Security monitoring method and equipment

Abstract

The invention is suitable for the technical field of security and protection monitoring, and particularly relates to a security and protection monitoring method and equipment, and the method comprises the steps: obtaining a current frame of a target region, and obtaining the historical people flow density and historical abnormal behavior frequency of the target region; wherein the target area is used for representing a certain security and protection monitoring area in a campus environment; determining a first risk factor based on the current frame and the historical people flow density; wherein the first risk factor is used for representing the dynamic change trend of the people flow density of the target area; determining a second risk factor based on the current frame and the historical abnormal behavior frequency; wherein the second risk factor is used for representing the abnormality of the current behavior mode in the target area; and determining a risk level of the target area based on the first risk factor and the second risk factor. According to the method, the monitoring efficiency and the accuracy of regional risk assessment are improved.

Description

Technical Field

[0001] The present invention relates to the field of security monitoring technology, and in particular to security monitoring methods and equipment. Background Art

[0002] Security monitoring (security protection monitoring) is to monitor and record designated areas in real time through technical means such as cameras, sensors, and network equipment to ensure the safety of personnel, property, information, etc. Security monitoring systems mainly include cameras, video recording equipment, display equipment, control systems and other components, and are widely used in homes, shopping malls, enterprises, transportation, public places, etc.

[0003] In the existing technology, most campus security monitoring systems only assess risks based on a single dimension (such as the flow of people or the frequency of abnormal events), and fail to fully consider the comprehensive impact of multi-dimensional factors on risks, resulting in one-sided assessment results. Traditional monitoring systems rely on manual observation or simple fixed rules (such as intrusion detection) to identify abnormal situations, but fail to quantify the impact of abnormal situations, resulting in a highly subjective risk assessment.

[0004] In summary, there is a problem of low assessment accuracy when assessing risk levels in campus security monitoring. Summary of the invention

[0005] The embodiments of the present application provide a security monitoring method and device, which can solve the problem of low assessment accuracy when assessing risk levels in campus security monitoring in related technologies.

[0006] In a first aspect, an embodiment of the present application provides a security monitoring method, comprising: Acquire a current frame of a target area and acquire a historical crowd density and a historical abnormal behavior frequency of the target area; wherein the target area is used to represent a security monitoring area in a campus environment; Determine a first risk factor based on the current frame and the historical crowd density; wherein the first risk factor is used to characterize the dynamic change trend of the crowd density in the target area; Determining a second risk factor based on the current frame and the historical abnormal behavior frequency; wherein the second risk factor is used to characterize the abnormality of the current behavior pattern in the target area; A risk level of the target area is determined based on the first risk factor and the second risk factor.

[0007] The above technical solutions in the embodiments of the present application have at least the following technical effects: The security monitoring method provided by the present application first obtains the current frame of the target area and obtains the historical crowd density and historical abnormal behavior frequency of the target area, and then determines the first risk factor based on the current frame and the historical crowd density, which is conducive to knowing the dynamic change trend of the crowd density in the target area, and then determines the second risk factor based on the current frame and the historical abnormal behavior frequency, which is conducive to knowing the abnormality of the current behavior pattern in the target area, and finally determines the risk level of the target area based on the first risk factor and the second risk factor. The method comprehensively evaluates the risk level of the target area by combining the first risk factor and the second risk factor, realizes a comprehensive grasp of the overall security status of the area, and helps decision makers take corresponding measures. The method reduces the pressure of manual monitoring and the errors caused by manual risk assessment through automated risk assessment, improves monitoring efficiency and the accuracy of risk assessment, and also improves the intelligence level of campus security systems. The method can be applied to a variety of scenarios, not only limited to campus environments, but also can be extended to other public places, such as subway stations, shopping malls, etc., to provide intelligent solutions for the safety management of large-scale public environments.

[0008] In a possible implementation manner of the first aspect, determining the first risk factor based on the current frame and the historical crowd density includes: Acquire the area of ​​the target area; Based on the current frame, calculating the total number of people in the current frame; Calculate the ratio of the total number of people in the current frame to the area of ​​the target area to obtain the current crowd density; The ratio of the current crowd flow density to the historical crowd flow density is calculated to obtain the first risk factor.

[0009] In a possible implementation manner of the first aspect, the method further includes: Acquire a time window, and acquire all frames in the time window according to the time window and the current frame; wherein the current frame is the last frame of all frames in the time window; Calculate the total number of people in each frame of all frames within the time window; Based on the total number of people in each frame of all frames in the time window and the area of ​​the target area, the average value of the crowd flow density in the time window is calculated to obtain the current crowd flow density.

[0010] In a possible implementation manner of the first aspect, determining the second risk factor based on the current frame and the historical abnormal behavior frequency includes: Determine a current abnormal behavior frequency according to the current frame and all frames within the time window; The ratio of the current abnormal behavior frequency to the historical abnormal behavior frequency is calculated to obtain the second risk factor.

[0011] In a possible implementation manner of the first aspect, determining a current abnormal behavior frequency according to the current frame and all frames in the time window includes: Marking each target in the current frame to obtain an identifier corresponding to each target; wherein each target in the current frame is used to represent each person in the current frame; Extracting behavioral features of each target from all frames within the time window; Determine abnormal target information according to the behavior characteristics of each target and the identifier corresponding to each target; wherein the abnormal target information includes the behavior characteristics of each abnormal target and the identifier corresponding to each abnormal target; The abnormal target information is mapped to the current frame, and the ratio of the number of abnormal targets in the current frame to the number of all targets in the current frame is calculated to obtain the current abnormal behavior frequency.

[0012] In a possible implementation manner of the first aspect, extracting the behavior feature of each target from all frames in the time window includes: Based on all frames in the time window, the displacement of each target is calculated, and according to the displacement of each target, the speed of each target in the time window is calculated to obtain the speed value of each target; Based on a current frame among all frames in the time window, calculating the distance value between each target and each target in the current frame to obtain a distance collection of each target; The speed value of each target and the distance collection of each target are integrated to obtain the behavioral characteristics of each target.

[0013] In a possible implementation manner of the first aspect, determining abnormal target information according to a behavior feature of each target and an identifier corresponding to each target includes: Compare the speed value of each target with the speed threshold value, determine whether the speed of each target is greater than the speed threshold value, determine the target whose speed is greater than the speed threshold value as a running target, and mark the identifier corresponding to each running target to obtain running target information; wherein the running target information includes the speed of each running target and the identifier corresponding to each running target after marking; Based on the distance collection of each target, each target is processed as follows: each distance value in the distance collection of the target is compared with the distance threshold, and it is determined whether each distance value in the distance collection of the target satisfies the first condition, and the target corresponding to the distance value that satisfies the first condition is determined as a close-range target; whether the distance value between the target and each close-range target satisfies the second condition, and the close-range target that satisfies the second condition is determined as an abnormal target; whether the number of abnormal targets satisfies the third condition, when the number of abnormal targets satisfies the third condition, the target and each abnormal target are determined as clustered targets, and the identifier corresponding to each clustered target is clustered and marked to obtain clustered target information; wherein, the first condition includes that the distance value is less than or equal to the distance threshold, the second condition includes that the distance value is less than or equal to the distance threshold within the time window, the third condition includes that the number of abnormal targets is greater than or equal to the number threshold, and the clustered target information includes the identifier corresponding to each clustered target after marking; The running target information and the gathering target information are integrated to obtain the abnormal target information.

[0014] In a possible implementation manner of the first aspect, determining the risk level of the target area based on the first risk factor and the second risk factor includes: Based on the first risk factor and the second risk factor, obtaining a total risk factor; Comparing the total risk factor with the first risk threshold and the second risk threshold respectively to obtain a comparison result; wherein the first risk threshold is less than the second risk threshold, and the comparison result includes that the total risk factor is less than or equal to the first risk threshold or the total risk factor is less than or equal to the second risk threshold and the total risk factor is greater than the first risk threshold or the total risk factor is greater than the second risk threshold; When the comparison result indicates that the total risk factor is less than or equal to the first risk threshold, determining that the risk level of the target area is low risk; When the comparison result indicates that the total risk factor is greater than the first risk threshold and the total risk factor is less than or equal to the second risk threshold, determining that the risk level of the target area is medium risk; When the comparison result indicates that the total risk factor is greater than the second risk threshold, the risk level of the target area is determined to be high risk.

[0015] In a possible implementation manner of the first aspect, determining the risk level of the target area based on the first risk factor and the second risk factor includes: The first risk factor and the second risk factor are input into a risk prediction model so that the risk prediction model predicts the risk level of the target area; wherein the risk prediction model is a machine learning model.

[0016] In a possible implementation manner of the first aspect, the method further includes: Obtaining a collection of risk factor samples; wherein the risk factor samples include a first risk factor and a second risk factor of a certain sample area; Labeling each risk factor sample in the risk factor sample collection to obtain a risk level label for each risk factor sample in the risk factor sample collection; Based on the risk factor sample collection and the risk label of each risk factor sample in the risk factor sample collection, a machine learning model is trained to obtain the risk prediction model.

[0017] In a second aspect, an embodiment of the present application provides a security monitoring device, including: An acquisition unit, used to acquire a current frame of a target area and to acquire a historical crowd density and a historical abnormal behavior frequency of the target area; wherein the target area is used to represent a security monitoring area in a campus environment; A first risk factor determination unit, configured to determine a first risk factor based on the current frame and the historical crowd density; wherein the first risk factor is used to characterize a dynamic change trend of the crowd density in the target area; A second risk factor determination unit, configured to determine a second risk factor based on the current frame and the historical abnormal behavior frequency; wherein the second risk factor is used to characterize the abnormality of the current behavior pattern in the target area; A risk level determination unit is used to determine the risk level of the target area based on the first risk factor and the second risk factor.

[0018] In a third aspect, an embodiment of the present application provides a security monitoring device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any one of the embodiments of the first aspect when executing the computer program.

[0019] It can be understood that the beneficial effects of the second to third aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 It is a flowchart of a security monitoring method provided by an embodiment of the present application; Figure 2 It is a schematic diagram of the implementation flow of step S200 in the security monitoring method provided in one embodiment of the present application; Figure 3 is a schematic diagram of the implementation flow of step S200 in the security monitoring method provided by another embodiment of the present application; Figure 4 It is a schematic diagram of the implementation process of obtaining running target information in the security monitoring method provided in the embodiment of the present application; Figure 5 It is a schematic diagram of the implementation process of obtaining the aggregated target information in the security monitoring method provided in one embodiment of the present application; Figure 6 is a schematic diagram of the structure of a security monitoring device provided in an embodiment of the present application; Figure 7 It is a structural diagram of the security monitoring device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0022] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0023] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0024] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0025] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0026] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0027] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0028] In related technologies, most campus security monitoring systems only assess risks based on a single dimension (such as the flow of people or the frequency of abnormal events), and fail to fully consider the comprehensive impact of multi-dimensional factors on risks, resulting in one-sided assessment results. Traditional monitoring systems rely on manual observation or simple fixed rules (such as intrusion detection) to identify abnormal situations, but fail to quantify the impact of abnormal situations, resulting in a highly subjective risk assessment.

[0029] To solve the above problems, the embodiment of the present application provides a security monitoring method and device. In the method, the current frame of the target area is first obtained, and the historical crowd density and historical abnormal behavior frequency of the target area are obtained. Then, based on the current frame and the historical crowd density, the first risk factor is determined, which is conducive to knowing the dynamic change trend of the crowd density in the target area. Then, based on the current frame and the historical abnormal behavior frequency, the second risk factor is determined, which is conducive to knowing the abnormality of the current behavior pattern in the target area. Finally, based on the first risk factor and the second risk factor, the risk level of the target area is determined. The method comprehensively evaluates the risk level of the target area by combining the first risk factor and the second risk factor, realizes a comprehensive grasp of the overall security status of the area, and helps decision makers take corresponding measures. The method reduces the pressure of manual monitoring and the errors caused by manual risk assessment through automated risk assessment, improves monitoring efficiency and the accuracy of risk assessment, and also improves the intelligence level of campus security systems. The method can be applied to a variety of scenarios, not only limited to campus environments, but also can be extended to other public places, such as subway stations, shopping malls, etc., to provide intelligent solutions for the safety management of large-scale public environments.

[0030] The security monitoring method provided in the embodiment of the present application can be applied to a security monitoring device. In this case, the security monitoring device is the executor of the security monitoring method provided in the embodiment of the present application. The embodiment of the present application does not impose any restrictions on the specific type of the security monitoring device.

[0031] Exemplarily, the security monitoring equipment may include a video recording device and a control device. The video recording device is a device capable of recording and storing videos of a target area. The monitoring device may include a fixed camera, a pan / tilt camera, a spherical camera, a hard disk video recorder (DVR / NVR), etc. The control device is a device capable of controlling the video recording device and performing data processing. The control device may be a mobile phone, a tablet computer, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), a desktop computer, a smart screen, a computing device or other processing device connected to a wireless modem, a computer, a laptop computer, a customer premise equipment (CPE) and / or other devices for communicating on a wireless system and a next generation communication system, such as a mobile terminal in a 5G network or a mobile terminal in a future evolved public land mobile network (PLMN).

[0032] In order to better understand the security monitoring method provided in the embodiment of the present application, the specific implementation process of the security monitoring method provided in the embodiment of the present application is exemplarily introduced below.

[0033] Figure 1 A schematic flow chart of a security monitoring method provided in an embodiment of the present application is shown, and the security monitoring method includes: S100, obtaining a current frame of a target area and obtaining a historical crowd density and a historical abnormal behavior frequency of the target area. The target area is used to represent a security monitoring area in a campus environment.

[0034] Exemplarily, a real-time video stream may be obtained from a video recording device, and a video acquisition module may be used to capture a current frame image.

[0035] It can be understood that the historical crowd density is calculated by analyzing the distribution of the number of people in the target area during a specific period of time in the past.

[0036] Exemplarily, historical data with the same time attribute as the current frame of the target area can be selected, for example, the same time period of the same day (such as 8:00-9:00 am), the same type of activity scene (such as class breaks, playground activities), and similar weather conditions (such as sunny days). The time length can be preset, and the target (person) detection results within the time length can be extracted from the historical videos or logs stored in the video recording device with the same time attribute as the current frame of the target area, including the number of people in each frame within the time length.

[0037] The number of people in each frame can be counted from all frames in the historical time period (within the time length), and the number of people in each frame can be summed to obtain the total number of people in all frames. According to the total number of people in all frames, the area of ​​the target area and the time length, the historical crowd density can be calculated. The calculation formula is: ,in, represents the historical flow density in the historical time period, Indicates the total number of people in all frames within the historical time period. represents the target area, Indicates the length of time.

[0038] If there are multiple historical time periods, the weighted average can be calculated by combining the data of these time periods, that is, ,in, Represents the average value of historical passenger flow density over multiple historical time periods. Indicates the number of historical time periods, Indicates historical time periods, Indicates The historical flow density in a historical period, Indicates The weight of each historical time period can be set based on the similarity between the historical time period and the current time period (such as time, activity type, weather).

[0039] It can be understood that the historical abnormal behavior frequency is the result obtained based on the statistics of abnormal behaviors in the historical time period, which is used to measure the deviation of historical behaviors from normal patterns. Abnormal behaviors can be activities that do not conform to normal behavior patterns, such as running, gathering, etc.

[0040] Exemplarily, historical data with the same time attributes as the current frame of the target area can be selected, for example, the same time period of the same day (such as 8:00-9:00 am), the same type of activity scene (such as recess, playground activities), and similar weather conditions (such as sunny days). The abnormal target (person) detection results within the time length are extracted from the historical videos or logs stored in the video recording device with the same time attributes as the current frame of the target area, including the number of abnormal behaviors and the total number of people in each frame within the time length.

[0041] The number of people with abnormal behaviors and the total number of people can be extracted from all frames in the historical time period (within the time length), and the frequency of historical abnormal behaviors can be calculated. The calculation formula is: ,in, Indicates the historical abnormal behavior frequency, Indicates the number of people with abnormal behaviors in all frames during the historical time period. Indicates the total number of people in all frames during the historical time period.

[0042] When there are multiple historical time periods for reference, the frequency of historical abnormal behavior can be calculated by weighted average, that is, ,in, Represents the average value of the historical abnormal behavior frequency over multiple historical time periods, Indicates The historical frequency of abnormal behavior in a historical time period.

[0043] This step can help to efficiently and accurately obtain the current frame and historical data, providing strong data support for subsequent risk factor analysis and regional risk level assessment.

[0044] S200: Determine a first risk factor based on the current frame and historical crowd density, wherein the first risk factor is used to characterize a dynamic change trend of crowd density in a target area.

[0045] It can be understood that the first risk factor reflects the trend of the change of the crowd density in the target area, that is, the change rate and change range of the crowd density. The first risk factor can include the change rate of the crowd density, the change rate of the crowd density in the target area in the current frame and the historical data; the change trend of the crowd density, according to the change trend of the crowd density in the current frame and the historical crowd density, the change direction of the crowd density can be judged.

[0046] For example, a computer vision algorithm (such as YOLO, RetinaNet, or Faster R-CNN) can be used for target detection to identify people in the current frame and count the number of people in the target area. Based on the number of people in the target area and the area of ​​the target area, the crowd density of the current frame is calculated, that is, ,in, Indicates the crowd density of the current frame. Indicates the total number of people in the current frame. Indicates the area of ​​the target region.

[0047] In this step, the historical average flow density calculated based on multiple historical time periods in step S100 can be used. The density difference between the current frame and the historical time period can be calculated to obtain the change rate of the crowd density, that is, ,in, Indicates the rate of change of crowd density. For example, if the crowd density of the current frame is 500 people / square meter and the historical average crowd density is 250 people / square meter, the change rate of crowd density is That is, the crowd density in the current frame has doubled compared with the historical data, indicating that the crowd density has increased significantly.

[0048] Trend line fitting methods (such as linear regression and exponential smoothing) can be used to capture the changing trend of crowd density over time in the historical time period. If the crowd density of the current frame is significantly higher than that of the historical time period, it means that there is a trend of dense crowds in the target area, which may bring potential safety risks; if the crowd density of the current frame is gradually reduced compared with the historical time period, it means that the crowding level in the target area is reduced and the risk is relatively low.

[0049] The weighted average method can be used to combine the change rate of the crowd density and the change trend of the crowd density to obtain the first risk factor.

[0050] The first risk factor obtained through this step can reflect the dynamic change trend of the crowd density in the target area, providing an effective basis for subsequent safety risk assessment.

[0051] In one possible implementation, see Figure 2 , S200, determining a first risk factor based on the current frame and historical crowd density, including: S210, obtaining the area of ​​the target region.

[0052] For example, if the physical area of ​​the target area is known (such as obtained through a building floor plan, campus planning map, etc.), the area of ​​the target area can be directly used. (Unit: square meters, m²).

[0053] If the target area is directly observed through surveillance video, the area can be estimated through viewing angle calibration and geometric calculation. The pixel coordinates in the video image can be mapped to the actual physical area coordinates using camera calibration. The area of ​​the target area can be calculated using the converted actual area length and width. .

[0054] S220, based on the current frame, calculate the total number of people in the current frame.

[0055] For example, you can use a target detection algorithm (such as YOLO, Faster R-CNN) to detect the number of people in the current frame and count the total number of all detected people. .

[0056] S230, calculating the ratio of the total number of people in the current frame to the area of ​​the target area to obtain the current crowd density.

[0057] For example, the current crowd density The calculation formula is For example, if the area of ​​the target area is 100m² and the total number of people in the current frame is 50, then the current crowd density is .

[0058] S240, calculating the ratio of the current crowd density to the historical crowd density to obtain a first risk factor.

[0059] It can be understood that the first risk factor characterizes the dynamic change trend of crowd density through the ratio of current crowd density to historical crowd density. If the ratio of current crowd density to historical crowd density (historical average crowd density) is 1, then the current crowd density is the same as the historical crowd density (historical average crowd density) and there is no significant change; if the ratio of current crowd density to historical crowd density (historical average crowd density) is greater than 1, then the current crowd density is higher than the historical crowd density (historical average crowd density), and the risk increases; if the ratio of current crowd density to historical crowd density (historical average crowd density) is less than 1, then the current crowd density is lower than the historical crowd density (historical average crowd density), and the risk is low.

[0060] Exemplarily, the calculation formula of the first risk factor is: or ,in, Indicates the first risk factor. For example, if the historical crowd density is 0.3 people / m² and the current crowd density is 0.5 people / m², then the first risk factor is .

[0061] In one possible implementation, see Figure 3 , the security monitoring method also includes: S201, obtaining a time window, and obtaining all frames in the time window according to the time window and the current frame, wherein the current frame is the last frame of all frames in the time window.

[0062] For example, a time window is a time period used to obtain all monitoring frames of the target area within the time period. The length of the time window can be set manually, such as .

[0063] You can use time windows Collect all frames from the video device from the start time to the end time (the time point of the current frame), and the frame sampling frequency can be one frame per second (FPS=1) or higher. Assume that the frame rate is (frames / second), then the time window The number of frames in . Use a list of frames to store time windows All frames within the time window can be The index of each frame in all frames is marked as ,in Indicates the current frame.

[0064] S202, calculating the total number of people in each frame of all frames within the time window.

[0065] For example, a target detection algorithm (such as YOLO, Faster R-CNN) can be used to detect the total number of people in each frame of all frames in the time window, and the total number of people in each frame of all frames is counted, and the total number of people in each frame of all frames is recorded as a sequence ,in, Indicates The total number of people in the frame, Indicates the total number of people in the current frame.

[0066] S203, based on the total number of people in each frame of all frames in the time window and the area of ​​the target area, calculate the average value of the crowd flow density in the time window to obtain the current crowd flow density.

[0067] For example, the time window is calculated The total number of people in each frame in all frames (i.e. ) and the area of ​​the target area The ratio of the crowd density of each frame is obtained; the crowd density of each frame is summed to obtain the total crowd density; and according to the time window Number of frames in And the total crowd density, calculate the average crowd density within the time window. Time window The calculation formula for the average value of the crowd density in the ,in, Represents a time window The average value of the crowd density within Indicates the total crowd density. The average of the crowd density within the time window is determined as the current crowd density.

[0068] Assuming time window Number of frames in is 6, and the total number of people in each frame is , the area of ​​the target area is 100m², then the average density of people flow in the time window is .

[0069] This step obtains all frames within the time window, calculates the total number of people frame by frame, and takes the average crowd density, which can more accurately reflect the actual crowd density status of the target area.

[0070] S300, determining a second risk factor based on the current frame and the historical abnormal behavior frequency, wherein the second risk factor is used to characterize the abnormality of the current behavior pattern in the target area.

[0071] For example, the current frame can be analyzed by target detection (such as YOLO, Faster R-CNN) combined with a behavior recognition model (such as a convolutional neural network, a long short-term memory network (LSTM) or a 3D convolutional neural network (C3D), etc.) to identify abnormal behavior patterns in the target area. For example, using a deep learning model or a traditional rule-based model, the abnormal behavior of the current frame is detected as running or gathering, and the abnormal behavior is marked as abnormal. The total number of people in the target area in the current frame and the number of people with abnormal behavior in the target area can be counted, and the frequency of abnormal behavior in the current frame can be calculated, that is, ,in, Indicates the frequency of abnormal behavior in the current frame, Indicates the number of people with abnormal behaviors in the target area in the current frame, Indicates the total number of people in the target area in the current frame.

[0072] Based on multiple historical abnormal behavior frequency data (multiple historical abnormal behavior frequencies calculated based on multiple historical time periods in step S100), a historical abnormal behavior sequence can be constructed in ascending order of time, and the historical abnormal behavior frequency sequence can be input into a machine learning model (such as a regression model, random forest, etc.) to predict future abnormal behavior frequencies. The error between the abnormal behavior frequency of the current frame and the predicted abnormal behavior frequency is calculated. If the abnormal behavior frequency of the current frame is much greater than the predicted value, it means that the abnormality of the behavior of the current frame is high, and the second risk factor value is also high, and the error value is used as the second risk factor.

[0073] The second risk factor obtained through this step can effectively characterize the abnormality of the current behavior pattern in the target area, provide an important risk assessment basis for the security monitoring system, and thus provide intelligent assistance for event warning, decision support and resource allocation.

[0074] In a possible implementation, S300, based on the current frame and the historical abnormal behavior frequency, determining the second risk factor includes: S310, determining a current abnormal behavior frequency according to a current frame and all frames in the time window.

[0075] For example, video analysis techniques (such as YOLO+LSTM, C3D model) can be used to analyze the time window Each frame in all frames ( ) to detect the total number of people and the number of people with abnormal behavior, and count the total number of people detected in each frame ( ) and the number of abnormal behaviors ( ,in Indicates the number of abnormal behaviors in each frame). Calculate the ratio of the number of abnormal behaviors to the total number of people in each frame to obtain the abnormal behavior frequency of each frame; sum the abnormal behavior frequencies of each frame to obtain the total abnormal behavior frequency; according to the total abnormal behavior frequency and time window Number of frames in ,Calculation time window The average frequency of abnormal behaviors within . The calculation formula is ,in, Represents a time window The average frequency of abnormal behavior within Represents the total abnormal behavior frequency. The average value of the abnormal behavior frequencies within is taken as the current abnormal behavior frequency.

[0076] Optionally, S310, determining a current abnormal behavior frequency according to the current frame and all frames in the time window, includes: S311, mark each target in the current frame to obtain an identifier corresponding to each target, wherein each target in the current frame is used to represent each person in the current frame.

[0077] For example, a target detection algorithm can be used to detect all targets (i.e., each person) in the current frame, and a unique identifier (such as ID1, ID2, ..., IDn) can be generated for each detected person. A tracking algorithm (such as SORT, DeepSORT) can be used to assign a consistent identifier to each target within a time window, which helps the same target maintain the same ID in multiple frames within the time window.

[0078] S312, extracting the behavior features of each target from all frames within the time window.

[0079] Exemplarily, a behavior recognition model (such as C3D, I3D, ST-GCN) can be used to extract the behavior features of each target in each frame of all frames in a time window, and aggregate the behavior features of each target in all frames in the time window to generate the overall behavior features of each target.

[0080] For example, see Figure 4 and Figure 5 , S312, extracting the behavior features of each target from all frames within the time window, including: S3121, based on all frames in the time window, calculate the displacement of each target, and calculate the speed of each target in the time window according to the displacement of each target, to obtain the speed value of each target.

[0081] For example, based on the identifier (ID1, ID2, ..., IDn) corresponding to each target obtained in step S311, each frame ( ) extracts the position coordinates of each target, that is, the identifier and position of each target are represented as ,in, Indicates goals, Indicates Target in frame The total displacement of each target in the time window is calculated based on the position coordinates of the first frame and the position coordinates of the last frame (current frame), that is, for each target: ,in, Indicates the target The total displacement within the time window, Indicates the target At the start frame of the time window, Indicates the target The position of the ending frame (the current frame) in the time window.

[0082] Depending on the length of the time window and the total displacement of each target in the time window, calculate the velocity of each target in the time window, that is, ,in, Indicates the target The speed within the time window.

[0083] S3122, based on the current frame in all frames within the time window, calculate the distance value between each target in the current frame and each target, and obtain a distance collection of each target.

[0084] Exemplarily, based on the position coordinates of each target in each frame of all frames within the time window obtained in step S3121, the position coordinates of each target in the end frame (current frame) can be extracted, that is, For every two targets in the current frame ( and ), calculate the Euclidean distance between them, that is, ,in, Indicates the target and goals The distance between Indicates the target in the current frame The location coordinates of Indicates the target in the current frame Based on the calculated distance values ​​between each target and each target, a distance collection of each target is constructed ,in, Indicates the total number of targets in the current frame. The distance from each target to itself can be set to 0.

[0085] S3123, integrating the speed value of each target and the distance collection of each target to obtain the behavior characteristics of each target.

[0086] For example, the behavior feature of each target may be a combination of the speed of each target and the distances to other targets in the current frame. The behavior feature of each target may be represented as a corresponding vector, such as .

[0087] Assume that the time window length is 10 seconds, the starting frame position coordinates of ID1 in the time window are (2, 3), the current frame position coordinates are (8, 7), and the position coordinates of all targets in the current frame are ID1 (8, 7), ID2 (5, 4), and ID3 (9, 9). Calculate the total displacement of ID1 , based on the total displacement of ID1, calculate the velocity of ID1 . Calculate the distance between ID1 and ID2 , calculate the distance between ID1 and ID3 , then the distance set of ID1 is , the behavioral feature vector of ID1 is .

[0088] The target's behavioral characteristics obtained through the above steps comprehensively reflect the target's motion characteristics (speed) and spatial relationship (distance from other targets). The behavioral characteristics can be used for subsequent behavioral pattern analysis and anomaly detection.

[0089] S313, determining abnormal target information according to the behavior characteristics of each target and the identifier corresponding to each target, wherein the abnormal target information includes the behavior characteristics of each abnormal target and the identifier corresponding to each abnormal target.

[0090] Exemplarily, historical data can be used to establish normal behavior patterns, and abnormal behavior can be detected based on statistical models or machine learning models. If the behavioral characteristics of a target deviate significantly from the normal behavior patterns, the model can determine that the target is an abnormal target and extract the identifier and behavioral characteristics corresponding to the target.

[0091] For example, see Figure 4 and Figure 5 , S313, determining abnormal target information according to the behavior characteristics of each target and the identifier corresponding to each target, including: S3131, comparing the speed value of each target with the speed threshold value, determining whether the speed of each target is greater than the speed threshold value, determining the target whose speed is greater than the speed threshold value as a running target, and marking the identifier corresponding to each running target as running, to obtain running target information. The running target information includes the speed of each running target and the identifier corresponding to each running target after marking.

[0092] For example, a speed threshold may be set to determine whether the target is in a running state. For example, the average speed of human walking is about 1.2 m / s, and the running speed may be higher than 2.5 m / s. The speed of each target may be compared with the speed threshold. If the speed of a target is greater than the speed threshold, it is determined to be a running target, and a running tag is added to the target. The speed value of the target and the identifier corresponding to the target with the running tag are extracted to generate the running target information of the target. The running target information of all the running targets determined to be running targets are merged to generate the total running target information.

[0093] Assume that the speed threshold is 2.5m / s, the speed of target ID1 is 2.0m / s, the speed of target ID2 is 3.5m / s, the speed of target ID3 is 1.8m / s, the speed of target ID4 is 4.0m / s, and the speed of target ID5 is 2.8m / s. Compare the speeds of target ID1 to target ID5 with the speed threshold. The speeds of target ID2, target ID4, and target ID5 are all greater than the speed threshold. Target ID2, target ID4, and target ID5 are marked as running. Then the running target information can be {(ID2, 3.5, running), (ID4, 4.0, running), (ID5, 2.8, running)}.

[0094] Through this step, the running targets can be efficiently screened out and the corresponding running target information can be generated. The running target information can be used for behavior analysis and early warning of the security monitoring system, especially in areas with high pedestrian density. Running behavior is related to abnormal events (such as sudden accidents or emergency evacuations), which has important security monitoring value.

[0095] S3132, based on the distance collection of each target, each target is processed as follows: each distance value in the distance collection of the target is compared with the distance threshold, and each distance value in the distance collection of the target is judged to meet the first condition, and the target corresponding to the distance value that meets the first condition is determined as a close-range target; whether the distance value between the target and each close-range target meets the second condition, and the close-range target that meets the second condition is determined as an abnormal target; whether the number of abnormal targets meets the third condition, when the number of abnormal targets meets the third condition, the target and each abnormal target are determined as clustered targets, and the identifier corresponding to each clustered target is clustered and marked to obtain the clustered target information. Among them, the first condition includes that the distance value is less than or equal to the distance threshold, the second condition includes that the distance value is less than or equal to the distance threshold within the time window, the third condition includes that the number of abnormal targets is greater than or equal to the number threshold, and the clustered target information includes the identifier corresponding to each clustered target after marking.

[0096] For example, a distance threshold may be set to define the criteria for determining close-range targets; a quantity threshold may be set to determine the quantity criteria for determining whether abnormal targets constitute a cluster. For each target IDn, the distance collection of target IDn ( , based on the current frame) are compared with the distance threshold, and the value that satisfies the distance threshold is filtered out, and the target IDm corresponding to the value is used as a close-range target. The distance between the close-range targets IDm and IDn in each frame of all frames in the time window is calculated. The calculation method is the same as step S3122 and will not be repeated here. From all close-range targets, the targets whose distances to the target IDn in all frames in the time window are less than or equal to the distance threshold are filtered out as abnormal targets. The number of abnormal targets is counted, and the number of abnormal targets is compared with the number threshold. If the number of abnormal targets is greater than or equal to the number threshold, all abnormal targets and target IDn are used as clustered targets, and all abnormal targets and target IDn are marked as clustered.

[0097] Assume that the distance threshold is 1.5m, the quantity threshold is 2, and the distance set of target ID1 is , the distance collection of target ID2 is , the distance collection of target ID3 is , the distance collection of target ID4 is . For target ID1, by comparing each value in the distance collection of target ID1 with the distance threshold, it can be concluded that the distance between target ID1 and target ID2 is less than the distance threshold and the distance between target ID1 and target ID4 is less than the distance threshold, and target ID2 and target ID4 are regarded as close targets. Assuming that it is calculated that the distance between target ID1 and target ID2 in each frame of all frames in the time window is less than the distance threshold and the distance between target ID1 and target ID4 is less than the distance threshold, target ID2 and target ID4 are regarded as abnormal targets. At this time, the number of abnormal targets is 2, and the number of abnormal targets is equal to the number threshold. Target ID1, target ID2 and target ID4 are regarded as clustered targets, and target ID1, target ID2 and target ID4 are marked as clustered. The clustered target information can be {(ID1, clustered), (ID2, clustered), (ID4, clustered)}.

[0098] This step can effectively detect targets with aggregation behavior and generate corresponding aggregation target information, which is suitable for risk assessment and abnormal behavior monitoring in crowded scenes.

[0099] S3133, integrating the running target information and the gathering target information to obtain abnormal target information.

[0100] Exemplarily, running and gathering are two independent abnormal behaviors, and the corresponding target numbers can be detected and counted separately. Since some targets may belong to both running and gathering, you can choose to remove duplicate statistics when counting, that is, a target can only be counted in the number of abnormal targets once. The number of running targets is counted from the running target information, and the number of gathering targets is counted from the gathering target information. Targets with the same identifier are screened out from the identifier of each running target in the running target information and the identifier of each gathering target in the gathering target information, and the number of targets with the same identifier is counted. The number of running targets is added to the number of gathering targets, and the number of targets with the same identifier is subtracted to obtain the number of abnormal targets.

[0101] Extract the identifier and the annotated label corresponding to each abnormal target, and merge the identifier and the annotated label corresponding to each abnormal target to generate abnormal target information. For example, the abnormal target information can be {(ID1, gathering), (ID2, running, gathering), (ID4, running, gathering)}.

[0102] S314, mapping the abnormal target information to the current frame, and calculating the ratio of the number of abnormal targets in the current frame to the number of all targets in the current frame to obtain the current abnormal behavior frequency.

[0103] Exemplarily, according to the identifier corresponding to each abnormal target in the abnormal target information, the abnormal targets in the time window are marked to the current frame, that is, the number of abnormal targets in the current frame is the number of targets with abnormal behavior in all frames in the time window. The current abnormal behavior frequency can be defined as the ratio of the number of abnormal targets to the total number of targets in the current frame. For example, if the number of abnormal targets in the current frame is 2 and the total number of targets in the current frame is 5, then the current abnormal behavior frequency is 2 / 5=0.4.

[0104] The current abnormal behavior frequency obtained through the above steps can be compared with the historical abnormal behavior frequency to further calculate the second risk factor, providing a basis for dynamic risk assessment and early warning.

[0105] S320, calculating the ratio of the current abnormal behavior frequency to the historical abnormal behavior frequency to obtain a second risk factor.

[0106] It can be understood that the second risk factor is used to measure the change in the current abnormal behavior frequency relative to the historical abnormal behavior frequency. If the ratio of the current abnormal behavior frequency to the historical abnormal behavior frequency (historical average abnormal behavior frequency) is 1, then the current abnormal behavior frequency is the same as the historical abnormal behavior frequency (historical average abnormal behavior frequency), indicating that there is no significant change; if the ratio of the current abnormal behavior frequency to the historical abnormal behavior frequency (historical average abnormal behavior frequency) is greater than 1, then the current abnormal behavior frequency is higher than the historical abnormal behavior frequency (historical average abnormal behavior frequency), indicating that abnormal behaviors in the target area have increased and the risk has increased; if the ratio of the current abnormal behavior frequency to the historical abnormal behavior frequency (historical average abnormal behavior frequency) is less than 1, then the current abnormal behavior frequency is lower than the historical abnormal behavior frequency (historical average abnormal behavior frequency), indicating that abnormal behaviors in the target area have decreased and the risk has decreased.

[0107] Exemplarily, the calculation formula of the second risk factor is: or ,in, Represents the second risk factor.

[0108] Through the above steps, abnormal behavior within the time window can be detected and the frequency of abnormal behavior can be calculated. By comparing it with the historical abnormal behavior frequency, the second risk factor can be accurately obtained. The second risk factor directly reflects the abnormal degree of the behavior pattern in the target area and provides an important basis for dynamic risk assessment.

[0109] S400: Determine a risk level of a target area based on a first risk factor and a second risk factor.

[0110] It is understandable that the risk level classification criteria can be set in advance. For example, low risk means that the target area has a low security risk and is not prone to emergencies or safety accidents; medium risk means that the target area has certain security risks and potential dangers, but is still controllable; high risk means that the target area has a high security risk and may have safety accidents or emergencies, and needs to be monitored closely.

[0111] For example, since the first risk factor and the second risk factor may use different units or dimensions, in order to be able to make effective comparisons and synthesis, the first risk factor and the second risk factor may be standardized or normalized. The standardization method may use Z-score standardization. The result of Z-score standardization will convert the data into a distribution with a mean of 0 and a standard deviation of 1, which is convenient for comparing the relative sizes of different factors. Normalization is to normalize each risk factor to a range of 0 to 1. The normalized value can directly reflect the relative position of the risk factor in the historical data.

[0112] The first risk factor and the second risk factor may contribute differently to the total risk, so weights can be assigned to the first risk factor and the second risk factor. The weights of the first risk factor and the second risk factor can be set manually; the weights can be determined by statistical analysis of historical data or by using machine learning methods, such as principal component analysis (PCA), decision trees, or regression analysis to evaluate the contribution of each factor. After determining the weights of the first risk factor and the second risk factor, the total risk score can be calculated by the weighted average method, that is, ,in, represents the total risk value, and represents the weight of the first risk factor and the weight of the second risk factor, and Indicates the first risk factor and the second risk factor. The threshold range for risk level division can be set manually, and the total risk score is compared with the threshold range for risk level division to determine the risk level of the target area.

[0113] Assume that the threshold range of low risk is [0, 0.33], the threshold range of medium risk is [0.34, 0.66], and the threshold range of high risk is [0.67, 1]. The standardized value of the first risk factor is 0.8, and the standardized value of the second risk factor is 0.6. The weight of the first risk factor and the weight of the second risk factor are set to 0.6 and 0.4 respectively, then the total risk value is , the total risk value of 0.72 is within the high risk threshold range [0.67, 1], so the risk level of the target area is high risk.

[0114] Through this step, the risk level of the target area can be accurately assessed. The classification of risk levels provides security managers with a clear judgment standard, helping them to take corresponding preventive measures, which is beneficial to the security of various monitoring areas on campus.

[0115] In a possible implementation, S400, determining the risk level of the target area based on the first risk factor and the second risk factor, includes: S410: Obtain a total risk factor based on the first risk factor and the second risk factor.

[0116] It can be understood that the total risk factor can be used to comprehensively reflect the overall risk level of the target area.

[0117] Exemplarily, the total risk factor may be calculated by multiplying the first risk factor and the second risk factor, that is, .

[0118] S420, comparing the total risk factor with the first risk threshold and the second risk threshold respectively to obtain a comparison result. The first risk threshold is less than the second risk threshold, and the comparison result includes that the total risk factor is less than or equal to the first risk threshold or the total risk factor is less than or equal to the second risk threshold and the total risk factor is greater than the first risk threshold or the total risk factor is greater than the second risk threshold.

[0119] For example, a first risk threshold and a second risk threshold may be set, wherein the first risk threshold is used to distinguish between low risk and medium risk, and the second risk threshold is used to distinguish between medium risk and high risk, and the first risk threshold is smaller than the second risk threshold. For example, the first risk threshold may be expressed as , the second risk threshold can be expressed as ,and .

[0120] The total risk factor The first risk threshold and the second risk threshold Make a comparison and obtain the comparison result.

[0121] S430: When the comparison result indicates that the total risk factor is less than or equal to the first risk threshold, determine that the risk level of the target area is low risk.

[0122] For example, if the comparison result is that the total risk factor is less than or equal to the first risk threshold, that is, , then the risk level of the target area is low risk.

[0123] S440: When the comparison result indicates that the total risk factor is greater than the first risk threshold and the total risk factor is less than or equal to the second risk threshold, determine that the risk level of the target area is medium risk.

[0124] For example, if the comparison result is that the total risk factor is greater than the first risk threshold and the total risk factor is less than or equal to the second risk threshold, that is, , then the risk level of the target area is medium risk.

[0125] S450: When the comparison result indicates that the total risk factor is greater than the second risk threshold, determine that the risk level of the target area is high risk.

[0126] For example, if the comparison result is that the total risk factor is greater than the second risk threshold, that is, , then the risk level of the target area is high risk.

[0127] Through the above steps and using the comparison rules of risk thresholds, the risk level of the target area can be determined quickly and accurately, providing effective decision support and early warning mechanisms for the security monitoring system.

[0128] In a possible implementation, S400, determining the risk level of the target area based on the first risk factor and the second risk factor, includes: S401, inputting the first risk factor and the second risk factor into a risk prediction model so that the risk prediction model predicts the risk level of the target area. The risk prediction model is a machine learning model.

[0129] Exemplarily, the first risk factor and the second risk factor can be used as input data and input into a trained risk prediction model. The risk prediction model can predict the risk level of the target area based on the input data. After the prediction is completed, the risk prediction model outputs a prediction result, i.e., the risk level of the target area.

[0130] In a possible implementation, the security monitoring method further includes: S10, obtaining a collection of risk factor samples, wherein the risk factor samples include a first risk factor and a second risk factor of a certain sample area.

[0131] For example, the first risk factors and the second risk factors of different regions and time periods can be collected through historical data stored in actual monitoring scenarios to form a risk factor sample collection, which can be represented by a two-dimensional table or matrix.

[0132] S20, labeling each risk factor sample in the risk factor sample collection to obtain a risk level label for each risk factor sample in the risk factor sample collection.

[0133] For example, specific risk level classification rules can be set manually according to business needs or domain knowledge. The values ​​of the first risk factor and the second risk factor of each sample are traversed, and the risk level of the sample is determined according to the risk level classification rules, and the judgment result is used as the risk level label of the sample.

[0134] Unsupervised learning methods (such as K-means clustering) can be used to input the values ​​of the first risk factor and the second risk factor as sample features into the clustering algorithm, set the number of clustering categories (such as 3 categories, low risk, medium risk, and high risk), and based on the clustering results, label each sample with the label of the category to which it belongs.

[0135] S30, based on the risk factor sample collection and the risk label of each risk factor sample in the risk factor sample collection, training the machine learning model to obtain a risk prediction model.

[0136] For example, the sample collection can be divided into a training set and a test set. The training set is used to train the machine learning model, and the ratio can be 70%-80%; the test set is used to evaluate the model performance, and the ratio can be 20%-30%. Each risk factor sample in the risk factor sample collection can be standardized or normalized to improve the model training effect.

[0137] You can choose a suitable machine learning model as the risk prediction model, for example, logistic regression, which is suitable for simple binary or multi-classification problems; decision tree, which is used for classification problems with clear risk factor characteristics; random forest: using multiple decision trees to improve the stability of the model; support vector machine (SVM), which is suitable for nonlinear classification problems; neural network, which is suitable for classification problems with complex feature relationships.

[0138] Each pair of risk factors (first risk factor and second risk factor) in the training set can be used as input features and the risk level as the output label to train the machine learning model so that the model can learn the mapping relationship between the first risk factor and the second risk factor and the risk level. The model is optimized for hyperparameters so that the model can accurately predict the risk level, for example, the maximum depth and minimum number of sample splits of the decision tree; the number of trees and maximum depth of the random forest; the number of layers and the number of nodes per layer of the neural network.

[0139] The test set can be input into the trained model to predict the risk level and calculate the degree of match between the prediction result and the actual label. Evaluation indicators can include accuracy, the proportion of samples predicted correctly by the model; precision, recall and F1 score, which measure the performance of the model. Cross-validation can be used to train and test the model multiple times to verify the stability of the model and avoid overfitting.

[0140] The trained and tested machine learning model can be used as a risk prediction model to predict the risk level of the target area in real time.

[0141] Through the above steps, a dynamic risk prediction model can be constructed. The risk prediction model can predict the risk level of the target area based on the first risk factor and the second risk factor input in real time, providing support for intelligent monitoring and safety management.

[0142] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0143] Corresponding to the security monitoring method described in the above embodiment, the embodiment of the present application further provides a security monitoring device, and each unit of the device can implement each step of the security monitoring method. Figure 6 A structural block diagram of a security monitoring device provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0144] Reference Figure 6 , the device comprises: The acquisition unit is used to acquire the current frame of the target area and acquire the historical crowd density and historical abnormal behavior frequency of the target area. The target area is used to represent a security monitoring area in a campus environment.

[0145] The first risk factor determination unit is used to determine a first risk factor based on the current frame and the historical crowd density, wherein the first risk factor is used to characterize the dynamic change trend of the crowd density in the target area.

[0146] The second risk factor determination unit is used to determine the second risk factor based on the current frame and the historical abnormal behavior frequency, wherein the second risk factor is used to characterize the abnormality of the current behavior pattern in the target area.

[0147] The risk level determination unit is used to determine the risk level of the target area based on the first risk factor and the second risk factor.

[0148] It should be noted that the information interaction, execution process and other contents between the above-mentioned units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0149] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned device can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0150] The present application also provides a security monitoring device. Figure 7 This is a schematic diagram of the structure of a security monitoring device provided in an embodiment of the present application. The security monitoring device includes a video recording device and a control device. Figure 7 As shown, the control device 6 of the security monitoring device of this embodiment includes: at least one processor 60 ( Figure 7 Only one is shown), at least one memory 61 ( Figure 7 Only one is shown in the figure) and a computer program 62 stored in the at least one memory 61 and executable on the at least one processor 60. When the processor 60 executes the computer program 62, the security monitoring device implements the steps in any of the above-mentioned security monitoring method embodiments, or the security monitoring device implements the functions of the units in the above-mentioned device embodiments.

[0151] Exemplarily, the computer program 62 may be divided into one or more modules / units, which are stored in the memory 61 and executed by the processor 60 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 62 in the control device 6 of the security monitoring device.

[0152] The control device 6 of the security monitoring device can be a computing device such as a desktop computer, a notebook, a palm computer, and a cloud server. The security monitoring device may include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art can understand that Figure 7 It is only an example of security monitoring equipment and does not constitute a limitation of the security monitoring equipment. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, buses, etc.

[0153] The processor 60 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0154] In some embodiments, the memory 61 may be an internal storage unit of the control device 6 of the security monitoring device, such as a hard disk or memory of the security monitoring device. In other embodiments, the memory 61 may also be an external storage device of the security monitoring device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the security monitoring device. Further, the memory 61 may also include both an internal storage unit and an external storage device of the security monitoring device. The memory 61 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program, etc. The memory 61 may also be used to temporarily store data that has been output or is to be output.

[0155] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0156] An embodiment of the present application provides a computer program product. When the computer program product runs on a security monitoring device, the security monitoring device implements the steps in any of the above method embodiments.

[0157] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the security monitoring equipment, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, USB flash drive, mobile hard disk, disk or optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0158] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0159] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0160] In the embodiments provided in the present application, it should be understood that the disclosed security monitoring devices, equipment and methods can be implemented in other ways. For example, the security monitoring device and equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0161] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0162] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A security monitoring method, characterized in that: include: Acquire a current frame of a target area and acquire a historical crowd density and a historical abnormal behavior frequency of the target area; wherein the target area is used to represent a security monitoring area in a campus environment; Determine a first risk factor based on the current frame and the historical crowd density; wherein the first risk factor is used to characterize the dynamic change trend of the crowd density in the target area; Determining a second risk factor based on the current frame and the historical abnormal behavior frequency; wherein the second risk factor is used to characterize the abnormality of the current behavior pattern in the target area; A risk level of the target area is determined based on the first risk factor and the second risk factor.

2. The security monitoring method according to claim 1, characterized in that: The determining of the first risk factor based on the current frame and the historical crowd density includes: Acquire the area of ​​the target area; Based on the current frame, calculating the total number of people in the current frame; Calculate the ratio of the total number of people in the current frame to the area of ​​the target area to obtain the current crowd density; The ratio of the current crowd flow density to the historical crowd flow density is calculated to obtain the first risk factor.

3. The security monitoring method according to claim 2, characterized in that: The method further comprises: Acquire a time window, and acquire all frames in the time window according to the time window and the current frame; wherein the current frame is the last frame of all frames in the time window; Calculate the total number of people in each frame of all frames within the time window; Based on the total number of people in each frame of all frames in the time window and the area of ​​the target area, the average value of the crowd flow density in the time window is calculated to obtain the current crowd flow density.

4. The security monitoring method according to claim 3, characterized in that: The determining of the second risk factor based on the current frame and the historical abnormal behavior frequency includes: Determine a current abnormal behavior frequency according to the current frame and all frames within the time window; The ratio of the current abnormal behavior frequency to the historical abnormal behavior frequency is calculated to obtain the second risk factor.

5. The security monitoring method according to claim 4, characterized in that: The determining the current abnormal behavior frequency according to the current frame and all frames in the time window includes: Marking each target in the current frame to obtain an identifier corresponding to each target; wherein each target in the current frame is used to represent each person in the current frame; Extracting behavioral features of each target from all frames within the time window; Determine abnormal target information according to the behavior characteristics of each target and the identifier corresponding to each target; wherein the abnormal target information includes the behavior characteristics of each abnormal target and the identifier corresponding to each abnormal target; The abnormal target information is mapped to the current frame, and the ratio of the number of abnormal targets in the current frame to the number of all targets in the current frame is calculated to obtain the current abnormal behavior frequency.

6. The security monitoring method according to claim 5, characterized in that: The step of extracting the behavior features of each target from all frames within the time window comprises: Based on all frames in the time window, the displacement of each target is calculated, and according to the displacement of each target, the speed of each target in the time window is calculated to obtain the speed value of each target; Based on a current frame among all frames in the time window, calculating the distance value between each target and each target in the current frame to obtain a distance collection of each target; The speed value of each target and the distance collection of each target are integrated to obtain the behavioral characteristics of each target.

7. The security monitoring method according to claim 6, characterized in that: The determining of abnormal target information according to the behavior characteristics of each target and the identifier corresponding to each target includes: Compare the speed value of each target with the speed threshold value, determine whether the speed of each target is greater than the speed threshold value, determine the target whose speed is greater than the speed threshold value as a running target, and mark the identifier corresponding to each running target as running, so as to obtain running target information; wherein the running target information includes the speed of each running target and the identifier corresponding to each running target after marking; Based on the distance collection of each target, each target is processed as follows: each distance value in the distance collection of the target is compared with the distance threshold, and it is determined whether each distance value in the distance collection of the target satisfies the first condition, and the target corresponding to the distance value that satisfies the first condition is determined as a close-range target; whether the distance value between the target and each close-range target satisfies the second condition, and the close-range target that satisfies the second condition is determined as an abnormal target; whether the number of abnormal targets satisfies the third condition, when the number of abnormal targets satisfies the third condition, the target and each abnormal target are determined as clustered targets, and the identifier corresponding to each clustered target is clustered and marked to obtain clustered target information; wherein, the first condition includes that the distance value is less than or equal to the distance threshold, the second condition includes that the distance value is less than or equal to the distance threshold within the time window, the third condition includes that the number of abnormal targets is greater than or equal to the number threshold, and the clustered target information includes the identifier corresponding to each clustered target after marking; The running target information and the gathering target information are integrated to obtain the abnormal target information.

8. The security monitoring method according to claim 1, characterized in that: The determining the risk level of the target area based on the first risk factor and the second risk factor includes: Based on the first risk factor and the second risk factor, obtaining a total risk factor; Comparing the total risk factor with the first risk threshold and the second risk threshold respectively to obtain a comparison result; wherein the first risk threshold is less than the second risk threshold, and the comparison result includes that the total risk factor is less than or equal to the first risk threshold or the total risk factor is less than or equal to the second risk threshold and the total risk factor is greater than the first risk threshold or the total risk factor is greater than the second risk threshold; When the comparison result indicates that the total risk factor is less than or equal to the first risk threshold, determining that the risk level of the target area is low risk; When the comparison result indicates that the total risk factor is greater than the first risk threshold and the total risk factor is less than or equal to the second risk threshold, determining that the risk level of the target area is medium risk; When the comparison result indicates that the total risk factor is greater than the second risk threshold, the risk level of the target area is determined to be high risk.

9. The security monitoring method according to claim 1, characterized in that: The determining the risk level of the target area based on the first risk factor and the second risk factor includes: The first risk factor and the second risk factor are input into a risk prediction model so that the risk prediction model predicts the risk level of the target area; wherein the risk prediction model is a machine learning model.

10. A security monitoring device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

Images