Intelligent security policy generation method and device based on big data

Abstract

The invention relates to the technical field of intelligent security and protection, in particular to an intelligent security and protection strategy generation method and device based on big data, and the method comprises the following steps: collecting historical data of security and protection events, carrying out data cleaning and format unification, checking data quality and consistency, and obtaining a comprehensive data set. According to the method, the comprehensive data set is created, efficient integration of data is achieved, historical and real-time monitoring data are fully utilized, the possibility of a future security event is accurately predicted, normalization and key index screening are carried out, the data processing flow is optimized, the mode recognition speed and accuracy are improved, potential threats can be quickly responded, and the safety of the security event is improved. According to the method, regional features and population density analysis are combined, regional security and protection requirements are accurately analyzed, a resource allocation strategy is optimized, the accuracy and efficiency of resource utilization are improved, behavior modes are deeply analyzed, abnormal behaviors are timely recognized, the adaptability to complex security challenges is enhanced, and the robustness and response effect in a changeable security environment are ensured.

Description

Technical Field

[0001] The present invention relates to the field of intelligent security technology, and in particular to a method and device for generating an intelligent security strategy based on big data. Background Art

[0002] The field of smart security technology mainly involves the use of artificial intelligence, machine learning, the Internet of Things and big data technologies to enhance the functionality and efficiency of traditional security systems, including but not limited to automated video surveillance analysis, intrusion detection, facial recognition, behavioral analysis and abnormal behavior detection. Smart security systems can automatically identify potential security threats through algorithms and pattern recognition, provide real-time feedback, and respond quickly through integrated communication systems. They are widely used in public security, residential security, corporate security and urban monitoring, with the aim of improving the automation level and response speed of preventive measures through technical means.

[0003] Among them, the intelligent security strategy generation method refers to the use of intelligent algorithms to automatically generate security strategies suitable for specific environments and needs. The main purpose is to improve the efficiency and effectiveness of the security system through automated processing and response, and reduce dependence on manual intervention. Strategy generation can be adjusted and optimized based on on-site environmental data, historical security events, and predictive models to ensure the timeliness and pertinence of security measures. It is especially suitable for dynamically changing environments, such as large-scale events, complex industrial areas, or highly sensitive facilities, and can provide robust and adaptable security strategies in a changing threat landscape.

[0004] Although existing technologies have integrated methods such as artificial intelligence and machine learning, they still lack flexibility in data processing and real-time response. In particular, in terms of the integration of multiple data sources, traditional systems often fail to process in a timely manner and cannot fully reflect changes in real-time data, which is particularly prominent in situations where rapid adaptation to environmental changes is required. For example, in an emergency, resource allocation cannot be adjusted immediately, resulting in untimely security response or waste of resources. In addition, when generating automated policies, there is often a lack of flexibility, resulting in policy generation being limited to preset rules, which is insufficient to face new or unknown threats. This is particularly evident in highly dynamic environments, which can easily lead to security loopholes. Summary of the invention

[0005] In order to solve the problem of insufficient flexibility in data processing and real-time response in the prior art. Especially in the integration of multiple data sources, traditional systems often do not process in a timely manner and cannot fully reflect changes in real-time data, which is particularly prominent when it is necessary to quickly adapt to environmental changes. For example, in an emergency, it is impossible to adjust resource allocation in real time, resulting in insufficient security response or waste of resources. In addition, when generating automated policies, there is often a lack of sufficient flexibility, resulting in policy generation being limited to preset rules, which is insufficient to face new or unknown threats. This is particularly evident in highly dynamic environments, and is prone to technical problems such as security protection loopholes. The embodiments of the present invention provide a method and device for generating intelligent security policies based on big data. The technical solution is as follows: On the one hand, a method for generating an intelligent security strategy based on big data is provided, comprising the following steps: S1: Collect historical security event data, clean the data and unify the format, verify the data quality and consistency, and obtain a comprehensive data set; S2: Based on the comprehensive data set, through data normalization and variable selection, key indicators are screened, and the initial event probability assessment model is established using the key indicators. The possibility of future security events is predicted through the event frequency and pattern in the historical data, and the event probability analysis results are generated; S3: Utilizing the event probability analysis results, combined with regional characteristic data, weighted analysis of regional population density and historical event frequency is performed to calculate the regional security demand index and generate regional security resource demand forecast results; S4: Based on the forecast results of the regional security resource demand, security manpower and physical resources are allocated, the efficiency of existing resources is evaluated, resources are adjusted according to regional demand, and a resource optimization allocation plan is generated; S5: Apply the resource optimization configuration solution to perform behavior pattern analysis on the real-time monitoring data, perform anomaly detection on the movement trajectory and residence time in the monitoring data, identify and record abnormal behaviors, and generate abnormal behavior identification records; S6: Conduct an in-depth analysis of the abnormal behavior recognition records, perform a matching test with the existing security strategies, simulate different security event response scenarios, evaluate the response effects of different security strategies, dynamically adjust the security strategies, and output a security strategy intelligent generation plan.

[0006] On the other hand, the comprehensive data set includes data types, data structures and data integrity test results, the event probability analysis results include probability prediction values, key influencing factors and reliability assessment results, the regional security resource demand forecast results include regional risk ratings, resource gap indexes and priority rankings, the resource optimization allocation plan includes resource reallocation records, optimized resource distribution records and expected resource coverage, the abnormal behavior identification records include abnormal behavior types, abnormal occurrence time points and abnormal behavior levels, and the security strategy intelligent generation plan includes strategy adaptive adjustment results, strategy coverage and expected defense effectiveness analysis results.

[0007] On the other hand, the specific steps for collecting historical security event data, cleaning and formatting, and verifying data quality and consistency to obtain a comprehensive data set are as follows: S101: Collect data based on access control records, perform data integration and import according to a unified format, check timestamps and event types, confirm information consistency, and generate original data sets; S102: According to the original data set, identify and delete duplicate data, correct erroneous input, fill in missing data values, and generate a cleaned data set; S103: Perform consistency and integrity checks on the cleaned data set to confirm that the records in the data set match the preset data standards and quality requirements, and obtain a comprehensive data set.

[0008] On the other hand, based on the comprehensive data set, through data normalization and variable selection, key indicators are screened, and the initial event probability assessment model is established using the key indicators. The possibility of future security events is predicted through the event frequency and pattern in the historical data. The specific steps for generating event probability analysis results are as follows: S201: Based on the comprehensive data set, perform standardization processing, adjust the value range and format and unify the scale to generate a normalized data set; S202: Based on the normalized data set, feature selection is performed to screen key indicators associated with security events, including the time, location and frequency of the events, and irrelevant variables are eliminated to obtain a key indicator data set; S203: Analyze the occurrence frequency and pattern of different security events using the key indicator data set, build a preliminary event probability assessment model, predict the possibility of future security events, and generate event probability analysis results.

[0009] On the other hand, the specific steps of using the event probability analysis results, combining regional characteristic data, weighted analysis of regional population density and historical event frequency, calculating the regional security demand index, and generating regional security resource demand forecast results are as follows: S301: Collect population density and historical event frequency data of the target area, format the data and standardize the range, confirm the consistency and comparability of the data, and generate a regional basic feature data set; S302: Based on the event probability analysis result, the population density in the regional basic feature data set and the historical event frequency are correlated and analyzed to reveal the difference in security requirements in different regions and obtain a correlation analysis result; S303: Utilizing the correlation analysis results, combined with population density and event frequency data, calculate the regional security demand index, analyze and generate regional security resource demand forecast results.

[0010] On the other hand, the regional security demand index is calculated according to the formula: ; Calculate, where Represents the security demand index value, represents the regional population density, represents the event frequency, Represents the size of the target area. Represents the weighted average of historical event data, Represents the monthly rate of change.

[0011] On the other hand, based on the forecast results of the regional security resource demand, security manpower and physical resources are allocated, the efficiency of existing resources is evaluated, resources are adjusted according to regional demand, and the specific steps of generating a resource optimization configuration plan are as follows: S401: Collect and organize the forecast results of the regional security resource demand, conduct an inventory of current security manpower and physical resources, check the resource type, quantity and distribution status, and generate a security resource status record; S402: Based on the security resource status record, perform resource efficiency evaluation, analyze the utilization efficiency and coverage effect of each resource, identify resource surplus and shortage areas, take adjustment measures to optimize resource allocation, and obtain resource allocation efficiency analysis results; S403: According to the resource allocation efficiency analysis result, plan each area to adjust human and physical resources as needed, accurately match security resources, and generate a resource optimization configuration plan.

[0012] On the other hand, the resource optimization configuration scheme is applied to perform behavior pattern analysis on real-time monitoring data, perform anomaly detection on movement trajectory and residence time in monitoring data, identify and record abnormal behavior, and generate abnormal behavior identification records in the following specific steps: S501: reconfigure the resource distribution of the monitoring system according to the resource optimization configuration plan, install cameras and sensors in key areas, and generate an adjusted monitoring equipment layout plan; S502: Using the adjusted monitoring equipment layout plan, conduct behavior pattern analysis on the real-time collected monitoring data, track changes in movement trajectory speed and direction, mark areas with abnormal residence time, identify abnormal changes in behavior patterns, and obtain abnormal behavior pattern analysis results; S503: According to the abnormal behavior pattern analysis result, the actual situation of each identified abnormal behavior is recorded, including the time, location and behavior feature description of the abnormal behavior, and an abnormal behavior identification record is generated.

[0013] On the other hand, the specific steps of deeply analyzing the abnormal behavior recognition records, matching the records with the existing security strategies, simulating the response scenarios of different security events, evaluating the response effects of different security strategies, dynamically adjusting the security strategies, and outputting the intelligent generation solutions of security strategies are as follows: S601: Based on the abnormal behavior recognition record, extract key behavior feature data, including behavior type, frequency and location, compare and analyze with the current security strategy, make adjustments according to the new behavior pattern, and generate a strategy requirement matching result; S602: Based on the strategy requirement matching result, by simulating different security event response scenarios, recording the security responses corresponding to the abnormal behaviors of different types, evaluating the actual application effect of the strategy, and obtaining the strategy effect simulation result; S603: According to the simulation results of the strategy effect, adjust and optimize the security strategy to respond to the latest identified abnormal behavior, dynamically optimize the strategy to match the continuously changing security needs, and output the security strategy intelligent generation plan.

[0014] On the other hand, a device for generating intelligent security strategies based on big data includes: The data collection and verification module collects data based on access control records, verifies timestamps and event types, confirms information consistency, corrects incorrect input, fills in missing data values, performs consistency and integrity checks, and obtains a comprehensive data set; The data processing and analysis module performs standardized processing based on the comprehensive data set, screens key indicators associated with security events, builds a preliminary event probability assessment model, predicts the possibility of future security events, and generates event probability analysis results; The feature data association module collects the population density and historical event frequency data of the target area, confirms the consistency and comparability of the data, and performs association analysis on the population density and historical event frequency in the basic feature data set of the area to obtain the association analysis results; The security demand assessment module uses the correlation analysis results, combined with population density and event frequency data, to calculate the regional security demand index, check resource types, quantities and distribution status, and generate a security resource status record; The resource allocation optimization module analyzes the utilization efficiency and coverage effect of each resource based on the current status record of the security resources, identifies areas of excess and shortage of resources, takes adjustment measures to optimize resource allocation, accurately matches security resources, and generates a resource optimization allocation plan; The behavior pattern analysis module reconfigures the resource distribution of the monitoring system according to the resource optimization configuration plan, performs behavior pattern analysis on the real-time collected monitoring data, records the actual situation of each identified abnormal behavior, and generates abnormal behavior identification records; The strategy generation and adjustment module extracts key behavior feature data based on the abnormal behavior identification records, compares and analyzes it with the current security strategy, simulates different security event response scenarios, evaluates the actual application effect of the strategy, adjusts and optimizes the security strategy, and outputs an intelligent security strategy generation plan.

[0015] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least: By creating a comprehensive data set, efficient data integration is achieved, historical and real-time monitoring data are fully utilized, the possibility of future security events is accurately predicted, normalization and key indicator screening are optimized for data processing, the speed and accuracy of pattern recognition are improved, and potential threats can be quickly responded to. By combining regional characteristics with population density analysis, regional security needs can be accurately analyzed, resource allocation strategies can be optimized, the accuracy and efficiency of resource utilization can be improved, in-depth analysis of behavioral patterns and timely identification of abnormal behaviors can be carried out, and the ability to adapt to complex security challenges can be enhanced to ensure robustness and response effects in a changing security environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 This is a flow chart of a method for generating an intelligent security strategy based on big data provided by an embodiment of the present invention; Figure 2 is a flow chart of the steps of S1 of the present invention; Figure 3 is a flow chart of the steps of S2 of the present invention; Figure 4 is a flow chart of the steps of S3 of the present invention; Figure 5 is a flow chart of the steps of S4 of the present invention; Figure 6 is a flow chart of the steps of S5 of the present invention; Figure 7is a flow chart of the steps of S6 of the present invention; Figure 8 It is a block diagram of a device for generating intelligent security strategies based on big data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0019] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0020] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0021] In the embodiments of the present invention, sometimes the subscripts such as W 1 It may be written in non-subscript form such as W1. When the difference is not emphasized, the meaning is the same.

[0022] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0023] The embodiment of the present invention provides a method for generating an intelligent security strategy based on big data, which can be implemented by an intelligent security strategy generating device based on big data, and the intelligent security strategy generating device based on big data can be a terminal or a server. Figure 1 The flowchart of a method for generating an intelligent security strategy based on big data is shown. The processing flow of the method may include the following steps: S1: Collect historical security event data, clean the data and unify the format, verify the data quality and consistency, and obtain a comprehensive data set; S2: Based on the comprehensive data set, through data normalization and variable selection, key indicators are screened, and the initial event probability assessment model is established using key indicators. The possibility of future security events is predicted through the event frequency and pattern in historical data, and event probability analysis results are generated; S3: Using the event probability analysis results, combined with regional characteristic data, weighted analysis of regional population density and historical event frequency is performed to calculate the regional security demand index and generate regional security resource demand forecast results; S4: Based on the regional security resource demand forecast results, security manpower and physical resources are allocated, the efficiency of existing resources is evaluated, resources are adjusted according to regional needs, and resource optimization allocation plans are generated; S5: Apply resource optimization configuration solutions, perform behavior pattern analysis on real-time monitoring data, perform anomaly detection on movement trajectories and dwell time in monitoring data, identify and record abnormal behaviors, and generate abnormal behavior identification records; S6: Conduct in-depth analysis of abnormal behavior recognition records, conduct matching tests with existing security strategies, simulate different security event response scenarios, evaluate the response effects of different security strategies, dynamically adjust security strategies, and output security strategy intelligent generation solutions.

[0024] The comprehensive data set includes data type, data structure and data integrity test results. The event probability analysis results include probability prediction value, key influencing factors and reliability assessment results. The regional security resource demand forecast results include regional risk rating, resource gap index and priority ranking. The resource optimization allocation plan includes resource reallocation records, optimized resource distribution records and expected resource coverage. The abnormal behavior identification records include abnormal behavior type, abnormal occurrence time and abnormal behavior level. The security strategy intelligent generation plan includes strategy adaptive adjustment results, strategy coverage and expected defense effectiveness analysis results.

[0025] See also Figure 2 , the specific steps of S1 are: S101: Collect data based on access control records, perform data integration and import according to a unified format, check timestamps and event types, confirm information consistency, and generate original data sets; Data collection based on access control records collects information such as the timestamp, event type, user ID, access rights, etc. of each record according to predefined field requirements and data format standards. The collected data is converted into a unified format and imported into a standardized database or data set. Each record is arranged in chronological order and attached with a record number when imported to ensure data integrity and traceability. To this end, the timestamp and event type of each record are checked by the program to ensure that they meet the preset data format and type requirements. If a timestamp with an incorrect format or an event type that does not comply with the regulations is encountered, the original records of the log file are manually proofread or corrected according to the rules. If the timestamp of a record is incomplete or wrong, the missing part can be filled in using the adjacent timestamp information. After all proofreading is completed, a structured original data set is finally generated.

[0026] S102: Based on the original data set, identify and delete duplicate data, correct incorrect input, fill in missing data values, and generate a cleaned data set; Based on the original data set, duplicate record entries in the data set are identified and deleted. The identification of duplicate items is confirmed one by one by comparing fields such as user ID, timestamp, event type, etc. After deleting excess redundant data, the erroneous input items found in the data set are corrected. The correction of erroneous input is based on the predefined value range. For abnormal or non-compliant data items, they are compared with the standard records in the database and reasonably corrected, such as converting timestamps that do not conform to the format into a standard format. At the same time, the missing data is filled in by inference, and adjacent events are used in the time series for reasonable supplementation. The missing values ​​are interpolated and estimated based on the characteristics of similar records to ensure the field integrity of each record. After cleaning, a complete data set containing no duplication, no errors, is generated.

[0027] S103: Perform consistency and integrity checks on the cleaned data set to confirm that the records in the data set match the preset data standards and quality requirements, and obtain a comprehensive data set; The cleaned data set is checked for consistency and integrity. First, each record is verified to match the preset data standard, including checking the consistency of field type, field length, and event type. Inconsistent data records are marked and removed using rule settings. The timestamps of each record are checked one by one to ensure that the order of the records conforms to the temporal logic. For event types, cross-checks are performed according to business presets to ensure compliance with the operation sequence and business logic. If the event type of a record is found to be inconsistent with the previous and next records, it is corrected through log proofreading and context analysis. At the same time, the field integrity of the data set is checked to ensure that all records contain necessary fields. Ultimately, a comprehensive data set that meets data quality and standard requirements is obtained.

[0028] See also Figure 3 , the specific steps of S2 are: S201: Based on the comprehensive data set, standardization processing is performed to adjust the value range and format and unify the scale to generate a standardized data set; Based on the comprehensive data set, all numerical fields are converted to a unified numerical range. For each numerical field, such as event frequency, response time, etc., the maximum and minimum numerical ranges are set and linear scaling is performed. The specific execution steps include extracting the numerical fields in the comprehensive data set one by one, and using the formula Normalization processing is performed to unify the format of text-type data fields, such as event type, event location, etc., and to use unified coding or numbering to represent them. For example, event types are unified as classification numbers with values ​​from 0 to n, and location fields are also coded according to different locations. All location nouns are standardized, and finally a standardized data set with unified data scale and standardized format is obtained.

[0029] S202: Based on the normalized data set, feature selection is performed to screen key indicators associated with security events, including the time, location, and frequency of the events, and irrelevant variables are eliminated to obtain a key indicator data set; Based on the normalized data set, the key indicators closely related to security events are determined through feature selection. First, the fields in the normalized data set are identified, and the indicators closely related to security events are selected, such as the specific time (hours and minutes) of the event, the code of the location, the frequency of the event, etc. The relevant fields in each record are extracted, and irrelevant fields or variables are eliminated, such as record numbers and user IDs that have no actual association. According to the selected indicators, a new key indicator data set is generated, including the time, location code, and frequency of the event.

[0030] S203: Analyze the occurrence frequency and pattern of different security events using the key indicator data set, build a preliminary event probability assessment model, predict the possibility of future security events, and generate event probability analysis results; Using the key indicator data set, the occurrence frequency of various security events is calculated one by one, and a probability distribution model of event occurrence is constructed based on the distribution pattern of time and location. First, the frequency distribution of each event type in a specific time period (such as 24 hours a day) and a specific location is statistically analyzed, and the event probability at different times and locations is calculated. The historical event data of each time period and location is used to model the probability of event occurrence as a conditional probability relationship. With time and location as independent variables, a preliminary event probability assessment model is generated for each event type. The probability density function is used to express the possibility of each security event at different times and locations, and the event probability analysis results are completed.

[0031] See also Figure 4 , the specific steps of S3 are: S301: Collect population density and historical event frequency data of the target area, format the data and standardize the range, confirm the consistency and comparability of the data, and generate a regional basic feature data set; Based on the population density and historical event frequency data of the target area, the collected data include the distribution of population density and the frequency of various events recorded in the past period of time. First, the data is formatted to unify the original data from different sources into the same data structure and field naming for subsequent processing operations. Next, the population density and event frequency data are range-standardized, and the population density and event frequency values ​​of each area are converted to the range of 0 to 1. Through this operation, the differences between the values ​​are eliminated to ensure that the data are compared at the same level. At the same time, the consistency of the data is checked, including verifying the integrity of the data records and the uniformity of the data format. For inconsistent data records, they are adjusted or eliminated item by item, and finally a regional basic characteristic data set containing population density and event frequency is generated.

[0032] S302: Based on the event probability analysis results, the population density in the regional basic feature data set and the historical event frequency are correlated and analyzed to reveal the differences in security requirements in different regions and obtain correlation analysis results; Based on the results of event probability analysis, the population density in the regional basic characteristic data set is correlated with the frequency of historical events. First, the population density and event frequency data are paired item by item, and a corresponding relationship is established between the event frequency in the same area and the population density of the area. The correlation between the two is analyzed, and the changing trend of population density and event frequency in each region is analyzed. For different areas, the distribution characteristics of high event frequency areas and population density are identified by comparing the correlation data of different areas, and the variables unrelated to security needs are eliminated. The indicators that significantly affect the frequency of security events are analyzed in detail, and the differences in security needs in different areas are obtained.

[0033] S303: Calculate the regional security demand index by using the correlation analysis results, combined with the population density and event frequency data, and analyze and generate the regional security resource demand forecast results; Regional security demand index, according to the formula, ; Calculate, where Represents the security demand index value, Represents regional population density, which is used to measure the concentration of population in a region. Represents the event frequency, reflecting the frequency of security incidents in the target area. Represents the size of the target area and is used to adjust the distribution density of security resources. Represents the weighted average of historical event data, Represents the monthly rate of change.

[0034] : Regional population density, measured in people per square kilometer.

[0035] : Event frequency, which indicates the number of times an event occurs within a specific period of time.

[0036] : Regional area, in square kilometers.

[0037] : The weighted average of historical event data, reflecting the contribution of past event data to the prediction.

[0038] : Monthly rate of change, showing the monthly volatility of event frequency.

[0039] The following data was collected from government databases and security reports:

[0040] people / km² (according to the most recent census data).

[0041] (Number of events per square kilometer in a month).

[0042] Square kilometres (measured using Geographic Information Systems).

[0043] (Weighted based on data from the past five years, with more emphasis on recent data).

[0044] (Last month's events increased by 5% compared to this month's).

[0045] Calculate the adjustments for the weighted average and monthly rate of change of historical events: ; Using these data calculate the formula: ; Calculate the square root and multiplication part: ; ; Substituting the values ​​into the formula: ; The results show that the regional security demand index is 14140, which reflects the comprehensive security demand level based on population density, event frequency and regional size. A high index means that the region has an urgent need for security resources and should give priority to resource allocation and strengthening of security measures. Through this index, the required security resources can be effectively predicted and allocated to ensure the rational use of resources and the optimization of regional security.

[0046] See also Figure 5 , the specific steps of S4 are: S401: Collect and organize the regional security resource demand forecast results, conduct an inventory of current security manpower and physical resources, check resource types, quantities and distribution status, and generate security resource status records; Based on the regional security resource demand forecast results, a systematic inventory of security human resources and physical resources in the current area is conducted. First, the number of security personnel, functional distribution and specific deployment of each area are collected. Physical resources, including monitoring equipment, alarm facilities, etc. are checked item by item, and the number, installation location and monitoring coverage of each type of resource are recorded. The data is summarized and resources of the same type are classified into one category. It is checked whether the quantity of each type of resource meets the needs of the corresponding area. The balance of resource distribution is further verified, and some areas with concentrated resources and areas with scarce resources are marked. The distribution status of resources in each area is registered to ensure that a complete resource status is obtained and a security resource status record is formed.

[0047] S402: Based on the current status records of security resources, perform resource efficiency evaluation, analyze the utilization efficiency and coverage effect of each resource, identify areas of excess and shortage of resources, take adjustment measures to optimize resource allocation, and obtain resource allocation efficiency analysis results; Based on the current status records of security resources, we conduct efficiency evaluations on each type of resource, collect statistics on the frequency of use and coverage of each resource, and then count the working hours of security personnel and the coverage area of ​​their responsible areas. We compare the frequency of use of physical resources in different areas, analyze whether the allocation and coverage of equipment and manpower are reasonable, identify areas with low resource utilization and shortage areas, classify resource utilization efficiency into different levels, determine the specific distribution areas of inefficient and surplus resources, and propose specific adjustment measures for areas with unreasonable resource distribution, so as to reallocate resources in inefficient areas and fill shortage areas, and obtain the results of resource allocation efficiency analysis.

[0048] S403: According to the resource allocation efficiency analysis results, plan to adjust human and physical resources in each area as needed, accurately match security resources, and generate a resource optimization allocation plan; According to the results of the resource allocation efficiency analysis, a security resource adjustment plan is formulated for each area. Priority is given to allocating sufficient security personnel and equipment to high-demand areas. The number of manpower and types of equipment allocated to each area are clearly defined to ensure that human resources are readjusted to key areas as needed. Physical resources, including monitoring and alarm equipment, are redeployed area by area, and the installation location and monitoring range of the equipment are adjusted to cover areas with prominent security needs. Based on the utilization of each type of equipment and human resources, the specific configuration quantity required for each area is counted. Through this allocation process, a resource optimization allocation plan is generated.

[0049] See also Figure 6 , the specific steps of S5 are: S501: reconfigure the resource distribution of the monitoring system according to the resource optimization configuration plan, install cameras and sensors in key areas, and generate an adjusted monitoring equipment layout plan; According to the resource optimization allocation plan, the specific installation locations of cameras and sensors in the monitoring system are readjusted. First, key areas are selected. According to the security demand density and actual geographical location of the area, cameras and sensors are installed centrally at entrances and exits, traffic-intensive areas, and areas prone to incidents. When each camera is installed, the monitoring viewing angle range is determined, and the appropriate height and angle are set to ensure that the maximum coverage range is covered. When installing the sensor, its detection range is calibrated, and different sensing sensitivities are set to adapt to environmental requirements. The functional status of each camera and sensor is tested one by one. After ensuring the normal operation of the equipment, an adjusted monitoring equipment layout plan is generated.

[0050] S502: Using the adjusted monitoring equipment layout plan, analyze the behavior pattern of the real-time collected monitoring data, track the changes in the speed and direction of the moving trajectory, mark the area with abnormal residence time, identify abnormal changes in the behavior pattern, and obtain the abnormal behavior pattern analysis results; Using the adjusted monitoring equipment layout plan, monitoring data is collected and recorded in real time, behavioral patterns are analyzed in detail, and the movement trajectory in each monitoring area is detected one by one. By comparing the continuously collected positioning data, the speed and direction changes of each target are counted, the movement of the target at different time points is tracked, and significant changes in direction or speed are identified and recorded. Furthermore, areas where the residence time exceeds the set time threshold are marked and identified as abnormal areas. The abnormal characteristics of the behavior pattern in the area are analyzed to obtain the abnormal behavior pattern analysis results.

[0051] S503: According to the abnormal behavior pattern analysis result, the actual situation of each identified abnormal behavior is recorded, including the time, location and behavior feature description of the abnormal behavior, and an abnormal behavior identification record is generated; According to the results of abnormal behavior pattern analysis, the abnormal behaviors identified in the monitoring are recorded item by item, and the actual situation of each abnormal event is recorded in detail, including the time of occurrence, specific location, and description of behavioral characteristics. The time of abnormal behavior is accurately recorded in hours and minutes, and the specific location where the abnormality occurs is marked. The characteristics of the behavior are recorded in detail through text descriptions, such as long stay time or frequent and recurring movement trajectories, to generate abnormal behavior identification records.

[0052] See also Figure 7 , the specific steps of S6 are: S601: Based on the abnormal behavior recognition records, extract key behavior feature data, including behavior type, frequency and location, compare and analyze with the current security strategy, make adjustments according to the new behavior pattern, and generate strategy demand matching results; Based on the abnormal behavior identification records, the key behavior feature data in each record is extracted, including the type of behavior, frequency of occurrence and specific location of occurrence. First, the feature data is classified according to the type of behavior, and the frequency of occurrence of each type of behavior is counted. The proportion of high-frequency abnormal behaviors is analyzed and compared with the frequency standards set in the current security strategy. Next, the location distribution of each abnormal behavior in the record is counted, and the main occurrence areas of high-frequency behaviors are listed one by one. According to the regional settings in the current security strategy, the non-compliant parts are identified and marked. According to the latest behavior patterns and characteristics, the applicability of the current strategy is analyzed, all non-matching policy parts are identified, and the non-compliant items are sorted out to form new adjustment requirements, and finally the strategy requirement matching results are generated.

[0053] S602: Based on the strategy requirement matching result, by simulating different security event response scenarios, recording the security responses corresponding to different types of abnormal behaviors, evaluating the actual application effect of the strategy, and obtaining the strategy effect simulation result; Based on the results of strategy demand matching, the response scenarios of different types of security events are simulated so that the corresponding security response steps can be clearly identified when each different type of abnormal behavior is triggered. First, various behavioral events in the simulation scenario are set up, and the manpower and physical equipment of the security system are gradually operated to record in detail the security response time, equipment startup delay, and coverage area effect after each behavioral event is triggered. For each behavior type and event scenario, the response time of human resources and the occupancy of equipment resources are analyzed. After the simulation is completed, the response effects of different response plans in the actual triggering behavior are compared in detail, and the effects and reaction performance of each security strategy in different scenarios are classified to finally generate the strategy effect simulation results.

[0054] S603: According to the simulation results of the strategy effect, adjust and optimize the security strategy to respond to the latest identified abnormal behavior, dynamically optimize the strategy to match the continuously changing security needs, and output the intelligent generation plan of the security strategy; According to the simulation results of the strategy effect, the existing security strategies are adjusted and optimized item by item. For the latest identified abnormal behaviors, the most suitable response strategies are analyzed and determined, and the distribution of human and equipment resources is reconfigured to better respond to changes in behavioral characteristics. The high-incidence frequency of behavior types in specific areas is analyzed, and dynamic resource allocation is performed based on the simulation data. The deployment priority of manpower and the response plan of equipment are updated. Specifically, strategies with slower response times are adjusted to adapt to actual changes in security needs. The updated strategies are gradually implemented in the security area, and intelligently generated security strategy plans are output.

[0055] Figure 8 This is a block diagram of a smart security strategy generation based on big data according to an exemplary embodiment. The device is used for a smart security strategy generation method based on big data. It includes: The data collection and verification module collects data based on access control records, verifies timestamps and event types, confirms information consistency, corrects incorrect input, fills in missing data values, performs consistency and integrity checks, and obtains a comprehensive data set; The data processing and analysis module performs standardized processing based on the comprehensive data set, screens key indicators related to security events, builds a preliminary event probability assessment model, predicts the possibility of future security events, and generates event probability analysis results; The feature data association module collects the population density and historical event frequency data of the target area, confirms the consistency and comparability of the data, and performs association analysis on the population density and historical event frequency in the regional basic feature data set to obtain the association analysis results; The security demand assessment module uses the results of correlation analysis, combined with population density and event frequency data, to calculate the regional security demand index, check resource types, quantities and distribution status, and generate a record of the current status of security resources; The resource allocation optimization module analyzes the utilization efficiency and coverage effect of each resource based on the current status records of security resources, identifies areas with excess and shortage resources, takes adjustment measures to optimize resource allocation, accurately matches security resources, and generates resource optimization allocation plans; The behavior pattern analysis module reconfigures the resource distribution of the monitoring system according to the resource optimization configuration plan, performs behavior pattern analysis on the real-time collected monitoring data, records the actual situation of each identified abnormal behavior, and generates abnormal behavior identification records; The strategy generation and adjustment module extracts key behavior feature data based on abnormal behavior identification records, compares and analyzes it with the current security strategy, simulates different security event response scenarios, evaluates the actual application effect of the strategy, adjusts and optimizes the security strategy, and outputs an intelligent security strategy generation plan.

[0056] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for generating intelligent security strategies based on big data, characterized in that: The following steps are involved: Collect historical security event data, clean the data and unify the format, verify the data quality and consistency, and obtain a comprehensive data set; Based on the comprehensive data set, key indicators are screened through data normalization and variable selection, and an initial event probability assessment model is established using the key indicators. The possibility of future security events is predicted through the frequency and pattern of events in historical data, and event probability analysis results are generated; Using the event probability analysis results, combined with regional characteristic data, weighted analysis of regional population density and historical event frequency is performed to calculate the regional security demand index and generate regional security resource demand forecast results; Based on the forecast results of the security resource demand in the region, security manpower and physical resources are allocated, the efficiency of existing resources is evaluated, resources are adjusted according to regional needs, and a resource optimization allocation plan is generated; Apply the resource optimization configuration scheme to perform behavior pattern analysis on real-time monitoring data, perform anomaly detection on movement trajectories and dwell time in the monitoring data, identify and record abnormal behaviors, and generate abnormal behavior identification records; Conduct an in-depth analysis of the abnormal behavior identification records, conduct a matching test with the existing security strategies, simulate different security event response scenarios, evaluate the response effects of different security strategies, dynamically adjust the security strategies, and output the intelligent generation plan of the security strategy.

2. The method for generating intelligent security strategies based on big data according to claim 1 is characterized in that: The comprehensive data set includes data types, data structures and data integrity test results, the event probability analysis results include probability prediction values, key influencing factors and reliability assessment results, the regional security resource demand prediction results include regional risk ratings, resource gap indexes and priority rankings, the resource optimization configuration plan includes resource reallocation records, optimized resource distribution records and expected resource coverage, the abnormal behavior identification records include abnormal behavior types, abnormal occurrence time points and abnormal behavior levels, and the security strategy intelligent generation plan includes strategy adaptive adjustment results, strategy coverage and expected defense effectiveness analysis results.

3. The method for generating intelligent security strategies based on big data according to claim 1 is characterized in that: The specific steps to collect historical security event data, clean and unify the data format, and verify the data quality and consistency to obtain a comprehensive data set are as follows: Collect data based on access control records, perform data integration, import according to a unified format, check timestamps and event types, confirm information consistency, and generate original data sets; According to the original data set, duplicate data is identified and deleted, incorrect input is corrected, missing data values ​​are filled, and a cleaned data set is generated; The cleaned data set is subjected to consistency and integrity checks to confirm that the records in the data set match the preset data standards and quality requirements, thereby obtaining a comprehensive data set.

4. The method for generating intelligent security strategies based on big data according to claim 1 is characterized in that: Based on the comprehensive data set, through data normalization and variable selection, key indicators are screened, and the initial event probability assessment model is established using the key indicators. The possibility of future security events is predicted through the frequency and pattern of events in historical data. The specific steps for generating event probability analysis results are as follows: Based on the comprehensive data set, standardization processing is performed to adjust the value range and format and unify the scale to generate a normalized data set; Based on the normalized data set, feature selection is performed to screen key indicators associated with security events, including the time, location and frequency of the events, and irrelevant variables are eliminated to obtain a key indicator data set; Utilize the key indicator data set to analyze the frequency and pattern of occurrence of different security events, build a preliminary event probability assessment model, predict the possibility of future security events, and generate event probability analysis results.

5. The method for generating intelligent security strategies based on big data according to claim 1, characterized in that: The specific steps of using the event probability analysis results, combining regional characteristic data, weighted analysis of regional population density and historical event frequency, calculating the regional security demand index, and generating regional security resource demand forecast results are as follows: Collect population density and historical event frequency data of the target area, format the data and standardize the scope, confirm the consistency and comparability of the data, and generate a regional basic characteristic data set; Based on the event probability analysis results, the population density in the regional basic feature data set is correlated with the historical event frequency to reveal the differences in security requirements in different regions and obtain correlation analysis results; The association analysis results are used in combination with population density and event frequency data to calculate the regional security demand index, analyze and generate regional security resource demand forecast results.

6. The method for generating intelligent security strategies based on big data according to claim 5 is characterized in that: The security demand index of the area is calculated according to the formula: ； Calculate, where Represents the security demand index value, represents the regional population density, represents the event frequency, Represents the size of the target area. Represents the weighted average of historical event data, Represents the monthly rate of change.

7. The method for generating intelligent security strategies based on big data according to claim 1, characterized in that: Based on the forecast results of the regional security resource demand, the specific steps of allocating security manpower and physical resources, evaluating the efficiency of existing resources, adjusting resources according to regional demand, and generating a resource optimization allocation plan are as follows: Collect and organize the forecast results of security resource demand in the area, conduct an inventory of current security manpower and physical resources, check resource types, quantities and distribution status, and generate a record of the current status of security resources; Based on the security resource status records, perform resource efficiency evaluation, analyze the utilization efficiency and coverage effect of each resource, identify areas of resource surplus and shortage, take adjustment measures to optimize resource allocation, and obtain resource allocation efficiency analysis results; According to the resource allocation efficiency analysis results, plan each area to adjust human and physical resources as needed, accurately match security resources, and generate a resource optimization configuration plan.

8. The method for generating intelligent security strategies based on big data according to claim 1, characterized in that: Apply the resource optimization configuration scheme, perform behavior pattern analysis on real-time monitoring data, perform anomaly detection on movement trajectory and residence time in monitoring data, identify and record abnormal behavior, and generate abnormal behavior identification records in the following specific steps: According to the resource optimization configuration plan, reconfigure the resource distribution of the monitoring system, install cameras and sensors in key areas, and generate an adjusted monitoring equipment layout plan; Using the adjusted monitoring equipment layout plan, the real-time collected monitoring data is analyzed for behavior patterns, the changes in the speed and direction of the moving trajectory are tracked, the areas with abnormal residence time are marked, the abnormal changes in the behavior patterns are identified, and the abnormal behavior pattern analysis results are obtained; According to the abnormal analysis result of the behavior pattern, the actual situation of each identified abnormal behavior is recorded, including the time, location and behavior feature description of the abnormal behavior, and an abnormal behavior identification record is generated.

9. The method for generating intelligent security strategies based on big data according to claim 1, characterized in that: The specific steps of deeply analyzing the abnormal behavior recognition records, matching the records with existing security strategies, simulating different security event response scenarios, evaluating the response effects of different security strategies, dynamically adjusting security strategies, and outputting security strategy intelligent generation solutions are as follows: Based on the abnormal behavior identification records, extract key behavior feature data, including behavior type, frequency and location, compare and analyze with the current security strategy, make adjustments according to the new behavior pattern, and generate strategy demand matching results; Based on the strategy requirement matching result, by simulating different security event response scenarios, recording the security responses corresponding to different types of abnormal behaviors, evaluating the actual application effect of the strategy, and obtaining the strategy effect simulation result; According to the simulation results of the strategy effect, the security strategy is adjusted and optimized to respond to the latest identified abnormal behavior, the strategy is dynamically optimized to match the continuously changing security needs, and the security strategy intelligent generation plan is output.

10. An intelligent security strategy generation device based on big data, characterized in that: According to the method for generating intelligent security strategies based on big data according to any one of claims 1 to 9, the device comprises: The data collection and verification module collects data based on access control records, verifies timestamps and event types, confirms information consistency, corrects incorrect input, fills in missing data values, performs consistency and integrity checks, and obtains a comprehensive data set; The data processing and analysis module performs standardized processing based on the comprehensive data set, screens key indicators associated with security events, builds a preliminary event probability assessment model, predicts the possibility of future security events, and generates event probability analysis results; The feature data association module collects the population density and historical event frequency data of the target area, confirms the consistency and comparability of the data, and performs association analysis on the population density and historical event frequency in the basic feature data set of the area to obtain the association analysis results; The security demand assessment module uses the correlation analysis results, combined with population density and event frequency data, to calculate the regional security demand index, check resource types, quantities and distribution status, and generate a security resource status record; The resource allocation optimization module analyzes the utilization efficiency and coverage effect of each resource based on the current status record of the security resources, identifies areas of excess and shortage of resources, takes adjustment measures to optimize resource allocation, accurately matches security resources, and generates a resource optimization allocation plan; The behavior pattern analysis module reconfigures the resource distribution of the monitoring system according to the resource optimization configuration plan, performs behavior pattern analysis on the real-time collected monitoring data, records the actual situation of each identified abnormal behavior, and generates abnormal behavior identification records; The strategy generation and adjustment module extracts key behavior feature data based on the abnormal behavior identification records, compares and analyzes it with the current security strategy, simulates different security event response scenarios, evaluates the actual application effect of the strategy, adjusts and optimizes the security strategy, and outputs an intelligent security strategy generation plan.

Images