Airport security check behavior pattern analysis and abnormal state detection method
By combining multimodal data acquisition and cross-modal semantic analysis with the fusion structure of Transformer and LSTM, an airport security inspection behavior pattern analysis method was established, which solved the problem of misjudgment in complex scenarios of existing systems and achieved accurate risk identification and efficient security inspection process.
Patent Information
- Application Number
- CN202511345827.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-19
- Publication Date
- 2025-12-23
AI Technical Summary
Existing airport security systems cannot effectively link multiple types of data such as facial recognition, identification documents, and behavior, leading to the failure to detect hidden risks. Existing models have a high misjudgment rate in complex scenarios and lack system-level decision guidance, thus limiting security efficiency.
By employing multimodal data acquisition and cross-modal semantic analysis, and combining the fusion structure of Transformer and LSTM, a scene-adaptive behavioral semantic model is established. Through risk classification calculation and multi-terminal collaborative processing, a complete detection-decision-processing-feedback process is formed.
It enables accurate risk identification in complex scenarios, reduces misjudgments, improves security inspection efficiency, ensures safety and effectiveness, and forms a closed loop of end-to-end optimization.
Smart Images
Figure CN121190849A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of airport security check anomaly detection technology, specifically a method for analyzing airport security check behavior patterns and detecting abnormal states. Background Technology
[0002] As the construction of smart airports continues to advance, airport security checks, as a key barrier to aviation safety, face an increasingly urgent need to balance security redundancy with throughput efficiency. While current security technology has automated basic functions such as facial recognition, document verification, and behavior monitoring, the following technical challenges remain when facing complex operational scenarios:
[0003] While existing systems can acquire various types of data such as faces, documents, and behaviors, they only remain at the level of "feature splicing." For example, they can only judge whether the anti-counterfeiting features of documents are abnormal or whether the micro-expressions of passengers are normal. They cannot correlate and analyze the subtle anomalies in document anti-counterfeiting features, tense micro-expressions on faces, and the behavior of deliberately delaying the presentation of documents. As a result, when a single-dimensional feature does not reach the judgment threshold, such hidden risks are missed.
[0004] Existing security inspection models are mostly trained on normal behavior thresholds based on fixed scenarios (such as standard passenger flow and equipment without malfunctions), without considering variables in real-world scenarios: the slow movements of elderly passengers and the normal behaviors of disabled passengers relying on assistive devices are easily misjudged as abnormal; behavioral distortions during peak passenger flow and feature loss due to temporary camera obstruction can cause model thresholds to fail; temporary reading deviations of document readers can also reduce data reliability, further amplifying the risk of misjudgment, increasing the workload of security personnel, and potentially overlooking real risks.
[0005] Existing technologies only focus on "anomaly identification" and have not formed a complete process of "detection-decision-handling-feedback": after the remote monitoring center detects anomalies, it is necessary to manually organize the data and synchronize it to the site, which may easily lead to missing the interception opportunity; medium-risk cases lack system-level decision guidance and rely on the subjective judgment of security inspectors, resulting in inconsistent handling standards; the handling results are not automatically fed back to the model for optimization, and similar problems recur, which restricts the overall efficiency of security inspection. Summary of the Invention
[0006] The purpose of this invention is to provide a method for analyzing airport security check behavior patterns and detecting abnormal states, so as to solve the problems mentioned in the background art.
[0007] To achieve the above objectives, the present invention provides the following technical solution: a method for analyzing airport security check behavior patterns and detecting abnormal states, the specific steps of which are as follows:
[0008] Multimodal data acquisition: Collect four-dimensional semantic data of faces, documents, behaviors, and environment, set two types of semantic labels: passenger attributes and device status, and simultaneously record potential semantic conflict points;
[0009] Data preprocessing mapping: Based on semantic data and the semantic conflict points, a dynamic cross-modal semantic space is established, semantic weights are adjusted according to device credibility scores, and a conflict determination rule base is established based on the semantic conflict points;
[0010] Scene adaptive modeling: Based on cross-modal semantic data, multiple composite scenes are divided and labeled. Based on the fusion structure of Transformer and LSTM, scene transfer learning unit and real-time scene evaluation unit are integrated to form a normal behavior semantic model that adapts to the scene.
[0011] Document verification association: Based on the normal behavior semantic model, the basic verification process is associated with document validity semantics and environmental semantics; the anti-counterfeiting verification process is associated with behavioral semantics and device semantics; the database verification process is associated with passenger itinerary semantics, and a verification semantic graph is output.
[0012] Risk grading calculation: Based on the normal behavior semantic model and the verification semantic graph, track the abnormal semantic propagation path, adjust the risk score weight, refine the scenario adaptive scoring rules, and set the risk level;
[0013] Multi-terminal anomaly handling: Based on the risk level, set handling methods for low risk, medium risk and high risk, and mark the handling results and the reasons for semantic deviation after the handling is completed;
[0014] Model optimization and tracing: Establish a federated semantic knowledge graph, and set up an automatic optimization trigger mechanism for abnormal scenarios to generate a full-link semantic tracing report.
[0015] Preferably, the specific steps for multimodal data acquisition are as follows:
[0016] The system collects four-dimensional semantic data on faces, documents, behaviors, and the environment, sets semantic tags for passenger attributes, marks special passenger types including elderly passengers, disabled passengers, and unaccompanied children, marks itinerary semantics including multiple round trips in a short period of time and overnight trips in different locations, and sets semantic tags for device status, marks the level of device interference, and associates it with dynamic data credibility scores.
[0017] At the same time, potential semantic conflict points are recorded during the data collection process, such as the contradiction between the semantics of elderly passenger attributes and the semantics of rapid behavior sequence, and the contradiction between the semantics of normal itinerary and the status of documents nearing expiration.
[0018] Dynamic scoring formula for equipment data credibility:
[0019] C m =α m ×A m ×(1-β m ×D m )
[0020] In the formula: C m This represents the real-time data reliability score of the m-th type of device, with a value range of [0, 100].
[0021] α m This represents the basic confidence coefficient of the m-th type of equipment, which is determined by the equipment type.
[0022] A m This represents the historical accuracy rate of the m-th type of device;
[0023] β m This represents the interference sensitivity coefficient of the m-th type of device;
[0024] D m This indicates the real-time interference level of the m-th type of device.
[0025] Preferably, the specific steps of the data preprocessing mapping are as follows:
[0026] Based on the multimodal semantic data collected, a dynamic cross-modal semantic space is established. An adaptive expansion mechanism for scene semantic dimensions is adopted to adjust the semantic vector dimension according to the actual scene requirements. At the same time, a dynamic attention weight allocation mechanism is introduced to adjust the semantic weight of each modality according to the device credibility score.
[0027] For the semantic conflict points identified in the multimodal data collection, a conflict determination rule base is established. For example, when faced with the conflict between the semantic attributes of elderly passengers and the semantics of rapid behavior sequence, the environmental semantics are combined to determine whether the passenger is in an abnormally tense state. When faced with the conflict between the semantics of the document being close to expiration and the semantics of the normal trip, the database is linked to verify the document replacement record.
[0028] Cross-modal semantic attention weight allocation formula:
[0029]
[0030] W m This represents the modal semantic weight corresponding to the m-th type of device;
[0031] C m This represents the real-time data reliability score of the m-th type of device, and C in the dynamic data reliability scoring formula for devices. m completely consistent;
[0032] n represents the total number of devices participating in cross-modal fusion, which is fixed at 3 categories according to the technical solution design;
[0033] This represents the sum of real-time credibility scores for all n types of devices.
[0034] Preferably, the specific steps of the scene adaptive modeling are as follows:
[0035] Based on the data preprocessing mapping of the preprocessed cross-modal semantic data, twenty-four composite scenarios are logically divided according to the basic scenario and special variables, and hierarchical normal behavior sequences are labeled for each composite scenario.
[0036] The basic architecture is built using a fusion design of Transformer and LSTM. Transformer is used to capture the correlation features between cross-modal data, while LSTM learns the temporal patterns of behavior. A scene transfer learning unit is added. When an unlabeled scene appears in the airport, the normal behavior sequence parameters of similar scenes are called in through transfer learning. Combined with real-time collected samples, the model can be adapted. A real-time scene evaluation unit is also added. The current scene variables are analyzed periodically, and the normal behavior threshold is dynamically updated to form a normal behavior semantic model adapted to the scene.
[0037] Preferably, the specific steps for document verification and association are as follows:
[0038] Based on the normal behavior semantic model adaptively modeled in the scenario, the basic verification step associates the document validity semantics with the comparison of OCR data and chip data, and corrects the data by combining environmental semantics; the anti-counterfeiting verification step outputs the anti-counterfeiting suspicion level through a CNN network, and adjusts the risk level by associating behavioral semantics with device semantics; the database verification step adds cross-verification of passenger itinerary semantics on the basis of verifying the document's history of use in different locations; and outputs a verification semantic graph.
[0039] Preferably, the specific steps for calculating the risk classification are as follows:
[0040] Based on the verification semantic graph associated with the document verification and the normal behavior semantic model of the scene adaptive modeling, the semantic risk propagation chain calculation method is adopted to track the propagation path of abnormal semantics in multimodal data, adjust the risk score weight according to the propagation duration and the number of propagation modes, and refine the scene adaptive scoring rules to adjust the risk score according to the scene under the same semantic correlation.
[0041] Set risk levels, with a maximum risk score of 100 points and a base score of 60 points. The semantic relevance corresponds to a score range of 0-40 points. A score of no more than 50 points is considered high risk, 51-70 points is considered medium risk, and a score of more than 70 points is considered low risk. At the same time, the core risk semantics are marked.
[0042] Semantic risk score calculation formula:
[0043] R = R0 + S r ×K s
[0044] In the formula: R represents the passenger's final semantic risk score;
[0045] R0 represents the base risk score, which is the initial risk score for all passengers;
[0046] S r It represents the semantic relevance, that is, the strength of the semantic association of multimodal anomalies;
[0047] K s This represents the scenario coefficient, which reflects the impact of different scenarios on risk assessment.
[0048] Preferably, the specific steps for handling multi-terminal anomalies are as follows:
[0049] Based on the risk level calculated by the risk classification, a semantic record template is automatically generated when handling low-risk situations, a semantic conflict resolution guide is pushed when handling medium-risk situations, and evidence of the risk propagation chain is synchronized to the public security terminal when handling high-risk situations.
[0050] After the security inspector completes the process, guide them to annotate the processing results and the reasons for semantic discrepancies, and output feedback data.
[0051] Preferably, the specific steps for model optimization and tracing are as follows:
[0052] Based on the feedback data of the multi-terminal anomaly handling, a federated semantic knowledge graph is established, enabling different airports to share scenario, semantic, and threshold association knowledge through federated learning. At the same time, an automatic optimization trigger mechanism for anomaly scenarios is set up. When the false alarm rate of a certain scenario exceeds 10%, the weight of the behavior time sequence deviation is reduced and the semantic knowledge of the same type of scenario is called.
[0053] Finally, a full-link semantic tracing report is generated, which includes the semantic evolution trajectory and labels key semantic evidence fragments in accordance with the public security tracing requirements;
[0054] Contextualized normal behavior threshold optimization formula:
[0055] T new =T old ×(1+γ×(E-E0))+δ×T trans
[0056] In the formula: T new This represents the threshold for normal behavior in the optimized scene;
[0057] T old This represents the threshold for normal behavior in the scene before optimization, i.e., the historical threshold for the current scene.
[0058] γ represents the threshold adjustment coefficient;
[0059] E represents the actual false alarm rate in the current scenario;
[0060] E0 represents the scene false alarm rate threshold, which is the critical value that triggers threshold optimization;
[0061] δ represents the weight of transferred knowledge;
[0062] T trans This represents the threshold for similar scenarios involving cross-airport migration.
[0063] The beneficial effects of this invention are as follows:
[0064] 1. This invention adds meaning tags to data such as faces, documents, behaviors, and device status, and establishes cross-modal association logic to connect scattered data such as document anti-counterfeiting features, passenger micro-expressions, and behavioral timing. For example, when the holographic pattern on a document is slightly blurred, if it is combined with a sudden increase in the frequency of blinking or a deliberate delay in presenting the document, the system can accurately identify the hidden risks of this single data not reaching the threshold. This avoids the situation of missing the detection of counterfeit documents accompanied by abnormal behavior, as is the case with traditional solutions, making the security check more comprehensive in capturing risks and effectively reducing security risks.
[0065] 2. This invention categorizes scenarios into 24 types, including peak passenger flow + elderly passengers, equipment malfunction + disabled passengers, and can dynamically adjust the normal behavior threshold based on real-time scenarios. For example, if elderly passengers move slightly slower during peak hours, the system will not misjudge it as abnormal as traditional models. When a camera is temporarily obstructed, millimeter-wave radar data will be used to supplement behavioral information to avoid misjudgments caused by missing features. This can significantly reduce the workload of security personnel in handling false alarms, allowing them to focus on real risks and improve security efficiency.
[0066] 3. By constructing a multi-terminal collaborative mechanism, when an anomaly occurs, the on-site security inspector terminal, the remote monitoring center, and the public security pre-inspection terminal can simultaneously receive information with specific risk points, such as a prompt that "the holographic pattern of the document needs to be verified" and related videos. Previously, it took 30-60 seconds to manually sort and transmit data, but now it can be synchronized in just over ten seconds, without missing the interception window. Moreover, after the handling is completed, the cause of the false alarm or the real risk will be automatically fed back into the system optimization model to avoid the recurrence of similar problems, so that the security inspection forms a complete closed loop from identification to handling to optimization. Attached Figure Description
[0067] Figure 1 This is a flowchart of the airport security check behavior pattern analysis and abnormal state detection method of the present invention. Detailed Implementation
[0068] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0069] like Figure 1 As shown in the figure, this invention provides a method for analyzing airport security check behavior patterns and detecting abnormal states. The specific steps of this method are as follows:
[0070] Multimodal data acquisition: Collect four-dimensional semantic data of faces, documents, behaviors, and environment, set two types of semantic labels: passenger attributes and device status, and simultaneously record potential semantic conflict points;
[0071] Data preprocessing mapping: Based on semantic data and semantic conflict points, a dynamic cross-modal semantic space is established, semantic weights are adjusted according to device trustworthiness scores, and a conflict determination rule base is established based on semantic conflict points;
[0072] Scene adaptive modeling: Based on cross-modal semantic data, multiple composite scenes are divided and labeled. Based on the fusion structure of Transformer and LSTM, scene transfer learning unit and real-time scene evaluation unit are integrated to form a normal behavior semantic model that adapts to the scene.
[0073] Document verification association: Based on the normal behavior semantic model, the basic verification process is associated with document validity semantics and environmental semantics; the anti-counterfeiting verification process is associated with behavioral semantics and device semantics; the database verification process is associated with passenger itinerary semantics, and the output is a verification semantic graph.
[0074] Risk grading calculation: Based on the normal behavior semantic model and verification semantic graph, track the propagation path of abnormal semantics, adjust the risk score weight, refine the scenario adaptive scoring rules, and set the risk level;
[0075] Multi-terminal anomaly handling: Based on risk level, set handling methods for low risk, medium risk and high risk, and mark the handling results and the reasons for semantic deviation after handling.
[0076] Model optimization and tracing: Establish a federated semantic knowledge graph, and set up an automatic optimization trigger mechanism for abnormal scenarios to generate a full-link semantic tracing report.
[0077] The specific steps for multimodal data acquisition are as follows:
[0078] The system collects four-dimensional semantic data on faces, documents, behaviors, and the environment, sets semantic tags for passenger attributes, marks special passenger types including elderly passengers, disabled passengers, and unaccompanied children, marks itinerary semantics including multiple round trips in a short period of time and overnight stays in different locations; sets semantic tags for device status, marks the level of device interference, and associates it with dynamic data credibility scores, with a score range of 0 to 100 points. For example, when the camera is obstructed, the data credibility score is 40 points.
[0079] Equipment interference levels include camera interference caused by strong light or obstruction, and document reader deviation caused by electromagnetic interference;
[0080] Simultaneously, potential semantic conflict points are recorded during the data collection process, such as the contradiction between the semantics of elderly passenger attributes and the semantics of rapid behavior sequence, and the contradiction between the semantics of normal itinerary and the status of documents nearing expiration.
[0081] Dynamic scoring formula for equipment data credibility:
[0082] C m =α m ×A m ×(1-β m ×D m )
[0083] In the formula: C m This represents the real-time data credibility score of the m-th type of device (such as camera, ID card reader, millimeter-wave radar), with a value range of [0, 100]. The higher the score, the stronger the data credibility, which corresponds to the technical design of "dynamic data credibility scoring" in multimodal data acquisition.
[0084] α m The base reliability coefficient represents the basic reliability coefficient of the m-th type of device, determined by the device type, and is used to reflect the inherent performance of the device. The base reliability coefficient for cameras is 0.9, for document readers it is 0.85, and for millimeter-wave radar it is 0.95. The calibration is based on 30 days of continuous operation testing results of 100 mainstream devices of the same type (Hikvision DS-2CD3T46WD-I5 cameras, Huashi CVR-100U document readers, and Dahua DH-ITC6000 millimeter-wave radar). The selection criteria for the test samples are: device manufacturing time ≤ 2 years and no major repair records. Devices of the same type from different brands need to be recalibrated according to the above testing standards. α m The deviation shall not exceed ±0.05;
[0085] A m This represents the historical accuracy rate of the m-th type of device, specifically the matching rate between the data collected by the device and the actual values over the past 30 days. For example, if the accuracy rate of the camera's data over the past 30 days is 98%, then A... m The value is 0.98;
[0086] β m The interference sensitivity coefficient represents the interference sensitivity coefficient of the m-th type of device, which reflects the device's tolerance to external interference. Among them, the camera is sensitive to strong light obstruction, with an interference sensitivity coefficient of 1.2; the document reader is sensitive to electromagnetic interference, with an interference sensitivity coefficient of 1.1; and the millimeter-wave radar has strong anti-interference capability, with an interference sensitivity coefficient of 0.8.
[0087] D mThis represents the real-time interference level of the m-th type of device, corresponding to the design of "device interference level" in multimodal data acquisition. It is used to quantify the degree of external interference. When there is no interference, D... m =0, D when there is slight interference m =0.2, D under severe interference m =0.8.
[0088] The specific steps of data preprocessing mapping are as follows:
[0089] Based on multimodal semantic data collected from multimodal data acquisition, a dynamic cross-modal semantic space is established. An adaptive expansion mechanism for scene semantic dimensions is adopted, adjusting the semantic vector dimensions according to actual scene requirements. For example, a behavior congestion correction dimension is added in peak passenger flow scenarios, and a data completion confidence dimension is added in equipment failure scenarios. Ultimately, the semantic vector dimensions can be adjusted from 128 to 256 dimensions. At the same time, a dynamic attention weight allocation mechanism is introduced, adjusting the semantic weights of each modality according to the device credibility score. For example, when the credibility score of camera data is 40, the semantic weight of that modality is adjusted from 0.3 to 0.1, while the semantic weight of credible modalities such as millimeter-wave radar is adjusted from 0.2 to 0.4.
[0090] To address semantic conflict points identified in multimodal data collection, a conflict determination rule base is established. For example, when faced with a conflict between the semantic attributes of elderly passengers and the temporal semantics of rapid behavior, the environmental semantics are combined to determine whether the passenger is in an abnormally tense state. When faced with a conflict between the semantics of a document nearing expiration and the semantics of a normal itinerary, the database is linked to verify the document replacement record to avoid misjudgment caused by relying solely on a single modality of data.
[0091] Cross-modal semantic attention weight allocation formula:
[0092]
[0093] W m The modal semantic weights corresponding to the m-th type of device are used to reflect the contribution of the modal data in cross-modal fusion, and the sum of all modal weights participating in the fusion is 1, which corresponds to the technical requirement of "dynamic allocation of attention weights" in data preprocessing mapping.
[0094] C m This represents the real-time data reliability score of the m-th type of device, and C in the dynamic data reliability scoring formula for devices. m Completely identical; it needs to be normalized to the range of 0-1 before being used in calculations. The normalization method is C′. m =C m / 100; If equipment failure causes C m If the value is ≤0, the device is considered to be faulty, the mode is automatically removed, and the weights of the remaining devices are recalculated.
[0095] n represents the total number of devices participating in cross-modal fusion, which is fixed to three categories according to the technical solution: cameras, document readers, and millimeter-wave radar.
[0096] This represents the sum of real-time credibility scores for all n types of devices. The calculation uses the original scores before normalization to accumulate, and the value range is [0, 300]. For example, when camera C1 = 42, document reader C2 = 75, and millimeter-wave radar C3 = 90, the sum is 42 + 75 + 90 = 207.
[0097] The specific steps of scene adaptive modeling are as follows:
[0098] Based on the cross-modal semantic data after data preprocessing and mapping, 24 composite scenarios are logically divided according to the basic scenario and special variables. These include elderly passengers in peak passenger flow scenarios, disabled passengers in equipment failure scenarios, and ordinary passengers in strong light environments. For each composite scenario, a hierarchical normal behavior sequence is labeled. For example, in the elderly passenger scenario in peak passenger flow scenarios, the normal behavior sequence includes a document presentation delay of no more than 8 seconds and an action range of no more than 60% of the action range of ordinary passengers. This solves the problem that single-scenario modeling in existing technologies cannot cover special situations.
[0099] Segmentation logic: The basic scenario quantification standard is normal passenger flow ≤ 2 people / m 2 Peak passenger flow: 2-5 people / m 2 Off-peak passenger flow < 1 person / m 2 The special variable combination rule is "basic scenario × 4 types of passenger types × 3 types of equipment status", excluding logically contradictory combinations, such as off-peak passenger flow + equipment failure, which are not classified separately, forming a total of 24 scenarios;
[0100] The basic architecture is built using a fusion design of Transformer and LSTM. Transformer is used to capture the correlation features between cross-modal data, while LSTM learns the temporal patterns of behavior. A scene transfer learning unit is added. When an unlabeled scene appears in the airport, the normal behavior sequence parameters of similar scenes are called through transfer learning. Combined with 500 samples collected in real time, the model can be adapted, which greatly improves the scene generalization efficiency. A real-time scene evaluation unit is also added. Every ten minutes, the current scene variables such as passenger flow density and equipment status are analyzed and the normal behavior threshold is dynamically updated. For example, when the passenger flow density increases from one person per square meter to three people per square meter, the behavior temporal deviation threshold is relaxed from 3 seconds to 5 seconds to form a normal behavior semantic model adapted to the scene.
[0101] Weighting rules: During migration, parameters from similar scenarios account for 60% of the weight, and parameters from the 500 real-time collected samples account for 40% of the weight; if there are fewer than 300 real-time samples, the weight of parameters from similar scenarios is increased to 80%.
[0102] Criteria for classifying similar scenarios: The basic scenario is the same + one special variable is the same. For example, "peak passenger flow + elderly + normal equipment" and "peak passenger flow + disabled + normal equipment" are considered to be in the same category.
[0103] Fusion architecture details: It adopts a series structure of "Transformer encoder → LSTM layer → fully connected layer"; the Transformer encoder has 6 layers, 8 multi-head attention heads, and 512 hidden layer dimensions; the LSTM layer has 2 layers, 256 hidden layer neurons, and the activation function is tanh; the input data is a normalized 128-dimensional cross-modal semantic vector; the training parameters are set to batch size = 32 and iteration number = 100 rounds.
[0104] The specific steps for document verification and association are as follows:
[0105] Based on a scene-adaptive modeling-based normal behavior semantic model, the basic verification stage associates document validity semantics with the comparison of OCR data and chip data. For example, if the remaining validity period of the document is less than three months, it automatically marks the document as having a validity risk. Simultaneously, it incorporates environmental semantics for data correction; for instance, if OCR recognition errors occur in strong light, it uses infrared document images for correction. In the anti-counterfeiting verification stage, a CNN network outputs an anti-counterfeiting suspicion level, including high suspicion, medium suspicion, and low suspicion. It also adjusts the risk level by associating behavioral semantics with device semantics. For example, an anti-counterfeiting level of medium suspicion accompanied by hand tremors and no device interference could indicate a low suspicion level. When a document is marked as having a high risk semantic, and its anti-counterfeiting level is highly suspicious but there is strong light interference from the device, it is temporarily marked as having a medium risk semantic to avoid misjudgment caused by ignoring environmental interference in existing technologies. In the database verification process, in addition to verifying the document's history of use in other locations, cross-verification of passenger itinerary semantics is added. For example, if the document has a record of use in other locations and the itinerary data shows that the passenger did not depart from the local area, it is marked as having an itinerary contradiction semantic. At the same time, a verification semantic graph is output. For example, through the graph form of "time-sensitive risk semantic, itinerary contradiction semantic, and hand trembling behavior semantic pointing to comprehensive risk semantic - suspected document misuse", security inspectors are provided with intuitive risk judgment basis.
[0106] CNN network details: A 5-layer structure is used, including convolutional layer 1 (3×3 filters, 32 neurons), convolutional layer 2 (3×3 filters, 64 neurons), max pooling layer (2×2), fully connected layer 1 (128 neurons), and fully connected layer 2 (output dimension 3). The training data consists of 100,000 ID card images (including 20,000 counterfeit ID cards, covering holographic patterns, fluorescent fibers, and watermark features). Suspicion level thresholds: output probability ≥ 0.8 is highly suspicious, 0.5-0.79 is moderately suspicious, and < 0.5 is low suspicious.
[0107] The specific steps for calculating risk grading are as follows:
[0108] Based on the verification semantic graph associated with document verification and the normal behavior semantic model of scene adaptive modeling, a semantic risk propagation chain calculation method is adopted to track the propagation path of abnormal semantics in multimodal data. For example, the sequence of a passenger showing nervous micro-expressions (time node t0), hesitating to show documents (two seconds after time node t0), and blurred document anti-counterfeiting features (five seconds after time node t0) is used. The risk score weight is adjusted according to the propagation duration (not exceeding five seconds is judged as rapid propagation) and the number of propagation modalities (covering three or more modalities is judged as strong propagation). Both types of situations correspond to high risk. At the same time, the scene adaptive scoring rules are refined. Under the same semantic relevance, the risk score is adjusted according to the scene. For example, when the semantic relevance is 60%, the risk score is 70 points in the elderly passenger scenario in the peak passenger flow scenario and 65 points in the ordinary passenger scenario in the equipment failure scenario. Since the equipment failure may cause semantic deviation, the risk score is appropriately reduced.
[0109] Set risk levels, with a maximum risk score of 100 points and a base score of 60 points. The semantic relevance score corresponds to a bonus range of 0-40 points. A score of no more than 50 points is considered high risk, 51-70 points is considered medium risk, and a score of more than 70 points is considered low risk. At the same time, the core risk semantics are marked. For example, the core risk semantics corresponding to high risk are highly suspicious anti-counterfeiting measures and nervous micro-expressions.
[0110] Semantic risk score calculation formula:
[0111] R = R0 + S r ×K s
[0112] In the formula: R represents the passenger's final semantic risk score, which is used for subsequent risk level determination. It corresponds to the design of the "comprehensive risk score" in the risk classification calculation. The value range is [0, 100]. The higher the score, the higher the risk level of the passenger.
[0113] R0 represents the basic risk score, which is the initial risk score for all passengers. It is used to reflect the basic security threshold for security checks and is fixed at 60 according to the technical solution design, corresponding to the setting of "basic score of 60 points" in the risk classification calculation.
[0114] S r It represents the semantic relevance, that is, the relevance strength of multimodal abnormal semantics. It is used to quantify the degree of coordination among the three types of abnormal semantics: "face-document-behavior". The value range is [0, 40], which corresponds to the rule of "semantic relevance score of 0-40 points" in risk classification calculation. The higher the relevance, the more points are added.
[0115] K s This represents the scenario coefficient, used to reflect the impact of different scenarios on risk assessment. It corresponds to the "scenario adaptive scoring rule" in risk grading calculation, and its value range is [0.8, 1.2]. Among them, K represents the scenario of peak passenger flow + elderly passengers. s =0.8, K in the scenario of equipment failure + ordinary passenger s =0.9, K in normal scenarios s =1.0, K for special scenarios (such as high passenger flow during traffic jams) s =1.2.
[0116] The specific steps for handling multiple anomalies are as follows:
[0117] Based on the risk level calculated by risk classification, a semantic record template is automatically generated when handling low-risk situations. The content includes risk semantics such as the approaching expiration of documents and handling suggestions such as reminding passengers to update their documents. When handling medium-risk situations, a semantic conflict resolution guide is pushed. The content includes conflict points such as itinerary contradictions and suspicious aspects of anti-counterfeiting measures, as well as verification directions such as verifying the authenticity of the itinerary and verifying the details and textures of documents. When handling high-risk situations, evidence of the risk propagation chain is synchronized to the public security terminal, including abnormal semantic temporal video clips marked with time nodes t0 to 5 seconds after t0, which shortens the evidence verification time to 15 to 20 seconds.
[0118] After the security inspector completes the handling, guide them to mark the handling results (including false alarms and real risks) and the reasons for semantic deviations. For example, the reason for a false alarm is marked as strong light causing misjudgment of anti-counterfeiting semantics, and the reason for a real risk is marked as conflicting travel itineraries and a rapid risk transmission chain. Output feedback data.
[0119] The specific steps for model optimization and tracing are as follows:
[0120] Based on feedback data from multi-terminal anomaly handling, a federated semantic knowledge graph is established, enabling different airports to share scenario, semantic, and threshold-related knowledge through federated learning. For example, the threshold parameters for elderly passengers in peak scenarios at airport A can be applied to similar scenarios at airport B, avoiding optimization lag caused by insufficient samples from a single airport. At the same time, an automatic optimization trigger mechanism for abnormal scenarios is set up. When the false alarm rate of a certain scenario exceeds 10%, the weight of behavioral temporal deviation is reduced and semantic knowledge of similar scenarios is invoked. For example, experience in relaxing action thresholds is invoked from the elderly passenger scenario to improve the model optimization efficiency.
[0121] Finally, a full-link semantic tracing report is generated. The report includes the semantic evolution trajectory, recording the entire process of abnormal semantics from multimodal data collection (e.g., tension micro-expressions at time node t0), data preprocessing mapping (e.g., semantic vector annotation at time node t1), document verification (e.g., anti-counterfeiting suspicious association at time node t2), multi-terminal abnormal handling (e.g., risk assessment at time node t3), to the optimization of this step (e.g., model threshold adjustment at time node t4). It also links key semantic evidence fragments to the public security tracing requirements, including semantic video frames of anti-counterfeiting anomalies and semantic data comparison tables of travel contradictions, to meet the public security's subsequent tracing work requirements for semantic evidence, while achieving the dual goals of continuous model optimization and risk traceability.
[0122] Contextualized normal behavior threshold optimization formula:
[0123]
[0124] In the formula: T new This represents the optimized normal behavior threshold, including types such as behavior timing deviation threshold and action amplitude threshold. It corresponds to the "model threshold adjustment" design in the model optimization tracing. The value varies with the threshold type. For example, the value range of the timing deviation threshold is 1-10 seconds, and the value range of the action amplitude threshold is [0.5, 1.2], which is a proportional value based on the action amplitude of ordinary passengers.
[0125] T old This represents the threshold for normal scene behavior before optimization, i.e., the historical threshold of the current scene. For example, in scene adaptive modeling, the setting of "travel timing deviation ≤ 3 seconds" is the T threshold for a certain scene. old Its value is related to T new Values belonging to the same type and unit;
[0126] γ represents the threshold adjustment coefficient, which is used to control the magnitude of threshold optimization and avoid excessive adjustment that could lead to model instability. Based on the monthly data feedback optimization cycle in the model optimization traceability, it is fixed at 0.3 to ensure that the monthly threshold adjustment magnitude does not exceed 30%.
[0127] E represents the actual false alarm rate of the current scenario, specifically the ratio of the number of false alarms to the total number of detections in the scenario over the past 30 days. The value range is [0, 1]. For example, if the false alarm rate of the scenario over the past 30 days is 12%, the value of E is 0.12.
[0128] E0 represents the scene false alarm rate threshold, which is the critical value that triggers threshold optimization. It corresponds to the rule in model optimization tracing that "optimize when false alarm rate > 10%", and is fixed at 0.1. When the actual false alarm rate E exceeds this value, the threshold optimization process is started.
[0129] δ represents the knowledge transfer weight, which reflects the contribution of cross-airport shared knowledge to the current scenario threshold. It corresponds to the design of "federated semantic knowledge transfer" in model optimization tracing. The value range is [0, 0.5]. When local samples are sufficient, δ = 0.2, and when local samples are insufficient, δ = 0.5.
[0130] T trans This represents the threshold for similar scenarios involving cross-airport migration. It's the optimal threshold for similar scenarios obtained from the federated semantic knowledge graph. For example, the temporal deviation threshold for the "elderly passengers + peak" scenario at Airport A is 5 seconds. This value is related to T... new Values belonging to the same type and unit.
[0131] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.
[0132] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A method for analyzing airport security check behavior patterns and detecting abnormal states, characterized in that: The specific steps of this method are as follows: Multimodal data acquisition: Collect four-dimensional semantic data of faces, documents, behaviors, and environment, set two types of semantic labels: passenger attributes and device status, and simultaneously record potential semantic conflict points; Data preprocessing mapping: Based on semantic data and the semantic conflict points, a dynamic cross-modal semantic space is established, semantic weights are adjusted according to device credibility scores, and a conflict determination rule base is established based on the semantic conflict points; Scene adaptive modeling: Based on cross-modal semantic data, multiple composite scenes are divided and labeled. Based on the fusion structure of Transformer and LSTM, scene transfer learning unit and real-time scene evaluation unit are integrated to form a normal behavior semantic model that adapts to the scene. Document verification association: Based on the normal behavior semantic model, the basic verification process is associated with document validity semantics and environmental semantics; the anti-counterfeiting verification process is associated with behavioral semantics and device semantics; the database verification process is associated with passenger itinerary semantics, and a verification semantic graph is output. Risk grading calculation: Based on the normal behavior semantic model and the verification semantic graph, track the abnormal semantic propagation path, adjust the risk score weight, refine the scenario adaptive scoring rules, and set the risk level; Multi-terminal anomaly handling: Based on the risk level, set handling methods for low risk, medium risk and high risk, and mark the handling results and the reasons for semantic deviation after the handling is completed; Model optimization and tracing: Establish a federated semantic knowledge graph, and set up an automatic optimization trigger mechanism for abnormal scenarios to generate a full-link semantic tracing report.
2. The airport security check behavior pattern analysis and abnormal state detection method according to claim 1, characterized in that: The specific steps for multimodal data acquisition are as follows: Collect four-dimensional semantic data on faces, documents, behaviors, and environment; set semantic tags for passenger attributes; label special passenger types, including elderly passengers, disabled passengers, and unaccompanied children; and label itinerary semantics, including multiple round trips within a short period of time and overnight stays in different locations. Set semantic labels for device status, mark the level of device interference, and associate them with dynamic data credibility scores; Simultaneously, potential semantic conflict points are recorded during the data collection process, such as the contradiction between the semantics of elderly passenger attributes and the semantics of rapid behavior sequence, and the contradiction between the semantics of normal itinerary and the status of documents nearing expiration.
3. The airport security check behavior pattern analysis and abnormal state detection method according to claim 2, characterized in that: The specific steps of the data preprocessing mapping are as follows: Based on the multimodal semantic data collected, a dynamic cross-modal semantic space is established. An adaptive expansion mechanism for scene semantic dimensions is adopted to adjust the semantic vector dimension according to the actual scene requirements. At the same time, a dynamic attention weight allocation mechanism is introduced to adjust the semantic weight of each modality according to the device credibility score. For the semantic conflict points identified in the multimodal data collection, a conflict determination rule base is established. For example, when faced with a conflict between the semantic attributes of elderly passengers and the semantics of rapid behavior sequence, the environmental semantics are combined to determine whether the passenger is in an abnormally tense state. When faced with a conflict between the semantics of a document nearing expiration and the semantics of a normal trip, the database is consulted to verify the document replacement record.
4. The airport security check behavior pattern analysis and abnormal state detection method according to claim 3, characterized in that: The specific steps for scene adaptive modeling are as follows: Based on the data preprocessing mapping of the preprocessed cross-modal semantic data, 24 composite scenarios are logically divided according to the basic scenario and special variables, and hierarchical normal behavior sequences are labeled for each composite scenario. The basic architecture is built by integrating Transformer and LSTM, where Transformer is used to capture the correlation features between cross-modal data, and LSTM is used to learn the temporal patterns of behavior. A scene transfer learning unit has been added. When an unlabeled scene appears at the airport, the normal behavior sequence parameters of similar scenes can be called through transfer learning and combined with real-time collected samples to complete the model adaptation. A real-time scene evaluation unit has also been added. The current scene variables are analyzed regularly and the normal behavior threshold is dynamically updated to form a normal behavior semantic model adapted to the scene.
5. The airport security check behavior pattern analysis and abnormal state detection method according to claim 4, characterized in that: The specific steps for document verification and association are as follows: Based on the normal behavior semantic model adaptively modeled in the scenario, the basic verification step associates the document validity semantics with the comparison of OCR data and chip data, and corrects the data by combining environmental semantics; the anti-counterfeiting verification step outputs the anti-counterfeiting suspicion level through a CNN network, and adjusts the risk level by associating behavioral semantics with device semantics; the database verification step adds cross-verification of passenger itinerary semantics on the basis of verifying the document's history of use in different locations; and outputs a verification semantic graph.
6. The airport security check behavior pattern analysis and abnormal state detection method according to claim 5, characterized in that: The specific steps for calculating the risk classification are as follows: Based on the verification semantic graph associated with the document verification and the normal behavior semantic model of the scene adaptive modeling, the semantic risk propagation chain calculation method is adopted to track the propagation path of abnormal semantics in multimodal data, adjust the risk score weight according to the propagation duration and the number of propagation modes, and refine the scene adaptive scoring rules to adjust the risk score according to the scene under the same semantic correlation. Set risk levels, with a maximum risk score of 100 points and a base score of 60 points. The semantic relevance score corresponds to a bonus range of 0-40 points. A score of no more than 50 points is considered high risk, 51-70 points is considered medium risk, and a score of more than 70 points is considered low risk. At the same time, the core risk semantics are marked.
7. The airport security check behavior pattern analysis and abnormal state detection method according to claim 6, characterized in that: The specific steps for handling multi-terminal anomalies are as follows: Based on the risk level calculated by the risk classification, a semantic record template is automatically generated when handling low-risk situations, a semantic conflict resolution guide is pushed when handling medium-risk situations, and evidence of the risk propagation chain is synchronized to the public security terminal when handling high-risk situations. After the security inspector completes the process, guide them to annotate the processing results and the reasons for semantic discrepancies, and output feedback data.
8. The airport security check behavior pattern analysis and abnormal state detection method according to claim 7, characterized in that: The specific steps for tracing the source of model optimization are as follows: Based on the feedback data of the multi-terminal anomaly handling, a federated semantic knowledge graph is established, enabling different airports to share scenario, semantic, and threshold association knowledge through federated learning. At the same time, an automatic optimization trigger mechanism for anomaly scenarios is set up. When the false alarm rate of a certain scenario exceeds 10%, the weight of the behavior time sequence deviation is reduced and the semantic knowledge of the same type of scenario is called. Finally, a full-link semantic tracing report is generated, which includes the semantic evolution trajectory and labels key semantic evidence fragments in accordance with public security tracing requirements.