Security monitoring big data processing method and system based on cloud computing

Abstract

The present invention discloses a security monitoring big data processing method and system based on cloud computing, which belongs to the field of security monitoring, and specifically includes: collecting and processing video monitoring data in real time through Internet of Things nodes, and uploading it to a cloud computing platform for distributed storage; using cloud computing resources, the system performs key frame splitting and feature extraction on the video, combines vision, audio, expression recognition, object recognition and time and space context information, and comprehensively judges abnormal behavior or dangerous intentions through a graph neural network; establishes a normal behavior pattern library through historical data analysis, and compares and identifies abnormal patterns; adopts a multi-classification algorithm to classify abnormal patterns, and performs multi-dimensional risk assessment to determine the danger level, and automatically triggers an adaptive alarm; links the emergency system, locates the abnormal location, and starts video playback and emergency response procedures, thereby achieving rapid and effective security prevention and control.

Description

Technical Field

[0001] The present invention belongs to the field of security monitoring, and specifically relates to a security monitoring big data processing method and system based on cloud computing. Background Art

[0002] Security monitoring, also known as security monitoring system, is a comprehensive security technology system that uses video, audio, and infrared sensor equipment to monitor, alarm, record, store, and remotely transmit targets in real time. The main purpose of security monitoring is to provide monitoring and early warning before or when a security incident occurs, so as to timely discover and deal with problems, thereby protecting the safety of personnel, property, and information. With the development of society and the advancement of technology, the demand for intelligent security monitoring systems is increasing, while traditional security systems mainly rely on manual monitoring and post-analysis, which are inefficient and prone to errors.

[0003] For example, the patent with publication number CN108259845A discloses a cloud computing-based security monitoring big data processing method and system, including: collecting security monitoring data captured by the monitoring terminal, and converting the collected video signal into an electrical signal; then importing it into the storage layer for virtualized distributed storage, and performing data backup processing in the management and scheduling layer; the user terminal communicates with the storage pool through various device interface terminals set in the application interface layer, and calls various security data in real time. This technical solution collects the monitoring data of the monitoring terminal and stores it in a distributed manner in the virtualized storage pool, thereby improving the storage capacity of the data and ensuring the processing efficiency of the big data of security monitoring. At the same time, it can perform real-time backup processing on the data and can call it in real time, thereby improving the fault tolerance rate of big data processing, and utilizing multiple distributed application interfaces to meet various service requests of users.

[0004] For example, the patent with publication number CN115474018A discloses a security video monitoring system, including: video monitoring module, alarm management module, data processing module, voice intercom module, system setting module, user management module, information storage module, information transmission module; the video monitoring module transmits the captured image information to the data processing module, user management module, and information storage module through the information transmission module every 10 seconds; the data processing module extracts facial feature information and behavioral feature information from the image information captured by the video monitoring module. Through the video monitoring module in the system of this technical solution, the captured image information is transmitted every 10 seconds, and the image information of the scene can be obtained in time, which improves the effectiveness of security monitoring.

[0005] The above existing technologies all have the following problems: they mainly focus on data collection, storage, backup and real-time call, but do not mention the most critical intelligent analysis and anomaly detection parts of security monitoring data. This means that even if the system can store and call a large amount of data, it cannot automatically identify and respond to potential security threats or abnormal behaviors; there is a lack of anomaly detection and early warning mechanism. When a security incident occurs, the system cannot respond in time, increasing security risks; there is a lack of intelligent processing capabilities and a lack of emergency response capabilities. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention proposes a cloud computing-based security monitoring big data processing method and system, which collects and processes video monitoring data in real time through Internet of Things nodes, and uploads it to the cloud computing platform for distributed storage; using cloud computing resources, the system performs key frame segmentation and feature extraction on the video, combines vision, audio, expression recognition, object recognition and time and space context information, and comprehensively judges abnormal behavior or dangerous intentions through graph neural networks; establishes a normal behavior pattern library through historical data analysis, and compares and identifies abnormal patterns; adopts a multi-classification algorithm to classify abnormal patterns, and conducts multi-dimensional risk assessment to determine the danger level, and automatically triggers an adaptive alarm; links the emergency system, locates the abnormal location, and starts video playback and emergency response procedures.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The security monitoring big data processing method based on cloud computing includes:

[0009] Step S1: collect video surveillance data in real time through the IoT node, perform preprocessing, and upload the preprocessed video surveillance data to the data storage pool of the cloud computing platform for distributed storage;

[0010] Step S2: Use the cloud computing platform to split the received video surveillance data into key frames, extract features from the key frames, generate visual and audio feature vectors, combine expression recognition, object recognition, time and space context information, and use the graph neural network method to comprehensively judge whether there is abnormal behavior or dangerous intention;

[0011] Step S3: Collect historical video surveillance data, establish a normal behavior pattern library through data analysis methods, and compare it with the identified abnormal behavior or dangerous intentions to identify abnormal patterns;

[0012] Step S4: using a multi-classification algorithm to classify the identified abnormal patterns, and based on the classification results and severity, conduct a multi-dimensional risk assessment to determine the danger level, and automatically trigger an adaptive alarm mechanism based on the danger level;

[0013] Step S5: The emergency system is linked to locate the location where the abnormal behavior occurs and start the video playback function. At the same time, the emergency response procedure is automatically started according to the preset emergency plan and the assessed danger level.

[0014] Specifically, the specific steps of step S2 include:

[0015] S2.1: The cloud computing platform uses a stream processing framework to receive and manage video surveillance data, and uses a threshold comparison method based on the picture change rate to extract key frames from the video surveillance data;

[0016] S2.2: Process the audio data corresponding to the key frames to extract audio features, and use the convolutional neural network model to extract image features of the key frames to generate visual features;

[0017] S2.3: Analyze the temporal sequence and logical relationship between key frames to construct temporal context information. At the same time, combine the spatial layout and object position of the video surveillance scene to construct spatial context information.

[0018] S2.4: Based on the visual features, the convolutional neural network model is used again to perform object detection and expression recognition to generate expression features and object features.

[0019] Specifically, the specific steps of step S2 also include:

[0020] S2.5: Perform multi-objective fusion of visual features, audio features, expression features, object features, temporal context information and spatial context information to obtain fused features;

[0021] S2.6: Use graph neural networks to process fused features and capture the relationships and interaction patterns between graph nodes. Key frames, objects, and faces are used as graph nodes, and spatial positions, time sequences, and interaction behaviors are used as edges to construct graph structures.

[0022] S2.7: Set safety thresholds , based on the output of the graph neural network, determine whether there is abnormal behavior or dangerous intention;

[0023] like , it is judged as normal mode;

[0024] like , it is judged as abnormal behavior or dangerous intention;

[0025] in, represents the output of the graph neural network, i Indicates the index position of the output result of the graph neural network;

[0026] S2.8: Based on ,The time series analysis prediction model is used to predict the probability of abnormal behavior or dangerous accidents occurring in the next time period.

[0027] Specifically, the specific steps of step S4 include:

[0028] S4.1: Receive the identified abnormal pattern data and preprocess it, use the trained convolutional neural network model to forward propagate the preprocessed abnormal pattern data, extract the feature map output by the convolution layer, and obtain the abnormal pattern feature data through the feature map ,in, Indicates n abnormal pattern feature data, n Indicates the number of abnormal pattern feature data;

[0029] S4.2: Set category labels for abnormal pattern feature data ,in, , indicating unauthorized transfer of items, , indicating that it carries potentially hazardous substances. , indicating aggressive behavioral preparation, , indicating that the residence is not authorized;

[0030] S4.3: The abnormal pattern feature data with category labels are divided, and the trained multi-classification model is obtained according to the divided abnormal pattern feature data. At the same time, the multi-classification SVM model is used to classify the abnormal pattern feature data. The formula is:

[0031] ;

[0032] in, Indicates that in a given x When the multi-classification model predicts the output as category j The probability of x represents abnormal pattern feature data with category labels, Indicates that in a given x is the category label of the abnormal pattern feature data, Indicates j The scaling factor for each category, express x The transformation function of Indicates j The bias term of each category, represents a nonlinear activation function, represents a nonlinear function combination, Indicates j A collection of parameters of categories, including j The weights or statistics of each category.

[0033] Specifically, the specific steps of step S4 also include:

[0034] S4.4: According to the classification results and abnormal pattern characteristics, set abnormal events and build a multi-dimensional risk assessment model;

[0035] S4.5: Use the probabilistic risk assessment method to quantitatively assess abnormal events. The formula is:

[0036] ;

[0037] Among them, Core represents the quantitative evaluation score, m Indicates the number of abnormal events, Indicates k The severity coefficient of an abnormal event, Indicates k The influence range coefficient of an abnormal event, Indicates k The probability of an abnormal event occurring, Indicates k The urgency coefficient of an abnormal event, Indicates k Among the abnormal events l The weight of the evaluation index, Indicates k Among the abnormal events l The scores of the evaluation indicators, Indicates k The number of evaluation indicators under abnormal events;

[0038] S4.6: Based on the multi-dimensional risk assessment results, comprehensively judge the severity of abnormal events, and classify abnormal events into three risk levels: low risk, medium risk, and high risk according to the judgment results;

[0039] S4.7: Automatically trigger the corresponding alarm mechanism according to the determined danger level.

[0040] Specifically, the extracted features in step S2 refer to extracted facial features, human body postures, motion trajectories and sound patterns.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. The present invention proposes a security monitoring big data processing method based on cloud computing, which uses a cloud computing platform for distributed storage and processing, improves the speed and efficiency of data processing, and enables the system to respond quickly to various security events; it covers multiple links such as data collection, intelligent identification, risk assessment, alarm triggering and emergency response, and generates a complete security monitoring system, so that the system can better adapt to complex and changeable security environments.

[0043] 2. The present invention proposes a cloud computing-based security monitoring big data processing system that can intelligently identify abnormal behaviors or dangerous intentions in video surveillance, and through the linkage emergency system, ensure that effective measures can be taken quickly in emergency situations to protect the safety of personnel and property. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flow chart of the security monitoring big data processing method based on cloud computing of the present invention;

[0045] Figure 2 This is a workflow diagram of the algorithm of the security monitoring big data processing method based on cloud computing of the present invention;

[0046] Figure 3 This is a structural diagram of the security monitoring big data processing system based on cloud computing of the present invention. DETAILED DESCRIPTION

[0047] Example 1

[0048] See also Figure 1-Figure 2 , an embodiment of the present invention provides: a security monitoring big data processing method based on cloud computing, comprising the following steps:

[0049] Step S1: collect video surveillance data in real time through the IoT node, perform preprocessing, and upload the preprocessed video surveillance data to the data storage pool of the cloud computing platform for distributed storage;

[0050] In the present invention, the IoT node refers to a camera; the storage pool is achieved by multiple servers and storage devices working together to achieve high availability, scalability and fault tolerance of data.

[0051] Step S2: Use the cloud computing platform to split the received video surveillance data into key frames, extract features from the key frames, generate visual feature vectors, combine expression recognition, object recognition, time and space context information, and use the graph neural network method to comprehensively judge whether there is abnormal behavior or dangerous intention;

[0052] Among them, the temporal and spatial context information includes the time of occurrence, location, and density of surrounding people.

[0053] Extracted features refer to extracted facial features, human body postures, motion trajectories, and sound patterns.

[0054] Step S3: Collect historical video surveillance data, establish a normal behavior pattern library through data analysis methods, and compare it with the identified abnormal behavior or dangerous intentions to identify abnormal patterns;

[0055] Among them, abnormal patterns include unauthorized transfer of items, carrying of potentially hazardous materials, preparation of aggressive behaviors, and unauthorized presence;

[0056] Furthermore, the specific steps of step S3 include:

[0057] (1) Collect historical video surveillance data within a specified time period and perform feature extraction, and quantify the extracted features;

[0058] (2) Based on the labeled normal behavior data, the extracted features are modeled using a probability distribution model. By training the probability distribution model, it can learn the characteristics and laws of normal behavior patterns.

[0059] (3) Saving the trained probability distribution model or model parameters to form a normal behavior pattern library, where the pattern library will serve as a benchmark for subsequent abnormal behavior detection;

[0060] (4) Verify and optimize the normal behavior pattern library to ensure that it can accurately reflect the laws and characteristics of normal behavior;

[0061] (5) Perform feature extraction and quantification on real-time or newly collected video data, and compare and analyze the extracted features with the normal behavior pattern library. If there is a difference, it is judged as abnormal behavior or dangerous intent.

[0062] Step S4: using a multi-classification algorithm to classify the identified abnormal patterns, and based on the classification results and severity, conduct a multi-dimensional risk assessment to determine the danger level, and automatically trigger an adaptive alarm mechanism based on the danger level;

[0063] Step S5: The emergency system is linked to locate the location where the abnormal behavior occurs and start the video playback function. At the same time, the emergency response procedure is automatically started according to the preset emergency plan and the assessed danger level.

[0064] Among them, the emergency system includes: GIS system, video alarm system, police-visual linkage system; the emergency response procedure refers to dispatching police force, blocking the scene, and evacuating the crowd.

[0065] The specific steps of step S2 include:

[0066] S2.1: The cloud computing platform uses a stream processing framework to receive and manage video surveillance data, and uses a threshold comparison method based on the picture change rate to extract key frames from the video surveillance data;

[0067] Among them, Apache Flink is selected as the stream processing framework in the present invention.

[0068] Furthermore, the specific steps of S2.1 include:

[0069] (1) Pre-set video stream processing tasks in the stream processing framework, including feature extraction tasks based on the picture change rate, and configure task parameters, such as the picture change rate threshold, key frame storage format and location;

[0070] (2) The processing node in the stream processing framework receives the video stream and detects the image change rate of each frame by comparing the pixel differences between adjacent frames;

[0071] (3) Setting the threshold ,like , then the current frame is considered to be a key frame, where Indicates the rate of picture change;

[0072] (4) Extract the key frames, compress them, annotate them, and store them in the cloud storage system.

[0073] S2.2: Process the audio data corresponding to the key frames to extract audio features, and use the convolutional neural network model to extract image features of the key frames to generate visual features;

[0074] Furthermore, the specific implementation steps of extracting audio features include:

[0075] (1) Extract the corresponding audio data from the key frame. Usually, the video and audio in video surveillance data are synchronized, so the corresponding audio segment can be found according to the timestamp of the key frame;

[0076] (2) Preprocess the audio data, including denoising, standardization, and sampling rate conversion, to ensure the quality and consistency of the audio data;

[0077] (3) Using an audio feature extraction algorithm to extract features from the preprocessed audio data, the present invention adopts a Mel-spectrum cepstral coefficient method, wherein the Mel-spectrum cepstral coefficient method is a prior art content in this field, is not an inventive solution of the present application, and is not described in detail here;

[0078] (4) Output the extracted audio feature vector.

[0079] At the same time, the specific implementation steps of generating visual features include:

[0080] (1) Extracting image data from keyframes usually involves loading, scaling, and cropping images to ensure that the image data meets the input requirements of the convolutional neural network;

[0081] (2) Select a convolutional neural network model, including determining the network structure parameters of the convolutional layer, pooling layer, activation function, and fully connected layer;

[0082] (3) Use image data from the collected video surveillance data to train the convolutional neural network to learn effective representations of image features;

[0083] (4) The key frame image is input into the trained convolutional neural network model, and the final image feature vector is obtained through forward propagation calculation. The convolutional neural network model and its forward propagation calculation method are the prior art contents in this field, and are not the inventive scheme of this application, and are not described in detail here.

[0084] S2.3: Analyze the temporal sequence and logical relationship between key frames to construct temporal context information. At the same time, combine the spatial layout and object position of the video surveillance scene to construct spatial context information.

[0085] S2.4: Based on the visual features, the convolutional neural network model is used again to perform object detection and expression recognition to generate expression features and object features;

[0086] S2.5: Multi-target fusion of visual features, audio features, expression features, object features, temporal context information and spatial context information is performed to obtain fusion features. In the present invention, a weighted fusion method is selected, and the calculation formula of the weighted fusion method is the prior art content in this field, which is not the inventive solution of the present application and is not described in detail here;

[0087] S2.6: Use graph neural networks to process fused features and capture the relationships and interaction patterns between graph nodes. Key frames, objects, and faces are used as graph nodes, and spatial positions, time sequences, and interaction behaviors are used as edges to construct graph structures.

[0088] S2.7: Set safety thresholds , based on the output of the graph neural network, determine whether there is abnormal behavior or dangerous intention;

[0089] like , it is judged as normal mode;

[0090] like , it is judged as abnormal behavior or dangerous intention;

[0091] in, represents the output of the graph neural network, i Indicates the index position of the output result of the graph neural network;

[0092] S2.8: Based on ,The time series analysis prediction model is used to predict the probability of abnormal behavior or dangerous accidents occurring in the next time period.

[0093] The specific steps of step S4 include:

[0094] S4.1: Receive the identified abnormal pattern data and preprocess it, use the trained convolutional neural network model to forward propagate the preprocessed abnormal pattern data, extract the feature map output by the convolution layer, and obtain the abnormal pattern feature data through the feature map ,in, Indicates n abnormal pattern feature data, n Indicates the number of abnormal pattern feature data;

[0095] S4.2: Set category labels for abnormal pattern feature data ,in, , indicating unauthorized transfer of items, , indicating that it carries potentially hazardous substances. , indicating aggressive behavioral preparation, , indicating that the residence is not authorized;

[0096] S4.3: The abnormal pattern feature data with category labels are divided, and the trained multi-classification model is obtained according to the divided abnormal pattern feature data. At the same time, the abnormal pattern feature data is classified using the multi-classification SVM model. The formula is:

[0097] ;

[0098] in, Indicates that in a given x When the multi-classification model predicts the output as category j The probability of x represents abnormal pattern feature data with category labels, Indicates that in a given x is the category label of the abnormal pattern feature data, Indicates j The scaling factor for each category, express x The transformation function of Indicates j The bias term of each category, represents a nonlinear activation function, represents a nonlinear function combination, Indicates j A collection of parameters of categories, including j weights or statistics of the categories;

[0099] S4.4: According to the classification results and abnormal pattern characteristics, set abnormal events and build a multi-dimensional risk assessment model;

[0100] The multidimensional risk assessment model comprehensively considers four dimensions: scope of impact, severity, probability of occurrence, and urgency.

[0101] S4.5: Use the probabilistic risk assessment method to quantitatively assess abnormal events. The formula is:

[0102] ;

[0103] Among them, Core represents the quantitative evaluation score, m Indicates the number of abnormal events, Indicates k The severity coefficient of an abnormal event, Indicates k The influence range coefficient of an abnormal event, Indicates k The probability of an abnormal event occurring, Indicates k The urgency coefficient of an abnormal event, Indicates k Among the abnormal events l The weight of the evaluation index, Indicates k Among the abnormal events l The scores of the evaluation indicators, Indicates k The number of evaluation indicators under abnormal events;

[0104] S4.6: Based on the multi-dimensional risk assessment results, comprehensively judge the severity of abnormal events, and classify abnormal events into three risk levels: low risk, medium risk, and high risk according to the judgment results;

[0105] S4.7: Automatically trigger the corresponding alarm mechanism according to the determined danger level.

[0106] Example 2

[0107] See also Figure 3 , another embodiment provided by the present invention: a security monitoring big data processing system based on cloud computing, comprising: a data processing module, a data analysis module, an abnormal behavior detection module, and an emergency response module;

[0108] Data processing module, used to collect video surveillance data in real time, pre-process it and store it in a data storage pool;

[0109] The data analysis module is used to analyze the stored video surveillance data, extract key frames and their feature vectors, and provide a basis for subsequent abnormal behavior detection;

[0110] The abnormal behavior detection module is used to establish a normal behavior pattern library through historical video surveillance data analysis and compare it with real-time video surveillance data to identify abnormal behavior patterns;

[0111] The emergency response module is used to automatically trigger the alarm mechanism based on the results of abnormal behavior detection, and link the emergency system to take corresponding emergency response measures.

[0112] The data processing module includes: IoT node unit, preprocessing unit, and storage unit;

[0113] The IoT node unit is used to collect video surveillance data in real time through IoT nodes deployed in the monitoring area;

[0114] The preprocessing unit is used to perform preprocessing operations such as cleaning, denoising and compression on the collected raw data to improve data quality and reduce storage and transmission burdens;

[0115] The storage unit is used to upload the pre-processed video surveillance data to the data storage pool of the cloud computing platform to achieve distributed storage and efficient management of data.

[0116] The data analysis module includes: key frame splitting unit, feature extraction unit, and graph neural network processing unit;

[0117] A key frame splitting unit is used to split key frames from a continuous video stream, wherein the key frames usually contain important information in the video;

[0118] A feature extraction unit is used to extract visual and audio features from key frames using image processing and speech recognition methods, and to generate multi-dimensional feature vectors by combining expression recognition and object recognition methods;

[0119] A graph neural network processing unit is used to use a graph neural network method, combined with time and space context information, to comprehensively analyze and judge the extracted features to identify abnormal behaviors or dangerous intentions.

[0120] The abnormal behavior detection module includes: a pattern library building unit, an abnormality detection unit, and a classification and evaluation unit;

[0121] A pattern library building unit is used to collect historical video surveillance data and build a normal behavior pattern library through data analysis methods;

[0122] Anomaly detection unit, which compares real-time video surveillance data with a library of normal behavior patterns to identify abnormal behavior or dangerous intent;

[0123] The classification and assessment unit is used to classify the identified abnormal patterns using a multi-classification algorithm and perform multi-dimensional risk assessment based on the classification results and severity.

[0124] The emergency response module includes: alarm trigger unit, emergency positioning unit, video playback unit, and emergency response unit;

[0125] An alarm trigger unit, which is used to automatically trigger the alarm mechanism according to the danger level and notify the staff or system;

[0126] Emergency positioning unit, used to use the positioning function of the video surveillance system to quickly locate the location where abnormal behavior occurs;

[0127] A video playback unit is used to start the video playback function so that relevant personnel can view the video footage when the abnormal behavior occurs;

[0128] The emergency response unit is used to automatically or manually initiate emergency response procedures based on the preset emergency plan and the assessed danger level, such as activating the sprinkler system and notifying security personnel.

[0129] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0131] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in the field may also change, modify, replace and modify the above-mentioned embodiments without departing from the purpose and scope of protection of the present invention, and all of these are within the protection of the present invention.

Claims

1. A security monitoring big data processing method based on cloud computing, characterized in that: include: Step S1: collect video surveillance data in real time through the IoT node, perform preprocessing, and upload the preprocessed video surveillance data to the data storage pool of the cloud computing platform for distributed storage; Step S2: Use the cloud computing platform to split the received video surveillance data into key frames, extract features from the key frames, generate visual and audio feature vectors, combine expression recognition, object recognition, time and space context information, and use the graph neural network method to comprehensively judge whether there is abnormal behavior or dangerous intention; Step S3: Collect historical video surveillance data, establish a normal behavior pattern library through data analysis methods, and compare it with the identified abnormal behavior or dangerous intentions to identify abnormal patterns; Step S4: using a multi-classification algorithm to classify the identified abnormal patterns, and based on the classification results and severity, conduct a multi-dimensional risk assessment to determine the danger level, and automatically trigger an adaptive alarm mechanism based on the danger level; Step S5: Linking the emergency system, locating the location where the abnormal behavior occurred, and starting the video playback function. At the same time, according to the preset emergency plan and the assessed danger level, the emergency response procedure is automatically started; The specific steps of step S2 include: S2.1: The cloud computing platform uses a stream processing framework to receive and manage video surveillance data, and uses a threshold comparison method based on the picture change rate to extract key frames from the video surveillance data; S2.2: Process the audio data corresponding to the key frames to extract audio features, and use the convolutional neural network model to extract image features of the key frames to generate visual features; S2.3: Analyze the temporal sequence and logical relationship between key frames to construct temporal context information. At the same time, combine the spatial layout and object position of the video surveillance scene to construct spatial context information. S2.4: Based on the visual features, the convolutional neural network model is used again to perform object detection and expression recognition to generate expression features and object features; The specific steps of step S2 also include: S2.5: Perform multi-objective fusion of visual features, audio features, expression features, object features, temporal context information and spatial context information to obtain fused features; S2.6: Use graph neural networks to process fused features and capture the relationships and interaction patterns between graph nodes. Key frames, objects, and faces are used as graph nodes, and spatial positions, time sequences, and interaction behaviors are used as edges to construct graph structures. S2.7: Set safety thresholds , based on the output of the graph neural network, determine whether there is abnormal behavior or dangerous intention; like , it is judged as normal mode; like , it is judged as abnormal behavior or dangerous intention; in, represents the output of the graph neural network, i Indicates the index position of the output result of the graph neural network; S2.8: Based on ,The time series analysis prediction model is used to predict the probability of abnormal behavior or dangerous accidents occurring in the next time period.

2. The cloud computing-based security monitoring big data processing method according to claim 1, characterized in that: The specific steps of step S4 include: S4.1: Receive the identified abnormal pattern data and preprocess it, use the trained convolutional neural network model to forward propagate the preprocessed abnormal pattern data, extract the feature map output by the convolution layer, and obtain the abnormal pattern feature data through the feature map ,in, Indicates n abnormal pattern feature data, n Indicates the number of abnormal pattern feature data; S4.2: Set category labels for abnormal pattern feature data ,in, , indicating unauthorized transfer of items, , indicating that it carries potentially hazardous substances. , indicating aggressive behavioral preparation, , indicating that the residence is not authorized; S4.3: The abnormal pattern feature data with category labels are divided, and the trained multi-classification model is obtained according to the divided abnormal pattern feature data. At the same time, the multi-classification SVM model is used to classify the abnormal pattern feature data. The formula is: ； in, Indicates that in a given x When the multi-classification model predicts the output as category j The probability of x represents abnormal pattern feature data with category labels, Indicates that in a given x is the category label of the abnormal pattern feature data, Indicates j The scaling factor for each category, express x The transformation function of Indicates j The bias term of each category, represents a nonlinear activation function, represents a nonlinear function combination, Indicates j A collection of parameters of categories, including j The weights or statistics of each category.

3. The cloud computing-based security monitoring big data processing method according to claim 2, characterized in that: The specific steps of step S4 also include: S4.4: According to the classification results and abnormal pattern characteristics, set abnormal events and build a multi-dimensional risk assessment model; S4.5: Use the probabilistic risk assessment method to quantitatively assess abnormal events. The formula is: ； Among them, Core represents the quantitative evaluation score, m Indicates the number of abnormal events, Indicates k The severity coefficient of an abnormal event, Indicates k The influence range coefficient of an abnormal event, Indicates k The probability of an abnormal event occurring, Indicates k The urgency coefficient of an abnormal event, Indicates k Among the abnormal events l The weight of the evaluation index, Indicates k Among the abnormal events l The scores of the evaluation indicators, Indicates k The number of evaluation indicators under abnormal events; S4.6: Based on the multi-dimensional risk assessment results, comprehensively judge the severity of abnormal events, and classify abnormal events into three risk levels: low risk, medium risk, and high risk according to the judgment results; S4.7: Automatically trigger the corresponding alarm mechanism according to the determined danger level.

4. The cloud computing-based security monitoring big data processing method according to claim 3, characterized in that: The extracted features in step S2 refer to extracted facial features, human body postures, motion trajectories and sound patterns.

5. A cloud computing-based security monitoring big data processing system, which is used to implement the cloud computing-based security monitoring big data processing method according to any one of claims 1 to 4, characterized in that: include: Data processing module, data analysis module, abnormal behavior detection module, emergency response module; The data processing module is used to collect video surveillance data in real time, and perform pre-processing and storage in a data storage pool; The data analysis module is used to analyze the stored video surveillance data, extract key frames and their feature vectors, and provide a basis for subsequent abnormal behavior detection; The abnormal behavior detection module is used to establish a normal behavior pattern library by analyzing historical video surveillance data, and compare it with real-time video surveillance data to identify abnormal behavior patterns; The emergency response module is used to automatically trigger the alarm mechanism according to the results of abnormal behavior detection, and to link the emergency system to take corresponding emergency response measures.

6. The cloud computing-based security monitoring big data processing system according to claim 5, characterized in that: The data analysis module includes: a feature extraction unit and a graph neural network processing unit; The feature extraction unit is used to extract visual and audio features from key frames using image processing and speech recognition methods, and to generate multi-dimensional feature vectors by combining expression recognition and object recognition methods; The graph neural network processing unit is used to use the graph neural network method, combined with time and space context information, to comprehensively analyze and judge the extracted features to identify abnormal behavior or dangerous intentions.

7. The cloud computing-based security monitoring big data processing system according to claim 6, characterized in that: The abnormal behavior detection module includes: a pattern library building unit, an abnormality detection unit, and a classification and evaluation unit; The pattern library building unit is used to collect historical video surveillance data and build a normal behavior pattern library through a data analysis method; The anomaly detection unit is used to compare the real-time video surveillance data with the normal behavior pattern library to identify abnormal behavior or dangerous intentions; The classification and assessment unit is used to classify the identified abnormal patterns using a multi-classification algorithm, and perform multi-dimensional risk assessment based on the classification results and severity.

Images