An abnormal behavior detection method based on time-series normal behavior persistent memory

Abstract

The application discloses an abnormal behavior detection method based on time sequence normal behavior continuous memory, a convolutional neural network model based on a convolutional autoencoder, and a neural network model comprising an encoder, a memory module and a decoder, and comprises the following steps: S1. packing and splitting a video, taking every five continuous pictures as a sample; S2. during training, inputting four pictures continuous in time into the encoder, comparing the output image with the fifth picture, constructing a loss function, and calculating a reconstruction error; S3. optimizing the loss function by using a stochastic gradient descent method to obtain a trained convolutional neural network model; and S4. during testing, setting a threshold to judge whether each picture is abnormal, so that the memory module is prevented from being updated by the features of abnormal behaviors during testing.

Description

Technical Field

[0001] This invention relates to the field of basic research on abnormal behavior detection in videos, and proposes an unsupervised learning method for abnormal behavior detection based on the continuous memory of normal behavior over time. Background Technology

[0002] Anomalies are a major concern in the field of public safety and have long been a hot topic in computer vision and image processing. Due to the numerous types of anomalies, their variability depending on the scene and target, and the difficulty in establishing a unified definition, the definition of anomalies primarily considers the surrounding environment. Examples include: cars driving on sidewalks, fights in public places, the protection of movable and immovable cultural relics in historical sites, the preservation of ancient tombs, and individuals disrupting the regular movement patterns within a crowd. Anomalies often accompany normal activities, making the classification of normal and anomalies crucial.

[0003] Anomaly detection is a task that detects samples that are rarely encountered or not present in a given training set. It uses the training data as its core to find samples that are dissimilar to the training samples. The problem can be summarized as follows: Given a training set x1, x2, ... x... n The present invention aims to find a function to detect whether the input x belongs to the same class as the data in the training set.

[0004] Based on the given training set, current research classifies samples into three categories: (1) Supervised classification, where each sample in the training set has a positive or negative label (positive for normal behavior and negative for abnormal behavior). In some cases, abnormality has a good definition. In this case, training a binary classifier is a straightforward idea. Although convolutional neural network-based models perform well, the deep model does not have good universality or broad applicability for abnormal samples due to the large gap between the number of normal and abnormal samples in the training data. Therefore, due to the diversity of abnormal samples, this method can only be applied to a limited number of practical problems. (2) Semi-supervised classification, where the training set contains a large amount of unlabeled data and some labeled data, and the network is trained based on a large amount of rich unlabeled data and a small number of normal and abnormal models. (3) Unsupervised classification, where the training set is entirely unlabeled data. Usually, abnormal samples appear very rarely in the training set, and it is very time-consuming and laborious to identify abnormal behavior, especially for problems where abnormal behavior is not clearly defined. In unsupervised learning methods, outliers can be detected through their inherent features.

[0005] In practice, positive training sets are readily available, but negative training sets are often difficult to obtain accurately because such negative samples are highly diverse in real life and cannot be exhaustively represented. Furthermore, in many cases, it's impossible to collect a sufficient number of negative samples due to their low probability of occurrence in real life. For example, credit card transactions are mostly normal transactions, while cases of fraudulent use are extremely rare, if not nonexistent. Therefore, anomaly detection cannot be simplified to a binary classification problem. Moreover, defining what constitutes an anomaly often requires industry experts and varies from person to person. Thus, unsupervised methods are more suitable for anomaly detection in public place video surveillance.

[0006] Some existing methods, both domestically and internationally, have certain drawbacks. The fundamental assumption of autoencoders based on convolutional neural networks (CNNs) is that anomalous samples will not be reconstructed well. However, since there are no anomalous samples in the training data, the reconstruction results of anomalous behavior cannot be predicted; that is, it cannot be mathematically determined that anomalous samples will definitely not be reconstructed perfectly. Moreover, CNNs have an extremely strong feature extraction capability, so when most of the anomalous sample image is normal, the reconstruction error of this image is very small. To address the problem of the excessive representational power of CNNs, prediction methods have been proposed to minimize the gap between the predicted future frame and the ground truth. However, this method only extracts general behavioral features rather than features of normal behavior and does not directly detect anomalous behavior. Furthermore, Deep SVDD proposes a single-classification method that only identifies normal samples and considers others as abnormal, but the drawback of this method is that it does not take into account the diversity of normal behavior. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and to provide an unsupervised learning method for detecting abnormal behavior based on the continuous memory of normal behavior in time series, addressing the difficulties in defining the concept of abnormal behavior in videos, the inability to exhaustively enumerate such behavior, and the scarcity and lack of annotation of negative samples.

[0008] The objective of this invention is achieved through the following technical solution:

[0009] An abnormal behavior detection method based on the persistent memory of normal temporal behavior, using a convolutional neural network model based on a convolutional autoencoder, the neural network model including an encoder, a memory module, and a decoder, includes the following steps:

[0010] S1. Pack and split the video, taking every five consecutive frames as a sample;

[0011] S2. During training, four consecutive frames of images are input into the encoder, the output image is compared with the fifth frame image, a loss function is constructed, and the reconstruction error is calculated.

[0012] S3. Optimize the loss function using stochastic gradient descent to obtain a trained convolutional neural network model;

[0013] S4. During testing, a threshold is set to determine whether each image is abnormal, thereby preventing the memory module from being updated by the features of abnormal behavior during testing.

[0014] Furthermore, the encoder and decoder together constitute an autoencoder in the U-net structure for feature extraction, omitting the last batch normalization layer and ReLU activation function layer in the encoder; using I... t and q t These represent the images in the video at time t and their corresponding features, respectively; the encoder will... t As input, the output q t The size is H×W×C; H, W, and C refer to the height, width, and number of channels, respectively; using normal feature vectors q t Each component in the matrix has a size of 1×1C, that is:

[0015] Where K = H × W

[0016] normal feature vectors The data is fed into the memory module, where the normal feature vectors are processed to obtain... Finally and The images are stitched together and fed into the decoder to obtain the reconstructed image, denoted as [image name missing].

[0017] Furthermore, the memory module includes M memory vectors to represent the diversity of normal behavior, denoted by p. m ∈R C , m = 1, ..., M represents the memory vector; through and p m inner product It represents the degree of similarity between two vectors. p m Transpose of p, calculate p pairwise. m and Taking the exponent of the inner product, we obtain the following M×K two-dimensional matrix, and then normalize the columns of this matrix using the softmax function:

[0018]

[0019] The element w in the k-th row and m-th column of the matrix t (k,m) is calculated using the following formula:

[0020] Each normal feature vector Corresponding to a feature The definition is as follows:

[0021]

[0022] Create K new vectors Combining them in order gives q t corresponding vector q along the C dimension of the H, W, and C channels of the image t and They are connected together and fed into the decoder, making the image output by the decoder closer to the normal sample.

[0023] Furthermore, based on the idea of ​​clustering, M memory vectors are selected. Specifically, before iterating using stochastic gradient descent, the M memory vectors are initialized. The final M memory vectors are the cluster centers after clustering all normal behavioral features, and it is ensured that the memory vectors are updated once after each iteration of the gradient descent method.

[0024] Furthermore, the M memory vectors are initialized as follows: all M vectors are set to 0. Using a Gaussian mixture model, the resulting M memory vectors are the mean of each Gaussian distribution.

[0025] Furthermore, the loss function includes a reconstruction loss function, a feature compaction loss function, and a feature dispersion loss function.

[0026] Furthermore, the memory vectors are updated simultaneously during the training and testing of the convolutional neural network model.

[0027] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the unsupervised learning abnormal behavior detection method based on the continuous memory of time-series normal behavior.

[0028] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the unsupervised learning abnormal behavior detection method based on the continuous memory of time-series normal behavior.

[0029] Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

[0030] 1. This invention takes into account the impact of the diversity of normal behavior and assumes that a single typical feature cannot fully represent all normal behavior features. Based on this assumption, it proposes using a memory module to store the features of all normal behaviors for abnormal behavior detection. This memory module is placed in the feature extraction layer, thereby reconstructing the image using normal behavior features, which can, to some extent, compensate for the shortcomings of the above methods.

[0031] 2. This invention uses memory modules to record features of normal behavior, diversifies the vectors within the memory modules by utilizing feature compaction and dispersion loss functions, and updates the memory vectors using a Gaussian mixture clustering algorithm, resulting in better accuracy and faster runtime for anomaly detection. On the internationally recognized algorithm detection dataset UCSD Ped2, the anomaly detection rate reaches 96.3%, and on the more complex CUHK Avenue dataset, it reaches 86.1%. Compared to current mainstream algorithms, this method runs faster (Unmasking: 20fps, StackRNN: 50fps, Frame-Pred: 25fps, MemAE: 45fps).

[0032] 3. To reduce the differences between normal features of the same class, this invention proposes a feature compaction loss function. Optimizing this function makes the features extracted from normal samples as close as possible to the most similar memory vector in the memory module. However, simply doing this will result in all vectors in the memory module being very similar, and simultaneously, the features of all normal samples will also be very similar. To solve this problem, this invention proposes a feature dispersion loss function. Optimizing this function will make the distance between each normal feature and its most similar memory vector small, while simultaneously increasing the distance between it and its second most similar memory vector.

[0033] 4. This invention also applies Gaussian mixture clustering to obtain memory vectors. The following techniques are employed during the clustering process: During prediction, to prevent the memory module from recording the features of anomalous samples, a score representation for measuring anomalous behavior is pre-set, and a threshold is set. Images with scores exceeding this threshold will not participate in the clustering process; while images with scores below the threshold are temporarily considered normal samples and can participate in the iterative process of the memory module. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the model structure of the present invention; Detailed Implementation

[0035] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not intended to limit the present invention.

[0036] This invention employs a prediction method based on convolutional autoencoders (CAEs). The CAE-based convolutional neural network model is divided into three parts: an encoder, a memory module, and a decoder. The encoder and decoder together constitute the autoencoder of the U-net structure. The encoder is responsible for extracting features; then, it compares the extracted features with the features in the memory module, finds the most similar memory feature, and updates the memory feature using the extracted features; finally, it combines the extracted features with the most similar memory feature and feeds them into the decoder to complete the reconstruction. Specifically, the encoder starts from the t-th image I... t Extracting feature q t Let K (K = H × W) queries of size 1*1*C be features q. t K components M items of size 1*1*C are represented by M memory vectors p. m (m=1,....M), constructed through linear combinations of memory vectors and put and q t The images are then stitched together; finally, the decoder takes the modified feature vectors as input and outputs the reconstructed image. See Figure 1 .

[0037] The specific implementation steps are as follows:

[0038] Step 1: Pack and split the video to be identified, and use the resulting data as input. Take every five consecutive frames as a sample.

[0039] Step 2: Input four consecutive frames of images into a convolutional autoencoder for prediction, compare them with the fifth frame, construct a loss function, and calculate the reconstruction error. Details are as follows:

[0040] Because the U-Net network structure performs exceptionally well in medical image reconstruction tasks, this embodiment uses the U-Net structure as an autoencoder for feature extraction. The ReLU function takes the form of... This embodiment removes the last batch normalization layer and ReLU activation function layer in the encoder to preserve the diversity of normal features (because the ReLU function turns the negative parts of the features into 0). This embodiment uses I... t and q t Let I represent the image in the video at time t and its corresponding feature, respectively. The encoder then... t As input, the output q t The size is H×W×C (where H, W, and C refer to height, width, and number of channels). Using normal feature vectors... q t Each component in the matrix has a size of 1×1×C, that is:

[0041] Where K = H × W

[0042] Then put these The data is fed into the memory module, where normal features are processed to obtain... Finally and The images are stitched together and fed into the decoder to obtain the reconstructed image, denoted as [image name missing].

[0043] Considering the diversity of normal samples, this embodiment argues that a single feature of normal behavior cannot accurately represent the diversity of normal samples; that is, the feature space of normal samples contains multiple prototype vectors. To achieve this, this embodiment constructs a memory module, where vectors correspond to features of different normal behaviors. Using vectors from the memory module to represent images in a video can weaken the representational power of the convolutional neural network.

[0044] The memory module contains M memory vectors to store features of various normal behaviors. This invention uses p... m ∈R C These memory vectors are represented by (m = 1, ..., M). and p m inner product (in p m The transpose of a vector can represent the similarity between two vectors to some extent. This invention calculates p pairwise. m and Taking the exponent of the inner product, we obtain the following M×K two-dimensional matrix, and then normalize the columns of this matrix using the soft max function:

[0045]

[0046] The element w in the k-th row and m-th column of the matrix t (k,m) can be calculated using the following formula:

[0047] For each vector Corresponding to a feature The definition is as follows:

[0048]

[0049] Therefore, by utilizing the diversity of normal behavioral characteristics, we can address each vector... This invention uses a linear combination of memory vectors in the memory module, namely... Let's represent it. Then we'll use these K new vectors. Combining them in order gives q t corresponding vector Next, this invention moves q along the C dimension of the three channels (H, W, C) of the image. t and When these images are concatenated and fed into the decoder, the output image becomes closer to a normal sample, thus weakening the convolutional neural network model's ability to represent abnormal samples.

[0050] The Gaussian mixture model is a linear combination of Gaussian models, noted as follows:

[0051]

[0052] Where, α k It is the coefficient, α k ≥0, It is a Gaussian distribution density. This is called the kth sub-model.

[0053] To address the question of how to select the M memory vectors, a clustering approach is proposed (classifying samples without class labels but with known class numbers): before iterating using stochastic gradient descent, the M memory vectors are initialized by setting them all to 0. Since memory vectors summarize normal behavioral characteristics and have an average meaning, a Gaussian mixture model is considered; the final M memory vectors are the means of each Gaussian distribution. Therefore, the memory vectors are updated after each iteration of the gradient descent method, specifically as follows: for each memory vector p... m This invention seeks the feature vector that is closest to it, i.e., all features that satisfy the condition. The value of k, note that there may be multiple Corresponding to a p m Therefore, U(t,m) represents the set of all k values ​​that satisfy the above conditions, i.e.:

[0054]

[0055] Assuming the feature vectors follow a Gaussian mixture distribution, this means all feature vectors are clustered into M classes, and the feature vectors of each class follow a Gaussian distribution. These M memory vectors then become the means of these M Gaussian distributions. In summary, this embodiment uses samples to estimate the means of these M Gaussian distributions (i.e., the model parameters) and then updates the memory vectors.

[0056] Since calculating the m-th Gaussian distribution right responsiveness This involves the Gaussian density function, whose complex form leads to increased computational complexity and excessive time consumption. Therefore, we consider simplifying its expression: Considering... The original meaning

[0057]

[0058] That is, given a sample, the k-th sample Belongs to the m-th Gaussian distribution The probability of, and thus can be considered as and p m similarity w t (k,m), and This aligns with probabilistic principles. Therefore, the EM algorithm based on the simplified Gaussian mixture model parameter estimation uses the following formula to estimate p. m Perform iterations:

[0059]

[0060] Where v t (k,m) represents w t Normalization of (k,m), i.e.

[0061]

[0062]

[0063] The purpose of the final normalization step is to prevent gradient vanishing during backpropagation.

[0064] To enable the memory vector to record more diverse features of normal behavior, this embodiment plans to update the memory vector simultaneously during training and testing. However, since the test set contains both normal and abnormal samples, this invention plans to design a weighted score to prevent the memory vector from recording features of abnormal behavior. For a given frame image I... t The present invention uses I t and The weighted reconstruction loss between them is used as the score ε t :

[0065]

[0066] Where the weight W ij The definition is as follows:

[0067]

[0068] i,j represent spatial coordinates. When the score ε t When the value is greater than a predefined threshold γ, this invention considers I to be... tIt is an anomalous sample and therefore should not be used to update the memory vector. This is because anomalous behavior generally only occurs in some localized regions. ij This embodiment pays more attention to reconstruction error. A large region, where (i,j) are the coordinates of each pixel in the image.

[0069] The loss function L consists of three parts: the reconstruction loss function L rec Feature compact loss function L compact and characteristic dispersion loss function L separate The specific form is as follows:

[0070] L = L rec +ω c ×L compact +ω s ×L separate

[0071] Where ω c and ω s These are weighting coefficients used to balance the importance of the three parts of the function.

[0072] The reconstruction loss function is: Minimize the decoder output And the original image I t The feature compaction loss function is defined as follows:

[0073]

[0074]

[0075] Where T is the number of frames in the video, p p Let p be the p-th memory vector.

[0076] The feature dispersion loss function is as follows:

[0077]

[0078]

[0079] α is a coefficient;

[0080] Step 3:

[0081] The loss function is optimized using stochastic gradient descent to obtain a trained network.

[0082] Step 4:

[0083] A threshold is set to determine whether each image is abnormal, thereby preventing the memory module from being updated with features of abnormal behavior during testing. Specific technical details are as follows:

[0084] When testing the test set, this embodiment needs to quantify the normality or abnormality of a single image frame for numerical comparison. Since the vectors in the memory module record features of normal behavior, it is reasonable to believe that the features encoded from normal samples are very similar to the memory vectors. The distance between each feature vector and its most similar memory vector is calculated, defined as follows:

[0085]

[0086] This embodiment should also consider the approximation of the reconstructed image, because images containing anomalous behavior generally cannot be reconstructed well. The following function is used to measure the quality of the reconstruction:

[0087]

[0088] Here, N is the number of pixels in a frame of an image. If I t If it contains abnormal behavior, then The value of I will be very small; if I t If there is no abnormal behavior, then The value will be very large. Remember to divide it into S. t From a probability perspective, S t It should represent I t Let S be the probability of a normal sample. t It should be normalized to the interval [0,1]. S t The definition is as follows:

[0089]

[0090] in

[0091]

[0092]

[0093] p represents all memory vectors p m The set ω∈[0,1] is a real number weight used to balance D(q) t ,p) and The impact on the score; the function g adjusts S t Within the range [0,1]. Therefore, when the input image is a normal sample, S... t S is close to 1; when the input image is an outlier, S t It is close to 0. Therefore, it can be determined by the score S. t This is used to judge whether the input image is abnormal. Specifically, for this experimental dataset, a threshold τ = 0.5 is selected. When S t When S ≥ 0.5, the input image is determined to be a normal sample; when St When the threshold τ is less than 0.5, the input image is considered an anomalous sample. For other datasets or scenarios, the threshold τ needs to be determined during testing to maximize the model's accuracy.

[0094] Specifically, the implementation process for inputting specific data is as follows:

[0095] Dataset Selection. This invention was tested on two anomalous behavior detection datasets. The first is the UCSDPed2 dataset, containing 16 training videos and 12 test videos (anomalous behaviors include cycling or driving on a pedestrian crossing). The second is the CUHK Avenue dataset, containing 16 training videos and 21 test videos (anomalous behaviors include running and throwing objects).

[0096] Parameter settings. In this embodiment, the size of each image is converted to 256*256, and the grayscale values ​​of the pixels are normalized to the interval [-1, 1]. The height, width, and number of channels of the feature vector are set to 32, 32, and 512 respectively; the number of memory vectors is set to 10. For each dataset, this invention sets the batch size to 4 and the number of training epochs to 30. ω is set... c =0.1,ω s =0.1, ω=0.6, α=1, γ=0.015. All models were trained end-to-end using PyTorch. The training time on the training dataset UCSD Ped2, CUHK Avenue was approximately 30 minutes and 6 hours, respectively. The GPU was an NVIDIA GeForce RTX.

[0097] Experimental Results. This embodiment uses AUC to represent the accuracy of the convolutional neural network model on the test set, and compares it with current mainstream methods. The results are shown in Table 1. This model takes an average of 0.014 seconds to detect a 256×256 image in the UCSD Ped2 dataset, achieving a processing speed of 70fps. Compared with current mainstream algorithms, this algorithm is faster (Unmasking: 20fps, StackRNN: 50fps, Frame-Pred: 25fps, MemAE: 45fps). Furthermore, this model takes an average of 0.02 seconds to detect a 256×256 image in the CUHK Avenue dataset, achieving a processing speed of 49fps. Algorithm comparisons are as follows.

[0098] Table 1. Comparison of accuracy of mainstream models on various datasets

[0099]

[0100] The embodiments of this application also provide a specific implementation of an electronic device capable of implementing all steps in the abnormal behavior detection method based on the continuous memory of time-series normal behavior in the above embodiments. The electronic device specifically includes the following:

[0101] Processor, memory, communications interface, and bus;

[0102] The processor, memory, and communication interface communicate with each other via a bus; the communication interface is used to realize information transmission between server-side devices, metering devices, and user-side devices.

[0103] The processor is used to call the computer program in the memory. When the processor executes the computer program, it implements all the steps in the abnormal behavior detection method based on the continuous memory of time-series normal behavior in the above embodiments.

[0104] Embodiments of this application also provide a computer-readable storage medium capable of implementing all steps of the abnormal behavior detection method based on the continuous memory of time-series normal behavior in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the abnormal behavior detection method based on the continuous memory of time-series normal behavior in the above embodiments.

[0105] Finally, it should be noted that the above examples are only used to illustrate the calculation process of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing examples, those skilled in the art should understand that modifications can still be made to the calculation process described in the foregoing examples, or equivalent substitutions can be made to some of the parameters. Such modifications or substitutions do not cause the essence of the corresponding calculation method to deviate from the spirit and scope of the calculation method of the present invention.

[0106] This invention is not limited to the embodiments described above. The above description of specific embodiments is intended to illustrate and explain the technical solutions of this invention. The specific embodiments described above are merely illustrative and not restrictive. Without departing from the spirit and scope of the claims, those skilled in the art can make many specific modifications based on the teachings of this invention, and these modifications all fall within the scope of protection of this invention.

Claims

1. A method for detecting abnormal behavior based on the continuous memory of normal behavior over time, characterized in that, A convolutional neural network model based on a convolutional autoencoder, comprising an encoder, a memory module, and a decoder, includes the following steps: S1. Pack and split the video, taking every five consecutive frames as a sample; S2. During training, four consecutive frames of images are input into the encoder, the output image is compared with the fifth frame image, a loss function is constructed, and the reconstruction error is calculated. S3. Optimize the loss function using stochastic gradient descent to obtain a trained convolutional neural network model; S4. During testing, a threshold is set to determine whether each image is abnormal, thereby preventing the memory module from being updated by features of abnormal behavior during testing; threshold. When measuring scores for abnormal behavior When the input image is considered a normal sample, it is determined that the input image is normal. When this happens, the input image is determined to be an abnormal sample.

2. The unsupervised learning method for detecting abnormal behavior based on the continuous memory of temporally normal behavior according to claim 1, characterized in that, The encoder and decoder together constitute the autoencoder in the U-net structure for feature extraction, omitting the batch normalization layer and ReLU activation function layer in the last group of the encoder; using and These represent the images in the video at time t and their corresponding features, respectively; the encoder will... As input, output The size is H, W, and C refer to height, width, and number of channels, respectively; using normal feature vectors. express Each of the sizes is The components, namely: ( , in ; normal feature vectors The data is fed into the memory module, where the normal feature vectors are processed to obtain... Finally, and The images are stitched together and fed into the decoder to obtain the reconstructed image, denoted as [image name missing]. .

3. The unsupervised learning method for detecting abnormal behavior based on the continuous memory of temporally normal behavior according to claim 2, characterized in that, The memory module includes M memory vectors to represent the diversity of normal behavior, using , Represents a memory vector; through and inner product * It represents the degree of similarity between two vectors. p m Transpose of the product, calculate pairwise. and Taking the exponent of the inner product, we get the following: A two-dimensional matrix is ​​obtained, and the columns of this matrix are normalized using the soft max function: ； The element in the k-th row and m-th column of the matrix Calculated using the following formula: ; Each normal feature vector Corresponding to a feature , k=1...K, defined as follows: ； Create K new vectors (k=1...K) are arranged in order to obtain the result. corresponding vector Along the H, W, and C channels of the image, the C dimension will be... and They are connected together and fed into the decoder, making the image output by the decoder closer to the normal sample.

4. The unsupervised learning method for detecting abnormal behavior based on the continuous memory of temporally normal behavior according to claim 3, characterized in that, Based on the idea of ​​clustering, M memory vectors are selected. Specifically, before iterating using stochastic gradient descent, the M memory vectors are initialized. The final M memory vectors are the cluster centers after clustering all normal behavioral features, and the memory vectors are updated once after each iteration of the gradient descent method.

5. The unsupervised learning abnormal behavior detection method based on the continuous memory of temporally normal behavior according to claim 4, characterized in that, The M memory vectors are initialized as follows: all M vectors are set to 0. Using a Gaussian mixture model, the resulting M memory vectors are the mean of each Gaussian distribution.

6. The unsupervised learning method for detecting abnormal behavior based on the continuous memory of temporally normal behavior according to claim 1, characterized in that, The loss function includes a reconstruction loss function, a feature compaction loss function, and a feature dispersion loss function.

7. The unsupervised learning abnormal behavior detection method based on the continuous memory of temporally normal behavior according to claim 4, characterized in that, The memory vector is updated simultaneously during the training and testing of the convolutional neural network model.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the unsupervised learning abnormal behavior detection method based on the continuous memory of temporally normal behavior as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the unsupervised learning method for detecting abnormal behavior based on the continuous memory of temporally normal behavior as described in any one of claims 1 to 7.

Images