A big data-based intelligent campus safety early warning platform

Abstract

The application discloses a kind of based on big data's wisdom campus safety early warning platform, including following steps: data preprocessing module, for collecting campus multi-source heterogeneous security data and pre-processing, form early warning analysis dataset;Candidate pair generation module, for extracting record link identification and generating candidate record pair set;Candidate pair screening module, for carrying out gate screening based on campus reachable domain constraint;Matching weight formation module, for executing the matching weight formation based on identity-event double-track comparison;Associated record link module, for executing Fellegi-Sunter probability record link algorithm to generate uniform association index;Matching determination result updating module, for executing the three-value determination boundary self-updating of grey zone upgrade backflow;Hierarchical early warning module, for output hierarchical early warning result.The application improves the association merging capability and hierarchical early warning accuracy of wisdom campus multi-source heterogeneous security data.

Description

Technical Field

[0001] This invention relates to the field of campus safety early warning technology, and in particular to a smart campus safety early warning platform based on big data. Background Technology

[0002] With the continuous development of big data, the Internet of Things, artificial intelligence, and smart security technologies, the construction of smart campuses has gradually evolved from the basic information management stage to the stage of comprehensive perception, intelligent analysis, and coordinated early warning. Existing smart campus security management typically relies on multi-source business systems such as video surveillance, access control, facial recognition, dormitory access control, campus card payment, attendance management, leave management, visitor registration, fire monitoring, environmental monitoring, location tracking, and network behavior logs to collect, summarize, and analyze data on personnel activities, site status, and abnormal events within the campus, thereby enabling the discovery, assessment, and early warning of campus security risks.

[0003] However, existing technologies still have significant shortcomings in practical applications. Most existing smart campus security early warning solutions focus on statistical analysis, rule judgment, or anomaly detection of data from a single business system or simply aggregated multi-source data. They lack in-depth processing mechanisms for the correlation between heterogeneous records across systems, making it difficult to accurately merge data records belonging to the same object or the same event chain. This can easily lead to the same object being identified separately and the same risk event being judged separately. Secondly, in the process of candidate data screening, existing technologies usually only use time proximity, spatial proximity, or simple rule filtering methods, lacking reachability constraint mechanisms that combine the characteristics of the campus scenario. They cannot fully consider the connectivity, travel paths, and spatiotemporal continuity between different locations in the campus scenario, resulting in an excessive number of candidate record pairs, a large number of invalid candidates, a heavy burden of subsequent correlation calculations, and a high probability of mismatch.

[0004] Therefore, how to provide a smart campus security early warning platform based on big data is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a smart campus security early warning platform based on big data. This invention achieves efficient association and merging of multi-source heterogeneous security data in the campus through candidate pair gating screening, identity-event dual-track comparison and weighting, Fellegi-Sunter probability record linking, and gray zone upgrade backflow update. This reduces the probability of false matching and missed matching, and improves the ability of smart campus security risk identification, the accuracy of early warning judgment, and the stability of hierarchical early warning output.

[0006] According to an embodiment of the present invention, a smart campus security early warning platform based on big data includes: The data preprocessing module is used to collect multi-source heterogeneous security data from the campus and preprocess it to form an early warning analysis dataset; The candidate pair generation module is used to extract record link identifiers from the early warning analysis dataset and generate a set of candidate record pairs based on the record link identifiers. The candidate pair filtering module is used for a candidate pair gating mechanism based on campus reachability domain constraints to filter the set of candidate record pairs and form a target set of candidate record pairs. The matching weight formation module is used to perform matching weight formation based on identity-event dual-track comparison for the target candidate record pair set, and obtain the matching weight corresponding to each target candidate record pair; The associated record linking module is used to perform the Fellegi-Sunter probabilistic record linking algorithm on the set of target candidate record pairs using the matching weights of each target candidate record pair, to obtain matching record pairs and record pairs to be reviewed, and to generate a unified associated index based on the matching record pairs; The matching judgment result update module is used to self-update the three-value judgment boundary of the record to be reviewed by performing gray zone upgrade backflow, and form the updated matching judgment result. The tiered early warning module is used to perform cross-system association and risk identification of early warning objects based on a unified association index, updated matching judgment results, and early warning analysis dataset, and output tiered early warning results.

[0007] Optionally, the data preprocessing module includes: Raw security data is collected from different business systems on campus. The raw security data is then aggregated, and integrity, duplication, and validity checks are performed on the aggregated raw security data. Data records with missing key content, duplicate data records, and invalid data records are removed to form a dataset to be processed. The dataset to be processed is preprocessed to obtain a standardized dataset; The standardized datasets are aggregated and organized, and then grouped according to the data organization methods required for early warning analysis to form an early warning analysis dataset.

[0008] Optionally, the candidate pair generation module includes: Read each data record in the early warning analysis dataset, split each data record according to a unified record parsing rule, extract the associated content that can represent the record subject, the time of the record, the location of the record, and the status of the record behavior, and combine the extracted associated content in a unified order to form a record link identifier that corresponds one-to-one with each data record. Based on the record link identifiers corresponding to each data record, any two data records are compared pairwise, and the comparison results are summarized to form the link comparison results; Based on the link comparison results, any two data records are judged as candidates, and the data record pairs that meet the preset association conditions are determined as candidate record pairs, forming a candidate judgment result corresponding to the link comparison results. Each candidate record pair determined by the candidate determination is collected and organized, and duplicate candidate record pairs and obviously conflicting candidate record pairs are removed to form a candidate record pair set.

[0009] Optionally, the candidate pair screening module includes: Read each candidate record pair in the candidate record pair set, and for each candidate record pair, obtain the time association content and spatial association content in the record link identifier of the corresponding two data records to form the basic data for reachability domain determination; The basic data for reachability determination adopts a candidate pair gating mechanism based on campus reachability constraints. The temporal continuity, spatial connectivity, and path reachability between two data records in a candidate record pair are determined. The temporal continuity determination is whether the time difference between the occurrence of the two data records is within a preset time range. The spatial connectivity determination is whether there is a permissible spatial connection between the corresponding positions of the two data records. The path reachability determination is whether it is possible to reach the corresponding position of the next data record from the corresponding position of the previous data record within the corresponding time range under the permissible path. The reachability determination results are formed for each candidate record pair. The campus reachability constraint condition is whether the candidate record pair meets the determination conditions of temporal continuity, spatial connectivity, and path reachability. Based on the reachability domain determination results, candidate record pairs that meet the campus reachability domain constraints are retained, while candidate record pairs that do not meet the campus reachability domain constraints are eliminated, forming a set of retained record pairs after gating. The retained record pairs are collected and organized to form the target candidate record pairs set.

[0010] Optionally, the matching weight formation module includes: Read each target candidate record pair in the target candidate record pair set, and extract the identity-related content and event-related content from the record link identifier for each target candidate record pair to form the basic data for dual-track comparison; The identity-related content in the dual-track comparison base data is compared item by item to determine the consistency results of each identity comparison item and summarize them to form the identity merging comparison results of the corresponding target candidate record pairs; The event-related content in the dual-track comparison base data is compared item by item to determine the continuity results of each event comparison item and summarize them to form the event link comparison results of the corresponding target candidate record pairs. The credibility of the identity merging comparison results and the event linking comparison results is coupled to obtain the coupling comparison value of the target candidate record pair; The coupling comparison weights are normalized to determine the corresponding matching weights for each target candidate record pair.

[0011] Optionally, the associated record linking module includes: Read the matching weight, identity merging comparison result and event link comparison result of each target candidate record pair in the target candidate record pair set, and construct a record link comparison vector that corresponds one-to-one with each target candidate record pair. Based on the record link comparison vector, and according to the Fellegi-Sunter probabilistic record linking algorithm, the identity matching probability in the matching state and the identity non-matching probability in the non-matching state of the identity merging comparison result are determined respectively. The event matching probability in the matching state and the event non-matching probability in the non-matching state of the event link comparison result are determined respectively, forming Fellegi-Sunter dual-track probability judgment data corresponding to each target candidate record pair. Based on the Fellegi-Sunter dual-track probability determination data, the ratio of identity matching probability to identity non-matching probability corresponding to the identity merging comparison result is converted to form the identity track link contribution value. The ratio of event matching probability to event non-matching probability corresponding to the event link comparison result is converted to form the event track link contribution value. The identity track link contribution value and the event track link contribution value are weighted and coupled with the corresponding matching weight of each target candidate record to form the comprehensive record link weight of each target candidate record to the corresponding comprehensive record. The comprehensive record link weight corresponding to each target candidate record pair is compared with the preset upper judgment threshold and the preset lower judgment threshold respectively. When the comprehensive record link weight is greater than or equal to the preset upper judgment threshold, the corresponding target candidate record pair is determined as a matching record pair. When the comprehensive record link weight is less than the preset upper judgment threshold but greater than the preset lower judgment threshold, the corresponding target candidate record pair is determined as a record pair to be reviewed. When the comprehensive record link weight is less than or equal to the preset lower judgment threshold, the corresponding target candidate record pair is determined as a non-matching record pair, thus forming the three-value judgment result corresponding to each target candidate record pair. The target candidate record pairs that are determined to be matching record pairs are associated and merged, and a unified associated index is generated in the manner that the same associated object corresponds to the same index identifier.

[0012] Optionally, the matching result update module includes: Read the pairs of records to be reviewed, and extract the corresponding comprehensive record link weight, three-value judgment result, and association status information in the unified association index for each pair of records to be reviewed, forming the basic data for gray zone judgment; The gray zone determination base data is processed to preserve the gray zone. The pairs of records to be reviewed whose comprehensive record link weights are between the preset upper and lower determination thresholds are retained as gray zone record pairs. New associated records corresponding to each gray zone record pair are continuously received to form gray zone upgrade input data. Based on the gray zone upgrade input data, the identity association consistency verification, event process continuity verification, and new record support strength determination are performed on each gray zone record pair to form the gray zone upgrade determination result; Based on the gray area upgrade judgment result, the three-value judgment boundary is automatically updated, the preset upper judgment threshold and the preset lower judgment threshold are adjusted, and each gray area record pair is re-matched and judged based on the adjusted preset upper judgment threshold and the adjusted preset lower judgment threshold. The re-evaluated matching record pairs, record pairs awaiting review, and non-matching record pairs are collected and organized to form an updated matching evaluation result.

[0013] Optionally, the tiered early warning module includes: The data records belonging to the same associated object in the early warning analysis dataset are aggregated according to the unified association index, and the aggregated data records are filtered according to the updated matching judgment results to form the early warning object dataset. Perform cross-system association and merging on the early warning object dataset. According to the unified association index, data records from different business systems are associated, sorted in time sequence, and merged to form cross-system association results corresponding to each early warning object. Based on the cross-system correlation results, risk identification data corresponding to each early warning object is extracted to form basic data for risk identification. Risk identification is performed on the basic data for risk identification to determine the risk status, risk type and risk level of each early warning object, and a graded early warning result is generated.

[0014] The beneficial effects of this invention are: This invention provides a unified data foundation for subsequent cross-system association and merging by uniformly preprocessing multi-source heterogeneous security data on campus and extracting record link identifiers to generate a candidate record pair set. This improves upon the problems of inconsistent data formats, semantic inconsistencies, and difficulty in direct association between different business systems in existing technologies. Secondly, this invention introduces a candidate pair gating mechanism based on campus reachability domain constraints to filter the candidate record pair set. This removes invalid candidate record pairs that do not meet the campus spatiotemporal reachability logic before entering the record link calculation, thereby reducing the number of invalid candidate pairs, lowering the complexity of subsequent association calculations, and improving the rationality and effectiveness of candidate record pairs.

[0015] This invention combines the judgment of subject identity with the judgment of the continuity of behavior process by forming matching weights based on identity-event dual-track comparison. This changes the way weights are calculated using a single comparison dimension in the prior art, and allows different types of related information to participate in the determination of matching weights, thereby improving the accuracy and stability of candidate records in the matching results.

[0016] This invention introduces the matching weight into the Fellegi-Sunter probabilistic record linking algorithm to form an improved record linking process for smart campus scenarios. This not only improves the reliability of cross-system data record merging, but also generates a unified association index based on the matching record pairs, providing unified support for subsequent risk identification and early warning object categorization.

[0017] This invention performs a three-valued judgment boundary self-update on the record to be reviewed based on gray zone upgrade backflow, which can incorporate the newly added associated record, review result and boundary adjustment process into the same update link. This overcomes the problem of insufficient utilization of the review result caused by one-time static judgment in the prior art, thereby improving the re-judgment capability of uncertain associated results.

[0018] Based on a unified association index, updated matching judgment results, and early warning analysis dataset, this invention performs cross-system association merging and risk identification on early warning objects and outputs hierarchical early warning results. This improves the overall capability of smart campus security incident discovery, risk identification, and hierarchical early warning output, reduces the probability of false matching and missed matching, and improves the accuracy, stability, and practicality of smart campus security early warning. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a smart campus security early warning platform based on big data proposed in this invention; Figure 2 This is a schematic diagram of the candidate gating mechanism and the three-value judgment boundary self-updating mechanism of a smart campus security early warning platform based on big data proposed in this invention. Figure 3 This is a schematic diagram of the Fellegi-Sunter probability record linking algorithm for a smart campus security early warning platform based on big data proposed in this invention. Detailed Implementation

[0020] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0021] refer to Figures 1-3 A smart campus security early warning platform based on big data includes the following steps: The data preprocessing module is used to collect multi-source heterogeneous security data from the campus and preprocess it to form an early warning analysis dataset; The candidate pair generation module is used to extract record link identifiers from the early warning analysis dataset and generate a set of candidate record pairs based on the record link identifiers. The candidate pair filtering module is used for a candidate pair gating mechanism based on campus reachability domain constraints to filter the set of candidate record pairs and form a target set of candidate record pairs. The matching weight formation module is used to perform matching weight formation based on identity-event dual-track comparison for the target candidate record pair set, and obtain the matching weight corresponding to each target candidate record pair; The associated record linking module is used to perform the Fellegi-Sunter probabilistic record linking algorithm on the set of target candidate record pairs using the matching weights of each target candidate record pair, to obtain matching record pairs and record pairs to be reviewed, and to generate a unified associated index based on the matching record pairs; The matching judgment result update module is used to self-update the three-value judgment boundary of the record to be reviewed by performing gray zone upgrade backflow, and form the updated matching judgment result. The tiered early warning module is used to perform cross-system association and risk identification of early warning objects based on a unified association index, updated matching judgment results, and early warning analysis dataset, and output tiered early warning results.

[0022] In this embodiment, the data preprocessing module includes: Raw security data is collected from different business systems on campus. The raw security data is then aggregated, and integrity, duplication, and validity checks are performed on the aggregated raw security data. Data records with missing key content, duplicate data records, and invalid data records are removed to form a dataset to be processed. The raw security data includes video surveillance data, access control data, face capture data, dormitory access data, campus card consumption data, attendance data, leave application and cancellation data, visitor registration data, fire monitoring data, environmental monitoring data, location trajectory data, network behavior log data, and historical security incident handling data. Data preprocessing is performed on the dataset to be processed. Data preprocessing includes time alignment of the record time in the dataset to be processed according to a unified time base, spatial mapping of the location identifier in the dataset to be processed according to a unified spatial coding rule, field standardization of the data content in the dataset to be processed according to a preset data format rule, and semantic unification of the business tags in the dataset to be processed according to a preset business semantic rule, so as to obtain a standardized dataset. The standardized datasets are aggregated and organized, and then grouped according to the data organization methods required for early warning analysis to form an early warning analysis dataset.

[0023] In this embodiment, the candidate pair generation module includes: Read each data record in the early warning analysis dataset, split each data record according to a unified record parsing rule, extract the associated content that can represent the record subject, the time of the record, the location of the record, and the status of the record behavior, and combine the extracted associated content in a unified order to form a record link identifier that corresponds one-to-one with each data record. Based on the record link identifiers corresponding to each data record, any two data records are compared pairwise. The pairwise comparison includes determining the degree of consistency and difference between the two data records in terms of record subject association content, time association content, location association content, and behavior association content. The comparison results are then summarized to form the link comparison results. Based on the link comparison results, any two data records are judged as candidates. Data record pairs that meet the preset association conditions are determined as candidate record pairs. The preset association conditions include the possibility of association between the record subjects, the continuity of association in the recording process, and the rationality of association in the recording behavior, thus forming a candidate judgment result corresponding to the link comparison results. Each candidate record pair determined by the candidate determination is collected and organized, and duplicate candidate record pairs and obviously conflicting candidate record pairs are removed to form a candidate record pair set.

[0024] In this embodiment, the candidate pair screening module includes: Read each candidate record pair in the candidate record pair set, and for each candidate record pair, obtain the time association content and spatial association content in the record link identifier of the corresponding two data records to form the basic data for reachability domain determination; The basic data for reachability determination adopts a candidate pair gating mechanism based on campus reachability constraints. The temporal continuity, spatial connectivity, and path reachability between two data records in a candidate record pair are determined. Temporal continuity is determined by whether the time difference between the occurrence of the two data records is within a preset time range. Spatial connectivity is determined by whether there is a permissible spatial connection between the corresponding locations of the two data records. Path reachability is determined by whether it is possible to reach the corresponding location of the next data record from the corresponding location of the previous data record within the corresponding time range under a permissible path. The reachability determination results are formed for each candidate record pair. The campus reachability constraint condition is whether the candidate record pair meets the determination conditions of temporal continuity, spatial connectivity, and path reachability. Based on the reachability domain determination results, candidate record pairs that meet the campus reachability domain constraints are retained, while candidate record pairs that do not meet the campus reachability domain constraints are eliminated, forming a set of retained record pairs after gating. The retained record pairs are collected and organized to form the target candidate record pairs set.

[0025] This invention introduces a candidate pair gating and screening mechanism based on campus reachability domain constraints. It imposes joint constraints on candidate record pairs in terms of temporal continuity, spatial connectivity, and path reachability. This effectively eliminates invalid candidate record pairs that do not conform to the actual activity patterns on campus, reduces the burden of subsequent correlation calculations, and improves the accuracy of target candidate record pairs and the overall efficiency of early warning analysis.

[0026] In this embodiment, the matching weight formation module includes: Read each target candidate record pair in the target candidate record pair set, and extract the identity association content and event association content from the record link identifier for each target candidate record pair to form dual-track comparison base data. The identity association content is used to characterize whether the subjects corresponding to the two data records in the candidate record pair have the sameness or association, and the event association content is used to characterize whether the corresponding behavior processes of the two data records in the candidate record pair have continuity or association. The identity association content in the dual-track comparison base data is compared item by item to determine the consistency results of each identity comparison item and summarize them to form the identity merging comparison results of the corresponding target candidate record pairs. The identity merging comparison results are recorded as identity merging comparison values, which are determined by the consistency accumulation method of identity merging comparison items. They are equal to the sum of the products of the comparison results of each identity merging comparison item and the weight of the corresponding identity merging comparison item. The comparison results of each identity merging comparison item are used to characterize whether the corresponding identity merging comparison item is consistent or similar, and the weight of each identity merging comparison item is used to characterize the degree of contribution of the corresponding identity merging comparison item in identity merging. The event-related content in the dual-track comparison base data is compared item by item to determine the continuity results of each event comparison item and summarize them to form the event link comparison results of the corresponding target candidate record pairs. The event link comparison results are recorded as event link comparison values, which are determined by the continuous accumulation method of event link comparison items. They are equal to the sum of the products of the comparison results of each event link comparison item and the weight of the corresponding event link comparison item. The comparison results of each event link comparison item are used to characterize whether the corresponding event link comparison item is continuous or related, and the weight of each event link comparison item is used to characterize the degree of contribution of the corresponding event link comparison item in the event link. The credibility of the identity merging comparison result and the event linking comparison result is coupled to obtain the coupling comparison value of the target candidate record pair. The coupling comparison value is denoted as the coupling comparison weight, which is equal to the sum of the product of the identity credibility coefficient and the identity merging comparison value and the product of the event credibility coefficient and the event linking comparison value. The identity credibility coefficient is used to characterize the credibility of the identity merging comparison result, and the event credibility coefficient is used to characterize the credibility of the event linking comparison result. The coupling comparison weights are normalized to determine the corresponding matching weights for each target candidate record pair.

[0027] This invention, by performing dual-track comparisons of identity-related content and event-related content in candidate record pairs and implementing credibility coupling, can more accurately reflect the merging relationship of the same subject and the continuity of the behavioral process, improve the pertinence and stability of matching weight determination, and thus reduce the probability of false matching and missed matching in multi-source heterogeneous security data association analysis.

[0028] In this embodiment, the associated record linking module includes: Read the matching weight, identity merging comparison result and event link comparison result of each target candidate record pair in the target candidate record pair set, and construct a record link comparison vector that corresponds one-to-one with each target candidate record pair. Based on the record link comparison vector, and according to the Fellegi-Sunter probabilistic record linking algorithm, the identity matching probability in the matching state and the identity non-matching probability in the non-matching state of the identity merging comparison result are determined respectively. The event matching probability in the matching state and the event non-matching probability in the non-matching state of the event link comparison result are determined respectively, forming Fellegi-Sunter dual-track probability judgment data corresponding to each target candidate record pair. Based on the Fellegi-Sunter dual-track probability determination data, the ratio of identity matching probability to identity non-matching probability corresponding to the identity merging comparison result is converted to form the identity track link contribution value. The ratio of event matching probability to event non-matching probability corresponding to the event link comparison result is converted to form the event track link contribution value. The identity track link contribution value and the event track link contribution value are weighted and coupled with the corresponding matching weight of each target candidate record to form the comprehensive record link weight of each target candidate record to the corresponding comprehensive record. The comprehensive record link weight corresponding to each target candidate record pair is compared with the preset upper judgment threshold and the preset lower judgment threshold respectively. When the comprehensive record link weight is greater than or equal to the preset upper judgment threshold, the corresponding target candidate record pair is determined as a matching record pair. When the comprehensive record link weight is less than the preset upper judgment threshold but greater than the preset lower judgment threshold, the corresponding target candidate record pair is determined as a record pair to be reviewed. When the comprehensive record link weight is less than or equal to the preset lower judgment threshold, the corresponding target candidate record pair is determined as a non-matching record pair, thus forming the three-value judgment result corresponding to each target candidate record pair. The target candidate record pairs that are determined to be matching record pairs are associated and merged, and a unified associated index is generated in the manner that the same associated object corresponds to the same index identifier.

[0029] This invention introduces the identity merging comparison result and the event linking comparison result into the Fellegi-Sunter probabilistic record linking process, forming a dual-track probability determination and comprehensive linking weight calculation mechanism for multi-source heterogeneous security data in smart campuses. This mechanism can improve the accuracy of associated object identification and the reliability of unified association index generation, and reduce the probability of false matching and missed matching.

[0030] In this embodiment, the matching result update module includes: Read the pairs of records to be reviewed, and extract the corresponding comprehensive record link weight, three-value judgment result, and association status information in the unified association index for each pair of records to be reviewed, forming the basic data for gray zone judgment; The gray zone determination base data is processed to preserve the gray zone. The pairs of records to be reviewed whose comprehensive record link weights are between the preset upper and lower determination thresholds are retained as gray zone record pairs. New associated records corresponding to each gray zone record pair are continuously received to form gray zone upgrade input data. Based on the gray zone upgrade input data, the identity association consistency review, event process continuity review, and new record support strength determination are performed on each gray zone record pair to form the gray zone upgrade determination result. The new record support strength determination is based on the degree of enhancement of the link weight of the new associated record to the original comprehensive record of the gray zone record pair to determine whether each gray zone record pair meets the upgrade conditions. Based on the gray zone upgrade judgment result, the three-value judgment boundary is self-updated, the preset upper judgment threshold and the preset lower judgment threshold are adjusted, and each gray zone record pair is re-matched and judged according to the adjusted preset upper judgment threshold and the adjusted preset lower judgment threshold. The matching judgment includes determining gray zone record pairs that reach the adjusted preset upper judgment threshold as matching record pairs, retaining gray zone record pairs that are lower than the adjusted preset upper judgment threshold but higher than the adjusted preset lower judgment threshold as record pairs to be reviewed, and determining gray zone record pairs that reach or are lower than the adjusted preset lower judgment threshold as non-matching record pairs. The re-evaluated matching record pairs, record pairs awaiting review, and non-matching record pairs are collected and organized to form an updated matching evaluation result.

[0031] This invention introduces a gray zone upgrade backflow and a three-value judgment boundary self-update mechanism, which can continuously maintain, dynamically enhance and re-judge the records to be reviewed, effectively improve the utilization rate of uncertain association results, reduce the risk of mismatch and missed match caused by static judgment, and improve the accuracy, stability and reliability of the association and merging of multi-source heterogeneous security data in smart campuses and the subsequent hierarchical early warning results.

[0032] In this embodiment, the graded early warning module includes: The data records belonging to the same associated object in the early warning analysis dataset are aggregated according to the unified association index, and the aggregated data records are filtered according to the updated matching judgment results to form the early warning object dataset. Perform cross-system association and merging on the early warning object dataset. According to the unified association index, data records from different business systems are associated, sorted in time sequence, and merged to form cross-system association results corresponding to each early warning object. Based on the cross-system correlation results, risk identification data corresponding to each early warning object is extracted. The risk identification data includes the object's activity trajectory, behavior change process, abnormal event correlation, and historical handling correlation, forming the basic data for risk identification. Risk identification is performed on the basic data for risk identification to determine the risk status, risk type and risk level of each warning object. The risk level is divided into different warning levels according to the preset classification rules, and a graded warning result is generated.

[0033] Example 1: To verify the feasibility of this invention in practice, it was applied to the smart campus security management scenario of a comprehensive university. The campus has already constructed a video surveillance system, access control system, facial recognition system, dormitory access management system, campus card system, attendance management system, leave application and cancellation management system, visitor registration system, fire monitoring system, environmental monitoring system, location tracking management system, and network behavior log management system. However, these systems have long operated independently, resulting in differences in data formats, time bases, spatial identifiers, and business tags. This means that when faced with situations such as abnormal gatherings, abnormal loitering, unauthorized entry into key areas, discrepancies between leave status and actual activities, and abnormal visitor activity, the campus security management department often needs to manually retrieve data from multiple systems for verification. Existing processing methods can usually only perform rule judgments on data from a single system or make rough comparisons on simply aggregated data. It is difficult to effectively merge records of the same object across systems, and it is also difficult to accurately associate discrete records in the same event chain. This can easily lead to problems such as the same object being identified separately, the same risk event being judged in segments, and the results pending review not being continuously usable, thus affecting the accuracy, real-time performance, and stability of smart campus security early warning.

[0034] In this scenario, the data preprocessing module first accesses the campus's multi-source heterogeneous security data and performs integrity checks, duplication checks, and validity checks on the collected data to delete records with missing key content, duplicate records, and obviously invalid records. Then, the retained data undergoes unified time benchmark alignment, unified spatial encoding mapping, field standardization, and unified business semantic processing to form an early warning analysis dataset.

[0035] After the early warning analysis dataset is formed, the candidate pair generation module extracts record link identifiers from each data record and generates a set of candidate record pairs based on these identifiers. In generating candidate record pairs, the system no longer uses a single field or simple temporal proximity for coarse concatenation. Instead, it uses record link identifiers to uniformly express the potential relationships between different records, allowing records from different business systems to enter the same candidate pair generation chain. Subsequently, the candidate pair filtering module introduces a candidate pair gating mechanism based on campus reachability constraints, gating candidate record pairs at three levels: temporal continuity, spatial connectivity, and path reachability. Candidate record pairs that do not conform to the actual activity patterns on campus—for example, record pairs that cannot be reached from one location to the next within the corresponding time range via an allowed path—are directly eliminated. Candidate record pairs that meet the campus reachability constraints are retained and form the target candidate record pair set. Through this process, a large number of invalid candidate pairs, common in existing technologies, are effectively compressed, avoiding the consumption of computational resources on a large number of false candidates in subsequent association calculations and reducing the probability of mismatches.

[0036] After the target candidate record pairs are formed, the matching weight formation module performs matching weight formation on each target candidate record pair based on a dual-track comparison of identity and event. Specifically, the system extracts identity-related content and event-related content from the record link identifiers, whereby the identity-related content characterizes whether the subjects corresponding to the two data records in the candidate record pair are identical or related, and the event-related content characterizes whether the corresponding behavioral processes of the two data records in the candidate record pair are continuous or related. Subsequently, the system compares the identity-related content item by item to form an identity merging comparison result, and compares the event-related content item by item to form an event link comparison result. Then, the system performs credibility coupling on the identity merging comparison result and the event link comparison result to determine the matching weight corresponding to each target candidate record pair. Compared with the existing technology that uses a single dimension for matching scoring, this invention can simultaneously consider the subject merging relationship and the event process relationship, avoiding one-sided judgments based solely on a single identity information or a single behavioral information, thereby improving the pertinence and stability of the matching weight formation.

[0037] After the matching weights are formed, the associated record linking module introduces the matching weights corresponding to each target candidate record pair into the Fellegi-Sunter probabilistic record linking algorithm. It then combines the identity merging comparison results and the event linking comparison results to perform a dual-track probability determination, further forming a comprehensive record linking weight. By comparing this comprehensive record linking weight with preset upper and lower judgment thresholds, target candidate record pairs are divided into matching record pairs, record pairs awaiting review, and non-matching record pairs. A unified association index is generated based on the matching record pairs. This unified association index allows for the unified organization and management of records of the same associated object that were originally scattered across multiple business systems, thus providing stable support for subsequent early warning object identification and risk analysis.

[0038] For record pairs awaiting review, this invention further executes a self-updating of the three-valued judgment boundary based on gray zone upgrade backflow through a matching judgment result update module. In specific applications, the record pairs awaiting review are first processed to maintain the gray zone, and new associated records corresponding to the gray zone record pairs are continuously received. When a new record can enhance the original comprehensive record link relationship, the gray zone record pairs undergo identity association consistency review, event process continuity review, and new record support strength judgment, and the three-valued judgment boundary is self-updated accordingly. After boundary adjustment, the system re-matches the gray zone record pairs, thereby upgrading some record pairs that were originally in an uncertain state to matching record pairs or downgrading them to non-matching record pairs. Through this process, a large number of intermediate results that remain in the manual waiting-for-verification state in the prior art are effectively utilized, avoiding omissions and misjudgments caused by static judgment, and also enabling new evidence to have a reverse effect on the front-end record link boundary.

[0039] After generating a unified association index and outputting updated matching results, the hierarchical early warning module uses the unified association index, updated matching results, and early warning analysis dataset to perform cross-system association merging and risk identification of early warning objects. In specific applications, the system aggregates records from multiple systems belonging to the same associated object, and then extracts risk identification data based on activity trajectories, behavioral change processes, abnormal event associations, and historical handling associations to identify the risk status, risk type, and risk level of the early warning object, and finally outputs hierarchical early warning results.

[0040] To further illustrate the effectiveness of this invention, the solution is compared with traditional single-system rule-based early warning schemes and traditional single-track record-linking early warning schemes. The traditional single-system rule-based early warning scheme relies primarily on data from a single business system and preset rule thresholds to identify and warn of abnormal behavior or security events. The traditional single-track record-linking early warning scheme is based on a single correlation dimension to uniformly match and link multi-source data records, and generates early warning results accordingly. Specific comparison data is shown in Table 1. Table 1 Comparison of Performance Indicators of Different Schemes

[0041] The comparison results in Table 1 show that the proposed solution exhibits superior overall performance in smart campus security early warning scenarios. Compared with traditional single-system rule-based early warning schemes and traditional single-track record-linked early warning schemes, the proposed solution, by introducing a candidate pair gating mechanism based on campus reachability domain constraints, a matching weight formation method based on identity-event dual-track comparison, Fellegi-Sunter probability record linking, and a three-valued judgment boundary self-updating mechanism for gray zone upgrade backflow, improves the candidate pair compression rate to 72.74%, the matching accuracy to 93.84%, the recall rate to 91.26%, and the F1 score to 0.925. Simultaneously, it reduces the false negative rate and false positive rate to 4.92% and 3.85%, respectively, shortens the average manual verification time to 6.9 minutes, and achieves a gray zone record pair upgrade success rate of 37.77%. This demonstrates that the proposed solution has significant advantages in terms of multi-source heterogeneous security data association and merging efficiency, early warning identification accuracy, and the ability to continuously utilize the results awaiting review.

[0042] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A smart campus security early warning platform based on big data, characterized in that, include: The data preprocessing module is used to collect multi-source heterogeneous security data from the campus and preprocess it to form an early warning analysis dataset; The candidate pair generation module is used to extract record link identifiers from the early warning analysis dataset and generate a set of candidate record pairs based on the record link identifiers. The candidate pair filtering module is used for a candidate pair gating mechanism based on campus reachability domain constraints to filter the set of candidate record pairs and form a target set of candidate record pairs. The matching weight formation module is used to perform matching weight formation based on identity-event dual-track comparison for the target candidate record pair set, and obtain the matching weight corresponding to each target candidate record pair; The associated record linking module is used to perform the Fellegi-Sunter probabilistic record linking algorithm on the set of target candidate record pairs using the matching weights of each target candidate record pair, to obtain matching record pairs and record pairs to be reviewed, and to generate a unified associated index based on the matching record pairs; The matching judgment result update module is used to self-update the three-value judgment boundary of the record to be reviewed by performing gray zone upgrade backflow, and form the updated matching judgment result. The tiered early warning module is used to perform cross-system association and risk identification of early warning objects based on a unified association index, updated matching judgment results, and early warning analysis dataset, and output tiered early warning results.

2. The smart campus security early warning platform based on big data according to claim 1, characterized in that, The data preprocessing module includes: Raw security data is collected from different business systems on campus. The raw security data is then aggregated, and integrity, duplication, and validity checks are performed on the aggregated raw security data. Data records with missing key content, duplicate data records, and invalid data records are removed to form a dataset to be processed. The dataset to be processed is preprocessed to obtain a standardized dataset; The standardized datasets are aggregated and organized, and then grouped according to the data organization methods required for early warning analysis to form an early warning analysis dataset.

3. The smart campus security early warning platform based on big data according to claim 1, characterized in that, The candidate pair generation module includes: Read each data record in the early warning analysis dataset, split each data record according to a unified record parsing rule, extract the associated content that can represent the record subject, the time of the record, the location of the record, and the status of the record behavior, and combine the extracted associated content in a unified order to form a record link identifier that corresponds one-to-one with each data record. Based on the record link identifiers corresponding to each data record, any two data records are compared pairwise, and the comparison results are summarized to form the link comparison results; Based on the link comparison results, any two data records are judged as candidates, and the data record pairs that meet the preset association conditions are determined as candidate record pairs, forming a candidate judgment result corresponding to the link comparison results. Each candidate record pair determined by the candidate determination is collected and organized, and duplicate candidate record pairs and obviously conflicting candidate record pairs are removed to form a candidate record pair set.

4. The smart campus security early warning platform based on big data according to claim 1, characterized in that, The candidate pair screening module includes: Read each candidate record pair in the candidate record pair set, and for each candidate record pair, obtain the time association content and spatial association content in the record link identifier of the corresponding two data records to form the basic data for reachability domain determination; The basic data for reachability determination adopts a candidate pair gating mechanism based on campus reachability constraints. The temporal continuity, spatial connectivity, and path reachability between two data records in a candidate record pair are determined. The temporal continuity determination is whether the time difference between the occurrence of the two data records is within a preset time range. The spatial connectivity determination is whether there is a permissible spatial connection between the corresponding positions of the two data records. The path reachability determination is whether it is possible to reach the corresponding position of the next data record from the corresponding position of the previous data record within the corresponding time range under the permissible path. The reachability determination results are formed for each candidate record pair. The campus reachability constraint condition is whether the candidate record pair meets the determination conditions of temporal continuity, spatial connectivity, and path reachability. Based on the reachability domain determination results, candidate record pairs that meet the campus reachability domain constraints are retained, while candidate record pairs that do not meet the campus reachability domain constraints are eliminated, forming a set of retained record pairs after gating. The retained record pairs are collected and organized to form the target candidate record pairs set.

5. A smart campus security early warning platform based on big data as described in claim 1, characterized in that, The matching weight formation module includes: Read each target candidate record pair in the target candidate record pair set, and extract the identity-related content and event-related content from the record link identifier for each target candidate record pair to form the basic data for dual-track comparison; The identity-related content in the dual-track comparison base data is compared item by item to determine the consistency results of each identity comparison item and summarize them to form the identity merging comparison results of the corresponding target candidate record pairs; The event-related content in the dual-track comparison base data is compared item by item to determine the continuity results of each event comparison item and summarize them to form the event link comparison results of the corresponding target candidate record pairs. The credibility of the identity merging comparison results and the event linking comparison results is coupled to obtain the coupling comparison value of the target candidate record pair; The coupling comparison weights are normalized to determine the corresponding matching weights for each target candidate record pair.

6. The smart campus security early warning platform based on big data according to claim 1, characterized in that, The associated record linking module includes: Read the matching weight, identity merging comparison result and event link comparison result of each target candidate record pair in the target candidate record pair set, and construct a record link comparison vector that corresponds one-to-one with each target candidate record pair. Based on the record link comparison vector, and according to the Fellegi-Sunter probabilistic record linking algorithm, the identity matching probability in the matching state and the identity non-matching probability in the non-matching state of the identity merging comparison result are determined respectively. The event matching probability in the matching state and the event non-matching probability in the non-matching state of the event link comparison result are determined respectively, forming Fellegi-Sunter dual-track probability judgment data corresponding to each target candidate record pair. Based on the Fellegi-Sunter dual-track probability determination data, the ratio of identity matching probability to identity non-matching probability corresponding to the identity merging comparison result is converted to form the identity track link contribution value. The ratio of event matching probability to event non-matching probability corresponding to the event link comparison result is converted to form the event track link contribution value. The identity track link contribution value and the event track link contribution value are weighted and coupled with the corresponding matching weight of each target candidate record to form the comprehensive record link weight of each target candidate record to the corresponding comprehensive record. The comprehensive record link weight corresponding to each target candidate record pair is compared with the preset upper judgment threshold and the preset lower judgment threshold respectively. When the comprehensive record link weight is greater than or equal to the preset upper judgment threshold, the corresponding target candidate record pair is determined as a matching record pair. When the comprehensive record link weight is less than the preset upper judgment threshold but greater than the preset lower judgment threshold, the corresponding target candidate record pair is determined as a record pair to be reviewed. When the comprehensive record link weight is less than or equal to the preset lower judgment threshold, the corresponding target candidate record pair is determined as a non-matching record pair, thus forming the three-value judgment result corresponding to each target candidate record pair. The target candidate record pairs that are determined to be matching record pairs are associated and merged, and a unified associated index is generated in the manner that the same associated object corresponds to the same index identifier.

7. A smart campus security early warning platform based on big data as described in claim 1, characterized in that, The matching result update module includes: Read the pairs of records to be reviewed, and extract the corresponding comprehensive record link weight, three-value judgment result, and association status information in the unified association index for each pair of records to be reviewed, forming the basic data for gray zone judgment; The gray zone determination base data is processed to preserve the gray zone. The pairs of records to be reviewed whose comprehensive record link weights are between the preset upper and lower determination thresholds are retained as gray zone record pairs. New associated records corresponding to each gray zone record pair are continuously received to form gray zone upgrade input data. Based on the gray zone upgrade input data, the identity association consistency verification, event process continuity verification, and new record support strength determination are performed on each gray zone record pair to form the gray zone upgrade determination result; Based on the gray area upgrade judgment result, the three-value judgment boundary is automatically updated, the preset upper judgment threshold and the preset lower judgment threshold are adjusted, and each gray area record pair is re-matched and judged based on the adjusted preset upper judgment threshold and the adjusted preset lower judgment threshold. The re-evaluated matching record pairs, record pairs awaiting review, and non-matching record pairs are collected and organized to form an updated matching evaluation result.

8. A smart campus security early warning platform based on big data as described in claim 1, characterized in that, The tiered early warning module includes: The data records belonging to the same associated object in the early warning analysis dataset are aggregated according to the unified association index, and the aggregated data records are filtered according to the updated matching judgment results to form the early warning object dataset. Perform cross-system association and merging on the early warning object dataset. According to the unified association index, data records from different business systems are associated, sorted in time sequence, and merged to form cross-system association results corresponding to each early warning object. Based on the cross-system correlation results, risk identification data corresponding to each early warning object is extracted to form basic data for risk identification. Risk identification is performed on the basic data for risk identification to determine the risk status, risk type and risk level of each early warning object, and a graded early warning result is generated.

Images