Law enforcement officer post abnormal behavior monitoring method, equipment and medium

Abstract

The embodiment of the invention discloses a law enforcement officer post abnormal behavior monitoring method and device and a medium, belongs to the technical field of video data monitoring, and solves the problem that the post supervision accuracy of law enforcement officers is low in the prior art. Comprising the following steps: analyzing monitoring video data corresponding to a law enforcement place, and identifying a target law enforcement object in a video frame; in the monitoring video data, extracting a structured semantic element corresponding to the target law enforcement object; according to a preset law enforcement place type rule base, scene adaptation packaging is carried out on the structured semantic elements, and supervision semantic data frames are generated; and based on the continuously generated supervision semantic data frames, constructing an encrypted supervision semantic stream, and transmitting the encrypted supervision semantic stream to a cloud supervision analysis platform, so that the cloud supervision analysis platform matches the supervision semantic data frames with a preset reference law enforcement knowledge graph, and outputs a post monitoring result corresponding to the target law enforcement object according to a matching result.

Description

Technical Field

[0001] This application relates to the field of video data monitoring technology, and in particular to a method, equipment and medium for monitoring abnormal behavior of law enforcement personnel. Background Technology

[0002] Objective and efficient supervision of law enforcement personnel's performance of their duties is a crucial link in ensuring the standardization of law enforcement activities.

[0003] In existing technologies, videos are typically recorded and stored using cameras deployed at law enforcement locations. Supervisory personnel need to review historical videos periodically or irregularly for manual inspection, or identify potential misconduct through real-time video patrols.

[0004] However, manual inspections and video reviews are limited by human resources and the attention span of monitoring personnel. Due to the limited number of supervisors, it is difficult to thoroughly screen all video content, and only sampling inspections can be adopted. This results in a large amount of video content not being effectively monitored, creating blind spots in supervision. Secondly, because humans are susceptible to fatigue, continuous monitoring of video footage can lead to visual fatigue and decreased attention, potentially resulting in missed detections of abnormal behaviors and thus lower accuracy in supervising law enforcement personnel. Summary of the Invention

[0005] This application provides a method, device, and medium for monitoring abnormal behavior of law enforcement personnel, which addresses the following technical problem: existing technologies are limited by human resources and the attention capacity of monitoring personnel, resulting in low accuracy in supervising law enforcement personnel.

[0006] The embodiments of this application adopt the following technical solutions: This application provides a method for monitoring abnormal behavior of law enforcement personnel. The method includes: analyzing surveillance video data corresponding to law enforcement locations to identify target law enforcement objects in the video frames; wherein the target law enforcement object includes at least one of target law enforcement personnel and target law enforcement facilities; extracting structured semantic elements corresponding to the target law enforcement objects from the surveillance video data; wherein the structured semantic elements include at least one of the following: the law enforcement personnel's identification, the law enforcement personnel's action classification, the state and location of the law enforcement facilities, and the spatial topological relationship between the target law enforcement objects; performing scene-adaptive encapsulation of the structured semantic elements according to a pre-set law enforcement location type rule base to generate supervisory semantic data frames; constructing an encrypted supervisory semantic stream based on the continuously generated supervisory semantic data frames and transmitting it to a cloud-based supervisory analysis platform, whereby the cloud-based supervisory analysis platform matches the supervisory semantic data frames with a pre-set reference law enforcement knowledge graph, and outputs the monitoring results corresponding to the target law enforcement objects based on the matching results.

[0007] In one implementation of this application, the analysis of surveillance video data corresponding to law enforcement locations to identify target law enforcement objects in video frames specifically includes: extracting visual features from video frames in the surveillance video data, calculating the similarity between the extracted visual features and pre-set textual description features of law enforcement objects, and filtering out a candidate set of target law enforcement objects and their confidence levels based on the calculation results; constructing a law enforcement scene relationship graph by using candidate law enforcement objects in the candidate set as nodes and the positional and interactive relationships between candidate law enforcement objects as edges; matching corresponding relationship constraint rule sets in a pre-set law enforcement scene common sense rule base based on the object types of each node in the law enforcement scene relationship graph; verifying the law enforcement scene relationship graph based on the relationship constraint rule sets; correcting the confidence levels of candidate law enforcement objects according to the verification results, and selecting candidate law enforcement objects whose corrected confidence levels meet a preset threshold as target law enforcement objects.

[0008] In one implementation of this application, the structured semantic elements corresponding to the target law enforcement object are extracted from the surveillance video data. Specifically, this includes: determining the corresponding reference visual features in a pre-set law enforcement feature rule library for each target law enforcement object based on its object type and current law enforcement scene information; replacing the monitoring features corresponding to the current target law enforcement object with the reference visual features while keeping the monitoring features of other target law enforcement objects in the scene unchanged; determining the degree of difference between the counterfactual feature representation after feature replacement and the actual monitored visual feature representation to obtain the abnormal deviation degree corresponding to the target law enforcement object; ranking the target law enforcement objects based on the abnormal deviation degree; selecting candidate law enforcement objects based on the ranking results; and extracting structured semantic elements from the candidate law enforcement objects.

[0009] In one implementation of this application, structured semantic elements are encapsulated for scene adaptation based on a pre-set law enforcement location type rule base to generate a supervisory semantic data frame. Specifically, this includes: taking the structured semantic elements as input, performing multi-hop related subgraph retrieval in a pre-set law enforcement knowledge graph to generate a target context subgraph corresponding to the semantics of the current law enforcement scene; encoding the structured semantic elements into a current scene state vector and comparing its similarity with the scene state vector cached at the previous moment; when the similarity is less than a preset event trigger threshold, encapsulating the current scene state vector, the difference elements that trigger the state change, and the target context subgraph to generate a supervisory semantic data frame.

[0010] In one implementation of this application, the current scene state vector, the differential elements that trigger state changes, and the target context sub-graph are encapsulated to generate a supervisory semantic data frame. Specifically, this includes: determining the supervisory value score corresponding to each structured semantic element based on historical law enforcement data and current law enforcement scene information; dividing the structured semantic elements into multiple level sets based on the supervisory value scores, and differentially encoding the structured semantic elements in different level sets; constructing a hierarchical data packet structure based on the encoded data; wherein the hierarchical data packet structure consists of at least a core layer containing the basic representation of the elements and an enhancement layer containing the corresponding data of the elements; during the encapsulation and transmission process, the supervisory value score of each structured semantic element is monitored, and if the score change value does not meet the preset score change threshold, a historical data backtracking instruction for the changed element is triggered to generate supplementary data packets based on the historical data for encapsulation and supplementary transmission.

[0011] In one implementation of this application, an encrypted supervisory semantic stream is constructed based on continuously generated supervisory semantic data frames. Specifically, this includes: encrypting the supervisory semantic data frames using a pre-set first encryption key to generate full ciphertext; encrypting key feature fields appearing in the supervisory semantic data frames using a pre-set second encryption key to generate retrieval ciphertext, and generating semantic fingerprints based on the key feature fields; wherein the key feature fields include at least one of a behavioral intent label field, a spatial relationship anomaly representation field, and a facility status anomaly encoding field; dividing the full ciphertext into multiple data slices and generating corresponding dynamic watermarks for each data slice; generating a random obfuscation factor based on the current time and the encrypted device encoding, and performing a linear transformation on the watermarked ciphertext slices using the random obfuscation factor to generate encoded ciphertext slices; encapsulating the encoded ciphertext slices, retrieval ciphertext, and semantic fingerprints to generate transmission units, and constructing an encrypted supervisory semantic stream based on the continuously transmitted transmission units.

[0012] In one implementation of this application, after constructing an encrypted supervisory semantic stream based on continuously generated supervisory semantic data frames and transmitting it to a cloud-based supervisory analysis platform, the method further includes: on the cloud-based supervisory analysis platform, matching the received semantic fingerprint with a pre-set database of non-compliant law enforcement behavior features; if the match is successful, performing multi-party computation based on the first secret share corresponding to the cloud-based supervisory analysis platform and the node holding the second secret share, and obtaining a result token; if the indication content corresponding to the result token is that no deep processing is required, then importing the encoded ciphertext slice into an encrypted storage system for archiving; if the indication content corresponding to the token is that deep processing is required, then obtaining decryption authorization from the authorizing party based on the result token, and using the decryption authorization to decrypt the encoded ciphertext slice to obtain a complete supervisory semantic data frame.

[0013] In one implementation of this application, a cloud-based supervision and analysis platform matches the supervision semantic data frame with a preset reference law enforcement knowledge graph, and outputs the post monitoring results corresponding to the target law enforcement object based on the matching results. Specifically, this includes: matching the supervision semantic data frame with rule nodes in the preset reference law enforcement knowledge graph, obtaining a law enforcement post behavior score based on the matching results; determining the judgment threshold corresponding to abnormal law enforcement behavior based on law enforcement scenario information and the historical behavior records of the target law enforcement object; comparing the law enforcement post behavior score with the judgment threshold, and if it is greater than the judgment threshold, outputting abnormal law enforcement post behavior information; retrieving supporting and weakening graph information related to the current law enforcement scenario from the preset reference law enforcement knowledge graph; and outputting post monitoring results based on the abnormal law enforcement post behavior information and the retrieved graph information.

[0014] This application provides a device for monitoring abnormal behavior of law enforcement personnel, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to: analyze surveillance video data corresponding to law enforcement locations and identify target law enforcement objects in the video frames; wherein the target law enforcement object includes at least one of target law enforcement personnel and target law enforcement facilities; extract structured semantic elements corresponding to the target law enforcement objects from the surveillance video data; wherein the structured semantic elements include at least one of the following: the identity of the law enforcement personnel, the action classification of the law enforcement personnel, the status and location of the law enforcement facilities, and the spatial topological relationship between each target law enforcement object; perform scene-adaptive encapsulation of the structured semantic elements according to a pre-set law enforcement location type rule base to generate supervisory semantic data frames; construct an encrypted supervisory semantic stream based on the continuously generated supervisory semantic data frames and transmit it to a cloud-based supervisory analysis platform, so that the cloud-based supervisory analysis platform matches the supervisory semantic data frames with a pre-set reference law enforcement knowledge graph and outputs the monitoring results of the target law enforcement object's corresponding position based on the matching results.

[0015] This application provides a non-volatile computer storage medium storing computer-executable instructions. These instructions are configured to: analyze surveillance video data corresponding to law enforcement locations and identify target law enforcement objects in the video frames; wherein the target law enforcement object includes at least one of target law enforcement personnel and target law enforcement facilities; extract structured semantic elements corresponding to the target law enforcement objects from the surveillance video data; wherein the structured semantic elements include at least one of the following: the identity identifier of the law enforcement personnel, the action classification of the law enforcement personnel, the status and location of the law enforcement facilities, and the spatial topological relationship between each target law enforcement object; perform scene-adaptive encapsulation of the structured semantic elements according to a pre-set law enforcement location type rule base to generate supervisory semantic data frames; construct an encrypted supervisory semantic stream based on the continuously generated supervisory semantic data frames and transmit it to a cloud-based supervisory analysis platform, whereby the cloud-based supervisory analysis platform matches the supervisory semantic data frames with a pre-set reference law enforcement knowledge graph and outputs the post monitoring results corresponding to the target law enforcement objects based on the matching results.

[0016] The above-mentioned technical solutions adopted in this application embodiment can achieve the following beneficial effects: Firstly, by identifying target law enforcement objects in video data, this application embodiment transforms unstructured video streams into computable entity objects, overcoming the limitations of traditional pixel-level processing due to semantic deficiencies. Secondly, this application embodiment extracts structured semantic elements and further converts object information into semantic tags containing business meaning, transforming raw visual data into machine-understandable law enforcement business language. Standardized supervisory semantic data frames are formed through semantic encapsulation, ensuring consistency across scenarios while preserving scenario-specific information. Subsequently, the construction and transmission of encrypted semantic streams not only reduces bandwidth pressure and storage costs but also ensures the security and privacy of sensitive law enforcement data during transmission through encryption mechanisms. Finally, by using cloud-based knowledge graph matching analysis to correlate semantic data with a law enforcement norm knowledge base, it is possible not only to identify abnormal law enforcement behavior but also to discover hidden law enforcement risks, improving both supervisory efficiency and the accuracy of behavior monitoring. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 A flowchart illustrating a method for monitoring abnormal behavior of law enforcement personnel in accordance with this application. Figure 2This is a schematic diagram of the structure of a monitoring device for abnormal behavior of law enforcement personnel, provided as an embodiment of this application.

[0018] Figure label: 200: Monitoring equipment for abnormal behavior of law enforcement personnel; 201: Processor; 202: Memory. Detailed Implementation

[0019] This application provides a method, device, and medium for monitoring abnormal behavior of law enforcement personnel.

[0020] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0021] Figure 1 A flowchart of a method for monitoring abnormal behavior of law enforcement officers is provided as an embodiment of this application, such as... Figure 1 As shown, the method for monitoring abnormal behavior of law enforcement officers includes the following steps: S101. Analyze the surveillance video data corresponding to the law enforcement site and identify the target law enforcement object in the video frame.

[0022] In one implementation of this application, visual features are extracted from video frames in the surveillance video data, and the extracted visual features are compared with the pre-set textual description features of law enforcement objects to calculate similarity, thereby selecting a candidate set of target law enforcement objects and their confidence levels based on the calculation results. Candidate law enforcement objects in the target law enforcement object candidate set are used as nodes, and the positional relationships and interaction relationships between candidate law enforcement objects are used as edges to construct a law enforcement scene relationship graph. Based on the object type of each node in the law enforcement scene relationship graph, a corresponding set of relationship constraint rules is matched in a pre-set law enforcement scene common sense rule base. Based on the set of relationship constraint rules, the law enforcement scene relationship graph is validated, and the confidence levels of candidate law enforcement objects are corrected according to the validation results. Candidate law enforcement objects whose corrected confidence levels meet a preset threshold are selected as target law enforcement objects. The target law enforcement object includes at least one of target law enforcement personnel and target law enforcement facilities.

[0023] Specifically, visual feature maps are extracted from each video frame in the surveillance video data. Simultaneously, the pre-set text description feature library for law enforcement objects in this embodiment stores standardized text descriptions of various law enforcement objects. These text descriptions have been converted into corresponding text feature vectors using a text encoder. The visual features of the video frames are compared with all text feature vectors to calculate similarity, generating a similarity score for each text category. This score is used as a confidence level, and categories with confidence levels higher than the initial screening threshold are selected as the candidate set of target law enforcement objects.

[0024] Secondly, after obtaining the candidate set of target law enforcement objects, a graph node is created for each candidate object. The node attributes include its category label, spatial location coordinates, and visual features. This embodiment constructs a law enforcement scene relationship graph through two types of edge relationships: one is spatial location relationships, which are connected based on the Euclidean distance and relative orientation between nodes, for example, establishing neighboring edges for nodes that are close in distance; the other is interactive action relationships, which determine whether there is interaction by analyzing the trajectory and posture changes of nodes between consecutive frames, and establishing corresponding directed edges for node pairs with interaction. Thus, a graph structure is formed where nodes represent entities and edges represent the spatiotemporal relationships between entities.

[0025] The pre-built common-sense rule base for law enforcement scenarios in this embodiment encodes reasonable constraint relationships between objects in law enforcement scenarios in a machine-readable form. Each node in the law enforcement scenario relationship graph is traversed, and based on its object type, all constraint rules involving nodes of that type are retrieved from the rule base, forming a set of relationship constraint rules for the current scenario graph. The constructed law enforcement scenario relationship graph is compared and verified with the matched set of relationship constraint rules. The verification process essentially checks whether the graph structure satisfies the logical constraints defined in the rule set. For example, for the interrogation room rule, it checks whether there are nodes of type interrogation chair and interrogated person in the graph, and whether there are used edges between them. It also checks whether there are law enforcement personnel nodes near the interrogation chair node. The verification algorithm traverses all relevant rules, marks the conditions that violate the rules in the current graph structure, and generates a detailed violation report.

[0026] Furthermore, based on the verification results, the confidence levels of each candidate object in the target law enforcement object candidate set are dynamically adjusted. Specific adjustment strategies include: if a candidate object node participates in multiple satisfied rules, its confidence level is increased; conversely, if it is involved in violating a rule, its confidence level is decreased. In addition, for conflicting candidate objects that exist simultaneously due to violations of mutual exclusion rules, the confidence level of one of them can be suppressed based on its original confidence level and the severity of the rule violation. Finally, the adjusted confidence levels are compared with a calibrated final judgment threshold. Candidate law enforcement objects with confidence levels higher than this threshold are officially identified as the target law enforcement object in the video frame, and their final category and location information are output. This application embodiment, by introducing logical verification feedback, corrects the semantic ambiguity and contextual errors that may arise from simple visual similarity matching, improving the robustness and accuracy of target recognition.

[0027] S102. Extract the structured semantic elements corresponding to the target law enforcement object from the surveillance video data.

[0028] In one implementation of this application, for each target law enforcement object and its corresponding object type and current law enforcement scenario information, a corresponding reference visual feature is determined from a pre-set law enforcement feature rule base. The monitoring feature corresponding to the current target law enforcement object is replaced with the reference visual feature, while keeping the monitoring features of other target law enforcement objects in the scenario unchanged. The degree of difference between the counterfactual feature representation after feature replacement and the actual monitored visual feature representation is determined to obtain the abnormal deviation degree corresponding to the target law enforcement object. The target law enforcement objects are ranked based on the abnormal deviation degree, candidate law enforcement objects are selected based on the ranking results, and structured semantic elements are extracted from the candidate law enforcement objects.

[0029] Specifically, this application embodiment includes a pre-built law enforcement feature rule base, which is generated in key-value pair format. The key consists of a combination of object type (e.g., police officer at a window, interrogation chair in a case-handling area, mobile law enforcement recorder) and law enforcement scene information (e.g., household registration window, interrogation room in a law enforcement case-handling area, patrol route), uniquely identified by a concatenated string of scene and type codes. The value is the standardized visual feature vector that the object of that type should present under compliant conditions in the corresponding scene. This feature vector can be obtained by clustering and averaging the multi-view, multi-instance features of the object extracted from normal video data of historical law enforcement behavior. When a target law enforcement object is identified, a query key is generated based on the identified object type and the current law enforcement scene information determined by the global scene classification module, and the corresponding reference visual feature vector is retrieved from the feature rule base.

[0030] Furthermore, for a specific target law enforcement object to be evaluated, its original monitoring visual features, actually extracted from the video, are replaced with retrieved reference visual features. Simultaneously, the monitoring visual features of all other target law enforcement objects in the scene remain unchanged. This generates a counterfactual visual feature representation that assumes the specific object is in an ideal compliance state while other objects remain unchanged. This counterfactual visual feature representation corresponds to the original actual monitoring visual feature representation in terms of data structure. For example, the original feature representation contains the actual features (FA_obs, FB_obs, FC_obs) of objects A, B, and C. For object A, FA_obs is replaced with its reference feature FA_ref to generate the counterfactual feature representation (FA_ref, FB_obs, FC_obs).

[0031] Furthermore, the overall difference between the two representations is calculated, and then, using gradient attribution techniques, the overall difference is primarily attributed to the region where the replaced feature is located, thereby quantifying the degree of visual deviation between the actual state of the specific target law enforcement object and the normal compliance reference state. The calculated attribution-based difference value is the abnormal deviation degree of the target law enforcement object. The larger this value, the greater the visual discrepancy between the object's visual appearance and its expected compliance state in the current scenario.

[0032] Iterate through all identified law enforcement targets in the current frame and calculate the corresponding anomaly deviation for each target. Then, sort all targets according to their anomaly deviation values ​​from highest to lowest, generating an ordered list. Select the top N targets, or all targets with anomaly deviations exceeding a dynamic threshold, and filter from this ordered list to identify candidate targets requiring priority in-depth analysis.

[0033] Furthermore, for each selected candidate law enforcement target, structured semantic element extraction is performed. For example, for each selected candidate, a high-resolution image region corresponding to its bounding box is first extracted from the original video frame. Subsequently, a convolutional neural network is used to perform secondary feature extraction on this region. Alternatively, the candidate law enforcement target can be considered as composed of several functional or structural components. For example, a window reception police officer can be decomposed into component regions such as head / face, torso / arms, hands, lower body / legs, and personal equipment. These components are located using a pre-trained component detection model. Then, fine-grained attribute classification or state recognition is performed on each component region: for example, head / face recognition to determine whether a police hat is being worn and the wearing procedure; hand recognition to determine whether identification, forms, or personal items are being held. Each recognition result is output as a structured attribute-value pair. The resulting set of fine-grained attributes is integrated with the basic information of the candidate law enforcement target and encoded into a machine-readable structured semantic element description, where the description can be in JSON, XML, or a specific protocol buffer format.

[0034] S103. Based on the pre-set law enforcement site type rule base, perform scenario-adaptive encapsulation of structured semantic elements to generate inspection semantic data frames.

[0035] In one implementation of this application, structured semantic elements are used as input, and multi-hop related subgraph retrieval is performed in a pre-set law enforcement knowledge graph to generate a target context subgraph corresponding to the semantics of the current law enforcement scenario. The structured semantic elements are encoded into a current scenario state vector, and a similarity comparison is performed with the scenario state vector cached at the previous time step. When the similarity is less than a preset event trigger threshold, the current scenario state vector, the difference elements that triggered the state change, and the target context subgraph are encapsulated to generate a supervisory semantic data frame.

[0036] Specifically, the received structured semantic elements (such as object IDs, actions, attributes, and interactions) are parsed into a set of entity and relation query statements. For example, the element {object_type: "police officer", action: "inquiry", interaction_with: "suspect"} is transformed into entity types and relation predicates in a graph query. These queries serve as seed nodes and initial relations, input into a pre-built law enforcement knowledge graph, which contains entities and the relationships between them. The system performs a 2-3 hop path-first traversal, starting from the seed entity and exploring along relation edges. All entities, relations, and their attributes encountered during the traversal, along with their connections, are extracted to form a subgraph structure closely related to the current input semantics, namely the target context subgraph.

[0037] Furthermore, all structured semantic elements extracted at the current moment are input into the encoder model. This encoder maps the unstructured set of elements into a dense vector of fixed dimension, which is the current scene state vector. This vector comprehensively represents the semantic picture of the entire law enforcement scene at the current moment. Simultaneously, this embodiment stores the scene state vector generated at the previous processing moment through a pre-set cache. The similarity between the current vector and the cached vector from the previous moment is calculated. By comparing this similarity value with a preset event trigger threshold, it is determined whether the overall scene state has changed.

[0038] In one implementation of this application, when the similarity is less than a preset event trigger threshold, the current scene state vector, the differential elements that trigger the state change, and the target context sub-graph are encapsulated to generate the supervisory semantic data frame. This process includes: determining the supervisory value score corresponding to each structured semantic element based on historical law enforcement data and current law enforcement scene information; dividing the structured semantic elements into multiple level sets based on the supervisory value scores, and differentially encoding the structured semantic elements in different level sets; constructing a hierarchical data packet structure based on the encoded data; wherein the hierarchical data packet structure consists at least of a core layer containing the basic representation of the elements and an enhancement layer containing the corresponding data of the elements; during the encapsulation and transmission process, the supervisory value score of each structured semantic element is monitored, and if the score change value does not meet the preset score change threshold, a historical data backtracking instruction for the changed element is triggered to generate supplementary data packets based on the historical data for encapsulation and retransmission.

[0039] Specifically, this application embodiment includes a dynamic value assessment model. The model's inputs include: a set of structured semantic elements at the current moment, the historical frequency and patterns of occurrence of each element, and static metadata of the current law enforcement scenario. Each element in the model has a predefined basic value weight, which is dynamically adjusted based on real-time and historical data. Adjustment factors include: the element's abnormal deviation degree, its correlation strength in historical violations, and the sensitivity coefficient of the current scenario. The model calculates the final supervisory value score for each element as follows: Element supervision value score = basic weight × scenario sensitivity coefficient × (1 + historical violation association factor) × real-time anomaly factor.

[0040] This calculated score is compared with a preset absolute threshold to assign a quantified supervisory value score to each element. Based on this score, the structured semantic elements are divided into three value levels: high, medium, and low. Differentiated encoding is performed for each level, specifically: for high-value elements, lossless or high-fidelity encoding is used, such as preserving complete attribute-value pairs, high-dimensional feature vectors, and precise spatiotemporal stamps; for medium-value elements, lossy but information-preserving encoding is used, such as employing lightweight compression algorithms, quantifying numerical precision, or merging similar entries; for low-value elements, highly compressed encoding is used, such as storing only their category ID, aggregate statistics, or using symbolic representation. All encodings adhere to a unified metadata format to ensure correct parsing at the decoding end.

[0041] After encoding, the data is assembled according to a hierarchical data packet structure. The core layer of this structure contains the basic representation of all structured semantic elements, such as element type IDs, basic attribute summaries, and location indexes, encapsulated in binary format to ensure the receiving end can obtain a basic overview of the scene. The enhancement layer consists of one or more sub-data packets, each corresponding to detailed data of one or more high-value elements, such as complete high-dimensional feature vectors, refined action parameters, and feature descriptors of high-resolution area images. Enhancement layer data is associated with specific elements by referencing indexes in the core layer. The final hierarchical data packet also includes header information to identify the data packet version, scene ID, timestamp, and the length and offset description of the core layer and each enhancement layer.

[0042] Furthermore, during the data transmission session, the changes in the supervisory value scores of each structured semantic element are continuously monitored. This application records the time series of each element's score using a sliding time window. For any element, if the difference between its current score and the score of the previous period exceeds a preset dynamic threshold—for example, if the score jumps by more than 50% or moves from a low level to a high level—it is determined that a significant value change has occurred, triggering a historical data backtracking instruction. At this time, the original high-fidelity or encoded data of the element within one backtracking window before the trigger point is retrieved from the local cache or edge storage. Based on the backtracked historical data, a supplementary data packet that meets the current high-value level encoding requirements is regenerated, containing detailed data of the element within the historical period. This supplementary packet is marked as a historical backtracking supplement and is prioritized for retransmission after the current data stream, ensuring that the cloud can perform retrospective analysis of the element's historical state, thereby forming a complete spatiotemporal analysis chain.

[0043] S104. Based on continuously generated inspection semantic data frames, construct an encrypted inspection semantic stream and transmit it to the cloud inspection analysis platform. The cloud inspection analysis platform will then match the inspection semantic data frames with a preset reference law enforcement knowledge graph and output the post monitoring results corresponding to the target law enforcement object based on the matching results.

[0044] In one implementation of this application, a first encryption key is used to encrypt the inspection semantic data frame, generating full ciphertext. A second encryption key is used to encrypt key feature fields appearing in the inspection semantic data frame, generating retrieval ciphertext, and a semantic fingerprint is generated based on the key feature fields; wherein the key feature fields include at least one of a behavioral intent label field, a spatial relationship anomaly representation field, and a facility status anomaly encoding field. The full ciphertext is divided into multiple data slices, and a corresponding dynamic watermark is generated for each data slice. Based on the current time and the encrypted device encoding, a random obfuscation factor is generated, and the watermarked ciphertext slice is linearly transformed using the random obfuscation factor to generate an encoded ciphertext slice. The encoded ciphertext slice, the retrieval ciphertext, and the semantic fingerprint are encapsulated to generate a transmission unit, and an encrypted inspection semantic stream is constructed based on the continuously transmitted transmission unit.

[0045] Specifically, the complete supervisory semantic data frame is symmetrically encrypted using a first encryption key, such as the AES-256-GCM algorithm, to generate full ciphertext. Simultaneously, predefined key feature fields are extracted from the data frame, including behavioral intent tags, spatial relationship anomaly identifiers, and facility status anomaly codes. These key feature fields are then encrypted using a second encryption key, such as a symmetric-based searchable encryption scheme or an encryption algorithm supporting homomorphic operations, to generate retrieval ciphertext. Furthermore, a lightweight hash function is used to operate on the plaintext or ciphertext of the key feature fields to generate a fixed-length digest, which serves as the semantic fingerprint of the data frame.

[0046] Furthermore, to enhance the robustness of data transmission and achieve fine-grained integrity verification, this embodiment divides the generated full ciphertext into multiple data slices of fixed length. A unique dynamic watermark is generated for each data slice. The watermark generation algorithm integrates the slice's sequence number, the current high-precision timestamp, the encryption device's unique code, and the hash value of the previous data slice's content. The watermark information is embedded into the corresponding data slice through a reversible encoding method, generating a watermarked ciphertext slice.

[0047] A unique random obfuscation factor is generated by combining the current timestamp and the device encoding that performed the encryption operation. Subsequently, a reversible linear transformation algorithm is used, for example, to permutate the slice bytes using a pseudo-random sequence generated based on the obfuscation factor, or to apply a lightweight linear transformation matrix controlled by the factor, to transform each resulting watermarked ciphertext slice. This transformation operation binds the content of each slice to a specific time and device, generating the final collusion-resistant encoded ciphertext slice. Even if the same data is processed at different times or by different devices, its encoded slices will exhibit significant differences, effectively resisting collusion attacks that collect multiple ciphertext copies for joint analysis.

[0048] The generated anti-collusion coded ciphertext slices, retrieval ciphertext, and semantic fingerprints are assembled according to a predefined communication protocol format and encapsulated into a complete transmission unit. Subsequently, the continuously generated transmission units are arranged in chronological order to ultimately construct a continuous encrypted supervisory semantic stream. This data stream can be sent to the cloud-based supervisory analysis platform via standard network transmission protocols. The entire encapsulation and stream construction process ensures the structural integrity, sequential correctness, and end-to-end confidentiality of the data during transmission.

[0049] In one implementation of this application, after transmission to the cloud-based inspection and analysis platform, the received semantic fingerprint is matched against a pre-built database of non-compliant law enforcement behavior features. If a match is successful, multi-party computation is performed based on the first secret share corresponding to the cloud-based inspection and analysis platform and the node holding the second secret share, and a result token is obtained. If the indication corresponding to the result token indicates that no deep processing is required, the encoded ciphertext slice is imported into an encrypted storage system for archiving. If the indication corresponding to the token indicates that deep processing is required, decryption authorization is obtained from the authorizing party based on the result token, and the decryption authorization is used to decrypt the encoded ciphertext slice to obtain a complete inspection semantic data frame.

[0050] Specifically, after receiving the transmission unit, the cloud-based supervision and analysis platform first extracts its semantic fingerprint. The platform then quickly compares this fingerprint with a pre-built database of non-compliant law enforcement behavior features. Each feature entry in this database is a set of hash values ​​for key feature fields of known or suspected violation patterns. The comparison process is implemented through hash table lookup. If the semantic fingerprint matches any record in the database, the transmission unit is determined to be involved in suspicious behavior, triggering subsequent privacy-enhanced joint analysis procedures. If no match is found, the transmission unit is considered regular data and can be directly archived.

[0051] Furthermore, upon successful semantic fingerprint matching, the cloud platform, as one of the participants, initiates a secure multi-party computation protocol with one or more authorized computing nodes. The cloud platform provides its first secret share associated with the current transmission unit, while the authorized nodes provide their second secret share and pre-defined judgment rules. Both parties perform secure computation, with neither the input ciphertext nor the secret share being exposed. Upon completion of the computation, the cloud platform obtains a result token output by the protocol, which is an encrypted or signed data structure representing the preliminary judgment conclusion.

[0052] Furthermore, the cloud platform parses the obtained result token. If the parsed token indicates low risk or requires no further processing, the event is deemed not urgent for in-depth analysis and is directly archived. If the token indicates high risk or requires in-depth processing, the cloud platform initiates a secure authorization request to a pre-defined authorization service center based on the token. After verifying the validity of the token and the legitimacy of the request, the authorization service center issues a temporary, restricted decryption authorization to the cloud platform. This authorization can be a short-term valid decryption key, whose permissions are strictly limited to decrypting the encoded ciphertext slice corresponding to the current specific transmission unit.

[0053] For all transmission units that were not subject to joint analysis or whose analysis results indicated no need for in-depth processing, their corresponding anti-collusion encoded ciphertext slices are written into an encrypted storage system for long-term archiving. The archiving process records metadata and generates data integrity certificates. For transmission units authorized to decrypt, the cloud platform first decodes the anti-collusion encoded ciphertext slices using an inverse transform algorithm to recover the watermarked ciphertext slices. Then, using a temporary decryption key obtained from the authorizing party, the decoded ciphertext slices are decrypted, and the continuity of the dynamic watermark is verified to confirm that the data has not been tampered with during transmission and decoding. Finally, the decrypted slices are reassembled to restore the complete, plaintext supervisory semantic data frame.

[0054] In one implementation of this application, the supervisory semantic data frame is matched with rule nodes in a preset reference law enforcement knowledge graph, and a law enforcement post behavior score is obtained based on the matching result. Based on law enforcement scenario information and the historical behavior records of the target law enforcement object, a judgment threshold corresponding to abnormal law enforcement behavior is determined. The law enforcement post behavior score is compared with the judgment threshold; if it is greater than the judgment threshold, abnormal law enforcement post behavior information is output. In the preset reference law enforcement knowledge graph, supporting and weakening graph information associated with the current law enforcement scenario is retrieved. Based on the abnormal law enforcement post behavior information and the retrieved graph information, the post monitoring result is output.

[0055] Specifically, after receiving the decrypted and restored semantic data frame, the cloud-based inspection and analysis platform parses it into a set of fact triples. These fact triples are then used as query input for subgraph matching within a pre-defined reference law enforcement knowledge graph. This knowledge graph is stored in a graph database, with nodes including various law enforcement entities, behaviors, states, and rule provisions, and edges representing the relationships between them. The matching process employs a graph pattern matching algorithm to find rule nodes and paths that match or are associated with the input fact triples. Each matched rule node contributes an increment or decrement to the score based on its pre-defined severity weight, matching confidence, and path complexity. All matching results are weighted and aggregated to ultimately calculate a quantified law enforcement post behavior score, which comprehensively reflects the degree of deviation between the current scenario and compliance rules.

[0056] Furthermore, based on the scene identifier in the data frame, the basic sensitivity coefficient for that scene is loaded. Then, the historical behavior scores of the target law enforcement object within a past time window are queried, and its average score, variance, and trend are calculated. Combining the current task type, time, and other factors, the basic threshold is dynamically adjusted upwards or downwards using preset rules and strategies. For example, for objects with good historical performance or in low-sensitivity scenes, the threshold may be appropriately increased to reduce false alarms; conversely, it may be decreased to improve sensitivity. Finally, a personalized and dynamic judgment threshold is generated for the current object and scene.

[0057] The calculated law enforcement behavior score is compared with a predetermined dynamic judgment threshold. If the behavior score exceeds the threshold, an anomaly judgment is triggered. Preliminary abnormal behavior information for the law enforcement position is then generated. This information is a structured data object containing at least the following fields: abnormal behavior ID, trigger timestamp, involved target law enforcement object, list of associated rule node IDs, calculated behavior score, dynamic threshold used, and a summary of the main fact triples leading to the high score. This preliminary information is cached and marked as pending verification, and can trigger a low-level real-time alarm to notify supervisory personnel.

[0058] After generating initial abnormal behavior information, to improve the accuracy of the judgment and prevent false alarms, a correlation search is performed on the rule nodes and related entities that triggered the anomaly within a pre-defined reference law enforcement knowledge graph. The search primarily retrieves two types of information: first, supporting graph information, such as other rules that logically form a causal chain with the current abnormal behavior, historical similar case nodes, or statistical information showing a recent trend of similar anomalies in the same object; second, weakening graph information, such as rule nodes that have an exception relationship with the current abnormal rule, paths showing that the current behavior conforms to a certain compliance workaround, or normal state information from other trusted data sources that can explain the current behavior. The system uses this retrieved graph information as evidentiary context.

[0059] The generated preliminary abnormal behavior information is comprehensively analyzed together with the retrieved supporting and weakening evidence graphs. The analysis process is based on pre-defined evidence fusion rules. For example, if strong weakening evidence exists, the preliminary abnormality judgment can be overturned, and the conclusion revised to compliance or requiring attention. If the supporting evidence is sufficient and no effective weakening evidence exists, the abnormality is confirmed. Finally, a structured job monitoring result is generated. This result not only includes the final judgment but also details the rules used, the associated evidence chain, the comparison of behavior scores with thresholds, and recommended handling codes based on the conclusion level. This result is output to the supervisory business system to generate reports, trigger workflows, or drive visual dashboard alerts.

[0060] Figure 2 This is a schematic diagram of the structure of a monitoring device for abnormal behavior of law enforcement officers, provided as an embodiment of this application. Figure 2 As shown, the law enforcement officer abnormal behavior monitoring device 200 includes: at least one processor 201; and a memory 202 communicatively connected to the at least one processor 201; wherein the memory 202 stores instructions executable by the at least one processor 201, and the instructions are executed by the at least one processor 201 to enable the at least one processor 201 to: analyze the surveillance video data corresponding to the law enforcement location and identify the target law enforcement object in the video frame; wherein the target law enforcement object includes at least one of the target law enforcement officer and the target law enforcement facility; and in the surveillance video data, perform structured semantic analysis on the target law enforcement object. The structured semantic elements are extracted; among them, the structured semantic elements include at least one of the following: the identification of law enforcement personnel, the classification of law enforcement personnel's actions, the status and location of law enforcement facilities, and the spatial topological relationship between each target law enforcement object; according to the pre-set law enforcement site type rule base, the structured semantic elements are encapsulated for scene adaptation to generate inspection semantic data frames; based on the continuously generated inspection semantic data frames, an encrypted inspection semantic stream is constructed and transmitted to the cloud inspection analysis platform, so that the inspection semantic data frames are matched with the pre-set reference law enforcement knowledge graph on the cloud inspection analysis platform, and the post monitoring results corresponding to the target law enforcement object are output according to the matching results.

[0061] This application provides a non-volatile computer storage medium storing computer-executable instructions. These instructions are configured to: analyze surveillance video data corresponding to law enforcement locations and identify target law enforcement objects in the video frames; wherein the target law enforcement object includes at least one of target law enforcement personnel and target law enforcement facilities; extract structured semantic elements corresponding to the target law enforcement objects from the surveillance video data; wherein the structured semantic elements include at least one of the following: the identity identifier of the law enforcement personnel, the action classification of the law enforcement personnel, the status and location of the law enforcement facilities, and the spatial topological relationship between each target law enforcement object; perform scene-adaptive encapsulation of the structured semantic elements according to a pre-set law enforcement location type rule base to generate supervisory semantic data frames; construct an encrypted supervisory semantic stream based on the continuously generated supervisory semantic data frames and transmit it to a cloud-based supervisory analysis platform, whereby the cloud-based supervisory analysis platform matches the supervisory semantic data frames with a pre-set reference law enforcement knowledge graph and outputs the post monitoring results corresponding to the target law enforcement objects based on the matching results.

[0062] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0063] The above descriptions are merely embodiments of this application and are not intended to limit the scope of this application. For those skilled in the art, various modifications and variations can be made to the embodiments of this application. These modifications or substitutions do not cause the essence of the corresponding technical solutions to depart from the spirit and scope of the technical solutions in the embodiments of this application.

Claims

1. A method for monitoring abnormal behavior of law enforcement personnel, characterized in that, The method includes: The surveillance video data corresponding to the law enforcement site is analyzed to identify the target law enforcement object in the video frame; wherein, the target law enforcement object includes at least one of the target law enforcement personnel and the target law enforcement facility; In the surveillance video data, structured semantic elements corresponding to the target law enforcement objects are extracted; wherein, the structured semantic elements include at least one of the following: the identity of the law enforcement personnel, the classification of the law enforcement personnel's actions, the status and location of the law enforcement facilities, and the spatial topological relationship between each target law enforcement object; Based on a pre-set rule base for law enforcement location types, the structured semantic elements are encapsulated for scene adaptation to generate supervisory semantic data frames. Based on the continuously generated inspection semantic data frames, an encrypted inspection semantic stream is constructed and transmitted to a cloud-based inspection analysis platform. The cloud-based inspection analysis platform then matches the inspection semantic data frames with a preset reference law enforcement knowledge graph and outputs the post monitoring results corresponding to the target law enforcement object based on the matching results.

2. The method for monitoring abnormal behavior of law enforcement personnel according to claim 1, characterized in that, The analysis of surveillance video data corresponding to law enforcement locations to identify target law enforcement objects in video frames specifically includes: Visual features are extracted from video frames in the surveillance video data, and the extracted visual features are compared with the pre-set text description features of law enforcement objects to calculate the similarity, so as to select a candidate set of target law enforcement objects and their confidence based on the calculation results. A law enforcement scenario relationship graph is constructed by taking the candidate law enforcement objects in the target law enforcement object candidate set as nodes and the positional relationships and interaction relationships between the candidate law enforcement objects as edges. Based on the object type of each node in the law enforcement scenario relationship graph, the corresponding relationship constraint rule set is matched in the pre-set law enforcement scenario common sense rule base; The law enforcement scenario relationship graph is validated based on the set of relationship constraint rules. Based on the verification results, the confidence level of the candidate law enforcement targets is corrected, and the candidate law enforcement targets whose corrected confidence level meets the preset threshold are taken as the target law enforcement targets.

3. The method for monitoring abnormal behavior of law enforcement personnel according to claim 1, characterized in that, The extraction of structured semantic elements corresponding to the target law enforcement object from the surveillance video data specifically includes: For each target law enforcement object, corresponding object type and current law enforcement scenario information are used to determine the corresponding reference visual features in a pre-set law enforcement feature rule base; Replace the monitoring features corresponding to the current target law enforcement object with the reference visual features, while keeping the monitoring features of other target law enforcement objects in the scene unchanged; The degree of difference between the counterfactual feature representation after feature replacement and the actual visual feature representation monitored is determined to obtain the abnormal deviation degree corresponding to the target law enforcement object; The target law enforcement objects are sorted based on the abnormal deviation, and candidate law enforcement objects are selected based on the sorting results. The candidate law enforcement objects are then subjected to structured semantic element extraction.

4. The method for monitoring abnormal behavior of law enforcement personnel according to claim 1, characterized in that, The step of performing scenario-adaptive encapsulation of the structured semantic elements based on a pre-set law enforcement location type rule base to generate a supervisory semantic data frame specifically includes: Using the structured semantic elements as input, multi-hop related subgraph retrieval is performed in the pre-set law enforcement knowledge graph to generate a target context subgraph corresponding to the semantics of the current law enforcement scenario; The structured semantic elements are encoded into the current scene state vector and compared with the scene state vector cached in the previous time step; When the similarity is less than a preset event trigger threshold, the current scene state vector, the difference elements that trigger the state change, and the target context sub-graph are encapsulated to generate the supervisory semantic data frame.

5. A method for monitoring abnormal behavior of law enforcement personnel according to claim 4, characterized in that, The step of encapsulating the current scene state vector, the differential elements that trigger state changes, and the target context sub-graph to generate the supervisory semantic data frame specifically includes: Based on historical law enforcement data and current law enforcement scenario information, the supervisory value scores corresponding to each of the structured semantic elements are determined. Based on the inspector value score, the structured semantic elements are divided into multiple level sets, and the structured semantic elements in different level sets are coded differently. Based on the encoded data, a hierarchical data packet structure is constructed; wherein, the hierarchical data packet structure consists of at least a core layer containing basic representations of features, and an enhancement layer containing corresponding data of features; During the encapsulation and transmission process, the supervisory value score of each structured semantic element is monitored, and if the score change value does not meet the preset score change threshold, a historical data backtracking instruction for the changed element is triggered to generate supplementary data packets based on the historical data for encapsulation and retransmission.

6. The method for monitoring abnormal behavior of law enforcement personnel according to claim 1, characterized in that, The construction of an encrypted supervisory semantic stream based on the continuously generated supervisory semantic data frames specifically includes: The inspection semantic data frame is encrypted using a preset first encryption key to generate full ciphertext; By using a pre-set second encryption key, the key feature fields appearing in the inspection semantic data frame are encrypted to generate retrieval ciphertext, and a semantic fingerprint is generated based on the key feature fields; wherein, the key feature fields include at least one of the following: behavioral intent label field, spatial relationship anomaly representation field, and facility status anomaly encoding field; The full encrypted text is divided into multiple data slices, and a corresponding dynamic watermark is generated for each data slice. Based on the current time and the device encoding for encryption, a random obfuscation factor is generated. The watermarked ciphertext slice is then linearly transformed using the random obfuscation factor to generate an encoded ciphertext slice. The encoded ciphertext slice, the retrieved ciphertext, and the semantic fingerprint are encapsulated to generate a transmission unit, and the encrypted supervisory semantic stream is constructed based on the continuously transmitted transmission unit.

7. A method for monitoring abnormal behavior of law enforcement personnel according to claim 6, characterized in that, After constructing an encrypted inspection semantic stream based on the continuously generated inspection semantic data frames and transmitting it to the cloud-based inspection analysis platform, the method further includes: The received semantic fingerprints are matched with a pre-set database of non-compliant law enforcement behavior features on the cloud-based inspection and analysis platform. If a match is successful, multi-party calculations are performed based on the first secret share corresponding to the cloud-based supervision and analysis platform and the node holding the second secret share, and a result token is obtained. If the indication content corresponding to the result token is that no deep processing is required, then the encoded ciphertext slice is imported into the encrypted storage system for archiving. If the indication content corresponding to the token requires in-depth processing, then based on the result token, a decryption authorization is obtained from the authorizing party, and the decryption authorization is used to decrypt the encoded ciphertext slice to obtain a complete supervisory semantic data frame.

8. A method for monitoring abnormal behavior of law enforcement personnel according to claim 1, characterized in that, The process involves matching the inspection semantic data frame with a preset reference law enforcement knowledge graph on the cloud-based inspection and analysis platform, and outputting the post monitoring results corresponding to the target law enforcement object based on the matching results. Specifically, this includes: The inspection semantic data frame is matched with the rule nodes in the preset reference law enforcement knowledge graph, and the law enforcement post behavior score is obtained based on the matching result. Based on law enforcement scenario information and the historical behavior records of the target law enforcement object, the judgment threshold corresponding to abnormal law enforcement behavior is determined. The law enforcement post behavior score is compared with the judgment threshold. If it is greater than the judgment threshold, the abnormal behavior information of the law enforcement post is output. In the preset reference law enforcement knowledge graph, retrieve supporting and weakening graph information that is associated with the current law enforcement scenario; Based on the abnormal behavior information of the law enforcement positions and the retrieved graph information, the monitoring results of the positions are output.

9. A monitoring device for abnormal behavior of law enforcement personnel, characterized in that, The device includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the device is triggered to perform the method described in any one of claims 1-8.

10. A non-volatile computer storage medium storing computer-executable instructions, characterized in that, The computer-executable instructions are capable of performing the method described in any one of claims 1-8.

Images