Digital exhibition hall safety management system

Abstract

The invention relates to the technical field of artificial intelligence, in particular to a digital exhibition hall safety management system which comprises an Internet of Things equipment management module, a big data processing and analysis module, an AI safety protection module, a regular inspection and maintenance module and an emergency response and recovery module. The big data processing and analysis module is electrically connected with the Internet of Things equipment management module and the AI safety protection module, and the big data processing and analysis module is electrically connected with the Internet of Things equipment management module and the AI safety protection module. Real-time monitoring, fault early warning, data driving decision making, intelligent protection, active prevention, continuous improvement and quick response and recovery of exhibition hall safety management can be realized, so that the overall safety and reliability of the exhibition hall are remarkably improved, and the quality of digital exhibition hall management is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of artificial intelligence, and in particular relates to a digital exhibition hall security management system. Background Art

[0002] Exhibits in digital exhibition halls may include precious cultural relics, artworks, high-tech products, etc., which have high economic and cultural value. In order to ensure their integrity and security, security management of digital exhibition halls can prevent exhibits from being damaged, stolen or lost.

[0003] At present, the security management method of digital exhibition halls usually uses big data technology and artificial intelligence to process and analyze the large amount of data generated during the operation and maintenance of the exhibition hall, so as to predict possible problems and formulate targeted solutions. At the same time, AI technology is also used to improve the protection and restoration of exhibits.

[0004] However, since the management of digital exhibition halls is highly dependent on technologies such as the Internet of Things, big data, and AI, once these technologies fail or are attacked, it may affect the normal operation and security of the exhibition hall, thereby affecting the quality of digital exhibition hall management. Therefore, we need to propose a digital exhibition hall security management system to solve the above-mentioned problems, so that it can automatically and regularly inspect and maintain technical equipment such as the Internet of Things, big data, and AI to ensure their normal operation. At the same time, it can strengthen the security protection of technology, prevent attacks, and improve the quality of digital exhibition hall management. Summary of the invention

[0005] In view of the above problems, the present invention provides a digital exhibition hall security management system, including: an Internet of Things device management module, which is used for the access, monitoring and maintenance of Internet of Things devices, and can automatically identify and connect various types of Internet of Things devices in the exhibition hall, and monitor the operating status of Internet of Things devices in real time. Once a failure or abnormality of an Internet of Things device is detected, an alarm will be immediately issued, and a maintenance process will be automatically triggered to ensure the normal operation of the Internet of Things device;

[0006] A big data processing and analysis module, which is used to collect, store and analyze the massive data generated in the exhibition hall, identify potential safety hazards, predict IoT equipment failures, and provide a scientific basis for the safety management of the exhibition hall;

[0007] An AI security protection module, which monitors network traffic in real time, identifies malicious attacks, takes corresponding defensive measures, and continuously optimizes its own security protection capabilities to cope with increasingly complex network threats;

[0008] The AI ​​security protection module includes a network traffic collection unit, a feature extraction unit, a model training and detection unit, a threat response and disposal unit, and an optimization and update unit. The network traffic collection unit is used to collect traffic data from the network, and clean, deduplicate and standardize the collected data to establish a traffic data set D; the feature extraction unit is used to select features related to network security threats from the original data collected by the network traffic collection unit, and then further convert the features related to network security threats; the model training and detection unit is used to train the extracted features to form a detection model, and then use the traffic data set to evaluate the performance of the detection model; the threat response and disposal unit identifies potential threats based on the evaluation results of the detection model, and takes corresponding defense measures for the identified threats; the optimization and update unit is used to optimize and adjust the detection model based on new data and threat intelligence to keep the detection model with the latest security protection capabilities;

[0009] A regular inspection and maintenance module, which is used to formulate and implement detailed inspection and maintenance plans, timely discover and solve potential problems through regular maintenance, and improve overall safety and reliability;

[0010] Emergency response and recovery module, which is used to quickly locate the cause of the problem and take corresponding emergency measures when encountering an emergency or safety accident, and quickly restore the normal operation of the system after the accident to minimize the loss;

[0011] The big data processing and analysis module is electrically connected to the Internet of Things device management module and the AI ​​security protection module respectively, and the regular inspection and maintenance module and the emergency response and recovery module are electrically connected to the Internet of Things device management module, the big data processing and analysis module and the AI ​​security protection module respectively.

[0012] Furthermore, the IoT device management module includes a central control unit and an anomaly detection unit. The central control unit is used to automatically scan the IoT devices in the exhibition hall, identify the type, specifications and connection requirements of the IoT devices, and automatically establish a connection; the anomaly detection unit is used to continuously monitor the operating status of the connected devices, detect abnormal behavior or signs of failure of the IoT devices, and once an anomaly is detected, an alarm is immediately issued, and the regular inspection and maintenance module is triggered.

[0013] Furthermore, when scanning the IoT devices in the exhibition hall, the central control unit first collects the MAC address, model and manufacturer information of the IoT devices to identify the type and specifications of the devices and sets the rules or policies for networking. Once the IoT devices are identified, the central control unit automatically configures the network parameters for the IoT devices according to the preset rules or policies. After the configuration is completed, a network connection is established between the central control unit and the IoT devices, and then identity authentication is performed through a shared key or digital certificate. When the identity authentication is successful, the communication between the central control unit and the IoT devices is encrypted to prevent data leakage or tampering.

[0014] Furthermore, the abnormality detection unit includes a sensor component for collecting operation data of the Internet of Things device in real time. The sensor component is electrically connected to the central control unit. The sensor data of temperature, humidity, pressure, current and voltage of the Internet of Things device are collected respectively through the sensor component, and the collected sensor data are transmitted to the central control unit for processing to ensure the stability and reliability of the network. If the Internet of Things device has a connection problem or data transmission is interrupted, the Internet of Things device management module can automatically troubleshoot and try to restore the connection. If the connection is restored successfully, the data between the central control unit and the Internet of Things device is transmitted normally. If the connection is not restored successfully, the regular inspection and maintenance module is triggered to perform inspection and maintenance work, and an alarm is issued at the same time.

[0015] Furthermore, the processing and analysis process of the big data processing and analysis module is as follows:

[0016] A1. Collect environmental and safety data in the exhibition hall in real time through IoT devices;

[0017] The environmental data include temperature, humidity, light intensity, air quality and noise level; the safety data include personnel flow, exhibit safety, fire risk, intrusion and emergency evacuation;

[0018] A2. Pre-process the collected environmental data and safety data, and establish a data set with the processed data;

[0019] The process of preprocessing the collected environmental data and safety data is as follows:

[0020] A21. Clean the collected environmental and safety data to remove noise, outliers and duplicate values;

[0021] A22. Use the normalization formula to normalize the cleaned data and convert the data into a unified format. The normalization formula is as follows:

[0022] Among them, x' is the normalized data, min is the minimum value in the original data, x is the original data, and max is the maximum value in the original data;

[0023] A3. Analyze the data in the dataset in depth, identify patterns and associations in the data, and discover potential security risks and IoT device failure trends;

[0024] A4. Establish a prediction model based on the analysis results. The formula for establishing the prediction model is:

[0025]

[0026] Where a is the slope of the linear relationship, b is the intercept, and x is i is the i-th data feature, is the mean of the data, ∈ is the error term, and y is the model output;

[0027] A5. Use the data set to train the prediction model and find out the output range of y when the IoT device is operating normally. This output range is the standard threshold.

[0028] A6. The prediction model will be used to predict the failure of IoT devices, and the predicted y value will be compared with the standard threshold. When the predicted y value is within the standard threshold, it is judged as a non-fault abnormality. When the predicted y value exceeds the standard threshold, it is judged as a fault abnormality.

[0029] Furthermore, in step A3, the process of in-depth analysis of the data in the dataset is as follows:

[0030] A31. Use the mean calculation formula to calculate the mean μ of the preprocessed data. The mean calculation formula is as follows:

[0031] Among them, x i For each sample data, N is the number of samples;

[0032] A32. Calculate the standard deviation σ based on the mean μ result. The standard deviation σ calculation formula is as follows:

[0033]

[0034] A33. Select two variable data x and y, and calculate the covariance cov(x,y) of the two variable data. The calculation formula is as follows:

[0035] Among them, μx and μy are the means of variable data x and variable data y respectively;

[0036] A34. Calculate the correlation coefficient ρ between the two variable data. The correlation coefficient calculation formula is as follows:

[0037] Among them, σx and σy are the standard deviations of variable data x and variable data y respectively.

[0038] Furthermore, the feature extraction unit performs the following steps for feature extraction:

[0039] B1. Calculate the frequency p of each data i , the calculation formula is as follows:

[0040] Among them, N is the total number of samples, n i is the number of data i samples;

[0041] B2. According to the frequency p i Calculate the entropy H of the traffic data set (d) , entropy H (d) The calculation formula is as follows:

[0042] H (d) =∑(p i *log2p i );

[0043] B3. Given feature A, calculate the conditional entropy H of the traffic dataset (dA) , conditional entropy H (dA) The calculation formula is as follows:

[0044] H (dA) =∑(p i-A *H (di-A )), where p i-A is the probability of feature A taking a value, H (di-A ) is the entropy of the subset di-A under the condition of feature A;

[0045] B4. Calculate the entropy H of the traffic data set D (d) The conditional entropy H of the traffic dataset D after given feature A (dA) If the difference is greater than 1, it is a relevant feature; if the difference is less than or equal to 1, it is an irrelevant feature.

[0046] B5. Perform standardization conversion on the selected features. The standardization conversion formula is as follows:

[0047] Among them, x is the original data, x' is the converted data, and x min is the minimum value in the original data, x max is the maximum value in the original data.

[0048] Furthermore, the model training and detection unit training process is as follows:

[0049] C1. Use the training function to train the extracted features using the data in the traffic data set D. The training function formula is as follows:

[0050]

[0051] sty i (w*x i +b)≥1-ξ i ,ξ i ≥0, i=1, 2, …, n;

[0052] Among them, w is the weight vector, b is the bias term, C is the regularization parameter, ξ i is the slack variable, x i and i are two extracted related features, z i is the output value;

[0053] C2. After the training is completed, the F1 score of the detection model is calculated based on the training results. The calculation formula of F1 is as follows:

[0054] Among them, TP refers to the number of samples correctly classified as positive examples, FN refers to the number of samples misclassified as negative examples, and FP refers to the number of samples misclassified as positive examples.

[0055] Furthermore, the process of the regular inspection and maintenance module formulating and executing a detailed inspection and maintenance plan is as follows:

[0056] D1. Develop an inspection and maintenance plan based on the characteristics and usage of the equipment. The inspection and maintenance plan includes the time intervals and contents of inspection and maintenance;

[0057] D2. Automatically perform performance checks on equipment at scheduled intervals;

[0058] D3. Carry out equipment maintenance work based on the inspection results;

[0059] D4. Propose improvement suggestions on the use and maintenance of equipment based on the inspection and maintenance results;

[0060] D5. Count the frequency of various equipment failures, identify common failures and occasional failures, evaluate the effectiveness of fault handling, and optimize maintenance processes and strategies.

[0061] Furthermore, the emergency response and recovery module includes an emergency response unit and a recovery unit. The emergency response unit monitors abnormal behaviors in the environment in real time with the help of an intrusion detection system and a security information and event management system. When a suspicious event is found, the emergency response unit is immediately triggered to conduct a detailed analysis of the received suspicious event, confirm the nature of the event, the scope of impact and the means of attack, and evaluate the urgency and potential risks of the event. According to the nature and needs of the event, the required emergency plan is quickly deployed from the emergency resource library. The emergency plan includes isolating faulty equipment and starting a backup system to minimize losses.

[0062] The beneficial effects of the present invention are:

[0063] 1. The present invention can realize real-time monitoring, fault warning, data-driven decision-making, intelligent protection, active prevention and continuous improvement, and rapid response and recovery of exhibition hall safety management through the cooperation of Internet of Things device management module, big data processing and analysis module, AI security protection module, regular inspection and maintenance module, and emergency response and recovery module, thereby significantly improving the overall safety and reliability of the exhibition hall and improving the quality of digital exhibition hall management.

[0064] 2. Through the setting of the IoT device management module, the present invention can automatically identify and connect various IoT devices in the exhibition hall, and monitor the operating status of the IoT devices in real time. Once a failure or abnormality of the IoT device is detected, an alarm will be issued immediately and the maintenance process will be automatically triggered to ensure the normal operation of the IoT device.

[0065] 3. The present invention can form a dynamic and intelligent security protection system through the cooperation of the big data processing and analysis module and the AI ​​security protection module, which can continuously adapt to and respond to increasingly complex network threats, and can also automatically perform in-depth analysis on the operating data of IoT devices to predict possible equipment failures. When the risk of equipment failure is predicted, the system can automatically trigger maintenance processes, such as sending maintenance notifications, starting backup equipment, etc., to reduce the impact of failures on exhibition hall operations. The AI ​​security protection module can also adjust network policies or strengthen security protection according to the equipment failure prediction results to prevent security incidents caused by equipment failures.

[0066] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0068] Figure 1 A system block diagram according to an embodiment of the present invention is shown;

[0069] Figure 2 A flowchart of a processing and analysis process of a big data processing and analysis module according to an embodiment of the present invention is shown;

[0070] Figure 3 It shows a flow chart of feature extraction performed by a feature extraction unit according to an embodiment of the present invention;

[0071] Figure 4 A flowchart of a model training and detection unit training process according to an embodiment of the present invention is shown;

[0072] Figure 5 A flowchart of a periodic inspection and maintenance module formulating and executing a detailed inspection and maintenance plan according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0074] The embodiment of the present invention provides a digital exhibition hall security management system, such as Figure 1-5As shown, it includes an Internet of Things device management module, a big data processing and analysis module, an AI security protection module, a regular inspection and maintenance module, and an emergency response and recovery module. The big data processing and analysis module is electrically connected to the Internet of Things device management module and the AI ​​security protection module, respectively, and the regular inspection and maintenance module and the emergency response and recovery module are electrically connected to the Internet of Things device management module, the big data processing and analysis module, and the AI ​​security protection module, respectively; through the cooperation of the Internet of Things device management module, the big data processing and analysis module, the AI ​​security protection module, the regular inspection and maintenance module, and the emergency response and recovery module, real-time monitoring, fault warning, data-driven decision-making, intelligent protection, active prevention and continuous improvement, and rapid response and recovery of exhibition hall safety management can be achieved, thereby significantly improving the overall safety and reliability of the exhibition hall and improving the quality of digital exhibition hall management.

[0075] The IoT device management module is used for the access, monitoring and maintenance of IoT devices. It can automatically identify and connect various IoT devices in the exhibition hall and monitor the operating status of IoT devices in real time. Once a failure or abnormality of an IoT device is detected, an alarm will be immediately issued and the maintenance process will be automatically triggered to ensure the normal operation of the IoT device.

[0076] The IoT device management module includes a central control unit and an anomaly detection unit. The central control unit is used to automatically scan IoT devices in the exhibition hall, identify the type, specification and connection requirements of IoT devices, and automatically establish a connection; the anomaly detection unit is used to continuously monitor the operating status of connected devices, detect abnormal behavior or signs of failure of IoT devices, and immediately alarm once an abnormality is detected, and trigger the regular inspection and maintenance module to work; wherein the operating status includes operating parameters, energy consumption and connection stability;

[0077] When scanning the IoT devices in the exhibition hall, the central control unit first collects the MAC address, model and manufacturer information of the IoT devices to identify the type and specifications of the devices and set the rules or policies for networking. Once the IoT devices are identified, the central control unit automatically configures the network parameters for the IoT devices according to the preset rules or policies. After the configuration is completed, a network connection is established between the central control unit and the IoT devices, and then identity authentication is performed through a shared key or digital certificate. When the identity authentication is successful, the communication between the central control unit and the IoT devices is encrypted to prevent data leakage or tampering;

[0078] The process of the central control unit scanning the IoT device is as follows:

[0079] E11. Collect the MAC address, model and manufacturer information of IoT devices, use network scanning tools to establish a device information database, store the device type and specification information corresponding to different models and manufacturers, and identify the device by querying the database;

[0080] E12. Collect the MAC address, model and manufacturer information of the device. Obtain the MAC address, model and manufacturer information of the device by parsing the Nmap scan results. Then query the corresponding device type and specification in the device information database according to the device model and manufacturer information. Finally, display the identification results in the management interface in a table format.

[0081] E13. Use the corresponding network configuration tools or protocols according to different network types (such as WiFi, Ethernet, etc.). For WiFi devices, use the WPA-PSK protocol for configuration, and use the wpa_supplicant tool in Python for configuration. The preset rules or policies are stored in the configuration file. The central control unit reads the configuration file and configures the network parameters for the device according to the rules.

[0082] E14. Preset network configuration rules, such as WiFi SSID, password, IP address allocation rules, etc. The type and specification information of the device will also affect the configuration of network parameters. For example, different types of devices may require different IP address segments. Check whether the device can successfully connect to the network. Use the ping command or other network connectivity test tools to verify. If the device can respond to the ping request normally, it means that the network parameters are configured successfully.

[0083] E15. The network configuration result is indicated in the form of a status indicator light on the management interface. Green indicates successful configuration and red indicates failed configuration. At the same time, the configuration process and results are recorded in the log file. For shared key authentication, a symmetric encryption algorithm such as AES is used. For digital certificate authentication, a PKI (public key infrastructure) system such as OpenSSL can be used to generate and manage digital certificates. During the communication process, the TLS / SSL protocol is used to encrypt data transmission. The SSL library is used in Python to implement the shared key or digital certificate. For example, the shared key is a fixed string. The digital certificate contains the public key of the device, the certificate authority and other information. Whether the authentication is successful is determined by verifying the status code or message returned during the authentication process.

[0084] E16. During the communication process, check whether the data can be encrypted and decrypted normally, and whether there is any data loss or tampering. Display the status of identity authentication and communication encryption on the management interface, such as "Authentication successful, communication encryption normal" or "Authentication failed, please check the certificate". At the same time, detailed information about the identity authentication and encryption process can be recorded in the log file;

[0085] The abnormality detection unit includes a sensor component for collecting operation data of the Internet of Things device in real time. The sensor component is electrically connected to the central control unit. The sensor component includes a temperature sensor, a humidity sensor, a pressure sensor, a current transformer and a voltage transformer. The sensor data of temperature, humidity, pressure, current and voltage of the Internet of Things device are collected respectively through the sensor component, and the collected sensor data are transmitted to the central control unit for processing to ensure the stability and reliability of the network. If the Internet of Things device has a connection problem or data transmission is interrupted, the Internet of Things device management module can automatically troubleshoot and try to restore the connection. If the connection is restored successfully, the data between the central control unit and the Internet of Things device is transmitted normally. If the connection is not restored successfully, the regular inspection and maintenance module is triggered to perform inspection and maintenance work, and an alarm is sounded at the same time.

[0086] The process of the anomaly detection unit performing anomaly detection is as follows:

[0087] E21. According to the device type, regularly obtain the working parameter data sent by the device, for example, for a smart meter, obtain its power reading; for a temperature sensor, obtain the temperature value, and read the data according to the communication protocol of the device through the established connection;

[0088] E22. For devices that support energy consumption monitoring, directly obtain energy consumption data. For some devices that do not directly provide energy consumption data, calculate it based on the power and operating time of the device;

[0089] E23. Check whether the device responds in time by sending heartbeat packets regularly (for example, in the MQTT protocol, the keepalive parameter can be set) to determine the stability of the connection. If no response is received within a certain period of time, it is considered that there is a problem with the connection.

[0090] E24. Set a reasonable threshold range for each operating status parameter; for example, for a temperature sensor, the normal operating temperature range may be -20℃ to 80℃. If it exceeds this range, it is considered abnormal;

[0091] E25. Use machine learning algorithms (such as Isolation Forest for anomaly detection) to model equipment operation data to discover more complex anomaly patterns;

[0092] E26. Once an abnormality is detected, an alarm is generated through various means, such as sending emails (using Python's smtplib library) and text messages (through the SMS gateway API), etc., to trigger the regular inspection and maintenance module, and notify the maintenance personnel to perform equipment inspection and maintenance by calling the relevant interfaces of the maintenance module.

[0093] Through the setting of the IoT device management module, various IoT devices in the exhibition hall can be automatically identified and connected, which greatly reduces the tediousness and errors of manual configuration. By real-time monitoring of the operating status of IoT devices, it ensures that the equipment is always in the best working condition. Once a failure or abnormality of the IoT device is detected, an alarm will be issued immediately and the maintenance process will be automatically triggered, shortening the fault response time and improving the availability of the equipment.

[0094] The big data processing and analysis module is used to collect, store and analyze the massive data generated in the exhibition hall, identify potential safety hazards, predict IoT equipment failures, and provide a scientific basis for the safety management of the exhibition hall;

[0095] like Figure 2 As shown, the processing and analysis process of the big data processing and analysis module is as follows:

[0096] A1. Collect environmental and safety data in the exhibition hall in real time through IoT devices;

[0097] The environmental data include temperature, humidity, light intensity, air quality and noise level; the safety data include personnel flow, exhibit safety, fire risk, intrusion and emergency evacuation;

[0098] A2. Pre-process the collected environmental data and safety data, and establish a data set with the processed data;

[0099] The process of preprocessing the collected environmental data and safety data is as follows:

[0100] A21. Clean the collected environmental and safety data to remove noise, outliers and duplicate values;

[0101] A22. Use the normalization formula to normalize the cleaned data and convert the data into a unified format. The normalization formula is as follows:

[0102] Among them, x' is the normalized data, min is the minimum value in the original data, x is the original data, and max is the maximum value in the original data;

[0103] A3. Analyze the data in the dataset in depth, identify patterns and associations in the data, and discover potential security risks and IoT device failure trends;

[0104] The process of in-depth analysis of the data in the dataset is as follows:

[0105] A31. Use the mean calculation formula to calculate the mean μ of the preprocessed data. The mean calculation formula is as follows:

[0106] Among them, x i For each sample data, N is the number of samples;

[0107] A32. Calculate the standard deviation σ based on the mean μ result. The standard deviation σ calculation formula is as follows:

[0108]

[0109] A33. Select two variable data x and y, and calculate the covariance cov(x,y) of the two variable data. The calculation formula is as follows:

[0110] Among them, μx and μy are the means of variable data x and variable data y respectively;

[0111] A34. Calculate the correlation coefficient ρ between the two variable data. The correlation coefficient calculation formula is as follows:

[0112] Among them, σx and σy are the standard deviations of variable data x and variable data y respectively.

[0113] A4. Establish a prediction model based on the analysis results. The formula for establishing the prediction model is:

[0114]

[0115] Where a is the slope of the linear relationship, b is the intercept, and x is i is the i-th data feature, is the mean of the data, ∈ is the error term, and y is the model output;

[0116] A5. Use the data set to train the prediction model and find out the output range of y when the IoT device is operating normally. This output range is the standard threshold.

[0117] A6. The prediction model will be used to predict the failure of IoT devices, and the predicted y value will be compared with the standard threshold. When the predicted y value is within the standard threshold, it is judged as a non-fault abnormality. When the predicted y value exceeds the standard threshold, it is judged as a fault abnormality.

[0118] The big data processing and analysis module collects environmental data and safety data in the exhibition hall in real time through IoT devices (such as sensors, cameras, etc.). During the data collection process, the accuracy and completeness of the data are ensured. Possible technologies include API calls, network crawling, etc. The collected data is then cleaned and normalized, and the mean and standard deviation statistics are calculated to understand the basic characteristics of the data, calculate the correlation coefficient between variables, identify the association relationship in the data, and predict the failure trend of IoT devices by establishing a prediction model. The prediction model is trained using a data set to find the output range value of IoT devices when they are operating normally. The performance of the model is evaluated and optimized by cross-validation and confusion matrix.

[0119] The big data processing and analysis module reflects the environmental conditions of the exhibition hall by analyzing data such as temperature, humidity, light intensity, air quality and noise level. It uses personnel flow, exhibit safety, fire risk, intrusion and emergency evacuation to reflect the safety conditions in the exhibition hall. It obtains the basic statistical characteristics of the data through descriptive analysis, obtains the correlation between variables through correlation analysis, and obtains the failure trend prediction results of IoT devices through predictive analysis. It mines valuable information and knowledge from large amounts of data, such as association rules and classification results. It uses the trained prediction model to predict the failure of IoT devices and obtain the predicted y value. It compares the predicted y value with the standard threshold to determine whether the equipment has a fault anomaly.

[0120] The AI ​​security protection module monitors network traffic in real time, identifies malicious attacks, takes corresponding defensive measures, and continuously optimizes its own security protection capabilities to cope with increasingly complex network threats.

[0121] The AI ​​security protection module includes a network traffic collection unit, a feature extraction unit, a model training and detection unit, a threat response and disposal unit, and an optimization and update unit. The network traffic collection unit is used to collect traffic data from the network, and clean, deduplicate and standardize the collected data to establish a traffic data set D; the feature extraction unit is used to select features related to network security threats from the original data collected by the network traffic collection unit, and then further convert the features related to network security threats; the model training and detection unit is used to train the extracted features to form a detection model, and then use the traffic data set to evaluate the performance of the detection model; the threat response and disposal unit identifies potential threats based on the evaluation results of the detection model, and takes corresponding defense measures for the identified threats; the optimization and update unit is used to optimize and adjust the detection model based on new data and threat intelligence to keep the detection model with the latest security protection capabilities.

[0122] like Figure 3As shown, the steps of feature extraction by the feature extraction unit are as follows:

[0123] B1. Calculate the frequency p of each data i , the calculation formula is as follows:

[0124] Among them, N is the total number of samples, n i is the number of data i samples;

[0125] B2. According to the frequency p i Calculate the entropy H of the traffic data set (d) , entropy H (d) The calculation formula is as follows:

[0126] H (d) =∑(p i *log2p i );

[0127] B3. Given feature A, calculate the conditional entropy H of the traffic dataset (dA) , conditional entropy H (dA) The calculation formula is as follows:

[0128] H (dA) =∑(p i-A *H (di-A )), where p i-A is the probability of feature A taking a value, H (di-A) is the entropy of the subset di-A under the condition of feature A;

[0129] B4. Calculate the entropy H of the traffic data set D (d) The conditional entropy H of the traffic dataset D after given feature A (dA) If the difference is greater than 1, it is a relevant feature; if the difference is less than or equal to 1, it is an irrelevant feature.

[0130] B5. Perform standardization conversion on the selected features. The standardization conversion formula is as follows:

[0131] Among them, x is the original data, x' is the converted data, and x min is the minimum value in the original data, x max is the maximum value in the original data;

[0132] like Figure 4 As shown, the process of training the model and the detection unit is as follows:

[0133] C1. Use the training function to train the extracted features using the data in the traffic data set D. The training function formula is as follows:

[0134]

[0135] sty i (w*x i +b)≥1-ξ i ,ξ i ≥0, i=1, 2, …, n;

[0136] Among them, w is the weight vector, b is the bias term, C is the regularization parameter, ξ i is the slack variable, x i and i are two extracted related features, z i is the output value;

[0137] C2. After the training is completed, the F1 score of the detection model is calculated based on the training results. The calculation formula of F1 is as follows:

[0138] Among them, TP refers to the number of samples correctly classified as positive examples, FN refers to the number of samples misclassified as negative examples, and FP refers to the number of samples misclassified as positive examples;

[0139] The threat response and disposal unit detects potential threats using an intrusion prevention system. When receiving an alarm from the intrusion prevention system, it matches the features in the alarm with known malicious behaviors to identify the specific threat type, and then conducts a risk assessment on the identified threat to determine the potential impact and degree of harm of the threat. It then performs security reinforcement based on the threat type and source, and formulates and implements emergency response countermeasures. Security reinforcement includes isolating the threatened network to block the spread of malicious traffic, using reliable anti-virus tools to remove malicious code and data, repairing hacked accounts and security settings, and strengthening identity authentication and data encryption methods;

[0140] When performing optimization and adjustment, the optimization and updating unit identifies deficiencies in the detection model based on the detection model performance evaluation results, analyzes the reasons for the failure of the detection model in combination with new data and threat intelligence, adjusts the parameters of the detection model according to the reasons for the failure, obtains a new detection model, and then extracts new feature data based on the new data and threat intelligence, trains the new detection model based on the new feature data, and after the new detection model is trained, performs a comparative test with the original detection model to evaluate the performance improvement of the new detection model. When the new detection model has obvious improvement, the new detection model is applied to the actual environment. When the new detection model has no obvious improvement, the failure analysis and adjustment of the detection model are re-analyzed and adjusted in combination with the new data and threat intelligence.

[0141] Through the cooperation of the big data processing and analysis module and the AI ​​security protection module, a dynamic and intelligent security protection system can be formed to continuously adapt to and respond to increasingly complex network threats. It can also automatically conduct in-depth analysis of the operating data of IoT devices and predict possible equipment failures. When the risk of equipment failure is predicted, the system can automatically trigger maintenance processes, such as sending maintenance notifications, starting backup equipment, etc., to reduce the impact of failures on exhibition hall operations. The AI ​​security protection module can also adjust network policies or strengthen security protection based on the equipment failure prediction results to prevent security incidents caused by equipment failures.

[0142] The regular inspection and maintenance module is used to formulate and implement a detailed inspection and maintenance plan, and through regular maintenance, timely discover and solve potential problems to improve overall safety and reliability.

[0143] like Figure 5 As shown, the process of the regular inspection and maintenance module to formulate and implement a detailed inspection and maintenance plan is as follows:

[0144] D1. Develop an inspection and maintenance plan based on the characteristics and usage of the equipment. The inspection and maintenance plan includes the time intervals and contents of inspection and maintenance;

[0145] D2. Automatically perform performance checks on the equipment at scheduled intervals. The performance checks include whether all sensors and actuators are well connected, whether the power lines are normal, whether the equipment's operating status and parameters meet expectations, and the processing of system logs and alarm information.

[0146] D3. Perform equipment maintenance work based on the inspection results, including removing dust and dirt from the surface of the equipment, lubricating parts that need lubrication, replacing damaged accessories or adjusting equipment settings;

[0147] D4. Based on the inspection and maintenance results, put forward suggestions for improvement on the use and maintenance of equipment to reduce equipment failures, improve equipment efficiency and extend equipment service life;

[0148] D5. Count the frequency of various equipment failures, identify common and occasional failures, evaluate the effectiveness of fault handling, optimize maintenance processes and strategies, collect equipment operation data, analyze equipment performance and potential failure modes, and discover and solve potential problems in advance.

[0149] The regular inspection and maintenance module uses statistical analysis and machine learning algorithms to analyze equipment operation data, identify failure modes and trends, and uses time series analysis technology to model and predict changes in equipment performance over time, and warn of possible equipment failures. It uses the Internet of Things technology to achieve remote monitoring of equipment, obtain equipment status and operating parameters in real time, and use sensor networks and wireless communication technologies to transmit equipment data to the central control unit in real time. Using automated testing tools and scripts, the equipment is regularly tested for performance and functional verification. Machine vision and image recognition technology are used to automatically detect the appearance and operating status of the equipment, including the equipment's operating status, operating parameters, power consumption, temperature, humidity, etc., which reflect the equipment's real-time performance and health status. Based on historical fault data and equipment operation data (including data on the time, type, cause, and repair measures of the fault, which are used to analyze fault modes, frequencies, and trends), a fault prediction model is established, and the prediction model is used to warn and predict possible future equipment failures.

[0150] The regular inspection and maintenance module analyzes and processes equipment operation data, fault record data and maintenance record data by adopting technologies such as data analysis, remote monitoring, automated detection and fault prediction, and obtains results such as equipment performance evaluation, fault warning and maintenance effect evaluation, which are presented in the form of reports, charts, warning information, maintenance suggestions and visual monitoring systems. These results help to timely discover and solve potential problems and improve the safety and reliability of equipment.

[0151] The emergency response and recovery module is used to quickly locate the cause of the problem when encountering an emergency or safety accident, and take corresponding emergency measures, as well as quickly restore the normal operation of the system after the accident occurs to minimize the loss;

[0152] The emergency response and recovery module includes an emergency response unit and a recovery unit. The emergency response unit monitors abnormal behaviors in the environment in real time with the help of an intrusion detection system and a security information and event management system. With the help of an intrusion detection system (IDS), the abnormal behaviors in the environment, such as unauthorized access attempts, malware activities, etc., are monitored in real time. The security information and event management system (SIEM) collects and analyzes security logs and events from different sources to identify potential security threats. When a suspicious event is found, the emergency response unit is immediately triggered to use machine learning algorithms and statistical analysis methods to conduct a detailed analysis of the received suspicious events to confirm the nature of the event and its impact. Scope and attack methods are based on historical data and domain knowledge of events, assessing the urgency and potential risks of events, and outputting event analysis reports, including information such as the nature of the event, scope of impact, and attack methods. According to the nature and needs of the event, an emergency plan library is established, which contains predefined response steps and resource allocation plans for different types of events. Automation technologies, such as scripts and automation tools, are used to quickly allocate required emergency plans according to the nature and needs of the event. Emergency plans include isolating faulty equipment and starting backup systems to minimize losses. The execution steps, timestamps, and execution results of the emergency plan are recorded to evaluate the effectiveness and execution efficiency of the emergency plan.

[0153] The recovery unit uses data backup and recovery tools to restore damaged data after the incident is under control, and uses system reconstruction technology, such as virtual machine migration, service restart, etc., to ensure the integrity of system functions. According to the problems exposed by the incident, vulnerability scanning tools are used to identify system vulnerabilities, and corresponding patches are applied to patch them. Access control strategies are strengthened, such as implementing multi-factor authentication, restricting access rights, etc., to prevent similar incidents from happening again. According to the problems exposed by the incident, vulnerabilities need to be patched, patches updated, and access control strengthened to prevent similar incidents from happening again. Finally, the emergency response process is summarized and analyzed, and the implementation of the emergency plan is evaluated;

[0154] The results obtained after analysis are expressed as follows:

[0155] Reports and Charts:

[0156] Output event analysis reports, emergency plan execution reports, data recovery and system reconstruction reports, etc., presenting the analysis results and execution process in text and chart form;

[0157] Logging and audit records:

[0158] Record security logs, event logs, emergency plan execution logs, etc., and display system status and response process in the form of timestamps and event descriptions;

[0159] Visual monitoring system:

[0160] Establish a visual monitoring system to display information such as system status, event handling progress, and emergency plan execution in real time;

[0161] Summary, analysis and improvement suggestions:

[0162] Summarize and analyze the emergency response process, evaluate the implementation and effectiveness of the emergency plan, and put forward improvement suggestions, such as optimizing the emergency plan, strengthening safety monitoring, etc., to improve the safety and reliability of the system.

[0163] The emergency response and recovery module uses a series of technologies and processes to conduct detailed analysis of security logs, system status, emergency plan execution and other data to obtain information such as the nature of the event, the scope of impact, and the results of the emergency plan execution, and presents it in the form of reports, charts, logs, and visual monitoring systems. These results help to quickly locate problems, take emergency measures, and restore the normal operation of the system afterwards to minimize losses.

[0164] The emergency response and recovery module monitors abnormal situations in the exhibition hall in real time, which improves the real-time and accuracy of emergency response. By quickly locating the cause of the problem, it can improve the efficiency and accuracy of problem locating, reduce the cost of troubleshooting, and take appropriate emergency measures according to the type and severity of the problem, effectively controlling the spread and impact of the problem and improving the system's recovery capabilities.

[0165] Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent substitutions for some of the technical features therein; and these modifications or substitutions do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A digital exhibition hall security management system, characterized by: include: The IoT device management module is used for the access, monitoring and maintenance of IoT devices. It can automatically identify and connect various IoT devices in the exhibition hall and monitor the operating status of IoT devices in real time. Once a failure or abnormality of an IoT device is detected, an alarm will be immediately issued and the maintenance process will be automatically triggered to ensure the normal operation of the IoT device; A big data processing and analysis module, which is used to collect, store and analyze the massive data generated in the exhibition hall, identify potential safety hazards, predict IoT equipment failures, and provide a scientific basis for the safety management of the exhibition hall; An AI security protection module, which monitors network traffic in real time, identifies malicious attacks, takes corresponding defensive measures, and continuously optimizes its own security protection capabilities to cope with increasingly complex network threats; The AI ​​security protection module includes a network traffic collection unit, a feature extraction unit, a model training and detection unit, a threat response and disposal unit, and an optimization and update unit. The network traffic collection unit is used to collect traffic data from the network, and clean, deduplicate and standardize the collected data to establish a traffic data set D; The feature extraction unit is used to select features related to network security threats from the original data collected by the network traffic collection unit, and then further convert the features related to network security threats; The model training and detection unit is used to train the extracted features to form a detection model, and then use the traffic data set to evaluate the performance of the detection model; the threat response and disposal unit identifies potential threats based on the detection model evaluation results and takes corresponding defense measures for the identified threats; the optimization and update unit is used to optimize and adjust the detection model based on new data and threat intelligence to keep the detection model with the latest security protection capabilities; A regular inspection and maintenance module, which is used to formulate and implement detailed inspection and maintenance plans, timely discover and solve potential problems through regular maintenance, and improve overall safety and reliability; Emergency response and recovery module, which is used to quickly locate the cause of the problem and take corresponding emergency measures when encountering an emergency or safety accident, and quickly restore the normal operation of the system after the accident to minimize the loss; The big data processing and analysis module is electrically connected to the Internet of Things device management module and the AI ​​security protection module respectively, and the regular inspection and maintenance module and the emergency response and recovery module are electrically connected to the Internet of Things device management module, the big data processing and analysis module and the AI ​​security protection module respectively.

2. A digital exhibition hall safety management system according to claim 1, characterized in that: The IoT device management module includes a central control unit and an anomaly detection unit. The central control unit is used to automatically scan the IoT devices in the exhibition hall, identify the type, specifications and connection requirements of the IoT devices, and automatically establish a connection; the anomaly detection unit is used to continuously monitor the operating status of the connected devices, detect abnormal behavior or signs of failure of the IoT devices, and once an abnormality is detected, an alarm is immediately issued, and the regular inspection and maintenance module is triggered.

3. A digital exhibition hall safety management system according to claim 2, characterized in that: When scanning the IoT devices in the exhibition hall, the central control unit first collects the MAC address, model and manufacturer information of the IoT devices to identify the type and specifications of the devices and set the rules or policies for networking. Once the IoT devices are identified, the central control unit automatically configures the network parameters for the IoT devices according to the preset rules or policies. After the configuration is completed, a network connection is established between the central control unit and the IoT devices, and then identity authentication is performed through a shared key or digital certificate. When the identity authentication is successful, the communication between the central control unit and the IoT devices is encrypted to prevent data leakage or tampering.

4. A digital exhibition hall safety management system according to claim 3, characterized in that: The abnormality detection unit includes a sensor component for collecting the operation data of the Internet of Things device in real time. The sensor component is electrically connected to the central control unit. The sensor data of the temperature, humidity, pressure, current and voltage of the Internet of Things device are collected respectively through the sensor component, and the collected sensor data are transmitted to the central control unit for processing to ensure the stability and reliability of the network. If the Internet of Things device has a connection problem or the data transmission is interrupted, the Internet of Things device management module can automatically troubleshoot the problem and try to restore the connection. If the connection is restored successfully, the data between the central control unit and the Internet of Things device is transmitted normally. If the connection is not restored successfully, the regular inspection and maintenance module is triggered to perform inspection and maintenance work, and an alarm is sounded at the same time.

5. A digital exhibition hall safety management system according to claim 4, characterized in that: The processing and analysis process of the big data processing and analysis module is as follows: A1. Collect environmental and safety data in the exhibition hall in real time through IoT devices; The environmental data include temperature, humidity, light intensity, air quality and noise level; the safety data include personnel flow, exhibit safety, fire risk, intrusion and emergency evacuation; A2. Pre-process the collected environmental data and safety data, and establish a data set with the processed data; The process of preprocessing the collected environmental data and safety data is as follows: A21. Clean the collected environmental and safety data to remove noise, outliers and duplicate values; A22. Use the normalization formula to normalize the cleaned data and convert the data into a unified format. The normalization formula is as follows: Among them, x' is the normalized data, min is the minimum value in the original data, x is the original data, and max is the maximum value in the original data; A3. Analyze the data in the dataset in depth, identify patterns and associations in the data, and discover potential security risks and IoT device failure trends; A4. Establish a prediction model based on the analysis results. The formula for establishing the prediction model is: Where a is the slope of the linear relationship, b is the intercept, and x is i is the i-th data feature, is the mean of the data, ∈ is the error term, and y is the model output; A5. Use the data set to train the prediction model and find out the output range of y when the IoT device is operating normally. This output range is the standard threshold. A6. The prediction model will be used to predict the failure of IoT devices, and the predicted y value will be compared with the standard threshold. When the predicted y value is within the standard threshold, it is judged as a non-fault abnormality. When the predicted y value exceeds the standard threshold, it is judged as a fault abnormality.

6. A digital exhibition hall safety management system according to claim 5, characterized in that: In step A3, the process of in-depth analysis of the data in the dataset is as follows: A31. Use the mean calculation formula to calculate the mean μ of the preprocessed data. The mean calculation formula is as follows: Among them, x i For each sample data, N is the number of samples; A32. Calculate the standard deviation σ based on the mean μ result. The standard deviation σ calculation formula is as follows: A33. Select two variable data x and y, and calculate the covariance cov(x,y) of the two variable data. The calculation formula is as follows: Among them, μx and μy are the means of variable data x and variable data y respectively; A34. Calculate the correlation coefficient ρ between the two variable data. The correlation coefficient calculation formula is as follows: Among them, σx and σy are the standard deviations of variable data x and variable data y respectively.

7. A digital exhibition hall safety management system according to claim 6, characterized in that: The steps of feature extraction by the feature extraction unit are as follows: B1. Calculate the frequency p of each data i , the calculation formula is as follows: Among them, N is the total number of samples, n i is the number of data i samples; B2. According to the frequency p i Calculate the entropy H(d) of the traffic data set. The calculation formula of entropy H(d) is as follows: H (d) =Σ(p i *log2p i ); B3. Given feature A, calculate the conditional entropy H of the traffic dataset (dA) , conditional entropy H (dA) The calculation formula is as follows: H (dA) =∑(p i-A *H (di-A) ), where p i-A is the probability of feature A taking a value, H (di-A) is the entropy of the subset di-A under the condition of feature A; B4. Calculate the entropy H of the traffic data set D (d) The conditional entropy H of the traffic dataset D after given feature A (dA) If the difference is greater than 1, it is a relevant feature; if the difference is less than or equal to 1, it is an irrelevant feature. B5. Perform standardization conversion on the selected features. The standardization conversion formula is as follows: Among them, x is the original data, x' is the converted data, and x min is the minimum value in the original data, x max is the maximum value in the original data.

8. A digital exhibition hall safety management system according to claim 7, characterized in that: The training process of the model training and detection unit is as follows: C1. Use the training function to train the extracted features using the data in the traffic data set D. The training function formula is as follows: s.t.y i (w*x i +b)≥1-ξ i ,ξ i ≥0,i=1,2,…,n; Among them, w is the weight vector, b is the bias term, C is the regularization parameter, ξ i is the slack variable, x i and i are two extracted related features, z i is the output value; C2. After the training is completed, the F1 score of the detection model is calculated based on the training results. The calculation formula of F1 is as follows: Among them, TP refers to the number of samples correctly classified as positive examples, FN refers to the number of samples misclassified as negative examples, and FP refers to the number of samples misclassified as positive examples.

9. A digital exhibition hall safety management system according to claim 8, characterized in that: The process of formulating and executing a detailed inspection and maintenance plan in the regular inspection and maintenance module is as follows: D1. Develop an inspection and maintenance plan based on the characteristics and usage of the equipment. The inspection and maintenance plan includes the time intervals and contents of inspection and maintenance; D2. Automatically perform performance checks on equipment at scheduled intervals; D3. Carry out equipment maintenance work based on the inspection results; D4. Propose improvement suggestions on the use and maintenance of equipment based on the inspection and maintenance results; D5. Count the frequency of various equipment failures, identify common failures and occasional failures, evaluate the effectiveness of fault handling, and optimize maintenance processes and strategies.

10. A digital exhibition hall safety management system according to claim 9, characterized in that: The emergency response and recovery module includes an emergency response unit and a recovery unit. The emergency response unit monitors abnormal behaviors in the environment in real time with the help of an intrusion detection system and a security information and event management system. When a suspicious event is found, the emergency response unit is immediately triggered to conduct a detailed analysis of the received suspicious event, confirm the nature of the event, the scope of impact and the means of attack, and evaluate the urgency and potential risks of the event. According to the nature and needs of the event, the required emergency plan is quickly deployed from the emergency resource library. The emergency plan includes isolating faulty equipment and starting the backup system to minimize losses.

Images