Abnormal behavior detection method and device based on campus security and electronic equipment

Abstract

The invention relates to the technical field of smart campuses, and discloses an abnormal behavior detection method and device based on campus safety and electronic equipment. The method comprises the steps of obtaining behavior data of a target object; preprocessing the behavior data to obtain processed behavior data; performing abnormal behavior detection on the processed behavior data to obtain a difference between the behavior data and a normal behavior mode; and determining whether the behavior data has a behavior deviating from a normal state or not according to the difference. The behavior data of the target object is automatically processed and detected, the possibility of manual intervention and misjudgment can be reduced, and the accuracy and efficiency of detection are improved. According to the invention, people, equipment and the like in the campus can be monitored and detected in real time, abnormal behaviors can be found in time, safety events in the campus can be prevented and restrained, and the safety of the campus is improved. The system can be applied to various scenes in a campus, such as teaching buildings, dormitories, canteens, playgrounds and the like, and has relatively high applicability and expansibility.

Description

Technical Field

[0001] The present application relates to the technical field of smart campuses, and in particular to an abnormal behavior detection method, device and electronic equipment based on campus safety. Background Art

[0002] Existing campus security technology solutions usually use traditional monitoring systems and manual patrols to maintain campus safety. These solutions rely on surveillance cameras, access control systems and other equipment installed on campus to obtain student behavior information, and use manual monitoring and analysis to determine whether there is abnormal behavior.

[0003] In the process of implementing the embodiments of the present application, the inventors found that the prior art has at least the following problems: the efficiency of manual monitoring is limited, and it is impossible to monitor and analyze the behavior of each student in real time, and it is easy to miss and delay the processing of abnormal behavior; manual monitoring is easily affected by subjective factors, and different monitoring personnel may have different judgment standards and accuracy for abnormal behavior, resulting in missed reports or false reports; the large amount of data collected needs to be processed and analyzed manually, which requires a lot of time and human resources, and it is difficult to obtain valuable information in a timely manner. Therefore, providing a method that can automatically detect abnormal behavior of target objects and issue alarms in a timely manner is of great significance to improving the level of campus safety. Summary of the invention

[0004] The main technical problem solved by the implementation method of this application is how to improve the efficiency and accuracy of abnormal behavior detection in campus security.

[0005] In order to solve the above technical problems, a technical solution adopted in the implementation mode of the present application is: to provide an abnormal behavior detection method based on campus safety, including: obtaining behavior data of a target object; preprocessing the behavior data to obtain processed behavior data; performing abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and the normal behavior pattern; and determining whether the behavior data contains behavior that deviates from the normal state based on the difference.

[0006] Optionally, the performing abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and the normal behavior pattern includes: extracting target features from the processed behavior data, the target features including location, timestamp, action, sound and image; comparing and matching the extracted target features with the normal behavior pattern in a training set to calculate the similarity or distance between the target features and the normal behavior pattern, and obtaining the difference between the behavior data and the normal behavior pattern based on the similarity or the distance.

[0007] Optionally, determining whether the behavior data has any behavior that deviates from the normal state based on the difference includes: comparing the difference with a preset threshold, and when the difference is greater than the preset threshold, determining that the behavior data has any behavior that deviates from the normal state, otherwise determining that the behavior data does not deviate from the normal state.

[0008] Optionally, the steps of performing abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and the normal behavior pattern, and determining whether the behavior data has behavior that deviates from the normal state based on the difference are performed by a preset algorithm model; the method also includes: obtaining sample data, the sample data including the behavior data of the target object; preprocessing the sample data to obtain processed sample data; extracting features of the target object based on the processed sample data; dividing the processed sample data into a training set and a test set, and classifying and labeling the training set, the classification labeling including labeling of normal behavior and abnormal behavior; training a machine learning model based on the features of the target object and the data with the classification labeling, so that the machine learning model learns the differences and rules between the normal behavior and the abnormal behavior, and obtains a trained machine learning model; using the test set to evaluate the trained machine learning model to compare the difference between the model's predicted results and the actual results; when the difference between the predicted results and the actual results meets the preset conditions, determining that the trained machine learning model is the preset algorithm model, otherwise, retraining the machine learning model.

[0009] Optionally, when the behavior data contains behavior that deviates from the normal state, the method further includes: triggering abnormal behavior alarm information; the triggering of abnormal behavior alarm information includes: obtaining characteristics of the behavior that deviates from the normal state; determining the alarm level to which the behavior that deviates from the normal state belongs based on the characteristics; and performing corresponding alarm processing based on the alarm level.

[0010] Optionally, the method also includes: marking a normal area and an abnormal behavior area in the activity area of ​​the target object according to the behavior data of the target object, and displaying an activity area image including the normal area and the abnormal behavior area; acquiring the occurrence time of the normal behavior and the abnormal behavior respectively according to the behavior data of the target object, and displaying the occurrence time of the normal behavior and the occurrence time of the abnormal behavior on a timeline; and loading the timeline including the occurrence time of the normal behavior and the occurrence time of the abnormal behavior into the activity area image.

[0011] Optionally, the method further includes: acquiring personal information of the target object that triggers the alarm and description information of the corresponding abnormal behavior, and recording the personal information and the description information of the abnormal behavior.

[0012] To solve the above technical problems, another technical solution adopted in the implementation mode of the present application is: to provide an abnormal behavior detection device based on campus safety, including: a data acquisition module, used to acquire the behavior data of the target object; a data preprocessing module, used to preprocess the behavior data to obtain processed behavior data; a difference determination module, used to perform abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and the normal behavior pattern; an abnormal behavior determination module, used to determine whether the behavior data has behavior that deviates from the normal state based on the difference.

[0013] To solve the above technical problems, another technical solution adopted in the implementation mode of the present application is: to provide an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method as described above.

[0014] In order to solve the above technical problems, another technical solution adopted in the implementation mode of the present application is: providing a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by an electronic device, the electronic device executes the method as described above.

[0015] Different from the related art, the embodiments of the present application provide a method, device and electronic device for abnormal behavior detection based on campus safety, by acquiring the behavior data of the target object; preprocessing the behavior data to obtain the processed behavior data; performing abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and the normal behavior pattern; and determining whether the behavior data has behavior that deviates from the normal state based on the difference. The implementation method provided by the embodiments of the present application realizes the automated processing and detection of the behavior data of the target object, which can reduce the possibility of manual intervention and misjudgment, and improve the accuracy and efficiency of detection. In addition, it is possible to monitor and detect personnel, equipment, etc. on campus in real time, detect abnormal behavior in time, prevent and curb security incidents on campus, and improve the safety of the campus. Furthermore, it can be applied to a variety of scenarios on campus, such as teaching buildings, dormitories, canteens, playgrounds, etc., and has strong applicability and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] One or more embodiments are exemplarily described by corresponding drawings, which do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and the figures in the drawings do not constitute proportional limitations unless otherwise stated.

[0017] Figure 1 This is a schematic diagram of an application environment provided by an embodiment of the present application;

[0018] Figure 2 is a flow chart of an abnormal behavior detection method based on campus safety provided by an embodiment of the present application;

[0019] Figure 3 is a flow chart of an abnormal behavior detection method based on campus safety provided by another embodiment of the present application;

[0020] Figure 4 is a flow chart of a method for displaying information about normal behavior and abnormal behavior of a target object provided by an embodiment of the present application;

[0021] Figure 5 It is a structural schematic diagram of an abnormal behavior detection device based on campus safety provided in an embodiment of the present application;

[0022] Figure 6 It is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0024] It should be noted that, if there is no conflict, the various features in the embodiments of the present application can be combined with each other, all within the scope of protection of the present application. In addition, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a different order than the module division in the device schematic diagram or the order in the flow chart.

[0025] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0026] Campus safety technology refers to the use of technology inside or around the school campus to help schools improve campus safety and protect the health and safety of students, faculty and staff, and visitors. Traditional campus safety technology solutions generally use traditional video surveillance systems and manual patrols to maintain campus safety. They rely on software and hardware equipment such as surveillance cameras and access control systems installed on campus to obtain students' behavior information data, and then manually monitor and analyze students' behavior information data to determine whether students have abnormal behavior based on the results of data analysis.

[0027] In the current campus safety technology solution, due to the large number of students on campus, the efficiency of manual monitoring is limited by factors such as manpower, and it is impossible to monitor and analyze the behavior of each student in real time, which is prone to missed reports. Then, in the process of manual monitoring and analysis, due to the differences in the judgment standards and accuracy of abnormal behavior by different monitoring personnel, the monitoring and analysis of student behavior is affected by the supervisory factors, which in turn leads to missed reports or false reports. Finally, the data collected about student behavior is massive, and using manual data processing and data analysis on the collected student behavior data requires a lot of time and human resources, and it is difficult to obtain valuable data information in a timely manner.

[0028] Therefore, the inventor provides a method and device for detecting abnormal behavior based on campus safety.

[0029] See also Figure 1 , Figure 1 This is a schematic diagram of an application environment of an abnormal behavior detection method based on campus safety provided in an embodiment of the present application. Figure 1 As shown, the server 101 obtains relevant data about active objects in or around the campus from other real-time data collection systems 102 that can collect data, such as campus surveillance camera systems, campus access control systems, campus network security systems, etc., through the network.

[0030] Among them, server 101 can be an independent server, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms. Server 101 carries a monitoring platform for abnormal behavior detection for campus safety. The data that can be collected in the real-time data acquisition system 102 include but are not limited to: monitoring video data, access control record data, network behavior data in network devices such as mobile phones or computers, etc. Also used simultaneously with the monitoring platform is the monitoring client 103, which is implemented through data visualization technology, providing intuitive information display and convenient operation interaction, so that monitoring personnel can quickly understand various behavioral situations on campus and take corresponding measures in a timely manner. It is understandable that Figure 1 The number of hardware devices in the server 101, the real-time data acquisition system 102 and the monitoring client 103 is only illustrative and can be expanded to any number according to actual needs.

[0031] The abnormal behavior detection method based on campus safety in the embodiment of the present application is described in detail below through specific examples.

[0032] See also Figure 2 , Figure 2 Flowchart of an abnormal behavior detection method based on campus safety provided by an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0033] S11. Obtaining behavior data of the target object.

[0034] In the embodiments of the present application, the target objects include but are not limited to persons appearing on or around the campus: students, faculty and staff, other active objects, etc. Students and faculty and staff on campus are the most frequently appearing active objects on campus, but in addition to students and faculty and staff, other active objects that may have a negative impact on campus safety should also be monitored to obtain behavioral data of other active objects. Furthermore, the sources of the behavioral data include but are not limited to: campus access control system, campus fire protection system, campus video surveillance system, campus network security system, etc.

[0035] For example, the campus access control system records when students or faculty members entered and exited which places, and when students or faculty members initiated access control applications to enter unauthorized places. For another example, the campus network security system records when students or faculty members used which devices to conduct network behaviors that violated campus network security, what information content that violated campus network security was released, and the analysis results of the information content.

[0036] S12: pre-processing the behavior data to obtain processed behavior data.

[0037] In an embodiment of the present application, preprocessing the behavior data is to perform data preprocessing operations such as data cleaning, data denoising, data integration, data conversion, data reduction and data feature extraction on the collected behavior data.

[0038] For example, the acquired campus access control system data is cleaned and denoised, and errors, missing values, abnormal values, and duplicate values ​​in the access control data are checked and processed or deleted, such as using interpolation to fill missing values ​​and using deletion or replacement to process abnormal values. For another example, the video surveillance data acquired from the campus video surveillance system is processed, the collected video surveillance data is cut into shorter time periods, and video frames are extracted from the time surveillance data at preset time intervals. The image frames extracted from the video are subjected to noise removal, brightness and contrast adjustment, cropping, scaling, and other operations. The pre-processed behavior data can more specifically improve the detection efficiency of abnormal behavior. In addition, the data pre-processing method can be continuously adjusted according to the detection requirements of abnormal behavior, providing more strongly correlated behavior data for abnormal behavior detection to improve the accuracy of abnormal behavior detection.

[0039] S13. Perform abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and a normal behavior pattern.

[0040] Specifically, when performing abnormal behavior detection on the processed behavior data, first, target feature data of the target object is extracted from the processed behavior data, and the target feature data includes but is not limited to: location, timestamp, action, sound, image, etc.

[0041] For example, after obtaining a piece of surveillance video data from a campus video surveillance system, it is necessary to extract target feature data such as the geographic location of the surveillance camera that generated the surveillance video, the shooting time period of the surveillance video, the video and sound of the surveillance video, and the video key frame images extracted from the surveillance video at preset time intervals.

[0042] Further, after extracting the target feature data of the target object, first, the extracted target feature is compared and matched with the normal behavior pattern in the training set to calculate the similarity or distance between the target feature and the normal behavior pattern. Wherein, similarity or distance is a concept used to measure the similarity or correlation between two objects, and the value range is between 0 and 1. The greater the similarity, the higher the similarity between the two objects, and vice versa, the lower the similarity between the two objects. The standards that can be used to measure similarity or distance include but are not limited to: cosine similarity, Euclidean distance, Manhattan distance, Pearson correlation coefficient, etc. For example, after extracting the features of the behavioral data of a faculty member on a certain day, the features of the behavioral data are compared and matched with the normal behavior pattern. It is found that the similarity between the behavioral data of the faculty member on that day and the normal behavior pattern is extremely high, which means that the probability that the behavioral data of the faculty member on that day is normal behavior is extremely high. Finally, the difference between the behavioral data and the normal behavior pattern is obtained based on the similarity or the distance. After obtaining the similarity or the distance, it is necessary to make a judgment based on the preset similarity or distance threshold. The behavior data whose similarity or distance to the normal behavior pattern exceeds the threshold needs to be further processed, that is, the difference between the behavior data and the normal behavior pattern is further calculated. For example, if it is found through calculation that the similarity or distance between the behavior data of a certain faculty member on a certain day and the normal behavior pattern exceeds the preset threshold, the difference between the behavior data and the normal behavior pattern is further calculated, and the calculated difference result shows that the faculty member's access card has a record of leaving the campus outside of working hours.

[0043] In some embodiments, the steps of performing abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and the normal behavior pattern, and determining whether the behavior data has a behavior that deviates from the normal state according to the difference are performed by a preset algorithm model. The preset algorithm model is obtained by machine learning training based on the behavior data of the target object.

[0044] Specifically, firstly, sample data is obtained, and the sample data includes the behavior data of the target object; the sample data is preprocessed to obtain processed sample data; and the features of the target object are extracted according to the processed sample data. Then, the processed sample data is divided into a training set and a test set, and the training set is classified and annotated, and the classification annotation includes the annotation of normal behavior and abnormal behavior.

[0045] Among them, the training set is a data set used to train the machine learning model. The training set contains multiple input features and a target variable. The machine learning model will use the input features in the training set to predict the target variable. During model training, the model will adjust the model's parameters and weights based on the relationship between the input features and the target variable, thereby improving the model's accuracy and performance. The test set is a data set used to evaluate the machine learning model. The test set also contains multiple input features and a target variable. During testing, the model will use the input features in the test set to predict the target variable and compare the predicted results with the true target variable in the test set. By comparing the difference between the predicted results and the true target variable, the accuracy and performance of the model can be evaluated.

[0046] Among them, data set annotation is an important step in machine learning and deep learning tasks. It is the process of matching samples in the data set with their corresponding labels. Through data annotation, it can provide useful information for the machine learning model in this embodiment, so that it can learn and extract the behavioral characteristics of the target object from the data, and obtain the behavioral data of the target object more comprehensively.

[0047] The machine learning model is trained according to the characteristics of the target object and the data with the classification annotations, so that the machine learning model learns the differences and patterns between the normal behavior and the abnormal behavior, and obtains a trained machine learning model. Among them, the differences and patterns between the normal behavior and the abnormal behavior are multi-dimensional. Not only can sensors and monitoring equipment be used to obtain basic data such as the location and time of the target object, but also other dimensional data, such as students' behavior patterns and behavior trajectories, can be combined for comprehensive analysis to obtain more differences and patterns between behaviors. Comprehensive multi-dimensional data analysis can provide a more comprehensive understanding of the behavior of the target object, improve the identification and early warning of abnormal behavior, and further improve the safety of the campus.

[0048] The trained machine learning model is evaluated using the test set to compare the difference between the model's predicted results and the actual results. When the difference between the predicted results and the actual results meets the preset conditions, the trained machine learning model is determined to be the preset algorithm model. Otherwise, the machine learning model is retrained. The difference between the predicted results and the actual results can be a set error function. When the machine learning model is in the process of training, when the error function converges, the trained machine learning model is obtained.

[0049] S14. Determine whether the behavior data contains any behavior that deviates from the normal state according to the difference.

[0050] Specifically, the difference is compared with a preset threshold value, and when the difference is greater than the preset threshold value, it is determined that the behavior data has a behavior that deviates from the normal state, otherwise it is determined that the behavior data does not deviate from the normal state. For example, by calculation, it is found that the similarity or distance between the behavior data of a student on a certain day and the normal behavior pattern exceeds the preset threshold value, then it is determined that the behavior data of the student on that day has a behavior that deviates from the normal state, and by further obtaining and analyzing the behavior data of the student on that day, it is found that the student was in the cafeteria for a long time during the class time period of that day.

[0051] Optionally, when the behavior data deviates from the normal behavior, the method further includes the process of alarm processing and data display. For details, please refer to Figure 3 , Figure 3 and Figure 2 The main difference is that the method further comprises:

[0052] S15. Trigger abnormal behavior alarm information.

[0053] The triggering of abnormal behavior alarm information includes: acquiring characteristics of the behavior that deviates from the normal state; determining the alarm level to which the behavior that deviates from the normal state belongs according to the characteristics; and performing corresponding alarm processing according to the alarm level.

[0054] After the above-mentioned embodiment obtains the existence of behaviors deviating from the normal state in the behavior data, the embodiment of the present application further performs alarm processing according to the behaviors deviating from the normal state.

[0055] Different alarm rules can be formulated for different abnormal behaviors. For example, when the target object is a student, if the target object appears in an abnormal place during an abnormal time period, or has an abnormal activity pattern, the target object can be set to trigger an alarm. By setting appropriate alarm rules, abnormal behaviors can be accurately identified.

[0056] Furthermore, different alarm levels need to be set for the severity of abnormal behavior. For example, minor abnormal behavior can be set as a low-level alarm, but more serious or urgent abnormal behavior needs to be set as a high-level alarm for processing. The specific alarm level setting level and the corresponding abnormal behavior severity can be designed and adjusted according to the specific application scenario.

[0057] Furthermore, when an alarm of the corresponding alarm level is generated, it is also necessary to perform corresponding alarm processing according to the alarm level. For example, for a first-level alarm, the security personnel can be notified by SMS or phone for timely handling, for a second-level alarm, a pop-up window prompt or email notification can be sent to the relevant department for follow-up processing, and for a low-level alarm, it can be handled by logging or simple prompting.

[0058] The above alarm processing enables timely notification and response, thus ensuring the safety of teachers and students on campus.

[0059] S16. Display information about normal behavior and abnormal behavior of the target object.

[0060] Specifically, after obtaining the behavior data of the target object, the normal behavior and abnormal behavior of the target behavior can also be visualized, and the information of the normal behavior and abnormal behavior of the target object is sent to the monitoring client 103 for display through the aforementioned monitoring platform 101. The monitoring client 103 can also be a monitoring large screen with a very large display range to display more comprehensive behavior data. For example, when the active object of a certain abnormal behavior is a student, the specific description of the abnormal behavior includes the student information of the student, and the abnormal behavior of the student: skipping classes, specifically including the time and place of skipping classes, and the alarm processing information for the abnormal behavior. The alarm processing information includes analyzing the reasons for skipping classes, the frequency of skipping classes, notifying parents, the information of parents' feedback, the information of teachers' feedback, and the feedback information of the student. The above-mentioned descriptions can be recorded in the background and can be displayed on a specific display device (such as the computer of the Dean of Academic Affairs) so that relevant personnel can understand the abnormal behavior of students in a timely manner and take corresponding measures to deal with it.

[0061] Alternatively, if Figure 4 As shown, the information showing the normal behavior and abnormal behavior of the target object includes:

[0062] S161. Marking a normal area and an abnormal behavior area in the activity area of ​​the target object according to the behavior data of the target object, and displaying an activity area image including the normal area and the abnormal behavior area.

[0063] Among them, the behavior data of the target object can be collected, for example, by means of monitoring equipment and other means, the behavior data of the target object in the activity area, including location, movement trajectory, time, behavior pattern, etc. Then analyze the normal behavior and abnormal behavior of the target object, analyze the collected behavior data, extract the normal behavior and abnormal behavior of the target object, and judge whether there is abnormal behavior based on different behavior characteristics and patterns. Then mark the normal area and abnormal behavior area. Specifically, the activity area can be divided into normal area and abnormal behavior area according to the normal behavior and abnormal behavior of the target object, and marked on a map or floor plan. Finally, the activity area image can be displayed, that is, the marked normal area and abnormal behavior area are drawn on a map or floor plan, and displayed to the monitoring personnel through a monitoring platform and other means.

[0064] In this way, the behavior of the target object can be displayed more intuitively, the accuracy of abnormal behavior detection can be improved, and the occurrence of misjudgment and missed judgment can be reduced. In addition, by displaying the activity area image, the monitoring personnel can have a more comprehensive understanding of the behavior of the target object, so that they can better control and manage, and improve the efficiency and level of campus safety management. Finally, it can also help monitoring personnel formulate more effective treatment measures. By analyzing the abnormal behavior of the target object, it can help monitoring personnel formulate more effective treatment measures, such as notifying parents, arranging tutoring, etc., so as to better help students correct wrong behaviors and promote their healthy growth.

[0065] S162: Obtain the occurrence time of the normal behavior and the abnormal behavior respectively according to the behavior data of the target object, and display the occurrence time of the normal behavior and the occurrence time of the abnormal behavior on a timeline.

[0066] Among them, the behavior data of the target object can be collected, and the behavior data of the target object in the activity area can be collected by means of monitoring equipment, including location, movement trajectory, time, behavior pattern, etc. The collected behavior data is analyzed to extract the normal behavior and abnormal behavior of the target object, and the time when they occur is recorded. The occurrence time of the normal behavior and abnormal behavior is displayed on the timeline, and the recorded occurrence time of the normal behavior and abnormal behavior is displayed on the timeline respectively, so that the monitoring personnel can observe and analyze. Therefore, by displaying the occurrence time of the normal behavior and abnormal behavior on the timeline, the monitoring personnel can understand the behavior of the target object more clearly and quickly discover and deal with abnormal behavior. By recording the occurrence time of the normal behavior and abnormal behavior, the occurrence time and frequency of the abnormal behavior can be more accurately judged, thereby improving the accuracy of abnormal behavior detection.

[0067] S163: Load a time axis including the occurrence time of the normal behavior and the occurrence time of the abnormal behavior into the activity area image.

[0068] The time of occurrence of the recorded normal behavior and abnormal behavior can be marked on the timeline respectively, and then the timeline and the activity area image can be merged, and the merged timeline and activity area image can be loaded into the monitoring platform so that the monitoring personnel can observe the activity area and behavior of the target object on the same interface, which is more convenient for analysis and processing.

[0069] This embodiment allows monitoring personnel to more intuitively understand the time of occurrence of normal and abnormal behaviors of target objects, so as to conduct more comprehensive control and management. At the same time, the display of the timeline can also help monitoring personnel discover the behavior patterns and rules of target objects, further improving the efficiency and level of campus safety management.

[0070] Optionally, it also includes S164, obtaining the personal information of the target object that triggers the alarm and the description information of the corresponding abnormal behavior, and recording the personal information and the description information of the abnormal behavior. Among them, in the monitoring system, the personal information of the target object, including name, age, gender, student number, etc., is obtained through the ID or other identity information of the target object. The description information of the corresponding abnormal behavior is obtained through the abnormal behavior data in the monitoring system, including the time, place, frequency, reason, etc. of skipping classes. The obtained personal information of the target object and the description information of the corresponding abnormal behavior are recorded in a database or other storage device for subsequent analysis and processing. This embodiment can help monitoring personnel better understand the background of the target object and the characteristics of the abnormal behavior, so as to formulate more targeted processing measures and improve the efficiency and level of campus safety management. At the same time, under the premise of protecting the privacy of the target object, recording the description information of personal information and abnormal behavior can also provide a valuable data source for subsequent data analysis and mining.

[0071] See also Figure 5 , Figure 5 1 is a schematic diagram of a campus safety-based abnormal behavior detection device provided in an embodiment of the present application. The campus safety-based abnormal behavior detection device 20 comprises: a data acquisition module 21, a data preprocessing module 22, a difference determination module 23 and an abnormal behavior determination module 24.

[0072] The data acquisition module 21 is used to acquire the behavior data of the target object; the data preprocessing module 22 is used to preprocess the behavior data to obtain the processed behavior data; the difference determination module 23 is used to perform abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and the normal behavior pattern; the abnormal behavior determination module 24 is used to determine whether the behavior data has any behavior that deviates from the normal state based on the difference.

[0073] Among them, the difference determination module 23 is specifically used to extract target features from the processed behavior data, and the target features include location, timestamp, action, sound and image; compare and match the extracted target features with the normal behavior patterns in the training set to calculate the similarity or distance between the target features and the normal behavior patterns, and obtain the difference between the behavior data and the normal behavior patterns based on the similarity or the distance.

[0074] Among them, the abnormal behavior determination module 24 is specifically used to compare the difference with a preset threshold. When the difference is greater than the preset threshold, it is determined that the behavior data has a behavior that deviates from the normal state, otherwise it is determined that the behavior data does not deviate from the normal state.

[0075] In some embodiments, it also includes an algorithm model module 25, which is used to obtain sample data, wherein the sample data includes behavioral data of the target object; preprocess the sample data to obtain processed sample data; extract the characteristics of the target object based on the processed sample data; divide the processed sample data into a training set and a test set, and classify and annotate the training set, wherein the classification annotation includes annotations of normal behavior and abnormal behavior; train a machine learning model based on the characteristics of the target object and the data with the classification annotation, so that the machine learning model learns the differences and rules between the normal behavior and the abnormal behavior, and obtains a trained machine learning model; uses the test set to evaluate the trained machine learning model to compare the difference between the model's predicted results and the actual results; when the difference between the predicted results and the actual results meets the preset conditions, the trained machine learning model is determined to be the preset algorithm model, otherwise, the machine learning model is retrained.

[0076] In some embodiments, an alarm module 26 is also included, which is used to trigger abnormal behavior alarm information, specifically, to obtain the characteristics of the behavior that deviates from the normal state; determine the alarm level to which the behavior that deviates from the normal state belongs based on the characteristics; and perform corresponding alarm processing based on the alarm level.

[0077] In some embodiments, a display module 27 is also included, which is used to mark the normal area and the abnormal behavior area in the activity area of ​​the target object according to the behavior data of the target object, and display the activity area image containing the normal area and the abnormal behavior area; obtain the occurrence time of the normal behavior and the abnormal behavior respectively according to the behavior data of the target object, and display the occurrence time of the normal behavior and the occurrence time of the abnormal behavior on the timeline; load the timeline containing the occurrence time of the normal behavior and the occurrence time of the abnormal behavior into the activity area image.

[0078] The display module 27 is also used to obtain the personal information of the target object that triggers the alarm and the description information of the corresponding abnormal behavior, and record the personal information and the description information of the abnormal behavior.

[0079] It should be noted that the above-mentioned abnormal behavior detection device based on campus safety can execute the abnormal behavior detection method based on campus safety provided in the embodiment of the present application, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not fully described in the embodiment of the abnormal behavior detection device based on campus safety, please refer to the abnormal behavior detection method based on campus safety provided in the embodiment of the present application.

[0080] Figure 6is a hardware structure diagram of an electronic device 30 provided in an embodiment of the present application, and the electronic device can be used to execute the above-mentioned abnormal behavior detection method based on campus safety. Figure 6 As shown, the electronic device 30 includes:

[0081] One or more processors 31 and memory 32, Figure 6 A processor 31 is taken as an example.

[0082] The processor 31 and the memory 32 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0083] The memory 32 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the abnormal behavior detection method based on campus safety in the embodiment of the present application. The processor 31 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 32, that is, the abnormal behavior detection method based on campus safety in the above method embodiment is implemented.

[0084] The memory 32 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required by at least one function; the data storage area may store data created according to the use of the abnormal behavior detection device based on campus safety, etc. In addition, the memory 32 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 32 may optionally include a memory remotely arranged relative to the processor 31, and these remote memories may be connected to the abnormal behavior detection device based on campus safety via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0085] The one or more modules are stored in the memory 32, and when executed by the one or more processors 31, the abnormal behavior detection method based on campus security in any of the above method embodiments is executed.

[0086] The above-mentioned product can execute the method provided in the embodiment of the present application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of the present application.

[0087] The electronic devices of the embodiments of the present application exist in various forms, including but not limited to: ultra-mobile personal computer devices, which belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. Such terminals include PDA, MID and UMPC devices, etc. Servers, devices that provide computing services, the composition of the server includes a processor, a hard disk, a memory, a system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc. And other electronic devices with data interaction functions.

[0088] The embodiment of the present application provides a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by one or more processors, such as Figure 6 A processor 31 in the embodiment may enable the one or more processors to execute the abnormal behavior detection method based on campus security in any of the above method embodiments.

[0089] An embodiment of the present application provides a computer program product, which includes a computer program stored on a non-volatile computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by the electronic device, the electronic device is enabled to execute the abnormal behavior detection method based on campus safety in any of the above-mentioned method embodiments.

[0090] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0091] Through the description of the above implementation methods, ordinary technicians in this field can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, it can also be implemented by hardware. Ordinary technicians in this field can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0092] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Under the concept of the present application, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes in different aspects of the present application as described above, which are not provided in detail for the sake of simplicity. Although the present application has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features can be replaced by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting abnormal behavior based on campus safety, characterized in that: include: Obtain the behavior data of the target object; preprocessing the behavior data to obtain processed behavior data; Performing abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and a normal behavior pattern; It is determined based on the difference whether the behavior data contains behavior that deviates from the normal state.

2. The method according to claim 1, characterized in that The performing abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and the normal behavior pattern includes: extracting target features from the processed behavior data, the target features including location, timestamp, action, sound, and image; The extracted target features are compared and matched with the normal behavior patterns in the training set to calculate the similarity or distance between the target features and the normal behavior patterns, and the difference between the behavior data and the normal behavior patterns is obtained based on the similarity or the distance.

3. The method according to claim 1, characterized in that Determining whether the behavior data has a behavior that deviates from the normal state according to the difference includes: The difference is compared with a preset threshold value, and when the difference is greater than the preset threshold value, it is determined that the behavior data has a behavior that deviates from the normal state, otherwise it is determined that the behavior data does not have a behavior that deviates from the normal state.

4. The method according to claim 1, characterized in that: The steps of performing abnormal behavior detection on the processed behavior data to obtain the difference between the behavior data and the normal behavior pattern, and determining whether the behavior data has a behavior deviating from the normal according to the difference are performed by a preset algorithm model; The method further comprises: Acquire sample data, wherein the sample data includes behavior data of a target object; Preprocessing the sample data to obtain processed sample data; Extracting features of the target object according to the processed sample data; Dividing the processed sample data into a training set and a test set, and classifying and labeling the training set, wherein the classification labeling includes labeling of normal behavior and abnormal behavior; Training a machine learning model according to the characteristics of the target object and the classified and labeled data, so that the machine learning model learns the differences and rules between the normal behavior and the abnormal behavior, and obtains a trained machine learning model; Using the test set to evaluate the trained machine learning model to compare the difference between the model's predicted results and the actual results; When the difference between the predicted result and the actual result meets the preset condition, the trained machine learning model is determined to be the preset algorithm model, otherwise, the machine learning model is retrained.

5. The method according to any one of claims 1 to 4, characterized in that: When the behavior data contains behavior that deviates from the normal state, the method further includes: triggering abnormal behavior alarm information; The abnormal behavior triggering alarm information includes: Acquiring characteristics of the deviant behavior; Determining the warning level to which the behavior deviating from the normal state belongs according to the characteristics; Perform corresponding alarm processing according to the alarm level.

6. The method according to claim 5, characterized in that The method further comprises: Marking a normal area and an abnormal behavior area in the activity area of ​​the target object according to the behavior data of the target object, and displaying an activity area image including the normal area and the abnormal behavior area; Obtaining the occurrence time of normal behavior and abnormal behavior respectively according to the behavior data of the target object, and displaying the occurrence time of the normal behavior and the occurrence time of the abnormal behavior on a timeline; A time axis including the occurrence time of the normal behavior and the occurrence time of the abnormal behavior is loaded into the activity area image.

7. The method according to claim 6, characterized in that The method further comprises: The personal information of the target object that triggers the alarm and the description information of the corresponding abnormal behavior are obtained, and the personal information and the description information of the abnormal behavior are recorded.

8. An abnormal behavior detection device based on campus safety, characterized in that: include: A data acquisition module is used to acquire the behavior data of the target object; A data preprocessing module, used for preprocessing the behavior data to obtain processed behavior data; a difference determination module, configured to perform abnormal behavior detection on the processed behavior data to obtain a difference between the behavior data and a normal behavior pattern; The abnormal behavior determination module is used to determine whether the behavior data contains any behavior that deviates from the normal state according to the difference.

9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A non-volatile computer-readable storage medium, characterized in that: The non-volatile computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by an electronic device, the electronic device executes the method according to any one of claims 1 to 7.

Images