An abnormal trajectory detection method and device integrating LSTM and scene rule knowledge

Abstract

The present invention discloses an abnormal trajectory detection method and device integrating LSTM and scene rule knowledge, including constructing a time series sequence according to the target trajectory; inputting the time series sequence into the LSTM network, obtaining the position latent vector of each moment in the target trajectory, and performing attention mechanism calculation based on each position latent vector to obtain the target trajectory representation vector; splicing the target trajectory representation vector and the vector of the set scene rule, and classifying the spliced ​​vector to obtain the abnormal trajectory detection result. In addition to using vectors to represent the trajectory, the fusion method adopted by the present invention also adds adjustable application scenario rules to solve the shortcomings of a single method and has better transferability.

Description

Technical Field

[0001] The present invention relates to the field of trajectory analysis, and in particular to an abnormal trajectory detection method and device integrating LSTM and scene rule knowledge. Background Art

[0002] With the rapid rise of mobile Internet, it is becoming more and more convenient to obtain user geographic trajectory data, and the analysis and research of trajectory data are gradually deepening. By analyzing and mining trajectory data, user behavior patterns can be obtained, so that the accuracy of many services based on location information can be improved, which has a positive effect on various subsequent tasks. Trajectory analysis is a frontier research field of multidisciplinary intersection, and trajectory anomaly detection is an important branch of trajectory analysis. Trajectory clustering is the premise of trajectory anomaly detection and is also an extremely important part. For the research on trajectory analysis, foreign researchers started early in this field and achieved rich research results. Compared with foreign countries, domestic research in the field of trajectory analysis started relatively late, but there are also a large number of scholars who have made research in this field. The trajectory of moving objects has a wide range, including various moving objects, mainly including humans, animals, vehicles, etc., and some scholars have also made research on the motion trajectory in natural science fields such as hurricane movement.

[0003] Existing abnormal trajectory detection methods mainly include the classic TROD algorithm, iBAT algorithm, etc. Since these algorithms do not consider the time factor, they are not conducive to directly discovering more abnormal patterns. Therefore, an independent time abnormal trajectory detection method is proposed. First, the top k hotspot trajectories of the historical trajectory in the time window are found, and then the temporal and spatial edit distances of the trajectory and the hotspot trajectory in the same time window are compared. The result is a dynamic anomaly, but the temporal and spatial characteristics of this anomaly are not obvious, and it is not easy to make further explanations.

[0004] In traditional anomaly detection methods, clustering-based methods treat anomalies as objects that do not belong to any cluster. They can simultaneously obtain meaningful clusters and abnormal clusters, and realize intuitive comparison between normal and abnormal trajectories. However, trajectory clustering is currently mainly used to mine frequent trajectory patterns and is rarely used in abnormal trajectory detection research. At present, many trajectory clustering methods have been proposed. A common method is to segment the trajectory and then cluster the trajectory shape. Compared with the method in which the entire trajectory is used as a clustering unit for calculation, it is more conducive to detailed comparison of local features of the trajectory, such as the TRACLU method based on density clustering ideas and the trajectory clustering algorithm based on improved Hausdorff distance.

[0005] Previous neural network-based methods were not able to identify some sudden, new normal trajectories well, and were also not able to be well transferred to some special scenarios, such as a city-scale taxi trajectory prediction method based on an attention mechanism disclosed in Chinese patent application CN110163439A and a network behavior anomaly detection method based on LSTM disclosed in Chinese patent application CN110287439A. Most of their trajectory analysis methods are based on feature engineering methods, relying on manual feature extraction, and have problems such as sensitivity to noise and incomplete feature consideration. Summary of the invention

[0006] In order to overcome the shortcomings of the existing methods, the present invention discloses an abnormal trajectory detection method and device that integrates LSTM and scene rule knowledge. Based on the temporal characteristics of trajectory data, an LSTM sequence is used to encode the trajectory, and then manually constructed scene rule knowledge features are integrated to classify the trajectory using binary classification to complete the detection of abnormal trajectories.

[0007] An abnormal trajectory detection method integrating LSTM and scene rule knowledge, the steps of which include:

[0008] 1) Construct a time series according to the target trajectory;

[0009] 2) Input the time series into the LSTM network, obtain the position latent vector of the target trajectory at each moment, and perform attention mechanism calculation based on each position latent vector to obtain the target trajectory representation vector;

[0010] 3) Concatenate the target trajectory representation vector and the vector of the set scene rule, and classify the concatenated vector to obtain the abnormal trajectory detection result.

[0011] Furthermore, the time series is obtained by the following steps:

[0012] 1) The target trajectory is represented as a spatiotemporal sequence T, where each element in the spatiotemporal sequence T includes: a time point k and a longitude and latitude information (x (k) ,y (k) );

[0013] 2) Calculate the longitude and latitude information (x (k) ,y (k) ) The corresponding two-dimensional vector v k ;

[0014] 3) Based on the time point k, the two-dimensional vector v k Sort them to get the time series.

[0015] Furthermore, when training the LSTM network, the output supervision data of each LSTM unit is the vector of the next trajectory point.

[0016] Furthermore, the target trajectory representation vector is obtained through the following steps:

[0017] 1) Based on the importance of each position latent vector to the target task classification, obtain the weight of the position latent vector;

[0018] 2) Perform weighted average calculation based on the weights of the latent vectors at each position to obtain the target trajectory representation vector.

[0019] Furthermore, setting scene rules includes: entering and exiting specific provinces and cities, location conditions during working hours, location conditions at night and early morning, excluding regular locations, excluding situations where the location is far away at special times, and the difference in longitude and latitude of the previous and next locations within a short period of time is greater than at least one of the set values.

[0020] Furthermore, the method of obtaining the vector for setting the scene rule includes: using the word2vec method.

[0021] Furthermore, the abnormal trajectory detection result is obtained through the following steps:

[0022] 1) Pass the concatenated vector through a softmax layer with an output dimension of 2 to obtain the probability that the target trajectory belongs to the normal category or the abnormal category;

[0023] 2) Take the category with the highest probability as the abnormal trajectory detection result.

[0024] Furthermore, when training the softmax layer, the one-hot vector representing the trajectory category is used as supervision data.

[0025] A storage medium stores a computer program, wherein the computer program is configured to execute the above method when running.

[0026] An electronic device includes a memory and a processor, wherein the memory stores a program for executing the above method.

[0027] Compared with the prior art, the present invention has the following advantages:

[0028] 1) Using deep feature coding to learn directly from the historical trajectory of the target individual or population, it can mine deep features that are difficult to model manually, thereby improving the accuracy and usability of the model;

[0029] 2) Using the attention mechanism, we can focus on the locations of interest in different scenarios, such as the user's uncommon addresses and key business areas, to obtain the features most relevant to the target task;

[0030] 3) The model of the present invention is not a traditional feature method, but uses LSTM sequence to encode the trajectory based on the temporal characteristics of trajectory data. The learned embedding representation is designed for the task of abnormal trajectory detection, so it has a better effect in the task of abnormal trajectory detection;

[0031] 4) Using deep feature encoding, learning directly from the historical trajectory of the target individual or population can mine deep features that are difficult to model manually, improve the accuracy and usability of the model, and the effect is significantly better than manual feature representation in classification problems;

[0032] 5) In addition to using vectors to represent trajectories, the fusion method used in the present invention also adds some rules applicable to the application scenario to solve the shortcomings of a single method;

[0033] 6) The present invention can also adjust rules according to different scenarios and has better portability. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is an abnormal trajectory detection diagram based on LSTM and Attention of the present invention.

[0035] Figure 2 It is a trajectory construction diagram.

[0036] Figure 3 It is based on LSTM position vector learning.

[0037] Figure 4 It is a trajectory vector representation graph based on the attention mechanism.

[0038] Figure 5 It is a schematic diagram of the SVM classifier. DETAILED DESCRIPTION

[0039] In order to make the above features and advantages of the present invention more clearly understood, examples are given below and detailed description is given in conjunction with the accompanying drawings.

[0040] The abnormal trajectory detection method provided by the present invention is applicable to abnormal trajectory detection tasks in real scenarios. The main idea of ​​the method is to encode the trajectory using LSTM sequence based on the temporal characteristics of trajectory data, and then integrate rule features, use binary classification to classify the trajectory, and add some manually formulated rules to assist in abnormal trajectory determination to complete the detection of abnormal trajectories. The abnormal trajectory detection method includes the following steps:

[0041] 1) Trajectory construction: Preprocess the location data of each user and merge them by day to obtain the user's trajectory data;

[0042] 2) Trajectory representation. The user's trajectory is modeled as a time series, and the location information at each moment is input into the LSTM unit to obtain the latent vector representation at each moment. Then, the Attention mechanism is used to fuse the vector representation of each moment to obtain the vector representation of the current trajectory.

[0043] 3) Abnormal trajectory detection. The trajectory vector and the regular vector are concatenated, and the concatenated joint vector is classified to determine the user's abnormal trajectory. The specific model is as follows: Figure 1 shown.

[0044] Step 1) Analyze the trajectory data in the dataset and formulate a sampling strategy. Sample each user's trajectory data once and use the sample as a set of trajectories. Then combine the location data by day and arrange them by time to obtain different trajectories of the user. Specific examples are as follows: Figure 2 shown.

[0045] For step 2), the trajectories extracted in this study are all fixed-length trajectories. For user i, for the trajectory sequence The position at time k uses a two-dimensional vector To represent, the dimensions of the two-dimensional vector are the longitude and latitude of the trajectory point. Set an LSTM sequence with the same length as the trajectory, and input the position points in sequence. Similar to the translation model, the output supervision data of each LSTM unit is the vector of the next trajectory point. Then use the Attention mechanism to fuse the position hidden vectors at each moment to obtain the final trajectory representation.

[0046] 2.1 Position vector representation based on LSTM

[0047] First, determine a fixed length l pre As the length of the history track used when encoding the history track. Set a length of l pre LSTM network, and randomly extract multiple segments of length l in the dataset pre These trajectory segments are used to train the LSTM.

[0048] Then, the trajectory points are input sequentially, where the output supervision data of each LSTM unit is the vector of the next trajectory point. i Each point in Use a two-dimensional vector as the representation vector of the point and put it in order Input into the kth LSTM unit. For the kth LSTM unit, its supervision data is The specific model diagram is as follows Figure 3 shown.

[0049] 2.2 Trajectory Vector Representation Based on Attention Mechanism

[0050] In order to focus on the locations of business concern, such as the user's uncommon addresses and key areas of business concern, we use the attention mechanism to obtain the features most relevant to the target task. In the attention model, the attention score of each location is calculated based on its importance to the target task classification, and is used as the weight of each location feature. The weighted average of all location latent vector representations is calculated as the perceived trajectory feature; after passing through several fully connected layers, the final trajectory vector representation is obtained based on the trajectory features. Specifically, Figure 4 shown.

[0051] 2.3 Abnormal trajectory detection based on scene rules

[0052] Step 3) For each user, we build a classifier to detect the user's abnormal trajectory. We use the user's trajectory representation and manual rules for classification, and we choose softmax to perform binary classification of abnormal trajectories.

[0053] The following is a detailed description of the three processes of trajectory construction, trajectory representation and abnormal trajectory detection:

[0054] First, in the process of trajectory construction in step 1), the trajectory data needs to be defined. This paper assumes that the trajectory data are in the following format: the unique identifiers of all users involved in the classification dataset can form a set U. For each user u in U i , the trajectory data can be represented as a spatiotemporal sequence T i , sequence T i Each element in contains a time point k and a longitude and latitude information. In mobile Internet trajectory data, the time interval between adjacent elements in the sequence may be measured in hours. The trajectory data is complete at each time point, that is, at each time point k, for each user in U, there is corresponding longitude and latitude information in their respective trajectory sequences.

[0055] Next, in the process of trajectory representation in step 2), the trajectory is encoded using an LSTM sequence based on the temporal characteristics of the trajectory data. First, the trajectory of each individual is modeled as a temporal sequence, and then the position information at each moment is input into the LSTM unit. Since the trajectory covers a long time and has different sampling frequencies, this method first preprocesses the trajectory data, and then randomly extracts samples in units of days from the preprocessed trajectory data as the classification sample set.

[0056] The trajectories extracted by this method are all fixed-length trajectories. For user i, for the trajectory sequence T iThe trajectory point at time k in the graph is represented by a two-dimensional vector To represent, the dimensions of the two-dimensional vector are the longitude and latitude of the trajectory point. Set an LSTM sequence with the same length as the trajectory, and input the trajectory points in sequence. The output supervision data of each LSTM unit is the vector of the next trajectory point. represents a trajectory sequence of length n, where represents the trajectory point of user i in the kth time slice.

[0057] For T i Each point in Both use two-dimensional vectors As the representation vector of the point, obtain the time series And in order Input into the kth LSTM unit. For the kth LSTM unit, its supervision data is

[0058] The internal iteration formula of LSTM is as follows:

[0059] Forget gate part:

[0060]

[0061] m k =c k-1 ⊙f k

[0062] Among them, U f and W f is the weight matrix of the forget gate, σ is the sigmoid function, f k is the output of the forget gate, c k-1 is the unit state at the previous moment, and ⊙ is the dot product operation.

[0063] Input gate part:

[0064]

[0065] j k =g k ⊙n k

[0066] c k =j k +m k

[0067] Among them, U i' and W i' is the weight matrix of the input gate, σ is the sigmoid function, g k Indicates the current input unit state, jk Indicates that the current input cell state is element-wise multiplied by the input gate n k , c k Indicates the new cell state.

[0068] Output gate part:

[0069]

[0070] Among them, U o and W o is the weight matrix of the input gate, σ is the sigmoid function, o k is the value of the output gate, is the current output value.

[0071] Using the above method, a pre-trained LSTM network is obtained, and then the trajectory segment to be encoded is input into the LSTM network according to the above method. Then the Attention mechanism is used to fuse the position latent vectors at each moment to obtain the final trajectory representation. In the attention model, the attention score of each position feature is calculated according to its importance to the target task classification, and it is used as the weight of each position feature. The weighted average of all position latent vector representations is calculated as the perceived trajectory feature.

[0072] The Attention iteration formula is as follows:

[0073]

[0074] Among them, W w is the weight matrix of Attention, b w is the bias, α ik is the weight of each position feature, and then normalizes it to get the trajectory feature representation

[0075] The trajectory encoding used in this method is the hidden state vector output by the Attention layer. In addition, in order to obtain deeper information, the expansion dimension should be set in actual operation.

[0076] Finally, in step 3) abnormal trajectory detection, this method uses the trajectory representation vector and the manually constructed regular features to concatenate for classification, where the regular feature vector is represented by a word2vec vector. The manually constructed regular features include:

[0077] ①Entering and exiting specific provinces and cities

[0078] ② Characteristics of the location during working hours and at night and early morning

[0079] ③ Exclude regular places such as "hospitals" and "shopping malls"

[0080] ④Exclude the situation where the person appears in a distant location during special times such as holidays

[0081] ⑤ The travel route is different from the regular route (for example, deliberately taking a long detour)

[0082] ⑥ The longitude and latitude of the previous and next positions are very different in a short period of time

[0083] Use a set of data to train a classifier, pass the vector through a softmax layer with an output dimension of 2, and the supervision data is a one-hot vector representing the trajectory category. The output is the probability that the trajectory belongs to the normal category or the abnormal category. After obtaining the output result, take the category with the highest probability as the output category of this classifier.

[0084] 3.1 Data Sampling

[0085] In the data sampling step, according to the time slice selected in the preprocessing stage and the actual data situation, select the appropriate period as the trajectory length. Segment the trajectory data according to the period, and sample the trajectory segment as the basic unit. When sampling, group them according to the same time period to avoid the difference in trajectories caused by different objective time affecting the classification results.

[0086] This section takes the group behavior analysis business data as an example to describe the sampling strategy in detail. In the preprocessing stage, the time slice determined by the data is 1 hour. According to the characteristics of the data, the daily action trajectory of the group has a certain periodicity, so the user trajectory is segmented using days as the period. 90 time periods are randomly selected from the segmented data. For each user in the data, the trajectory segments corresponding to the above 90 time periods are found, and the data are grouped according to absolute time. Each group contains one of the trajectories of all users, and the absolute time of the trajectories in the same group is the same. Simple random sampling is performed on the 90 groups of data after grouping, and 9 groups of data are extracted for the training data construction stage described in the following section.

[0087] 3.2 Training Data Construction

[0088] This step constructs training data based on the multiple sets of trajectory data obtained in the data sampling step. For the same user, this method uses the multiple trajectory codes of the user to obtain multiple representation codes of the user. This process is performed for all users to obtain multiple sets of representation codes.

[0089] Each set of data obtained in the above steps contains the representation codes of all users. The data is divided into training sets and test sets based on users, that is, in each set of data, the representation vectors of the training group users are used as the training set, and the representation vectors of the test group users are used as the test set. After each set of data is divided according to this division, multiple classifiers are trained using multiple sets of data, and the test set is classified using the above classifiers. For each test group user, a set of classification results is obtained.

[0090] 3.3 Experimental Verification

[0091] This study intends to use the public volunteer dataset Geolife as the dataset. This GPS trajectory dataset is the trajectory of 178 users collected in the Geolife project (Microsoft Research Asia) over a period of four years (April 2007 to October 2011). The GPS trajectory of this dataset is represented by a sequence of timestamped points, each of which contains latitude, longitude, and altitude information. The dataset contains 17,621 trajectories with a total distance of 1,251,654 kilometers and a total duration of 48,203 hours. All the above data have been preprocessed.

[0092] As mentioned above, due to the large time span of the trajectory, this experiment adopts the method described in 3.1 to sample the trajectory data, and the number of sample groups is 9, that is, a total of 9 days of trajectory data are sampled. The above users have no missing data in the 9 time periods sampled.

[0093] 3.3.1 Evaluation criteria

[0094] This study is a two-class classification problem. From the experimental data, we can see that the data set used in this paper is relatively balanced, so the classification accuracy and F1 value are used as evaluation criteria.

[0095]

[0096] Among them, TP, TN, FP, and FN are the numbers of true positive examples, true negative examples, false positive examples, and false negative examples, respectively.

[0097] 3.3.2 Feature Representation Comparison

[0098] This experiment only set up a control experiment on the trajectory encoding method in different representation methods of the same category. LSTM+Attention refers to the trajectory representation method used in this study, as described in step 2); Manual Features refers to the trajectory representation constructed using manual rule features, and LA+MF refers to the trajectory representation method in this study plus the assistance of manual rule features.

[0099] 3.3.3 Comparison of Classification Models

[0100] This method uses Softmax classification to classify users. In order to obtain the best classification results, this experiment uses another shallow classification model, support vector machine (SVM), for comparative experiments. Figure 5 As shown in the figure. SVM is one of the most commonly used and effective classifiers, especially in small sample sets. The core of this method is the idea of ​​maximizing the classification margin. The support vector plays a decisive role in the classification decision, which makes the algorithm simple to calculate and insensitive to the addition and deletion of non-support vectors, and has good robustness.

[0101] 3.4 Summary and Analysis

[0102] The method used in this paper has achieved better results in the comparison of representation methods and classification model dimensions. In the comparison of representation models, the overall effect of using deep encoding to represent trajectory features is better than the indicator value when using manual feature representation. In the comparison of classification models, the classification effect of using the Softmax model is significantly better than that of the SVM model for each representation method involved in the experiment.

[0103] This paper proposes an abnormal trajectory detection method that integrates LSTM and scene rule knowledge. It uses the method of training a binary classifier to classify the user's trajectory features to determine whether it is abnormal, reducing the impact of data randomness, thereby improving the accuracy of abnormal trajectory detection. In this paper, we first introduce the background technology of the method, and then elaborate on the invention content, specific implementation technology, etc., and finally summarize and analyze the abnormal trajectory detection method.

[0104] The above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. A person skilled in the art may modify or make equivalent substitutions for the technical solutions of the present invention without departing from the spirit and scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. An abnormal trajectory detection method integrating LSTM and scene rule knowledge, the steps of which include: 1) constructing a time series according to the target trajectory; wherein, constructing a time series according to the target trajectory includes: The target trajectory is represented as a spatiotemporal sequence T, where each element in the spatiotemporal sequence T includes: a time point k and a longitude and latitude information (x (k) ,y (k) ); Calculate the longitude and latitude information (x (k) ,y (k) ) The corresponding two-dimensional vector v k ; Based on the time point k, the two-dimensional vector v k Sort and get the time series; 2) Inputting the time series into the LSTM network, obtaining the position latent vector of the target trajectory at each moment, and performing an attention mechanism calculation based on each position latent vector to obtain the target trajectory representation vector; wherein, performing an attention mechanism calculation based on each position latent vector to obtain the target trajectory representation vector includes: Based on the importance of each position latent vector to the target task classification, the weight of the position latent vector is obtained; The target trajectory representation vector is obtained by performing weighted average calculation based on the weights of the latent vectors at each position; 3) splicing the target trajectory representation vector and the vector of the set scene rule, and classifying the spliced ​​vector to obtain an abnormal trajectory detection result; wherein, classifying the spliced ​​vector to obtain the abnormal trajectory detection result includes: The concatenated vector is passed through a softmax layer with an output dimension of 2 to obtain the probability that the target trajectory belongs to the normal category or the abnormal category; The category with the highest probability is taken as the abnormal trajectory detection result.

2. The method according to claim 1, characterized in that When training the LSTM network, the output supervision data of each LSTM unit is the vector of the next trajectory point.

3. The method according to claim 1, characterized in that The setting scene rules include: entering and exiting specific provinces and cities, location conditions during working hours, location conditions at night and early morning, excluding regular locations, excluding situations where the location is far away during special times, and the difference in longitude and latitude between the previous and next locations within a short period of time is greater than at least one of the set values.

4. The method according to claim 1, characterized in that Methods for obtaining vectors for setting scene rules include: using a word2vec method.

5. The method according to claim 1, characterized in that When training the softmax layer, one-hot vectors representing trajectory categories are used as supervisory data.

6. A storage medium storing a computer program, wherein: The computer program is configured to execute the method according to any one of claims 1 to 5 when executed.

7. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 5.

Images