Police equipment user portrait and behavior anomaly detection method and system

Abstract

The invention belongs to but not limited to the technical field of data mining, and particularly relates to a police service equipment user portrait and behavior anomaly detection method and system, and the method comprises the steps: S1, reading data from a police service equipment log database by the system; s2, grouping the police service equipment log data by a user IP; s3, re-grouping the IP data of each user by taking day as a unit; s4, dividing the intra-day data into time periods at equal intervals, and constructing a character string data set according to an ascending sequence of the time periods and task execution numbers; s5, performing frequent item mining on any user IP by using an Apriori algorithm to obtain a sequence structure of frequent execution task numbers of the user IPs; s6, classifying the user IPs with the same sequence structure; and S7, continuously monitoring a user IP task execution sequence structure, and when the sequence structure changes, sending out a user IP class abnormity early warning. Based on the data mining technology, the police service equipment user portrait and abnormal behavior detection is realized, and the user safety management of the police service department is ensured.

Description

Technical Field

[0001] The present invention belongs to but is not limited to the field of data mining technology, and in particular relates to a method and system for detecting police equipment user portraits and abnormal behavior. Background Art

[0002] With the deepening development of informatization and intelligence, the types of police equipment have become increasingly complex and diverse, and the user management of police equipment has become an increasingly severe test. After the continuous use of police equipment, a large amount of police equipment log data has been generated, forming a rich police equipment log database. By extracting and analyzing the information of the police equipment log database, it can provide a more in-depth perspective for the user management of police equipment, making the decision more scientific and accurate.

[0003] In view of the above analysis, the technical problems that urgently need to be solved in the existing technology are: preprocessing the police equipment log database, designing a police equipment user classification method based on the preprocessed police equipment log database, and designing a user class behavior anomaly detection method. Summary of the invention

[0004] In response to the problems existing in the prior art, the present invention provides a method and system for detecting police equipment user portraits and abnormal behaviors. It combines data mining technology to analyze the police equipment log database, mines the behavioral patterns of police equipment users, and designs a method for detecting abnormal behaviors of police equipment users to achieve safe management of police equipment users.

[0005] The present invention is implemented as follows: a police equipment user profile and a method for detecting abnormal behavior thereof, comprising:

[0006] S1, the system reads data from the police equipment log database;

[0007] S2, grouping police equipment log data by user IP;

[0008] S3, regrouping each user's IP data by day;

[0009] S4, the intraday data is divided into time periods at equal intervals, and the time periods and task execution numbers are in ascending order to construct a string data set;

[0010] S5. Use the Apriori algorithm to mine frequent items for any user IP and obtain the sequential structure of the task numbers frequently executed by the user IP;

[0011] S6, classifying user IPs with the same sequence structure;

[0012] S7. Continuously monitor the user IP task execution sequence structure, and issue a user IP abnormality warning when the sequence structure changes.

[0013] Furthermore, in S1, the system reads data from the police equipment log database. The log data contains basic fields <user IP, device ID, recording time, task execution number> and is stored in the MySQL database.

[0014] In S2, the police equipment log data is grouped by user IP, and the log data in MySQL is grouped by the user IP field.

[0015] In S3, each user IP data is regrouped in units of days, and in each group grouped by the user IP field, the data is grouped again in units of days.

[0016] Furthermore, the intraday data in S4 is divided into time periods at equal intervals, and the time periods and task execution numbers are used in ascending order to construct a string data set, where the task execution number is the number corresponding to the task that the user IP is performing using the police equipment. The user IP may have multiple tasks in a time period within a day. The task execution numbers are arranged in ascending order for multiple tasks and concatenated with the hours, minutes, and seconds of the time period to form a string. The strings of multiple time periods within a day constitute a one-dimensional string array, and the multi-day data of the user IP constitutes a two-dimensional string array, i.e., a string data set.

[0017] Furthermore, in S5, the Apriori algorithm is used to perform frequent item mining on any user IP string data set to obtain a sequential structure of the task numbers frequently executed by the user IP, wherein the frequent sequential structure is a plurality of frequent strings that appear in a single day in the user IP string data set.

[0018] Furthermore, in S6, user IPs with the same sequence structure are classified. Specifically, if multiple user IPs have the same sequence structure Seqstr item, the multiple IPs are regarded as the same type of users, and the division of user classes is completed.

[0019] Furthermore, S7 continuously monitors the user IP task execution sequence structure, and issues a user IP abnormality warning when the sequence structure changes. Specifically, with the operation of police equipment and the continuous update of the police equipment log database, the user IP task execution sequence structure is continuously mined, and when the user IP sequence structure changes, a user IP abnormality warning is issued.

[0020] Another object of the present invention is to provide a police equipment user portrait and its behavior abnormality detection system for realizing the police equipment user portrait and its behavior abnormality detection method, comprising:

[0021] Data reading module, the system reads data from the police equipment log database;

[0022] Data grouping module, which groups police equipment log data by user IP;

[0023] Data regrouping module, regrouping each user's IP data by day;

[0024] The time period division module divides the intraday data into time periods at equal intervals, and constructs a string data set in ascending order of time periods and task execution numbers;

[0025] The frequent item mining module uses the Apriori algorithm to perform frequent item mining on any user IP and obtain the sequential structure of the task numbers frequently executed by the user IP;

[0026] User IP classification module, classifies user IPs with the same sequence structure;

[0027] The abnormal warning module continuously monitors the user IP task execution sequence structure, and issues a user IP abnormal warning when the sequence structure changes.

[0028] Another object of the present invention is to provide a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor executes the steps of the police equipment user profiling and abnormal behavior detection method.

[0029] Another object of the present invention is to provide a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of the police equipment user profiling and abnormal behavior detection method.

[0030] Another object of the present invention is to provide an information data processing terminal, which includes the police equipment user portrait and its abnormal behavior detection system.

[0031] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0032] First, based on data mining technology, the present invention realizes the user profiling of police equipment and its abnormal behavior detection, ensuring the user security management of the police department.

[0033] Second, the expected benefits and commercial value after the transformation of the technical solution of the present invention are: the technical solution of the present invention can be widely used in the user management of police equipment such as drones and unmanned vehicles, significantly improving the accuracy and efficiency of user management of police equipment, and improving the effectiveness of the use of police equipment.

[0034] The technical solution of the present invention fills the technical gap in the industry at home and abroad: The technical solution of the present invention fills the technical gap in classifying police equipment users by analyzing the task execution sequence structure of police equipment users based on data mining technology, and monitoring the task execution sequence structure of police equipment users, thereby issuing early warnings for abnormal behaviors of police equipment users.

[0035] The technical solution of the present invention solves a technical problem that people have been eager to solve but have never succeeded in solving: the technical solution of the present invention significantly reduces the computational complexity of mining the task execution sequence structure of police equipment users by designing a police equipment log database preprocessing method, thereby making it possible to classify police equipment users based on the task execution sequence structure.

[0036] The technical solution of the present invention overcomes technical prejudice: the technical solution of the present invention overcomes the thinking limitation of high computational complexity of task execution sequence structure of mining police equipment users, and realizes the construction of police equipment user class based on data mining and its abnormal behavior detection.

[0037] Third, the technical solution of the present invention solves the following key problems in the prior art in industrial applications and brings about significant technological progress:

[0038] 1. Solve the problem of abnormal behavior detection in existing technologies

[0039] In the use of police equipment, traditional user behavior monitoring and anomaly detection mainly rely on simple rule matching or static behavior patterns, which are difficult to adapt to complex and changeable user operation behaviors, especially in high-risk operations and frequent task switching environments, anomaly detection is often inaccurate. The present invention can dynamically build user behavior portraits through behavioral sequence analysis based on user IP, combined with the Apriori algorithm to mine the user's frequent task execution sequence structure, effectively improving the accuracy and timeliness of anomaly detection, thereby overcoming the defect of poor detection of complex behavior patterns in the prior art.

[0040] 2. Improve the real-time and accuracy of abnormal warning

[0041] Existing systems usually have difficulty in detecting changes in behavior patterns in a timely manner, and abnormal behavior may pose a threat to system security before being identified. The present invention structures and continuously monitors user behavior sequences. Once an abnormal fluctuation occurs in the behavior sequence, an early warning is triggered, which effectively improves the real-time and accuracy of abnormal early warnings and makes the monitoring and management of police equipment more intelligent and agile. This feature is of great significance to industrial application scenarios that require real-time protection of system security, and reduces the security risks caused by delayed detection.

[0042] 3. Automating behavioral analysis and making pattern recognition more efficient

[0043] In traditional methods, a large amount of behavior analysis and anomaly identification rely on manual judgment or static rules, which are inefficient and easily interfered by subjective factors. The present invention introduces the Apriori algorithm for frequent item mining, so that the system can automatically identify and summarize the task structure frequently performed by users, and classify and summarize the typical user group behavior patterns. Through automated and efficient behavior analysis and pattern recognition, the system can quickly adapt to changes in user behavior, reduce the need for manual intervention, and improve the analysis efficiency and reliability in industrial applications.

[0044] 4. Effectively reduce false alarm rate and maintenance costs

[0045] The false alarm rate of traditional anomaly detection methods is usually high, requiring a lot of manpower for secondary screening and judgment, which increases the system maintenance cost. The present invention can accurately distinguish between normal and abnormal behaviors by combining user profiling and behavioral feature extraction, significantly reducing the false alarm rate, thereby reducing the workload and manpower cost of system maintenance. This advantage is particularly significant in the high-frequency operation of police equipment, providing a guarantee for the long-term stable operation of the system.

[0046] 5. Significantly improve the intelligence level of police equipment management

[0047] The present invention combines user behavior data, frequent item mining algorithms, and anomaly monitoring strategies to realize intelligent user behavior monitoring and anomaly detection processes, significantly improving the intelligence level of police equipment management. The system can automatically learn and update user behavior profiles and adjust according to actual changes, so that the system has the ability to adapt and dynamically adjust. This intelligent management model not only improves the user operation experience, but also provides strong support for the efficient and safe management of police equipment.

[0048] In industrial applications, this invention not only solves the accuracy, real-time and false alarm rate problems in traditional anomaly detection, but also significantly improves the intelligence and automation level of police equipment management, providing reliable and efficient technical support for high-risk and high-security application environments. This technical solution can be applied to a variety of user behavior monitoring scenarios, with wide promotion value and significant technological progress. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flow chart of a police equipment user portrait and a method for detecting abnormal behavior thereof provided by an embodiment of the present invention;

[0050] Figure 2 It is a structural diagram of a police equipment user portrait and anomaly behavior detection system provided by an embodiment of the present invention;

[0051] Figure 3It is a main page diagram for constructing a user IP class for entering a police device provided by an embodiment of the present invention;

[0052] Figure 4 This is a diagram of the main page for detecting anomaly of user IP types entering police equipment provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0054] like Figure 1 As shown, the embodiment of the present invention provides a police equipment user portrait and abnormal behavior detection solution, which specifically includes the following steps:

[0055] S101. The system reads data from the police equipment log database.

[0056] S102. Group police equipment log data by user IP.

[0057] S103, regrouping each user's IP data in units of days.

[0058] S104. The intraday data is divided into time periods at equal intervals, and a character string data set is constructed by an ascending sequence of time periods and task execution numbers.

[0059] S105 , using the Apriori algorithm to perform frequent item mining on any user IP, and obtaining a sequential structure of task numbers frequently executed by the user IP.

[0060] S106: Classify user IPs with the same sequence structure.

[0061] S107, continuously monitor the user IP task execution sequence structure, and issue a user IP abnormality warning when the sequence structure changes.

[0062] The police equipment user profile and abnormal behavior detection scheme of the present invention realizes continuous monitoring and abnormal detection of police equipment user behavior through data analysis and mining algorithms. The specific principles are as follows:

[0063] First, in **step S101**, the system reads relevant data from the police equipment log database, including user access records, task execution status and other log information. These data provide a basis for subsequent analysis of user behavior and ensure the accuracy of user profiling and anomaly detection.

[0064] Next, in step S102, the system groups the log data based on the user's IP address so that the behavior records of each user's IP address can be divided independently to form the usage behavior trajectory data of a single user. This step helps to analyze the unique behavior characteristics of each user in the future, thus providing a reference for anomaly detection.

[0065] In **step S103**, the system further groups the data of each user IP by day, so that the behavior sequence of each IP address on a daily basis can be clearly presented. This can capture daily behavior patterns and provide support for the construction of user portraits and periodic analysis of behavior.

[0066] Then, in step S104, the system divides the daily data into several time periods at equal intervals, and constructs a string data set in ascending order of time periods and task execution numbers. This structured string data set can describe the operation sequence and frequency of each user in a day, laying the foundation for the identification of frequent behavior patterns.

[0067] In step S105, the system uses the Apriori algorithm to perform frequent item mining on the string data set of any user IP to identify the sequential structure of the task numbers that the user frequently performs. Through this frequent item mining, the system can extract the characteristic patterns of user behavior and generate a behavioral profile of the user IP.

[0068] Next, in **step S106**, the system categorizes the user IPs with the same task execution sequence structure to construct typical behavior characteristics of the user group. For users with similar operation sequences, the system can perform similar analysis on their behaviors to improve the reliability of anomaly detection.

[0069] Finally, the system continuously monitors the task execution sequence structure of the user IP in **step S107**. When the sequence structure changes abnormally, the system issues a user IP abnormality warning. This warning function can quickly detect situations where user behavior deviates from the normal state, provide support for timely response to abnormal situations, and thus improve the safety and management efficiency of police equipment.

[0070] The above steps S101 to S107 will be described in detail below.

[0071] Regarding step S101, the system reads data from the police equipment log database. Specifically, the log data contains basic fields <user IP, device ID, recording time, task execution number>, which are stored in the mysql database.

[0072] Regarding step S102, the police equipment log data is grouped by user IP, specifically, the log data in MySQL is grouped by user IP field.

[0073] Regarding step S103, each user IP data is regrouped in units of days. Specifically, in each group grouped by the user IP field, the data is grouped twice in units of days.

[0074] Regarding step S104, the intra-day data is divided into time periods at equal intervals, and the time periods and the task execution numbers are used in ascending sequence to construct a string data set. Specifically, the data group after the secondary grouping is divided at equal time intervals. In this embodiment, the single-day data is divided at intervals of five minutes, and the task execution numbers of all log data entries within five minutes are extracted and arranged in ascending order. The hours, minutes, and seconds of the time period are concatenated with the ascending sequence of the task number to obtain a string set.

[0075] The string concatenation is as follows, such as log data:

[0076] [1,2024-09-0115:00:00,192.168.1.1,101]

[0077] [1,2024-09-0115:00:00,192.168.1.1,102]

[0078] Take the ascending sequence of task numbers [101,102], take the time period 15:00:00-15:05:00, and get the concatenated string 15:00:00||101||102. For a single user, get the concatenated string two-dimensional array IPstr as the transaction database of the Apriori algorithm.

[0079] Regarding step S105, the Apriori algorithm is used to mine frequent items for any user IP to obtain the sequential structure of the task numbers frequently executed by the user IP. Specifically, the IPstr two-dimensional data is used as the transaction database, and IPstr [i] As a transaction, IPstr [i][j] As a transaction item, set the support threshold support threshold , construct frequent 1-item sets. When:

[0080] Support(X,Y)≥support threshold ;

[0081]

[0082] It is considered as a frequent item. X, Y are transaction items, number(XY) is the frequency of (X, Y), and number(AllSamples) is the number of transactions.

[0083] Then, a candidate 2-item set C2 is generated from a frequent 1-item set such as L1 = {A, B, C}, where C2 is generated by the permutation and combination of L1, C2 = {(A, B), (A, C), (B, C)}, and its construction rule is to start from L k Select each pair of frequent k-item sets from . If the two frequent k-item sets have (k-1) items in common, that is, they share the first (k-1) items, then the two item sets can be merged into a candidate (k+1)-item set, and continue to generate candidate (k+1)-item sets. Recursively solve L k+1 , until the frequent item set is empty, forming a two-dimensional array of the sequential structure Seqstr of the user IP's frequently executed task numbers, as shown below.

[0084] [[12:00:00||101||102,15:00:00||101||102],[11:00:00||101||102,12:00:00||10||12,

[0085] 13:00:00||11||12]]

[0086] Regarding step S106, user IPs with the same sequence structure are classified. Specifically, if multiple user IPs have the same sequence structure Seqstr item, the multiple IPs are regarded as the same type of users, and the division of user classes is completed.

[0087] Regarding step S107, continuously monitor the user IP task execution sequence structure, and issue a user IP abnormality warning when the sequence structure changes. Specifically, with the operation of police equipment, the police equipment log database is continuously updated, and by continuously mining the user IP task execution sequence structure, when the user IP sequence structure changes, a user IP abnormality warning is issued.

[0088] The present invention realizes the police equipment user portrait and abnormal behavior detection based on data mining technology, thus ensuring the user safety management of the police department.

[0089] like Figure 2 As shown in the figure, the police equipment user portrait and its behavior anomaly detection system include:

[0090] Data reading module, the system reads data from the police equipment log database;

[0091] Data grouping module, which groups police equipment log data by user IP;

[0092] Data regrouping module, regrouping each user's IP data by day;

[0093] The time period division module divides the intraday data into time periods at equal intervals, and constructs a string data set in ascending order of time periods and task execution numbers;

[0094] The frequent item mining module uses the Apriori algorithm to perform frequent item mining on any user IP and obtain the sequential structure of the task numbers frequently executed by the user IP;

[0095] User IP classification module, classifies user IPs with the same sequence structure;

[0096] The abnormal warning module continuously monitors the user IP task execution sequence structure, and issues a user IP abnormal warning when the sequence structure changes.

[0097] An application embodiment of the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor executes the steps of a method for detecting user profiling of police equipment and abnormal behavior thereof.

[0098] An application embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the steps of a method for detecting user profiling of police equipment and abnormal behavior thereof.

[0099] An application embodiment of the present invention provides an information data processing terminal, which includes a police equipment user portrait and an abnormal behavior detection system.

[0100] The present invention can be applied to the potential value mining of the police equipment log database of the police department of large-scale activities. By analyzing the task execution sequence structure of the police equipment user IP, a user IP class with the same task execution sequence structure is constructed. As the police equipment log database is continuously updated, the task execution sequence structure of the same police equipment user IP class is monitored, and early warnings are issued for abnormal police equipment user IP classes.

[0101] The following is the software simulation effect of the present invention: Enter the police equipment user IP class to build the main page, as shown in the attached manual Figure 3 As shown, by selecting the start and end time, you can choose the police equipment log database to be analyzed, select the police equipment set to be analyzed, and click query to obtain the user IP class and corresponding user IP members constructed according to the task execution sequence structure of the police equipment user IP.

[0102] Enter the main page of the police equipment user IP anomaly detection, as shown in the attached manual. Figure 4As shown, select the start and end time, select the updated police equipment log database, and click query. You can then detect the task execution sequence structure of the police equipment user IP class. When the task execution sequence structure of the police equipment user IP class changes, an early warning will be issued for the abnormal police equipment user IP class.

[0103] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0104] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A police equipment user profile and behavior anomaly detection method, characterized in that: include: S1, the system reads data from the police equipment log database; S2, grouping police equipment log data by user IP; S3, regrouping each user's IP data by day; S4, the intraday data is divided into time periods at equal intervals, and the time periods and task execution numbers are in ascending order to construct a string data set; S5. Use the Apriori algorithm to mine frequent items for any user IP and obtain the sequential structure of the task numbers frequently executed by the user IP; S6, classifying user IPs with the same sequence structure; S7. Continuously monitor the user IP task execution sequence structure, and issue a user IP abnormality warning when the sequence structure changes.

2. The police equipment user profile and behavior abnormality detection method as claimed in claim 1, characterized in that: In S1, the system reads data from the police equipment log database. The log data contains basic fields <user IP, equipment ID, recording time, task execution number> and is stored in the MySQL database; In S2, the police equipment log data is grouped by user IP, and the log data in MySQL is grouped by the user IP field; In S3, each user IP data is regrouped in units of days, and in each group grouped by the user IP field, the data is grouped again in units of days.

3. The police equipment user profile and behavior abnormality detection method as claimed in claim 1, characterized in that: In S4, the intraday data is divided into time periods at equal intervals, and the time periods and task execution numbers are used to construct a string data set in ascending order. The task execution number is the number corresponding to the task that the user IP is performing using the police equipment. The user IP may have multiple tasks in a time period within a day. The task execution numbers are arranged in ascending order and concatenated with the hours, minutes, and seconds of the time period to form a string. The strings of multiple time periods within a day constitute a one-dimensional string array, and the multi-day data of the user IP constitutes a two-dimensional string array, namely, a string data set.

4. The police equipment user profile and behavior abnormality detection method as claimed in claim 1, characterized in that: In S5, the Apriori algorithm is used to perform frequent item mining on any user IP string data set to obtain a sequence structure of task numbers frequently executed by the user IP, wherein the frequent sequence structure is a plurality of frequent strings that appear in a single day in the user IP string data set.

5. The police equipment user profile and behavior abnormality detection method as claimed in claim 1, characterized in that: In S6, user IPs with the same sequence structure are classified. Specifically, if multiple user IPs have the same sequence structure Seqstr item, the multiple IPs are regarded as the same type of users, and the division of user classes is completed.

6. The police equipment user profile and behavior abnormality detection method as claimed in claim 1, characterized in that: S7 continuously monitors the user IP task execution sequence structure, and issues a user IP abnormality warning when the sequence structure changes. Specifically, as the police equipment is running and the police equipment log database is continuously updated, the user IP task execution sequence structure is continuously mined, and when the user IP sequence structure changes, a user IP abnormality warning is issued.

7. A police equipment user portrait and its behavior abnormality detection system implementing the police equipment user portrait and its behavior abnormality detection method as claimed in any one of claims 1 to 6, characterized in that: include: Data reading module, the system reads data from the police equipment log database; Data grouping module, which groups police equipment log data by user IP; Data regrouping module, regrouping each user's IP data by day; Time period division module: the intraday data is divided into time periods at equal intervals, and the ascending sequence of time periods and task execution numbers is used to construct a string data set; The frequent item mining module uses the Apriori algorithm to perform frequent item mining on any user IP and obtain the sequential structure of the task numbers frequently executed by the user IP; User IP classification module, classifies user IPs with the same sequence structure; The abnormal warning module continuously monitors the user IP task execution sequence structure, and issues a user IP abnormal warning when the sequence structure changes.

8. A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for detecting user profiling and abnormal behavior of police equipment as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to execute the steps of the method for detecting user profiling and abnormal behavior of police equipment as described in any one of claims 1 to 6.

10. An information data processing terminal, comprising the police equipment user portrait and abnormal behavior detection system as claimed in claim 7.

Images