Security responsibility assessment and closed-loop tracing method for smart governance scenarios
By acquiring multi-source heterogeneous data to generate structured evidence packages and conducting responsibility assessments, this approach solves the problems of discretized evidence chains and inconsistent responsibility determination in smart governance scenarios. It achieves the quantification and closed-loop optimization of responsibility and is applicable to scenarios such as refined oil taxation, market supervision, traffic management, and emergency management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANJING UNIV OF SCI & TECH
- Filing Date
- 2026-06-02
- Publication Date
- 2026-07-03
Smart Images
Figure CN122335112A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to an intelligent supervision technology, and in particular to a method for safety responsibility assessment and closed-loop traceability for smart governance scenarios. Background Technology
[0002] With the continuous improvement of digitalization and intelligence in urban governance, video surveillance systems, business management systems, equipment sensing systems, and historical archive systems are widely used in scenarios such as refined oil tax supervision, market supervision, traffic management, and emergency management. In the field of intelligent supervision, one type of existing technology mainly relies on a single video stream, a single log, or a single business table for anomaly identification. Although it can detect local anomalies, it is difficult to uniformly bind video evidence, business records, equipment status, rule-matching results, and subsequent handling feedback, resulting in a discrete and fragmented evidence chain for anomaly events, making it difficult to support subsequent responsibility determination and review and tracing. Another type of solution, although it has alarm or work order circulation functions, still relies mainly on human experience judgment, lacking a unified responsibility factor system and responsibility quantification mechanism. This leads to inconsistent judgment standards for similar anomalies among different personnel, resulting in poor objectivity, interpretability, and consistency of responsibility assessment results. In addition, in smart governance scenarios involving multiple stakeholders, the same anomaly often involves multiple responsible parties such as personnel, vehicles, equipment, operating entities, and management entities. Existing systems can usually only output whether it is an anomaly, but it is difficult to further distinguish between direct responsible parties, related responsible parties, and management responsible parties, and it is also difficult to classify and quantify the degree of responsibility. Meanwhile, existing systems often lack a closed-loop mechanism of "identification-assessment-handling-feedback-update," making it difficult for abnormal events to be effectively fed back into the rule base and model base after handling. The systems rely heavily on fixed thresholds and static rules, hindering continuous optimization. Therefore, there is an urgent need to propose a security responsibility assessment and closed-loop tracing method for smart governance scenarios to address issues such as strong subjectivity in defining responsibility for abnormal events, incomplete evidence chains, low tracing efficiency, and insufficient closed-loop optimization. Summary of the Invention
[0003] The purpose of this invention is to provide a method for security responsibility assessment and closed-loop traceability in smart governance scenarios, including:
[0004] Step S100: Acquire multi-source heterogeneous data in the smart governance scenario and preprocess it. The multi-source heterogeneous data includes at least video image data, business log data, device status data, time and space data, historical event data and disposal feedback data. The data is then synchronized in time, aligned in space, unified in object identification and preprocessed.
[0005] Step S200: Based on the preset anomaly recognition model and rule engine, perform anomaly detection on the preprocessed multi-source heterogeneous data, generate corresponding event identifiers when an anomaly event is detected, and trigger the evidence extraction process according to the event identifiers;
[0006] Step S300: Extract key video clips, object trajectory information, business association records, device operating status, rule hit results, and historical association information within the target time window and target spatial range around the event identifier, and perform tagging, structured encapsulation, and indexing processing on the extracted results to generate the corresponding structured evidence package;
[0007] Step S400: Extract responsibility factors from the structured evidence package, including at least one or more of the following: intensity of abnormal behavior, completeness of evidence, strength of object association, degree of rule violation, frequency of historical repetition, scope of impact, timeliness of handling, and collaborative relationship between the parties.
[0008] Step S500: Input the responsibility factors into the responsibility assessment model and the responsibility scoring function to obtain the responsibility score, responsibility level and responsibility confidence level corresponding to the abnormal event, and determine at least one of the direct responsible party, related responsible party and management responsible party according to the responsibility relationship;
[0009] Step S600: Automatically generate corresponding handling instructions based on the level of responsibility and the category of responsible entity, including one or more of the following: alarm push, work order dispatch, manual review, joint handling, restrictive measures, and traceability archiving, and bind the handling process data and handling result data to the relevant event identifier.
[0010] Furthermore, the preprocessing of multi-source heterogeneous data in step S100 includes timestamp standardization, coordinate and region identifier mapping, object identity identifier normalization, missing value completion, abnormal format cleaning, and field standardization.
[0011] Furthermore, the structured evidence package in step S300 includes at least one or more of the following fields: event identifier, timestamp, spatial location, object identifier, key video clip index, object trajectory information, business association record, device operating status, rule hit result, historical associated event information, handling context information, and evidence source identifier.
[0012] Furthermore, the responsibility factors in step S400 include one or more of the following: duration of abnormality, frequency of abnormal behavior, degree of economic impact, consistency of evidence, degree of spatial coverage, and degree of personnel presence; among which, consistency of evidence is used to characterize the degree of matching between video image data and business log data and equipment status data.
[0013] Furthermore, step S500 specifically includes the following processes:
[0014] Step S510: Using a linear normalization or nonlinear mapping function, each responsibility factor is converted into a standardized responsibility index with a unified dimension.
[0015] Step S520: Perform multiplication and summation operations on the standardized responsibility indicators and their corresponding weights to obtain the responsibility score corresponding to the abnormal event;
[0016] Step S530: Compare the responsibility score with a preset level determination threshold range; when the responsibility score reaches the preset high level threshold, it is determined to be a high responsibility level; when the responsibility score is in the medium level threshold range, it is determined to be a medium responsibility level; when the responsibility score is lower than the preset threshold, it is determined to be a low responsibility level.
[0017] Step S540: By retrieving a preset device credit rating table, identify the source reliability weight corresponding to the evidence source identifier; based on the evidence completeness I... integ Consistency of Evidence C cons and source reliability weight W src Obtain the goodness of fit F between video image data, business log data, and device status data. match ,
[0018] F match =(C cons ×W src )×I integ ;
[0019] The matching fit is converted into a standardized value in the range [0,1], which is the responsibility confidence score.
[0020] Furthermore, the specific process in step S500 of determining at least one of the directly responsible party, the related responsible party, and the management responsible party based on the liability relationship includes:
[0021] Step S550: Input the responsibility level as the retrieval depth threshold into the pre-constructed responsibility association graph. Based on the level of responsibility, determine the number of search jumps or the level depth for subject tracing in the graph, and then output the target association subgraph.
[0022] Step S560: Identify the main node in the target association subgraph that has a direct connection with the abnormal event node and whose object association strength exceeds a preset threshold, and determine it as the directly responsible entity;
[0023] Step S570: Take the identified directly responsible entity as the starting node, traverse along the edges in the target association subgraph, and calculate the indirect sharing score of other nodes that have a collaborative relationship with the directly responsible entity based on the responsibility score. If the score reaches the judgment threshold, it is determined to be an associated responsible entity.
[0024] Step S580: Obtain the identified direct and related responsible entities, trace upwards along the relationship edges in the target association subgraph, and identify the nodes at the management level as the management responsible entities.
[0025] Furthermore, in step S600, differentiated handling strategies are generated based on the level of responsibility and the category of the responsible entity. When the level of responsibility reaches the preset high-level threshold, a linkage handling instruction is triggered for the directly responsible entity, and a high-priority alarm push instruction is triggered for the management responsible entity. When the level of responsibility is in the medium-level threshold range, a work order dispatch instruction is triggered for the directly responsible entity and related responsible entities, and a manual review instruction is triggered for the management responsible entity. When the level of responsibility is lower than the preset threshold, traceability and archiving are performed for all responsible entities, and a continuous monitoring instruction is triggered for a specific management responsible entity.
[0026] Compared with the prior art, the present invention has the following advantages: (1) The present invention constructs a structured evidence package around the event identifier, and encapsulates video images, business logs, equipment status and rule hit results in a unified manner, which significantly improves the integrity and traceability of the evidence chain of abnormal events; (2) The present invention transforms the traditional responsibility judgment process that relies on human experience into a responsibility factor extraction and responsibility quantification assessment process, which can output responsibility score, responsibility level and responsibility confidence, and improve the consistency and objectivity of responsibility judgment; (3) The present invention supports the hierarchical identification of direct responsible subjects, related responsible subjects and management responsible subjects, which is conducive to solving the technical problem of multiple subjects participating and complex responsibility boundaries in the smart governance scenario; (4) The present invention links the responsibility assessment results with alarm push, work order dispatch, linkage disposal and traceability archiving, realizes automatic traceability, proactive early warning and closed-loop optimization of abnormal events, and is suitable for promotion to typical scenarios such as smart supervision of refined oil taxation, market supervision, traffic management and emergency management.
[0027] The present invention will now be further described with reference to the accompanying drawings. Attached Figure Description
[0028] Figure 1 This is a flowchart illustrating the steps of the security responsibility assessment and closed-loop traceability method for smart governance scenarios according to the present invention.
[0029] Figure 2 A flowchart for updating responsibility assessment, coordinated response, and closed-loop feedback. Detailed Implementation
[0030] Combination Figure 1 A method for security responsibility assessment and closed-loop traceability in smart governance scenarios, characterized by including:
[0031] Step S100: Obtain multi-source heterogeneous data in the smart governance scenario, including at least video image data, business log data, device status data, time and space data, historical event data and handling feedback data, and perform preprocessing on the data for time synchronization, spatial alignment and unified object identification.
[0032] Step S200: Based on the preset anomaly recognition model and rule engine, perform anomaly detection on the preprocessed multi-source heterogeneous data, generate corresponding event identifiers when an anomaly event is detected, and trigger the evidence extraction process according to the event identifiers;
[0033] Step S300: Extract key video clips, object trajectory information, business association records, device operating status, rule hit results, and historical association information within the target time window and target spatial range around the event identifier, and perform tagging, structured encapsulation, and indexing processing on the extracted results to generate the corresponding structured evidence package;
[0034] Step S400: Extract responsibility factors from the structured evidence package, including at least one or more of the following: intensity of abnormal behavior, completeness of evidence, strength of object association, degree of rule violation, frequency of historical repetition, scope of impact, timeliness of handling, and collaborative relationship between the parties.
[0035] Step S500: Input the responsibility factors into the responsibility assessment model and the responsibility scoring function to obtain the responsibility score, responsibility level and responsibility confidence level corresponding to the abnormal event, and determine at least one of the direct responsible party, related responsible party and management responsible party according to the responsibility relationship;
[0036] Step S600: Automatically generate corresponding handling instructions based on the level of responsibility and the category of responsible entity, including one or more of the following: alarm push, work order dispatch, manual review, joint handling, restrictive measures, and traceability archiving; and bind the handling process data and handling result data to the relevant event identifier.
[0037] Step S700: Obtain the review results and handling results of the abnormal event, and update the responsibility assessment model, rule engine, responsibility factor weights and handling strategies based on the results to form a continuous optimization mechanism for responsibility assessment and closed-loop traceability.
[0038] Step S100 first acquires video image data, transaction or business log data, device status data, temporal and spatial location data, historical abnormal event data, and historical handling feedback data. The above data undergoes preprocessing, including unifying timestamps to the same time base, mapping spatial identifiers from different sources to unified regional coordinates, normalizing the identifiers of the same object in different systems, and cleaning missing fields, abnormal formats, and duplicate records to form a unified event analysis data foundation.
[0039] In step S200, when an event that meets the abnormal triggering conditions is detected, such as abnormal business behavior, abnormal equipment status, abnormal transaction pattern, or abnormal handling delay, a unique event identifier is generated. Abnormal triggering can be completed by a preset rule engine or by an abnormal identification model.
[0040] In step S300, key video clips, object trajectory information, associated business records, device operating status, rule hit results, and historical associated event information are extracted from the target time window and target spatial range around the event identifier. These are then uniformly packaged into a structured evidence package, which may include event identifier, timestamp, spatial location, object identifier, key video clip index, object trajectory information, business association records, device operating status, rule hit results, historical associated event information, handling context information, and evidence source identifier.
[0041] Step S400 further includes one or more of the following responsibility factors: duration of abnormality, frequency of abnormal behavior, degree of economic impact, consistency of evidence, spatial coverage, and personnel availability. Consistency of evidence characterizes the degree of matching between video image data and business log data, as well as equipment status data. For example, in the scenario of intelligent tax supervision of refined oil products, the intensity of abnormal behavior can be determined by the abnormal loading and unloading actions identified in the video, abnormal business behavior patterns, and abnormal transaction deviations in the business system; consistency of evidence can be determined by the degree of matching between the object's behavior in the video clip and business flow, equipment status, and alarm records; and the degree of economic impact can be calculated based on the amount, tax, or operational impact associated with the abnormal behavior.
[0042] Combination Figure 2 In step S500, the responsibility assessment stage, the extracted responsibility factors are input into the responsibility assessment model and responsibility scoring function. Each responsibility factor is first standardized, then fused according to preset weights to output a responsibility score, responsibility level, and responsibility confidence level. The responsibility score reflects the quantitative degree of responsibility borne by the entity corresponding to a certain abnormal event; the responsibility level reflects the severity of the responsibility; and the responsibility confidence level characterizes the reliability of the current responsibility assessment results. A responsibility association graph is constructed based on the relationship between event, entity, behavior, and evidence to distinguish between directly responsible entities, related responsible entities, and management responsible entities. The specific process is shown below.
[0043] Step S510: Obtain the multiple responsibility factors extracted in step S400 and input them into the data standardization module in the responsibility assessment model; the data standardization module uses linear normalization and / or nonlinear mapping functions to convert each responsibility factor (such as the intensity of abnormal behavior, consistency of evidence, degree of economic impact, etc.) into standardized responsibility indicators with unified dimensions; the standardized responsibility indicators take values between [0,1], which are used to eliminate the dimensional differences between different business data (such as transaction amount and video recognition action frequency).
[0044] Step S520: The standardized responsibility indicators mentioned above are input into the weighted scoring engine of the responsibility assessment model. This engine, by calling the preset responsibility factor weight table, multiplies and adds up each standardized responsibility indicator with its corresponding weight to obtain the responsibility score corresponding to the abnormal event. The responsibility factor weight table is a matrix that stores the importance parameters of each evaluation dimension (such as the consistency of evidence in refined oil supervision). It is trained using a machine learning model, such as the analytic hierarchy process or gradient boosting decision tree, and is used to reflect the contribution of different factors to the final responsibility determination.
[0045] Step S530: Input the obtained responsibility score into the rule division module in the responsibility assessment model, and compare the responsibility score with the preset level judgment threshold range: when the responsibility score reaches the preset high level threshold, it is judged as a high responsibility level; when the responsibility score is in the medium level threshold range, it is judged as a medium responsibility level; when the responsibility score is lower than the preset threshold, it is judged as a low responsibility level.
[0046] Step S540: While calculating the responsibility score, the completeness of evidence I is also considered. integ Consistency of Evidence C cons and source reliability weight W src As input, the confidence assessment function is passed into the responsibility assessment model. This confidence assessment function calculates the degree of fit F between the video image data and the business flow and equipment status data. match Output the responsibility confidence level.
[0047] F match =(C cons ×W src )×I integ ;
[0048] The matching fit is converted into a standardized value within the range [0,1], which is the responsibility confidence score. The responsibility confidence score is a quantitative indicator that measures the reliability of the responsibility assessment results, and it is determined by the consistency level of the evidence and the spatiotemporal coverage. For example, when the abnormal oil loading and unloading actions identified by the video are highly consistent with the transaction deviations in the business system, this indicator will have a high value.
[0049] The generated responsibility scores, responsibility levels, and responsibility confidence levels, along with the structured evidence package generated in step S300, are input into the graph model inference module to determine the direct responsible party, related responsible parties, and management responsible parties corresponding to the abnormal event. This module, based on a pre-constructed responsibility association graph, uses graph node search and path tracing to ultimately determine the direct responsible party, related responsible party, and management responsible party corresponding to the abnormal event, specifically including the following processes.
[0050] Step S550: The responsibility level is input as a retrieval depth threshold into the pre-constructed responsibility association graph. Based on the responsibility level, the number of hops or the depth of the search for subject tracing in the graph are determined, thereby outputting the target association subgraph. The responsibility association graph is a topological network representing the multi-dimensional logical relationship between "event-subject-behavior-evidence". By matching the current event identifier with nodes in the graph, the entity subgraph related to the abnormal event is activated. The target association subgraph is the set of nodes selected from the full graph that are related to the current abnormal event under a specific responsibility level constraint. The responsibility association graph consists of nodes and edges; nodes include event nodes, subject nodes, behavior / object nodes, and evidence nodes; edges represent the association logic between nodes, and each edge usually has a weight to reflect the tightness of the association; edges include implementation / participation edges, attribution / jurisdiction edges, business collaboration edges, and evidence support edges.
[0051] Step S560: Identify the main nodes in the target association subgraph that have direct edges connected to the abnormal event nodes and whose object association strength exceeds a preset threshold, and determine them as the directly responsible entities. The directly responsible entity refers to the entity that directly implements abnormal behavior in physical space or business logic. In the refined oil supervision scenario, if the abnormal oil loading and unloading actions identified by the video are consistent with a specific fuel dispenser number and the corresponding employee shift information, then the fuel dispenser operator is determined to be the directly responsible entity.
[0052] Step S570: Using the identified directly responsible entity as the starting node, traverse along the edges in the target association subgraph. Calculate the indirect contribution score for other nodes with a collaborative relationship with the directly responsible entity, based on their responsibility scores. If this score reaches the judgment threshold, the node is identified as a related responsible entity. The indirect contribution score refers to the value calculated based on the primary responsible party's responsibility score, according to the association weights in the graph, such as the attenuation of collaborative relationship weights. It is used to measure the contribution of indirect participants to the risk.
[0053] Step S580: Obtain the identified direct and related responsible entities. Traverse upwards along the relationship edges in the target association subgraph to identify management-level nodes (such as the company head or safety supervisor) as the management responsible entities. The responsibility level serves as a routing mechanism here. For example, when the level is high, tracing back to the legal representative; when the level is medium, tracing back only to the on-site supervisor.
[0054] In step S600, differentiated handling strategies are generated based on the level of responsibility and the category of the responsible entity. When the level of responsibility reaches the preset high-level threshold, a linkage handling instruction is triggered for the directly responsible entity, and a high-priority alarm push instruction is triggered for the management responsible entity. When the level of responsibility is in the medium-level threshold range, a work order dispatch instruction is triggered for the directly responsible entity and related responsible entities, and a manual review instruction is triggered for the management responsible entity. When the level of responsibility is lower than the preset threshold, traceability and archiving are performed for all responsible entities, and a continuous monitoring instruction is triggered for a specific management responsible entity.
[0055] In the closed-loop feedback phase of step S700, the system receives manual review results, law enforcement handling results, or historical feedback information, and updates the responsibility factor weights, anomaly identification thresholds, responsibility level classification strategies, and handling strategies based on the feedback. By continuously introducing real handling results to feed back into the model and rule base, the accuracy and stability of subsequent responsibility assessments for similar abnormal events can be improved.
Claims
1. A method for security responsibility assessment and closed-loop traceability in smart governance scenarios, characterized in that, include: Step S100: Acquire multi-source heterogeneous data in the smart governance scenario and preprocess it. The multi-source heterogeneous data includes at least video image data, business log data, device status data, time and space data, historical event data and disposal feedback data. Step S200: When an abnormal event is detected in multi-source heterogeneous data, a corresponding event identifier is generated; Step S300: Extract key video segments, object trajectory information, business association records, device operating status, rule hit results, and historical association information within the target time window and target spatial range based on the event identifier, and perform tagging, structured encapsulation, and indexing processing on the extracted results to generate the corresponding structured evidence package. Step S400: Extract responsibility factors from the structured evidence package, including at least one or more of the following: intensity of abnormal behavior, completeness of evidence, strength of object association, degree of rule violation, frequency of historical repetition, scope of impact, timeliness of handling, and collaborative relationship between the parties. Step S500: Input the responsibility factors into the responsibility assessment model and the responsibility scoring function to obtain the responsibility score, responsibility level and responsibility confidence level corresponding to the abnormal event, and determine at least one of the direct responsible party, related responsible party and management responsible party according to the responsibility relationship; Step S600: Automatically generate corresponding handling instructions based on the level of responsibility and the category of responsible entity, including one or more of the following: alarm push, work order dispatch, manual review, joint handling, restrictive measures, and traceability archiving, and bind the handling process data and handling result data to the relevant event identifier.
2. The method according to claim 1, characterized in that, The preprocessing of multi-source heterogeneous data in step S100 includes timestamp standardization, coordinate and region identifier mapping, object identity normalization, missing value completion, abnormal format cleaning, and field standardization.
3. The method according to claim 1, characterized in that, The structured evidence package in step S300 shall include at least one or more of the following fields: event identifier, timestamp, spatial location, object identifier, key video clip index, object trajectory information, business association record, device operating status, rule hit result, historical associated event information, handling context information, and evidence source identifier.
4. The method according to claim 3, characterized in that, In step S400, the responsibility factors further include one or more of the following: duration of abnormality, frequency of abnormal behavior, degree of economic impact, consistency of evidence, degree of spatial coverage, and degree of personnel presence; among which, consistency of evidence is used to characterize the degree of matching between video image data and business log data and equipment status data.
5. The method according to claim 4, characterized in that, Step S500 specifically includes the following processes: Step S510: Using a linear normalization or nonlinear mapping function, each responsibility factor is converted into a standardized responsibility index with a unified dimension. Step S520: Perform multiplication and summation operations on the standardized responsibility indicators and their corresponding weights to obtain the responsibility score corresponding to the abnormal event; Step S530: Compare the responsibility score with a preset level determination threshold range; when the responsibility score reaches the preset high level threshold, it is determined to be a high responsibility level; when the responsibility score is in the medium level threshold range, it is determined to be a medium responsibility level; when the responsibility score is lower than the preset threshold, it is determined to be a low responsibility level. Step S540: By retrieving a preset device credit rating table, identify the source reliability weight corresponding to the evidence source identifier; based on the evidence completeness I... integ Consistency of Evidence C cons and source reliability weight W src Obtain the goodness of fit F between video image data, business log data, and device status data. match , F match =(C cons ×W src )×I integ ; The matching fit is converted into a standardized value in the range [0,1], which is the responsibility confidence score.
6. The method according to claim 5, characterized in that, Step S500, which involves determining at least one of the directly responsible party, related responsible party, and management responsible party based on the liability relationship, includes the following specific steps: Step S550: Input the responsibility level as the retrieval depth threshold into the pre-constructed responsibility association graph. Based on the level of responsibility, determine the number of search jumps or the level depth for subject tracing in the graph, and then output the target association subgraph. Step S560: Identify the main node in the target association subgraph that has a direct connection with the abnormal event node and whose object association strength exceeds a preset threshold, and determine it as the directly responsible entity; Step S570: Take the identified directly responsible entity as the starting node, traverse along the edges in the target association subgraph, and calculate the indirect sharing score of other nodes that have a collaborative relationship with the directly responsible entity based on the responsibility score. If the score reaches the judgment threshold, it is determined to be an associated responsible entity. Step S580: Obtain the identified direct and related responsible entities, trace upwards along the relationship edges in the target association subgraph, and identify the nodes at the management level as the management responsible entities.
7. The method according to claim 1, characterized in that, In step S600, differentiated handling strategies are generated based on the level of responsibility and the category of the responsible entity. When the level of responsibility reaches the preset high-level threshold, a linkage handling instruction is triggered for the directly responsible entity, and a high-priority alarm push instruction is triggered for the management responsible entity. When the level of responsibility is in the medium-level threshold range, a work order dispatch instruction is triggered for the directly responsible entity and related responsible entities, and a manual review instruction is triggered for the management responsible entity. When the level of responsibility is lower than the preset threshold, traceability and archiving are performed for all responsible entities, and a continuous monitoring instruction is triggered for a specific management responsible entity.