Big data analysis method and system applied to intelligent security and protection and cloud server

Abstract

The invention discloses a big data analysis method and system applied to intelligent security and protection and a cloud server, and the method comprises the steps: obtaining image data, audio data and sensor data, carrying out the calculation of a similarity matrix and a distance matrix, and obtaining the similarity matrix and the distance matrix; initializing a sparse matrix and performing heuristic clustering to obtain a sparse connected graph; performing space-time depth feature extraction and graph structure feature extraction on the sparse connected graph to obtain a space-time depth feature and a graph structure feature, and inputting the space-time depth feature and the graph structure feature into a pre-trained anomaly detection model to obtain an anomaly score; when it is judged that the abnormal score is larger than a preset abnormal threshold value, an alarm instruction is generated and sent to the user side; according to the anomaly detection model, historical data and a standard anomaly score serve as input data, an initial anomaly detection model is constructed, the initial anomaly detection model is trained, and the anomaly detection model is obtained. According to the method, real-time detection and accurate early warning of abnormal events can be realized, and data security is ensured.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a big data analysis method, system and cloud server applied to smart security. Background Art

[0002] With the advancement of smart city construction, smart security systems play an important role in ensuring public safety and improving urban management. Smart security systems need to process a large amount of multimodal data, including images, audio, and various sensor data, to achieve real-time monitoring and early warning of abnormal events. However, traditional security systems face huge challenges in efficiently processing and accurately analyzing massive amounts of data.

[0003] At present, existing technologies mainly address the above needs through the following methods: First, using deep learning-based image recognition technology to process and analyze images captured by surveillance cameras to detect abnormal behavior. Second, using audio recognition technology to analyze audio data in the environment and detect abnormal audio events. In addition, using sensor data, such as temperature, humidity, and motion sensors, to monitor environmental changes and human movement.

[0004] Existing technologies have poor accuracy and real-time performance in complex environments, are prone to false positives or omissions, lack effective data protection mechanisms, and are unable to guarantee data security. Summary of the invention

[0005] The present invention provides a big data analysis method, system and cloud server applied to smart security, so as to realize real-time and accurate detection and early warning of abnormal events and ensure data security.

[0006] In the first aspect, in order to solve the above technical problems, the present invention provides a big data analysis method applied to smart security, comprising: Acquire image data and audio data collected by monitoring camera equipment and sensor data collected by sensor equipment; Perform similarity matrix calculation and distance matrix calculation according to the image data, the audio data and the sensor data to obtain a similarity matrix and a distance matrix; Initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph; According to the sparse connected graph, performing spatiotemporal depth feature extraction and graph structure feature extraction to obtain spatiotemporal depth features and graph structure features; Inputting the spatiotemporal depth features and the graph structure features into a pre-trained anomaly detection model to obtain an anomaly score; When it is determined that the abnormality score is greater than a preset abnormality threshold, an alarm instruction is generated and sent to the user terminal; The anomaly detection model is based on the spatiotemporal depth features and graph structure features of historical data and standard anomaly scores as input data, constructs an initial anomaly detection model, and trains the initial anomaly detection model to obtain an anomaly detection model.

[0007] As an optional implementation manner, the similarity matrix calculation and the distance matrix calculation are performed according to the image data, the audio data and the sensor data to obtain the similarity matrix and the distance matrix, including: Performing a feature extraction operation according to the image data, the audio data and the sensor data to obtain a feature vector, and normalizing the feature vector; According to the normalized eigenvectors, directed similarity calculation is performed to obtain the similarity matrix and distance matrix.

[0008] As an optional implementation manner, the step of initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph includes: Initializing a sparse matrix according to the similarity matrix and the distance matrix; Performing a heuristic clustering operation according to the sparse matrix to group the nodes to obtain a plurality of clusters; Obtaining a sparse connected graph according to the clustering clusters and the clustering results; The elements of the sparse matrix represent the connection strength between nodes, each node in the sparse connected graph represents a cluster, and the edges represent the connection relationship between clusters.

[0009] As an optional implementation, performing spatiotemporal depth feature extraction and graph structure feature extraction according to the sparse connected graph to obtain spatiotemporal depth features and graph structure features includes: Based on the sparse connected graph, extracting spatiotemporal depth features through a temporal convolution layer and a spatial convolution layer to obtain spatiotemporal depth features; Based on the sparse connected graph and the spatiotemporal depth features, a complex network measurement calculation is performed to obtain graph structure features; The complex network metrics include average path length, clustering coefficient, density, and node degree entropy.

[0010] As an optional implementation, the extracting spatiotemporal depth features through a temporal convolution layer and a spatial convolution layer based on the sparse connected graph to obtain the spatiotemporal depth features includes: The calculation formula of the temporal convolutional layer is as follows:

[0011] in, is sparse connected graph data, obtained by performing graph clustering on the image data, the audio data, and the sensor data; It is a temporal depth feature, which is used to represent the correlation of each timestamp in the monitoring data; is the sigmoid activation function; and is a learnable parameter; It is Hadamard; It is the convolutional attention calculated based on the input sparse connected graph data, which is used to represent the importance weight of each timestamp in the monitoring data; The feature extraction calculation formula of the spatial convolution layer is as follows:

[0012] in, It is the matrix concatenation operation; and For the Nodes of a layer sparsely connected graph and The characteristic variable is used to represent the characteristic value of the current position of the monitoring data; is the attention function; is the sigmoid activation function, It is a spatial deep feature used to represent complex patterns and structures in surveillance data; is the number of attention heads.

[0013] As an optional implementation, the spatiotemporal depth features and graph structure features based on historical data and the standard anomaly score are used as input data to construct an initial anomaly detection model, and the initial anomaly detection model is trained to obtain an anomaly detection model, including: Obtain the spatiotemporal depth features and graph structure features in historical data and the corresponding standard anomaly scores; Taking the spatiotemporal depth features, the graph structure features and the standard anomaly score as input data, and building an initial anomaly detection model based on an autoencoder model; Based on the initial anomaly detection model, the model is trained by iteratively optimizing the weights and biases of the encoder and decoder; When the number of training times is greater than or equal to the preset maximum number of training times, the training is determined to be completed and an anomaly detection model is obtained.

[0014] As an optional implementation manner, when it is determined that the abnormality score is greater than a preset abnormality threshold, generating an alarm instruction and sending the alarm instruction to the user terminal includes: Obtaining anomaly detection scores and anomaly location data obtained from the anomaly detection model; Compare the anomaly detection score with a preset anomaly threshold to determine whether the anomaly detection score is higher than the preset anomaly threshold; When it is determined that the anomaly detection score is higher than the preset anomaly threshold, an alarm instruction is generated and sent to the user terminal through a pre-configured communication channel; The alarm location is marked on the user-side map according to the abnormal location data, and an abnormal alarm is issued.

[0015] As an optional implementation, the method further includes: Data encryption and data anonymization are performed based on the image data, the audio data, and the sensor data to generate an encrypted data packet.

[0016] In a second aspect, the present invention provides a big data analysis system for smart security, comprising: A data acquisition module, used to acquire image data and audio data collected by monitoring camera equipment and sensor data collected by sensor equipment; A matrix calculation module, used to perform similarity matrix calculation and distance matrix calculation according to the image data, the audio data and the sensor data to obtain a similarity matrix and a distance matrix; A graph clustering module, used for initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph; A feature extraction module, used to extract spatiotemporal depth features and graph structure features according to the sparse connected graph, to obtain spatiotemporal depth features and graph structure features; An anomaly detection module, used for inputting the spatiotemporal depth features and the graph structure features into a pre-trained anomaly detection model to obtain an anomaly score; The abnormality alarm module is used to generate an alarm instruction when it is determined that the abnormality score is greater than a preset abnormality threshold, and send the alarm instruction to the user end so that the user can understand the abnormal situation in time and take corresponding countermeasures; The model training module is used to construct an initial anomaly detection model based on the spatiotemporal depth features and graph structure features of historical data and the standard anomaly score as input data, and train the initial anomaly detection model to obtain an anomaly detection model.

[0017] In a third aspect, the present invention also provides a cloud server, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the big data analysis method applied to smart security as described in any one of the above items.

[0018] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides a big data analysis method applied to smart security, comprising: acquiring image data, audio data collected by a monitoring camera device, and sensor data collected by a sensor device; performing similarity matrix calculation and distance matrix calculation according to the image data, the audio data, and the sensor data to obtain a similarity matrix and a distance matrix; initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph; performing spatiotemporal depth feature extraction and graph structure feature extraction according to the sparse connected graph to obtain spatiotemporal depth features and graph structure features; inputting the spatiotemporal depth features and the graph structure features into a pre-trained anomaly detection model to obtain anomaly scores; when it is determined that the anomaly score is greater than a preset anomaly threshold, generating an alarm instruction, and sending the alarm instruction to a user end; wherein the anomaly detection model is based on the spatiotemporal depth features and graph structure features of historical data and a standard anomaly score as input data, constructing an initial anomaly detection model, and training the initial anomaly detection model to obtain an anomaly detection model. The method extracts spatiotemporal features from historical multimodal monitoring data, trains an anomaly detection model, uses the anomaly detection model to perform real-time detection and encrypt data, thereby achieving real-time and accurate detection and early warning of abnormal events and ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a flowchart of a big data analysis method applied to smart security provided by an embodiment of the present invention; Figure 2 It is a flowchart of a big data analysis system applied to smart security provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] With the advancement of smart city construction, smart security systems play an important role in ensuring public safety and improving urban management. Smart security systems need to process a large amount of multimodal data, including images, audio, and various sensor data, to achieve real-time monitoring and early warning of abnormal events. However, in the face of efficient processing and accurate analysis of massive data, traditional security systems face huge challenges.

[0022] At present, existing technologies mainly address the above needs through the following methods: First, using deep learning-based image recognition technology to process and analyze images captured by surveillance cameras to detect abnormal behavior. Second, using audio recognition technology to analyze audio data in the environment and detect abnormal audio events. In addition, using sensor data, such as temperature, humidity, and motion sensors, to monitor environmental changes and human movement.

[0023] Existing technologies have poor accuracy and real-time performance in complex environments, are prone to false positives or omissions, lack effective data protection mechanisms, and are unable to guarantee data security.

[0024] In order to solve the above problems, a big data analysis method applied to smart security provided by an embodiment of the present application will be introduced and explained in detail through the following specific embodiments.

[0025] Reference Figure 1 The first embodiment of the present invention provides a big data analysis method for smart security, comprising the following steps: S11, acquiring image data and audio data collected by a monitoring camera device and sensor data collected by a sensor device; S12, performing similarity matrix calculation and distance matrix calculation according to the image data, the audio data and the sensor data to obtain a similarity matrix and a distance matrix; S13, initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph; S14, performing spatiotemporal depth feature extraction and graph structure feature extraction according to the sparse connected graph to obtain spatiotemporal depth features and graph structure features; S15, inputting the spatiotemporal depth features and the graph structure features into a pre-trained anomaly detection model to obtain an anomaly score; S16: When it is determined that the abnormality score is greater than a preset abnormality threshold, an alarm instruction is generated and sent to the user terminal.

[0026] In step S11, image data and audio data collected by the monitoring camera device and sensor data collected by the sensor device are obtained.

[0027] It should be noted that the data collected in step S11 is multimodal data, including images, audio, and sensor data. These multimodal data are collected in real time or regularly through special monitoring cameras, audio acquisition devices, and various sensor devices. For example, monitoring cameras capture images and videos, audio devices record sounds, and sensors monitor environmental parameters such as temperature and humidity. These multimodal data are used to enhance the functions and performance of the security system, and can significantly improve the accuracy and responsiveness of the security system. In the present invention, the system combines image and audio data to more effectively identify abnormal behavior or sound, while sensor data can help assess the safety status of the environment, thereby discovering details that may be overlooked by a single data source and improving the comprehensiveness and reliability of the system.

[0028] In step S12, similarity matrix calculation and distance matrix calculation are performed according to the image data, the audio data and the sensor data to obtain a similarity matrix and a distance matrix, including: Performing a feature extraction operation according to the image data, the audio data and the sensor data to obtain a feature vector, and normalizing the feature vector; According to the normalized eigenvectors, directed similarity calculation is performed to obtain the similarity matrix and distance matrix.

[0029] Among them, feature extraction is the extraction of meaningful information fragments from a large amount of raw data, which can represent the essential attributes of the data. By applying various feature extraction algorithms, such as edge detection and texture analysis in image processing, spectrum analysis in audio processing, and statistical feature extraction in sensor data, the raw data is converted into a form that is easier to process and analyze. In the present invention, normalization is the process of converting features of different dimensions or ranges to the same dimension or range. Normalization can improve the stability and accuracy of the algorithm, especially when multimodal data is involved, ensuring that the data of each modality has equal importance in the analysis. Exemplarily, the normalization algorithm used in the present invention is the Z-score normalization algorithm. Of course, the normalization algorithm can also use the minimum-maximum normalization algorithm, the nonlinear normalization algorithm, etc., which is not limited by the present invention.

[0030] It should be noted that similarity matrix calculation and distance matrix calculation are performed by calculating the similarity and distance between the eigenvectors of the data, arranging the similarities and distances between multiple eigenvectors in correspondence, and obtaining similarity matrix and distance matrix, each element of which represents the similarity or distance between a pair of eigenvectors. Among them, directed similarity refers to calculating the similarity between two data points when considering the directionality of the data features, by applying specific similarity calculation formulas, such as cosine similarity, Euclidean distance, etc. Directed similarity calculation is used to quantify the similarity or difference between different data points, and is the basis for generating similarity matrix and distance matrix.

[0031] In step S13, a sparse matrix is ​​initialized and heuristic clustering is performed according to the similarity matrix and the distance matrix to obtain a sparse connected graph, including: Initializing a sparse matrix according to the similarity matrix and the distance matrix; Performing a heuristic clustering operation according to the sparse matrix to group the nodes to obtain a plurality of clusters; Obtaining a sparse connected graph according to the clustering clusters and the clustering results; The elements of the sparse matrix represent the connection strength between nodes, each node in the sparse connected graph represents a cluster, and the edges represent the connection relationship between clusters.

[0032] Among them, a sparse matrix is ​​a matrix with most elements being zero, which is used to represent the connection strength between nodes. Sparse matrices are used to represent the connection relationship between data points, providing a basis for subsequent clustering and graph construction. Heuristic clustering is an experience- and rule-based clustering method that groups the collected monitoring data points into multiple clusters through iterative optimization, where each cluster represents a group of similar monitoring data points. A sparse connected graph is a graph structure in which each node represents a cluster and the edges represent the connection relationship between clusters. Sparse connected graphs are used to visualize and analyze complex relationships between data points, which helps to understand the structure and dynamics of the data.

[0033] In step S14, the extraction of spatiotemporal depth features and graph structure features is performed according to the sparse connected graph to obtain spatiotemporal depth features and graph structure features, including: Based on the sparse connected graph, extracting spatiotemporal depth features through a temporal convolution layer and a spatial convolution layer to obtain spatiotemporal depth features; Based on the sparse connected graph and the spatiotemporal depth features, a complex network measurement calculation is performed to obtain graph structure features; The complex network metrics include average path length, clustering coefficient, density, and node degree entropy.

[0034] It should be noted that spatiotemporal deep features refer to deep features extracted by combining time and space dimensions, which can reflect the complex patterns of data in time and space. Features are extracted from sparse connected graphs by applying temporal convolution layers and spatial convolution layers. The temporal convolution layer focuses on the changes of data over time, while the spatial convolution layer focuses on the distribution of data in space. Spatiotemporal deep feature extraction is used to capture the dynamic changes and associations of data in time and space, which helps to conduct more in-depth data analysis and prediction. Graph structural features refer to features extracted from the graph structure, which can reflect the organization and relationship of nodes and edges in the graph. Features are extracted from sparse connected graphs by calculating complex network measures. Graph structural feature extraction is used to quantify the structural characteristics of the graph, which helps to understand the topological structure and dynamic behavior of the graph.

[0035] Exemplarily, the calculation formula of the graph structure feature in the present invention is as follows:

[0036] in, It represents the average path length, which is defined as the average distance between two nodes on the monitoring data graph G. It is mainly used to measure the compactness of the data network and the efficiency and performance of mutual communication; represents the average clustering coefficient, which is defined as the average of the local clustering coefficients of all nodes in the graph G; It represents density, which is defined as the ratio of the actual number of edges in the data network to the upper limit of the number of edges that can be accommodated; It represents the node degree entropy, which is defined as the importance of the node.

[0037] The step of extracting spatiotemporal depth features based on the sparse connected graph through a temporal convolution layer and a spatial convolution layer to obtain spatiotemporal depth features includes: The calculation formula of the temporal convolutional layer is as follows:

[0038] in, is sparse connected graph data, obtained by performing graph clustering on the image data, the audio data, and the sensor data; It is a temporal depth feature, which is used to represent the correlation of each timestamp in the monitoring data; is the sigmoid activation function; and is a learnable parameter; It is Hadamard; It is the convolutional attention calculated based on the input sparse connected graph data, which is used to represent the importance weight of each timestamp in the monitoring data; The feature extraction calculation formula of the spatial convolution layer is as follows:

[0039] in, It is the matrix concatenation operation; and For the Nodes of a layer sparsely connected graph and The characteristic variable is used to represent the characteristic value of the current position of the monitoring data; is the attention function; is the sigmoid activation function, It is a spatial deep feature used to represent complex patterns and structures in surveillance data; is the number of attention heads.

[0040] In step S15, the spatiotemporal depth features and the graph structure features are input into a pre-trained anomaly detection model to obtain an anomaly score.

[0041] It is worth noting that the anomaly detection model is a pre-trained model used to identify and evaluate the degree of anomaly in data. It is trained using historical data and standard anomaly scores through the model training process in the previous steps. The anomaly score is a quantitative indicator that indicates the degree of anomaly of a data point relative to normal data.

[0042] In one embodiment, the anomaly score is calculated using a comprehensive anomaly score formula as follows: , in, represents the abnormality score; , , and Weight coefficient, used to balance the contribution of different anomaly scoring indicators; It represents the average path length, which is defined as the average distance between two nodes on the monitoring data graph G. It is mainly used to measure the compactness of the data network and the efficiency and performance of mutual communication; represents the average clustering coefficient, which is defined as the average of the local clustering coefficients of all nodes in the graph G; It represents density, which is defined as the ratio of the actual number of edges in the data network to the upper limit of the number of edges that can be accommodated; It represents the node degree entropy, which is defined as the importance of the node.

[0043] It should be noted that the weight coefficient , , and The choice of needs to be adjusted according to the characteristics of the specific task and data set. In this embodiment, , , and The weight coefficients are set to 0.3, 0.3, 0.2 and 0.2 respectively. Of course, the weight coefficients can also be set to other values, which are not limited in the present invention.

[0044] In another embodiment, based on the spatiotemporal depth features and graph structure features of historical data and the standard anomaly score as input data, an initial anomaly detection model is constructed, and the initial anomaly detection model is trained to obtain an anomaly detection model, including: Obtain the spatiotemporal depth features and graph structure features in historical data and the corresponding standard anomaly scores; Taking the spatiotemporal depth features, the graph structure features and the standard anomaly score as input data, and building an initial anomaly detection model based on an autoencoder model; Based on the initial anomaly detection model, the model is trained by iteratively optimizing the weights and biases of the encoder and decoder; When the number of training times is greater than or equal to the preset maximum number of training times, the training is determined to be completed and an anomaly detection model is obtained.

[0045] It should be noted that the spatiotemporal depth features and graph structure features are features extracted from historical data, and the standard anomaly score is a known anomaly label or score. These features and scores are used to build and train anomaly detection models to help the model learn the difference between normal and abnormal data. The initial anomaly detection model is an autoencoder-based model for learning the normal pattern of data. An autoencoder is an unsupervised artificial neural network used to learn a compressed representation of data. An autoencoder consists of two main parts: an encoder and a decoder. The encoder compresses the input data into a low-dimensional representation, called an encoding or latent space representation, while the decoder reconstructs this low-dimensional representation back to the original data space. Exemplarily, in anomaly detection tasks, autoencoders are often used to learn feature representations of normal data. When the input data is normal data, the autoencoder can reconstruct the input well; when the input data contains anomalies or noise, the reconstruction error increases significantly. By setting an error threshold, abnormal data can be identified based on the reconstruction error.

[0046] Among them, model training is to iteratively optimize the weights and biases of the encoder and decoder so that the model can accurately identify abnormal data. Through the back propagation algorithm and optimizer, the parameters of the model are adjusted to minimize the loss function.

[0047] It is worth noting that the preset maximum number of training times is a key parameter that determines the degree of learning of the model on the training data. If it is set too small, the model may not converge and cannot be accurately detected; if it is set too large, it will increase the computing cost and time consumption and cause overfitting. In this embodiment, the maximum number of training times is set to 100. Depending on the application scenario and user needs, the maximum number of training times can also be set to 50, 200, etc., which is not limited by the present invention.

[0048] In step S16, when it is determined that the abnormality score is greater than the preset abnormality threshold, an alarm instruction is generated and sent to the user terminal, including: Obtaining anomaly detection scores and anomaly location data obtained from the anomaly detection model; Compare the anomaly detection score with a preset anomaly threshold to determine whether the anomaly detection score is higher than the preset anomaly threshold; When it is determined that the anomaly detection score is higher than the preset anomaly threshold, an alarm instruction is generated and sent to the user terminal through a pre-configured communication channel; The alarm location is marked on the user-side map according to the abnormal location data, and an abnormal alarm is issued.

[0049] The abnormal location data is specific location information related to the abnormal detection score. The pre-configured communication channel is used to send the alarm instruction to the user end. In a specific implementation, the communication with the user end is carried out through SMS. Of course, the pre-configured communication channel can also be an email, an application notification, etc., which is not limited by the present invention.

[0050] It is worth noting that the selection of the preset abnormal threshold is the key, which needs to be determined according to the specific application scenario, data characteristics and risk tolerance. In the specific implementation, the score range is between 0 and 100, where 0 points means that the data point or node is completely normal and there is no abnormal sign; 100 points means that the data point or node has the highest degree of abnormality and there are serious abnormalities; the intermediate score represents different degrees of abnormality, and the higher the score, the more serious the abnormality. In this embodiment, the preset abnormal threshold is set to 75 through historical data analysis, expert experience and multiple experiments. When the abnormal score value is higher than this preset abnormal threshold, the system will automatically generate an alarm instruction and send it to the user end. Of course, the preset abnormal threshold can also be set to 70, 80, etc. According to the specific application scenario and risk tolerance, one or more abnormal thresholds can also be set. Specifically, a lower threshold of 30 points can be set to identify minor abnormalities, and a higher threshold of 70 points can be set to identify serious abnormalities. The present invention does not limit this.

[0051] In an optional implementation, the method further includes: Data encryption and data anonymization are performed based on the image data, the audio data, and the sensor data to generate an encrypted data packet.

[0052] It should be noted that data encryption is to protect the confidentiality of data and prevent unauthorized access and leakage. In a specific embodiment, the image data, audio data and sensor data are encrypted using the AES encryption algorithm, and the original data is converted into an encrypted format before data transmission or storage, so that only users with the correct key can decrypt and access the data.

[0053] Among them, data anonymization is to protect personal privacy and prevent the leakage of personal identity information. In the specific implementation process, data anonymity is achieved by removing or replacing sensitive information, including personal identification, location information, etc. In the data processing process, data containing personal privacy information is anonymized to ensure that the use of the data cannot be traced back to specific individuals.

[0054] In order to facilitate the understanding of the present invention, some preferred embodiments of the present invention are further described below.

[0055] In this embodiment, the smart security system collects a large amount of image, audio and sensor data through cameras, microphones and sensors deployed in different locations. This data is used for real-time monitoring, anomaly detection and behavior analysis to improve security and prevent crime. In order to effectively process and analyze this big data, the system uses advanced data analysis methods and ensures data security and privacy protection throughout the entire working process.

[0056] The specific working process is as follows: Step 1: The smart security system starts the daily monitoring process, the security monitoring point starts working, and transmits real-time security data to the server; Step 2: Before data transmission, the collected security data is encrypted and anonymized to ensure the security and anonymity of the data during transmission; Step 3: The server receives the encrypted and anonymized security data, performs data processing and feature extraction, and uses anomaly detection models to analyze and evaluate the extracted features; Step 4: Compare the anomaly score evaluated by the model with the preset anomaly threshold; Step 5: During the monitoring process, a security monitoring point detects an abnormal increase in the anomaly score, exceeding the preset anomaly threshold; Step 6: The server generates an alarm instruction and sends it to the user; Step 7: The server marks the alarm location on the security map based on the positioning data of the security monitoring point, and adjusts the monitoring strategy of the alarm location to strengthen security protection; Step 8: The server sends the alarm information to the user to remind the security management personnel to take appropriate emergency measures; Step 9: After receiving the alarm information, the security manager will quickly go to the alarm location to conduct on-site command and take emergency measures according to the actual situation.

[0057] Through the above steps, the smart security system can detect and respond to security anomalies in a timely manner to ensure public safety and property safety.

[0058] In order to send the alarm instruction to the user end, the following two implementation methods are provided: In one embodiment, the server sends an alarm instruction to the user end through a communication module configured on the server end, so that the security manager receives the alarm information and takes emergency measures; wherein the communication module and the user end are connected in advance through a wired network.

[0059] In this embodiment, the communication module of the server has established a stable communication connection with the user end in advance. Once the server detects that the abnormality score is greater than the preset abnormality threshold, it will immediately send an alarm instruction to the user end through the wired network. This method sends the information to the user end through a dedicated communication network to ensure the timeliness and reliability of the information.

[0060] In another embodiment, the server sends an alarm instruction to the user end through a communication module configured on the server end, so that the security manager receives the alarm information and takes emergency measures; wherein the communication module and the user end are connected in advance through a wireless network.

[0061] In this embodiment, the communication module of the server has established a communication connection with the user end in advance. Once the server detects that the abnormality score is greater than the preset abnormality threshold, it will immediately send an alarm instruction to the user end via the wireless network, so that security managers can receive alarm information anytime and anywhere.

[0062] Reference Figure 2 The second embodiment of the present invention provides a big data analysis system for smart security, including: A data acquisition module, used to acquire image data and audio data collected by monitoring camera equipment and sensor data collected by sensor equipment; A matrix calculation module, used to perform similarity matrix calculation and distance matrix calculation according to the image data, the audio data and the sensor data to obtain a similarity matrix and a distance matrix; A graph clustering module, used for initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph; A feature extraction module, used to extract spatiotemporal depth features and graph structure features according to the sparse connected graph, to obtain spatiotemporal depth features and graph structure features; An anomaly detection module, used for inputting the spatiotemporal depth features and the graph structure features into a pre-trained anomaly detection model to obtain an anomaly score; The abnormality alarm module is used to generate an alarm instruction when it is determined that the abnormality score is greater than a preset abnormality threshold, and send the alarm instruction to the user end so that the user can understand the abnormal situation in time and take corresponding countermeasures; The model training module is used to construct an initial anomaly detection model based on the spatiotemporal depth features and graph structure features of historical data and the standard anomaly score as input data, and train the initial anomaly detection model to obtain an anomaly detection model.

[0063] It should be noted that the big data analysis system applied to smart security provided in an embodiment of the present invention is used to execute all the process steps of the big data analysis method applied to smart security in the above-mentioned embodiment. The working principles and beneficial effects of the two correspond one to one, and therefore will not be repeated here.

[0064] In summary, the present invention provides a big data analysis method applied to smart security, including: acquiring image data, audio data collected by a monitoring camera device, and sensor data collected by a sensor device; performing similarity matrix calculation and distance matrix calculation according to the image data, the audio data and the sensor data to obtain a similarity matrix and a distance matrix; initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph; performing spatiotemporal depth feature extraction and graph structure feature extraction according to the sparse connected graph to obtain spatiotemporal depth features and graph structure features; inputting the spatiotemporal depth features and the graph structure features into a pre-trained anomaly detection model to obtain an anomaly score; when it is determined that the anomaly score is greater than a preset anomaly threshold, generating an alarm instruction, and sending the alarm instruction to a user end; wherein the anomaly detection model is based on the spatiotemporal depth features and graph structure features of historical data and a standard anomaly score as input data, constructing an initial anomaly detection model, and training the initial anomaly detection model to obtain an anomaly detection model. The method extracts spatiotemporal features from historical multimodal monitoring data, trains an anomaly detection model, uses the anomaly detection model to perform real-time detection and encrypt data, thereby achieving real-time and accurate detection and early warning of abnormal events and ensuring data security.

[0065] The embodiment of the present invention further provides a terminal device. The terminal device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as an authorization program for a projector. When the processor executes the computer program, the steps in the above-mentioned big data analysis method embodiment for smart security are implemented, such as Figure 1 Alternatively, the processor implements the functions of each module / unit in the above-mentioned system embodiments when executing the computer program.

[0066] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the terminal device.

[0067] The terminal device may be a computing device such as a desktop computer, a notebook, a PDA, and a smart tablet. The terminal device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the above components are merely examples of terminal devices and do not constitute a limitation on the terminal device. The terminal device may include more or fewer components than the above components, or may combine certain components, or different components. For example, the terminal device may also include input and output devices, network access devices, buses, etc.

[0068] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the server end of the terminal device, and uses various interfaces and lines to connect various parts of the entire terminal device.

[0069] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the terminal device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as an audio playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0070] Wherein, if the module / unit integrated in the terminal device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or system capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0071] It should be noted that the system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the system embodiment provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0072] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A big data analysis method applied to smart security, characterized in that: Executed by the server, including: Acquire image data and audio data collected by monitoring camera equipment and sensor data collected by sensor equipment; Perform similarity matrix calculation and distance matrix calculation according to the image data, the audio data and the sensor data to obtain a similarity matrix and a distance matrix; Initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph; According to the sparse connected graph, performing spatiotemporal depth feature extraction and graph structure feature extraction to obtain spatiotemporal depth features and graph structure features; Inputting the spatiotemporal depth features and the graph structure features into a pre-trained anomaly detection model to obtain an anomaly score; When it is determined that the abnormality score is greater than a preset abnormality threshold, an alarm instruction is generated and sent to the user terminal; The anomaly detection model is based on the spatiotemporal depth features and graph structure features of historical data and standard anomaly scores as input data, constructs an initial anomaly detection model, and trains the initial anomaly detection model to obtain an anomaly detection model.

2. The big data analysis method for smart security according to claim 1 is characterized in that: The similarity matrix and the distance matrix are calculated based on the image data, the audio data and the sensor data to obtain the similarity matrix and the distance matrix, including: Performing a feature extraction operation according to the image data, the audio data and the sensor data to obtain a feature vector, and normalizing the feature vector; According to the normalized eigenvectors, directed similarity calculation is performed to obtain the similarity matrix and distance matrix.

3. The big data analysis method for smart security according to claim 1, characterized in that: Initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph includes: Initializing a sparse matrix according to the similarity matrix and the distance matrix; Performing a heuristic clustering operation according to the sparse matrix to group the nodes to obtain a plurality of clusters; Obtaining a sparse connected graph according to the clustering clusters and the clustering results; The elements of the sparse matrix represent the connection strength between nodes, each node in the sparse connected graph represents a cluster, and the edges represent the connection relationship between clusters.

4. The big data analysis method for smart security according to claim 1, characterized in that: The step of extracting spatiotemporal depth features and graph structure features according to the sparse connected graph to obtain spatiotemporal depth features and graph structure features includes: Based on the sparse connected graph, extracting spatiotemporal depth features through a temporal convolution layer and a spatial convolution layer to obtain spatiotemporal depth features; Based on the sparse connected graph and the spatiotemporal depth features, a complex network measurement calculation is performed to obtain graph structure features; The complex network metrics include average path length, clustering coefficient, density, and node degree entropy.

5. The big data analysis method for smart security according to claim 4 is characterized in that: The step of extracting spatiotemporal depth features based on the sparse connected graph through a temporal convolution layer and a spatial convolution layer to obtain spatiotemporal depth features includes: The calculation formula of the temporal convolution layer is as follows: in, is sparse connected graph data, obtained by performing graph clustering on the image data, the audio data, and the sensor data; It is a temporal depth feature, which is used to represent the correlation of each timestamp in the monitoring data; is the sigmoid activation function; and is a learnable parameter; It is Hadamard; It is the convolutional attention calculated based on the input sparse connected graph data, which is used to represent the importance weight of each timestamp in the monitoring data; The feature extraction calculation formula of the spatial convolution layer is as follows: in, It is the matrix concatenation operation; and For the Nodes of a layer sparsely connected graph and The characteristic variable is used to represent the characteristic value of the current position of the monitoring data; is the attention function; is the sigmoid activation function, It is a spatial deep feature used to represent complex patterns and structures in surveillance data; is the number of attention heads.

6. The big data analysis method for smart security according to claim 1, characterized in that: The spatiotemporal depth features and graph structure features based on historical data and the standard anomaly score are used as input data to construct an initial anomaly detection model, and the initial anomaly detection model is trained to obtain an anomaly detection model, including: Obtain the spatiotemporal depth features and graph structure features in historical data and the corresponding standard anomaly scores; Taking the spatiotemporal depth features, the graph structure features and the standard anomaly score as input data, and building an initial anomaly detection model based on an autoencoder model; Based on the initial anomaly detection model, the model is trained by iteratively optimizing the weights and biases of the encoder and decoder; When the number of training times is greater than or equal to the preset maximum number of training times, the training is determined to be completed and an anomaly detection model is obtained.

7. The big data analysis method for smart security according to claim 1, characterized in that: When it is determined that the abnormality score is greater than a preset abnormality threshold, generating an alarm instruction and sending the alarm instruction to the user terminal includes: Obtaining anomaly detection scores and anomaly location data obtained from the anomaly detection model; Compare the anomaly detection score with a preset anomaly threshold to determine whether the anomaly detection score is higher than the preset anomaly threshold; When it is determined that the anomaly detection score is higher than the preset anomaly threshold, an alarm instruction is generated and sent to the user terminal through a pre-configured communication channel; The alarm location is marked on the user-side map according to the abnormal location data, and an abnormal alarm is issued.

8. The big data analysis method for smart security according to claim 1, characterized in that: The method further comprises: Data encryption and data anonymization are performed based on the image data, the audio data, and the sensor data to generate an encrypted data packet.

9. A big data analysis system applied to smart security, characterized in that: include: A data acquisition module, used to acquire image data and audio data collected by monitoring camera equipment and sensor data collected by sensor equipment; A matrix calculation module, used to perform similarity matrix calculation and distance matrix calculation according to the image data, the audio data and the sensor data to obtain a similarity matrix and a distance matrix; A graph clustering module, used for initializing a sparse matrix and performing heuristic clustering according to the similarity matrix and the distance matrix to obtain a sparse connected graph; A feature extraction module, used to extract spatiotemporal depth features and graph structure features according to the sparse connected graph, to obtain spatiotemporal depth features and graph structure features; An anomaly detection module, used for inputting the spatiotemporal depth features and the graph structure features into a pre-trained anomaly detection model to obtain an anomaly score; The abnormality alarm module is used to generate an alarm instruction when it is determined that the abnormality score is greater than a preset abnormality threshold, and send the alarm instruction to the user end so that the user can understand the abnormal situation in time and take corresponding countermeasures; The model training module is used to construct an initial anomaly detection model based on the spatiotemporal depth features and graph structure features of historical data and the standard anomaly score as input data, and train the initial anomaly detection model to obtain an anomaly detection model.

10. A cloud server, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the big data analysis method applied to smart security as described in any one of claims 1 to 8.

Images