A multi-attribute anomaly detection method based on mobile target trajectory classification

Abstract

The application provides a multi-attribute anomaly detection method based on mobile target trajectory classification, first, based on a multi-attribute mobile target trajectory data set, a normal behavior mode of the mobile target is established by using sequence mining and clustering algorithm, then, the trajectory data is compared with the normal behavior mode, so that the mobile target abnormal behavior is detected. Finally, aiming at the characteristics of the fast updating and large data quantity of the trajectory data set, an incremental anomaly detection scheme is provided. The application can effectively detect the sequence type and numerical type of the mobile target abnormal behavior, and the incremental updating makes the model adapt to the dynamic growth of the trajectory, and provides a basis for establishing a reaction mechanism for the mobile target behavior.

Description

Technical Field

[0001] This invention relates to an anomaly detection method, specifically a multi-attribute anomaly detection method based on moving target trajectory classification. Background Technology

[0002] Against the backdrop of the rapid development of high technologies such as the Internet and mobile location services, moving targets are constantly generating trajectory data. Trajectory data, in the traditional sense, includes traffic data, human movement data, animal migration trajectory data, and natural phenomenon trajectory data. With the rapid development of information technology and the widespread application of database management systems, the amount of trajectory data accumulated by people has surged, and this massive amount of trajectory data has significant research value. Generally speaking, trajectory data is characterized by spatiotemporal sequence, heterogeneous sampling, and poor data quality. Therefore, complex and rigorous preprocessing is required for trajectory data acquired by information collection devices, followed by analysis to uncover the target's movement characteristics, providing support for further research and decision-making. For example, trajectory data processing based on urban traffic can provide excellent solutions for optimizing traffic routes, personalized route recommendations, road network prediction, and municipal planning; analysis based on human movement trajectories, stop points, and behavioral characteristics can uncover implicit information such as personal interests and social relationships; and mining the interrelated trajectory behaviors within large amounts of LBS (Location Based Services) trajectory data can further explore the implicit characteristics of users in terms of data correlation and spatiotemporal features.

[0003] Continuously changing spatiotemporal trajectory data makes it easier to infer the behavioral patterns and habits of moving targets. Researchers can use the characteristics of historical movement trajectory data to mine their activity range and scenarios, construct a set of normal behavioral patterns, and perform anomaly detection. This allows them to consciously avoid anomalies or make decisions based on this information. Therefore, how to mine the implicit features and patterns of moving target trajectory data and detect abnormal trajectories has become a hot topic of interest for scholars and experts.

[0004] Generally, based on the different types of data processed, anomaly detection of moving target trajectory data can be divided into two types: methods for static datasets and methods for data streams. Representative algorithms for anomaly detection on static datasets include the anomaly trajectory detection algorithm based on partitioning and detection framework proposed by Lee et al., the anomaly trajectory detection algorithm based on R-Tree proposed by Liu Liangxu et al., and the real-time trajectory anomaly detection algorithm proposed by Ge et al. Representative algorithms for anomaly detection on trajectory data streams include the anomaly trajectory detection algorithm based on sliding window proposed by Bu et al., and the anomaly moving target detection algorithm in massive trajectory streams proposed by Cao et al.

[0005] The main problems with existing moving target anomaly detection algorithms include: they do not take into account the dynamic growth of the trajectory, cannot incrementally update the anomaly detection model, and cannot detect the evolution of abnormal behavior; at the same time, due to the huge amount of trajectory point data, traditional anomaly detection algorithms have high time overhead and a large amount of storage space. Summary of the Invention

[0006] Purpose of the invention: The technical problem to be solved by the present invention is to provide a multi-attribute anomaly detection method based on moving target trajectory classification, which addresses the shortcomings of the existing technology.

[0007] To address the aforementioned technical problems, this invention discloses a multi-attribute anomaly detection method based on moving target trajectory classification, comprising the following steps:

[0008] Step 1, Trajectory Compilation of Moving Target: The original trajectory dataset of the moving target is compiled to construct a trajectory compilation dataset, which includes trajectory data and trajectory point data; the original trajectory dataset of the moving target contains several trajectories, and each trajectory contains several trajectory points;

[0009] Step 2, Moving target trajectory feature extraction: After further calculation, a set of feature attributes of a trajectory of the moving target is obtained, including: the area traversed by the moving target, average speed, trajectory appearance time, disappearance time, appearance duration, nearest distance to other moving targets, and nearest distance to a preset hotspot area; the attributes contained in the above feature attribute set are the abnormal attributes to be detected;

[0010] The above-mentioned abnormal attributes to be detected are divided into two categories: numerical and sequential. The sequential type includes: the area traversed by the moving target, and the numerical type includes: average speed, trajectory appearance time, trajectory disappearance time, trajectory appearance duration, nearest distance to other moving targets, and nearest distance to a preset hotspot area.

[0011] Step 3, Multi-attribute anomaly detection of moving target trajectory: Based on the type of the anomaly attribute to be detected, sequence pattern and clustering classification methods are used for detection to complete the multi-attribute anomaly detection based on moving target trajectory classification;

[0012] Step 4: Visualize the abnormal data obtained from the detection and provide a basis for emergency decision-making.

[0013] Furthermore, the motion trajectory compilation dataset constructed in step 1 specifically includes:

[0014] Trajectory data: This is a dataset describing the activity of a moving target. It consists of several trajectories. The attributes of any trajectory of a moving target include: the unique identifier of the trajectory, the name of the moving target, the time the trajectory appears, and the time the trajectory disappears.

[0015] Track point data: This is a dataset that describes the details of a specified trajectory of a moving target. A specified trajectory consists of several track points. For the set of track points that constitute the current trajectory, the attributes of any track point include: the unique identifier of the current track point, the unique identifier of the trajectory to which it belongs, longitude, latitude, current time, speed, and altitude.

[0016] Furthermore, step 2 involves obtaining a set of feature attributes for a trajectory of the moving target through further calculations, specifically performing feature extraction based on the category of the anomaly attribute to be detected. This includes:

[0017] Step 2-1: Extract sequence-type features from the trajectory of the moving target;

[0018] Step 2-2: Extract numerical features from the trajectory of the moving target.

[0019] Furthermore, the sequential feature extraction of the moving target trajectory described in step 2-1 specifically includes:

[0020] Step 2-1-1: Calculate the maximum latitude and longitude value {jd} among all trajectory points of the moving target. max ,wd max} and minimum value {jd min ,wd min};

[0021] Step 2-1-2, place {jd} on the map min ,wd min}、{jd min ,wd max}、{jd max ,wd min} and {jd max ,wd max The area within the four points of latitude and longitude is designated as the activity area of ​​the moving target;

[0022] Step 2-1-3: Grid the active area of ​​the aforementioned moving target and name each grid area;

[0023] Step 2-1-4: Convert each trajectory of the moving target into a sequence q according to the grid where the trajectory points are located. s This allows us to obtain the area traversed by the moving target's trajectory.

[0024] Furthermore, the numerical feature extraction of the moving target trajectory described in step 2-2 specifically includes:

[0025] Step 2-2-1, let any trajectory of the moving target A be TR, TR = {tr1, tr2, ..., tr n}, where tri Let i represent the i-th trajectory point on trajectory TR, where i∈{1,2,…,n} and n is the number of trajectory points contained in this trajectory.

[0026] Step 2-2-2: Based on the trajectory appearance time cxsj and trajectory disappearance time xssj in the trajectory attributes, calculate the trajectory appearance duration, as follows:

[0027] For trajectory point tr i It includes the following attributes: the unique identifier (pid) of the current trajectory point. i The unique identifier tid of the trajectory, and the latitude and longitude of the trajectory point jd i and wd i Current time sj i Speed ​​sd i High GD i and the region qy where the trajectory point is located i ;

[0028] For a trajectory TR of a moving target A, the duration cxsc of its occurrence is:

[0029] cxsc=(xssj-cxsj) / 1000

[0030] Where cxsc represents the duration of the trajectory appearance;

[0031] Step 2-2-3, calculate the average velocity avg_sd on the current trajectory, which is:

[0032]

[0033] Among them, sd i Let be the velocity of the i-th trajectory point on the current trajectory;

[0034] Step 2-2-4, the calculation method for the nearest distance min_dis_t to other moving targets is as follows:

[0035] min_dis_t=min{disT j}

[0036] Among them, disT j For a moving target trajectory that shares a common time interval with trajectory TR, the distance between sampling points at the same moment within the common time interval is defined as follows: j represents the j-th sampling point.

[0037]

[0038] Where R represents the Earth's radius, jd p and wd p jd represents the latitude and longitude of any sampling point on trajectory TR, respectively.q and wd q This represents the latitude and longitude of the sampling point for any moving target other than moving target A at the same moment;

[0039] Step 2-2-5, the nearest distance min_dis_a to the preset hotspot area is calculated as follows:

[0040] min_dis_a=min{disA j}

[0041] Among them, disA j This represents the distance between the trajectory TR and the preset hotspot area at the sampling point time during the time period in which the trajectory TR appears.

[0042] Furthermore, the distance disA mentioned in step 2-2-5 j The calculation method is as follows:

[0043]

[0044] Among them, id a and wd a This indicates the latitude and longitude of the center of the preset hotspot area.

[0045] Furthermore, the detection using sequence pattern and clustering classification methods described in step 3 specifically includes: Step 3-1, using sequence pattern to perform anomaly detection on the sequence-type abnormal attributes to be detected, including:

[0046] Step 3-1-1: Analyze the trajectory data of the moving target and mine the set of frequently active area sequences corresponding to the moving target as the normal pattern of the area traversed by the current moving target;

[0047] Step 3-1-2, perform anomaly detection: Anomaly detection is completed by comparing the real-time trajectory of the same moving target through the area with the normal pattern described above;

[0048] Step 3-1-3: Update the set of frequently active area sequences corresponding to the moving target;

[0049] Step 3-2: Apply clustering classification methods to detect anomalies in numerical attributes, including:

[0050] The normal activity pattern set corresponding to the numerical abnormal attributes to be detected for moving targets is mined, where the normal activity pattern of each attribute corresponds to a numerical value range. The abnormal attributes to be detected for each numerical abnormal attribute of the real-time trajectory of the same moving target are compared with the normal activity pattern of that attribute to complete the anomaly detection. Then the above normal activity pattern set is updated.

[0051] Furthermore, the mining of the frequent activity region sequence set corresponding to the moving target as described in step 3-1-1, namely, the mining of the frequent sequence pattern mining method based on prefix projection, is carried out using the following specific method:

[0052] Step 3-1-1-1: Based on the name of the moving target and the time interval, filter the moving target trajectory data that meets the conditions, and extract the moving target trajectory sequence features based on the area traversed by the trajectory, i.e., the trajectory activity sequence q. s Establish a sequence database Trace, where the size of the sequence database Trace |Trace| = sn, and the longest sequence length is...

[0053] Step 3-1-1-2, set the support percentage (sup). pc Then the support level is sup Δ =sup pc ×sn, scans the sequence database Trace, searching for sequences whose occurrence frequency is greater than the support sum. Δ A single item is denoted as the set of patterns in the sequence database Trace, i.e. This represents the m-th item in the pattern set;

[0054] Step 3-1-1-3: Traverse the set of patterns P. 1 For each of them Establish a projection database That is, in the sequence database Trace, the prefix is The set of suffixes for a sequence;

[0055] Set the search parameter l=2, and mine within it for... The set of l patterns with prefix P l That is, the number of traces in the sequence database is greater than the support score. Δ The prefix set of a sequence of length l;

[0056] Increment l by 1, repeat step 3-1-1-3, until l = L or ... Obtain the sequence pattern set SP;

[0057] Step 3-1-1-4: Based on the sequence pattern set SP, the longest sequence pattern set LP is obtained by prefix merging, which is the set of frequently active regions of the moving target.

[0058] Furthermore, the anomaly detection described in step 3-1-2 specifically includes:

[0059] Step 3-1-2-1: For the trajectories of the n′ newly added moving targets in real time, convert them into a sequence q′. i Establish a real-time trajectory dataset Trace′, where |Trace′|=n′;

[0060] Step 3-1-2-1: Traverse Trace′. If Trace′ traversal is complete, jump to step 3-1-2-3; otherwise, proceed to step 3-1-2-2.

[0061] Step 3-1-2-2, determine the real-time sequence q′ i Is it any sequence lp in the set LP of frequently active regions of a moving target? j If it is a substring, then iterate through the real-time trajectory dataset Trace′ and continue to judge; otherwise, continue to judge the next sequence in the set LP of frequently active areas of the moving target. If the set LP has been traversed, q′ i If a substring cannot be matched to any element in LP, then the sequence q′ that marks the current target trajectory is determined. i If an anomaly is found in the area passed through, it is stored in the area_abnormal result table. The real-time trajectory dataset Trace′ is traversed and further judgment is made.

[0062] Step 3-1-2-3: The trajectory sequence anomaly detection for the newly added moving target trajectory dataset Trace′ is completed. Based on the data in the area_abnormal table, a visualization is performed.

[0063] Furthermore, updating the set of frequently active area sequences corresponding to the moving target as described in step 3-1-3 specifically includes:

[0064] Let the existing moving target trajectory dataset be Trace, the newly added trajectory dataset be Trace′, and the updated trajectory dataset be Trace. N The existing set of frequently active region sequences for the current moving target is LP, the newly added set of frequently active region sequences is LP′, and the updated set of frequently active region sequences is LP. N The number of supports for sequence q in the Trace is support. Trace (q), the number of supports in Trace′ is support Trace′ (q), in Trace N The number of supporters is The sets of frequently updated active region sequences can be categorized into the following four types:

[0065] Case 1: Sequence q belongs to both the existing set of frequently active region sequences LP and the newly added set of frequently active region sequences LP′.

[0066] Case 2: Sequence q belongs to the existing set of frequently active region sequences LP, but does not belong to the newly added set of frequently active region sequences LP′.

[0067] Case 3: Sequence q belongs to the newly added frequent activity region sequence set LP′, but does not belong to the existing frequent activity region sequence set LP;

[0068] For the three scenarios mentioned above, calculate the number of supports. Right now:

[0069]

[0070] If satisfied Then add sequence q to the updated set of frequently active region sequences LP. N middle;

[0071] Case 4: Sequence q belongs to neither the existing set of frequently active region sequences LP nor the newly added set of frequently active region sequences LP′, and is therefore not considered.

[0072] Beneficial effects:

[0073] (1) In this invention, anomalies are classified according to trajectory attributes, and detection algorithms are designed for numerical and sequential anomalies respectively, which can quantitatively analyze and discover abnormal behaviors in a single attribute dimension of the trajectory.

[0074] (2) In view of the characteristics of the trajectory dataset being updated quickly and having a large amount of data, the present invention proposes an incremental anomaly detection scheme, which enables the model to adapt to the dynamic growth of the trajectory and achieve the goal of detecting the evolution of abnormal behavior of moving target trajectories.

[0075] (3) The present invention uses a clustering method with relatively lower complexity to improve execution efficiency. Attached Figure Description

[0076] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0077] Figure 1 This is a flowchart of a frequent sequence pattern mining algorithm based on prefix projection.

[0078] Figure 2 This is a flowchart of a numerical anomaly detection algorithm for moving target trajectories.

[0079] Figure 3 This is a schematic diagram of a projected database with a prefix length of 1.

[0080] Figure 4 This is a schematic diagram of a projected database with a prefix length of 2.

[0081] Figure 5 This is a schematic diagram of the results of the anomaly detection algorithm for the area through which a moving target passes.

[0082] Figure 6 This is a schematic diagram of the results of a numerical anomaly detection algorithm for moving targets. Detailed Implementation

[0083] This invention designs a multi-attribute anomaly detection algorithm based on moving target trajectory classification. This algorithm classifies anomalies according to trajectory attributes, and separate detection algorithms are designed for numerical and sequential anomalies. Furthermore, a less complex clustering method is employed to improve the algorithm's execution efficiency. Finally, considering the characteristics of rapid updates and large data volumes in trajectory datasets, an incremental anomaly detection scheme is proposed to meet the functional requirements of dynamic, real-time, and accurate detection system modules.

[0084] In this invention, the original trajectory dataset of a moving target consists of several trajectories, each of which is composed of several trajectory points; that is, each trajectory can be represented as a set of trajectory points. For a trajectory of a specific moving target, its attributes include the unique identifier of the current trajectory, the name of the moving target, the trajectory's appearance time, and its disappearance time. For the set of trajectory points constituting the current trajectory, each trajectory point contains attributes including its unique identifier, the unique identifier of its associated trajectory, longitude, latitude, current time, speed, and altitude. Further calculations yield a set of feature attributes for a trajectory of a specific moving target, including the area traversed by the moving target, average speed, trajectory appearance time, disappearance time, duration of appearance, nearest distance to other moving targets, and nearest distance to hotspot areas. These seven attributes are the moving target features for anomaly detection in this invention. Finally, this invention categorizes the anomaly attributes to be detected into two types: numerical and sequential anomaly attributes, and uses sequence pattern and clustering classification for anomaly detection, respectively.

[0085] This invention comprises the following three steps:

[0086] 1. Moving target reorganization

[0087] In this invention, the trajectory dataset of a moving target consists of several trajectories, each of which is composed of several trajectory points; that is, each trajectory can be represented as a set of trajectory points. For a single trajectory of a moving target, its attributes include the unique identifier of the current trajectory, the name of the moving target, the trajectory's appearance time, and its disappearance time. For the set of trajectory points constituting the current trajectory, each trajectory point contains attributes including the unique identifier of the current trajectory point, the unique identifier of its associated trajectory, the trajectory point's longitude, latitude, current time, speed, and altitude.

[0088] 2. Feature extraction of moving target trajectory

[0089] Further calculations yield a set of characteristic attributes for a trajectory of a moving target, including the area traversed by the moving target, average speed, trajectory appearance time, disappearance time, duration of appearance, nearest distance to other moving targets, and nearest distance to hotspot areas. Based on the attribute categories, the features extraction steps for the moving target trajectory are as follows.

[0090] 2.1 Feature Extraction of Moving Target Trajectory Sequence

[0091] First, calculate the maximum latitude and longitude of all moving target trajectory points {jd}. max ,wd max} and minimum value {jd min ,wd min}, and the area within that range, i.e., the area on the map {jd min ,wd min}、{jd min ,wd max}、{jd max ,wd min} and {jd max ,wd max The area within the four coordinate ranges is designated as the moving target's activity area. This area is then gridded, and each grid region is named. Finally, each trajectory of the moving target is converted into a sequence q according to the grid points located on that trajectory. i The characteristic attributes of the areas through which the trajectory of the moving target is formed are used as the sequence-type features of the moving target trajectory.

[0092] 2.2 Numerical Feature Extraction of Moving Target Trajectory

[0093] For a trajectory TR of a moving target A, TR = {tr1, tr2, ..., tr n}, where tr i Let represent a trajectory point on trajectory TR, where i ∈ {1, 2, ..., n}, and n is the number of trajectory points contained in this trajectory. For trajectory TR, its attributes include the unique identifier tid of the current trajectory, the name of the moving target mbmc, the trajectory appearance time cxsj, the trajectory disappearance time xssj, and the sequence of regions traversed by the current trajectory jgqy. For trajectory point tr... i Specifically, it contains the unique identifier pid of the current trajectory point. i The unique identifier tid of the trajectory, and the latitude and longitude of the trajectory point jd i and wd i Current time sj i Speed ​​sd i High GDi and the region qy where the trajectory point is located i The time attribute is a long integer.

[0094] For a trajectory TR of a moving target A, the duration cxsc of its occurrence is:

[0095] cxsc=(xssj-cxsj) / 1000

[0096] For a trajectory TR of a moving target A, its average velocity on the current trajectory is:

[0097]

[0098] That is, the average velocity of all trajectory points contained in the current trajectory TR.

[0099] For a trajectory TR of a moving target A, the nearest distance between it and any other moving target besides itself is min_dis_t = min{disT} j}, where disT j For a moving target trajectory that shares a common time interval with trajectory TR, the distance between sampling points at the same instant within that common time interval is...

[0100]

[0101] In the formula, R represents the Earth's radius, jd p and wd p jd represents the latitude and longitude of a sampling point on trajectory TR, respectively. q and wd q This represents the latitude and longitude of the sampling point for any moving target other than moving target A at the same moment.

[0102] For a trajectory TR of a moving target A, its nearest distance to the hotspot region is min_dis_a = min{disA} j}, where disA j This represents the distance between the trajectory TR and the hotspot region at the sampling point within the time period during which the trajectory TR appears.

[0103]

[0104] In the formula, R represents the Earth's radius, jd p and wd p jd represents the latitude and longitude of a sampling point on trajectory TR, respectively. a and wd a Indicates the latitude and longitude of the center of the hotspot area.

[0105] For a trajectory TR of a moving target A, extract its trajectory appearance time cxsj and trajectory disappearance time xssj. This will give us the numerical features of the trajectory TE of the moving target A, including trajectory appearance time, disappearance time, appearance duration, average speed, nearest distance to other moving targets, and nearest distance to hotspot areas.

[0106] 3. Anomaly detection of multiple attributes in the trajectory of moving targets

[0107] The abnormal attributes to be detected are divided into two categories: numerical and sequential abnormal attributes. Sequence patterns and clustering classification are used for anomaly detection, respectively. The steps for multi-attribute anomaly detection of moving target trajectory are as follows.

[0108] 3.1 Anomaly Detection of Moving Target Trajectory Sequence Attributes

[0109] The anomaly detection algorithm for moving target trajectory sequence attributes first needs to analyze the trajectory data of the moving target and mine its frequently active region sequence set as the normal pattern of the current moving target's sequence attributes. Here, the PrefixSpan algorithm based on prefix projection is used for frequent sequence pattern mining, and the process is as follows: Figure 1 As shown.

[0110] The main steps of the algorithm for mining the set of frequently active regions of moving targets are as follows:

[0111] (1) Based on the name of the moving target and the time interval, filter the moving target trajectory data that meet the conditions, and extract the moving target trajectory sequence features. Based on the features of the area traversed by the trajectory, that is, the trajectory activity sequence q i Establish a sequence database Trace, with a Trace size |Trace| = n and the longest sequence length.

[0112] (2) Set the support percentage. pc Then the support level is sup Δ =sup pc ×n, scan the Trace, and find the condition that appears more than sup. Δ A single item, denoted as the 1-pattern set of the Trace, is denoted as...

[0113] (3) Traverse P 1 For P 1 Each item Establish a projection database That is, the prefix in Trace is The set of suffixes for sequences. Let l = 2, and mine within it... The set of l-patterns P with prefixes l That is, the number of traces is greater than sup Δ The prefix set of sequences of length l. Increment l by 1, repeat step (3) until l = L or Obtain the sequence pattern set SP.

[0114] (4) For SP, the longest sequence pattern set LP is obtained by prefix merging. LP is the set of frequently active regions of the target.

[0115] Based on the mined set of frequently active regions of moving targets, the main steps of the moving target trajectory sequence anomaly detection algorithm are as follows:

[0116] (1) Pre-set the support threshold of the trajectory. Δ Then, based on the PrefixSpan algorithm, the set of frequently active regions sequence LP of the current moving target is obtained.

[0117] (2) For the n′ newly added moving target trajectories in real time, convert them into a sequence q′. i Establish a real-time trajectory dataset Trace′, where |Trace′|=n′.

[0118] (3) Traverse Trace′. If Trace′ traversal is complete, jump to step (5); otherwise, proceed to step (4).

[0119] (4) Use dynamic programming to determine the real-time sequence q′ i Is any sequence lp in the set LP of frequently active areas of a moving target? j If it is a substring, then stop judging, i = i + 1, and return to step (3); if the set LP has been traversed, q′ i If it still cannot be matched as a substring of any element in LP, then the current trajectory q is marked. i If an anomaly is found in the traversed area, store it in the area_abnormal result table, i = i + 1, and return to step (3).

[0120] (5) The trajectory sequence anomaly detection for the newly added moving target trajectory dataset Trace′ is completed, and the data in the area_abnormal table is used for visualization.

[0121] As time progresses, more and more moving target trajectories will be added to the moving target trajectory dataset. In this situation, the already obtained set of frequent activity region sequences (LP) for the current moving target may no longer meet the set support threshold, or new frequent activity sequences not included in the LP may appear, thus losing their timeliness. Therefore, this invention also proposes a method for updating the set of frequent activity region sequences to adapt to the needs of anomaly detection under incremental data.

[0122] Assuming there is an existing moving target trajectory dataset named Trace, a newly added trajectory dataset named Trace′, and the updated trajectory dataset named Trace. N The existing set of frequently active region sequences for the current moving target is LP, the newly added set of frequently active region sequences is LP′, and the updated set of frequently active region sequences is LP. N The number of supports for sequence q in the Trace is support. Trace (q), the number of supports in Trace′ is support Trace′ (q), in Trace N The number of supporters is The sets of frequently updated active region sequences can be categorized into the following four types:

[0123] (1) Sequence q belongs to both the existing set of frequently active region sequences LP and the newly added set of frequently active region sequences LP′;

[0124] (2) Sequence q belongs to the existing set of frequently active region sequences LP, but does not belong to the newly added set of frequently active region sequences LP′;

[0125] (3) Sequence q belongs to the newly added frequent activity region sequence set LP′, but does not belong to the existing frequent activity region sequence set LP;

[0126] (4) Sequence q belongs to neither the existing set of frequent activity region sequences LP nor the newly added set of frequent activity region sequences LP′.

[0127] For the above cases (1) to (3), calculate Right now:

[0128]

[0129] If satisfied Then add sequence q to the updated set of frequently active region sequences LP. N middle.

[0130] Regarding the above situation (4), it can be known from mathematical principles that its It must be less than the pre-set support threshold. Δ, that is, the trajectories that are infrequent in the existing and newly added trajectory datasets are also infrequent in the merged new dataset, so they are not considered.

[0131] 3.2 Anomaly Detection for Numerical Attributes of Moving Target Trajectories

[0132] Taking the anomaly detection algorithm for the average speed attribute of moving targets as an example, if the data set composed of the average speeds of the existing n trajectories is AVG_SD = {avg_sd i | i = 1, 2,..., n}, as Figure 2 shown, the main steps of the algorithm are as follows:

[0133] (1) For the set AVG_SD, set a threshold

[0134] (2) Define a data point set COPY and let COPY = AVG_SD;

[0135] (3) Arbitrarily select a data point copy i from the set COPY as the center point of a Canopy set x j , denoted as C j , and remove copy i from COPY;

[0136] (4) Calculate the distance dist from all points in COPY to copy i ;

[0137] (5) If dist < T1, then assign the corresponding points to Center;

[0138] (6) If dist ≤ T2, then remove the corresponding points from COY and add them to the Canopy set x j corresponding to C j ;

[0139] (7) Repeat steps (3) to (6) until the set COPY is empty, and thus K Canopy sets can be obtained;

[0140] (8) Define a data point set TEMP and let TEMP = AVG_SD;

[0141] (9) Select the center points of the K Canopy sets obtained in step (7) as representative data points, construct a representative data point set REPRESENT, and delete these K representative data points from the set TEMP;

[0142] (10) Set the number of neighbor nodes l = K(n - K) × 1.25%, and initialize with cnt = 1;

[0143] (11) Randomly select a data point r from the representative data point set REPRESENT. j A data point t is randomly selected from the set TEMP. i Replace r j And calculate r respectively j The standard of absolute error E for representative data points r , and t i The standard of absolute error E for representative data points t ;

[0144] (12) If E r >E t The data points r in the representative data point set REPRESENT j =t i Reset cnt = 1, otherwise cnt = cnt + 1;

[0145] (13) Repeat steps (11) to (12) until cnt>l. At this point, the representative data point set REPRESENT is the minimum cost representative data point set.

[0146] (14) Using the data points contained in the set REPRESENT as the cluster center, divide each data point in the set AVG_SD into the cluster represented by the nearest cluster center, thereby obtaining K clusters after clustering, and constructing the corresponding normal behavior pattern AVG_SD_normal, which should be K value intervals.

[0147] (15) Traverse the newly obtained set of data points and match them with AVG_SD_normal. If a match cannot be found, the current data point value is considered to be abnormal and stored in the corresponding table in the database.

[0148] For numerical anomalies in the trajectory of moving targets, the algorithm steps for detecting the five attributes to be detected—time of occurrence, time of disappearance, duration of occurrence, closest distance to other moving targets, and closest distance to hotspot areas—are the same as those for detecting anomalies in the average velocity attribute of moving targets. It is only necessary to replace the corresponding attributes in the input data set and the database table of output anomaly results, so they will not be repeated here.

[0149] Similarly, as time progresses and more moving target trajectories are added, the normal pattern set of numerical attributes of moving targets should also be updated accordingly. In this case, to meet the timeliness requirements of the algorithm, unlike the anomaly detection algorithm for moving target trajectory sequence attributes, this invention considers using a sliding window method to update the normal pattern set of numerical attributes of moving targets. That is, an update cycle threshold is preset, and at the beginning of a new cycle, the normal pattern set corresponding to the numerical attributes is recalculated for all data within the window size range, and the normal pattern set stored in the database in the previous cycle is globally replaced to adapt to the needs of anomaly detection under incremental data.

[0150] Example:

[0151] The multi-attribute anomaly detection algorithm based on moving target trajectory classification mainly includes three steps, and the specific implementation plan for each step is shown below.

[0152] 1. Trajectory compilation of moving targets

[0153] The trajectory dataset of a moving target consists of several trajectories, each of which is composed of several trajectory points; that is, each trajectory can be represented as a set of trajectory points. For a single trajectory of a moving target, its attributes include the unique identifier of the current trajectory, the name of the moving target, the time the trajectory appeared, and the time the trajectory disappeared. For the set of trajectory points constituting the current trajectory, each trajectory point contains attributes including its unique identifier, the unique identifier of its associated trajectory, longitude, latitude, current time, speed, and altitude. An analysis of approximately 1TB of moving target trajectory data for the entire year of 2017 is presented below, along with examples of trajectory and trajectory point information.

[0154] Table 1 Trajectory Information Table

[0155]

[0156] Table 2 Trajectory Point Information Table

[0157]

[0158]

[0159] 2. Feature extraction of moving target trajectory

[0160] Further calculations on the trajectory dataset yield a set of feature attributes for a trajectory of a certain moving target. These attributes include the area traversed by the moving target, average speed, trajectory appearance time, disappearance time, duration of appearance, nearest distance to other moving targets, and nearest distance to hotspot areas. The seven attributes included in this feature attribute set are all features of moving targets for anomaly detection in this invention.

[0161] 2.1 Feature Extraction of Moving Target Trajectory Sequence

[0162] After the activity area is gridded, each trajectory of the moving target is transformed into a sequence based on the region where the trajectory points are located, forming the characteristic attributes of the regions traversed by the moving target trajectory. An example of trajectory sequence-type characteristic information is shown below after analyzing the moving target trajectory data.

[0163] Table 3 Trajectory Sequence Type Feature Information Table

[0164]

[0165] 2.2 Numerical Feature Extraction of Moving Target Trajectory

[0166] Based on the individual trajectories of moving targets and their corresponding trajectory point attributes, the appearance and disappearance times of each trajectory are extracted. The appearance duration, average speed, nearest distance to other moving targets, and nearest distance to hotspot areas of the current trajectory are calculated as numerical features of the moving target trajectory. An example of the numerical feature information of the moving target trajectory data is shown below.

[0167] Table 4. Numerical Feature Information of Trajectory

[0168]

[0169] 3. Anomaly detection of multiple attributes in the trajectory of moving targets

[0170] The abnormal attributes to be detected are divided into two categories: numerical and sequential abnormal attributes. Sequence patterns and clustering classification are used for anomaly detection respectively. The multi-attribute anomaly detection of moving target trajectory includes two parts: anomaly detection of sequential attributes of moving target trajectory and anomaly detection of numerical attributes of moving target trajectory.

[0171] 3.1 Anomaly Detection of Moving Target Trajectory Sequence Attributes

[0172] The algorithm for detecting anomalies in the sequence-type attributes of moving targets first needs to analyze the trajectory data of the moving target and mine its frequently active region sequences as normal patterns for the current moving target's sequence-type attributes. Here, the PrefixSpan algorithm, based on prefix projection, is used for frequent sequence pattern mining.

[0173] Taking moving target A as an example, assuming that within a specified time range, the sequence database Trace obtained by filtering is shown in Table 5 (I1 in the table represents region 1, and so on).

[0174] Table 5. Sequence database of moving target A within a specified time range.

[0175]

[0176]

[0177] Set up support pc =20%, corresponding to sup Δ =2. The steps to obtain the set of frequently active areas of moving target A are as follows:

[0178] (1) The number of visits to each region obtained by scanning the Trace is shown in Table 6.

[0179] Table 6: Number of visits to various areas by mobile target A within a specified time range

[0180]

[0181] Obtain a prefix of length 1: <i1> 、 <i2> 、 <i3> 、 <i4> 、 <i5>Their support counts are the number of times each region is accessed by a specified mobile target, as shown in the table above. The support count is reserved to satisfy the supremacy condition. Δ The sequence that does not meet the requirements is deleted and removed from the active sequence, resulting in a 1-pattern set P. 1 ={ <i1:6> , <i2:7> , <i3:6> , <i4:2> , <i5:2>}

[0182] (2) With P 1 Each element in the sequence is a prefix, and frequent sequences are mined. The correspondence between each prefix and its suffix is ​​as follows: Figure 3 As shown.

[0183] For prefix <i4> 、 <i5>As for it, it has no suffix, therefore there are no frequent sequences with a length greater than 1.

[0184] For prefix <i3>In other words, it only has a suffix. <i5>The support count is 1, which does not meet the sup requirement. Δ ,therefore<I3,I5> It is not a 2-mode.

[0185] For prefix <i2>In other words, counting its suffixes yields { <i5:2> , <i4:2> , <i3:4>}, for the number of supporters, press support Δ Filtering is performed to obtain the 2-pattern set P. 2 The middle part is<I2,I3:4> ,<I2,I4:2> ,<I2,I5:2> .

[0186] For prefix <i1>In other words, counting its suffixes yields { <i2:4> , <i3:4> , <i4:1> , <i5:2>}, for the number of supporters, press support Δ Filtering is performed to obtain the 2-pattern set P. 2 The middle part is<I1,I2:4> ,<I1,I3:4> ,<I1,I5:2> .

[0187] In summary, we obtain the 2-pattern set P. 2 ={<I2,I3:4> ,<I2,I4:2> ,<I2,I5:2> ,<I1,I2:4> ,<I1,I3:4> ,<I1,I5:2>}

[0188] (3) With P 2 Each element in the sequence is a prefix, and frequent sequences are mined. The correspondence between each prefix and its suffix is ​​as follows: Figure 4 As shown.

[0189] Similarly, we can obtain the 3-pattern set P. 3 ={<I1,I2,I3:2> ,<I1,I2,I5:2>}

[0190] (4) With P 3 Each element in the set is a prefix; frequent sequences are mined. If the result is empty, the frequent sequence mining ends. At this point, the sequence pattern set SP for the current moving target is { <i1:6> , <i2:7> , <i3:6> , <i4:2> , <i5:2>,<I2,I3:4> ,<I2,I4:2> ,<I2,I5:2> ,<I1,I2:4> ,<I1,I3:4> ,<I1,I5:2> ,<I1,I2,I3:2> ,<I1,I2,I5:2>}

[0191] (5) Merge sequences with the same prefix in SP, and keep only the longest sequence to obtain the set of frequently active regions of the moving target, LP = {<I1,I2,I3:2> ,<I1,I2,I5:2> ,<I2,I4> :2} means that, within a specified time range, the sequence of frequently active areas of the moving target A is area 1->area 2->area 3, area 1->area 2->area 5, and area 2->area 4.

[0192] For each newly added trajectory of a moving target A, it is converted into an activity sequence and its substring is determined to be a substring of a frequently active area sequence of the moving target A. If no match is found, the area traversed by the newly added trajectory is marked as abnormal and visualized on a map. The result is as follows: Figure 5 As shown, the dashed lines represent abnormal trajectories, and the solid lines represent normal trajectories.

[0193] 3.2 Anomaly Detection of Numerical Attributes of Moving Target Trajectory

[0194] Within a given time interval, this section first uses the Canopy algorithm to calculate the number of clusters, then employs the CLARANS algorithm to cluster different numerical feature attributes of the moving target, thereby constructing a set of normal behavior patterns for the current moving target. Finally, the corresponding attributes in the real-time trajectory data generated by the current moving target are matched with the normal behavior patterns to achieve the purpose of classifying and identifying abnormal trajectories. Examples of the normal behavior pattern table and abnormal trajectory information for the moving target are shown below.

[0195] Table 7 Normal Behavior Patterns of Moving Targets

[0196]

[0197]

[0198] Table 8 Abnormal Trajectory Information Table

[0199]

[0200] The detection results of the numerical attribute anomaly detection algorithm for moving target trajectories are combined with visualization, such as... Figure 6 As shown.

[0201] In its specific implementation, this application provides a computer storage medium and a corresponding data processing unit. The computer storage medium is capable of storing a computer program, which, when executed by the data processing unit, can run the invention's content regarding a multi-attribute anomaly detection method based on moving target trajectory classification, as well as some or all of the steps in various embodiments. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0202] Those skilled in the art will clearly understand that the technical solutions in the embodiments of the present invention can be implemented using computer programs and their corresponding general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of computer programs, i.e., software products. These computer program software products can be stored in a storage medium and include several instructions to cause a device containing a data processing unit (which may be a personal computer, server, microcontroller, MUU, or network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of the present invention.

[0203] This invention provides a concept and method for multi-attribute anomaly detection based on moving target trajectory classification. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment of the invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies. < / i4:2> < / i3:6> < / i2:7> < / i1:6> < / i4:1> < / i3:4> < / i2:4> < / i4:2> < / i5:2> < / i4> < / i4:2> < / i3:6> < / i2:7> < / i1:6> < / i4> < / i3> < / i2> < / i1>

Claims

1. A multi-attribute anomaly detection method based on moving target trajectory classification, characterized in that, Includes the following steps: Step 1, Trajectory Compilation of Moving Target: The original trajectory dataset of the moving target is compiled to construct a trajectory compilation dataset, which includes trajectory data and trajectory point data; the original trajectory dataset of the moving target contains several trajectories, and each trajectory contains several trajectory points; Step 2, Moving target trajectory feature extraction: After further calculation, a set of feature attributes of a trajectory of the moving target is obtained, including: the area traversed by the moving target, average speed, trajectory appearance time, disappearance time, appearance duration, nearest distance to other moving targets, and nearest distance to a preset hotspot area; the attributes contained in the above feature attribute set are the abnormal attributes to be detected; The above-mentioned abnormal attributes to be detected are divided into two categories: numerical and sequential. The sequential type includes: the area traversed by the moving target, and the numerical type includes: average speed, trajectory appearance time, trajectory disappearance time, trajectory appearance duration, nearest distance to other moving targets, and nearest distance to a preset hotspot area. Step 3, Multi-attribute anomaly detection of moving target trajectory: Based on the type of the anomaly attribute to be detected, sequence pattern and clustering classification methods are used for detection to complete the multi-attribute anomaly detection based on moving target trajectory classification; Step 4: Visualize the abnormal data obtained from the detection and provide a basis for emergency decision-making; Step 3 specifically includes: Step 3-1, using sequence patterns to perform anomaly detection on the sequence-type abnormal attributes to be detected, including: Step 3-1-1: Analyze the trajectory data of the moving target and mine the set of frequently active area sequences corresponding to the moving target as the normal pattern of the area traversed by the current moving target; Step 3-1-2, perform anomaly detection: Anomaly detection is completed by comparing the real-time trajectory of the same moving target through the area with the normal pattern described above; Step 3-1-3 updates the set of frequently active area sequences corresponding to the moving target, specifically including: Suppose we have a dataset of moving target trajectories. The newly added trajectory dataset is The updated trajectory dataset is The set of frequently active regions of the currently moving target is as follows: The newly added set of frequently active region sequences is The updated set of frequently active region sequences is ,sequence exist The number of supporters is ,exist The number of supporters is ,exist The number of supporters is The following four scenarios apply to updating the set of frequently active region sequences: Case 1, sequence It belongs to the existing set of frequently active region sequences. It also belongs to the set of newly added frequently active area sequences. ; Case 2, Sequence Belongs to the existing set of frequently active region sequences However, it does not belong to the set of newly added frequently active region sequences. ; Case 3, Sequence Belongs to the set of newly added frequently active region sequences However, it does not belong to the existing set of frequently active region sequences. ; For the three scenarios mentioned above, calculate the number of supports. ,Right now: ； If satisfied Then the sequence Added to the updated set of frequently active region sequences middle; Case 4, Sequence It does not belong to the existing set of frequently active region sequences It also does not belong to the set of newly added frequently active area sequences. Not to be considered; Step 3-2: Use clustering classification methods to detect anomalies in numerical abnormal attributes.

2. The multi-attribute anomaly detection method based on moving target trajectory classification according to claim 1, characterized in that, The motion trajectory compilation dataset constructed in step 1 specifically includes: Trajectory data: This is a dataset describing the activity of a moving target. It consists of several trajectories. The attributes of any trajectory of a moving target include: the unique identifier of the trajectory, the name of the moving target, the time the trajectory appears, and the time the trajectory disappears. Track point data: This is a dataset that describes the details of a specified trajectory of a moving target. A specified trajectory consists of several track points. For the set of track points that constitute the current trajectory, the attributes of any track point include: the unique identifier of the current track point, the unique identifier of the trajectory to which it belongs, longitude, latitude, current time, speed, and altitude.

3. The multi-attribute anomaly detection method based on moving target trajectory classification according to claim 1, characterized in that, Step 2 involves further calculation to obtain a set of feature attributes for a trajectory of the moving target. Specifically, feature extraction is performed based on the category of the anomaly attribute to be detected, including: Step 2-1: Extract sequence-type features from the trajectory of the moving target; Step 2-2: Extract numerical features from the trajectory of the moving target.

4. The multi-attribute anomaly detection method based on moving target trajectory classification according to claim 3, characterized in that, Step 2-1, which describes the extraction of sequence features from the trajectory of the moving target, specifically includes: Step 2-1-1: Calculate the maximum latitude and longitude values ​​among all trajectory points of the moving target. and minimum value ; Step 2-1-2, place the map , , and The area within the four points of latitude and longitude is designated as the activity area of ​​the moving target. Step 2-1-3: Grid the active area of ​​the aforementioned moving target and name each grid area; Step 2-1-4: Convert each trajectory of the moving target into a sequence according to the grid where the trajectory points are located. This allows us to obtain the area traversed by the moving target's trajectory.

5. The multi-attribute anomaly detection method based on moving target trajectory classification according to claim 3, characterized in that, Step 2-2, which describes the numerical feature extraction of the moving target trajectory, specifically includes: Step 2-2-1, let any trajectory of the moving target A be... , ,in Representing the trajectory The first A trajectory point, , This represents the number of trajectory points contained in the trajectory. Step 2-2-2, based on the trajectory occurrence time in the trajectory attributes. and the time of disappearance of the trajectory The duration of the calculated trajectory is as follows: For trajectory points It includes the following attributes: a unique identifier for the current trajectory point. The unique identifier of the trajectory Latitude and longitude of the trajectory point and Current time ,speed ,high and the area where the trajectory point is located. ; For a trajectory of moving target A In terms of the duration of its trajectory for: ； in, The duration of the trajectory; Step 2-2-3: Calculate the average velocity on the current trajectory. ,for: ； in, For the current trajectory, the first The velocity of each trajectory point; Step 2-2-4, the closest distance to other moving targets The calculation method is as follows: ； in, To track The trajectories of moving targets that coexist within a common time interval, and the distance between sampling points at the same instant within that common time interval, Indicates the first One sampling point, namely: ； in, Represents the Earth's radius. and Representing trajectories The latitude and longitude of any of the above sampling points and This represents the latitude and longitude of the sampling point for any moving target other than moving target A at the same moment; Step 2-2-5, the closest distance to the preset hotspot area The calculation method is as follows: ； in, In the trajectory The distance between the sampled area and the preset hotspot area at the sampling point within the time period in which the sampled area appears.

6. The multi-attribute anomaly detection method based on moving target trajectory classification according to claim 5, characterized in that, The distance mentioned in step 2-2-5 The calculation method is as follows: ； in, and This indicates the latitude and longitude of the center of the preset hotspot area.

7. The multi-attribute anomaly detection method based on moving target trajectory classification according to claim 6, characterized in that, Step 3, which describes the detection using sequence patterns and clustering classification methods, specifically includes: Step 3-1, using sequence patterns to perform anomaly detection on the sequence-type abnormal attributes to be detected, including: Step 3-1-1: Analyze the trajectory data of the moving target and mine the set of frequently active area sequences corresponding to the moving target as the normal pattern of the area traversed by the current moving target; Step 3-1-2, perform anomaly detection: Anomaly detection is completed by comparing the real-time trajectory of the same moving target through the area with the normal pattern described above; Step 3-1-3: Update the set of frequently active area sequences corresponding to the moving target; Step 3-2: Apply clustering classification methods to detect anomalies in numerical attributes, including: The normal activity pattern set corresponding to the numerical abnormal attributes to be detected for moving targets is mined, where the normal activity pattern of each attribute corresponds to a numerical value range. The abnormal attributes to be detected for each numerical abnormal attribute of the real-time trajectory of the same moving target are compared with the normal activity pattern of that attribute to complete the anomaly detection. Then the above normal activity pattern set is updated.

8. The multi-attribute anomaly detection method based on moving target trajectory classification according to claim 7, characterized in that, The step 3-1-1 describes mining the set of frequently active regions corresponding to moving targets, which involves using a frequent sequence pattern mining method based on prefix projection to mine the set of frequently active regions of moving targets. The specific method is as follows: Step 3-1-1-1: Based on the name of the moving target and the time interval, filter the moving target trajectory data that meets the conditions, and extract the moving target trajectory sequence features based on the area traversed by the trajectory, i.e., the trajectory activity sequence. Establish a sequence database And sequence database Size Longest sequence length ; Step 3-1-1-2, set the support percentage Then support Scan sequence database Find the condition that the frequency of occurrence is greater than the support. A single item, denoted as a sequence database. of Set, that is , Indicates the first pattern in the set of patterns. One item; Step 3-1-1-3: Traverse the set of patterns 1 ,for Each item Establish a projection database That is, in sequence database The prefix is The set of suffixes for a sequence; Set search parameters And dig within it to prefixed gather That is, in sequence database The number of middle items is greater than the support. The length is The prefix set of the sequence; Increment by 1, repeat step 3-1-1-3, until... or This yields a set of sequence patterns. ; Step 3-1-1-4, based on the sequence pattern set The longest sequence pattern set is obtained by prefix merging. This is the set of frequently active areas of the moving target.

9. A multi-attribute anomaly detection method based on moving target trajectory classification according to claim 8, characterized in that, The anomaly detection described in step 3-1-2 specifically includes: Step 3-1-2-1, for real-time additions The trajectory of a moving target is converted into a sequence. Establish a real-time trajectory dataset ,and ; Step 3-1-2-1, Traverse ,like If the traversal is complete, jump to step 3-1-2-3; otherwise, proceed to step 3-1-2-2. Step 3-1-2-2, Determine the real-time sequence Is it a set of frequently active areas of a moving target? any sequence If it is a substring, then iterate through the real-time trajectory dataset. And continue to judge; otherwise, continue to judge the set of frequently active areas of the moving target. The next sequence in the set, if set After the traversal is complete, Unmatched A substring of any element in the sequence defines the current target trajectory. If an anomaly is detected in the passed-through area, store it in the passed-through area anomaly results table. In the process, traverse the real-time trajectory dataset. And continue to make judgments; Step 3-1-2-3, for the newly added moving target trajectory dataset The trajectory sequence anomaly detection is complete, based on The data in the table will be visualized.

Images