A police equipment user portrait and a behavior anomaly detection method and system thereof

Abstract

The present application belongs to but is not limited to the technical field of data mining, and particularly relates to a police service equipment user portrait and a behavior anomaly detection method and system thereof, comprising the following steps: S1, the system reads data from a police service equipment log database; S2, the police service equipment log data is grouped according to user IP; S3, each user IP data is further grouped in units of days; S4, the data in a day is divided into time periods at equal intervals, and a string data set is constructed in ascending order of time period and task execution number; S5, the Apriori algorithm is used to perform frequent item mining on any user IP, and the order structure of the user IP frequently executed task number is obtained; S6, the user IP with the same order structure is classified; S7, the user IP task execution order structure is continuously monitored, and when the order structure changes, an abnormal early warning of the user IP class is sent. The present application realizes the police service equipment user portrait and the abnormal behavior detection thereof based on the data mining technology, and guarantees the user safety management of the police department.

Description

Technical Field

[0001] This invention belongs to, but is not limited to, the field of data mining technology, and particularly relates to a user profiling method and system for police equipment and its abnormal behavior detection. Background Technology

[0002] With the deepening development of informatization and intelligentization, the types of police equipment are becoming increasingly complex and diverse, making the management of police equipment users an increasingly severe challenge. Through continuous use of police equipment, a large amount of police equipment log data is generated, forming a rich police equipment log database. By extracting and analyzing information from this database, a deeper perspective can be provided for police equipment user management, leading to more scientific and accurate decision-making.

[0003] Based on the above analysis, the urgent technical problems that need to be solved in the existing technology are: to preprocess the police equipment log database, to design a police equipment user classification method based on the preprocessed police equipment log database, and to design a user behavior anomaly detection method. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides a user profile for police equipment and a method and system for detecting abnormal behavior. It combines data mining technology to analyze the police equipment log database, uncover the behavioral patterns of police equipment users, and designs a method for detecting abnormal behavior of police equipment users, thereby achieving security management of police equipment users.

[0005] This invention is implemented as follows: a user profiling method for police equipment and a method for detecting abnormal behavior, comprising:

[0006] S1. The system reads data from the police equipment log database;

[0007] S2. Group police equipment log data by user IP;

[0008] S3. Regroup each user's IP data on a daily basis;

[0009] S4. Intraday data is divided into time periods at equal intervals, and a string dataset is constructed by combining the time periods and the ascending sequence of task execution numbers.

[0010] S5. Use the Apriori algorithm to perform frequent item mining on any user IP to obtain the sequential structure of the frequently executed task numbers of the user IP.

[0011] S6. Classify user IPs with the same sequential structure;

[0012] S7. Continuously monitor the execution order structure of user IP tasks. When the order structure changes, issue an alert for user IP-related anomalies.

[0013] Furthermore, in S1, the system reads data from the police equipment log database. The log data contains basic fields such as <user IP, device ID, recording time, and task execution number>, and is stored in a MySQL database.

[0014] In S2, police equipment log data is grouped by user IP, and MySQL log data is also grouped by the user IP field.

[0015] In S3, each user's IP data is further grouped on a daily basis. Within each group grouped by the user's IP field, the data is further grouped on a daily basis.

[0016] Furthermore, in S4, the intraday data is divided into time periods at equal intervals. The time periods and the ascending sequence of task execution numbers are used to construct a string dataset. The task execution number is the number corresponding to the task being performed by the user IP using the police equipment. Within a time period of the day, the user IP may have multiple tasks. The task execution numbers of the multiple tasks are arranged in ascending order and concatenated with the hour, minute, and second of the time period to form a string. The strings of multiple time periods within a day constitute a one-dimensional string array, and the multi-day data of the user IP constitutes a two-dimensional string array, i.e., the string dataset.

[0017] Furthermore, in S5, the Apriori algorithm is used to perform frequent item mining on any user IP string dataset to obtain the sequential structure of frequently executed task numbers of user IPs. The frequent sequential structure consists of multiple frequent strings that appear on a single day in the user IP string dataset.

[0018] Furthermore, in S6, user IPs with the same sequential structure are categorized. Specifically, if multiple user IPs have the same sequential structure Seqstr item, then these multiple IPs are regarded as the same type of user, thus completing the user class division.

[0019] Furthermore, S7 continuously monitors the user IP task execution sequence structure, and issues a user IP-related anomaly warning when the sequence structure changes. Specifically, as the police equipment operates and the police equipment log database is continuously updated, by constantly mining the user IP task execution sequence structure, a user IP-related anomaly warning is issued when the user IP sequence structure changes.

[0020] Another objective of this invention is to provide a system for profiling and detecting abnormal behavior of police equipment users, which implements the aforementioned method for profiling police equipment users and detecting abnormal behavior, comprising:

[0021] The data reading module reads data from the police equipment log database.

[0022] The data grouping module groups police equipment log data by user IP address;

[0023] The data regrouping module regroups each user's IP data on a daily basis.

[0024] The time period segmentation module divides the intraday data into time periods at equal intervals, and constructs a string dataset by combining the time periods and the ascending sequence of task execution numbers.

[0025] The frequent item mining module uses the Apriori algorithm to perform frequent item mining on any user IP to obtain the sequential structure of the frequently executed task numbers of the user IP;

[0026] The user IP classification module categorizes user IPs with the same sequential structure.

[0027] The anomaly warning module continuously monitors the execution sequence structure of user IP tasks. When the sequence structure changes, it issues an anomaly warning for user IP-related anomalies.

[0028] Another object of the present invention is to provide a computer device, the computer device including a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, causing the processor to perform the steps of the police equipment user profiling and abnormal behavior detection method.

[0029] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the described method for user profiling of police equipment and detection of abnormal behavior.

[0030] Another objective of this invention is to provide an information data processing terminal, which includes the aforementioned police equipment user profiling and abnormal behavior detection system.

[0031] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0032] First, this invention, based on data mining technology, realizes user profiling of police equipment and detection of abnormal behavior, thus ensuring user security management for police departments.

[0033] Second, the expected benefits and commercial value of the technical solution of the present invention after transformation are as follows: The technical solution of the present invention can be widely applied to the user management of police equipment such as drones and unmanned vehicles, significantly improving the accuracy and efficiency of police equipment user management and enhancing the effectiveness of police equipment use.

[0034] The technical solution of this invention fills a technological gap in the industry both domestically and internationally: the technical solution of this invention fills a technological gap in which police equipment users are classified by analyzing the task execution sequence structure of police equipment users based on data mining technology, and then the abnormal behavior of police equipment users is warned by monitoring the task execution sequence structure of police equipment users.

[0035] The technical solution of this invention solves a technical problem that people have long desired to solve but have never been able to achieve: the technical solution of this invention significantly reduces the computational complexity of mining the task execution order structure of police equipment users by designing a preprocessing method for police equipment log database, thus enabling the classification of police equipment user classes based on the task execution order structure.

[0036] The technical solution of this invention overcomes technical bias: the technical solution of this invention overcomes the limitation of thinking that the task execution sequence structure of police equipment users is highly computationally complex, and realizes the construction of police equipment user classes and the detection of abnormal behavior based on data mining.

[0037] Third, the technical solution of this invention solves the following key problems in the prior art in industrial applications and brings about significant technological progress:

[0038] 1. Solve the problem of abnormal behavior detection in existing technologies.

[0039] In the use of police equipment, traditional user behavior monitoring and anomaly detection mainly rely on simple rule matching or static behavior patterns, which are difficult to adapt to complex and ever-changing user operations. Especially in high-risk operations and environments with frequent task switching, anomaly detection is often inaccurate. This invention, through user IP-based behavior sequence analysis combined with the Apriori algorithm to mine the structure of users' frequent task execution sequences, can dynamically construct user behavior profiles, effectively improving the accuracy and timeliness of anomaly detection, thereby overcoming the shortcomings of existing technologies in detecting complex behavior patterns.

[0040] 2. Improve the real-time performance and accuracy of anomaly warnings.

[0041] Existing systems often struggle to detect changes in behavioral patterns in a timely manner, and abnormal behavior may pose a threat to system security before it is identified. This invention addresses this by structuring and continuously monitoring user behavior sequences. Once an abnormal fluctuation in the behavior sequence occurs, an alert is triggered, effectively improving the real-time performance and accuracy of anomaly warnings. This makes the monitoring and management of police equipment more intelligent and agile. This feature is of great significance for industrial applications requiring real-time system security assurance, reducing security risks caused by delayed detection.

[0042] 3. Achieve automation of behavior analysis and high efficiency in pattern recognition.

[0043] Traditional methods rely heavily on manual judgment or static rules for behavioral analysis and anomaly identification, resulting in low efficiency and susceptibility to subjective factors. This invention introduces the Apriori algorithm for frequent item mining, enabling the system to automatically identify and summarize frequently performed task structures and classify typical user group behavior patterns. Through automated and efficient behavioral analysis and pattern recognition, the system can quickly adapt to changes in user behavior, reduce the need for manual intervention, and improve the efficiency and reliability of analysis in industrial applications.

[0044] 4. Effectively reduces false alarm rate and maintenance costs.

[0045] Traditional anomaly detection methods typically have high false alarm rates, requiring significant manpower for secondary screening and judgment, thus increasing system maintenance costs. This invention, by combining user profiling and behavioral feature extraction, can accurately distinguish between normal and abnormal behavior, significantly reducing the false alarm rate and consequently decreasing system maintenance workload and manpower costs. This advantage is particularly pronounced in high-frequency police equipment environments, ensuring the long-term stable operation of the system.

[0046] 5. Significantly improve the level of intelligence in police equipment management.

[0047] This invention combines user behavior data, frequent item mining algorithms, and anomaly monitoring strategies to achieve intelligent user behavior monitoring and anomaly detection processes, significantly improving the intelligence level of police equipment management. The system can automatically learn and update user behavior profiles and adjust according to actual changes, giving it adaptive and dynamic adjustment capabilities. This intelligent management model not only enhances the user experience but also provides strong support for the efficient and secure management of police equipment.

[0048] This invention not only solves the problems of accuracy, real-time performance, and false alarm rate in traditional anomaly detection in industrial applications, but also significantly improves the intelligence and automation level of police equipment management, providing reliable and efficient technical support for application environments with high risk and high security requirements. This technical solution can be applied to various user behavior monitoring scenarios, possessing broad promotional value and significant technological advancements. Attached Figure Description

[0049] Figure 1 This is a flowchart of the user profiling and abnormal behavior detection method for police equipment provided in this embodiment of the invention;

[0050] Figure 2 This is a structural diagram of the police equipment user profiling and abnormal behavior detection system provided in this embodiment of the invention;

[0051] Figure 3This is a diagram of the main page for constructing the user IP class for entering police equipment, provided in an embodiment of the present invention.

[0052] Figure 4 This is a screenshot of the main page for detecting abnormal user IP addresses when entering police equipment, provided in an embodiment of the present invention. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0054] like Figure 1 As shown, this embodiment of the invention provides a user profile for police equipment and a scheme for detecting abnormal behavior, specifically including the following steps:

[0055] S101, The system reads data from the police equipment log database.

[0056] S102. Group the police equipment log data by user IP.

[0057] S103. Regroup each user's IP data on a daily basis.

[0058] S104. Intraday data is divided into time periods at equal intervals, and a string dataset is constructed by combining the time periods and the ascending sequence of task execution numbers.

[0059] S105. Use the Apriori algorithm to perform frequent item mining on any user IP to obtain the sequential structure of the frequently executed task numbers of the user IP.

[0060] S106. Classify user IPs with the same sequential structure.

[0061] S107. Continuously monitor the execution sequence structure of user IP tasks, and issue a warning for user IP-related anomalies when the sequence structure changes.

[0062] The user profiling and abnormal behavior detection scheme for police equipment of the present invention achieves continuous monitoring and abnormal detection of user behavior of police equipment through data analysis and mining algorithms. The specific principle is as follows:

[0063] First, in step S101, the system reads relevant data from the police equipment log database, including user access records, task execution status, and other log information. This data provides the foundation for subsequent analysis of user behavior, ensuring the accuracy of user profiling and anomaly detection.

[0064] Next, in step S102, the system groups the log data based on the user's IP address, so that the behavior records of each user IP can be independently divided to form the usage behavior trajectory data of a single user. This step helps in subsequent analysis of the unique behavioral characteristics of each user, thus providing a reference for anomaly detection.

[0065] In step S103, the system further groups the data for each user IP address by day, clearly presenting the daily behavioral sequence of each IP address. This captures daily behavioral patterns, supporting the construction of user profiles and the periodic analysis of behavior.

[0066] Next, in step S104, the system divides the daily data into several time periods at equal intervals and constructs a string dataset in ascending order of time period and task execution number. This structured string dataset can describe the order and frequency of each user's operations throughout the day, laying the foundation for identifying frequent behavioral patterns.

[0067] In step S105, the system uses the Apriori algorithm to perform frequent item mining on the string dataset of any user IP, identifying the sequential structure of frequently executed task numbers. Through this frequent item mining, the system can extract feature patterns of user behavior and generate a behavioral profile of the user IP.

[0068] Next, in step S106, the system categorizes user IPs with the same task execution sequence structure to construct typical behavioral characteristics of user groups. For users with similar operation sequences, the system can perform similar behavior analysis, improving the reliability of anomaly detection.

[0069] Finally, in step S107, the system continuously monitors the task execution sequence structure of the user IP. When abnormal changes occur in the sequence structure, the system issues an alert for user IP anomalies. This alert function can quickly detect deviations in user behavior, providing support for timely responses to anomalies and thus improving the security and management efficiency of police equipment.

[0070] The steps S101 to S107 described above will be described in detail below.

[0071] Regarding step S101, the system reads data from the police equipment log database. Specifically, the log data includes basic fields such as <user IP, device ID, recording time, and task execution number>, and is stored in a MySQL database.

[0072] Regarding step S102, the police equipment log data is grouped by user IP, specifically, the log data in MySQL is grouped by the user IP field.

[0073] Regarding step S103, each user IP data is further grouped on a daily basis. Specifically, within each group grouped by the user IP field, the data is grouped a second time on a daily basis.

[0074] Regarding step S104, the daily data is divided into time periods at equal intervals, and a string dataset is constructed by combining the time periods and the ascending sequence of task execution numbers. Specifically, the data groups after the second grouping are divided into segments at equal time intervals. In this embodiment, the daily data is divided into segments at five-minute intervals. The task execution numbers of all log data entries within five minutes are extracted and arranged in ascending order. The hours, minutes, and seconds of the time periods are concatenated with the ascending sequence of task numbers to obtain a string set.

[0075] The string concatenation, such as log data:

[0076] [1,2024-09-0115:00:00,192.168.1.1,101]

[0077] [1,2024-09-0115:00:00,192.168.1.1,102]

[0078] Take the task number ascending sequence [101, 102], take the time period 15:00:00-15:05:00, and get the concatenated string 15:00:00||101||102. For a single user, get the concatenated string two-dimensional array IPstr, which serves as the transaction database for the Apriori algorithm.

[0079] Regarding step S105, the Apriori algorithm is used to perform frequent item mining on any user IP to obtain the sequential structure of frequently executed task numbers of the user IP. Specifically, the two-dimensional data IPstr is used as a transaction database. [i] As a transaction, IPstr [i][j] As a transaction item, set the support threshold. threshold Construct frequent 1-itemsets. When the following conditions are met:

[0080] Support(X,Y)≥support threshold ;

[0081]

[0082] It is considered a frequent item. Where X and Y are transaction items, number(XY) is the frequency of (X,Y) occurrence, and number(AllSamples) is the number of transactions.

[0083] Furthermore, candidate 2-itemsets C2 are generated from frequent 1-itemsets such as L1 = {A, B, C}, where C2 is generated by permutations and combinations of L1, and C2 = {(A, B), (A, C), (B, C)}. The construction rule is to start from L1... k Select each pair of frequent k-itemsets. If these two frequent k-itemsets have (k-1) items in common, i.e., they share the first (k-1) items, then these two itemsets can be merged into a candidate (k+1)-itemset, and so on, generating more candidate (k+1)-itemsets. Solve L recursively. k+1 This continues until the frequent itemset is empty, forming a two-dimensional array Seqstr, which represents the sequence of frequently executed task numbers by the user's IP address, as shown below.

[0084] [[12:00:00||101||102,15:00:00||101||102],[11:00:00||101||102,12:00:00||10||12,

[0085] 13:00:00||11||12]]

[0086] Regarding step S106, classify user IPs with the same sequential structure. Specifically, if multiple user IPs have the same sequential structure Seqstr item, then these multiple IPs are regarded as the same type of user, thus completing the user class division.

[0087] Regarding step S107, continuously monitor the user IP task execution sequence structure, and issue a user IP-related anomaly warning when the sequence structure changes. Specifically, as the police equipment operates and the police equipment log database is continuously updated, by constantly mining the user IP task execution sequence structure, a user IP-related anomaly warning is issued when the user IP sequence structure changes.

[0088] Based on data mining technology, this invention realizes user profiling of police equipment and detection of abnormal behavior, thus ensuring user security management for police departments.

[0089] like Figure 2 As shown, the police equipment user profiling and abnormal behavior detection system includes:

[0090] The data reading module reads data from the police equipment log database.

[0091] The data grouping module groups police equipment log data by user IP address;

[0092] The data regrouping module regroups each user's IP data on a daily basis.

[0093] The time period segmentation module divides the intraday data into time periods at equal intervals, and constructs a string dataset by combining the time periods and the ascending sequence of task execution numbers.

[0094] The frequent item mining module uses the Apriori algorithm to perform frequent item mining on any user IP to obtain the sequential structure of the frequently executed task numbers of the user IP;

[0095] The user IP classification module categorizes user IPs with the same sequential structure.

[0096] The anomaly warning module continuously monitors the execution sequence structure of user IP tasks. When the sequence structure changes, it issues an anomaly warning for user IP-related anomalies.

[0097] An application embodiment of the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of a method for creating a user profile for a police device and detecting abnormal behavior.

[0098] An application embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of a method for profiling a police device user profile and detecting abnormal behavior.

[0099] An application embodiment of the present invention provides an information data processing terminal, which includes a police equipment user profile and behavior anomaly detection system.

[0100] This invention can be applied to the potential value mining of police equipment log databases in police departments during large-scale events. By analyzing the task execution sequence structure of police equipment user IPs, user IP classes with the same task execution sequence structure are constructed. As the police equipment log database is continuously updated, the task execution sequence structure of the same police equipment user IP class is monitored, and abnormal police equipment user IP classes are given early warning.

[0101] The following is the software simulation effect of the present invention: Entering the main page for constructing the user IP class of the police equipment, as shown in the appendix of the instruction manual. Figure 3 As shown, by selecting the start and end times, you can select the police equipment log database to be analyzed, select the set of police equipment to be analyzed, and click query to obtain the user IP class and corresponding user IP members constructed based on the task execution order structure of the police equipment user IPs.

[0102] Access the main page for detecting abnormal IP addresses of police equipment users, as shown in the instruction manual. Figure 4As shown, select the start and end times, select the updated police equipment log database, and click query. This will detect the task execution order structure of police equipment user IP classes and issue warnings for abnormal police equipment user IP classes when the task execution order structure of police equipment user IP classes changes.

[0103] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0104] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A user profiling method for police equipment and a method for detecting abnormal behavior, characterized in that, include: S1. The system reads data from the police equipment log database; S2. Group police equipment log data by user IP; S3. Regroup each user's IP data on a daily basis; S4. Intraday data is divided into time periods at equal intervals, and a string dataset is constructed by combining the time periods and the ascending sequence of task execution numbers. S5. Use the Apriori algorithm to perform frequent item mining on any user IP to obtain the sequential structure of the frequently executed task numbers of the user IP. S6. Classify user IPs with the same sequential structure; S7. Continuously monitor the execution sequence structure of user IP tasks, and issue an alert for user IP-related anomalies when the sequence structure changes. In S1, the system reads data from the police equipment log database. The log data contains basic fields such as <user IP, device ID, recording time, and task execution number>, and is stored in a MySQL database. In S2, police equipment log data is grouped by user IP, and MySQL log data is grouped by user IP field; In S3, each user IP data is further grouped on a daily basis. Within each group grouped by the user IP field, the data is further grouped on a daily basis. In S4, the intraday data is divided into time periods at equal intervals. The time periods and the task execution numbers are arranged in ascending order to form a string dataset. The task execution number is the number corresponding to the task being performed by the user IP using the police equipment. Within a time period of the day, the user IP may have multiple tasks. The task execution numbers of the multiple tasks are arranged in ascending order and concatenated with the time period's hour, minute, and second to form a string. The strings of multiple time periods within a day constitute a one-dimensional string array, and the multi-day data of the user IP constitutes a two-dimensional string array, i.e., the string dataset.

2. The user profiling method for police equipment and its abnormal behavior detection method as described in claim 1, characterized in that, S5 uses the Apriori algorithm to perform frequent item mining on any user IP string dataset to obtain the sequential structure of frequently executed task numbers of user IPs. The sequential structure of frequently executed task numbers of user IPs consists of multiple frequent strings that appear on a single day in the user IP string dataset.

3. The user profiling method for police equipment and its abnormal behavior detection method as described in claim 1, characterized in that, In S6, user IPs with the same sequential structure are categorized. Specifically, if multiple user IPs have the same Seqstr sequential structure, then these multiple user IPs are regarded as the same type of user, thus completing the user class division.

4. The user profiling and abnormal behavior detection method for police equipment as described in claim 1, characterized in that, S7 continuously monitors the user IP task execution sequence structure. When the sequence structure changes, it issues a user IP-related anomaly warning. Specifically, as the police equipment operates and the police equipment log database is continuously updated, it continuously mines the user IP task execution sequence structure. When the user IP sequence structure changes, it issues a user IP-related anomaly warning.

5. A system for profiling and detecting abnormal behavior of police equipment users as described in any one of claims 1 to 4, characterized in that, include: The data reading module reads data from the police equipment log database. The data grouping module groups police equipment log data by user IP address; The data regrouping module regroups each user's IP data on a daily basis. The time period segmentation module divides intraday data into time periods at equal intervals, and constructs a string dataset by combining the time periods and the ascending sequence of task execution numbers. The frequent item mining module uses the Apriori algorithm to perform frequent item mining on any user IP to obtain the sequential structure of the frequently executed task numbers of the user IP; The user IP classification module categorizes user IPs with the same sequential structure. The anomaly warning module continuously monitors the execution sequence structure of user IP tasks. When the sequence structure changes, it issues an anomaly warning for user IP-related anomalies.

6. A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the police equipment user profiling and abnormal behavior detection method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor performs the steps of the police equipment user profiling and abnormal behavior detection method as described in any one of claims 1 to 4.

8. An information data processing terminal, comprising the police equipment user profiling and abnormal behavior detection system as described in claim 5.

Images