Reinforcement learning and multi-model integrated anomaly detection system for smart entry and exit security

Abstract

The embodiments disclosed in this disclosure enable the immediate detection and response to abnormal situations by analyzing logs, images, and sensor data in real time using time series analysis (LSTM), graph neural networks (GNN), GAN-based prediction models, etc. Furthermore, the embodiments disclosed in this disclosure introduce Reinforcement Learning (RL) to learn the severity, frequency, and feedback results of abnormal signs as rewards, and provide autonomous security control functions by dynamically optimizing control strategies (delayed control, immediate blocking, etc.) according to environmental changes. Additionally, the embodiments disclosed in this disclosure improve detection accuracy and enable quantitative determination of complex anomalies by integrating and analyzing heterogeneous data, such as logs, images, and environmental sensors, in a multi-modal fusion structure. Furthermore, the embodiments disclosed in this disclosure apply blockchain (e.g., Ethereum-based smart contracts) to store all logs in a distributed hash chain format, thereby preventing tampering and forgery and ensuring traceability in the event of a security incident.

Description

Technology Field

[0001] The present invention relates to the field of physical access control (Access Control System, ACS) technology, and specifically, to a multi-model (time series model, graph neural network, generative model, etc.) based analysis technology that detects abnormal signs by collecting and fusing heterogeneous data such as access logs, images, and environmental sensors in real time, an autonomous control technology that optimizes access control policies responding to abnormal signs using reinforcement learning, and a log integrity guarantee technology using a distributed ledger (blockchain). Background Technology

[0002] Unless otherwise indicated in this specification, the contents described in this section are not prior art for the claims of this application, and are not to be recognized as prior art simply because they are included in this section.

[0003] Smart Access Control Systems (ACS), which integrate information and physical security, belong to a technology field that allows or blocks access to doors, gates, and areas through user authentication methods such as RFID / card swiping, passwords, and fingerprint / face recognition. Recently, there has been a growing trend of simultaneously handling access logs and video / sensor data as servers distributed across internal networks and the cloud, along with multiple edge devices (door lock controllers, cameras, PIR / door sensors, etc.), are interconnected. In this environment, real-time anomaly detection and automatic control have emerged as key challenges in security operations.

[0004] Traditional ACS systems typically collect and store event logs for post-inquiry and auditing. While some systems apply threshold-based rules (frequency, time zones, number of failures, etc.) or simple statistical outlier detection, they struggle to dynamically adapt to long-term user pattern changes or complex contexts (presence of companions, correlations between zone movements, device status, environmental sensor conditions). In particular, behavior-based threats such as tailgating, simultaneous movement between unauthorized zones, and repeated short-term attempts by the same user are difficult to detect with high accuracy using only a single log stream.

[0005] Prior technologies incorporating machine learning (ML) model user-specific time-based and frequency patterns to identify abnormal attempts, or utilize identity probabilities as auxiliary indicators through face and object recognition in parallel with video analysis. However, these approaches face limitations in detecting group anomalies (simultaneous / sequential movements) because (i) the systems for calculating contextual risk by simultaneously fusing multiple modals of logs, video, and sensors are limited, or (ii) the capabilities for modeling user-zone-time relationships in a graph structure and updating them in real-time are weak. Furthermore, future pattern prediction using generative models such as GANs remains in the research stage or faces issues in that it is not sufficiently integrated to meet the requirements for managing latency and false positives in operational environments.

[0006] In terms of security operations, autonomic response requires multi-stage control such as issuing alerts, locking doors, delaying opening, and on-site verification (dispatching security personnel / robots); however, existing systems tend to rely heavily on fixed thresholds and static rules. Consequently, they have low adaptability to environmental changes (e.g., changes in entry / exit time distribution due to the spread of remote work, changes in body temperature and mask policies during infectious disease outbreaks, and fluctuations in movement patterns due to temporary construction or inspections in specific areas), leading to the accumulation of false positives and under-detections. While the theoretical utility of policy optimization through reinforcement learning (RL) is known, there are few cases where a closed-loop learning system connecting anomaly scores, actions, and rewards (threat reduction rates, false positive costs, etc.) has been established in actual operational ACS.

[0007] Log reliability and audit response are also critical challenges. Logs relying on a central repository have been criticized for risks of modification or deletion by insiders and issues regarding reduced forensic reliability. While distributed ledger (blockchain)-based tamper-proof storage is being discussed as an alternative, practical design that incorporates hash chains and smart contracts to process ACS volume events without delay and ensure compatibility with operational policies (such as personal information protection and GDPR) remains a challenge. In particular, when integrating video and biometric data, a balance is required between minimizing personal information, encryption, and pseudonymization with real-time responsiveness.

[0008] From a network and system perspective, the edge-cloud hybrid architecture can be vulnerable to latency and availability issues (network failures and segmentation). For the reliability of real-time control, stable synchronization between edge-side preprocessing and inference and central policies is required. Furthermore, communication security (signatures, integrity, and retransmission prevention) between cameras, readers, controllers, and servers, along with correlation analysis of failure and error logs, must be performed in parallel. Existing SIEM / IDS integrations are primarily structured around cyber events, which limits cross-correlation analysis with physical access events. Prior art literature

[0009] 1. Korean Patent Registration No. 10-2372508 (March 4, 2022) 2. Korean Patent Publication No. 10-2025-0026702 (February 25, 2025) The problem to be solved

[0010] The embodiments disclosed in this disclosure enable the immediate detection and response to abnormal situations by analyzing logs, images, and sensor data in real time using time series analysis (LSTM), graph neural networks (GNN), GAN-based prediction models, etc.

[0011] In addition, the embodiments disclosed in this disclosure introduce Reinforcement Learning (RL) to learn the severity, frequency, and feedback results of abnormal signs as rewards, and provide autonomous security control functions by dynamically optimizing control strategies (delayed control, immediate blocking, etc.) according to changes in the environment.

[0012] In addition, the embodiments disclosed in this disclosure integrate and analyze heterogeneous data, such as logs, images, and environmental sensors, into a multi-modal fusion structure to improve detection accuracy and enable quantitative determination of complex anomalies.

[0013] In addition, the embodiments disclosed in this disclosure apply a blockchain (e.g., an Ethereum-based smart contract) to store all logs in a distributed hash chain format, thereby preventing tampering and forgery and ensuring traceability in the event of a security incident.

[0014] In addition, the embodiments disclosed in this disclosure enable automatic adaptation to seasonal, work patterns, organizational changes, etc., through RL-based learning security policies, and autonomously generate customized control strategies suitable for each environment (enterprise, hospital, factory, military facility).

[0015] In addition, the embodiments disclosed in this disclosure utilize edge computing to process anomaly detection and control commands at the field level, and simultaneously ensure real-time performance and stability through synchronization with a cloud server.

[0016] Accordingly, the embodiments disclosed in this disclosure aim to provide a smart access security system that combines a reinforcement learning-based autonomous control algorithm with a multi-model integrated anomaly detection engine, thereby simultaneously achieving real-time prediction, control, and integrity assurance, and maximizing security and operational efficiency.

[0017] Meanwhile, the technical problems of the present invention are not limited to those mentioned above, and other unmentioned technical problems will be clearly understood by a person skilled in the art from the description below. means of solving the problem

[0018] A system for reinforcement learning and multi-model integrated anomaly detection for smart access security according to the present disclosure for achieving the aforementioned technical objectives includes: a memory storing at least one instruction; and a processor performing operations according to said instruction, wherein the processor includes: a log collection module receiving log data collected from an Access Control System (ACS); an anomaly detection engine detecting anomaly signs by analyzing said log data and sensor / image data; an RL optimization module dynamically optimizing an access control policy through reinforcement learning (RL) based on the output result of said anomaly detection engine; an automatic control module performing physical control of an access door, gate, alarm device, etc. according to the result of said RL optimization module; and an integrity assurance module preventing tampering by storing said log and control history in a blockchain-based distributed ledger, wherein the anomaly detection engine is a multi-model integrated structure including a time series analysis model (LSTM), a graph neural network (GNN), and a generative adversarial network (GAN), and can detect real-time anomaly signs from access patterns by user, zone, and time, and perform predictive risk analysis. Effects of the invention

[0019] According to the means for solving the aforementioned problem of the present disclosure, by integrating multiple AI models, such as time series analysis (LSTM), graph neural networks (GNN), and GAN-based generative models, to simultaneously analyze log, video, and sensor data, it is possible to detect pattern-based anomalies in real time rather than single events. In particular, predictive anomaly detection through GANs enables preemptive blocking by predicting potential future attacks and unauthorized access in advance.

[0020] Furthermore, according to the aforementioned means for solving the problem of the present disclosure, a reinforcement learning module automatically generates an optimal control policy that adapts to environmental changes (time of day, location, user characteristics, etc.) by iteratively learning anomaly score (state), control behavior (action), and threat reduction rate (reward). Accordingly, the false positive rate is reduced, and repetitive administrator intervention is minimized.

[0021] Furthermore, according to the aforementioned means for solving the problem of the present disclosure, security policies required in different environments, such as corporate buildings, hospitals, and military facilities, are automatically learned and adapted. For example, in a hospital environment, RL learns body temperature and mask recognition data through seasonal statistics and dynamically adjusts the body temperature threshold, thereby reducing unnecessary blocking even during infectious disease response and maintaining a balance between security and convenience.

[0022] Furthermore, according to the aforementioned means for solving the problem of the present disclosure, each entry and exit event is linked to a hash chain through a blockchain-based log storage structure and stored in a distributed manner that is impossible to tamper with or forge. This prevents insider attacks or the deletion and manipulation of logs, and ensures high reliability during audits and regulatory compliance.

[0023] Furthermore, according to the aforementioned means for solving the problem disclosed herein, AI automation and reinforcement learning-based control significantly reduce the burden of real-time monitoring on security personnel, and a workforce reduction effect of approximately 30% can be expected based on experimental evaluation criteria. In addition, since it is easy to integrate with various IoT devices such as cameras, robots, and sensors, it can be expanded and applied to large-scale industrial environments.

[0024] Furthermore, according to the aforementioned means for solving the problem of the present disclosure, the reinforcement learning-based control structure continuously improves policies based on past anomaly response results and environmental feedback. Accordingly, the system can realize an intelligent security ecosystem that automatically adapts to insider threats, pattern changes, and new attacks by evolving its security level over time.

[0025] Consequently, the present invention is an integrated smart access security system combining multi-AI model fusion analysis, reinforcement learning-based control, and blockchain integrity storage, providing the effect of simultaneously improving security, efficiency, and reliability by transforming the existing static and passive security system into an active and autonomous system.

[0026] The effects obtainable from the exemplary embodiments of the present disclosure are not limited to those mentioned above, and other unmentioned effects can be clearly derived and understood by those skilled in the art to which the exemplary embodiments of the present disclosure belong from the description below. That is, unintended effects resulting from the implementation of the exemplary embodiments of the present disclosure can also be derived by those skilled in the art from the exemplary embodiments of the present disclosure. Brief explanation of the drawing

[0027] FIG. 1 is a block diagram of a reinforcement learning and multi-model integrated anomaly detection system for smart entry / exit security according to an embodiment. FIG. 2 is a diagram showing the configuration of an instruction set stored in memory according to an embodiment. Figure 3 is a diagram illustrating the function of an instruction set. FIG. 4 shows a comparison table by detection model illustrating how each detection algorithm (LSTM, GNN, Multi-Modal, GAN) detects different abnormal signs for each detection target in the multi-model integration structure of the anomaly detection engine (122) according to an embodiment of the present invention. FIG. 5 is a diagram showing an example of operation of a reinforcement learning (RL)-based automatic control module (124) according to an embodiment of the present invention. Specific details for implementing the invention

[0028] Hereinafter, various embodiments of the present disclosure are described in conjunction with the accompanying drawings. As various embodiments of the present disclosure may be subject to various modifications and may have various forms, specific embodiments are illustrated in the drawings and described in detail. However, this is not intended to limit the various embodiments of the present disclosure to specific forms, and it should be understood that they include all modifications and / or equivalents and substitutions that fall within the spirit and scope of the various embodiments of the present disclosure. In relation to the description of the drawings, similar reference numerals have been used for similar components.

[0029] In various embodiments of the present disclosure, terms such as “comprising” or “having” are intended to indicate the existence of the features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, and should be understood as not precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0030] In various embodiments of the present disclosure, expressions such as “or” include any and all combinations of the words listed together. For example, “A or B” may include A, may include B, or may include both A and B.

[0031] Expressions such as "first," "second," "first," or "second" used in various embodiments of the present disclosure may modify various components of the various embodiments, but do not limit such components. For example, such expressions do not limit the order and / or importance of such components and may be used to distinguish one component from another.

[0032] When it is mentioned that a component is "connected" or "joined" to another component, it should be understood that the component may be directly connected or joined to the other component, but that a new component may also exist between the component and the other component.

[0033] In the embodiments of the present disclosure, terms such as "module," "unit," "part," etc. are used to refer to a component that performs at least one function or operation, and such component may be implemented in hardware or software, or in a combination of hardware and software. Additionally, a plurality of "modules," "units," "parts," etc. may be integrated into at least one module or chip and implemented as at least one processor, except where each needs to be implemented in specific individual hardware.

[0034] Terms such as those defined in commonly used dictionaries should be interpreted as having meanings consistent with their meanings in the context of the relevant technology, and should not be interpreted in an ideal or overly formal sense unless explicitly defined in the various embodiments of the present disclosure.

[0035] The reinforcement learning and multi-model integrated anomaly detection system for smart entry / exit security according to the embodiment is a system that analyzes entry / exit patterns in real time by integrating machine learning (ML), graph neural networks (GNN), and generative adversarial networks (GAN) based on log data collected from an access control system (ACS), automatically detects and predicts anomalies, and dynamically optimizes control policies through reinforcement learning (RL).

[0036] This system calculates an overall risk level by fusing log, video, and environmental sensor data in a multimodal manner, and if the probability of anomalies exceeds a threshold, it performs door locking, delayed opening, alarm issuance, or dispatch of security personnel or robots through an automatic control module. Furthermore, it ensures security and audit traceability by storing all logs and control history in an immutable form using a blockchain-based distributed ledger. Accordingly, this invention overcomes the limitations of static rule-based access control systems and provides an autonomous smart security system capable of simultaneously performing real-time prediction, control, and integrity assurance.

[0037] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the attached drawings.

[0038] FIG. 1 is a block diagram of a reinforcement learning and multi-model integrated anomaly detection system for smart entry / exit security according to an embodiment.

[0039] The configuration of the reinforcement learning and multi-model integrated anomaly detection system for smart entry / exit security shown in Fig. 1 is merely a simplified example.

[0040] The communication module (110) can be configured regardless of the mode of communication, such as wired or wireless, and can be configured with various communication networks, such as a Personal Area Network (PAN) or a Wide Area Network (WAN). Additionally, the communication module (110) can operate based on the known World Wide Web (WWW) and may utilize wireless transmission technologies used for short-range communication, such as Infrared Data Association (IrDA) or Bluetooth. For example, the communication module (110) may be responsible for transmitting and receiving data necessary to perform a technique according to one embodiment of the present disclosure.

[0041] Memory (120) may refer to any storage medium. For example, memory (120) may include at least one storage medium among flash memory type, hard disk type, multimedia card micro type, card type memory (e.g., SD or XD memory, etc.), RAM (Random Access Memory), SRAM (Static Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), PROM (Programmable Read-Only Memory), magnetic memory, magnetic disk, and optical disk. Such memory (120) may also constitute the database shown in FIG. 1.

[0042] The memory (120) can store at least one instruction that can be executed by the processor (130). Additionally, the memory (120) can store any form of information generated or determined by the processor (130) and any form of information received by the server (200). Additionally, the memory (120) stores various types of modules, instruction sets, or models.

[0043] The processor (130) can perform technical features according to embodiments of the present disclosure to be described below by executing at least one instruction stored in memory (120). In one embodiment, the processor (130) may be composed of at least one core and may include a processor for data analysis and / or processing, such as a central processing unit (CPU) of a computer device, a general purpose graphics processing unit (GPGPU), or a tensor processing unit (TPU).

[0044] This processor (130) can train a neural network or model designed in a machine learning or deep learning manner. To this end, the processor (130) can perform calculations for training the neural network, such as processing input data for training, extracting features from input data, calculating errors, and updating the weights of the neural network using backpropagation. Additionally, the processor (130) can perform inference for a specific purpose using a model implemented in an artificial neural network manner.

[0045] FIG. 2 is a diagram showing the configuration of an instruction set stored in memory according to an embodiment, and FIG. 3 is a diagram for explaining the function of an instruction set.

[0046] Referring to FIGS. 2 and 3, the instruction set according to the embodiment may be configured to include a log collection module (121), an anomaly detection engine (122), an RL optimization module (123), an automatic control module (124), and an integrity assurance module (125). The term "module" as used herein should be interpreted to include software, hardware, or a combination thereof, depending on the context in which the term is used. For example, software may be machine language, firmware, embedded code, and application software. As another example, hardware may be a circuit, processor, computer, integrated circuit, integrated circuit core, sensor, MEMS (Micro-Electro-Mechanical System), passive device, or a combination thereof.

[0047] The log collection module (121) receives log data collected from the Access Control System (ACS). The log collection module (121) receives various types of log data generated from the Access Control System (hereinafter referred to as “ACS”) in real time and performs the function of standardizing and preprocessing them so that they can be used for anomaly detection analysis and reinforcement learning-based control.

[0048] Specifically, the log collection module (121) collects entry event logs generated from an RFID reader, a card reader, a biometric device (fingerprint, face, iris, etc.), a network gateway, and a camera sensor through a network. Each log includes a time stamp, user ID, door ID / zone ID, entry status (enter / exit / denial), authentication method (card / biometric / QR), and environmental information (temperature, humidity, illuminance, number of motion detections, etc.).

[0049] In addition, the log collection module (121) converts the received logs into a Common Log Format (CLF) for unstructured logs generated from ACS equipment of various manufacturers through the protocol conversion unit (121a). For example, it converts logs in JSON, XML, or CSV formats into a standardized structure and performs time synchronization and deduplication procedures for each field.

[0050] Meanwhile, the log collection module (121) has a data reception structure based on a stream buffer and can be implemented as a fault-tolerant structure that temporarily stores the log for a certain period of time and retransmits it upon recovery, even when network delay or equipment failure occurs during real-time log collection.

[0051] The above log collection module (121) applies an AES or RSA-based encryption algorithm to the log data being transmitted for security enhancement, and performs a SHA-256 hash verification procedure in parallel to prevent tampering or forgery that may occur during the log transmission process.

[0052] Additionally, the log collection module (121) preprocesses the collected logs into a structure that can be input into an anomaly detection engine (122) or a reinforcement learning module (123) before transmitting them to a database or a blockchain-based distributed storage in chronological order. Specifically, the preprocessing process may include procedures such as checking for missing logs and supplementing them, indexing by user / zone, calculating event time interval Δt, and mapping camera and sensor metadata.

[0053] The anomaly detection engine (122) detects anomalies by analyzing the log data and sensor / image data. The anomaly detection engine (122) receives entry / exit log data, environmental sensor data, and image recognition data transmitted from the log collection module (121) as input, and performs the function of detecting anomalies by analyzing deviations from normal entry / exit patterns. Specifically, the anomaly detection engine (122) is implemented with a multi-stage analysis structure and may include a time-series-based analysis unit (122a), a graph-based relationship analysis unit (122b), a multi-modal fusion unit (122c), and a prediction-based anomaly detection unit (122d).

[0054] The time series-based analysis unit described above uses a Long Short-Term Memory (LSTM) or Gated Recurrent Unit (GRU) network to learn entry and exit time patterns by user and area, and detects abnormal deviations in time zones, frequencies, and entry / exit intervals. For example, if a user attempts to access at 2 AM despite having a pattern of usually going to work between 8 AM and 9 AM, it is determined that a deviation of 3σ or more from the average pattern has occurred, and an anomaly probability is calculated. The results of the analysis are quantified in the form of an anomaly score (0 to 1) and transmitted to subsequent modules.

[0055] The graph-based relationship analysis unit described above constructs a dynamic graph by defining users, doors, and zones as nodes and entry / exit events as edges, and performs relationship-based anomaly detection using a Graph Neural Network (GNN), Graph Attention Network (GAT), or GraphSAGE model. For example, if a new connection is created between an unauthorized user and a specific zone, or if a tailgating pattern is detected where multiple users continuously move to the same zone within a short period, anomaly signs are determined based on changes in edge embedding similarity in the GNN. This configuration has the advantage of being able to detect group anomalies and unauthorized interaction relationships in real time, compared to existing single-log-based detection.

[0056] The multimodal fusion unit described above detects physical behavioral anomalies by combining image and environmental sensor data in addition to log data. For example, even if an event is determined to be a normal approval in the entry log, if camera image analysis results in a face not being recognized or a body posture being determined to be abnormal (e.g., wearing a mask or hat, face obscuring), the probability of abnormal behavior is calculated using a Convolutional Neural Network (CNN) or a Vision Transformer (ViT).

[0057] The multimodal fusion unit calculates the final anomaly probability by combining data detected from environmental sensors (temperature, movement, illuminance, etc.) with log analysis results using the Bayesian fusion method when the data falls outside the normal range (e.g., detection of movement in an unmanned area).

[0058] The prediction-based anomaly detection unit described above uses a Generative Adversarial Network (GAN) to learn normal entry patterns as a generative model and predicts abnormal patterns based on the reconstruction error with respect to input logs. For example, if the same user attempts to enter 10 or more times within one minute, the GAN's discriminator determines it as an abnormal event if the reconstruction error rate is calculated to be 0.9 or higher. This enables the early detection of potential attack attempts or automated card hacking attempts.

[0059] In the embodiments, the time series, graph, image, and sensor analysis results are aggregated into an Integrated Anomaly Score. The weights wt, wg, and wm for each analysis result are automatically adjusted according to a reinforcement learning-based policy, and the final anomaly probability (P anomaly ) can be calculated using the following mathematical formula.

[0060]

[0061] Here, St is the time-series anomaly score, Sg is the graph anomaly score, and Sm is the multimodal anomaly score. f(·) is a sigmoid or softmax function. Additionally, Wt is a weight representing the importance of the time-series analysis results, Wg is the weight of the graph neural network (GNN)-based relationship analysis results, and Wm is the weight of the multimodal fusion analysis results.

[0062] When the probability of an anomaly exceeds a threshold value, an anomaly detection signal (Alert Signal) is transmitted to the automatic control module (123) to perform physical control (door locking, alarm issuance, etc.). Accordingly, the anomaly detection engine (122) is characterized by reducing false positives based on a single event by fusion analysis of log, video, and sensor data using multiple models, and detecting multidimensional anomaly signs based on patterns, relationships, and predictions in real time. Thus, the present invention can detect insider threats, unauthorized access, group movement anomalies, and repetitive attack attempts at an early stage, thereby enabling the implementation of an advanced intelligent security system linked with a reinforcement learning-based automatic control system.

[0063] The RL optimization module (123) dynamically optimizes the access control policy through reinforcement learning (RL) based on the output result of the anomaly detection engine. Specifically, the RL optimization module (123) follows a state-action-reward framework (SARSA or Q-Learning structure) consisting of environment, state, action, and reward.

[0064] In the embodiment, the state includes an anomaly score (e.g., anomaly probability, detection type, occurrence zone, time zone, etc.) transmitted from the anomaly detection engine and environmental information (working hours status, user class, detection sensor status, etc.). For example, if an anomaly score of 0.9 occurs during nighttime entry by a specific user and the corresponding zone is set as a server room, the state vector is

[0065]

[0066] It consists of.

[0067] The RL agent selects one of the possible sets of actions A={a1, a2, a3, a4} corresponding to the state. For example, a1 includes Delay unlock (hold for 30 seconds), a2 includes Lock immediately, a3 includes Alert + Siren, and a4 includes Security Dispatch, and the selection is made by an ε-greedy policy or a Softmax search policy.

[0068] The reward rt awarded based on the outcome of an action is calculated by combining the threat reduction rate, false positive rate, user inconvenience, etc. The reward can be defined by the following formula.

[0069]

[0070] Here, Rthreat_reduction is the actual threat blocking rate, Rfalse_alarm is the false alarm rate, Ruser_inconvenience is the user inconvenience, and α, β, and γ are learning parameters whose weights are adjusted according to the environment.

[0071] The above RL optimization module (123) updates the Q-function using a Q-Learning or Deep Reinforcement Learning (DQN) structure.

[0072]

[0073] Through this, the agent estimates the long-term reward for each state-action pair and derives the optimal policy π*(st)=argmaxaQ(st,a).

[0074] In the embodiment, the RL optimization module (123) periodically receives feedback data from the anomaly detection engine (122) and the automatic control module (124) to update policy parameters in real time. For example, if unauthorized nighttime access to the server room by user EMP1234 is repeatedly detected, a delayed control (30-second lock) is initially applied. However, when the RL agent learns that a 5-minute lock is more effective with a threat blocking rate of 90%, it automatically selects the 5-minute lock policy in subsequent situations. Through this, the embodiment improves adaptability to environmental changes (time zone, user patterns, seasonal factors) compared to a fixed threshold-based control system, and continuously reduces false positives and under-detection rates through learning, thereby realizing self-optimizing security control. Additionally, the creation of reinforcement learning-based policies can achieve the effects of responding to unauthorized access, mitigating insider threats, and improving operational efficiency.

[0075] The automatic control module (124) performs physical control of doors, gates, alarm devices, etc. according to the results of the RL optimization module. The automatic control module (124) performs immediate security response when abnormal signs occur by controlling physical control devices, such as doors, gates, and alarm devices, in real time according to the optimal control policy provided by the RL optimization module (123). The automatic control module (124) performs stepwise and adaptive control by comprehensively considering the severity of the abnormal sign, the probability of threat, the zone type, and the time context.

[0076] In an embodiment, the automatic control module (124) may be composed of a control command generation unit (124a), a physical interface control unit (124b), and a status feedback management unit (124c).

[0077] The control command generation unit (124a) interprets the policy vector π*(st) input from the RL optimization module and generates a specific control command corresponding to the situation. For example, the control command may include “Delay Unlock for 30 seconds,” “Immediate Lock,” “Alarm + Light Flash,” “Security Dispatch,” etc.

[0078] The physical interface control unit (124b) transmits the command to each device (door lock controller, gate relay, siren, emergency light, robot API, etc.). The control command is transmitted via REST API, MQTT (Message Queuing Telemetry Transport), or Modbus / TCP protocol. At this time, each device uses a unique authentication token (Device Token) to prevent tampering with the command, and the result of the command execution is returned as an encrypted ACK packet.

[0079] The status feedback management unit (124c) monitors the response status (“success,” “failure,” “delay”) of each device in real time and escalates to a retry or higher alert level in the event of a control failure or exception. Subsequently, the automatic control module (124) performs the following multi-stage control strategy based on the risk level of the abnormal signs. For example, if the probability of an anomaly is 0.5 or higher but less than 0.8, measures are taken to approve the opening of the door after a 30-second delay and output a speaker warning. This is intended to mitigate the response to user false positives and to ensure rapid reconfirmation. If the probability of an anomaly is greater than 0.8 but less than 0.9, measures are taken to lock the door, send a notification to the administrator app, and activate the CCTV. This is intended to preemptively block potential threats and secure video evidence.

[0080] If the anomaly probability is 0.9 or higher, measures such as blocking the entire area, sounding an alarm (siren) and flashing red lights, and automatically dispatching security robots or personnel are taken. This is intended to prevent physical intrusion and activate an immediate response system. The above steps are dynamically adjusted based on the learning results of the RL optimization module, and threshold values ​​are automatically modified to reflect environmental variables such as time of day, day of the week, and work pattern.

[0081] Additionally, the automatic control module (124) provides the results of each control execution (“threat blocking success / failure,” “user inconvenience occurrence,” “false positive status”) as feedback data to the RL optimization module (123). For example, if the “5-minute lock” measure achieves a 90% threat reduction rate when nighttime server room access is detected, the corresponding reward value is strengthened to a positive (+) value, increasing the probability of selecting the same action in similar situations thereafter. Conversely, if a false positive complaint occurs due to excessive locking, the policy is automatically adjusted to a negative (-) reward. Furthermore, the automatic control module (124) is deployed on an edge gateway or cloud server to perform external integration. For example, it can provide real-time control logs to an administrator dashboard via a RESTful API, or perform complex security scenario execution by integrating with robots, drones, and lighting systems. Additionally, each control event is transmitted to the integrity assurance module (125) to be recorded as a hash-based audit log.

[0082] The integrity guarantee module (125) prevents tampering and forgery by storing the logs and control history in a blockchain-based distributed ledger. The integrity guarantee module (125) performs the function of preventing data tampering and forgery and ensuring audit traceability by storing all logs and control history generated from the log collection module (121) and the automatic control module (124) in a blockchain-based distributed ledger.

[0083] The integrity guarantee module (125) is configured to fundamentally block log deletion, modification, and forgery issues that may occur in existing centralized databases by combining a hash chain structure and a smart contract-based verification procedure. To this end, the integrity guarantee module (125) first converts each of the access event logs obtained from the log collection module (121), the detection results of the anomaly detection engine (122), and the control command history of the automatic control module (124) into a SHA-256 or Keccak-256 hash algorithm. For example, in the case of [Event] User EMP1234 / Zone: Server Room F / Time: 2025-10-20 02:00:30 / Status: Door Locked, the hash value is 3fa2b7d9f0a4c8e9... The hash value generated in the embodiment is connected to the hash value of the previous block and stored in a chain form. In the embodiment, a new block is created at regular time intervals (e.g., every 10 seconds) or upon the accumulation of events (e.g., upon the accumulation of 50 logs). The block includes a block header, a transaction hash list, a timestamp, and a previous hash. The block header records the source of the log, cryptographic signature, and data integrity indicators, enabling consensus verification among nodes within the blockchain network. Upon block creation, a smart contract is automatically executed to verify the log format, signature validity, and hash consistency. For example, if a specific log is modified or deleted without administrator privileges, the smart contract automatically classifies it as an “Invalid Transaction” and rejects block creation. This verification process can be performed on Ethereum, Hyperledger Fabric, or a private blockchain structure.The verified blocks in the embodiments are replicated and stored across multiple nodes, and their integrity is guaranteed through Proof of Authority (PoA) or Practical Byzantine Fault Tolerance (PBFT) consensus algorithms. Even if a specific node is compromised or attacked, automatic recovery is possible on other nodes maintaining the same blocks.

[0084] In addition, the integrity guarantee module (125) effectively prevents tampering with logs. To this end, each log entry verifies whether it has been changed or deleted by comparing the hash recorded on the blockchain with the hash of the real-time log data. If tampering is detected, the block is marked as “Invalid Block,” and an alert is immediately sent to the administrator. All access and control events are uniquely identified by a blockchain transaction ID, and the authenticity of the log can be directly verified on the blockchain network during an audit. This prevents risks such as log deletion, administrator manipulation, and insider attacks, and ensures an immutable record of all actions.

[0085] In addition, the integrity guarantee module (125) is linked with a security management server or an external audit server so that when an external auditing agency requests the hash of a specific event, it can immediately verify the authenticity by querying the same hash on the blockchain. Furthermore, at regular intervals, the blockchain storage status, the number of blocks, and the status of node verification are visualized and displayed on an administrator dashboard. Additionally, personally identifiable information (PII) is converted through hash processing or pseudonymization and stored on the blockchain to comply with personal information protection regulations such as GDPR.

[0086] In the embodiment, the anomaly detection engine (122) is a multi-model integrated structure including a time series analysis model (LSTM), a graph neural network (GNN), and a generative adversarial network (GAN), and detects real-time anomaly signs from user-specific, zone-specific, and time-specific entry and exit patterns, and performs predictive risk analysis. The anomaly detection engine (122) is configured to hierarchically combine three artificial intelligence models having different analysis perspectives to identify complex anomaly signs that are difficult to detect with a single model with high precision. Each model independently extracts features, and then calculates an Integrated Anomaly Score in the final fusion layer.

[0087] The integrated abnormal score Stotal is calculated using the following formula.

[0088]

[0089] Here, S LSTM is the time pattern anomaly score S calculated by the time series model. GNN is the relationship-based anomaly score calculated by the graph neural network, S GAN is a prediction-based anomaly score calculated by a Generative Adversarial Network, and wt, wg, and wgan are weights of each analysis result, which are dynamically adjusted by a reinforcement learning (RL) module. f(·) is a normalization function composed of a sigmoid or softmax function. This structure provides higher detection precision and prediction reliability than a single anomaly detection method by integrating and analyzing heterogeneous data such as real-time access logs, sensor events, and video analysis results.

[0090] In the embodiment, the time series analysis unit learns entry and exit time patterns by user and zone using a Long Short-Term Memory (LSTM) network and models the temporal continuity of normal behavior based on log data from the past 30 to 60 days. For example, even though a specific user usually showed a pattern of passing through the main gate between 08:00 and 09:00 AM, if an access attempt occurs at 02:00 AM, it is judged as an abnormal pattern exceeding the mean deviation (μ±3σ), and an abnormality score S LSTM= It is calculated as 0.95. This result improves detection accuracy for long-term pattern changes (e.g., increased frequency of nighttime entry, weekend entry attempts, etc.) rather than single events.

[0091] The Graph Neural Network analysis unit constructs a dynamic graph by modeling Users, Doors, Zones, etc., as nodes and entry / exit events as edges. The Graph Neural Network (GNN) or Graph Attention Network (GAT) learns the connection structure and relationship strengths between nodes to detect relationship-based threats (Relational Anomalies), such as unauthorized access, tailgating, and group movement anomalies. For example, if Users EMP5678 (with Lab privileges) and EMP9012 (without privileges) attempt to enter a data center zone simultaneously, the GNN detects an "unauthorized relationship (edge)" and assigns an anomaly score S GNN It outputs =0.90. In addition, the GNN utilizes a real-time updated graph structure to continuously track dynamic anomalies resulting from changes in relationships between nodes (colleague relationships, zone movement history, work shift assignments, etc.).

[0092] Furthermore, the Generative Adversarial Network (GAN)-based prediction unit has a generator learn the statistical distribution of normal entry logs and predicts abnormal patterns and future risk using the difference from actual logs (reconstruction error). For example, if the same user attempts card swiping more than 10 times within one minute, the generator fails to reconstruct a normal pattern, and the discriminator [obtains] a high error value S GAN= It outputs 0.92. In addition, GANs perform a predictive anomaly detection function by learning the time series distribution of past repetitive anomaly patterns to warn in advance of threat events that are likely to occur in the future.

[0093] In the embodiment, the anomaly detection engine (122) integrates the results of the three models to calculate the final anomaly probability, and if it exceeds a threshold, transmits an anomaly detection signal to the automatic control module (124) to respond immediately. Additionally, each analysis result is transmitted to the reinforcement learning module (123) and used as training data for optimizing control policies, and automatically adapts to environmental changes (time zone, user patterns, frequency of access to areas, etc.) through iterative learning.

[0094] Additionally, the anomaly detection engine (122) fuses image data and environmental sensor data (Multi-Modal Fusion) in addition to log data to calculate an anomaly score that combines the results of object recognition within the image with log-based events. The anomaly detection engine (122) is configured to identify complex anomalies that are difficult to detect with single log analysis by combining different data modalities (log, image, sensor). To this end, the event feature vector extracted from log data, the object and behavior feature vector extracted from Flog image data, and the situation feature vector extracted from Fvis environmental sensor data are integrated to calculate the final anomaly score Sfusion.

[0095] The multimodal fusion calculation formula is expressed as follows.

[0096]

[0097] Here, Flog is a feature vector extracted from access log events, such as time, location, user ID, and authentication results; Fvis is the result of object detection and pose estimation extracted from image data; and Fenv is the feature value of environmental sensor data, such as temperature, humidity, motion sensor, and illuminance. wl, wv, and we are weights corresponding to the reliability and importance of each modal, and f(·) is a normalization and combination function (e.g., Softmax, Bayesian Fusion, etc.). Through this structure, data inconsistencies or noise between different sensors can be corrected, and real-time anomaly detection based on context awareness can be performed.

[0098] In the embodiment, the video analysis unit processes real-time video data input from a camera module or CCTV through object detection and action recognition. In the object detection step, a neural network based on YOLO, Faster-RCNN, or Vision Transformer (ViT) is applied to extract the number of people, face ID, body posture, and direction of movement. In the action recognition step, a CNN-LSTM-based model is used to recognize "abnormal posture," "mask wearing status," "whether an authorized user is present," etc. For example, the system is designed so that if "EMP1234, approved" is recorded in the entry log, but a face mismatch or an unauthorized companion (exceeding the number of companions) is detected in the video at the same time, the anomaly score increases. In the embodiment, the environmental sensor analysis unit collects data in real time from temperature, humidity, motion, illuminance (Lux), and body temperature sensors installed in key areas such as doors, gates, and server rooms. For example, even if a “server room entry event” is determined to be normal in the log, the anomaly score is corrected if the motion sensor detects additional personnel (unregistered users) at that time or if the ambient temperature rises abnormally (e.g., above 30℃). This multi-sensor information strengthens the context of the log, enabling the detection of situation-aware anomalies rather than simple statistical anomalies.

[0099] The results of multimodal analysis are combined in the Fusion Layer to calculate the final anomaly score Sfusion. For example, the log analysis result Slog=0.25 may indicate normality, the image analysis result Svis=0.85 may indicate face mismatch detection, and the sensor analysis result Senv=0.80 may indicate unauthorized motion detection. Additionally, when applying weights wl:wv:we=0.2:0.5:0.3, Sfusion=0.25(0.2)+0.85(0.5)+0.80(0.3)=0.74, which exceeds the threshold of 0.7 and can be determined as "anomaly indication occurred." This result is passed to the RL optimization module (123) and reflected in the control policy learning.

[0100] The anomaly detection engine (122) operates in a data streaming manner at the edge computing node and maintains timestamp synchronization between video frames, log events, and sensor data. Additionally, the fusion results are transmitted to the automatic control module (124) to generate real-time control commands such as door locking, alarm activation, and administrator notification. Through a feedback loop, cases of incorrect judgment (false positive / under-detection) are reflected in the reinforcement learning policy, and the weights are automatically adjusted in subsequent identical situations.

[0101] In addition, in the embodiment, the graph neural network (GNN) models users, doors, and zones as nodes and detects unauthorized group movement, tailgating, or unauthorized access through a dynamic graph created by connecting entry events as edges. To this end, the GNN analysis unit within the anomaly detection engine (122) receives real-time entry event data provided by the log collection module (121) as input and constructs a graph. For example, each user, door, and zone is defined as a node, and events such as entry attempts, approvals, and failures are connected between nodes via edges.

[0102] Edges include attributes such as the time of event occurrence, authentication method (RFID, biometric information, etc.), access status (authorized / denied), and the number of companions. The graph is managed as a dynamic graph that is continuously updated over time, allowing it to reflect past, present, and predicted states. For example, if the “User EMP5678 → Door Data Center C” event is authorized, an edge (EMP5678, Data Center C) is created; if the “EMP9012 → Data Center C, Status: Attempted” event is added at the same time, the GNN analyzes the relationship between the two edges to evaluate the possibility of unauthorized companion access. To achieve this, the Graph Neural Network (GNN) learns the connection strength and attribute similarity between nodes based on the graph's adjacency matrix. Subsequently, it classifies legitimate relationships (Authorized Links) and unauthorized relationships (Unauthorized Links) using learned graph embeddings. In addition, whenever a real-time event occurs, the GNN calculates the authority probability of the new edge by comparing it with the previous graph, and comprehensively evaluates the possibility of unauthorized access, anomalies in group movement patterns, failure to identify companions, etc., to obtain an anomaly score S GNN It calculates. For example, when EMP5678 (Laboratory privileges) and EMP9012 (Office privileges) simultaneously access Data Center C, the GNN detects that there is no connection between the privilege nodes of the two users, classifies it as an “Unauthorized Edge,” and calculates an anomaly score S. GNN Prints =0.9.

[0103] In the embodiment, the GNN analysis results are combined with an image analysis module or a sensor module to perform contextual validation. For example, if “Number of companions: 2, Face ID: EMP5678 only recognized” is detected in the camera log, the unauthorized edge detected by the GNN is determined to be confirmed tailgating. Through this, precise detection reflecting not only simple data anomalies but also the actual physical field situation is possible.

[0104] The graph is updated in real-time at regular intervals or on an event basis, and the structure of the GNN is retrained whenever a new node (new user, new area) or edge (new entry / exit event) is added. At this time, the edge weights and thresholds are dynamically adjusted by reflecting feedback on incorrectly detected cases (false positives, under-detection) in conjunction with the reinforcement learning (RL) module (123).

[0105] Additionally, the RL optimization module (123) learns a state including an anomaly score, a behavior including a control action, and a reward including a threat reduction rate, automatically selects a control strategy including at least one of delayed control, immediate blocking, and issuing an alarm, and dynamically adjusts a threshold value according to changes in the environment.

[0106] In the embodiment, the RL optimization module (123) is a component that receives anomaly detection scores, detection types, environmental information, etc., output from the anomaly detection engine (122) as input, and automatically learns and determines an optimal access control strategy through a Reinforcement Learning (RL) framework. The RL optimization module (123) operates based on a reinforcement learning structure composed of four elements: Environment, State, Action, and Reward. In the embodiment, the State is defined by variables such as anomaly detection scores (e.g., probability of unauthorized access, risk level, etc.), detection zone, time zone, and user authority level transmitted from the anomaly detection engine (122). The Action consists of a set of control actions that the RL agent can select in response to the State. In the embodiment, possible action set A={a1, a2, a3} can be a1: Delay Control — delaying door opening for a certain period of time, a2: Immediate Lock — locking the door immediately, and alert Trigger — sending a siren and an administrator notification.

[0107] In addition, the reward is calculated by combining the Threat Reduction Rate, False Alarm Rate, User Discomfort Index, etc., based on the results of the action performance. In the embodiment, the reward function can be expressed by the following formula.

[0108]

[0109] Here, α, β, and γ are weights that RL dynamically adjusts based on the importance of each environment.

[0110] The above RL optimization module (123) iteratively learns the state-action-reward relationship using Q-Learning or DQN (Deep Q-Network) algorithms. The Q-function update automatically selects the optimal action for each state among delayed control, immediate blocking, or issuing an alert, according to the learned optimal policy π*(st). For example, if the same user attempts to access an unauthorized area three or more times in a short period, the RL module selects the “immediate blocking” action by referring to past learning results, and can automatically adjust the policy to send a real-time notification to the administrator simultaneously with an alert if the threat reduction rate is low.

[0111] In addition, existing systems determine whether an anomaly exists based on a statically set threshold (e.g., 0.8), but the RL optimization module (123) dynamically adjusts the threshold according to environmental changes (time zone, season, user patterns, security level, etc.). For example, during working hours (09:00–18:00), the threshold is raised to 0.9 to reduce false positives, and during nighttime, it is lowered to 0.7 to increase sensitivity. Furthermore, RL continuously learns and updates the optimal threshold for each environment through reward feedback, and forms an autonomous adaptive security policy tailored to real-time operating conditions.

[0112] In the embodiment, the automatic control module (124) performs a level-based response according to the severity of the abnormal sign, and automatically performs delayed opening in the case of a minor abnormality, and door locking, alarm, or dispatch of security personnel and robots in the case of a major abnormality. The automatic control module (124) is an intelligent control module that performs a level-based response according to the severity of the abnormal situation based on the abnormal sign score and response policy information transmitted from the abnormal detection engine (122) and the RL optimization module (123).

[0113] The above automatic control module (124) is configured to classify the severity level of an anomaly into multiple stages and to automatically perform different physical and logical control procedures for each stage. For example, in the case of a minor anomaly (Low-Level Anomaly, anomaly score 0.5 to 0.8), the opening of the door is delayed for a certain period of time (e.g., 30 seconds), or a voice warning such as “companion verification required” is output through a speaker to induce the user to re-authenticate.

[0114] In addition, the camera is automatically activated to capture the relevant scene, and automatic opening is performed upon confirmation of normality following a delayed opening. For example, if user EMP5678 is detected as suspected tailgating, the door may be opened after a 30-second delayed opening and warning, followed by reconfirmation of normality. If a critical anomaly (High-Level Anomaly, anomaly score ≥ 0.8) occurs, the door or gate is immediately locked, and the alarm system is activated simultaneously. For instance, upon detection of unauthorized user access or abnormal access during nighttime hours, a physical lock command is transmitted via API through a solenoid lock or electronic door controller. At the same time, a "Attempted Security Zone Intrusion" notification is sent to the administrator app and email. For instance, if user EMP1234 accesses Server Room F at 2:00 AM, an anomaly score of 0.95 is detected, the door is automatically locked, and an SMS is sent to the administrator.

[0115] If a critical anomaly (anomaly score ≥ 0.9) occurs, in addition to the locking and alarm mentioned above, security personnel or autonomous security robots are automatically dispatched. Based on policies learned in the RL module, real-time dispatch commands are transmitted to a robot control system or security personnel management server via API integration, and video feedback is collected upon arrival at the site. For example, when unauthorized movement is detected in Warehouse G, or when an anomaly score of 0.88 is detected, a security robot is dispatched and real-time video feedback is transmitted.

[0116] Afterwards, the automatic control module (124) receives the control policy and anomaly detection results transmitted from the RL optimization module (123) as input and selects a control strategy according to the next step-by-step logic.

[0117]

[0118] Here, Sanomaly is the integrated anomaly score of the anomaly detection engine, θ1 and θ2 are step thresholds learned by the RL module, and Dispatch refers to the dispatch of security personnel or robots. In the embodiment, the RL module dynamically adjusts the step thresholds according to environmental changes (time zone, zone, user patterns, etc.) to optimize the balance between false positive rate and response speed.

[0119] In addition, the integrity guarantee module (125) prevents log tampering and ensures audit traceability by connecting the access logs, anomaly detection results, and control history into a hash chain structure and recording them in a distributed ledger including a blockchain. The integrity guarantee module (125) prevents data alteration, deletion, or forgery by connecting the access logs, anomaly detection results, and control history into a hash chain structure and converting each data item into a hash function such as SHA-256 or Keccak-256 and recording them sequentially in a blockchain-based distributed ledger. To this end, the integrity guarantee module (125) includes the hash value and timestamp of the previous block in each log block and connects them in a chain form, and performs a multi-node verification procedure through a PBFT or PoA consensus algorithm when creating a block. In the embodiment, the verified block is automatically verified by a smart contract to check the format, signature, and duplicate status, and then permanently stored in the blockchain network.

[0120] In addition, each event is identified by a unique Transaction ID, and during external audits, tampering or forgery can be verified in real time by comparing the hash values ​​of the original log and the blockchain record using this ID.

[0121] In addition, if there is a discrepancy between the real-time log hash value and the record value in the ledger, an integrity violation event is automatically generated and an alert is sent to the administrator. In the embodiment, the integrity guarantee module (125) can simultaneously ensure prevention of tampering and falsification of log data of the access control system and audit traceability by combining a hash chain structure and a blockchain-based distributed storage method.

[0122] The anomaly detection system according to the embodiment is implemented based on edge computing, independently performing anomaly detection and control commands at the edge even in the event of network delays or server failures, and maintaining log consistency and real-time performance through synchronization with a cloud server.

[0123] The anomaly detection system according to the embodiment is implemented based on edge computing, and by independently performing anomaly detection and control commands at the physical field edge layer of the access control system (ACS), it can continuously maintain real-time security response functions even in the event of network latency or cloud server failure. The system of the present embodiment is designed with a hierarchical distributed architecture consisting of a cloud server and a plurality of edge nodes. The edge nodes are composed of field access controllers, gateways, or local AI modules, and each node directly collects log data from sensors (RFID, cameras, biometric recognition devices) and performs local AI inference by embedding a lightweight version of the anomaly detection engine (122).

[0124] The cloud server (Cloud Layer) aggregates and analyzes integrated logs collected from multiple edge nodes and performs long-term learning, policy updates, and central control functions, including a reinforcement learning module (RL optimization module (123)). Through this structure, even if network connectivity is unstable or server failure occurs, anomaly detection and immediate control (door locking, alarm issuance, etc.) are possible at the edge.

[0125] In addition, the edge node according to the embodiment performs an independent autonomous local response through the following procedure. In the embodiment, the edge node analyzes log data collected in real time (entry / exit events, sensor inputs, video metadata, etc.) and detects anomalies using lightweight models based on LSTM and GNN. Subsequently, if the detected anomaly exceeds a threshold, the edge node directly controls the door lock, activates an alarm, or issues an on-site warning without authorization from the central server. For example, when unauthorized access is detected while the server connection is disconnected, the edge node can independently execute an “immediate block” command.

[0126] In addition, edge nodes prevent log loss by writing the results of executed controls to local non-volatile storage (NVM, SSD, etc.).

[0127] In the embodiment, once network connectivity is restored, the edge node automatically synchronizes logs and control history with the cloud server to maintain the consistency and real-time integrity of the entire system. For instance, missing logs are transmitted to the server via an asynchronous message queue (e.g., MQTT, Kafka), and duplicates are verified by comparing hash values ​​for identical events. Additionally, the server re-verifies the integrity of the logs by comparing the timestamps of the logs received from the edge node with the blockchain record hashes. Furthermore, when the latest reinforcement learning policies or detection models are updated in the cloud, the corresponding models are automatically deployed to each edge node.

[0128] This enables real-time anomaly detection and control at the edge, even in the event of network or server failures, thereby minimizing response delays. Furthermore, it ensures that core security functions continue to operate even in the event of a central server failure, preventing system downtime. In addition, automatic synchronization between the edge and the cloud guarantees the continuity and integrity of logs. Moreover, by performing context-aware AI inference on a per-edge node basis, it implements a highly scalable security architecture suitable for large-scale facilities.

[0129] FIG. 4 shows a comparison table by detection model illustrating how each detection algorithm (LSTM, GNN, Multi-Modal, GAN) detects different abnormal signs for each detection target in the multi-model integration structure of the anomaly detection engine (122) according to an embodiment of the present invention.

[0130] Referring to FIG. 4, the anomaly detection engine (122) includes four core analysis models, each model being applied separately according to the form of input data and the purpose of detection.

[0131] Each column represents a detection algorithm based on Time Series (LSTM), Graph Neural Network (GNN), Multi-Modal, and Generative Adversarial Network (GAN). The Time Series (LSTM)-based anomaly detection unit detects abnormal behavior based on time-series patterns, such as abnormal time zones or nighttime access. In this case, the detection targets include entry during abnormal time zones and nighttime access. For example, this may include an attempt by user EMP1234 to enter at 02:00, and the detection score may be calculated as 0.95. In this case, the applied algorithm is Long Short-Term Memory (LSTM). In the embodiment, the Graph Neural Network (GNN)-based anomaly detection unit models the relationships between entering and exiting users and group movement patterns as nodes and edges to detect tailgating or unauthorized group movement. In this case, the detection targets include tailgating and group movement, and, for example, can detect the simultaneous movement of EMP5678 and one additional companion. The detection score can be calculated as 0.90, and the applied algorithm may include a Graph Neural Network.

[0132] In addition, the multi-modal-based anomaly detection unit detects complex abnormal behaviors by combining camera images and environmental sensor data in addition to log data. At this time, the detection targets may include mask wearing, companion recognition mismatch, and abnormal behavior fusion. For example, combined camera and sensor detection can be performed. The detection score may be calculated as 0.88, and the applied algorithms may include a Convolutional Neural Network (CNN) and Bayesian Fusion.

[0133] A Generative Adversarial Network (GAN)-based anomaly detection unit learns normal patterns and then detects predictive anomalies based on reconstruction error or pattern variability. In this case, the detection targets may include repetitive access attempts, brute-force card swipe attacks, etc. For example, user EMP9012 can detect 10 card swipe attempts within 5 minutes. The detection score may be calculated as 0.92, and the applied algorithm may include a Generative Adversarial Network (GAN).

[0134] As illustrated in FIG. 4, the anomaly detection engine (122) according to the present invention has a structure that combines time series analysis (LSTM), relationship-based analysis (GNN), multimodal fusion analysis (CNN, Bayesian Fusion), and generative model-based prediction analysis (GAN), and is characterized by multidimensionally identifying anomalies according to different data characteristics and detection purposes, and performing comprehensive anomaly judgment through quantitative evaluation of detection scores (0.88~0.95), thereby significantly improving precision and detection reliability compared to existing single models.

[0135] FIG. 5 is a diagram showing an example of operation of a reinforcement learning (RL)-based automatic control module (124) according to an embodiment of the present invention, showing how different control types and execution actions, and the reinforcement learning reward values ​​are determined according to an anomaly score.

[0136] Referring to FIG. 5, an anomaly score (S_anomaly) calculated from an anomaly detection engine (122) is input into an RL optimization module (123), and the RL agent automatically selects the following stepwise control strategy through a learning framework of State, Action, and Reward. In the embodiment, if the anomaly score is 0.95, an Immediate Lock is performed. If the detected anomaly is at a critical level, the system executes a control command to immediately lock the door. Execution examples may include maintaining the door lock for 5 minutes. At this time, the RL learning result may be set to a reward value of +1.0, as the threat reduction rate is highest. Additionally, application scenarios may include the detection of unauthorized nighttime access or repeated attempts to enter.

[0137] An anomaly score of 0.75 serves as a Delayed Control; for low-level anomalies, a delay is applied instead of immediate blocking to perform additional verification. Execution examples may include opening a door after waiting 30 seconds. The RL learning result is evaluated with a reward value of +0.8, and feedback is adjusted based on whether the user has successfully accessed the site. Application scenarios may include the detection of minor anomalies, such as suspected tailgating or failure to recognize a companion.

[0138] In the embodiment, an anomaly score of 0.90 is an Alert. In the embodiment, when a medium-level anomaly is detected, an alert is issued instead of an immediate lock and the administrator is notified. Execution examples may include siren activation and SMS notification transmission, where the RL learning result is evaluated as a threat reduction rate of 90%, and a reward value of +0.9 is assigned.

[0139] Application scenarios may include unauthorized recognition failures, detection of abnormal behavior, etc.

[0140] An anomaly score of 0.88 allows for the performance of Security Dispatch. In the embodiment, security personnel or security robots are automatically dispatched for physical verification in cases of high-level anomalies. In this case, execution examples may include the dispatch of security guards and the movement of security robots to the site, and the RL learning result may be calculated as a reward value of +0.95 due to a high threat reduction effect. Application scenarios may include the detection of unauthorized movement, sensor anomalies, or access retries.

[0141] As illustrated in FIG. 5, the reinforcement learning-based automatic control module (124) performs a multi-level control strategy, such as delayed control, immediate blocking, issuing an alarm, and dispatching security personnel, based on an abnormal score, and receives feedback on the effectiveness of each strategy (threat reduction rate, false positive prevention rate, etc.) as a reward value, thereby autonomously optimizing the control policy according to changes in the environment.

[0142] Meanwhile, the methods according to the various embodiments of the present invention described above can be implemented in the form of an application or software program that can be installed on an existing electronic device.

[0143] In addition, the whole or part of the method may be composed of multiple software function modules and implemented on an operating system (OS). Alternatively, each step may be composed of a single software function module, or each step may be combined to form a single software function module and implemented on an operating system. Therefore, even if all of the embodiments of the present disclosure are not implemented as a single software function module, if multiple software function modules implement each step of the present disclosure and multiple software function modules are implemented on a single operating system, it can be understood that the method of the present disclosure has been implemented.

[0144] In addition, the methods according to the various embodiments of the present invention described above can be implemented solely through software upgrades or hardware upgrades of existing electronic devices. Furthermore, the various embodiments of the present invention described above can also be performed through an embedded server equipped in an electronic device or an external server of the electronic device.

[0145] Meanwhile, according to one embodiment of the present invention, the various embodiments described above may be implemented as software comprising instructions stored on a computer-readable recording medium using software, hardware, or a combination thereof. In some cases, the embodiments described herein may be implemented as the processor itself. According to the software implementation, embodiments such as the procedures and functions described herein may be implemented as separate software modules. Each of the software modules may perform one or more functions and operations described herein.

[0146] Meanwhile, a computer or a similar device may include a device according to the disclosed embodiments, which is capable of calling instructions stored from a storage medium and operating according to the called instructions. When said instructions are executed by a processor, the processor may perform a function corresponding to said instructions directly or by using other components under the control of said processor. The instructions may include code generated or executed by a compiler or an interpreter.

[0147] A computer-readable recording medium may be provided in the form of a non-transitory computer-readable recording medium. Here, "non-transitory" simply means that the storage medium does not contain a signal and is tangible, without distinguishing whether data is stored semi-permanently or temporarily on the storage medium. In this context, a non-transitory computer-readable medium refers to a medium that stores data semi-permanently and is readable by a device, rather than a medium that stores data for a short moment, such as registers, caches, or memory. Specific examples of non-transitory computer-readable media may include CDs, DVDs, hard disks, Blu-ray discs, USBs, memory cards, and ROMs.

[0148] As described above, exemplary embodiments have been disclosed in the drawings and specification. Although specific terms have been used to describe the embodiments in this specification, they are used only for the purpose of explaining the technical concept of this disclosure and are not intended to limit the meaning or the scope of this disclosure as defined in the claims. Therefore, those skilled in the art will understand that various modifications and equivalent alternative embodiments are possible therefrom. Accordingly, the true technical scope of protection of this disclosure should be determined by the technical concept of the appended claims.

Claims

Claim 1 A memory storing at least one instruction for reinforcement learning and multi-model integrated anomaly detection for smart access security; and a processor performing an operation according to said instruction, wherein the processor includes: a log collection module receiving log data collected from an Access Control System (ACS); an anomaly detection engine detecting anomaly signs by analyzing said log data and sensor / image data; an RL optimization module dynamically optimizing an access control policy through reinforcement learning (RL) based on the output result of said anomaly detection engine; an automatic control module performing physical control of doors, gates, alarm devices, etc. according to the result of said RL optimization module; and an integrity assurance module preventing tampering by storing said logs and control history in a blockchain-based distributed ledger.It includes, wherein the anomaly detection engine is a multi-model integrated structure including a time series analysis model (LSTM), a graph neural network (GNN), and a generative adversarial network (GAN); it detects real-time anomaly signs from user-specific, zone-specific, and time-specific entry and exit patterns and performs predictive risk analysis; the anomaly detection engine fuses video data and environmental sensor data (Multi-Modal Fusion) in addition to log data to calculate an anomaly score combining object recognition results within the video and log-based events; the anomaly detection engine maintains timestamp synchronization between video frames, log events, and sensor data; the automatic control module generates at least one real-time control command among door locking, alarm activation, and administrator notification; reflects false positive cases in a reinforcement learning policy through a feedback loop to automatically adjust weights in the same situation thereafter; the anomaly detection engine receives real-time entry and exit event data as input to construct a graph, and the edges of the graph include at least one attribute among the time of event occurrence, authentication method, access status, and number of companions; and the anomaly score (S_anomaly) calculated by the anomaly detection engine is to the RL optimization module A system that, upon input, selects a stepwise control strategy through at least one learning framework among State, Action, and Reward. Claim 2 delete Claim 3 A system according to claim 1, wherein the graph neural network (GNN) models users, doors, and zones as nodes and detects unauthorized group movement, tailgating, or unauthorized access through a dynamic graph generated by connecting entry and exit events as edges. Claim 4 A system according to claim 1, wherein the RL optimization module learns a state including an anomaly score, a behavior including a control action, and a reward including a threat reduction rate, automatically selects a control strategy including at least one of delayed control, immediate blocking, and issuing an alarm, and dynamically adjusts a threshold value according to changes in the environment. Claim 5 A system according to claim 1, wherein the automatic control module performs a stepwise response according to the severity of abnormal signs, and automatically performs delayed opening in the case of a minor abnormality, and door locking, alarm, or dispatch of security personnel and robots in the case of a major abnormality. Claim 6 A system according to claim 1, wherein the integrity guarantee module prevents log tampering and ensures audit traceability by connecting access logs, anomaly detection results, and control history, respectively, into a hash chain structure and recording them in a distributed ledger including a blockchain. Claim 7 In claim 1, the system is implemented based on edge computing, independently performs anomaly detection and control commands at the edge even in the event of network delay or server failure, and maintains log consistency and real-time performance through synchronization with a cloud server.

Images