City area event classification method and device, abnormal event detection method and device

Abstract

Embodiments of the present disclosure disclose a municipal area event classification method and device, and an abnormal event detection method and device. A specific implementation of the classification method comprises: generating event input data according to target event data; inputting the event input data into a pre-trained classification model to obtain a predicted event type of the target event data, wherein the classification model is used to predict the classification type of the input event; and selecting a candidate type from a candidate type set as the event type of the target event data based on the similarity between the predicted event type and each candidate type in the candidate type set. The implementation is related to municipal area management technology, and can determine the event type of the event according to the similarity between the predicted event type and each candidate type. This can improve the accuracy of event type determination and is conducive to the accuracy of subsequent abnormal event detection, thereby reducing the number of invalid warnings (false alarms).

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of urban management technology, specifically to urban event classification methods and apparatus, and abnormal event detection methods and apparatus. Background Technology

[0002] In the urban governance system, high-incidence events are typically identified by monitoring and analyzing changes in the number of various types of incidents. This facilitates tailored policy implementation and effectively improves the overall governance of the city.

[0003] The information disclosed in this background section is only intended to enhance the understanding of the background of the inventive concept, and therefore may contain information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0005] Some embodiments of this disclosure provide a method for classifying urban events, a device for classifying urban events, a method for detecting abnormal events, a device for detecting abnormal events, an electronic device, a computer-readable medium, and a computer program product to solve one or more of the technical problems mentioned in the background section above.

[0006] In a first aspect, some embodiments of this disclosure provide a method for classifying urban events, including: generating event input data based on target event data; inputting the event input data into a pre-trained classification model to obtain a predicted event type of the target event data, wherein the classification model is used to predict the classification type of the input event; and selecting a candidate type from the candidate type set as the event type of the target event data based on the similarity between each candidate type in the candidate type set and the predicted event type.

[0007] In some embodiments, generating event input data based on target event data includes: performing word segmentation on the target event data to obtain a word set of the target event data; and generating event input data based on the word set.

[0008] In some embodiments, generating event input data based on a word set includes: determining the vector representation of each word in the word set, and using the vector representation of each word as a row in an event representation matrix to obtain an event representation matrix as event input data.

[0009] In some embodiments, obtaining the predicted event type of the target event data includes: in response to the type representation matrix output by the classification model, determining the predicted event type of the target event data based on the values ​​of each element in the type representation matrix.

[0010] In some embodiments, determining the predicted event type of the target event data based on the values ​​of each element in the type representation matrix includes: determining the maximum value of each row element in the type representation matrix, determining the text in the corresponding preset vocabulary according to the column index number of the maximum value element, and obtaining the predicted event type of the text description; wherein, the number of columns in the type representation matrix corresponds to the length of the preset vocabulary, and the index number of each character in the preset vocabulary is related to the position of the character in the table.

[0011] In some embodiments, the method further includes: using the Jaccard coefficient to determine the similarity between each candidate type in the candidate type set and the predicted event type.

[0012] In some embodiments, the classification model is trained by: inputting the sample event representation matrix from the sample data into the classification model and outputting the predicted type representation matrix; comparing and analyzing the predicted type representation matrix with the corresponding sample type representation matrix, and adjusting the parameters in the classification model according to the comparison results to continue training the model, wherein the sample type representation matrix is ​​obtained by one-hot encoding the sample type data.

[0013] Secondly, some embodiments of this disclosure provide a city-wide event classification device, including: a data generation unit configured to generate event input data based on target event data; a type prediction unit configured to input the event input data into a pre-trained classification model to obtain a predicted event type of the target event data, wherein the classification model is used to predict the classification type of the input event; and a type selection unit configured to select a candidate type from the candidate type set based on the similarity between each candidate type in the candidate type set and the predicted event type, as the event type of the target event data.

[0014] In some embodiments, the data generation unit is further configured to perform word segmentation on the target event data to obtain a word set of the target event data; and generate event input data based on the word set.

[0015] In some embodiments, the data generation unit is further configured to determine the vector representation of each word in the word set, and to use the vector representation of each word as a row in the event representation matrix to obtain the event representation matrix as event input data.

[0016] In some embodiments, the type prediction unit is further configured to determine the predicted event type of the target event data based on the values ​​of each element in the type representation matrix in response to the type representation matrix output by the classification model.

[0017] In some embodiments, the type prediction unit is further configured to determine the maximum value of each row element in the type representation matrix, and determine the text in the corresponding preset vocabulary according to the column index number of the maximum value element, thereby obtaining the predicted event type of the text description; wherein, the number of columns in the type representation matrix corresponds to the length of the preset vocabulary, and the index number of each character in the preset vocabulary is related to the position of the character in the table.

[0018] In some embodiments, the classification apparatus further includes a similarity determination unit configured to determine the similarity between each candidate type in the candidate type set and the predicted event type using Jaccard coefficients.

[0019] In some embodiments, the classification apparatus further includes a model training unit configured to input a sample event representation matrix from the sample data into a classification model and output a predicted type representation matrix; compare and analyze the predicted type representation matrix with the corresponding sample type representation matrix; and adjust the parameters in the classification model according to the comparison result to continue training the model, wherein the sample type representation matrix is ​​obtained by one-hot encoding of the sample type data.

[0020] Thirdly, some embodiments of this disclosure provide an abnormal event detection method, including: extracting time series features based on the number of historical events of a target event type within each statistical period, wherein the target event type is determined using the city-wide event classification method described in any implementation of the first aspect above; inputting the time series features into an abnormal detection model and outputting an abnormal threshold; and detecting whether there is an abnormal event of the target event type based on the abnormal threshold.

[0021] In some embodiments, the time series features include at least one of the following: the change value of the number of events and the rate of change of the number of events within the number of statistical periods preceding the current statistical period, wherein the number of events includes at least one number; and the statistical values ​​of the number of events within the number of statistical periods preceding the current statistical period, wherein the statistical values ​​of the number of events include at least one of the following: the sum of the number of events, the mean, the median, the maximum value, the minimum value, and the variance.

[0022] In some embodiments, extracting time series features based on the amount of historical event data of the target event type within each statistical period further includes: in response to determining that a time series feature is missing for a certain statistical period, using the mean of the time series features corresponding to other statistical periods as the attribute value of the missing time series feature; and for the same time series feature in each statistical period, replacing the attribute value that is less than the mean of the time series feature with the feature mean.

[0023] Fourthly, some embodiments of this disclosure provide an abnormal event detection device, including: a feature extraction unit configured to extract time series features based on the number of historical events of a target event type within each statistical period, wherein the target event type is determined using the city-wide event classification method described in any implementation of the first aspect; a threshold determination unit configured to input the time series features into an abnormal detection model and output an abnormal threshold; and a detection unit configured to detect whether an abnormal event of the target event type exists based on the abnormal threshold.

[0024] In some embodiments, the time series features include at least one of the following: the change value of the number of events and the rate of change of the number of events within the number of statistical periods preceding the current statistical period, wherein the number of events includes at least one number; and the statistical values ​​of the number of events within the number of statistical periods preceding the current statistical period, wherein the statistical values ​​of the number of events include at least one of the following: the sum of the number of events, the mean, the median, the maximum value, the minimum value, and the variance.

[0025] In some embodiments, the feature extraction unit is further configured to, in response to determining that a time series feature for a certain statistical period is missing, use the mean of the time series features corresponding to other statistical periods as the attribute value of the missing time series feature; and for the same time series feature in each statistical period, replace the attribute value that is less than the mean of the time series feature with the feature mean.

[0026] Fifthly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the methods described in any of the implementations of the first or third aspects above.

[0027] Sixthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the implementations of the first or third aspect above.

[0028] In a seventh aspect, some embodiments of this disclosure provide a computer program product, including a computer program that, when executed by a processor, implements the method described in any of the implementations of the first or third aspect above.

[0029] The embodiments disclosed above have the following beneficial effects: the city-wide event classification methods of some embodiments of this disclosure can improve the accuracy of event type determination. Specifically, in the process of analyzing changes in the number of events, event information usually needs to include event type information. However, some city-wide events may lack event types. For some city-wide events that do have event types, the labeled event types may not be accurate. These factors all affect the accuracy of subsequent abnormal event detection.

[0030] Based on this, some embodiments of the city-wide event classification method disclosed herein first input event data into a classification model to obtain the predicted event type. Analyzing and predicting through the model improves the accuracy of type determination. Next, based on the similarity between the predicted event type and each candidate type, a candidate type can be selected from the candidate type set as the event type. The final event type is determined by further analyzing the predicted event type and candidate types, rather than directly using the model's prediction as the final event type. This helps to further improve the accuracy of type determination, thereby obtaining the required event type data. Accurate event types are beneficial for improving the accuracy of subsequent abnormal event detection. This, in turn, helps to reduce the number of abnormal event warnings and the number of invalid warnings (false warnings), thereby reducing the waste of city-wide resources (such as human resources and facility resources). Attached Figure Description

[0031] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0032] Figure 1 This is a flowchart of some embodiments of the urban event classification method disclosed herein;

[0033] Figure 2 These are schematic diagrams illustrating some application scenarios of the publicly disclosed urban event classification method;

[0034] Figure 3 This is a schematic diagram of the structure of some embodiments of the urban event classification device disclosed herein;

[0035] Figure 4A This is a flowchart of some embodiments of the abnormal event detection method disclosed herein;

[0036] Figure 4B These are schematic diagrams illustrating some application scenarios of the abnormal event detection method disclosed herein;

[0037] Figure 4C This is a data distribution diagram of some embodiments of road congestion type events;

[0038] Figure 4D This is a data distribution diagram of some embodiments of abnormal event detection data;

[0039] Figure 5 This is a schematic diagram of the structure of some embodiments of the abnormal event detection device disclosed herein;

[0040] Figure 6 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation

[0041] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0042] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0043] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0044] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0045] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0046] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0047] Figure 1A flow 100 is shown illustrating some embodiments of a city-wide event classification method according to this disclosure. The classification method includes the following steps:

[0048] Step 101: Generate event input data based on the target event data.

[0049] In some embodiments, the entity executing the city-wide event classification method (e.g., a server) can acquire event data via wired or wireless connections. The event data here can be event data related to city governance, such as events occurring within the city (e.g., traffic congestion). The city generally refers to the entire area under the administrative jurisdiction of a city. The format (representation) of the event data is not limited here; it can be used to describe or characterize the event content, such as text data, image data, etc.

[0050] It is understandable that in the urban governance system, to facilitate the monitoring and analysis of changes in the number of various types of events, the reported event information often includes event category information. The aforementioned target event data can be event data with missing event types. That is, for some event data with missing event types, the urban event classification method in this disclosure embodiment can be used to analyze and obtain the event type. Of course, the aforementioned target event data can also be event data with event types. That is, for event data with known event types, the method of this disclosure can also be used to further verify whether the type is accurate.

[0051] In some embodiments, when the executing entity receives target event data, especially event data with a missing event type, it can generate event input data based on the target event data. For example, for event data in different formats, the executing entity can convert them into a unified preset format to facilitate subsequent processing. This preset format can be set according to actual conditions. As an example, for event data represented by an image, the executing entity can perform image recognition and analysis to extract data from the image to obtain text-described event input data. For example, in a traffic map, green indicates smooth traffic, yellow indicates slow traffic, and red indicates congestion.

[0052] Optionally, the executing entity can use various word segmentation or word cutting tools to segment the received target event data to obtain a word set for the target event data. Event input data can then be generated based on this word set. For example, the executing entity can directly use these words from the word set as event input data; or it can extract key words from the word set to construct the event input data. The method for extracting key words is not limited here; for example, a classification labeling model can be used to classify and label the words in the word set. For instance, using BIO labeling, Pb represents the beginning of a key word, Pi represents the middle or end of a key word, and O represents a non-key word. The key words here can also be set according to the actual situation. The aforementioned classification labeling model can be trained using sample labeled words containing key word types.

[0053] In some embodiments, the executing entity may first determine the vector representation of each word in the word set. Then, the vector representation of each word is used as a row in the event representation matrix, thus obtaining the event representation matrix as the event input data. That is, the executing entity can extract the word vector features of each word in the event content, and the vector representation of each word can be used as a row in matrix S, thereby representing the event content as matrix S. In other words, the number of rows in the event representation matrix corresponds to the number of words (or word vectors) in the event data. It can be understood that rows can also be replaced by columns.

[0054] Step 102: Input the event input data into the pre-trained classification model to obtain the predicted event type of the target event data.

[0055] In some embodiments, the executing entity can input the event input data obtained in step 101 into a pre-trained classification model, thereby obtaining the predicted event type of the target event data based on the model's output. The classification model can be used to predict the classification type of the input event. For example, if the output of the classification model is an event type prediction result, such as the probability of the target event data belonging to different event types, or the top few event types with higher probabilities, the executing entity can determine the event type (or several event types) with the highest probability value as the predicted event type.

[0056] In some embodiments, the classification model described above can be a seq2seq model based on a Bi-LSTM (Bi-directional Long Short-Term Memory) structure; or a seq2seq model based on a GRU (Gated Recurrent Unit, a neural network model) structure or other text2text (text-to-text) text generation models.

[0057] Here, the above classification model can be trained through the following method: First, input the sample event representation matrix in the sample data into the classification model, and output the predicted type representation matrix; then, compare and analyze the predicted type representation matrix with the corresponding sample type representation matrix, and adjust the parameters in the classification model according to the comparison results to continue training the model. Among them, the sample type representation matrix can be obtained by performing one-hot encoding (i.e., one-hot encoding) on the sample type data.

[0058] That is to say, as Figure 2 shown, when constructing the sample data set of the training model, first, the input sample event description can be tokenized. Then, the word vectors of each word can be extracted to be used as a row in the event representation matrix respectively, so as to obtain the sample event representation matrix S. After that, for the sample (event) type corresponding to each sample event in the sample data set, it can be represented as the one-hot encoding of the word (or word) index number, so as to obtain the sample type representation matrix L.

[0059] As an example, if the event type is "road congestion", according to the word list [road, way, big, congested, blocked], the obtained index numbers are [0, 1, 3, 4]. At this time, the type representation matrix L can be: [[1, 0, 0, 0, 0],

[0060] [0, 1, 0, 0, 0],

[0061] [0, 0, 0, 1, 0],

[0062] [0, 0, 0, 0, 1]].

[0063] From the above description, it can be seen that the number of rows (or columns) of the type representation matrix corresponds to the number of words in the event type. That is, if there are several words in the event type, then the type representation matrix has several rows. Among them, the word list can be pre-processed according to a large number of event descriptions. For example, the words that appear in the event data can be numbered in sequence. When scanning a certain word, if the word is not in the word list, then a new word can be added to the word list. The index number of this word can be the length of the word list before adding this word; if the word is in the word list, it can be skipped.

[0064] It can be understood that the above word list can also use a word list, that is, encode each word. Compared with the word list, the word list can reduce the amount of data in the table, which helps to reduce the occupation of storage space and also helps to improve the retrieval and query efficiency of the table. In addition, the training process of the above classification model can be completed by the execution subject or by other electronic devices.

[0065] In some embodiments, if the classification model output type represents a matrix, the execution entity may determine the predicted event type of the target event data based on the values of the elements in the type representation matrix. Specifically, first, the maximum value of the elements in each row (or column) of the type representation matrix can be determined; then, according to the column (or row) index number where the maximum value element is located, the text in the corresponding preset word list can be determined to obtain the predicted event type described in words. Among them, the number of columns (or rows) of the type representation matrix can correspond to the length of the preset word list. And the index number of each character in the preset word list is related to the position of the character in the list. The preset word list here can be the above-mentioned character list or word list. That is, the words in the preset word list can be words containing at least one character.

[0066] As an example, such as Figure 2 shown, if the model performs event type inference and the obtained type representation matrix is:

[0067] [[0.9, 0, 0, 0, 0.1],

[0068] [0, 0.5, 0.6, 0, 0],

[0069] [0, 0, 0.2, 0.8, 0],

[0070] [0, 0, 0.2, 0.13, 0.67]].

[0071] Then, the maximum value elements in each row are 0.9, 0.6, 0.8, and 0.67 respectively. For the character list ["road", "big", "congestion", "block"], the column index numbers where these elements are located are [0, 2, 3, 4] in sequence. At this time, the predicted event type described in words obtained is "big road congestion".

[0072] Optionally, the execution entity may also use the column index number where the maximum value element in each row of the type representation matrix is located as the predicted event type described by the code.

[0073] Step 103, select a candidate type from the candidate type set as the event type of the target event data based on the similarity between each candidate type in the candidate type set and the predicted event type.

[0074] In some embodiments, such as Figure 2As shown, the executing entity can calculate the similarity between the predicted event type obtained in step 102 and each candidate type in the candidate type set. Then, based on the similarity between each candidate type and the predicted event type, a candidate type can be selected from the candidate type set as the event type of the target event data. For example, the executing entity can determine the candidate type with the highest similarity value as the event type of the target event data, in descending order of similarity value, and thus output the event type. The output method is not limited and can include at least one of the following: display, storage, and tagging, etc.

[0075] Here, the similarity calculation method is also unrestricted. As an example, the executing agent can use cosine distance to calculate the similarity between the vector representation of the predicted event type and the vector representations of each candidate type. Alternatively, to simplify the calculation, the executing agent can also use the Jaccard coefficient to determine the similarity between the predicted event type and each candidate type.

[0076] As an example, for the predicted event type "severe traffic congestion" mentioned above, the implementing entity can determine its similarity to the candidate type [road congestion] as follows:

[0077]

[0078] Optionally, the executing entity can first determine the index codes for each candidate type based on the aforementioned preset vocabulary. Then, the similarity between the predicted event type described by the code and the index codes of each candidate type can be calculated. It should be noted that since the index codes for candidate types are usually fixed and unique, these candidate type index codes can be stored and retrieved to improve the efficiency of similarity calculation. This avoids the need to determine the index codes for candidate types again later. Furthermore, using index codes for similarity calculation reduces the conversion process from code to text for predicted event types, thus simplifying the processing. And generally, the processing efficiency of numerical codes is higher than that of text. This is beneficial for further improving the classification efficiency of city-wide events.

[0079] Based on the above description, the city-wide event classification method of some embodiments of this disclosure first inputs event data into a classification model to obtain the predicted event type. Analyzing and predicting through the model improves the accuracy of type determination. Next, based on the similarity between the predicted event type and each candidate type, a candidate type can be selected from the candidate type set as the event type. The final event type is determined by further analyzing the predicted event type and candidate types, rather than directly using the model's prediction result as the final event type. This helps to further improve the accuracy of type determination, thereby obtaining the required event type data. Accurate event types are beneficial for improving the accuracy of subsequent abnormal event detection. This, in turn, helps to reduce the number of abnormal event warnings and the number of invalid warnings (false warnings), thereby reducing the waste of city-wide resources (such as human resources and facility resources).

[0080] Further reference Figure 3 As a response to the above Figure 1 , 2 The present disclosure provides some embodiments of a city-wide event classification device to implement the city-wide event classification method. These classification device embodiments are similar to... Figure 1 , 2 The examples of the classification methods shown correspond to those in the illustration. This classification device can be specifically applied to various electronic devices.

[0081] like Figure 3 As shown, the city-wide event classification device 300 in some embodiments may include: a data generation unit 301, configured to generate event input data based on target event data; a type prediction unit 302, configured to input the event input data into a pre-trained classification model to obtain a predicted event type of the target event data, wherein the classification model is used to predict the classification type of the input event; and a type selection unit 303, configured to select a candidate type from the candidate type set based on the similarity between each candidate type in the candidate type set and the predicted event type, as the event type of the target event data.

[0082] In some embodiments, the data generation unit 301 may be further configured to perform word segmentation on the target event data to obtain a word set of the target event data; and generate event input data based on the word set.

[0083] In some embodiments, the data generation unit 301 may be further configured to determine the vector representation of each word in the word set, and to use the vector representation of each word as a row in the event representation matrix to obtain the event representation matrix as event input data.

[0084] In some embodiments, the type prediction unit 302 may be further configured to determine the predicted event type of the target event data based on the values ​​of each element in the type representation matrix in response to the type representation matrix output by the classification model.

[0085] In some embodiments, the type prediction unit 302 may be further configured to determine the maximum value of each row element in the type representation matrix, and determine the text in the corresponding preset vocabulary according to the column index number of the maximum value element, thereby obtaining the predicted event type of the text description; wherein, the number of columns in the type representation matrix corresponds to the length of the preset vocabulary, and the index number of each character in the preset vocabulary is related to the position of the character in the table.

[0086] In some embodiments, the classification apparatus 300 may further include a similarity determination unit (not shown in the figure), configured to determine the similarity between each candidate type in the candidate type set and the predicted event type using the Jaccard coefficient.

[0087] In some embodiments, the classification device 300 may further include a model training unit (not shown in the figure), configured to input the sample event representation matrix in the sample data into the classification model, output a prediction type representation matrix; compare and analyze the prediction type representation matrix with the corresponding sample type representation matrix, and adjust the parameters in the classification model according to the comparison result to continue training the model, wherein the sample type representation matrix is ​​obtained by one-hot encoding of the sample type data.

[0088] It is understandable that the units described in the classification device 300 are related to the reference. Figure 1 , 2 The steps in the described classification method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the classification device 300 and the units contained therein, and will not be repeated here.

[0089] See below. Figure 4A The diagram illustrates a flow 400 of some embodiments of an anomaly detection method according to the present disclosure. The detection method includes the following steps:

[0090] Step 401: Extract time series features based on the number of historical events of the target event type within each statistical period.

[0091] In some embodiments, the entity executing the abnormal event detection method (e.g., a server) can communicate with other electronic devices via wired or wireless connections. Here, as... Figure 4BAs shown, the implementing entity can calculate and determine the start and end times of each statistical period based on the current time and the cycle length of the city-wide event warning. For example, if the current time is "2022-01-12 00:00:00" and the statistical period is 1 day, then the previous statistical period is from "2022-01-11 00:00:00" to "2022-01-12 00:00:00", and so on. Next, for each event type (such as the candidate types mentioned above), the number of events of that event type occurring within each period can be counted. For example, for city-wide events of the road congestion type, the statistics can yield the following results: Figure 4C The data distribution chart shown is illustrated. In the chart, the vertical axis (0-50) represents the number of events, while the horizontal axis (August 29, 2020 to January 11, 2022) represents time. Additionally, the executing entity can store statistical data, such as storing it in a data table according to attributes like the start and end times of the period, event type, and number of events.

[0092] In some embodiments, the event type requiring anomaly detection can be designated as the target event type. This allows the executing entity to extract time-series features based on the number of historical events of that event type within each statistical period, i.e., the number of events belonging to the target event type. The target event type (the event type of a city-wide event) can be determined using the city-wide event classification method described in any of the above embodiments. Furthermore, the time-series features are not limited here.

[0093] In some embodiments, the time series features may include at least one of the following: the change in the number of events within the previous preset number of statistical periods in the current statistical period, the rate of change in the number of events, and the statistical values ​​of the number of events within the previous preset number of statistical periods. The statistical values ​​of the number of events may include at least one of the following: the sum of the number of events, the mean, the median, the maximum value, the minimum value, and the variance. The preset number may include at least one number. As an example, the preset number may be 1, 2, 3, 5, and 7. That is, the time series features of the 1st and 1st, the 2nd and 2nd, ..., the 7th and 7th statistical periods may be taken respectively.

[0094] Furthermore, to avoid impacting subsequent data analysis, if a time series feature for a certain statistical period is determined to be missing, the mean of the time series features corresponding to other statistical periods can be used as the attribute value of the missing time series feature. In other words, the missing feature is filled with the column mean of that feature. Additionally, in city-level management, typically only high-incidence warnings are considered; therefore, for the same time series feature across different statistical periods, attribute values ​​lower than the mean of that time series feature are replaced with the feature mean. That is, features lower than the column mean are covered with the column mean.

[0095] Step 402: Input the time series features into the anomaly detection model and output the anomaly threshold.

[0096] In some embodiments, the executing entity can input the time series features obtained in step 401 into the anomaly detection model, thereby outputting an anomaly threshold. The anomaly detection model can be used to perform anomaly analysis on the input data. The anomaly detection model can be selected according to the actual situation. For example, an unsupervised model structure can be used, such as a distance-based algorithm. Such algorithms can include nearest neighbor (KNN) or K-means clustering. Density-based algorithms, such as DBScan (Density-Based Spatial Clustering of Applications with Noise) or LOF (Local outlier factor), can also be used.

[0097] Alternatively, an unsupervised anomaly detection model based on the Isolation Forest (IForest) algorithm can be used. In this case, a matrix formed by the feature vectors of each period can be input into the model. The model can then output the data anomaly score for each period, as well as the anomaly score threshold calculated by the model, to determine whether there are any anomalous events (such as high-incidence events) in each period.

[0098] Step 403: Based on the anomaly threshold, detect whether there are any abnormal events of the target event type.

[0099] In some embodiments, based on the anomaly threshold obtained in step 402, the executing entity can detect whether there are any anomalous events of the target event type. For example, the executing entity can determine whether the number of events of the target event type occurring within each statistical period is greater than (or less than) the anomaly threshold. If the number of events is greater than the anomaly threshold, it can be determined that there are anomalous events of the target event type within that statistical period.

[0100] In some embodiments, the executing entity may also generate, based on abnormal event detection data, such as Figure 4D The data distribution chart shown is illustrated. The horizontal line represents the anomaly threshold obtained by the model. The curve indicated by the arrow represents the anomaly score for each statistical period. Another curve represents the number of events for each statistical period. From... Figure 4D As can be seen, for periods where the abnormal score is greater than the abnormal threshold, the number of events corresponding to these periods shows a sharp upward trend compared to nearby periods, or multiple nearby periods remain at a high level.

[0101] Furthermore, if an abnormal event is identified, the executing entity can output a warning message. The output method and the content of the warning message can be configured according to the actual situation. For example, the output may include at least one of the following: display, sound alert, and light alert, etc.

[0102] In addition, such as Figure 4B As shown, when performing event quantity statistics for an event type, the executing entity also determines whether all event types have been retrieved. If an event type has been retrieved, it means that not all event types have been retrieved, and the subsequent data statistics process can proceed. If no event types have been retrieved, it means that all event types have been retrieved, indicating that all event types have been counted, and the process can end at this point. It is understood that the executing entity in this embodiment can be the same as described above. Figure 1 The executing entities in the embodiments may be the same or different.

[0103] It should be noted that some of the research techniques related to high-incidence events target events reported in online news or on social media. Analysis of such events typically utilizes information such as likes, views, comments, media weight, and article content. However, this information is often absent in the context of urban governance.

[0104] In research targeting high-incidence incidents in urban governance, one approach is to use word vectors based on event type for clustering. High-incidence event types are identified by setting a threshold for the number of clusters in each type. The drawback of this method is that artificially set high-incidence thresholds lack scientific rigor and fail to compare historical changes in event numbers. This could lead to consistently high numbers for a particular type / region, resulting in uniform warnings for that type / region, which does not meet actual operational requirements.

[0105] Another approach is to utilize the BERT (Bidirectional Encoder Representations from Transformers) model (a pre-trained model) to extract semantic features from grid event data. This involves using a one-dimensional clustering algorithm to cluster the grid event data. Different types of event clusters are then sorted in descending order, and the top K types are considered the most frequent event types. However, this method suffers from the drawback of using a manually set value for K, which lacks scientific rigor, and it fails to compare changes in the number of events over historical periods.

[0106] As described above, the abnormal event detection method of this disclosure automatically derives anomaly thresholds for defining abnormal events by learning and analyzing historical event data through an anomaly detection model. This avoids the inconsistency caused by manually set thresholds, making the determination of anomaly thresholds more scientific, reasonable, and accurate. Furthermore, the anomaly thresholds can be adaptively and dynamically adjusted according to changes in the distribution of event data. This further improves the accuracy of the thresholds, helps reduce the number of abnormal event warnings, and reduces the number of invalid warnings (false warnings). This, in turn, helps reduce the waste of municipal resources (such as human resources and facility resources).

[0107] Continue to refer to Figure 5 As a response to the above Figure 4A , 4B The present disclosure provides some embodiments of an anomaly event detection device to implement the anomaly event detection method shown. These detection device embodiments are similar to... Figure 4A , 4B The examples of the detection methods shown correspond to those in the illustration. This detection device can be specifically applied to various electronic devices.

[0108] like Figure 5 As shown, the abnormal event detection device 500 in some embodiments may include: a feature extraction unit 501, configured to extract time series features based on the number of historical events of the target event type within each statistical period, wherein the target event type is determined using the city-wide event classification method described in any implementation of the first aspect above; a threshold determination unit 502, configured to input the time series features into an abnormal detection model and output an abnormal threshold; and a detection unit 503, configured to detect whether there is an abnormal event of the target event type based on the abnormal threshold.

[0109] In some embodiments, time series features may include at least one of the following: the change value of the number of events and the rate of change of the number of events within the number of statistical periods preceding the current statistical period, wherein the number of events includes at least one number; and the statistical values ​​of the number of events within the number of statistical periods preceding the current statistical period, wherein the statistical values ​​of the number of events include at least one of the following: the sum of the number of events, the mean, the median, the maximum value, the minimum value, and the variance.

[0110] In some embodiments, the feature extraction unit 501 may also be configured to, in response to determining that a time series feature for a certain statistical period is missing, use the mean of the time series features corresponding to other statistical periods as the attribute value of the missing time series feature; and for the same time series feature in each statistical period, replace the attribute value that is less than the mean of the time series feature with the feature mean.

[0111] It is understandable that the units described in the abnormal event detection device 500 are related to the reference... Figure 4A , 4B The steps in the described detection method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the detection device 500 and the units contained therein, and will not be repeated here.

[0112] The following is for reference. Figure 6 It shows a schematic diagram of the structure of an electronic device 600 suitable for implementing some embodiments of the present disclosure. Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0113] like Figure 6 As shown, electronic device 600 may include processing unit 601 (e.g., central processing unit, graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603. RAM 603 also stores various programs and data required for the operation of electronic device 600. Processing unit 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0114] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, speakers, vibrators, etc.; storage devices 608 including, for example, hard disks, disks, etc.; and communication devices 609. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6 An electronic device 600 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 6 Each box shown can represent a device or multiple devices as needed.

[0115] In particular, according to some embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined above in the methods of some embodiments of this disclosure.

[0116] It should be noted that, in some embodiments of this disclosure, the computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In some embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0117] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0118] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: generate event input data based on target event data; input the event input data into a pre-trained classification model to obtain a predicted event type for the target event data, wherein the classification model is used to predict the classification type of the input event; and select a candidate type from the candidate type set as the event type of the target event data based on the similarity between each candidate type in the candidate type set and the predicted event type.

[0119] Alternatively, based on the number of historical events of the target event type within each statistical period, time series features are extracted, wherein the target event type is determined using the city-wide event classification method described in any of the implementation methods in the first aspect above; the time series features are input into the anomaly detection model, and an anomaly threshold is output; based on the anomaly threshold, the existence of anomaly events of the target event type is detected.

[0120] Furthermore, computer program code for performing operations of some embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0121] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0122] The units described in some embodiments of this disclosure can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor may be described as including a data generation unit, a type prediction unit, and a type selection unit; or it may include a feature extraction unit, a threshold determination unit, and a detection unit. The names of these units do not necessarily limit the unit itself; for example, a data generation unit may also be described as a "unit that generates event input data."

[0123] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0124] Some embodiments of this disclosure also provide a computer program product, including a computer program that, when executed by a processor, implements any of the above-described urban event classification methods or abnormal event detection methods.

[0125] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A method for classifying municipal events, comprising: Generate event input data based on the target event data; The event input data is input into a pre-trained classification model to obtain the predicted event type of the target event data, wherein the classification model is used to predict the classification type of the input event; Based on the similarity between each candidate type in the candidate type set and the predicted event type, the candidate type with the highest similarity value is selected from the candidate type set as the event type of the target event data, instead of directly using the predicted event type as the final event type. The predicted event types for obtaining the target event data include: In response to the type representation matrix output by the classification model, the maximum value of each row element in the type representation matrix is ​​determined. Based on the column index number of the maximum value element, the text in the corresponding preset vocabulary is determined to obtain the predicted event type of the text description. The number of rows in the type representation matrix corresponds to the number of characters in the predicted event type.

2. The urban event classification method according to claim 1, wherein, The step of generating event input data based on target event data includes: The target event data is segmented into words to obtain the word set of the target event data; Event input data is generated based on the vocabulary set.

3. The urban event classification method according to claim 2, wherein, The step of generating event input data based on the word set includes: The vector representation of each word in the word set is determined, and the vector representation of each word is used as a row in the event representation matrix to obtain the event representation matrix as event input data.

4. The urban event classification method according to claim 3, wherein, The type indicates that the number of columns in the matrix corresponds to the length of the preset vocabulary, and the index number of each character in the preset vocabulary is related to the position of the character in the table.

5. The method for classifying municipal events according to claim 1, wherein, The method further includes: Using the Jaccard coefficient, the similarity between each candidate type in the candidate type set and the predicted event type is determined.

6. The method for classifying municipal events according to any one of claims 1-5, wherein, The classification model was trained using the following method: Input the sample event representation matrix from the sample data into the classification model, and output the prediction type representation matrix. The predicted type representation matrix is ​​compared and analyzed with the corresponding sample type representation matrix, and the parameters in the classification model are adjusted according to the comparison results to continue training the model. The sample type representation matrix is ​​obtained by one-hot encoding of the sample type data.

7. A city-wide event classification device, comprising: The data generation unit is configured to generate event input data based on the target event data; A type prediction unit is configured to input the event input data into a pre-trained classification model to obtain a predicted event type of the target event data, wherein the classification model is used to predict the classification type of the input event; The type selection unit is configured to select the candidate type with the highest similarity value from the candidate type set based on the similarity between each candidate type in the candidate type set and the predicted event type, instead of directly using the predicted event type as the event type of the target event data; The predicted event types for obtaining the target event data include: In response to the type representation matrix output by the classification model, the maximum value of each row element in the type representation matrix is ​​determined. Based on the column index number of the maximum value element, the text in the corresponding preset vocabulary is determined to obtain the predicted event type of the text description. The number of rows in the type representation matrix corresponds to the number of characters in the predicted event type.

8. An abnormal event detection method, comprising: Based on the number of historical events of the target event type within each statistical period, time series features are extracted, wherein the target event type is determined using the city-wide event classification method as described in any one of claims 1-6; The time series features are input into the anomaly detection model, and the anomaly threshold is output. Based on the aforementioned anomaly threshold, detect whether there is an anomaly event of the target event type.

9. The abnormal event detection method according to claim 8, wherein, The time series features include at least one of the following: The change value of the number of events and the rate of change of the number of events within the number of statistical periods preceding the current statistical period, wherein the number of events includes at least one number; The event quantity statistics within the aforementioned preset number of statistical periods include at least one of the following: total number of events, mean, median, maximum, minimum, and variance.

10. The abnormal event detection method according to claim 9, wherein, The step of extracting time series features based on the amount of historical event data of the target event type within each statistical period also includes: In response to the determination that a time series feature is missing for a certain statistical period, the mean of the time series features corresponding to other statistical periods is used as the attribute value of the missing time series feature; and For the same time series feature across different statistical periods, attribute values ​​that are less than the mean of that time series feature are replaced with the feature mean.

11. An abnormal event detection device, comprising: The feature extraction unit is configured to extract time series features based on the number of historical events of the target event type within each statistical period, wherein the target event type is determined using the city-wide event classification method as described in any one of claims 1-6; The threshold determination unit is configured to input the time series features into the anomaly detection model and output an anomaly threshold. The detection unit is configured to detect whether an abnormal event of the target event type exists based on the abnormality threshold.

12. An electronic device, comprising: One or more processors; Storage device, on which one or more programs are stored, When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-6 or 8-10.

13. A computer-readable medium having a computer program stored thereon, wherein, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6 or 8-10.

14. A computer program product comprising a computer program that, when executed by a processor, implements the method as described in any one of claims 1-6 or 8-10.

Images