Internet of Things intelligent security data system

Abstract

The invention, which relates to the technical field of data management, discloses an Internet-of-Things intelligent security data system comprising a data acquisition module for acquiring field data based on a sensor and a camera; the data transmission module is used for transmitting the acquired data through a network; the data analysis module is used for identifying and pre-warning potential security threats based on a clustering analysis algorithm, and carrying out danger coefficient scoring on the potential security threats; the alarm level identification module is used for dynamically adjusting the alarm level based on the risk coefficient score; and the alarm information pushing module is used for automatically triggering linkage equipment according to different alarm levels and situations and pushing the alarm information. Through sensor data acquisition, edge calculation, clustering analysis, danger coefficient scoring and other technical means, the prediction capability, response speed and processing efficiency of the security event are effectively improved, and through automatic linkage equipment and an intelligent alarm mechanism, it is ensured that the security event is responded and processed in time.

Description

Technical Field

[0001] The present invention relates to the technical field of data management, and in particular to an Internet of Things smart security data system. Background Art

[0002] With the rapid development of information technology and the Internet of Things, intelligent security systems have played an important role in ensuring public safety, corporate safety and family safety. Traditional security systems mainly rely on manual monitoring and simple alarm devices, but these systems have problems such as slow response speed, poor real-time performance and limited information processing capabilities. They are unable to cope with increasingly complex security threats. The Internet of Things smart security system uses sensors, cameras and network communication technology to monitor environmental changes in real time, perceive potential security threats, and perform data analysis and processing. Especially in terms of intelligent applications, with the help of data analysis and edge computing, the system can identify and predict possible security incidents in advance, thereby improving prevention capabilities.

[0003] Traditional security systems usually rely on manual monitoring and processing of data, cannot respond quickly to emergencies, lack intelligent data analysis and automated response methods, and are prone to delays, false alarms and other problems. Therefore, smart security systems based on big data, artificial intelligence and machine learning have emerged. They provide more accurate and efficient security protection through real-time collection and analysis of on-site sensor and camera data, combined with intelligent decision-making and linkage mechanisms. Summary of the invention

[0004] In order to solve the above technical problems, an Internet of Things smart security data system is provided, and this technical solution solves the above problems.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0006] An Internet of Things smart security data system, comprising:

[0007] Data acquisition module: The data acquisition module is used to acquire on-site data based on sensors and cameras;

[0008] Data transmission module: The data transmission module is electrically connected to the data acquisition module, and is used to transmit the collected data through the network, perform edge computing on the data, and store the data;

[0009] Data analysis module: The data analysis module is electrically connected to the data transmission module, and is used to identify and warn potential security threats based on a cluster analysis algorithm, and to score the potential security threats for risk factors;

[0010] Alarm level recognition module: The alarm level recognition module is electrically connected to the data analysis module, and the alarm level recognition module is used to dynamically adjust the alarm level based on the risk factor score;

[0011] Alarm information push module: The alarm information push module is electrically connected to the alarm level identification module. The alarm information push module is used to automatically trigger the linkage device and push the alarm information according to different alarm levels and situations.

[0012] Preferably, the data acquisition module specifically includes:

[0013] Sensor data acquisition unit: collects changes in the surrounding environment in real time based on sensors, the sensors include:

[0014] Environmental monitoring sensors: including temperature, humidity, gas concentration and smoke, to collect changes in the surrounding environment in real time;

[0015] Motion sensor: detects the movement of objects and people;

[0016] Sound sensor: used to capture abnormal sounds, including broken windows and abnormal noises;

[0017] Door and window switch sensor: monitor whether the doors and windows are opened illegally;

[0018] Vibration sensor: used to detect abnormal vibrations of the ground and objects to determine whether there is intrusion;

[0019] Camera data acquisition unit: Based on the infrared night vision camera, it captures the video images of the scene in real time, and performs real-time face recognition to verify the identity through image acquisition;

[0020] Data fusion and preprocessing unit: combines multi-source data from different sensors and cameras, formats them uniformly, performs preliminary filtering and denoising, and synchronizes the data collected by sensors and cameras.

[0021] Preferably, the data transmission module specifically includes:

[0022] Network transmission unit: transmits the processed data to the cloud through the network;

[0023] Data segmentation unit: divides the collected big data into small data packets and reduces the data transmission volume through compression technology;

[0024] Edge computing unit: performs edge computing on data, and the data is transmitted through the HTTP network protocol. The edge computing formula is:

[0025]

[0026] In the formula, D is the data integrated from multiple data sources, D i is the data from the ith data source, n is the number of data sources, σ is the standard deviation of the data, n is the total number of data points in the data set, and D i The i-th data point in the data set, μ is the mean of the data set;

[0027] Data storage unit: sends data packets to the target device and stores the processed data in the cloud.

[0028] Preferably, the data analysis module specifically includes:

[0029] Feature extraction unit: acquires real-time data and extracts features related to security threats from raw data, including user activities, access patterns, system calls, and file operations;

[0030] Abnormal identification unit: Uses cluster analysis algorithms to identify abnormal behaviors and compares them with real-time data to detect abnormal behaviors that deviate from the baseline.

[0031] Threat classification unit: Identify potential security threats based on the results of behavioral analysis and classify threats according to the type and degree of danger of the behavior;

[0032] Hazard factor calculation unit: Calculates the risk factor score based on the risk factor scoring formula, and triggers an early warning based on the risk factor and the risk score.

[0033] Preferably, the method of identifying whether abnormal behavior exists by using a cluster analysis algorithm and comparing it with real-time data to detect abnormal behavior that deviates from the baseline specifically includes:

[0034] Collect real-time data and compare with baseline models;

[0035] Take the standard deviation as the benchmark and set 3 times the standard deviation as the deviation threshold. If the real-time data exceeds this range, it is considered abnormal behavior.

[0036] By clustering the real-time data with the baseline data, outliers are found, which are abnormal behaviors;

[0037] The clustering formula is:

[0038]

[0039] In the formula, LOF(x i ) is the local outlier factor of the i-th data point in the data set, N k (x i ) represents the data point x i k-neighborhood, lrd(x i ) represents the data point x iThe local reachable density, lrd(x j ) is the data point x j The local reachable density of .

[0040] Preferably, identifying potential security threats based on the results of cluster analysis and classifying the threats according to the type and degree of danger of the behavior specifically includes:

[0041] Obtain the results of cluster analysis and predict the potential security threats of outliers. The prediction formula is:

[0042]

[0043] In the formula, R(x i ) is the data point x i The threat score of i ,C k ) is the data point x i To cluster C k The distance, S(x i ) is a security score based on other features of the data point, and f is a comprehensive function that combines the distance to the outlier and other features to output a threat score.

[0044] Preferably, the step of calculating the risk factor score based on the risk factor score formula specifically includes:

[0045] The risk factor scoring formula is:

[0046] F=W P ×P+W L ×L+W C ×(1-C)+W R ×R

[0047] Where F is the risk factor score, P is the probability score of the event, and W P is the weight coefficient of the probability score of the event, L is the loss degree score of the event, and W L is the weight coefficient of the loss degree score of the event, C is the effectiveness score of the control measures, and W C is the weight coefficient of the effectiveness score of the control measure, R is the threat score, and W C is the weight coefficient of the threat score.

[0048] Preferably, the alarm level identification module specifically includes:

[0049] Danger factor score acquisition unit: obtains real-time risk factor score from the data analysis module;

[0050] Alarm level threshold setting unit: defines different risk factor scoring intervals, each interval corresponds to a different alarm level, including:

[0051] Low risk (score: 0-3): indicates low risk, low alarm level, no immediate action required;

[0052] Medium risk (score: 3-7): indicates medium risk, medium alert level, requiring attention and preventive measures;

[0053] High risk (score: 7-10): indicates a high risk, a high alarm level, and requires immediate processing and emergency measures;

[0054] Dynamic threshold adjustment unit: Set up a dynamic adjustment mechanism so that the alarm level threshold changes with changes in the external environment, system status and events;

[0055] Alarm level classification unit: Based on the acquired risk factor score, the alarm level identification module dynamically divides the alarm level according to the preset risk factor score interval;

[0056] include:

[0057] Score ≤3: Alarm level = low, triggering a mild warning;

[0058] 3<score≤7: Alarm level = medium, triggering a medium warning;

[0059] Score > 7: Alarm level = high, triggering a high-intensity warning;

[0060] The alarm level recognition module compares the risk factor scores and determines the corresponding alarm level according to the size of the scores;

[0061] Alarm level trigger mechanism unit: When the risk factor score exceeds the set threshold range, the alarm level identification module will trigger the corresponding alarm response measures.

[0062] Preferably, the alarm response measures include:

[0063] Low-level alarm: Displays warning information to prompt relevant personnel to monitor;

[0064] Medium-level alarm: Send notifications and emails to request relevant departments to take preventive measures;

[0065] High-level alarm: Automatically initiate emergency procedures, notify relevant personnel to take immediate measures, and automatically shut down related equipment and cut off dangerous sources.

[0066] Preferably, the alarm information push module specifically includes: receiving alarm level data and determining the push method according to the level and situation, selecting the push target, triggering linkage equipment, including automatic control systems and emergency response equipment, pushing alarm information in real time, and ensuring the accuracy of information transmission.

[0067] Compared with the prior art, the present invention has the following beneficial effects:

[0068] The present invention proposes to effectively improve the prediction ability, response speed and processing efficiency of security incidents through technical means such as sensor data collection, edge computing, cluster analysis and hazard factor scoring. Compared with traditional security systems, this system can more accurately identify and prevent potential security threats, and through automated linkage equipment and intelligent alarm mechanisms, ensure timely response and processing of security incidents, thereby providing users with safer and more reliable security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 It is a system framework diagram of the present invention;

[0070] Figure 2 It is a system framework diagram of the data acquisition module in the present invention;

[0071] Figure 3 It is a system framework diagram of the data transmission module in the present invention;

[0072] Figure 4 This is a system framework diagram of the data analysis module in the present invention;

[0073] Figure 5 This is a system framework diagram of the alarm level identification module in the present invention. DETAILED DESCRIPTION

[0074] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0075] Reference Figure 1 As shown, an IoT smart security data system includes:

[0076] Data acquisition module:

[0077] Sensor data acquisition unit: collects changes in the surrounding environment in real time based on sensors, the sensors include:

[0078] Environmental monitoring sensors: including temperature, humidity, gas concentration and smoke, to collect changes in the surrounding environment in real time;

[0079] Motion sensor: detects the movement of objects and people;

[0080] Sound sensor: used to capture abnormal sounds, including broken windows and abnormal noises;

[0081] Door and window switch sensor: monitor whether the doors and windows are opened illegally;

[0082] Vibration sensor: used to detect abnormal vibrations of the ground and objects to determine whether there is intrusion;

[0083] Camera data acquisition unit: Based on the infrared night vision camera, it captures the video images of the scene in real time, and performs real-time face recognition to verify the identity through image acquisition;

[0084] Data fusion and preprocessing unit: combines multi-source data from different sensors and cameras, formats them uniformly, performs preliminary filtering and denoising, and synchronizes the data collected by sensors and cameras.

[0085] Data transmission module:

[0086] Network transmission unit: transmits the processed data to the cloud through the network;

[0087] Data segmentation unit: divides the collected big data into small data packets and reduces the data transmission volume through compression technology;

[0088] Edge computing unit: performs edge computing on data, and the data is transmitted through the HTTP network protocol. The edge computing formula is:

[0089]

[0090] In the formula, D is the data integrated from multiple data sources, D i is the data from the ith data source, n is the number of data sources, σ is the standard deviation of the data, n is the total number of data points in the data set, and D i The i-th data point in the data set, μ is the mean of the data set;

[0091] Data storage unit: sends data packets to the target device and stores the processed data in the cloud.

[0092] Data Analysis Module:

[0093] Feature extraction unit: acquires real-time data and extracts features related to security threats from raw data, including user activities, access patterns, system calls, and file operations;

[0094] Abnormal identification unit: Uses cluster analysis algorithms to identify abnormal behaviors and compares them with real-time data to detect abnormal behaviors that deviate from the baseline.

[0095] Collect real-time data and compare with baseline models;

[0096] Take the standard deviation as the benchmark and set 3 times the standard deviation as the deviation threshold. If the real-time data exceeds this range, it is considered abnormal behavior.

[0097] By clustering the real-time data with the baseline data, outliers are found, which are abnormal behaviors;

[0098] The clustering formula is:

[0099]

[0100] In the formula, LOF(x i ) is the local outlier factor of the i-th data point in the data set, N k (x i ) represents the data point x i k-neighborhood, lrd(x i ) represents the data point x i The local reachable density, lrd(x j ) is the data point x j The local reachable density of

[0101] Threat classification unit: Identify potential security threats based on the results of behavioral analysis and classify threats according to the type and degree of danger of the behavior;

[0102] Obtain the results of cluster analysis and predict the potential security threats of outliers. The prediction formula is:

[0103]

[0104] In the formula, R(x i 0 is the data point x i The threat score of i ,C k 0 is the data point x i To cluster C k The distance, S(x i It is a security score based on other features of the data point. f is a comprehensive function that combines the distance of the outlier and other features to output a threat score.

[0105] Risk factor calculation unit: calculates the risk factor score based on the risk factor scoring formula, and triggers an early warning based on the risk factor and the risk score;

[0106] The risk factor scoring formula is:

[0107] F=W P ×P+W L ×L+W C ×(1-C)+W R ×R

[0108] Where F is the risk factor score, P is the probability score of the event, and W P is the weight coefficient of the probability score of the event, L is the loss degree score of the event, and WL is the weight coefficient of the loss degree score of the event, C is the effectiveness score of the control measures, and W C is the weight coefficient of the effectiveness score of the control measure, R is the threat score, and W C is the weight coefficient of the threat score.

[0109] Alarm level identification module:

[0110] Danger factor score acquisition unit: obtains real-time risk factor score from the data analysis module;

[0111] Alarm level threshold setting unit: defines different risk factor scoring intervals, each interval corresponds to a different alarm level, including:

[0112] Low risk (score: 0-3): indicates low risk, low alarm level, no immediate action required;

[0113] Medium risk (score: 3-7): indicates medium risk, medium alert level, requiring attention and preventive measures;

[0114] High risk (score: 7-10): indicates a high risk, a high alarm level, and requires immediate processing and emergency measures;

[0115] Dynamic threshold adjustment unit: Set up a dynamic adjustment mechanism so that the alarm level threshold changes with changes in the external environment, system status and events;

[0116] Alarm level classification unit: Based on the acquired risk factor score, the alarm level identification module dynamically divides the alarm level according to the preset risk factor score interval;

[0117] include:

[0118] Score ≤3: Alarm level = low, triggering a mild warning;

[0119] 3<score≤7: Alarm level = medium, triggering a medium warning;

[0120] Score > 7: Alarm level = high, triggering a high-intensity warning;

[0121] The alarm level recognition module compares the risk factor scores and determines the corresponding alarm level according to the size of the scores;

[0122] Alarm level trigger mechanism unit: When the risk factor score exceeds the set threshold range, the alarm level identification module will trigger the corresponding alarm response measures, including:

[0123] Low-level alarm: Displays warning information to prompt relevant personnel to monitor;

[0124] Medium-level alarm: Send notifications and emails to request relevant departments to take preventive measures;

[0125] High-level alarm: Automatically start the emergency procedure, notify relevant personnel to take immediate measures, and automatically shut down related equipment and cut off the source of danger;

[0126] Alarm information push module:

[0127] Receive alarm level data and determine the push method based on the level and situation, select the push target, trigger linkage equipment, including automated control systems and emergency response equipment, push alarm information in real time, and ensure the accuracy of information transmission.

[0128] In summary, the advantages of the present invention are:

[0129] The system collects on-site data in real time through sensors and cameras, and performs preliminary processing with the help of edge computing, and can efficiently transmit the data to the cloud for further analysis. This design greatly improves the real-time nature and processing efficiency of data, can identify potential security threats in a timely manner, and reduce the response time to incidents;

[0130] The cluster analysis algorithm is used to conduct in-depth data mining, which can identify potential abnormal behaviors and conduct risk assessment. By comparing with baseline data, the system can effectively detect abnormal points that deviate from normal behavior, thereby warning of potential security threats in advance and avoiding the occurrence of security incidents.

[0131] Based on the risk factor score, different threat types are scored, and the alarm level is dynamically adjusted according to the score, so that the system can make a more intelligent response according to the actual situation;

[0132] The alarm level recognition module of the present invention dynamically adjusts the alarm level based on the risk factor score, so that the system can make corresponding processing decisions according to different risk scenarios. Low-risk situations can be handled by mild warnings, while high-risk situations will trigger emergency response measures;

[0133] The system can automatically trigger linkage equipment, such as automated control systems and emergency response equipment. For example, in high-risk situations, the system will automatically start emergency procedures, cut off the source of danger and notify relevant personnel to take action. This automated linkage mechanism greatly improves response speed and emergency handling capabilities, and reduces reliance on manual intervention;

[0134] The system integrates data from multiple sensors and cameras, and performs data preprocessing and denoising to ensure data quality and accuracy. Through feature extraction and abnormal behavior recognition, it can quickly identify potential safety hazards in massive data and reduce the possibility of false positives and false negatives.

[0135] Cluster analysis can not only help the system identify abnormal behaviors, but also predict threats to outliers and classify them according to threat scores, providing an accurate basis for subsequent alarms and emergency responses;

[0136] The system adopts a modular design and can be flexibly expanded according to actual needs. More sensors can be added according to different environmental requirements, or different camera and sensor combinations can be applied in different monitoring scenarios. The scalability of the system enables it to adapt to various scenarios and needs.

[0137] Through cloud data storage and processing, the system can use the powerful processing capabilities of cloud computing to perform large-scale data analysis, which not only ensures data security, but also enables in-depth mining and pattern recognition of historical data, further improving the system's prediction accuracy and decision-making capabilities;

[0138] The system can ensure rapid response and effective prevention of security incidents through intelligent analysis and real-time monitoring. Whether it is fire, intrusion or equipment failure, the system can provide real-time early warning, automated processing and alarm information push, providing users with all-round security protection.

[0139] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. An IoT smart security data system, characterized in that: include: Data acquisition module: The data acquisition module is used to acquire on-site data based on sensors and cameras; Data transmission module: The data transmission module is electrically connected to the data acquisition module, and is used to transmit the collected data through the network, perform edge computing on the data, and store the data; Data analysis module: The data analysis module is electrically connected to the data transmission module, and is used to identify and warn potential security threats based on a cluster analysis algorithm, and to score the potential security threats for risk factors; Alarm level recognition module: The alarm level recognition module is electrically connected to the data analysis module, and the alarm level recognition module is used to dynamically adjust the alarm level based on the risk factor score; Alarm information push module: The alarm information push module is electrically connected to the alarm level identification module. The alarm information push module is used to automatically trigger the linkage device and push the alarm information according to different alarm levels and situations.

2. The IoT smart security data system according to claim 1, characterized in that: The data acquisition module specifically includes: Sensor data acquisition unit: collects changes in the surrounding environment in real time based on sensors, including environmental monitoring sensors, motion sensors, sound sensors, door and window switch sensors, and vibration sensors; Camera data acquisition unit: Based on the infrared night vision camera, it captures the video images of the scene in real time, and performs real-time face recognition to verify the identity through image acquisition; Data fusion and preprocessing unit: combines multi-source data from different sensors and cameras, formats them uniformly, performs preliminary filtering and denoising, and synchronizes the data collected by sensors and cameras.

3. The IoT smart security data system according to claim 2, characterized in that: The data transmission module specifically includes: Network transmission unit: transmits the processed data to the cloud through the network; Data segmentation unit: divides the collected big data into small data packets and reduces the data transmission volume through compression technology; Edge computing unit: performs edge computing on data, and the data is transmitted through the HTTP network protocol. The edge computing formula is: In the formula, D is the data integrated from multiple data sources, D i is the data from the ith data source, n is the number of data sources, σ is the standard deviation of the data, n is the total number of data points in the data set, and D i The i-th data point in the data set, μ is the mean of the data set; Data storage unit: sends data packets to the target device and stores the processed data in the cloud.

4. The IoT smart security data system according to claim 3 is characterized in that: The data analysis module specifically includes: Feature extraction unit: acquires real-time data and extracts features related to security threats from raw data, including user activities, access patterns, system calls, and file operations; Abnormal identification unit: Uses cluster analysis algorithms to identify abnormal behaviors and compares them with real-time data to detect abnormal behaviors that deviate from the baseline. Threat classification unit: Identify potential security threats based on the results of behavioral analysis and classify threats according to the type and degree of danger of the behavior; Hazard factor calculation unit: Calculates the risk factor score based on the risk factor scoring formula, and triggers an early warning based on the risk factor and the risk score.

5. The IoT smart security data system according to claim 4, characterized in that: The cluster analysis algorithm is used to identify whether there is abnormal behavior, and compare it with real-time data to detect abnormal behavior that deviates from the baseline, specifically including: Collect real-time data and compare with baseline models; Take the standard deviation as the benchmark and set 3 times the standard deviation as the deviation threshold. If the real-time data exceeds this range, it is considered abnormal behavior. By clustering the real-time data with the baseline data, outliers are found, which are abnormal behaviors; The clustering formula is: In the formula, LOF(x i ) is the local outlier factor of the i-th data point in the data set, N k (x i ) represents the data point x i k-neighborhood, lrd(x i ) represents the data point x i The local reachable density, lrd(x j ) is the data point x j The local reachable density of .

6. The IoT smart security data system according to claim 5, characterized in that: According to the results of cluster analysis, potential security threats are identified and classified according to the type and degree of danger of the behavior. Specifically, the threats are: Obtain the results of cluster analysis and predict the potential security threats of outliers. The prediction formula is: R(x i )=f(d(x i ,C k ),S(x i )) In the formula, R(x i ) is the data point x i The threat score of i ,C k ) is the data point x i To cluster C k The distance, S(x i ) is a security score based on other features of the data point, and f is a comprehensive function that combines the distance to the outlier and other features to output a threat score.

7. The IoT smart security data system according to claim 6, characterized in that: The risk factor scoring formula is used to calculate the risk factor scoring. include: The risk factor scoring formula is: F=W P ×P+W L ×L+W C ×(1-C)+W R ×R Where F is the risk factor score, P is the probability score of the event, and W P is the weight coefficient of the probability score of the event, L is the loss degree score of the event, and W L is the weight coefficient of the loss degree score of the event, C is the effectiveness score of the control measures, and W C is the weight coefficient of the effectiveness score of the control measure, R is the threat score, and W C is the weight coefficient of the threat score.

8. The IoT smart security data system according to claim 7, characterized in that: The alarm level identification module specifically includes: Danger factor score acquisition unit: obtains real-time risk factor score from the data analysis module; Alarm level threshold setting unit: defines different risk factor scoring intervals, each interval corresponds to a different alarm level; Dynamic threshold adjustment unit: Set up a dynamic adjustment mechanism so that the alarm level threshold changes with changes in the external environment, system status and events; Alarm level classification unit: Based on the acquired risk factor score, the alarm level identification module dynamically divides the alarm level according to the preset risk factor score interval; The alarm level recognition module compares the risk factor scores and determines the corresponding alarm level according to the size of the scores; Alarm level trigger mechanism unit: When the risk factor score exceeds the set threshold range, the alarm level identification module will trigger the corresponding alarm response measures.

9. The IoT smart security data system according to claim 8, characterized in that: The alarm response measures include: Low-level alarm: Displays warning information to prompt relevant personnel to monitor; Medium-level alarm: Send notifications and emails to request relevant departments to take preventive measures; High-level alarm: Automatically initiate emergency procedures, notify relevant personnel to take immediate measures, and automatically shut down related equipment and cut off dangerous sources.

10. The IoT smart security data system according to claim 9, characterized in that: The alarm information push module specifically includes: receiving alarm level data and determining the push method according to the level and situation, selecting the push target, triggering linkage equipment, including automatic control systems and emergency response equipment, pushing alarm information in real time, and ensuring the accuracy of information transmission.

Images