Personnel dynamic early warning device and method based on behavior pattern analysis

Abstract

The invention relates to the related technical field of dynamic early warning, in particular to a personnel dynamic early warning device and method based on behavior pattern analysis, and the device comprises a configuration module, a monitoring module, a feature analysis module, a model construction module and an anomaly analysis module. By configuring an early warning perimeter, capturing a personnel trajectory, analyzing perimeter distribution characteristics, constructing a cross-regional behavior anomaly analysis model, identifying abnormal behaviors and performing early warning, the problem that conventional personnel dynamic early warning depends on fixed monitoring layout and preset rules and is difficult to flexibly adapt to complex and changeable monitoring environments and subtle changes of personnel behavior modes is solved; the technical problems that the accuracy of abnormal behavior early warning and the adaptive capacity in various complex scenes are insufficient are solved, and accurate recognition and instant early warning of abnormal behaviors are achieved through fine configuration of early warning perimeter, intelligent capture of personnel tracks, deep analysis of perimeter distribution characteristics and construction of an efficient cross-region behavior abnormal analysis model. And the real-time response capability and the accurate early warning rate of abnormal behavior early warning are obviously improved.

Description

Technical Field

[0001] The present invention relates to the technical field related to dynamic early warning, and in particular to a personnel dynamic early warning device and method based on behavior pattern analysis. Background Art

[0002] With the acceleration of urbanization and the improvement of social informatization, the need for public and personal security has become more urgent. Conventional security monitoring systems often rely on fixed rules. Although they have maintained social order to a certain extent, their excessive reliance on preset fixed rules has gradually revealed their limitations. Faced with increasingly complex and changing security threats, such as cyber attacks and the rapid evolution of emergencies, conventional security monitoring systems are difficult to adapt quickly and respond effectively.

[0003] To sum up, the conventional dynamic warning of personnel in the existing technology relies on fixed monitoring layout and preset rules, which is difficult to flexibly adapt to the complex and changeable monitoring environment and the subtle changes in personnel behavior patterns. It also has technical problems such as the accuracy of abnormal behavior warning and insufficient adaptability in various complex scenarios. Summary of the invention

[0004] This application provides a personnel dynamic warning device based on behavior pattern analysis, aiming to solve the technical problems in the prior art that conventional personnel dynamic warning relies on fixed monitoring layout and preset rules, is difficult to flexibly adapt to complex and changeable monitoring environments and subtle changes in personnel behavior patterns, and has insufficient accuracy of abnormal behavior warnings and adaptability to various complex scenarios.

[0005] In view of the above problems, the technical solution to implement this application is: On the one hand, the present application provides a personnel dynamic warning device based on behavior pattern analysis, wherein the device includes: a warning perimeter configuration module, which is used to configure multiple personnel warning perimeters based on a target area; a monitoring module, which is used to capture the movement trajectory of personnel, identify and mark the personnel warning perimeter from the personnel warning perimeter according to the movement trajectory of the personnel, and extract the behavior monitoring data set of the personnel in the marked personnel warning perimeter; a feature analysis module, which is used to analyze the perimeter distribution characteristics of the marked personnel warning perimeter, wherein the perimeter distribution characteristics include embedded hierarchical distribution and non-embedded horizontal distribution, wherein the embedded hierarchical distribution includes the movement behavior of personnel in multiple nested areas, and the non-embedded horizontal distribution includes the movement behavior of personnel in multiple independent but parallel areas; a model construction module, which is used to construct a cross-regional behavior pattern anomaly analysis model, wherein the cross-regional behavior pattern anomaly analysis model includes a hierarchical behavior pattern anomaly analysis network and a horizontal behavior pattern anomaly analysis network; an anomaly analysis module, which is used for the cross-regional behavior pattern anomaly analysis model to perform anomaly analysis according to the perimeter distribution characteristics of the marked personnel warning perimeter and the behavior monitoring data set to generate a first anomaly warning signal.

[0006] On the other hand, the present application provides a personnel dynamic warning method based on behavior pattern analysis, wherein the method includes: configuring multiple personnel warning perimeters based on the target area; capturing personnel movement trajectories, identifying and marking personnel warning perimeters from the personnel warning perimeters according to the personnel movement trajectories, and extracting a behavior monitoring data set of personnel in the marked personnel warning perimeter; analyzing the perimeter distribution characteristics of the marked personnel warning perimeter, the perimeter distribution characteristics include embedded hierarchical distribution and non-embedded horizontal distribution, the embedded hierarchical distribution includes the movement behavior of personnel in multiple nested areas, and the non-embedded horizontal distribution includes the movement behavior of personnel in multiple independent but parallel areas; constructing a cross-regional behavior pattern anomaly analysis model, wherein the cross-regional behavior pattern anomaly analysis model includes a hierarchical behavior pattern anomaly analysis network and a horizontal behavior pattern anomaly analysis network; the cross-regional behavior pattern anomaly analysis model performs anomaly analysis according to the perimeter distribution characteristics of the marked personnel warning perimeter and the behavior monitoring data set to generate a first abnormal warning signal.

[0007] In summary, one or more technical solutions provided in this application solve the technical problems that conventional dynamic warnings of personnel rely on fixed monitoring layouts and preset rules, are difficult to flexibly adapt to complex and changeable monitoring environments and subtle changes in personnel behavior patterns, and have insufficient accuracy and adaptability to various complex scenarios in abnormal behavior warnings. It achieves accurate identification and immediate warning of abnormal behaviors through fine configuration of warning perimeters, intelligent capture of personnel trajectories, in-depth analysis of perimeter distribution characteristics, and construction of an efficient cross-regional behavior anomaly analysis model, significantly improving the real-time response capability and accurate warning rate of abnormal behavior warnings, while enhancing the monitoring efficiency in complex and changeable scenarios, achieving the technical effect of improving the level of regional security prevention. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 A structural schematic diagram of a personnel dynamic early warning device based on behavior pattern analysis is provided for this application; Figure 2 A flow chart of a personnel dynamic early warning method based on behavior pattern analysis is provided for this application.

[0009] Explanation of the reference numerals: warning perimeter configuration module M100, monitoring module M200, feature analysis module M300, model building module M400, anomaly analysis module M500. DETAILED DESCRIPTION Example 1

[0010] The present application is described in detail below with reference to the accompanying drawings. Figure 1 As shown, the embodiment of the present application provides a personnel dynamic warning device based on behavior pattern analysis, wherein the device includes: The warning perimeter configuration module M100 is used to configure multiple personnel warning perimeters based on the target area; the monitoring module M200 is used to capture the movement trajectory of personnel, identify and mark the personnel warning perimeter from the personnel warning perimeter according to the movement trajectory of the personnel, and extract the behavior monitoring data set of the personnel in the marked personnel warning perimeter.

[0011] Specifically, multiple warning perimeters are delineated in the target area, each of which has its own specific monitoring range; the activities of people in the target area are tracked in real time by capturing the movement trajectory of people; using advanced video surveillance technology, the system can accurately identify the movement direction and speed of people, and then determine whether they have entered a certain configured warning perimeter; once a person is identified as entering a certain warning perimeter, the perimeter is marked as a marked person warning perimeter; the behavior monitoring data set of the person is extracted from the marked person warning perimeter, and the behavior monitoring data set contains all the key behavior information of the person within the perimeter, such as residence time, movement path, action mode, etc., providing rich data support for subsequent abnormal behavior analysis. Through the above steps, the precise monitoring and data analysis of the activities of people in the target area provides a solid foundation for the subsequent abnormal behavior warning.

[0012] The feature analysis module M300 is used to analyze the perimeter distribution characteristics of the identified personnel warning perimeter, and the perimeter distribution characteristics include embedded hierarchical distribution and non-embedded horizontal distribution. The embedded hierarchical distribution includes the movement behavior of personnel in multiple nested areas, and the non-embedded horizontal distribution includes the movement behavior of personnel in multiple independent but parallel areas.

[0013] Furthermore, the feature analysis module M300 is used to perform the following method: Analyze the connection relationship between each perimeter in the identified personnel warning perimeter to form a personnel trajectory connection network; identify the perimeter range of each perimeter in the identified personnel warning perimeter; perform overlapping relationship analysis based on the personnel trajectory connection network and the perimeter range to identify perimeter distribution characteristics.

[0014] Optionally, when analyzing the perimeter distribution characteristics of the identification personnel warning perimeter, further, two distribution modes are targeted: embedded hierarchical distribution and non-embedded horizontal distribution. The embedded hierarchical distribution refers to the presence of multiple nested areas in the warning perimeter, and these areas contain each other according to a certain hierarchical relationship; the non-embedded horizontal distribution refers to the warning perimeter consisting of multiple independent but parallel areas, and there is no direct nesting relationship between these areas.

[0015] Among them, when people move in the nested areas corresponding to the embedded hierarchical distribution, their behavior will be affected and restricted by the perimeters of different levels. This distribution feature reflects the complex relationship and hierarchical structure between areas, which is of great significance for analyzing the behavior patterns of people in multi-level spaces. By analyzing the embedded hierarchical distribution, we can better understand the movement rules and behavior preferences of people between different levels, so as to more accurately judge whether there are abnormal behaviors. In the areas corresponding to the non-embedded horizontal distribution, people can move freely in different parallel areas, and their behavior is affected by the rules and restrictions set independently in each area. Non-embedded horizontal distribution is common in areas that need to be monitored independently but are interrelated, such as different teaching buildings on campus, different production lines in factories, etc. By analyzing the non-embedded horizontal distribution, we can understand the activities of people in each independent area and identify abnormal behavior patterns across areas.

[0016] In summary, an in-depth analysis of the perimeter distribution characteristics of the warning perimeter of marked personnel can help to more comprehensively understand the movement behavior of personnel in different types of areas and provide a more accurate and reliable basis for subsequent abnormal behavior warnings.

[0017] More specifically, the perimeter distribution characteristics of the identified personnel warning perimeter are analyzed to clarify the position and layout of each perimeter in the physical space; map data collection and processing are involved, including but not limited to GPS coordinates, building layout, and road network; a network diagram composed of various perimeter nodes is constructed, in which the nodes represent the perimeters and the edges represent the connection relationships between the perimeters (such as adjacent, reachable, etc.); in the process of constructing the network diagram, special attention should be paid to the actual passage paths and obstacles between the perimeters. For example, two adjacent perimeters may not be directly accessible due to natural or man-made obstacles such as walls and rivers. In this case, these obstacles need to be taken into account when constructing the network diagram to avoid the formation of incorrect connection relationships; then, a personnel trajectory connection network is formed, which reflects the possible movement paths and methods of the identified personnel between different perimeters.

[0018] After determining the connectivity of the perimeters, the next step is to identify the specific scope of each perimeter, which usually involves precise measurement and calibration of the perimeter boundaries, which can be accomplished using GIS (Geographic Information System) technology. Through the GIS system, you can clearly see the shape, size, and relationship of each perimeter with other geographic elements. When identifying the scope of the perimeter, you also need to pay attention to the complexity and diversity of the perimeter. For example, some perimeters contain multiple sub-areas or floors, each with its own unique layout and traffic rules. Therefore, when identifying the scope of the perimeter, you need to fully consider these internal details for more accurate analysis and early warning.

[0019] After obtaining the personnel trajectory connection network and perimeter range information, an overlapping relationship analysis is performed. Overlapping relationship analysis refers to checking whether there is spatial overlap or intersection between different perimeters, and the possible impact of such overlap or intersection on personnel trajectory and early warning mechanism; through overlapping relationship analysis, the distribution characteristics of perimeters are identified, such as embedded hierarchical distribution (one perimeter is completely located inside another perimeter) or non-embedded horizontal distribution (multiple perimeters are independent of each other on the same plane but may be crossed). Embedded hierarchical distribution and non-embedded horizontal distribution are of great significance for the subsequent formulation of early warning strategies and optimization of monitoring layout; in addition, overlapping relationship analysis can identify potential monitoring blind spots or overlapping monitoring areas, and can also optimize the configuration and utilization of monitoring resources. For example, when it is found that there is an overlapping monitoring area between two perimeters, the position and angle of the monitoring camera can be adjusted to avoid waste of resources and repeated monitoring.

[0020] In summary, by analyzing the perimeter connection relationship, identifying the perimeter range, and conducting overlapping relationship analysis, we can fully understand the layout and characteristics of the warning perimeter of the identification personnel, and provide strong support for the subsequent warning mechanism design and optimization.

[0021] The model building module M400 is used to build a cross-regional behavior pattern anomaly analysis model, wherein the cross-regional behavior pattern anomaly analysis model includes a hierarchical behavior pattern anomaly analysis network and a horizontal behavior pattern anomaly analysis network.

[0022] Since the behavioral anomaly discrimination methods of the two distribution characteristics of embedded hierarchical distribution and non-embedded horizontal distribution require different processing and analysis strategies to accurately identify abnormal behaviors, further, targeting the complexity of perimeter distribution characteristics, a model architecture consisting of two parts: a hierarchical behavior pattern anomaly analysis network and a horizontal behavior pattern anomaly analysis network is constructed.

[0023] Among them, the hierarchical behavior pattern anomaly analysis network is used to process the behavior pattern anomaly analysis under embedded hierarchical distribution; by constructing a multi-level neural network structure, it simulates the movement path and behavior changes of personnel in the nested area; each layer of the network corresponds to a warning perimeter of a level, which can capture the behavior characteristics of personnel in the level and identify abnormal behaviors that do not conform to the normal behavior pattern; at the same time, the networks between different levels will transmit and interact information to comprehensively evaluate whether the overall behavior pattern of personnel in the multi-level space is abnormal. The horizontal behavior pattern anomaly analysis network corresponds to the hierarchical network, and the horizontal behavior pattern anomaly analysis network focuses on the behavior pattern analysis under non-embedded horizontal distribution; using parallel processing, an independent analysis unit is assigned to each independent but parallel warning perimeter; each analysis unit is responsible for capturing the behavior characteristics of personnel in the corresponding area, and through certain algorithm logic, comparison and correlation analysis are performed to identify abnormal behavior patterns across regions; the design of the horizontal network enables the system to efficiently process a large amount of parallel data and quickly respond to abnormal behaviors across regions.

[0024] When constructing a cross-regional behavior pattern anomaly analysis model, it is also necessary to consider the collaborative working mechanism between different networks. Through reasonable algorithm design and parameter tuning, it is ensured that the hierarchical networks and horizontal networks can seamlessly connect and complement each other to jointly achieve a comprehensive and accurate analysis of cross-regional behavior patterns. At the same time, the model also needs to have self-learning and adaptive capabilities, and be able to continuously optimize its own analysis performance and warning accuracy based on historical data and real-time feedback.

[0025] The abnormality analysis module M500 is used for the cross-regional behavior pattern abnormality analysis model to perform abnormality analysis according to the perimeter distribution characteristics of the identified personnel warning perimeter and the behavior monitoring data set to generate a first abnormality warning signal.

[0026] Further, in the first case, the abnormality analysis module M500 is used to perform the following method: If the perimeter distribution characteristic of the identified personnel warning perimeter is an embedded hierarchical distribution, the behavior monitoring data set is subjected to an anomaly analysis according to the hierarchical behavior pattern anomaly analysis network to extract the hierarchical entry sequence, hierarchical entry frequency and hierarchical residence time; abnormal behavior pattern recognition is performed according to the hierarchical entry sequence, hierarchical entry frequency and hierarchical residence time to obtain the behavior deviation degree; if the behavior deviation degree is greater than the preset deviation degree, a first abnormal warning signal is triggered.

[0027] Further, in the second case, the abnormality analysis module M500 is also used to execute the following method: If the perimeter distribution characteristic of the identified personnel warning perimeter is a non-embedded horizontal distribution, the behavior monitoring data set is subjected to an abnormality analysis according to the horizontal behavior pattern abnormality analysis network to extract the horizontal cross frequency, horizontal residence time and horizontal activity frequency; abnormal behavior pattern recognition is performed according to the horizontal cross frequency, horizontal residence time and horizontal activity frequency to obtain the behavior deviation degree; if the behavior deviation degree is greater than the preset deviation degree, a first abnormal warning signal is triggered.

[0028] After receiving the perimeter distribution characteristics of the warning perimeter of the marked personnel and the corresponding behavior monitoring data set, the cross-regional behavior pattern anomaly analysis model will immediately start the anomaly analysis process; comprehensively utilizing the complexity of the perimeter distribution characteristics and the richness of the behavior monitoring data, through preset algorithms and logical rules, it will conduct an in-depth analysis of the behavior patterns of personnel during cross-regional movement. Furthermore, in the anomaly analysis process, the cross-regional behavior pattern anomaly analysis model will logically divide the target area according to the perimeter distribution characteristics (including embedded hierarchical distribution and non-embedded horizontal distribution), and conduct targeted analysis on the behavior characteristics under different distribution patterns.

[0029] In the first case, for the embedded hierarchical distribution, the cross-regional behavior pattern anomaly analysis model will focus on key indicators such as the movement trajectory, residence time, and behavior pattern changes of personnel between multiple nested areas to determine whether they have violated hierarchical rules or exceeded the normal behavior range.

[0030] To be more specific, when the perimeter distribution characteristics of the warning perimeter of the marked personnel are embedded hierarchical distribution, the hierarchical behavior pattern anomaly analysis network will extract key behavior indicators related to the embedded hierarchical distribution from the behavior monitoring data set based on the behavior monitoring data set, including the hierarchical entry order, the hierarchical entry frequency, and the hierarchical residence time. The key behavior indicators related to the embedded hierarchical distribution directly reflect the movement patterns and behavioral habits of personnel in multi-level spaces.

[0031] Among them, the hierarchical entry order refers to the order in which personnel enter each nested area; by analyzing the hierarchical entry order, the hierarchical behavior pattern anomaly analysis network can determine whether the movement path of personnel conforms to normal logic or preset rules. For example, in some scenarios, personnel may be required to pass through the outer area before entering the inner area. Any behavior that violates this order may be considered abnormal. The hierarchical entry frequency reflects the frequency of personnel's movement between various hierarchical areas. The hierarchical behavior pattern anomaly analysis network will compare the entry frequency under normal circumstances with the currently monitored frequency to identify whether there is abnormally frequent hierarchical switching or staying in a certain level for a long time without entering other levels. The hierarchical residence time refers to the length of time that personnel stay in each hierarchical area. By analyzing the hierarchical residence time, the hierarchical behavior pattern anomaly analysis network can determine whether personnel stay in a certain hierarchical area for too long or too short, which may be related to illegal stay, abnormal activities or emergencies.

[0032] In a feasible implementation of the present application, the hierarchical behavior pattern anomaly analysis network will use preset algorithms and logical rules to identify abnormal behavior patterns and calculate the behavior deviation, that is, the degree of deviation between the actual behavior and the normal behavior pattern; if the behavior deviation is greater than the preset deviation threshold, it indicates that there is a significant abnormality in the current behavior pattern and immediate measures need to be taken to intervene; at this time, the cross-regional behavior pattern anomaly analysis model will trigger the first abnormal warning signal to notify relevant personnel to pay attention and take corresponding safety response measures. Through the above steps, the hierarchical behavior pattern anomaly analysis network can realize accurate monitoring and abnormal warning of personnel behavior under embedded hierarchical distribution, providing strong support for improving the level of regional security prevention.

[0033] In the second case, for non-embedded horizontal distribution, the cross-regional behavior pattern anomaly analysis model will focus on the activity correlation and behavior consistency of analysts between independent regions to identify possible cross-regional abnormal behaviors.

[0034] To be more specific, when the perimeter distribution characteristics of the identification personnel warning perimeter are non-embedded horizontal distribution, the horizontal behavior pattern anomaly analysis network will receive and process the behavior monitoring data set; the horizontal behavior pattern anomaly analysis network extracts key behavior characteristics related to the horizontal behavior pattern anomaly analysis from the behavior monitoring data set, and the key behavior characteristics related to the horizontal behavior pattern anomaly analysis include horizontal crossing frequency, horizontal residence time and horizontal activity frequency. The key behavior characteristics related to the horizontal behavior pattern anomaly analysis reflect the activity characteristics of personnel in multiple independent but parallel areas.

[0035] Among them, horizontal cross frequency refers to the frequency of personnel moving between various horizontal areas, reflecting the activity of personnel in multiple areas. Horizontal residence time refers to the length of time personnel stay in each horizontal area, which may reveal the special attention or abnormal stay of personnel in a certain area. Horizontal activity frequency refers to the frequency of various activities carried out by personnel in horizontal areas, such as entering and exiting, talking, operating, etc. These activities may differ from normal behavior patterns.

[0036] In a feasible implementation of the present application, the horizontal behavior pattern anomaly analysis network uses preset algorithms and logical rules to identify abnormal behavior patterns; compares the difference between actual behavior characteristics and normal behavior patterns, and calculates the behavior deviation degree, which is a quantitative indicator used to measure the degree of deviation between actual behavior and normal behavior patterns; if the calculated behavior deviation degree is greater than the preset deviation degree threshold, it indicates that there is a significant abnormality in the current behavior pattern and immediate measures need to be taken to intervene; at this time, the horizontal behavior pattern anomaly analysis network will trigger the first abnormal warning signal to notify relevant personnel to pay attention and take corresponding safety response measures. Through the above steps, the horizontal behavior pattern anomaly analysis network can realize accurate monitoring and abnormal warning of personnel behavior under non-embedded horizontal distribution, which is of great significance for maintaining regional safety and preventing potential risks.

[0037] Then, with the support of the behavior monitoring data set, the cross-regional behavior pattern anomaly analysis model can extract key data points related to abnormal behavior, such as abnormal movement speed, abnormal stop position, abnormal behavior frequency, etc., and compare the corresponding data points with the preset threshold or behavior pattern library; once the actual behavior is found to be significantly different from the normal pattern or exceeds the preset range, the cross-regional behavior pattern anomaly analysis model will immediately determine it as abnormal behavior and generate the first abnormal warning signal. The generation of the first abnormal warning signal indicates that the system has successfully identified potential threats or risks, providing timely and accurate information support for subsequent security response and disposal measures. According to the level and content of the warning signal, relevant personnel can quickly take corresponding measures, such as strengthening monitoring, on-site verification, emergency evacuation, etc., to ensure the safety and stability of the target area.

[0038] Further, in the first case, the abnormality analysis module M500 is further used to execute the following method: The hierarchical behavior pattern anomaly analysis network is obtained by training the first historical abnormal behavior data set through the LSTM network and the GNN network, the LSTM network is used to capture time series features, and the GNN network is used to capture hierarchical structure features; wherein, the first historical abnormal behavior data set is a hierarchical abnormal behavior data sample; a first loss function is introduced to optimize the loss data of the LSTM network and the CNN network until a preset accuracy rate is met, and the hierarchical behavior pattern anomaly analysis network is activated.

[0039] The hierarchical behavior pattern anomaly analysis network is obtained by combining the LSTM network and the GNN network to train the first historical abnormal behavior dataset, aiming to simultaneously capture time series features and hierarchical structure features to more accurately identify and analyze hierarchical abnormal behaviors.

[0040] The LSTM network is used to capture time series features. LSTM (Long Short-Term Memory Network) is a special recurrent neural network (RNN) that can effectively process long-term dependencies in time series data. In the analysis of hierarchical behavior pattern anomalies, LSTM can learn the time evolution patterns in historical abnormal behavior data to help predict possible abnormal behaviors in the future. The GNN network is used to capture hierarchical structure features. GNN (Graph Neural Network) is a neural network that specializes in processing graph structure data and can be represented in the form of a graph, where nodes represent entities at different levels (such as departments, teams, or individuals) and edges represent the relationships between levels. GNN can learn complex patterns and features in these hierarchical relationships, thereby improving the accuracy of anomaly detection.

[0041] Among them, the first historical abnormal behavior data set is a data set composed of hierarchical abnormal behavior data samples, which is used to train the hierarchical behavior pattern abnormal analysis network; the hierarchical abnormal behavior data samples contain abnormal behavior records that have occurred in history, including the timestamp of the behavior, hierarchical information, behavior type, etc.

[0042] In order to train the LSTM network and CNN network, it is necessary to define the first loss function, which is used to measure the difference between the network prediction result and the actual result; through the back-propagation algorithm, the weight and bias of the network are continuously adjusted to minimize the value of the loss function; when the loss value corresponding to the first loss function is reduced to meet the preset accuracy, it is considered that the training has been completed, and the hierarchical behavior pattern anomaly analysis network is activated for practical application. At the same time, it is also necessary to consider how to balance the contribution of the LSTM and GNN networks in the overall model, and how to deal with factors such as noise and imbalance in the data. As new data is continuously generated, the trained network is further optimized and updated to improve the adaptability and accuracy of the hierarchical behavior pattern anomaly analysis network.

[0043] Further, in the second case, the abnormality analysis module M500 is also used to execute the following method: The horizontal behavior pattern anomaly analysis network is obtained by training the second historical abnormal behavior data set through a clustering network and a decision tree network. The clustering network is used to cluster the activity pattern characteristics of personnel, and the decision tree network is used to classify normal and abnormal behavior patterns and calculate the behavior deviation degree; wherein, the second historical abnormal behavior data set is a horizontal abnormal behavior data sample; a second loss function is introduced to optimize the loss data of the clustering network and the decision tree network until the preset accuracy rate is met, and the horizontal behavior pattern anomaly analysis network is activated.

[0044] The horizontal behavior pattern anomaly analysis network is obtained by training the second historical abnormal behavior data set by combining a clustering network and a decision tree network. It aims to analyze the activity patterns of people in the horizontal area to identify normal and abnormal behavior patterns and calculate the degree of behavior deviation, which is very important for maintaining perimeter security, monitoring employee behavior and other scenarios.

[0045] Among them, the clustering network is used to cluster the characteristics of people's activity patterns, including their movement trajectories, stay time, activity types, etc. Through clustering, people with similar activity patterns can be grouped to facilitate subsequent analysis and identification; commonly used clustering algorithms include K-means, DBSCAN, hierarchical clustering, etc. The specific algorithm to be selected depends on the characteristics of the data and the needs of the analysis. The decision tree network is used to classify normal and abnormal behavior patterns and calculate the degree of behavioral deviation; through training, the decision tree can learn which feature combinations correspond to normal behavior and which correspond to abnormal behavior, and classify the newly input activity patterns accordingly. At the same time, it can also quantify the degree of deviation between the behavior and the normal pattern; the decision tree is a commonly used classification and regression method that recursively selects the optimal features to divide the data set and construct a decision tree network.

[0046] Among them, the second historical abnormal behavior data set is a data set composed of horizontal abnormal behavior data samples, which is used to train the horizontal behavior pattern abnormal analysis network; the horizontal abnormal behavior data samples contain historical activity records of people in the horizontal area, including normal behavior and abnormal behavior.

[0047] In order to train the clustering network and decision tree network, it is necessary to introduce a second loss function, which is used to measure the difference between the model prediction result and the actual result; for the clustering network, the second loss function is based on the evaluation index of the clustering effect (such as the silhouette coefficient, Calinski-Harabasz index, etc.); for the decision tree network, the classification error rate or cross entropy loss is usually used; further, by adjusting the parameters of the clustering algorithm and the decision tree network and minimizing the loss value corresponding to the second loss function, the performance of the clustering network and the decision tree network is optimized; when the loss value corresponding to the second loss function is reduced to meet the preset accuracy, it is considered that the training has been completed, and the horizontal behavior pattern anomaly analysis network is activated for practical application. In practical applications, the horizontal behavior pattern anomaly analysis network can monitor the activity patterns of people in the horizontal area in real time and automatically identify abnormal behaviors; once abnormal behaviors are detected, an early warning signal can be immediately issued, and corresponding behavior deviation information can be provided so that relevant personnel can take timely countermeasures.

[0048] Furthermore, the abnormality analysis module M500 is also used to execute the following method: After the first abnormal warning signal is triggered, the hierarchical abnormality persistence and the horizontal abnormality persistence are detected; when either the hierarchical abnormality persistence or the horizontal abnormality persistence is greater than or equal to a preset persistence threshold, the second abnormal warning signal is triggered.

[0049] When the first abnormal warning signal is triggered, it is necessary to continue to detect the persistence of abnormal behavior to evaluate whether a higher level of warning measures need to be taken. Further, the hierarchical abnormal persistence and horizontal abnormal persistence are detected, where the hierarchical abnormal persistence refers to the length of time or degree of hierarchical abnormal behavior after the first abnormal warning signal is triggered. The hierarchical abnormal persistence is used to measure whether the hierarchical abnormal behavior persists and whether it is likely to evolve into a more serious security incident. It is necessary to continuously monitor the personnel behavior data in the hierarchical area, calculate and update the hierarchical abnormal persistence. The horizontal abnormal persistence refers to the duration and degree of horizontal abnormal behavior after the first abnormal warning signal is triggered. The horizontal abnormal persistence reflects the stability and persistence of abnormal behavior in the horizontal area, which is also important for evaluating whether the warning level needs to be upgraded.

[0050] After monitoring the hierarchical abnormality persistence or the horizontal abnormality persistence, the hierarchical abnormality persistence will be compared with the preset persistence threshold, and the horizontal abnormality persistence will be compared with the preset persistence threshold. The preset persistence threshold is set according to security policies, historical data and actual conditions, and is used to determine whether the abnormal behavior has reached the level that requires higher-level warning measures: if either the hierarchical abnormality persistence or the horizontal abnormality persistence is greater than or equal to the preset persistence threshold, it is considered that the current abnormal behavior has continued for a period of time or has reached a certain level of severity, and there is a certain probability that it will pose a greater threat to security. Therefore, the second abnormal warning signal will be triggered. The triggering of the second abnormal warning signal means that more urgent and effective response measures need to be taken to curb the further development of abnormal behavior and ensure safety in the perimeter area.

[0051] Through the above steps, different types of abnormal behaviors can be identified and handled more accurately, ensuring that when abnormal behaviors persist and may escalate into higher-level security incidents, corresponding measures can be taken in a timely manner to ensure personnel safety.

[0052] In summary, the beneficial effects of the embodiments of the present application are: 1. Through real-time monitoring and intelligent analysis, early warnings can be issued before abnormal behaviors develop into actual threats. Machine learning models can be used to train more accurate behavior patterns based on historical data, reducing false positive and false negative rates.

[0053] 2. By building a cross-regional behavior pattern anomaly analysis model, we can provide more accurate early warning services based on the characteristics of different regions and the behavioral habits of the population. By combining high-performance computing capabilities and optimized algorithms, we can achieve real-time data processing and feedback, and improve the response speed of abnormal behavior warnings.

[0054] 3. Since the hierarchical behavior pattern anomaly analysis network is used to train the first historical abnormal behavior data set through the LSTM network and the GNN network, the LSTM network is used to capture time series features, and the GNN network is used to capture hierarchical structure features; among them, the first historical abnormal behavior data set is a hierarchical abnormal behavior data sample; the first loss function is introduced to optimize the loss data of the LSTM network and the CNN network until the preset accuracy is met, and the hierarchical behavior pattern anomaly analysis network is activated. With the continuous generation of new data, the trained network is further optimized and updated to improve the adaptability and accuracy of the hierarchical behavior pattern anomaly analysis network. Example 2

[0055] Based on the same inventive concept as the personnel dynamic early warning method based on behavior pattern analysis in the aforementioned embodiment, Figure 2 As shown, the present application provides a personnel dynamic early warning method based on behavior pattern analysis, wherein the method comprises: S1: Configure multiple personnel warning perimeters based on the target area; S2: Capturing the movement trajectory of personnel, identifying the marked personnel warning perimeter from the personnel warning perimeter according to the movement trajectory of personnel, and extracting the behavior monitoring data set of personnel in the marked personnel warning perimeter; S3: analyzing the perimeter distribution characteristics of the identified personnel warning perimeter, wherein the perimeter distribution characteristics include embedded hierarchical distribution and non-embedded horizontal distribution, wherein the embedded hierarchical distribution includes the movement behavior of personnel in multiple nested areas, and the non-embedded horizontal distribution includes the movement behavior of personnel in multiple independent but parallel areas; S4: constructing a cross-regional behavior pattern anomaly analysis model, wherein the cross-regional behavior pattern anomaly analysis model includes a hierarchical behavior pattern anomaly analysis network and a horizontal behavior pattern anomaly analysis network; S5: The cross-regional behavior pattern anomaly analysis model performs an anomaly analysis based on the perimeter distribution characteristics of the identified personnel warning perimeter and the behavior monitoring data set to generate a first anomaly warning signal.

[0056] Furthermore, the cross-regional behavior pattern anomaly analysis model performs anomaly analysis based on the perimeter distribution characteristics of the identified personnel warning perimeter and the behavior monitoring data set. The method of this application includes: If the perimeter distribution feature of the identified personnel warning perimeter is an embedded hierarchical distribution, an anomaly analysis is performed on the behavior monitoring data set according to the hierarchical behavior pattern anomaly analysis network to extract the hierarchical entry sequence, hierarchical entry frequency and hierarchical residence time; According to the level entry sequence, level entry frequency and level residence time, abnormal behavior pattern recognition is performed to obtain the behavior deviation degree; If the behavior deviation is greater than a preset deviation, a first abnormal warning signal is triggered.

[0057] Furthermore, the present application method also includes: The hierarchical behavior pattern anomaly analysis network is obtained by training the first historical abnormal behavior data set through an LSTM network and a GNN network, wherein the LSTM network is used to capture time series features, and the GNN network is used to capture hierarchical structure features; Wherein, the first historical abnormal behavior data set is a hierarchical abnormal behavior data sample; A first loss function is introduced to optimize the loss data of the LSTM network and the CNN network until a preset accuracy rate is met, and the hierarchical behavior pattern anomaly analysis network is activated.

[0058] Furthermore, the cross-regional behavior pattern anomaly analysis model performs anomaly analysis based on the perimeter distribution characteristics of the identified personnel warning perimeter and the behavior monitoring data set, and the method of the present application also includes: If the perimeter distribution feature of the identified personnel warning perimeter is a non-embedded horizontal distribution, an abnormal analysis is performed on the behavior monitoring data set according to the horizontal behavior pattern abnormal analysis network to extract horizontal crossing frequency, horizontal residence time and horizontal activity frequency; Perform abnormal behavior pattern recognition based on the horizontal crossover frequency, horizontal stay time, and horizontal activity frequency to obtain a behavior deviation degree; If the behavior deviation is greater than a preset deviation, a first abnormal warning signal is triggered.

[0059] Furthermore, the application method includes: The horizontal behavior pattern abnormality analysis network is obtained by training the second historical abnormal behavior data set through a clustering network and a decision tree network, wherein the clustering network is used to cluster the activity pattern characteristics of personnel, and the decision tree network is used to classify normal and abnormal behavior patterns and calculate the behavior deviation degree; Wherein, the second historical abnormal behavior data set is a level abnormal behavior data sample; A second loss function is introduced to optimize the loss data of the clustering network and the decision tree network until the preset accuracy rate is met, and the horizontal behavior pattern anomaly analysis network is activated.

[0060] Further, the perimeter distribution characteristics of the identified personnel warning perimeter are analyzed, and the perimeter distribution characteristics include embedded hierarchical distribution and non-embedded horizontal distribution. The method of the present application includes: Analyze the connection relationship between each perimeter in the identified personnel warning perimeter to form a personnel trajectory connection network; Identify the perimeter range of each perimeter in the identified personnel warning perimeter; An overlapping relationship analysis is performed based on the personnel trajectory connection network and the perimeter range to identify perimeter distribution characteristics.

[0061] Furthermore, after the first abnormal warning signal is triggered, the method of the present application further includes: After the first abnormal warning signal is triggered, the hierarchical abnormality persistence and the horizontal abnormality persistence are detected; When any one of the layer abnormality persistence or the horizontal abnormality persistence is greater than or equal to a preset persistence threshold, a second abnormality warning signal is triggered.

[0062] In summary, any step can be stored as a computer instruction or program in an unlimited computer memory, and can be called and recognized by an unlimited computer processor, and no unnecessary restrictions are made here.

[0063] Furthermore, the above-mentioned technical scheme only reflects the preferred technical scheme of the technical scheme of the embodiment of the present application. Some changes that may be made to some parts thereof by technicians in this technical field all reflect the novel principles of the embodiment of the present application. Obviously, technicians in this field can make various changes and modifications to the present application without departing from the scope of the present application.

Claims

1. A personnel dynamic early warning device based on behavior pattern analysis, characterized in that: The device comprises: Warning perimeter configuration module, used to configure multiple personnel warning perimeters based on the target area; A monitoring module, used to capture the movement trajectory of personnel, identify the marked personnel warning perimeter from the personnel warning perimeter according to the movement trajectory of personnel, and extract the behavior monitoring data set of personnel in the marked personnel warning perimeter; A feature analysis module, used to analyze the perimeter distribution features of the identified personnel warning perimeter, wherein the perimeter distribution features include embedded hierarchical distribution and non-embedded horizontal distribution, wherein the embedded hierarchical distribution includes the movement behavior of personnel in multiple nested areas, and the non-embedded horizontal distribution includes the movement behavior of personnel in multiple independent but parallel areas; A model building module, used to build a cross-regional behavior pattern anomaly analysis model, wherein the cross-regional behavior pattern anomaly analysis model includes a hierarchical behavior pattern anomaly analysis network and a horizontal behavior pattern anomaly analysis network; The abnormality analysis module is used for the cross-regional behavior pattern abnormality analysis model to perform abnormality analysis according to the perimeter distribution characteristics of the identified personnel warning perimeter and the behavior monitoring data set to generate a first abnormality warning signal.

2. The device according to claim 1, characterized in that The cross-regional behavior pattern anomaly analysis model performs anomaly analysis based on the perimeter distribution characteristics of the identified personnel warning perimeter and the behavior monitoring data set, including: If the perimeter distribution feature of the identified personnel warning perimeter is an embedded hierarchical distribution, an anomaly analysis is performed on the behavior monitoring data set according to the hierarchical behavior pattern anomaly analysis network to extract the hierarchical entry sequence, hierarchical entry frequency and hierarchical residence time; According to the level entry sequence, level entry frequency and level residence time, abnormal behavior pattern recognition is performed to obtain the behavior deviation degree; If the behavior deviation is greater than a preset deviation, a first abnormal warning signal is triggered.

3. The device according to claim 2, characterized in that The hierarchical behavior pattern anomaly analysis network is obtained by training the first historical abnormal behavior data set through an LSTM network and a GNN network, wherein the LSTM network is used to capture time series features, and the GNN network is used to capture hierarchical structure features; Wherein, the first historical abnormal behavior data set is a hierarchical abnormal behavior data sample; A first loss function is introduced to optimize the loss data of the LSTM network and the CNN network until a preset accuracy rate is met, and the hierarchical behavior pattern anomaly analysis network is activated.

4. The device according to claim 1, characterized in that The cross-regional behavior pattern anomaly analysis model performs anomaly analysis based on the perimeter distribution characteristics of the identified personnel warning perimeter and the behavior monitoring data set, and further includes: If the perimeter distribution feature of the identified personnel warning perimeter is a non-embedded horizontal distribution, an abnormal analysis is performed on the behavior monitoring data set according to the horizontal behavior pattern abnormal analysis network to extract horizontal crossing frequency, horizontal residence time and horizontal activity frequency; Perform abnormal behavior pattern recognition based on the horizontal crossover frequency, horizontal stay time, and horizontal activity frequency to obtain a behavior deviation degree; If the behavior deviation is greater than a preset deviation, a first abnormal warning signal is triggered.

5. The device according to claim 4, characterized in that The horizontal behavior pattern abnormality analysis network is obtained by training the second historical abnormal behavior data set through a clustering network and a decision tree network, wherein the clustering network is used to cluster the activity pattern characteristics of personnel, and the decision tree network is used to classify normal and abnormal behavior patterns and calculate the behavior deviation degree; Wherein, the second historical abnormal behavior data set is a level abnormal behavior data sample; A second loss function is introduced to optimize the loss data of the clustering network and the decision tree network until the preset accuracy rate is met, and the horizontal behavior pattern anomaly analysis network is activated.

6. The device according to claim 1, characterized in that Analyze the perimeter distribution characteristics of the identified personnel warning perimeter, the perimeter distribution characteristics include embedded hierarchical distribution and non-embedded horizontal distribution, including: Analyze the connection relationship between each perimeter in the identified personnel warning perimeter to form a personnel trajectory connection network; Identify the perimeter range of each perimeter in the identified personnel warning perimeter; An overlapping relationship analysis is performed based on the personnel trajectory connection network and the perimeter range to identify perimeter distribution characteristics.

7. The device according to claim 1, characterized in that After the first abnormal warning signal is triggered, the following steps are also included: After the first abnormal warning signal is triggered, the hierarchical abnormality persistence and the horizontal abnormality persistence are detected; When any one of the layer abnormality persistence or the horizontal abnormality persistence is greater than or equal to a preset persistence threshold, a second abnormality warning signal is triggered.

8. A personnel dynamic early warning method based on behavior pattern analysis is characterized by: A personnel dynamic early warning device based on behavior pattern analysis for implementing any one of claims 1 to 7, the method comprising: Configure multiple personnel warning perimeters based on the target area; Capturing the movement trajectory of personnel, identifying and marking the personnel warning perimeter from the personnel warning perimeter according to the movement trajectory of personnel, and extracting the behavior monitoring data set of personnel in the marked personnel warning perimeter; Analyze the perimeter distribution characteristics of the identified personnel warning perimeter, wherein the perimeter distribution characteristics include embedded hierarchical distribution and non-embedded horizontal distribution, wherein the embedded hierarchical distribution includes the movement behavior of personnel in multiple nested areas, and the non-embedded horizontal distribution includes the movement behavior of personnel in multiple independent but parallel areas; Constructing a cross-regional behavior pattern anomaly analysis model, wherein the cross-regional behavior pattern anomaly analysis model includes a hierarchical behavior pattern anomaly analysis network and a horizontal behavior pattern anomaly analysis network; The cross-regional behavior pattern anomaly analysis model performs an anomaly analysis based on the perimeter distribution characteristics of the identified personnel warning perimeter and the behavior monitoring data set to generate a first anomaly warning signal.

Images