A security monitoring method and system

Abstract

The present invention provides a security monitoring method and system, which relate to the field of data processing technology. In the present invention, the security monitoring data to be processed corresponding to each local monitoring area in the multiple local monitoring areas included in the target monitoring area is collected; for each security monitoring data to be processed, the actual security abnormality degree information of the security monitoring data to be processed is analyzed; in the case where there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, the multiple security monitoring data to be processed are subjected to correlation analysis processing to output multiple correlated actual security abnormality degree information, and the target actual security abnormality degree information belongs to each actual security abnormality degree information that is greater than or equal to the security abnormality degree threshold information. Based on the above method, the reliability of security abnormality analysis can be improved to a certain extent.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a security monitoring method and system. Background Art

[0002] As data processing technology matures, its application scenarios are increasing. For example, image comparison and analysis can be performed based on data processing technology to obtain corresponding analysis results. Specifically, information such as whether there are security anomalies or the degree of security anomalies in the monitoring image data can be compared and analyzed based on data processing technology. However, in the prior art, the security monitoring images to be processed in each area are generally compared and analyzed separately, and then the corresponding analysis results are obtained. Therefore, it is easy to obtain data processing results with low reliability. Summary of the invention

[0003] In view of this, an object of the present invention is to provide a security monitoring method and system to improve the reliability of security anomaly analysis to a certain extent.

[0004] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0005] A security monitoring method, comprising:

[0006] Collecting the security monitoring data to be processed corresponding to each of the multiple local monitoring areas included in the target monitoring area, to obtain multiple security monitoring data to be processed;

[0007] For each of the plurality of security monitoring data to be processed, analyzing the actual security abnormality degree information of the security monitoring data to be processed;

[0008] In the case where there is target actual security abnormality level information among the multiple actual security abnormality level information possessed by the multiple security monitoring data to be processed, the multiple security monitoring data to be processed are subjected to correlation analysis processing to output multiple correlated actual security abnormality level information corresponding to the multiple security monitoring data to be processed, wherein the target actual security abnormality level information belongs to each actual security abnormality level information among the multiple actual security abnormality level information that is greater than or equal to the security abnormality level threshold information.

[0009] In some preferred embodiments, in the above security monitoring method, when there is target actual security abnormality level information among the multiple actual security abnormality level information of the multiple security monitoring data to be processed, the step of performing correlation analysis on the multiple security monitoring data to be processed to output multiple correlated actual security abnormality level information corresponding to the multiple security monitoring data to be processed includes:

[0010] In the case where there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, according to the local monitoring area corresponding to the security monitoring data to be processed, among the multiple local monitoring areas, a relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant regional security monitoring data corresponding to the security monitoring data to be processed;

[0011] By means of a target security data analysis neural network, the security monitoring data to be processed is analyzed and processed to output a security monitoring data description vector corresponding to the security monitoring data to be processed, and the security monitoring data of the relevant area corresponding to the security monitoring data to be processed is analyzed and processed to output a relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0012] Analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed;

[0013] For each of the plurality of security monitoring data to be processed, the associated actual security abnormality degree information corresponding to the security monitoring data to be processed is analyzed based on the associated security monitoring data description vector corresponding to the security monitoring data to be processed.

[0014] In some preferred embodiments, in the above security monitoring method, when there is target actual security abnormality degree information in the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, according to the local monitoring area corresponding to the security monitoring data to be processed, in the multiple local monitoring areas, the relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant area security monitoring data corresponding to the security monitoring data to be processed, the step includes:

[0015] In the case that target actual security abnormality level information exists among the multiple actual security abnormality level information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, based on the regional distribution information of the local monitoring area corresponding to the security monitoring data to be processed, among the multiple local monitoring areas, the relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant regional security monitoring data corresponding to the security monitoring data to be processed, and the regional distribution information at least reflects the regional position of the local monitoring area.

[0016] In some preferred embodiments, in the above security monitoring method, the step of analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed includes:

[0017] Multiplying the security monitoring data description vector corresponding to the security monitoring data to be processed and the security monitoring data description vector to output a corresponding importance characterization parameter matrix, and multiplying the importance characterization parameter matrix and the security monitoring data description vector to output a significant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0018] Multiplying the relevant security monitoring data description vector corresponding to the security monitoring data to be processed and the relevant security monitoring data description vector to output a corresponding relevant importance characterization parameter matrix, and multiplying the relevant importance characterization parameter matrix and the relevant security monitoring data description vector to output a significantly relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0019] The significant security monitoring data description vector and the significant related security monitoring data description vector are weighted superimposed or spliced ​​to form a related security monitoring data description vector corresponding to the security monitoring data to be processed.

[0020] In some preferred embodiments, in the above security monitoring method, the step of analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed includes:

[0021] Multiplying the security monitoring data description vector corresponding to the security monitoring data to be processed and the security monitoring data description vector to output a corresponding importance characterization parameter matrix, and multiplying the importance characterization parameter matrix and the security monitoring data description vector to output a significant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0022] Multiplying the relevant security monitoring data description vector corresponding to the security monitoring data to be processed and the relevant security monitoring data description vector to output a corresponding relevant importance characterization parameter matrix, and multiplying the relevant importance characterization parameter matrix and the relevant security monitoring data description vector to output a significantly relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0023] Performing a first pooling process on the significant security monitoring data description vector to obtain a corresponding first pooled description vector, and performing a second pooling process on the significant security monitoring data description vector to obtain a corresponding second pooled description vector, and aggregating the first pooled description vector and the second pooled description vector to form a corresponding first aggregated security monitoring data description vector, wherein the first pooling process and the second pooling process are different; and aggregating the significant security monitoring data description vector and the significantly related security monitoring data description vector to form a corresponding second aggregated security monitoring data description vector;

[0024] The first aggregated security monitoring data description vector and the second aggregated security monitoring data description vector are superimposed to form a corresponding associated security monitoring data description vector.

[0025] In some preferred embodiments, in the above security monitoring method, the step of aggregating the first pooled description vector and the second pooled description vector to form a corresponding first aggregated security monitoring data description vector includes:

[0026] Based on the vector dimension, the first pooled description vector and the second pooled description vector are combined in terms of vector dimension to form a corresponding first aggregated security monitoring data description vector, wherein the vector dimension of the first aggregated security monitoring data description vector is equal to the sum of the vector dimension of the first pooled description vector and the vector dimension of the second pooled description vector;

[0027] The step of aggregating the significant security monitoring data description vector and the significant related security monitoring data description vector to form a corresponding second aggregated security monitoring data description vector comprises:

[0028] Based on the vector dimension, the significant security monitoring data description vector and the significant related security monitoring data description vector are combined in terms of vector dimension to form a corresponding second aggregated security monitoring data description vector, wherein the vector dimension of the second aggregated security monitoring data description vector is equal to the sum of the vector dimension of the significant security monitoring data description vector and the vector dimension of the significant related security monitoring data description vector.

[0029] In some preferred embodiments, in the above security monitoring method, the step of analyzing the actual security abnormality degree information of each of the plurality of security monitoring data to be processed includes:

[0030] Based on typical security monitoring data, performing network optimization processing on an initial security data analysis network to form a corresponding target security data analysis neural network, wherein the typical security monitoring data includes multiple frames of typical security monitoring images having a time series relationship;

[0031] By means of the target security data analysis neural network, the collected security monitoring data to be processed is analyzed and processed to output a corresponding security monitoring data description vector, wherein the security monitoring data to be processed includes a plurality of frames of security monitoring images to be processed having a time sequence relationship;

[0032] Respectively determining a vector matching degree between the security monitoring data description vector and each of a plurality of pre-configured reference security monitoring data description vectors, each of the reference security monitoring data description vectors being generated based on a reference security monitoring data;

[0033] According to the vector matching degree between the security monitoring data description vector and each of the reference security monitoring data description vectors, and based on the reference security abnormality degree information of the reference security monitoring data corresponding to each of the reference security monitoring data description vectors, the actual security abnormality degree information of the security monitoring data to be processed is determined.

[0034] The embodiment of the present invention further provides a security monitoring system, comprising:

[0035] A monitoring data acquisition module is used to collect the security monitoring data to be processed corresponding to each of the multiple local monitoring areas included in the target monitoring area, and obtain multiple security monitoring data to be processed;

[0036] A first security anomaly analysis module is used to analyze the actual security anomaly degree information of each of the plurality of security monitoring data to be processed to obtain the actual security anomaly degree information of the security monitoring data to be processed;

[0037] The second security anomaly analysis module is used to, when there is target actual security anomaly level information among the multiple actual security anomaly level information of the multiple security monitoring data to be processed, perform correlation analysis on the multiple security monitoring data to be processed, so as to output multiple correlated actual security anomaly level information corresponding to the multiple security monitoring data to be processed, wherein the target actual security anomaly level information belongs to each actual security anomaly level information among the multiple actual security anomaly level information that is greater than or equal to the security anomaly level threshold information.

[0038] In some preferred embodiments, in the above security monitoring system, the second security anomaly analysis module is specifically used to:

[0039] In the case where there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, according to the local monitoring area corresponding to the security monitoring data to be processed, among the multiple local monitoring areas, a relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant regional security monitoring data corresponding to the security monitoring data to be processed;

[0040] By means of a target security data analysis neural network, the security monitoring data to be processed is analyzed and processed to output a security monitoring data description vector corresponding to the security monitoring data to be processed, and the security monitoring data of the relevant area corresponding to the security monitoring data to be processed is analyzed and processed to output a relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0041] Analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed;

[0042] For each of the plurality of security monitoring data to be processed, the associated actual security abnormality degree information corresponding to the security monitoring data to be processed is analyzed based on the associated security monitoring data description vector corresponding to the security monitoring data to be processed.

[0043] In some preferred embodiments, in the above security monitoring system, the step of analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed includes:

[0044] Multiplying the security monitoring data description vector corresponding to the security monitoring data to be processed and the security monitoring data description vector to output a corresponding importance characterization parameter matrix, and multiplying the importance characterization parameter matrix and the security monitoring data description vector to output a significant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0045] Multiplying the relevant security monitoring data description vector corresponding to the security monitoring data to be processed and the relevant security monitoring data description vector to output a corresponding relevant importance characterization parameter matrix, and multiplying the relevant importance characterization parameter matrix and the relevant security monitoring data description vector to output a significantly relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0046] Performing a first pooling process on the significant security monitoring data description vector to obtain a corresponding first pooled description vector, and performing a second pooling process on the significant security monitoring data description vector to obtain a corresponding second pooled description vector, and aggregating the first pooled description vector and the second pooled description vector to form a corresponding first aggregated security monitoring data description vector, wherein the first pooling process and the second pooling process are different; and aggregating the significant security monitoring data description vector and the significantly related security monitoring data description vector to form a corresponding second aggregated security monitoring data description vector;

[0047] The first aggregated security monitoring data description vector and the second aggregated security monitoring data description vector are superimposed to form a corresponding associated security monitoring data description vector.

[0048] A security monitoring method and system provided by an embodiment of the present invention can collect the security monitoring data to be processed corresponding to each of the multiple local monitoring areas included in the target monitoring area; for each security monitoring data to be processed, analyze the actual security abnormality degree information of the security monitoring data to be processed; in the case where there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, the multiple security monitoring data to be processed are subjected to correlation analysis and processing to output multiple correlated actual security abnormality degree information, and the target actual security abnormality degree information belongs to each actual security abnormality degree information that is greater than or equal to the security abnormality degree threshold information. Based on this, a two-level security abnormality analysis can be realized, and thus, the reliability of the security abnormality analysis can be improved to a certain extent.

[0049] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 This is a structural block diagram of the security monitoring platform provided in an embodiment of the present invention.

[0051] Figure 2 A schematic flow chart of the steps included in the security monitoring method provided in an embodiment of the present invention.

[0052] Figure 3 A schematic diagram of various modules included in the security monitoring system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0054] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] like Figure 1 As shown, an embodiment of the present invention provides a security monitoring platform, wherein the security monitoring platform may include a memory and a processor.

[0056] In detail, the memory and the processor are electrically connected directly or indirectly to achieve data transmission or interaction. For example, they can be electrically connected to each other through one or more communication buses or signal lines. The memory may store at least one software function module (computer program) that may exist in the form of software or firmware. The processor may be used to execute the executable computer program stored in the memory, thereby implementing the security monitoring method provided by the embodiment of the present invention.

[0057] Optionally, in some embodiments, the memory may be, but is not limited to, random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (Electric Erasable Programmable Read-Only Memory, EEPROM), etc.

[0058] Optionally, in some embodiments, the processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), a system on chip (SoC), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0059] and, Figure 1 The structure shown is for illustration only. The security monitoring platform may also include Figure 1 More or fewer components as shown, or with Figure 1 The various configurations shown may, for example, include a communication unit for exchanging information with other devices.

[0060] Optionally, in some implementations, the security monitoring platform may be a server with data processing capabilities.

[0061] Combination Figure 2 The embodiment of the present invention further provides a security monitoring method, which can be applied to the above-mentioned security monitoring platform. The method steps defined in the process related to the security monitoring method can be implemented by the security monitoring platform. Figure 2 The specific process shown is explained in detail.

[0062] Step S100, collecting the security monitoring data to be processed corresponding to each of the multiple local monitoring areas included in the target monitoring area, and obtaining multiple security monitoring data to be processed.

[0063] In the embodiment of the present invention, the security monitoring platform can collect the security monitoring data to be processed corresponding to each of the multiple local monitoring areas included in the target monitoring area, and obtain multiple security monitoring data to be processed.

[0064] Step S200: for each of the plurality of security monitoring data to be processed, analyzing the actual security abnormality degree information of the security monitoring data to be processed.

[0065] In the embodiment of the present invention, the security monitoring platform can analyze the actual security abnormality degree information of each security monitoring data to be processed among the plurality of security monitoring data to be processed.

[0066] Step S300, when there is target actual security abnormality level information among the multiple actual security abnormality level information of the multiple security monitoring data to be processed, the multiple security monitoring data to be processed are subjected to correlation analysis and processing to output multiple correlated actual security abnormality level information corresponding to the multiple security monitoring data to be processed.

[0067] In an embodiment of the present invention, the security monitoring platform may, when there is target actual security abnormality level information among the multiple actual security abnormality level information of the multiple security monitoring data to be processed, perform correlation analysis processing on the multiple security monitoring data to be processed to output multiple correlated actual security abnormality level information corresponding to the multiple security monitoring data to be processed. The target actual security abnormality level information belongs to each actual security abnormality level information among the multiple actual security abnormality level information that is greater than or equal to the security abnormality level threshold information.

[0068] Based on this, the above steps S100 to S300 can realize two-level security anomaly analysis, thereby improving the reliability of security anomaly analysis to a certain extent. In addition, in the second-level security anomaly analysis process, the plurality of security monitoring data to be processed are still subjected to correlation analysis, so that the basis for analysis is more sufficient and the reliability can be higher.

[0069] Optionally, in some implementations, step S200 above may further include the following implementation contents, such as including steps S110 to S140.

[0070] Step S110, based on typical security monitoring data, the initial security data analysis network is optimized to form a corresponding target security data analysis neural network.

[0071] In an embodiment of the present invention, the security monitoring platform can perform network optimization processing on the initial security data analysis network based on typical security monitoring data to form a corresponding target security data analysis neural network. The typical security monitoring data includes multiple frames of typical security monitoring images with a time sequence relationship (i.e., with a certain sequence relationship).

[0072] Step S120: analyzing and processing the collected security monitoring data to be processed through the target security data analysis neural network to output a corresponding security monitoring data description vector.

[0073] In an embodiment of the present invention, the security monitoring platform can analyze and process the collected security monitoring data to be processed through the target security data analysis neural network to output a corresponding security monitoring data description vector. The security monitoring data to be processed includes multiple frames of security monitoring images to be processed with a time sequence relationship.

[0074] Step S130 , respectively determining a vector matching degree between the security monitoring data description vector and each of a plurality of pre-configured reference security monitoring data description vectors.

[0075] In an embodiment of the present invention, the security monitoring platform can respectively determine the vector matching degree (such as cosine distance) between the security monitoring data description vector and each of the pre-configured reference security monitoring data description vectors. Each of the reference security monitoring data description vectors is generated based on a reference security monitoring data.

[0076] Step S140, based on the vector matching degree between the security monitoring data description vector and each of the reference security monitoring data description vectors, and based on the reference security abnormality degree information of the reference security monitoring data corresponding to each of the reference security monitoring data description vectors, determine the actual security abnormality degree information of the security monitoring data to be processed.

[0077] In an embodiment of the present invention, the security monitoring platform can determine the actual security abnormality degree information of the security monitoring data to be processed based on the vector matching degree between the security monitoring data description vector and each of the reference security monitoring data description vectors, and based on the reference security abnormality degree information of the reference security monitoring data corresponding to each of the reference security monitoring data description vectors (exemplarily, the reference security abnormality degree information of the reference security monitoring data corresponding to the reference security monitoring data description vector corresponding to the vector matching degree with the maximum value can be used as the actual security abnormality degree information of the security monitoring data to be processed, or, based on the vector matching degree between the security monitoring data description vector and each of the reference security monitoring data description vectors, the reference security abnormality degree information of the reference security monitoring data corresponding to each of the reference security monitoring data description vectors can be weighted summed up to obtain the actual security abnormality degree information of the security monitoring data to be processed).

[0078] Based on this, that is, the above-mentioned steps S110-S140, since the security monitoring data description vector corresponding to the security monitoring data to be processed is first analyzed, and then the security abnormality degree information is determined based on the security monitoring data description vector, that is, a more reliable security abnormality degree information is determined through a more reliable security monitoring data description vector, thereby improving the reliability of security monitoring data processing to a certain extent, and improving the poor reliability problem existing in the prior art.

[0079] Optionally, in some implementations, step S110 above may further include the following implementation contents:

[0080] A typical security monitoring data cluster is extracted, wherein the typical security monitoring data cluster includes at least two typical security monitoring data, each of the typical security monitoring data includes multiple frames of typical security monitoring images with a time sequence relationship, and the correlation between the image semantics corresponding to each two of the typical security monitoring data is less than or equal to a pre-configured reference correlation (that is, the correlation between the image semantics corresponding to each two of the typical security monitoring data is low);

[0081] For a first typical security monitoring data in the typical security monitoring data cluster, combining the first typical security monitoring data with other typical security monitoring data in the typical security monitoring data cluster other than the first typical security monitoring data to form non-correlated complex typical security monitoring data corresponding to the first typical security monitoring data, wherein the first typical security monitoring data belongs to any one of at least two typical security monitoring data included in the typical security monitoring data cluster;

[0082] The initial security data analysis network is optimized by using the non-correlated complex typical security monitoring data corresponding to the first typical security monitoring data to form a corresponding target security data analysis neural network.

[0083] Alternatively, in some implementations, the step of combining the first typical security monitoring data in the typical security monitoring data cluster with other typical security monitoring data in the typical security monitoring data cluster other than the first typical security monitoring data to form non-correlated complex typical security monitoring data corresponding to the first typical security monitoring data may further include the following implementation contents:

[0084] Extracting the most relevant typical security monitoring data corresponding to the first typical security monitoring data from other typical security monitoring data in the typical security monitoring data cluster other than the first typical security monitoring data;

[0085] The most relevant typical security monitoring data is added to the first typical security monitoring data to form non-relevant complex typical security monitoring data corresponding to the first typical security monitoring data.

[0086] Optionally, in some implementations, the step of extracting the most relevant typical security monitoring data corresponding to the first typical security monitoring data from other typical security monitoring data in the typical security monitoring data cluster other than the first typical security monitoring data may further include the following implementation contents:

[0087] Calculating the data difference between each of the other typical security monitoring data and the first typical security monitoring data (the data difference may have a negative correlation with the corresponding image similarity, and the calculation method of the image similarity may refer to the existing related technology);

[0088] Other typical security monitoring data whose data difference is not greater than the pre-configured first reference data difference are marked as the most relevant typical security monitoring data corresponding to the first typical security monitoring data (the first reference data difference can be configured as required).

[0089] Optionally, in some implementations, the step of adding the most relevant typical security monitoring data to the first typical security monitoring data to form non-relevant complex typical security monitoring data corresponding to the first typical security monitoring data may further include the following implementation contents:

[0090] Decomposing the first typical security monitoring data (exemplarily, decomposing may be performed based on image similarity between monitoring images, for example, if the image similarity between two monitoring images is small, the position between the two monitoring images may be used as a decomposition position, i.e., a segmentation position) to form at least one local first typical security monitoring data, wherein the at least one local first typical security monitoring data is combined to form the first typical security monitoring data;

[0091] Calculating the data difference between each of the local first typical security monitoring data and the most relevant typical security monitoring data respectively;

[0092] Based on the coordinates of the local first typical security monitoring data whose data difference is not greater than the pre-configured second reference data difference in the first typical security monitoring data, the most relevant typical security monitoring data is added to the first typical security monitoring data to form non-related complex typical security monitoring data corresponding to the first typical security monitoring data (the specific numerical value of the second reference data difference is not restricted and can be configured according to requirements, that is, although the data difference between the first typical security monitoring data and other typical security monitoring data is relatively large, that is, the image semantic relevance is relatively small, in order to avoid the problem of low discrimination accuracy of the target security data analysis neural network formed by directly performing network optimization based on the first typical security monitoring data and other typical security monitoring data, the most relevant typical security monitoring data is added to the first typical security monitoring data, so that the difference between the formed non-related complex typical security monitoring data and the first typical security monitoring data is smaller, thereby making the discrimination accuracy of the formed target security data analysis neural network higher).

[0093] Optionally, in some implementations, the step of adding the most relevant typical security monitoring data to the first typical security monitoring data to form non-relevant complex typical security monitoring data corresponding to the first typical security monitoring data may further include the following implementation contents:

[0094] Analyzing the most relevant typical security monitoring data to obtain important typical security monitoring data of the most relevant typical security monitoring data (the important typical security monitoring data may refer to part of the most relevant typical security monitoring data, and the data difference between the part of the data and other parts of the data may be the smallest);

[0095] The important typical security monitoring data is added to the first typical security monitoring data to form non-related complex typical security monitoring data corresponding to the first typical security monitoring data (exemplarily, the important typical security monitoring data can be added to any position in the first typical security monitoring data, such as behind the first frame image, etc.).

[0096] Optionally, in some implementations, the step of performing network optimization processing on the initial security data analysis network by using the non-correlated complex typical security monitoring data corresponding to the first typical security monitoring data to form a corresponding target security data analysis neural network may further include the following implementation contents:

[0097] Based on the initial security data analysis network, a first inactivated security data analysis network, a second inactivated security data analysis network and a third inactivated security data analysis network are constructed, wherein the first inactivated security data analysis network, the second inactivated security data analysis network and the third inactivated security data analysis network have different network parameters;

[0098] The first typical security monitoring data is loaded and processed, so as to analyze the corresponding typical security monitoring data description vector using the first inactivated security data analysis network (i.e., to mine key information, such as mapping to a feature space, and then filtering based on a filter matrix, etc.);

[0099] Loading and processing the relevant typical security monitoring data corresponding to the first typical security monitoring data (the relevant typical security monitoring data may be the first typical security monitoring data, that is, the first typical security monitoring data and the first typical security monitoring data are the same data), so as to analyze the corresponding relevant typical security monitoring data description vector by using the second inactivated security data analysis network;

[0100] Loading and processing the non-correlated complex typical security monitoring data corresponding to the first typical security monitoring data, so as to analyze the corresponding non-correlated typical security monitoring data description vector using the third inactivated security data analysis network;

[0101] Analyzing the corresponding degree of difference of relevant data based on the typical security monitoring data description vector and the relevant typical security monitoring data description vector; and analyzing the corresponding degree of difference of non-relevant data based on the typical security monitoring data description vector and the non-relevant typical security monitoring data description vector;

[0102] According to the respective relevant data difference and irrelevant data difference of each of the typical security monitoring data, the initial security data analysis network is subjected to network optimization processing to form a corresponding target security data analysis neural network (exemplarily, the network optimization processing can be performed in the direction of increasing the relevant data difference and reducing the irrelevant data difference).

[0103] Among them, it can be selected that, in some embodiments, the step of constructing the first inactivated security data analysis network, the second inactivated security data analysis network and the third inactivated security data analysis network based on the initial security data analysis network can further include the following implementation contents:

[0104] All network parameters included in the initial security data analysis network are subjected to three arbitrary inactivation processings with target probabilities (that is, the target probabilities of the three inactivation processings are the same, such as 0.1, that is, if the number of all network parameters is 50, the number of inactivated network parameters is 5) to form three inactivated security data analysis networks including a first inactivated security data analysis network, a second inactivated security data analysis network and a third inactivated security data analysis network, and the inactivated network parameters of the three inactivated security data analysis networks are not exactly the same.

[0105] Among them, it can be selected that, in some embodiments, the step of performing network optimization processing on the initial security data analysis network through the non-correlated complex typical security monitoring data corresponding to the first typical security monitoring data to form the corresponding target security data analysis neural network can further include the following implementation contents:

[0106] Based on the initial security data analysis network, a first inactivated security data analysis network, a second inactivated security data analysis network, a third inactivated security data analysis network and a fourth inactivated security data analysis network are constructed, wherein the first inactivated security data analysis network, the second inactivated security data analysis network, the third inactivated security data analysis network and the fourth inactivated security data analysis network have different network parameters (such as different inactivated network parameters);

[0107] The first typical security monitoring data is loaded and processed, so as to analyze the corresponding typical security monitoring data description vector using the first inactivated security data analysis network (i.e., to mine key information, such as mapping to a feature space, and then filtering based on a filter matrix, etc.);

[0108] Loading and processing the relevant typical security monitoring data corresponding to the first typical security monitoring data (the relevant typical security monitoring data may be the first typical security monitoring data, that is, the first typical security monitoring data and the first typical security monitoring data are the same data), so as to analyze the corresponding relevant typical security monitoring data description vector by using the second inactivated security data analysis network;

[0109] Loading and processing the non-correlated complex typical security monitoring data corresponding to the first typical security monitoring data, so as to analyze the corresponding non-correlated typical security monitoring data description vector using the third inactivated security data analysis network;

[0110] Loading and processing the non-correlated simple typical security monitoring data corresponding to the first typical security monitoring data (the non-correlated simple typical security monitoring data may be other typical security monitoring data other than the first typical security monitoring data in the typical security monitoring data cluster), so as to analyze the corresponding other non-correlated typical security monitoring data description vectors by using the fourth inactivated security data analysis network;

[0111] Based on the typical security monitoring data description vector and the relevant typical security monitoring data description vector, the corresponding relevant data difference is analyzed; and, based on the typical security monitoring data description vector and the relevant typical security monitoring data description vector, the corresponding non-relevant data difference is analyzed; and, based on the typical security monitoring data description vector and the relevant other non-relevant typical security monitoring data description vector, the corresponding other non-relevant data difference is analyzed;

[0112] According to the respective relevant data differences and irrelevant data differences of each of the typical security monitoring data, the initial security data analysis network is subjected to network optimization processing to form a corresponding target security data analysis neural network (exemplarily, the network optimization can be performed in the direction of increasing the relevant data difference, reducing the irrelevant data difference, and reducing other irrelevant data differences).

[0113] Optionally, in some implementations, step S300 above may further include the following implementation contents:

[0114] In the case where there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, according to the local monitoring area corresponding to the security monitoring data to be processed, among the multiple local monitoring areas, a relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant regional security monitoring data corresponding to the security monitoring data to be processed;

[0115] By means of a target security data analysis neural network, the security monitoring data to be processed is analyzed and processed to output a security monitoring data description vector corresponding to the security monitoring data to be processed, and the security monitoring data of the relevant area corresponding to the security monitoring data to be processed is analyzed and processed to output a relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0116] Analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed;

[0117] For each of the multiple security monitoring data to be processed, the associated actual security abnormality degree information corresponding to the security monitoring data to be processed is analyzed based on the associated security monitoring data description vector corresponding to the security monitoring data to be processed (the associated actual security abnormality degree information is analyzed based on the associated security monitoring data description vector, and the relevant steps in step S200 can be referred to, or the associated security monitoring data description vector can be predictively analyzed based on a relevant neural network to obtain the associated actual security abnormality degree information).

[0118] Optionally, in some embodiments, when there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, according to the local monitoring area corresponding to the security monitoring data to be processed, the step of determining the relevant local monitoring area corresponding to the security monitoring data to be processed among the multiple local monitoring areas, and marking the security monitoring data to be processed corresponding to the relevant local monitoring area as the security monitoring data of the relevant area corresponding to the security monitoring data to be processed, may further include the following implementation contents:

[0119] In the case that target actual security abnormality level information exists among the multiple actual security abnormality level information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, based on the regional distribution information of the local monitoring area corresponding to the security monitoring data to be processed, among the multiple local monitoring areas, the relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant regional security monitoring data corresponding to the security monitoring data to be processed, and the regional distribution information at least reflects the regional position of the local monitoring area (such as determining a local monitoring area with the closest regional position as the relevant local monitoring area).

[0120] Optionally, in some implementations, the step of analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed may further include the following implementation contents:

[0121] Multiplying the security monitoring data description vector corresponding to the security monitoring data to be processed and the security monitoring data description vector to output a corresponding importance characterization parameter matrix, and multiplying the importance characterization parameter matrix and the security monitoring data description vector to output a significant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0122] Multiplying the relevant security monitoring data description vector corresponding to the security monitoring data to be processed and the relevant security monitoring data description vector to output a corresponding relevant importance characterization parameter matrix, and multiplying the relevant importance characterization parameter matrix and the relevant security monitoring data description vector to output a significantly relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0123] The significant security monitoring data description vector and the significant related security monitoring data description vector are weighted superimposed or spliced ​​to form a related security monitoring data description vector corresponding to the security monitoring data to be processed.

[0124] Optionally, in some implementations, the step of analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed may further include the following implementation contents:

[0125] Multiplying the security monitoring data description vector corresponding to the security monitoring data to be processed and the security monitoring data description vector to output a corresponding importance characterization parameter matrix, and multiplying the importance characterization parameter matrix and the security monitoring data description vector to output a significant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0126] Multiplying the relevant security monitoring data description vector corresponding to the security monitoring data to be processed and the relevant security monitoring data description vector to output a corresponding relevant importance characterization parameter matrix, and multiplying the relevant importance characterization parameter matrix and the relevant security monitoring data description vector to output a significantly relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0127] Performing a first pooling process on the significant security monitoring data description vector to obtain a corresponding first pooled description vector, and performing a second pooling process on the significant security monitoring data description vector to obtain a corresponding second pooled description vector (the specific pooling types of the first pooling process and the second pooling process are not limited, and can be any two different pooling processes), and aggregating the first pooled description vector and the second pooled description vector to form a corresponding first aggregated security monitoring data description vector, wherein the first pooling process and the second pooling process are different; and aggregating the significant security monitoring data description vector and the significantly related security monitoring data description vector to form a corresponding second aggregated security monitoring data description vector;

[0128] The first aggregated security monitoring data description vector and the second aggregated security monitoring data description vector are superimposed to form a corresponding associated security monitoring data description vector.

[0129] Optionally, in some implementations, the step of aggregating the first pooled description vector and the second pooled description vector to form a corresponding first aggregated security monitoring data description vector may further include the following implementation contents:

[0130] Based on the vector dimension, the first pooled description vector and the second pooled description vector are combined in terms of vector dimension to form a corresponding first aggregated security monitoring data description vector, wherein the vector dimension of the first aggregated security monitoring data description vector is equal to the sum of the vector dimension of the first pooled description vector and the vector dimension of the second pooled description vector.

[0131] Optionally, in some embodiments, the step of aggregating the significant security monitoring data description vector and the significant related security monitoring data description vector to form a corresponding second aggregated security monitoring data description vector may include the following implementation contents:

[0132] Based on the vector dimension, the significant security monitoring data description vector and the significant related security monitoring data description vector are combined in terms of vector dimension to form a corresponding second aggregated security monitoring data description vector, wherein the vector dimension of the second aggregated security monitoring data description vector is equal to the sum of the vector dimension of the significant security monitoring data description vector and the vector dimension of the significant related security monitoring data description vector.

[0133] Combination Figure 3 The embodiment of the present invention further provides a security monitoring system, which can be applied to the above security monitoring platform. The security monitoring system may include:

[0134] A monitoring data acquisition module is used to collect the security monitoring data to be processed corresponding to each of the multiple local monitoring areas included in the target monitoring area, and obtain multiple security monitoring data to be processed;

[0135] A first security anomaly analysis module is used to analyze the actual security anomaly degree information of each of the plurality of security monitoring data to be processed to obtain the actual security anomaly degree information of the security monitoring data to be processed;

[0136] The second security anomaly analysis module is used to, when there is target actual security anomaly level information among the multiple actual security anomaly level information of the multiple security monitoring data to be processed, perform correlation analysis on the multiple security monitoring data to be processed, so as to output multiple correlated actual security anomaly level information corresponding to the multiple security monitoring data to be processed, wherein the target actual security anomaly level information belongs to each actual security anomaly level information among the multiple actual security anomaly level information that is greater than or equal to the security anomaly level threshold information.

[0137] Optionally, in some implementations, the second security anomaly analysis module is specifically used to:

[0138] In the case where there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, according to the local monitoring area corresponding to the security monitoring data to be processed, among the multiple local monitoring areas, a relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant regional security monitoring data corresponding to the security monitoring data to be processed;

[0139] By means of a target security data analysis neural network, the security monitoring data to be processed is analyzed and processed to output a security monitoring data description vector corresponding to the security monitoring data to be processed, and the security monitoring data of the relevant area corresponding to the security monitoring data to be processed is analyzed and processed to output a relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0140] Analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed;

[0141] For each of the plurality of security monitoring data to be processed, the associated actual security abnormality degree information corresponding to the security monitoring data to be processed is analyzed based on the associated security monitoring data description vector corresponding to the security monitoring data to be processed.

[0142] Optionally, in some implementations, the step of analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed includes:

[0143] Multiplying the security monitoring data description vector corresponding to the security monitoring data to be processed and the security monitoring data description vector to output a corresponding importance characterization parameter matrix, and multiplying the importance characterization parameter matrix and the security monitoring data description vector to output a significant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0144] Multiplying the relevant security monitoring data description vector corresponding to the security monitoring data to be processed and the relevant security monitoring data description vector to output a corresponding relevant importance characterization parameter matrix, and multiplying the relevant importance characterization parameter matrix and the relevant security monitoring data description vector to output a significantly relevant security monitoring data description vector corresponding to the security monitoring data to be processed;

[0145] Performing a first pooling process on the significant security monitoring data description vector to obtain a corresponding first pooled description vector, and performing a second pooling process on the significant security monitoring data description vector to obtain a corresponding second pooled description vector, and aggregating the first pooled description vector and the second pooled description vector to form a corresponding first aggregated security monitoring data description vector, wherein the first pooling process and the second pooling process are different; and aggregating the significant security monitoring data description vector and the significantly related security monitoring data description vector to form a corresponding second aggregated security monitoring data description vector;

[0146] The first aggregated security monitoring data description vector and the second aggregated security monitoring data description vector are superimposed to form a corresponding associated security monitoring data description vector.

[0147] In summary, the security monitoring method and system provided by the present invention can collect the security monitoring data to be processed corresponding to each of the multiple local monitoring areas included in the target monitoring area; for each security monitoring data to be processed, analyze the actual security abnormality degree information of the security monitoring data to be processed; in the case where there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, the multiple security monitoring data to be processed are subjected to correlation analysis and processing to output multiple correlated actual security abnormality degree information, and the target actual security abnormality degree information belongs to each actual security abnormality degree information that is greater than or equal to the security abnormality degree threshold information. Based on this, two-level security abnormality analysis can be realized, and thus, the reliability of security abnormality analysis can be improved to a certain extent.

[0148] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A security monitoring method, characterized in that: include: Collecting the security monitoring data to be processed corresponding to each of the multiple local monitoring areas included in the target monitoring area, to obtain multiple security monitoring data to be processed; For each of the plurality of security monitoring data to be processed, analyzing the actual security abnormality degree information of the security monitoring data to be processed; In the case where there is target actual security abnormality level information among the multiple actual security abnormality level information of the multiple security monitoring data to be processed, the multiple security monitoring data to be processed are subjected to correlation analysis processing to output multiple correlated actual security abnormality level information corresponding to the multiple security monitoring data to be processed, wherein the target actual security abnormality level information belongs to each actual security abnormality level information among the multiple actual security abnormality level information that is greater than or equal to the security abnormality level threshold information; The step of analyzing the actual security abnormality degree information of each of the plurality of security monitoring data to be processed includes: Based on typical security monitoring data, performing network optimization processing on an initial security data analysis network to form a corresponding target security data analysis neural network, wherein the typical security monitoring data includes multiple frames of typical security monitoring images having a time series relationship; By means of the target security data analysis neural network, the collected security monitoring data to be processed is analyzed and processed to output a corresponding security monitoring data description vector, wherein the security monitoring data to be processed includes a plurality of frames of security monitoring images to be processed having a time sequence relationship; Respectively determining a vector matching degree between the security monitoring data description vector and each of a plurality of pre-configured reference security monitoring data description vectors, each of the reference security monitoring data description vectors being generated based on a reference security monitoring data; According to the vector matching degree between the security monitoring data description vector and each of the reference security monitoring data description vectors, and based on the reference security abnormality degree information of the reference security monitoring data corresponding to each of the reference security monitoring data description vectors, determining the actual security abnormality degree information of the security monitoring data to be processed; Among them, when there is target actual security abnormality level information among the multiple actual security abnormality level information of the multiple security monitoring data to be processed, the step of performing correlation analysis on the multiple security monitoring data to be processed to output multiple correlated actual security abnormality level information corresponding to the multiple security monitoring data to be processed includes: In the case where there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, according to the local monitoring area corresponding to the security monitoring data to be processed, among the multiple local monitoring areas, a relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant regional security monitoring data corresponding to the security monitoring data to be processed; By means of a target security data analysis neural network, the security monitoring data to be processed is analyzed and processed to output a security monitoring data description vector corresponding to the security monitoring data to be processed, and the security monitoring data of the relevant area corresponding to the security monitoring data to be processed is analyzed and processed to output a relevant security monitoring data description vector corresponding to the security monitoring data to be processed; Analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed; For each of the plurality of security monitoring data to be processed, analyzing the associated actual security abnormality degree information corresponding to the security monitoring data to be processed according to the associated security monitoring data description vector corresponding to the security monitoring data to be processed; Wherein, the step of analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed comprises: Multiplying the security monitoring data description vector corresponding to the security monitoring data to be processed and the security monitoring data description vector to output a corresponding importance characterization parameter matrix, and multiplying the importance characterization parameter matrix and the security monitoring data description vector to output a significant security monitoring data description vector corresponding to the security monitoring data to be processed; Multiplying the relevant security monitoring data description vector corresponding to the security monitoring data to be processed and the relevant security monitoring data description vector to output a corresponding relevant importance characterization parameter matrix, and multiplying the relevant importance characterization parameter matrix and the relevant security monitoring data description vector to output a significantly relevant security monitoring data description vector corresponding to the security monitoring data to be processed; Performing a first pooling process on the significant security monitoring data description vector to obtain a corresponding first pooled description vector, and performing a second pooling process on the significant security monitoring data description vector to obtain a corresponding second pooled description vector, and aggregating the first pooled description vector and the second pooled description vector to form a corresponding first aggregated security monitoring data description vector, wherein the first pooling process and the second pooling process are different; and aggregating the significant security monitoring data description vector and the significantly related security monitoring data description vector to form a corresponding second aggregated security monitoring data description vector; The first aggregated security monitoring data description vector and the second aggregated security monitoring data description vector are superimposed to form a corresponding associated security monitoring data description vector.

2. The security monitoring method according to claim 1, characterized in that: In the case that there is target actual security abnormality degree information in the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, according to the local monitoring area corresponding to the security monitoring data to be processed, the relevant local monitoring area corresponding to the security monitoring data to be processed is determined in the multiple local monitoring areas, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant area security monitoring data corresponding to the security monitoring data to be processed, including: In the case that target actual security abnormality level information exists among the multiple actual security abnormality level information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, based on the regional distribution information of the local monitoring area corresponding to the security monitoring data to be processed, among the multiple local monitoring areas, the relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant regional security monitoring data corresponding to the security monitoring data to be processed, and the regional distribution information at least reflects the regional position of the local monitoring area.

3. The security monitoring method according to claim 1, characterized in that: The step of analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed comprises: Multiplying the security monitoring data description vector corresponding to the security monitoring data to be processed and the security monitoring data description vector to output a corresponding importance characterization parameter matrix, and multiplying the importance characterization parameter matrix and the security monitoring data description vector to output a significant security monitoring data description vector corresponding to the security monitoring data to be processed; Multiplying the relevant security monitoring data description vector corresponding to the security monitoring data to be processed and the relevant security monitoring data description vector to output a corresponding relevant importance characterization parameter matrix, and multiplying the relevant importance characterization parameter matrix and the relevant security monitoring data description vector to output a significantly relevant security monitoring data description vector corresponding to the security monitoring data to be processed; The significant security monitoring data description vector and the significant related security monitoring data description vector are weighted superimposed or spliced ​​to form a related security monitoring data description vector corresponding to the security monitoring data to be processed.

4. The security monitoring method according to claim 1, characterized in that: The step of aggregating the first pooled description vector and the second pooled description vector to form a corresponding first aggregated security monitoring data description vector includes: Based on the vector dimension, the first pooled description vector and the second pooled description vector are combined in terms of vector dimension to form a corresponding first aggregated security monitoring data description vector, wherein the vector dimension of the first aggregated security monitoring data description vector is equal to the sum of the vector dimension of the first pooled description vector and the vector dimension of the second pooled description vector; The step of aggregating the significant security monitoring data description vector and the significant related security monitoring data description vector to form a corresponding second aggregated security monitoring data description vector comprises: Based on the vector dimension, the significant security monitoring data description vector and the significant related security monitoring data description vector are combined in terms of vector dimension to form a corresponding second aggregated security monitoring data description vector, wherein the vector dimension of the second aggregated security monitoring data description vector is equal to the sum of the vector dimension of the significant security monitoring data description vector and the vector dimension of the significant related security monitoring data description vector.

5. A security monitoring system, characterized in that: include: A monitoring data acquisition module is used to collect the security monitoring data to be processed corresponding to each of the multiple local monitoring areas included in the target monitoring area, and obtain multiple security monitoring data to be processed; A first security anomaly analysis module is used to analyze the actual security anomaly degree information of each of the plurality of security monitoring data to be processed to obtain the actual security anomaly degree information of the security monitoring data to be processed; a second security anomaly analysis module, configured to, when there is target actual security anomaly level information among the multiple actual security anomaly level information of the multiple security monitoring data to be processed, perform correlation analysis processing on the multiple security monitoring data to be processed, so as to output multiple correlated actual security anomaly level information corresponding to the multiple security monitoring data to be processed, wherein the target actual security anomaly level information belongs to each actual security anomaly level information among the multiple actual security anomaly level information that is greater than or equal to the security anomaly level threshold information; The step of analyzing the actual security abnormality degree information of each of the plurality of security monitoring data to be processed includes: Based on typical security monitoring data, performing network optimization processing on an initial security data analysis network to form a corresponding target security data analysis neural network, wherein the typical security monitoring data includes multiple frames of typical security monitoring images having a time series relationship; By means of the target security data analysis neural network, the collected security monitoring data to be processed is analyzed and processed to output a corresponding security monitoring data description vector, wherein the security monitoring data to be processed includes a plurality of frames of security monitoring images to be processed having a time sequence relationship; Respectively determining a vector matching degree between the security monitoring data description vector and each of a plurality of pre-configured reference security monitoring data description vectors, each of the reference security monitoring data description vectors being generated based on a reference security monitoring data; According to the vector matching degree between the security monitoring data description vector and each of the reference security monitoring data description vectors, and based on the reference security abnormality degree information of the reference security monitoring data corresponding to each of the reference security monitoring data description vectors, the actual security abnormality degree information of the security monitoring data to be processed is determined. Wherein, the second security anomaly analysis module is specifically used for: In the case where there is target actual security abnormality degree information among the multiple actual security abnormality degree information of the multiple security monitoring data to be processed, for each of the multiple security monitoring data to be processed, according to the local monitoring area corresponding to the security monitoring data to be processed, among the multiple local monitoring areas, a relevant local monitoring area corresponding to the security monitoring data to be processed is determined, and the security monitoring data to be processed corresponding to the relevant local monitoring area is marked as the relevant regional security monitoring data corresponding to the security monitoring data to be processed; By means of a target security data analysis neural network, the security monitoring data to be processed is analyzed and processed to output a security monitoring data description vector corresponding to the security monitoring data to be processed, and the security monitoring data of the relevant area corresponding to the security monitoring data to be processed is analyzed and processed to output a relevant security monitoring data description vector corresponding to the security monitoring data to be processed; Analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed; For each of the plurality of security monitoring data to be processed, analyzing the associated actual security abnormality degree information corresponding to the security monitoring data to be processed according to the associated security monitoring data description vector corresponding to the security monitoring data to be processed; Wherein, the step of analyzing the associated security monitoring data description vector corresponding to the security monitoring data to be processed based on the security monitoring data description vector corresponding to the security monitoring data to be processed and the associated security monitoring data description vector corresponding to the security monitoring data to be processed includes: Multiplying the security monitoring data description vector corresponding to the security monitoring data to be processed and the security monitoring data description vector to output a corresponding importance characterization parameter matrix, and multiplying the importance characterization parameter matrix and the security monitoring data description vector to output a significant security monitoring data description vector corresponding to the security monitoring data to be processed; Multiplying the relevant security monitoring data description vector corresponding to the security monitoring data to be processed and the relevant security monitoring data description vector to output a corresponding relevant importance characterization parameter matrix, and multiplying the relevant importance characterization parameter matrix and the relevant security monitoring data description vector to output a significantly relevant security monitoring data description vector corresponding to the security monitoring data to be processed; Performing a first pooling process on the significant security monitoring data description vector to obtain a corresponding first pooled description vector, and performing a second pooling process on the significant security monitoring data description vector to obtain a corresponding second pooled description vector, and aggregating the first pooled description vector and the second pooled description vector to form a corresponding first aggregated security monitoring data description vector, wherein the first pooling process and the second pooling process are different; and aggregating the significant security monitoring data description vector and the significantly related security monitoring data description vector to form a corresponding second aggregated security monitoring data description vector; The first aggregated security monitoring data description vector and the second aggregated security monitoring data description vector are superimposed to form a corresponding associated security monitoring data description vector.

Images