Intelligent security management system based on AI large model

Abstract

The invention discloses an intelligent security and protection management system based on an AI large model, and relates to the technical field of security and protection management, the intelligent security and protection management system comprises a modal large model and a chained reasoning module, the chained reasoning module comprises a distributed chained reasoning sub-module, and a preset chained reasoning algorithm process is adopted to execute the following steps: scene segmentation and target detection; quantifying risk factors; constructing a causal relationship; threat scene simulation; and risk assessment calculation. According to the method, the multi-modal large model and the chain reasoning module are designed, multi-modal information is extracted and fused in real time to form the risk state matrix, the risk situation is deduced step by step, the problem that the multi-causal relationship and dynamic change in a complex scene are difficult to capture in traditional single-layer anomaly detection is solved, the risk identification accuracy is remarkably improved, and the risk identification efficiency is improved. The false alarm and the missing alarm are reduced, and the accurate prejudgment of the global security situation is provided for the system.

Description

Technical Field

[0001] The present invention relates to the technical field of security management, and specifically to an intelligent security management system based on an AI large model. Background Art

[0002] Currently, most traditional security systems rely on fixed rules and static models, making it difficult to handle complex and changing security scenarios and data noise problems. At the same time, the phenomenon of data islands is serious among various subsystems, and a global security situation cannot be formed.

[0003] To break through these limitations, this design proposes an intelligent security management system based on an AI large model. By constructing a virtual replication of the real environment through digital twins and combining multi-modal data deep fusion and chain reasoning, panoramic, intelligent, and proactive security prevention and control are achieved, improving the system response speed and decision-making accuracy.

[0004] Patent document CN118840812B discloses an intelligent security management system and method based on the Internet of Things. The above patent realizes more precise guidance of the flow of people and avoids congestion and chaos.

[0005] The above patent can adjust the lighting guidance strategy in real time according to the real-time monitored crowd density information. When the crowd density changes, the color, brightness, and flashing frequency of the lights can be changed in a timely manner to adapt to different evacuation needs and handle different situations, but the problems of multiple causal relationships and dynamic changes in complex scenarios have not been fully solved; Therefore, this application proposes an intelligent security management system based on an AI large model that can extract and fuse multi-modal information in real time to form a risk state matrix and gradually deduce the risk situation. Summary of the Invention

[0006] The purpose of the present invention is to provide an intelligent security management system based on an AI large model to solve the technical problem that most current traditional security systems rely on fixed rules and static models and are difficult to handle complex and changing security scenarios as mentioned in the above background art.

[0007] To achieve the above purpose, the present invention provides the following technical solution: An intelligent security management system based on an AI large model, including a modal large model and a chain reasoning module. The chain reasoning module includes: Multi-modal data input unit: Using a convolutional neural network to perform preliminary feature extraction on image data and a recurrent neural network to perform preliminary feature extraction on audio and time series data; Feature fusion unit based on Transformer: Performing weighted fusion on the feature vectors extracted from each modality and generating a fusion vector using the self-attention mechanism; Distributed chain reasoning sub-module, which executes the following steps using a preset chain reasoning algorithm process: a. Scene segmentation and object detection, using the object detection algorithm based on YOLO; b. Risk factor quantification, using a multi-layer perceptron to quantify the features of the target area; c. Causal relationship construction, establishing a causal association matrix between risk factors through a graph neural network and using Bayesian inference for probability update; d. Threat scenario simulation, using a state transition model based on a Markov chain for iterative prediction; e. Risk assessment calculation, using a gradient descent optimization algorithm to finely adjust the risk score.

[0008] Preferably, the multi-modal data input unit uses a preprocessing algorithm to perform gray-scale normalization, edge detection, and image enhancement on the image, performs short-time Fourier transform and Mel-frequency cepstral coefficient extraction on the audio data, and normalizes the sensor time-series data. The preprocessing results are used as the input of the Transformer encoder.

[0009] Preferably, the Transformer-based feature fusion unit uses a multi-head self-attention mechanism, specifically including: Generating query Q, key K, and value V vectors by linearly transforming each modal data; Calculating the attention score for each head respectively ; Using residual connection and layer normalization to post-process the fusion result and output the fusion feature vector for the subsequent distributed chain reasoning sub-module.

[0010] Preferably, in the distributed chain reasoning sub-module, the region proposal algorithm of the Faster R-CNN network structure is used in the scene segmentation and object detection stage, the precise positioning of the target area is realized by using the region convolution feature, and the candidate regions are screened by using the intersection over union criterion.

[0011] Preferably, a graph neural network is used in the causal relationship construction stage, and the specific steps include: Regarding each target area feature as a graph node, calculating the initial adjacency matrix by using the cosine similarity of the preliminary correlation between each node; Using the graph convolutional layer to perform information propagation and update on the node features, and the formula is ; Combining the Bayesian inference method, quantifying the risk factors by updating the prior probability and the likelihood function, and outputting the risk state matrix.

[0012] Preferably, a state transition module based on a Markov chain is used in the threat scenario simulation stage, and the specific steps include: Defining the state space as {S0 , S 1 ,..., S n} represents different risk levels; By calculating the state transition probability matrix P, where P ij = Pr(S t+1 = S j | S t = S i ); Use the iterative update algorithm to predict the future state until it converges to the preset error limit, and output the final risk assessment value.

[0013] Preferably, the intelligent security management system further includes a dynamic identity authentication module, and the dynamic identity authentication module includes: A behavioral biometric acquisition unit that acquires user gait, key press rhythm, and mouse trajectory data through a camera, an accelerometer, and a touchpad; A feature extraction unit that uses convolutional and recurrent neural networks to extract temporal features from the data acquired by the behavioral biometric acquisition unit; A siamese network structure to achieve real-time feature matching. The input is the current user feature vector and the pre-stored template vector, which are compared using cosine similarity, and an identity credibility score is output; The dynamic identity authentication module further uses a weighted fusion algorithm to perform weighted fusion on the multi-modal behavioral feature quantities. The weights are automatically learned and determined by a network based on the attention mechanism, and a support vector machine is used to perform classification determination on the fusion result to achieve real-time identity anomaly detection.

[0014] Preferably, the intelligent security management system further includes a real-time adaptive anomaly detection module, and the real-time adaptive anomaly detection module includes: An anomaly detection unit based on an autoencoder that uses an encoder-decoder structure to reconstruct multi-modal data, and uses the reconstruction error as an anomaly score; A threshold dynamic adjustment unit based on reinforcement learning that uses the Q-learning algorithm to update the action value function and continuously updates the anomaly determination threshold according to historical event feedback; An anomaly feedback closed loop that uses a generative adversarial network to generate a normal sample distribution, and further corrects the anomaly detection model parameters by comparing the difference between the real-time data distribution and the generated sample distribution.

[0015] Preferably, the intelligent security management system further includes a global security situation awareness and collaborative decision-making module, and the global security situation awareness and collaborative decision-making module includes: A distributed data center that uses the MQTT protocol to perform real-time transmission and caching of multi-modal data from each regional subsystem; The data fusion and denoising unit uses weighted average and Kalman filtering algorithms to perform spatio-temporal alignment and noise suppression on data from different sources; The multi-agent collaborative decision-making sub-module uses multi-agent reinforcement learning based on policy gradients to collaboratively calculate the risk indices of each region, uses an LSTM network to predict the trends of time series data, and generates specific intervention measures through a decision tree.

[0016] Preferably, the intelligent security management system further includes a data acquisition and fusion unit, a digital twin engine, and an active warning and decision support module; The data acquisition and fusion unit integrates cameras, lidars, infrared sensors, environmental monitors, and audio acquisition modules to respectively acquire image data, depth data, thermal imaging data, environmental parameters, and audio data, and performs temporal and spatial alignment on each data through a synchronization algorithm based on timestamps and spatial tags; The digital twin engine uses a three-dimensional reconstruction method based on structured light to generate a three-dimensional model of the physical environment data in real time and continuously updates it using sparse reconstruction and dense matching techniques; The active warning and decision support module inputs the risk values and state matrices output by the chain reasoning module into the warning algorithm, and generates specific intervention instructions using threshold determination and decision tree methods.

[0017] Compared with the prior art, the beneficial effects of the present invention are: 1. By designing a multi-modal large model and a chain reasoning module, the present invention realizes the real-time extraction and fusion of multi-modal information to form a risk state matrix, gradually deduces the risk situation, breaks through the problem that traditional single-layer anomaly detection is difficult to capture multi-causal relationships and dynamic changes in complex scenarios, significantly improves the risk recognition accuracy, reduces false alarms and missed detections, and provides an accurate pre-judgment of the global security situation for the system; 2. By designing the construction of a digital twin environment, the present invention realizes the real-time virtual replication of the physical space, provides an accurate background for data fusion and risk reasoning, overcomes the problems that traditional security systems cannot intuitively reflect environmental changes and lack a global perspective, enables the security system to have the ability of holographic scene perception, and provides richer environmental information support for intelligent decision-making; 3. By designing a real-time adaptive anomaly detection module, the present invention realizes the real-time anomaly detection of multi-modal data and adaptively adjusts the detection criteria according to environmental changes, solves the problems of misjudgment and insufficient sensitivity caused by fixed thresholds in complex scenarios, significantly improves the accuracy and adaptability of anomaly detection, reduces the false alarm and missed detection rate, and ensures the stable operation of the system; 4. The present invention realizes global security situation awareness and cross-regional collaborative decision-making by designing a global security situation awareness and collaborative decision-making module, overcomes the problems of data islands in each subsystem of traditional security systems, lack of global security situation assessment and intelligent decision-making, greatly improves the response speed and decision-making accuracy of security incidents, realizes intelligent linkage prevention and control, and ensures overall security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a schematic diagram of the security management process of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0020] Please refer to Figure 1 , an embodiment provided by the present invention: an intelligent security management system based on an AI large model, the intelligent security management system further includes a data acquisition and fusion unit, a digital twin engine, and an active warning and decision support module; The data acquisition and fusion unit integrates cameras, lidar, infrared sensors, environmental monitors, and audio acquisition modules, respectively acquires image data, depth data, thermal imaging data, environmental parameters, and audio data, and performs time series and spatial alignment on each data through a synchronization algorithm based on timestamps and spatial tags; The digital twin engine uses a three-dimensional reconstruction method based on structured light to generate a three-dimensional model of the physical environment data in real time, and continuously updates it using sparse reconstruction and dense matching technologies; The active warning and decision support module inputs the risk value and status matrix output by the chain reasoning module into the warning algorithm, and generates specific intervention instructions using the threshold determination and decision tree methods; It includes a multi-modal large model and a chain reasoning module, and the chain reasoning module includes: Multi-modal data input unit: uses a convolutional neural network to perform preliminary feature extraction on image data, and a recurrent neural network to perform preliminary feature extraction on audio and time series data; Feature fusion unit based on Transformer: performs weighted fusion on the feature vectors extracted from each modality, and generates a fusion vector using the self-attention mechanism; Distributed chain reasoning sub-module, which executes the following steps using a preset chain reasoning algorithm process: a. Scene segmentation and target detection, using a target detection algorithm based on YOLO; b. Risk factor quantification, using a multi-layer perceptron to quantify the features of the target area; c. Causal relationship construction, establishing a causal association matrix between risk factors through a graph neural network and using Bayesian inference for probability update; d. Threat scenario simulation, using a state transition model based on a Markov chain for iterative prediction; e. Risk assessment calculation, using the gradient descent optimization algorithm to finely adjust the risk score; Furthermore, the image data is input into a convolutional neural network for feature extraction to identify features such as the color and texture of the target. The audio data is input into a recurrent neural network for speech and abnormal sound recognition, such as glass breakage and distress call detection. The lidar data is processed by PointNet to extract spatial geometric features. Combining with RFID data, a preliminary match of the target identity is performed. The multi-head attention mechanism is used to fuse the feature data of different modalities, and the position encoding is used to ensure the integrity of the data time series information, generating a unified high-dimensional feature vector for subsequent inference and analysis; The YOLOv5 network is used for target detection, and the detection range includes pedestrians, vehicles, drones, etc. Combining with environmental information, three-dimensional spatial positioning of the target is performed. For the target behavior characteristics, a multi-layer perceptron is used to calculate the degree of abnormality. For example, abnormal stay of personnel, unauthorized activities at night, abnormal crowd density, etc. are all used as risk factors. A graph neural network is used to construct the causal association between the target and environmental factors, such as the relationship between "a person staying in a dangerous area for too long" and "potential accident risk", and the risk probability is updated through Bayesian inference. Based on the Markov chain, the risk state transition is simulated, such as: abnormal stay → attempt to break in → illegal intrusion, and the state transition probability matrix is used to predict the subsequent development trend. The gradient descent optimization algorithm is used to finely adjust the risk score and optimize the evaluation criteria in combination with historical data; Set a risk threshold. When the risk score exceeds the threshold, an alarm is triggered. Combining with a decision tree model, countermeasures are automatically generated, such as warning broadcasts, blocking channels, notifying security personnel, etc. For example, when it is found that unauthorized personnel enter a high-risk area at night, the system will automatically link the access control system to lock the channel and play a warning message through the intelligent broadcast system.

[0021] Please refer to Figure 1 As shown in [a certain reference], an embodiment provided by the present invention: An intelligent security management system based on an AI large model. The multi-modal data input unit uses a preprocessing algorithm to perform gray normalization, edge detection, and image enhancement on the image, performs short-time Fourier transform and Mel-frequency cepstral coefficient extraction on the audio data, and normalizes the sensor time series data. The preprocessing results are used as the input of the Transformer encoder; The Transformer-based feature fusion unit adopts a multi-head self-attention mechanism, which specifically includes: Generating query Q, key K, and value V vectors by linearly transforming each modality data; Calculating the attention scores for each head respectively ; Using residual connection and layer normalization to post-process the fusion result and output the fused feature vector for the subsequent distributed chain inference sub-module; Furthermore, for image, audio, and sensor data, features are extracted using CNN, RNN, and statistical methods respectively, and mapped to the same high-dimensional vector space. Query Q, key K, and value V vectors are obtained through linear transformation, Q = W q F, K = W k F, V = W v F, where W q W k W v is a trainable weight matrix, and F represents the input feature vector; Calculating the attention weights between each modality data using scaled dot-product attention ; Among them, d k is the scaling factor of the feature dimension to ensure numerical stability; Dividing the query, key, and value vectors into h parts respectively, and calculating the attention independently for each part: Head i = Attention(QW q i , KW k i , VW v i ), and finally fusing the outputs of each head, h represents the number of attention heads, and W q i W k i W v i represents the weight of the i-th head; To prevent gradient vanishing or gradient explosion, residual connection is adopted, F res = F input + MultiHead(Q, K, V), F input represents the input feature, and MultiHead(Q, K, V) represents the output of the multi-head attention; Adopting layer normalization:

[0022] Among them, x represents the input feature vector, μ is the mean, σ is the standard deviation, and ε represents a small constant to prevent division by zero; Finally, the fused high-dimensional feature vector will be used in the distributed chain reasoning submodule to achieve risk assessment, anomaly detection and decision support in intelligent security scenarios.

[0023] See also Figure 1 , an embodiment provided by the present invention: an intelligent security management system based on an AI large model, wherein in the distributed chain reasoning submodule, a region proposal algorithm of a Faster R-CNN network structure is used in the scene segmentation and target detection stages, the regional convolution feature is used to achieve accurate positioning of the target area, and the intersection-over-union ratio standard is used to screen the candidate areas; The causal relationship construction stage adopts a graph neural network, and the specific steps include: Each target region feature is used as a graph node, and the initial correlation between nodes is calculated using cosine similarity to form an initial adjacency matrix; The graph convolution layer is used to propagate and update node features. The formula is: ; Combined with the Bayesian reasoning method, the risk factors are quantified by updating the prior probability and likelihood function, and the risk state matrix is ​​output; The threat scenario simulation stage adopts a state transfer module based on Markov chain, and the specific steps include: Define the state space as {S 0 ,S 1 ,...,S n} indicates different risk levels; By calculating the state transition probability matrix P, where P ij =Pr(S t+1 =S j 丨S t =S i ); Use iterative update algorithms to predict future states until they converge to the preset error limit and output the final risk assessment value; Furthermore, the input image is used to extract features through a convolutional neural network to generate multiple candidate regions, i.e. anchor boxes. Each anchor box is classified as a target or background and regressed to the bounding box position of the target. The generated candidate region is compared with the real annotation box for intersection over union (IoU). IoU measures the overlap between the candidate region and the annotation box and is often used to screen the quality of the candidate box. Generally, a threshold is set to exclude areas that do not meet the conditions. Intersection ratio formula: Among them, A is the candidate area, and B is the real marked area; Regional feature extraction: F=CNN(I), I is the input image, F is the feature map extracted from image I; Target area classification and regression: Class(p i )=σ(Wp F i +b p ),BBox(p i )=W r F i +b r Among them, p i is the category of the i-th candidate region, F i is the feature of the i-th candidate region, W p W r is the weight matrix for classification and regression, b p b r is the bias term; Node construction and preliminary correlation calculation: The feature vector of each target region is used as a node of the graph. The similarity between nodes is calculated through cosine similarity, thereby constructing an initial adjacency matrix:

[0024] u is the feature vector of node u, v is the feature vector of node v, and the denominator represents the L2 norm of the node feature; The graph convolutional layer propagates the features of each node with the features of its neighbor nodes, and uses the graph convolutional layer to propagate and update the node features. The formula is

[0025] Among them, H(l) represents the node feature matrix of the l-th layer. Each row corresponds to the feature vector of a target region, and the initial input is the multi-modal feature vector; H(l + 1) represents the updated node feature matrix of the l + 1-th layer, that is, the feature representation after information propagation; A is the adjacency matrix, representing the initial connection relationship between target regions; D is the degree matrix, which is a diagonal matrix; D －1 / 2 AD －1 / 2 is the normalized adjacency matrix, which is used to prevent the features from expanding as the number of layers increases, making the information propagation more stable; W(l) is the trainable weight matrix, which is used to linearly transform the feature information of different layers and is continuously optimized during the training process to enhance the relationship modeling ability between nodes; σ(·) is the activation function, which is used to introduce non-linear features, enabling the network to learn complex causal relationships; The process of graph convolution is completed through the adjacency matrix, and the features of the nodes are weighted and updated; H’ = σ(A’XW), H’ represents the updated node feature, A’ represents the standardized adjacency matrix, X represents the input feature matrix, W represents the weight matrix, and σ represents the activation function; The prior probability and likelihood function are updated through the Bayesian inference method to quantify risk factors.

[0026] Among them, P(Risk|Evidence) is the risk probability given evidence, P(Evidence|Risk) is the likelihood of evidence, P(Risk) is the prior risk probability, and P(Evidence) is the total probability of evidence. In the threat scenario simulation stage, the Markov chain model is used to simulate the transfer process of risk levels and evaluate future threat scenarios. By calculating the state transition probability matrix, the changes in future states are simulated: Define the state space: The state space {S 0 , S 1 ,..., S n} represents different risk levels, S 0 is the safest state, and S n is the most dangerous state; The key of the Markov chain model lies in calculating the probability matrix P of state transition, where Pij represents the probability of transitioning from state S i to state S j : P ij = Pr(S t+1 = S j |S t = S i ); represents the transition probability from state S i to state S j ; S t is the current state, and S t+1 is the state at the next moment; The iterative method is used to update the prediction of the state until the prediction result converges to the preset error limit: P （t+1） = P （t） ·P; P （t） represents the state transition matrix at the t-th iteration, and P （t+1） represents the state transition matrix at the (t + 1)-th iteration. Through continuous iteration, the state transition matrix gradually stabilizes, and finally the final risk assessment value can be output.

[0027] Please refer to Figure 1 , an embodiment provided by the present invention: An intelligent security management system based on an AI large model, the intelligent security management system further includes a dynamic identity authentication module, and the dynamic identity authentication module includes: The behavioral biometric acquisition unit collects user gait, key press rhythm, and mouse trajectory data through a camera, an accelerometer, and a touchpad; The feature extraction unit uses convolutional and recurrent neural networks to extract temporal features from the data collected by the behavioral biometric acquisition unit; The siamese network structure realizes real-time feature matching. The inputs are the current user feature vector and the pre-stored template vector. The cosine similarity is used for comparison, and an identity confidence score is output; The dynamic identity authentication module further uses a weighted fusion algorithm to perform weighted fusion on the multi-modal behavioral feature quantities. The weights are automatically learned and determined by a network based on the attention mechanism, and a support vector machine is used to classify and determine the fusion result to achieve real-time identity anomaly detection; Furthermore, a gait image sequence is collected by a camera, and acceleration and angular velocity data are extracted in combination with an accelerometer and a gyroscope to obtain gait dynamic change features. The key press time series is recorded through a touchpad or a keyboard, and the mouse movement trajectory, acceleration, and click pattern are recorded through mouse event monitoring; A convolutional neural network is used to process the gait images to extract spatial features, and a long short-term memory network is used to model the gait sequence in the time dimension to capture the dynamic change features of the gait: F gait =LSTM(CNN(X gait ))), where X gait represents the gait data input, CNN represents the convolutional neural network for extracting spatial features, LSTM represents the long short-term memory network for processing temporal data, and F gait represents the gait feature vector; The key press time series X key is input into a unidirectional LSTM network to extract time-dependent features: F key =LSTM(X key ); The mouse trajectory data is converted into a two-dimensional trajectory map and input into a CNN to extract local features, and then the trajectory pattern is extracted: F mouse =CNN(X mouse ); The siamese network is used to compare the current user feature vector with the pre-stored identity template vector to calculate the similarity. Two identical CNN-RNN networks respectively process the input data, including the current user behavior features and the pre-stored template features, and calculate the cosine similarity between the two sets of feature vectors:

[0028] Finput represents the current user behavior feature vector; Ftemplate represents the pre-stored user template feature vector; S is the identity confidence score, and the value range is [0, 1]; if S is lower than the set threshold T, the system determines that the identity is abnormal; Use a weighted fusion algorithm to combine three features: gait, case rhythm, and mouse trajectory. The weights are automatically learned by the attention mechanism. Use a support vector machine to classify the fused features, determine whether the user is legal, and trigger an identity anomaly alarm to notify security personnel for handling.

[0029] Please refer to Figure 1 , an embodiment provided by the present invention: an intelligent security management system based on an AI large model, the intelligent security management system further includes a real-time adaptive anomaly detection module, and the real-time adaptive anomaly detection module includes: Anomaly detection unit based on autoencoder, which uses an encoder-decoder structure to reconstruct multimodal data and uses the reconstruction error as an anomaly score; Threshold dynamic adjustment unit based on reinforcement learning, which uses the Q-learning algorithm to update the action value function and continuously updates the anomaly determination threshold according to the historical event feedback; Anomaly feedback closed loop, which uses a generative adversarial network to generate a normal sample distribution and further corrects the anomaly detection model parameters by comparing the difference between the real-time data distribution and the generated sample distribution; Furthermore, multimodal data such as images, audio, and sensor time-series data from different subsystems are first preprocessed, including normalization, denoising, and dimension alignment. The processed data is input into the encoder, which is responsible for mapping the original data to a low-dimensional latent variable space and extracting core features. The low-dimensional feature vector is transmitted to the decoder, which attempts to reconstruct the original data from the latent variable, calculates the reconstruction error, that is, the difference between the original input data and the reconstructed data, as an anomaly scoring metric. When the reconstruction error exceeds a preset threshold, the system determines that the current data may be abnormal, generates an anomaly scoring matrix, and marks the events with scores higher than the threshold as abnormal events and enters the subsequent decision-making process; Initially set a set of default anomaly judgment thresholds, fine-tune them according to the historical data of the system, and use the false positive rate and false negative rate as feedback indicators in combination with the historical event records. Use the Q-learning algorithm, and the system performs reinforcement learning according to the historical judgment results to update the anomaly judgment threshold. Set a reward mechanism. When the new threshold setting reduces false positives or false negatives, the system gives a positive reward, otherwise it makes adjustments. By continuously learning and optimizing the threshold setting strategy, it adapts to the anomaly detection requirements in different environments; Adopt a generative adversarial network to train the generator with historical normal data to generate samples consistent with the normal data distribution, obtain the distribution characteristics of real-time input data, and compare them with the generated sample distribution. If the difference exceeds a certain range, the system adjusts the autoencoder and threshold setting to better adapt to the current data environment; when the misjudgment rate of abnormal events is detected to be high, it is fed back to the autoencoder to optimize the reconstruction ability and improve the accuracy of anomaly detection; when the anomaly score does not meet the system expectation, it is fed back to the threshold dynamic adjustment unit to optimize the decision-making strategy.

[0030] Please refer to Figure 1 , an embodiment provided by the present invention: an intelligent security management system based on an AI large model, the intelligent security management system further includes a global security situation awareness and collaborative decision-making module, and the global security situation awareness and collaborative decision-making module includes: A distributed data center for real-time transmission and caching of multimodal data from each regional subsystem using the MQTT protocol; A data fusion and denoising unit that uses weighted average and Kalman filtering algorithms to perform spatio-temporal alignment and noise suppression on data from different sources; A multi-agent collaborative decision-making sub-module that uses multi-agent reinforcement learning based on policy gradients to collaboratively calculate the risk index of each region, uses an LSTM network to predict the trend of time series data, and generates specific intervention measures through a decision tree; Furthermore, each regional subsystem uploads multimodal data, including images, environmental parameters, audio, etc., through the MQTT protocol. The server-side parses the data and stores it in the cache system to achieve low-latency and high-throughput data transmission; the weighted average algorithm is used to fuse multi-sensor data to reduce the instability of single-sensor data, and Kalman filtering is used to remove sensor noise to improve the stability and credibility of the data; multi-agent reinforcement learning calculates the risk index of each region and optimizes the global security policy, the LSTM network performs time series prediction to predict possible future security events in advance, and the decision tree algorithm generates specific intervention measures, including automatic alarm, area blockade, dispatching security personnel, etc.

[0031] Working principle: The system first synchronously collects multimodal data from cameras, lidar, infrared sensors, environmental monitors, and audio acquisition modules through a distributed data acquisition and fusion unit. After these data are aligned with time stamps and spatial tags, they are transmitted to the digital twin engine. The engine uses structured light three-dimensional reconstruction technology to continuously update and maintain the three-dimensional digital twin model of the physical environment through sparse reconstruction and dense matching, providing a real-time and accurate virtual environment mapping for subsequent data processing; Based on the digital twin model, the system utilizes the modal large model and the chain reasoning module to deeply fuse and gradually reason about multimodal data. First, the multimodal data is respectively processed by the preprocessing unit, such as image normalization, edge detection, audio spectrum conversion, etc., and then input into the feature fusion unit based on Transformer, and a unified high-dimensional feature vector is obtained through the multi-head self-attention mechanism. Then, the distributed chain reasoning sub-module sequentially performs scene segmentation, object detection, risk factor quantification, causal relationship construction, and threat scenario simulation, and finally outputs the risk score and the risk status matrix to provide an accurate security situation assessment for the system; The system further integrates a real-time adaptive anomaly detection module and a global security situation awareness and collaborative decision-making module. The anomaly detection module reconstructs the multimodal data based on the autoencoder, judges the anomaly situation through the reconstruction error, dynamically adjusts the anomaly threshold using reinforcement learning, and at the same time uses the generative adversarial network to feedback and correct the model parameters to ensure the high precision and self-adaptability of anomaly detection. At the same time, the global security situation awareness module uses the MQTT protocol to realize the real-time transmission of data from each regional subsystem, completes data fusion and denoising through weighted average and Kalman filtering, and then uses multi-agent reinforcement learning and the LSTM network to collaboratively calculate and trend predict the risk indices of each region. Finally, specific intervention measures are generated in combination with the decision tree to achieve intelligent response and linkage decision-making for global security events.

[0032] For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic characteristics of the present invention. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-limiting. The scope of the present invention is defined by the appended claims rather than the above description. Therefore, all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be embraced within the present invention. Any reference signs in the claims should not be regarded as limiting the claims involved.

Claims

1. An intelligent security management system based on an AI big model, comprising a modal big model and a chain reasoning module, characterized in that: The chain reasoning module includes: Multimodal data input unit: Use convolutional neural networks to extract preliminary features from image data and recurrent neural networks to extract features from audio and time series data; Transformer-based feature fusion unit: performs weighted fusion on the feature vectors extracted from each modality and generates a fusion vector using the self-attention mechanism; The distributed chain reasoning submodule uses the preset chain reasoning algorithm process to perform the following steps: a. Scene segmentation and target detection, using the YOLO-based target detection algorithm; b. Quantification of risk factors: using a multi-layer perceptron to quantify the characteristics of the target area; c. Causal relationship construction: establish a causal association matrix between risk factors through graph neural networks, and use Bayesian reasoning to update the probability; d. Threat scenario simulation, using a state transition model based on Markov chain for iterative prediction; e. Risk assessment calculation, using gradient descent optimization algorithm to fine-tune the risk score.

2. According to claim 1, an intelligent security management system based on an AI big model is characterized by: The multimodal data input unit uses a preprocessing algorithm to perform grayscale normalization, edge detection and image enhancement on the image, performs short-time Fourier transform and Mel-frequency cepstral coefficient extraction on the audio data, and normalizes the sensor time series data. The preprocessing result is used as the input of the Transformer encoder.

3. According to claim 1, the intelligent security management system based on AI big model is characterized by: The Transformer-based feature fusion unit adopts a multi-head self-attention mechanism, specifically including: Each modal data is linearly transformed to generate query Q, key K, value V vectors; Calculate the attention score for each head separately ; Residual connection and layer normalization are used to post-process the fusion results, and the fused feature vector is output for the subsequent distributed chain reasoning submodule.

4. According to claim 1, the intelligent security management system based on AI big model is characterized by: In the distributed chain reasoning submodule, the scene segmentation and target detection stages use the region proposal algorithm of the Faster R-CNN network structure, use regional convolution features to accurately locate the target area, and use the intersection-over-union standard to screen the candidate areas.

5. According to claim 1, the intelligent security management system based on AI big model is characterized by: The causal relationship construction stage adopts a graph neural network, and the specific steps include: Each target region feature is used as a graph node, and the initial correlation between nodes is calculated using cosine similarity to form an initial adjacency matrix; The graph convolution layer is used to propagate and update node features. The formula is: ; Combined with the Bayesian reasoning method, the risk factors are quantified by updating the prior probability and likelihood function, and the risk status matrix is ​​output.

6. According to claim 1, the intelligent security management system based on AI big model is characterized by: The threat scenario simulation stage adopts a state transfer module based on Markov chain, and the specific steps include: Define the state space as {S0,S1,...,S n } indicates different risk levels; By calculating the state transition probability matrix P, where P ij = Pr(S t+1 = S j | S t = S i ); The iterative update algorithm is used to predict the future state until it converges to the preset error limit and outputs the final risk assessment value.

7. The intelligent security management system based on AI big model according to claim 1 is characterized by: The intelligent security management system further includes a dynamic identity authentication module, which includes: Behavioral biometrics collection unit, which collects user gait, keystroke rhythm and mouse trajectory data through cameras, accelerometers and touchpads; The feature extraction unit uses convolutional and recurrent neural networks to extract time series features from the data collected by the behavior biometric feature collection unit; The twin network structure realizes real-time feature matching. The input is the current user feature vector and the pre-stored template vector. The cosine similarity is used for comparison and the identity credibility score is output. The dynamic identity authentication module further adopts a weighted fusion algorithm to perform weighted fusion on multimodal behavioral features. The weights are determined by automatic learning of the network based on the attention mechanism, and the fusion results are classified and determined by the support vector machine to achieve real-time identity anomaly detection.

8. The intelligent security management system based on AI big model according to claim 1 is characterized by: The intelligent security management system further includes a real-time adaptive anomaly detection module, which includes: The autoencoder-based anomaly detection unit uses an encoder-decoder structure to reconstruct multimodal data and uses the reconstruction error as anomaly score; The threshold dynamic adjustment unit based on reinforcement learning uses the Q-learning algorithm to update the action value function and continuously updates the abnormality judgment threshold based on historical event feedback; The anomaly feedback loop uses a generative adversarial network to generate normal sample distribution, and further corrects the anomaly detection model parameters by comparing the difference between the real-time data distribution and the generated sample distribution.

9. The intelligent security management system based on AI big model according to claim 1 is characterized by: The intelligent security management system further includes a global security situation awareness and collaborative decision-making module, which includes: The distributed data center uses the MQTT protocol to transmit and cache multimodal data from each regional subsystem in real time; The data fusion and denoising unit uses weighted averaging and Kalman filtering algorithms to perform spatiotemporal alignment and noise suppression on data from different sources; The multi-agent collaborative decision-making submodule adopts multi-agent reinforcement learning based on policy gradient to collaboratively calculate the risk index of each region, uses the LSTM network to predict the trend of time series data, and generates specific intervention measures through the decision tree.

10. The intelligent security management system based on AI big model according to claim 1 is characterized by: The intelligent security management system also includes a data acquisition and fusion unit, a digital twin engine, and an active early warning and decision support module; The data acquisition and fusion unit integrates cameras, lidar, infrared sensors, environmental monitors and audio acquisition modules to collect image data, depth data, thermal imaging data, environmental parameters and audio data respectively, and aligns the time sequence and space of each data through a synchronization algorithm based on timestamps and spatial tags; The digital twin engine uses a 3D reconstruction method based on structured light to generate a 3D model from physical environment data in real time, and continuously updates it using sparse reconstruction and dense matching technology; The active warning and decision support module inputs the risk value and state matrix output by the chain reasoning module into the warning algorithm, and uses threshold judgment and decision tree methods to generate specific intervention instructions.

Images