined with TSCM as claimed in claim 2, characterized in that: Performing interference coupling analysis on the first frequency band capture signal according to the first frequency band scanning scene feature data and the first scanning device state information to determine a first interference compensation factor includes: Performing anomaly detection on the first frequency band scanning scene feature data to obtain a first scanning scene anomaly detection result, and performing interference identification on the first frequency band captured signal according to the first scanning scene anomaly detection result to obtain a signal first interference identification result; Performing an abnormality detection on the state information of the first scanning device to obtain an abnormality detection result of the first scanning device, and performing interference identification on the captured signal of the first frequency band according to the abnormality detection result of the first scanning device to obtain a second interference identification result of the signal; A fusion analysis is performed based on the first interference identification result of the signal and the second interference identification result of the signal to generate the first interference compensation factor.

4. The remote eavesdropping audiovisual device detection method combined with TSCM as claimed in claim 1, characterized in that: Performing spectrum analysis on the second captured signal set using multiple spectrum analyzers to construct characteristic curves of captured signals in each frequency band includes: Performing spectrum analysis on the first optimized captured signal according to the multiple spectrum analyzers to obtain multiple groups of signal spectrum analysis results; Perform credible filtering according to the plurality of signal spectrum analysis results to establish a first credible spectrum analysis space; Performing data fusion according to the first spectrum analysis credible space to obtain a first spectrum analysis credible result; According to the first spectrum analysis reliable result, a first frequency band captured signal characteristic curve is constructed, and the first frequency band captured signal characteristic curve is added to the each frequency band captured signal characteristic curve.

5. The remote eavesdropping audiovisual device detection method combined with TSCM as claimed in claim 4, characterized in that: Performing credible filtering according to the plurality of signal spectrum analysis results to establish a first spectrum analysis credible space includes: When the multiple spectrum analyzers perform spectrum analysis on the first optimized captured signal, state parameters of the multiple spectrum analyzers are collected in real time to obtain multiple analyzer monitoring sequences; Performing anomaly detection according to the plurality of analyzer monitoring sequences to determine a plurality of analyzer state anomaly coefficients; Determine whether the multiple analyzer state abnormality coefficients are less than a predetermined state abnormality coefficient, and obtain multiple analyzer state determination results; The plurality of groups of signal spectrum analysis results are filtered and cleaned according to the plurality of analyzer status judgment results to generate the first spectrum analysis credible space.

6. The remote eavesdropping audiovisual device detection method combined with TSCM as claimed in claim 1, characterized in that: The target area is mined for credible signal features to construct a credible signal feature space, including: Performing signal feature sample retrieval on each trusted device in the target area to obtain multiple device signal feature sample sets; Extracting a first device signal feature sample set according to the plurality of device signal feature sample sets; Performing confidence evaluation on each signal feature sample in the signal feature sample set of the first device to obtain a confidence coefficient of each feature sample; Optimizing and screening the first device signal feature sample set according to the confidence coefficients of the feature samples to generate a first confidence signal feature sample set that meets a predetermined confidence coefficient; A first credible signal feature curve is constructed according to the first credible signal feature sample set, and the first credible signal feature curve is added to the credible signal feature space.

7. The remote eavesdropping audiovisual device detection method combined with TSCM as claimed in claim 1, characterized in that: Inputting the captured signal characteristic curves of each frequency band into the trusted signal characteristic space to determine a first suspicious device detection result, including: According to each credible signal characteristic curve in the credible signal characteristic space, twin comparison is performed on the first frequency band capture signal characteristic curve to obtain a first capture signal characteristic twin evaluation matrix; Performing maximum value screening on the first capture signal feature twin evaluation matrix to determine the first capture signal credibility coefficient; Determining whether the first capture signal credibility coefficient is less than a capture signal credibility threshold; If the first capture signal credibility coefficient is less than the capture signal credibility threshold, device tracing is performed on the first frequency band capture signal characteristic curve to determine a first suspicious device, and the first suspicious device is added to the first suspicious device detection result.

8. The remote audiovisual device detection method combined with TSCM as claimed in claim 1, characterized in that: Performing infrared detection compensation according to the first suspicious device detection result to obtain a second suspicious device detection result includes: Scanning the target area with an infrared thermal imager to obtain an infrared thermal image of the area; According to the trusted device benchmark thermal image of the target area, suspicious devices are identified on the infrared thermal image of the area to obtain infrared suspicious device detection results; The first suspicious device detection result is compensated according to the infrared suspicious device detection result to generate the second suspicious device detection result.

9. The remote eavesdropping audiovisual device detection method combined with TSCM as claimed in claim 1, characterized in that: Performing a risk assessment on the second suspicious device detection result according to the real-time network traffic log of the target area to obtain a suspicious device detection report, including: According to the second suspicious device detection result, the real-time network traffic log is associated and captured to obtain associated logs of each suspicious device; Inputting the associated logs of each suspicious device into a risk assessment model to obtain a risk coefficient of each suspicious device; The second suspicious device detection result, the associated logs of the suspicious devices, and the risk coefficients of the suspicious devices are collated to generate the suspicious device detection report.

10. The remote audiovisual equipment detection system combined with TSCM is characterized by: The system is used to implement the remote eavesdropping audiovisual device detection method combined with TSCM according to any one of claims 1 to 9, and the system comprises: A multi-band scanning module, used to perform a multi-band scanning on a target area through an RF scanner to obtain a first capture signal set, wherein the first capture signal set includes a multi-band capture signal; An adaptive interference compensation module, used to perform adaptive interference compensation on the first captured signal set according to the multi-band scanning scene feature data to obtain a second captured signal set; A spectrum analysis module, used for performing spectrum analysis on the second captured signal set according to a plurality of spectrum analyzers, and constructing a characteristic curve of captured signals in each frequency band; A suspicious device detection module, used to mine the credible signal features of the target area, construct a credible signal feature space, input the captured signal feature curves of each frequency band into the credible signal feature space, and determine a first suspicious device detection result; An infrared detection compensation module, used to perform infrared detection compensation according to the first suspicious device detection result to obtain a second suspicious device detection result; The risk assessment module is used to perform risk assessment on the second result of the suspicious device detection according to the real-time network traffic log of the target area to obtain a suspicious device detection report.

Images