Intelligent security data analysis decision method and system based on artificial intelligence

Abstract

The invention provides an intelligent security and protection data analysis and decision method and system based on artificial intelligence. The method comprises the following steps: firstly, collecting heterogeneous data streams such as video frame sequences, infrared sensing signals, audio waveforms and equipment state logs uploaded by a plurality of security and protection monitoring equipment in a target area; multi-modal feature extraction is carried out through the spatial-temporal feature fusion model, and spatial-temporal feature vectors containing equipment deployment coordinates and the like are generated; dynamically dividing equipment clusters based on a self-adaptive clustering algorithm, so that the spatial-temporal feature vector similarity of the equipment in the same cluster is high; secondly, for each cluster, analyzing abnormal signal relevance by using an abnormal propagation network model to obtain a cluster-level risk prediction result and an equipment collaborative response instruction; and finally, according to the risk prediction result, dynamically adjusting the node weight of the abnormal propagation network model and the clustering center of the adaptive clustering algorithm, optimizing subsequent cluster division, and improving the accuracy and intelligence of intelligent security data analysis decision.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an intelligent security data analysis and decision-making method and system based on artificial intelligence. Background Art

[0002] With the development of society and the advancement of science and technology, the field of intelligent security has received widespread attention. Driven by the need to ensure the safety of various places, the intelligence level of security systems has been continuously improved. However, the current intelligent security technology still has many limitations when facing complex and changing actual scenarios.

[0003] Traditional security data analysis methods often focus on processing only a single type of data. For example, most systems rely only on video surveillance data, ignoring other important information sources such as infrared sensor signals, audio waveforms, and device status logs. This single data analysis method cannot fully and accurately reflect the actual security status of the target area, and is prone to missing many potential security threats.

[0004] For the processing of multi-source data, even if previous technologies try to integrate different types of data, they only perform simple splicing or shallow correlation analysis, and it is difficult to explore the deep internal connections between data. These methods fail to fully consider the spatiotemporal characteristics of the data and the environmental context information, and cannot effectively extract features that can accurately describe the security scene, resulting in low accuracy and reliability of the analysis results.

[0005] In terms of device management and cluster division, traditional technologies mostly use static division methods. Fixed device grouping rules are pre-set without considering the actual operating status and correlation changes of devices at different times and in different environments. When the security situation in the target area changes dynamically, this static division method cannot adapt in time, making subsequent data analysis inefficient and difficult to quickly and accurately detect abnormal situations.

[0006] In terms of anomaly analysis and risk prediction, existing security systems usually perform independent anomaly detection on a single device, lacking in-depth analysis of the correlation between abnormal signals between devices. It is impossible to grasp security risks from a holistic level, and it is impossible to predict possible chain reactions or complex security incidents in advance, resulting in incomplete and in-time decision-making in the face of complex security threats, and it is difficult to take effective coordinated response measures. Summary of the invention

[0007] In view of the above-mentioned problems, in combination with the first aspect of the present invention, an embodiment of the present invention provides an intelligent security data analysis and decision-making method based on artificial intelligence, the method comprising: Collect heterogeneous data streams uploaded in real time by multiple security monitoring devices within the target area, where the heterogeneous data streams include video frame sequences, infrared sensing signals, audio waveforms, and device status logs; Perform multi-modal feature extraction on the heterogeneous data streams through a spatio-temporal feature fusion model to generate spatio-temporal feature vectors corresponding to each security monitoring device, where the spatio-temporal feature vectors include device deployment coordinates, monitoring timestamps, environmental context correlation degrees, and abnormal signal intensities; Based on the spatio-temporal feature vectors, use an adaptive clustering algorithm to perform dynamic cluster partitioning on the multiple security monitoring devices to generate multiple device clusters, where the similarity of security monitoring devices within the same device cluster in terms of spatio-temporal feature vectors is greater than the similarity of devices across clusters; For each device cluster, analyze the abnormal signal correlation of security monitoring devices within the device cluster through an abnormal propagation network model to generate cluster-level risk prediction results and device collaborative response instructions; According to the cluster-level risk prediction results, dynamically adjust the node weights of the abnormal propagation network model and update the clustering centers of the adaptive clustering algorithm to optimize subsequent cluster partitioning.

[0008] On the other hand, an embodiment of the present invention further provides an intelligent security data analysis and decision-making system based on artificial intelligence, including a processor and a machine-readable storage medium, where the machine-readable storage medium is connected to the processor, the machine-readable storage medium is used to store programs, instructions, or codes, and the processor is used to execute the programs, instructions, or codes in the machine-readable storage medium to implement the above method.

[0009] Based on the above aspects, the embodiments of the present application collect various heterogeneous data streams within the target area, covering video frame sequences, infrared sensing signals, audio waveforms, and device status logs, breaking through the limitation of traditional security data analysis that only relies on a single type of data. Through a spatio-temporal feature fusion model for multi-modal feature extraction, spatio-temporal feature vectors including device deployment coordinates, monitoring timestamps, environmental context correlation degrees, and abnormal signal intensities are generated, which can comprehensively and meticulously depict the complex scene information monitored by security monitoring devices. This way of fusing multi-source heterogeneous data and extracting deep features greatly improves the perception accuracy of the security situation in the target area and can discover potential security hazards that are difficult to detect by traditional methods.

[0010] Using an adaptive clustering algorithm, dynamic cluster division is performed on multiple security monitoring devices based on spatio-temporal feature vectors. Devices within the same device cluster have high similarity in spatio-temporal feature vectors, forming a distinct contrast with devices across clusters. Compared with traditional fixed clustering methods, this dynamic cluster division can adapt to changes in the security situation within the target area in real time and automatically adjust the device cluster structure. For example, the relevance between devices may change at different time periods or under different environmental conditions. The adaptive clustering algorithm can quickly respond to these changes to ensure that the cluster division always matches the actual security scenario, thereby improving the pertinence and efficiency of subsequent data analysis.

[0011] For each device cluster, the anomaly propagation network model is used to deeply analyze the anomaly signal relevance of security monitoring devices. It can not only accurately generate cluster-level risk prediction results but also give device collaboration response instructions. This analysis method based on the network model fully considers the complex interaction relationships between devices, can predict potential security risks in advance, and formulate collaborative response strategies. Compared with traditional simple anomaly detection methods, this method can more deeply explore the logical relationships behind anomaly signals and achieve more intelligent and comprehensive security decision-making.

[0012] According to the cluster-level risk prediction results, the node weights of the anomaly propagation network model are dynamically adjusted, and the clustering centers of the adaptive clustering algorithm are updated, forming an intelligent iterative optimization mechanism. This self-optimization ability enables the system to continuously learn and adapt to newly emerging security situations. Over time, the model and algorithm can perform risk prediction and device cluster division more accurately, thereby continuously improving the performance and reliability of the entire intelligent security data analysis and decision-making system. Description of the Drawings

[0013] Figure 1 It is a schematic execution flow diagram of an intelligent security data analysis and decision-making method based on artificial intelligence provided by an embodiment of the present invention.

[0014] Figure 2 It is a schematic hardware architecture diagram of an intelligent security data analysis and decision-making system based on artificial intelligence provided by an embodiment of the present invention. Detailed Embodiments

[0015] The present invention will be specifically described below in conjunction with the accompanying drawings of the specification. Figure 1 It is a schematic flow diagram of an intelligent security data analysis and decision-making method based on artificial intelligence provided by an embodiment of the present invention. The intelligent security data analysis and decision-making method based on artificial intelligence will be introduced in detail below.

[0016] Step S110, collect the heterogeneous data streams uploaded in real time by multiple security monitoring devices within the target area. The heterogeneous data streams include video frame sequences, infrared sensing signals, audio waveforms, and device status logs.

[0017] In this embodiment, consider an industrial park as the target area, where various security monitoring devices are distributed. Multiple cameras are installed at various corners of the industrial park, such as at the entrance and exit of the park, around production workshops, near warehouses, and along the roads inside the park. These cameras collect video frame sequences in real time. The video frame sequences contain information about the activities of personnel in the park, the driving trajectories of vehicles, and the overall picture of each area. For example, a camera at the entrance of a production workshop in the park can continuously capture information such as the appearance characteristics of employees entering the workshop, the items they carry, and the entry time. A series of video frames are generated every second, and these video frames, when connected together, form a video frame sequence.

[0018] At the same time, infrared sensing devices are installed in some key areas, such as around warehouses storing flammable items. These infrared sensing devices continuously upload infrared sensing signals. When an object with abnormal temperature approaches the warehouse, such as a vehicle that has just been driven and has a high engine temperature approaching the warehouse, the infrared sensing device can detect the presence of the heat source and send out the infrared sensing signal, which contains various information about the heat source, such as the approximate location of the heat source and the intensity of the heat.

[0019] Audio monitoring devices are also installed in different areas of the park. These audio monitoring devices record the sounds in the park in real time to form audio waveforms. For example, in the office area of the park, the audio monitoring devices can capture the conversations between employees, the working sounds of printers, etc.; in the public area of the park, the sounds of vehicle driving, broadcast announcements, etc. may be captured.

[0020] In addition, each security monitoring device itself generates a device status log. Taking the camera as an example, the device status log records the working status of the camera, such as whether it is operating normally, whether the lens is blocked, whether the storage device is full, etc.; for the infrared sensing device, the device status log includes information such as the temperature calibration of the device and whether the signal transmission is normal; the device status log of the audio monitoring device records whether the volume detection range of the device is normal and whether there is a microphone failure, etc. The video frame sequences, infrared sensing signals, audio waveforms, and device status logs uploaded in real time by all these different types of security monitoring devices constitute the heterogeneous data streams, and these heterogeneous data streams are collected uniformly for subsequent processing.

[0021] Step S120: Use a spatio-temporal feature fusion model to perform multi-modal feature extraction on the heterogeneous data stream, generating a spatio-temporal feature vector corresponding to each security monitoring device. The spatio-temporal feature vector includes device deployment coordinates, monitoring timestamps, environmental context correlation degrees, and abnormal signal strengths.

[0022] Still taking the industrial park as an example, for the collected video frame sequence, optical flow analysis is performed in this embodiment. For example, in the video frame sequence collected by the camera at the park entrance, when a car drives into the park, the trajectory of the moving target of the car and the consistency parameter of the driving direction of the car can be accurately extracted through optical flow analysis. If the car drives straight into the park along the specified lane, then the motion direction consistency parameter is relatively high; if the car makes abnormal turns or sways, this parameter will reflect this abnormal situation.

[0023] For the infrared sensing signal, frequency domain transformation is performed. Suppose an infrared sensing device near the warehouse detects a heat source approaching the warehouse. After frequency domain transformation, the heat source distribution density can be extracted, such as whether it is concentrated in a small area or relatively dispersed. If it is a faulty electrical device generating heat, the heat source distribution may be relatively concentrated; if it is due to the generally high ambient air temperature caused by hot weather, the heat source distribution may be relatively dispersed. At the same time, the temperature gradient change rate can also be extracted. If an object suddenly approaches the warehouse and has a high temperature, then the temperature gradient change rate will be relatively large.

[0024] In terms of audio waveforms, voiceprint feature decomposition is performed. For example, in the audio waveform collected by the audio monitoring device in the office area, if an abnormal high-decibel sharp sound suddenly appears, through voiceprint feature decomposition, the abnormal sound source localization coordinates can be extracted to determine whether this sound comes from a specific office or corridor, etc., and the sound pressure level mutation frequency can be obtained, that is, the frequency situation where the intensity of this sound suddenly increases.

[0025] Perform temporal parsing on the device status log. Taking the camera as an example, if the device status log of the camera shows that the storage device full prompt frequently appears within a certain period of time, through temporal parsing, the device operation stability index can be extracted, and the fault warning interval can be calculated, such as how often a storage-related problem will occur.

[0026] Then, the moving target trajectory, heat source distribution density, abnormal sound source localization coordinates, and equipment operation stability indicators are input into the encoder layer of the spatio-temporal feature fusion model to generate a primary feature representation. Suppose there is a camera near a production workshop in the park. The moving target trajectory captured by it shows normal personnel flow. The heat source distribution density detected by the nearby infrared sensing equipment is also normal. The audio monitoring equipment does not detect any abnormal sound sources, and the equipment operation stability indicator of the camera itself is good. After these features are input into the encoder layer, a primary feature representation reflecting the overall state of this area will be generated.

[0027] Next, through the attention mechanism layer of the spatio-temporal feature fusion model, calculate the contribution weights of different modality features in the primary feature representation, and dynamically weight and fuse different modality features according to the contribution weights. For example, when judging whether there is a security risk in an area, since this area is a production workshop, the stability of equipment operation may be more important, so the contribution weight of the modality feature of the equipment operation stability indicator will be relatively high; while if it is in a public area of the park, the flow of people and vehicles may be more important, then the contribution weight of the modality feature of the moving target trajectory will increase.

[0028] Finally, splice the weighted and fused features with the motion direction consistency parameter, temperature gradient change rate, sound pressure level mutation frequency, and fault warning interval to generate a spatio-temporal feature vector. For a certain security monitoring device in the park, its spatio-temporal feature vector includes its device deployment coordinates (such as the specific longitude and latitude coordinates in the park), monitoring timestamp (the monitoring data acquisition time accurate to seconds), environmental context relevance (such as the relevance of environmental information such as whether the area is a production area, office area, or warehouse area), and abnormal signal intensity (judging whether there is an abnormality and the degree of abnormality based on various modality features).

[0029] Step S130, based on the spatio-temporal feature vector, use the adaptive clustering algorithm to dynamically cluster and divide the multiple security monitoring devices to generate multiple device clusters, where the similarity of the security monitoring devices within the same device cluster on the spatio-temporal feature vector is greater than the similarity of devices across clusters.

[0030] In the security monitoring system of the industrial park, this embodiment begins to use the adaptive clustering algorithm to divide device clusters. First, initialize the clustering centers of the adaptive clustering algorithm. Select the feature vectors corresponding to the top K security monitoring devices with the highest abnormal signal intensity in the spatio-temporal feature vectors as the clustering centers, assuming K = 3. For example, select the spatio-temporal feature vectors of an infrared sensing device near the hazardous chemical warehouse in the park (because it may often detect some small temperature fluctuations and has a relatively high abnormal signal intensity), a camera at the park entrance (due to the frequent entry and exit of people and vehicles, and occasional abnormal human behaviors or vehicle violations, the abnormal signal intensity is also relatively high), and an audio monitoring device in the office area (which may generate a relatively high abnormal signal intensity due to situations such as arguments among people) as the initial clustering centers.

[0031] Then calculate the cosine similarity between the spatio-temporal feature vector of each security monitoring device and all clustering centers. For example, a camera inside the production workshop, its spatio-temporal feature vector includes the device deployment coordinates inside the workshop, the monitoring timestamp during normal working hours, the environmental context relevance as the production environment, and a relatively low abnormal signal intensity (because everything is normal inside the workshop). Calculate the cosine similarity between the spatio-temporal feature vector of this camera and the above three clustering centers. According to the set similarity threshold, if the similarity between this camera and the clustering center of the infrared sensing device near the warehouse is lower than the threshold, the similarity with the clustering center of the camera at the park entrance is also lower than the threshold, but the similarity with the clustering center of the audio monitoring device in the office area is higher than the threshold, then this camera is assigned to the temporary cluster with the audio monitoring device in the office area as the clustering center.

[0032] For each temporary cluster, calculate the mean and variance of the spatio-temporal feature vectors of the security monitoring devices within the temporary cluster. Assume that in the temporary cluster with the audio monitoring device in the office area as the clustering center, there are multiple cameras and audio monitoring devices. If the variance of this temporary cluster is greater than the set variance threshold, this may mean that although the devices within this cluster are similar to some extent, there are also relatively large differences. For example, some devices in this cluster are near the meeting room in the office area, and some are near the corridor in the office area, and the environmental context relevance is quite different. Then split this temporary cluster into two sub-clusters and add new clustering centers. For example, divide the devices near the meeting room into one sub-cluster, divide the devices near the corridor into another sub-cluster, and determine new clustering centers respectively.

[0033] Recalculate the similarity between all security monitoring devices and the updated cluster centers according to the split sub - clusters, and iteratively execute the assignment and split operations. For example, a newly installed camera in the park that was not previously assigned to a suitable cluster will recalculate its similarity to each cluster center after the cluster centers are updated and may then be assigned to a suitable cluster. This process is repeated continuously until the internal variance of all clusters is lower than the set variance threshold.

[0034] Finally, merge adjacent clusters with a spatio - temporal feature vector similarity greater than the set merge threshold, and delete isolated clusters with the number of devices lower than the minimum scale threshold to generate multiple final stable device clusters. For example, for the device clusters in two adjacent office areas with a very high spatio - temporal feature vector similarity, they are merged into one device cluster; and if there is a cluster with only one device and the number of devices in this cluster is lower than the minimum scale threshold, this isolated cluster is deleted, finally forming stable device clusters that can better reflect the distribution and correlation of security monitoring devices in the industrial park.

[0035] Step S140: For each device cluster, analyze the anomaly signal correlation of the security monitoring devices within the device cluster through the anomaly propagation network model to generate a cluster - level risk prediction result and a device collaboration response instruction.

[0036] Taking the device clusters in the previously divided industrial park as an example, analyze a device cluster that includes cameras, infrared sensing devices, and audio monitoring devices around the production workshop. First, construct an anomaly propagation graph with this device cluster as a node. In this device cluster, if a camera detects that someone enters the production workshop during non - working hours, and at the same time, the infrared sensing device in the workshop detects a sudden increase in the temperature of a certain device, the time synchronization of these two anomaly signals is very high, and because the camera and the infrared sensing device are close in space, their spatial proximity is also high. Therefore, in the anomaly propagation graph, the weight of the edge connecting these two devices will be relatively high.

[0037] Input the spatio - temporal feature vector of this device cluster into the graph convolutional layer of the anomaly propagation network model to extract the potential risk features of the cluster nodes. Suppose the spatio - temporal feature vector of this device cluster shows that the recent maintenance records of the devices in the workshop are poor, the environmental temperature is high, and the personnel flow has an abnormal increase during a specific period. After these features are input into the graph convolutional layer, potential risk features regarding the possible risks of this device cluster can be extracted, such as an increased risk of device failure and an increased risk of security violations.

[0038] Analyze the evolution pattern of potential risk features at consecutive time steps through the time-recursive layer of the anomaly propagation network model, and predict the risk outbreak probability of cluster nodes within a future time window. For example, in the past few hours, the temperature of the equipment in the workshop has been continuously rising, and the frequency of personnel entering the workshop illegally has also been increasing. Based on the changes of these potential risk features at consecutive time steps, it is predicted that within the next hour, the risk outbreak probability of this equipment cluster is 30%.

[0039] If this risk outbreak probability exceeds the preset probability, assuming the preset probability is 20%, then trigger the process of generating device collaborative response instructions. According to the deployment coordinates and monitoring capabilities of the security monitoring devices within the equipment cluster, assign the roles of the main control device and auxiliary devices. For example, in the equipment cluster of this production workshop, since the camera located in the center of the workshop can cover a large area and has good data transmission stability, this camera is assigned as the main control device, while the other cameras, infrared sensing devices, and audio monitoring devices around the workshop are used as auxiliary devices.

[0040] Based on the real-time data feedback of the main control device, dynamically adjust the working mode and data acquisition frequency of the auxiliary devices. If the main control device detects abnormal smoke in a certain area of the workshop, it can notify the nearby infrared sensing devices to increase the data acquisition frequency to more accurately monitor the temperature change; at the same time, notify the surrounding cameras to adjust the shooting angle and focus on the area where risks may exist.

[0041] Generate a cross-device collaborative early warning signal transmission path to ensure low-latency synchronization of early warning information among devices in the cluster. For example, establish a direct communication link from the main control camera to each auxiliary device. When the main control device detects an abnormal situation, it can quickly send the early warning signal to all auxiliary devices, enabling the entire equipment cluster to respond quickly.

[0042] Step S150, dynamically adjust the node weights of the anomaly propagation network model according to the cluster-level risk prediction results, and update the cluster centers of the adaptive clustering algorithm to optimize subsequent cluster partitioning.

[0043] Continuing with the example of the security monitoring system in the industrial park, after predicting the risks of the equipment cluster in the production workshop, collect the execution effect data of the device collaborative response instructions. Assume that the device collaborative response instructions require the cameras and infrared sensing devices in the workshop to conduct collaborative monitoring when detecting abnormalities. The execution effect data includes the risk suppression response time, device collaboration success rate, and false alarm rate, etc. If it is found that the risk suppression response time from the occurrence of the anomaly to the start of device collaborative response is long, the device collaboration success rate is low, and there is a certain false alarm rate, for example, the equipment misjudges the normal start-up heat of the equipment as abnormal high temperature.

[0044] Calculate the prediction error gradient of the anomaly propagation network model based on these execution effect data, and update the weight parameters of the graph convolutional layer and the temporal recurrent layer through the backpropagation algorithm. For example, due to a high false alarm rate, it may be that the weight setting for judging the normal state characteristics of the device in the graph convolutional layer is unreasonable. Adjust the weight parameters related to the normal operation characteristics of the device in the graph convolutional layer through the backpropagation algorithm. Due to a long risk suppression response time, it may be that the time step setting for predicting the risk evolution in the temporal recurrent layer is inaccurate, and thus adjust the weight parameters of the temporal recurrent layer.

[0045] Apply the updated anomaly propagation network model to the historical spatio-temporal feature vectors again to generate corrected cluster-level risk prediction results. Re-enter the spatio-temporal feature vectors of the production workshop equipment cluster before into the updated anomaly propagation network model to obtain new risk prediction results. For example, the previously predicted risk outbreak probability was 30%, and after correction, it may become 25%.

[0046] Compare the differences in the cluster-level risk prediction results before and after correction, and identify the equipment cluster with the largest prediction deviation as the optimization target for the clustering center. If it is found that the production workshop equipment cluster has the largest prediction deviation, then this equipment cluster will be used as the target for optimizing the clustering center.

[0047] For this clustering center optimization target, perform interpolation calculation on the mean value of the spatio-temporal feature vectors of this clustering center optimization target and the feature vectors of adjacent clusters to generate a new clustering center and replace the original center. Assume that the mean value of the spatio-temporal feature vectors of the production workshop equipment cluster includes information such as the average deployment coordinates of the equipment, the average monitoring timestamp, the average environmental context correlation degree, and the average abnormal signal intensity. Perform interpolation calculation on it and the feature vectors of the adjacent warehouse equipment cluster to obtain a new clustering center, and use this new clustering center to replace the original clustering center of the production workshop equipment cluster.

[0048] Trigger a new round of equipment cluster division process until the prediction deviation of all clusters is lower than the convergence threshold. For example, re-cluster all the security monitoring devices in the industrial park according to the new clustering center, and continuously repeat this process until the prediction deviation of each equipment cluster is small enough, lower than the convergence threshold, so as to optimize the equipment cluster division and risk prediction capabilities of the entire security monitoring system.

[0049] Based on the above steps, the embodiment of the present application collects multiple heterogeneous data streams in the target area, including video frame sequences, infrared sensor signals, audio waveforms and equipment status logs, breaking through the limitation of traditional security data analysis that only relies on a single type of data. Multimodal feature extraction is performed through the spatiotemporal feature fusion model to generate a spatiotemporal feature vector containing device deployment coordinates, monitoring timestamps, environmental context correlation and abnormal signal strength, which can comprehensively and meticulously characterize the complex scene information monitored by security monitoring equipment. This method of fusing multi-source heterogeneous data and extracting deep features greatly improves the perception accuracy of the security situation in the target area, and can discover potential safety hazards that are difficult to detect with traditional methods.

[0050] Adaptive clustering algorithms are used to dynamically cluster multiple security monitoring devices based on spatiotemporal feature vectors. Devices in the same device cluster have high similarity in spatiotemporal feature vectors, which is clearly distinguished from cross-cluster devices. Compared with traditional fixed clustering methods, this dynamic clustering can adapt to changes in security conditions in the target area in real time and automatically adjust the device cluster structure. For example, the correlation between devices may change in different time periods or under different environmental conditions. The adaptive clustering algorithm can quickly respond to these changes, ensuring that the clustering always matches the actual security scenario, thereby improving the pertinence and efficiency of subsequent data analysis.

[0051] For each device cluster, the abnormal signal correlation of the security monitoring equipment is deeply analyzed through the abnormal propagation network model, which can not only accurately generate cluster-level risk prediction results, but also give equipment coordinated response instructions. This network model-based analysis method fully considers the complex interaction relationship between devices, can predict potential security risks in advance, and formulate a coordinated response strategy. Compared with traditional simple anomaly detection methods, this method can more deeply explore the logical relationship behind abnormal signals and achieve smarter and more comprehensive security decisions.

[0052] According to the cluster-level risk prediction results, the node weights of the abnormal propagation network model are dynamically adjusted, and the cluster centers of the adaptive clustering algorithm are updated, forming an intelligent iterative optimization mechanism. This self-optimization capability enables the system to continuously learn and adapt to emerging security situations. As time goes by, the model and algorithm can more accurately predict risks and divide equipment clusters, thereby continuously improving the performance and reliability of the entire intelligent security data analysis and decision-making system.

[0053] In a possible implementation, step S120 includes: Step S121, performing optical flow analysis on the video frame sequence to extract moving target trajectory and moving direction consistency parameters.

[0054] For example, on the main road of the park, the camera continuously captures passing vehicles and pedestrians. Optical flow analysis technology can accurately track every moving target in the picture, thereby extracting the trajectory of the moving target. Taking a forklift driving in the park as an example, through optical flow analysis, the complete driving trajectory of the forklift from a warehouse to a specific channel to the production workshop can be accurately depicted. At the same time, the motion direction consistency parameter can also be obtained. If the forklift always drives in a straight line along the specified lane during driving, without sudden turns or irregular deviations, then its motion direction consistency parameter will be very high, indicating that the forklift is in normal driving state; on the contrary, if the forklift has multiple irregular turns or swings back and forth between lanes, this parameter will be low, which may indicate that the forklift driver is operating improperly or that the forklift itself has hidden faults.

[0055] Step S122, performing frequency domain transformation on the infrared sensor signal to extract the heat source distribution density and the temperature gradient change rate.

[0056] Next, the infrared sensor signals emitted by the infrared sensor devices installed in key areas of the park (such as around warehouses storing flammable and explosive items) are transformed in the frequency domain. When a truck that has just completed a transportation task stops near the warehouse, the infrared sensor signal can detect the heat source due to the long-term operation of the truck engine. Through frequency domain transformation, the heat source distribution density can be accurately extracted. If the engine heat dissipation is normal, the heat will be relatively evenly distributed around the engine, and the heat source distribution density will present a relatively regular pattern; if the engine has a heat dissipation failure, it may cause local overheating, and the heat source distribution density will be concentrated in the overheating area. At the same time, the temperature gradient change rate can also be accurately obtained. When the truck just stops, the engine temperature is high. As time goes by, the heat gradually dissipates and the temperature gradually decreases. The temperature change rate in this process is represented by the temperature gradient change rate. If the temperature drops too slowly, it may indicate a potential safety risk to the vehicle, such as a failure in the engine cooling system.

[0057] Step S123, performing voiceprint feature decomposition on the audio waveform to extract the abnormal sound source positioning coordinates and the sound pressure level mutation frequency.

[0058] Then, perform voiceprint feature decomposition on the audio waveforms collected by the audio monitoring devices in each area of the park (such as the office area, production workshop, public area, etc.). In the office area, the normal conversations of employees, the working sounds of printers, and the operating sounds of air conditioners, etc. constitute a complex audio environment. When an abnormal sound suddenly appears, for example, a sharp sound of equipment collision occurs in a certain office, through voiceprint feature decomposition, the coordinates of this abnormal sound source can be accurately located to determine which office or which specific location the sound comes from. Moreover, the mutation frequency of the sound pressure level can also be extracted. If this equipment collision sound is a one-time occurrence, the mutation frequency of the sound pressure level is a short peak; if the equipment continuously emits abnormal high-frequency noise, then the mutation frequency of the sound pressure level will remain at a relatively high value within a certain period of time, which may indicate that the equipment has a serious fault and needs to be repaired in a timely manner.

[0059] Step S124: Perform chronological analysis on the device status log to extract the device operation stability index and the fault warning interval.

[0060] In addition, perform chronological analysis on the device status log generated by each security monitoring device itself. Taking the cameras in each corner of the park as an example, the device status log records various operation status information of the cameras. Through chronological analysis, the device operation stability index can be extracted. If the camera frequently experiences problems such as blurred images and data transmission interruptions within a certain period of time, then the device operation stability index will be relatively low, indicating that there may be a hardware fault or unstable network connection with the camera. At the same time, the fault warning interval can also be determined. For example, if the camera gives a prompt of insufficient storage capacity every few days, this time interval is the fault warning interval, which can help the operation and maintenance personnel plan device maintenance and data cleaning work in advance to ensure the normal operation of the camera.

[0061] Step S125: Input the moving target trajectory, heat source distribution density, abnormal sound source location coordinates, and device operation stability index into the encoder layer of the spatio-temporal feature fusion model to generate a primary feature representation.

[0062] For example, near the production workshop in the park, the moving target trajectory of personnel and equipment monitored by the camera, the heat source distribution density detected by the infrared sensing device in the workshop, the abnormal sound source location coordinates analyzed by the surrounding audio monitoring devices, and the device operation stability index of the camera itself are jointly input into the encoder layer. Assuming that the activities of personnel and equipment in the production workshop are in a normal state, the heat source distribution is normal, no abnormal sound source is detected, and the camera is operating stably, then the encoder layer will generate a primary feature representation that can reflect the overall stable state of this production workshop area, and this primary feature representation synthesizes the basic feature information of all aspects.

[0063] In step S126, through the attention mechanism layer of the spatio-temporal feature fusion model, calculate the contribution weights of different modality features in the primary feature representation, and dynamically weight and fuse different modality features according to the contribution weights.

[0064] After that, in the environment of an industrial park, the key points of security monitoring in different areas are different. For the production workshop area, the stability of equipment operation and the movement trajectories of personnel and equipment may be more important. Therefore, in the calculation of the attention mechanism layer, the contribution weights of the two modality features of the equipment operation stability index and the movement target trajectory will be relatively high. For the office area, the abnormal sound source localization coordinates and the sound pressure level mutation frequency of the sound source may be more concerned, because the office area needs to maintain a quiet working environment, so the contribution weights of these two modality features will be correspondingly increased in the calculation of the office area. According to different contribution weights, dynamically weight and fuse each modality feature, so that the fused features can better reflect the key points of security monitoring and actual needs in different areas.

[0065] In step S127, splice the weighted and fused features with the movement direction consistency parameter, the temperature gradient change rate, the sound pressure level mutation frequency, and the fault warning interval to generate the spatio-temporal feature vector.

[0066] Continuing with an example of a specific security monitoring device in the park, this security monitoring device may be a camera located at the warehouse entrance. The weighted and fused features contain comprehensive information after weighting on various aspects such as the activities of personnel and vehicles in the warehouse entrance area, the surrounding heat source situation, the sound environment, and the operation status of the device itself. The movement direction consistency parameter reflects whether the vehicle enters the warehouse along the specified route; the temperature gradient change rate reflects the change of the ambient temperature around the warehouse, for example, whether the temperature around the warehouse rises abnormally in hot weather; the sound pressure level mutation frequency indicates whether there is a sudden high-decibel sound near the warehouse, which may be the sound emitted by equipment failure or abnormal operation; the fault warning interval shows the fault warning situation of the camera itself. Splicing these information together generates the spatio-temporal feature vector corresponding to the camera located at the warehouse entrance. This spatio-temporal feature vector comprehensively contains information such as the deployment coordinates of the device, the monitoring timestamp, the environmental context correlation degree, and the abnormal signal intensity, providing a rich data basis for subsequent security monitoring analysis.

[0067] In a possible implementation manner, step S130 includes: In step S131, initialize the clustering center of the adaptive clustering algorithm as the feature vectors corresponding to the top K security monitoring devices with the highest abnormal signal intensity in the spatio-temporal feature vector, where K is the preset initial number of clusters.

[0068] In this embodiment, since K is the preset initial number of clusters and it is assumed that K = 3. Among the numerous security monitoring devices in the industrial park, the feature vectors corresponding to the top 3 security monitoring devices with the highest abnormal signal intensity in the spatio-temporal feature vectors can be found as the initial clustering centers. For example, an infrared sensing device near the dangerous chemical warehouse in the park. Due to the special nature of dangerous chemicals, even a slight temperature change in this area may be regarded as an abnormal signal, so the abnormal signal intensity of this device is relatively high; a camera at the entrance of the park. Due to the frequent entry and exit of personnel and vehicles, there may occasionally be situations where personnel enter or exit without following the prescribed procedures or vehicles park illegally, resulting in a relatively high abnormal signal intensity; and a sensor in the production workshop for monitoring the operating status of key equipment. Once the equipment shows abnormal fluctuations, it will generate a relatively high abnormal signal intensity. The spatio-temporal feature vectors of these three devices are determined as the initial clustering centers.

[0069] Step S132: Calculate the cosine similarity between the spatio-temporal feature vector of each security monitoring device and all clustering centers, and assign the device to a temporary cluster according to the similarity threshold.

[0070] For example, a camera located in the corridor of the office area in the park. Its spatio-temporal feature vector includes the device deployment coordinates in the office area corridor, the monitoring timestamp during normal working hours, the environmental context relevance of the office environment, and a relatively low abnormal signal intensity (because the office area is usually relatively stable). Thus, the cosine similarity between the spatio-temporal feature vector of this camera and the above three clustering centers (the infrared sensing device near the dangerous chemical warehouse, the camera at the park entrance, and the sensor in the production workshop) can be calculated respectively. If the set similarity threshold is 0.6, and the cosine similarity between this camera and the clustering center of the infrared sensing device near the dangerous chemical warehouse is 0.3, the cosine similarity with the clustering center of the camera at the park entrance is 0.5, and the cosine similarity with the clustering center of the sensor in the production workshop is 0.7. Since its cosine similarity with the clustering center of the sensor in the production workshop is higher than the threshold, then this camera will be assigned to the temporary cluster with the sensor in the production workshop as the clustering center.

[0071] Step S133: For each temporary cluster, calculate the mean and variance of the spatio-temporal feature vectors of the security monitoring devices within the temporary cluster. If the variance is greater than the set variance threshold, split the temporary cluster into two sub-clusters and add new clustering centers.

[0072] Taking the temporary cluster with sensors in the production workshop as the clustering center as an example, this cluster may include multiple devices such as cameras and sensors in the workshop. Calculate the mean of the spatio-temporal feature vectors of these devices, including information such as the average device deployment coordinates, average monitoring timestamps, average environmental context correlation degrees, and average abnormal signal intensities. At the same time, calculate the variance. If the variance is greater than the set variance threshold, it means that although the devices within this temporary cluster are similar to some extent, there are also significant differences. For example, some devices in the workshop are close to large production equipment, while some are close to the workshop passage, resulting in significant differences in the environmental context correlation degrees, which may cause a large variance. In this case, split this temporary cluster into two sub-clusters and add new clustering centers. For example, divide the devices close to the large production equipment into one sub-cluster, and use the spatio-temporal feature vector of one of the devices as the new clustering center; divide the devices close to the workshop passage into another sub-cluster and determine a new clustering center.

[0073] Step S134, recalculate the similarity between all security monitoring devices and the updated clustering centers according to the split sub-clusters, and iteratively execute the assignment and splitting operations until the internal variances of all clusters are lower than the set variance threshold.

[0074] For example, a newly installed sensor in a corner of the workshop in the park was previously assigned to the temporary cluster with sensors in the production workshop as the clustering center. However, after the temporary cluster is split, it is necessary to recalculate its similarity with the new clustering center. If this sensor has a higher similarity with the new clustering center of the sub-cluster close to the large production equipment, it will be reassigned to this sub-cluster. This process is repeated continuously until the internal variances of all clusters are lower than the set variance threshold, ensuring that the devices within each cluster have a high degree of similarity.

[0075] Step S135, merge adjacent clusters with spatio-temporal feature vector similarities greater than the set merging threshold, and delete isolated clusters with the number of devices lower than the minimum scale threshold to generate multiple final stable device clusters.

[0076] Suppose there are two sub - clusters in a workshop. One is an equipment cluster near large - scale production equipment, and the other is an equipment cluster near small - scale auxiliary equipment. After calculation, the similarity of their spatio - temporal feature vectors is 0.8, while the set merging threshold is 0.75. Since their similarity is higher than the merging threshold, these two clusters are merged into one equipment cluster. And if there is a cluster that contains only one device, and the number of devices in this cluster is lower than the minimum scale threshold, for example, this device may be a temporarily installed sensor for testing a specific area. Because it does not have sufficient representativeness or monitoring significance, this isolated cluster is deleted. Through such operations, multiple stable equipment clusters are finally generated. These equipment clusters can better reflect the distribution and correlation of security monitoring equipment in the industrial park in terms of spatio - temporal features, providing a reasonable basis for equipment grouping for subsequent security analysis and management.

[0077] In a possible implementation manner, step S140 includes: Step S141, constructing an abnormal propagation graph with equipment clusters as nodes, where the weight of the edges in the abnormal propagation graph is jointly determined by the time synchronization and spatial proximity of abnormal signals between devices.

[0078] In this embodiment, for example, in an equipment cluster that includes security monitoring equipment in a production workshop and its surrounding areas, there are multiple cameras, infrared sensing devices, and audio monitoring devices, etc. If a camera in the production workshop detects that a worker enters the workshop during non - working hours, and at the same time an infrared sensing device in the workshop detects that the temperature of a certain device suddenly rises, the time of these two abnormal signals is almost synchronous. And because the camera and the infrared sensing device are close in space, in the abnormal propagation graph, the weight of the edge connecting the nodes corresponding to these two devices will be relatively high. If an audio monitoring device in the workshop detects an abnormal sound, but this sound is not synchronous with the previous two abnormal signals in time, and the audio monitoring device is far from the previous two devices in space, then the weight of the edge connecting it to the nodes corresponding to the previous two devices will be relatively low. This abnormal propagation graph jointly determines the weight of the edges through the time synchronization and spatial proximity of abnormal signals between devices, thereby reflecting the correlation of abnormal signals between each device in the equipment cluster.

[0079] Step S142, inputting the spatio - temporal feature vectors of each equipment cluster into the graph convolution layer of the abnormal propagation network model to extract the potential risk features of the cluster nodes.

[0080] For the equipment cluster in the above production workshop, its spatio-temporal feature vectors include information such as the deployment coordinates of the equipment (e.g., the specific locations of each piece of equipment in the workshop), monitoring timestamps (the time information of the data collected by the equipment), the degree of environmental context association (relevant information such as the production environment in the workshop), and the abnormal signal intensity (the comprehensive intensity of various previously detected abnormal signals). After inputting these spatio-temporal feature vectors into the graph convolutional layer, the graph convolutional layer will process this information. Suppose the recent maintenance records of the equipment in the workshop are poor, which can be reflected from the spatio-temporal feature vectors, and the personnel flow in the workshop has an abnormal increase during a specific period, and at the same time, the operating temperatures of some equipment in the workshop are approaching the critical value, etc. Under the processing of the graph convolutional layer, these information can extract potential risk features regarding the possible risks of this equipment cluster, such as an increased risk of equipment failure, an increased risk of illegal operation, and an increased risk of safety accidents, etc.

[0081] Step S143, analyze the evolution pattern of the potential risk features at consecutive time steps through the time recurrence layer of the abnormal propagation network model, and predict the risk outbreak probability of the cluster nodes within the future time window.

[0082] If the risk outbreak probability exceeds the preset probability, trigger the equipment collaborative response instruction generation process, and the equipment collaborative response instruction generation process specifically includes: According to the deployment coordinates and monitoring capabilities of the security monitoring equipment within the equipment cluster, assign the roles of the main control equipment and the auxiliary equipment.

[0083] Based on the real-time data feedback of the main control equipment, dynamically adjust the working mode and data collection frequency of the auxiliary equipment.

[0084] Generate a cross-device collaborative early warning signal transmission path to ensure low-latency synchronization of early warning information among the equipment in the cluster.

[0085] In the example of the production workshop, looking at the past few hours, the temperature of the equipment in the workshop has been continuously rising, the frequency of personnel illegally entering the workshop is also increasing, and the unstable operating states of some equipment in the workshop are continuously deteriorating. The time recurrence layer analyzes according to the changes of these potential risk features at consecutive time steps. Suppose the set future time window is the next hour, and through analysis and calculation, the risk outbreak probability of this equipment cluster within this future time window is 30%.

[0086] If the risk outbreak probability exceeds the preset probability, assuming the preset probability is 20%, the device collaborative response instruction generation process is triggered. First, based on the deployment coordinates and monitoring capabilities of the security monitoring devices in the device cluster, the roles of the master device and the auxiliary devices are assigned. In the device cluster in the production workshop, since a high-definition camera located in the center of the workshop can cover a large area and has good data transmission stability, this camera is assigned as the master device. For the other cameras around the workshop, although their coverage areas are smaller, they can supplement the monitoring blind spots. The infrared sensing devices are used to precisely detect changes in device temperature, and the audio monitoring devices are used to monitor abnormal sounds. These devices are assigned as auxiliary devices.

[0087] Based on the real-time data feedback of the master device, the working modes and data collection frequencies of the auxiliary devices are dynamically adjusted. For example, if the master device detects abnormal smoke in a certain area of the workshop, it can send an instruction to the nearby infrared sensing devices to increase the data collection frequency in order to more precisely monitor the temperature change situation, because the smoke may be accompanied by an abnormal increase in temperature and more timely and accurate data is needed. At the same time, the master device will notify the surrounding cameras to adjust the shooting angles and focus on the areas where risks may exist, such as the area where the smoke appears or the area where people gather, in order to obtain more detailed image information.

[0088] Generate a cross-device collaborative early warning signal transmission path to ensure low-latency synchronization of early warning information among the devices in the cluster. A direct communication link is established between the master camera and each auxiliary device, and a high-speed and stable communication protocol is adopted. When the master device detects an abnormal situation, it can quickly send the early warning signal to all the auxiliary devices. For example, when the master camera discovers a fire hazard in the workshop, it can send the early warning signal to all the infrared sensing devices, other cameras, and audio monitoring devices in the workshop within a very short time, enabling the entire device cluster to quickly respond, such as activating the fire extinguishing device or evacuating personnel, etc.

[0089] Among them, step S150 includes: Step S151, collect the execution effect data of the device collaborative response instruction, and the execution effect data includes the risk suppression response time, the device cooperation success rate, and the false alarm rate.

[0090] In this process, it is also necessary to dynamically adjust the node weights of the abnormal propagation network model and update the cluster centers of the adaptive clustering algorithm to optimize subsequent cluster partitioning. First, collect the execution effect data of the device collaborative response instructions. The execution effect data includes the risk suppression response time, the device collaboration success rate, the false alarm rate, etc. In the example of the device cluster in the production workshop, if it is found that the risk suppression response time from the occurrence of an anomaly (such as the appearance of a fire hazard) to the start of device collaborative response (such as activating a fire extinguishing device or evacuating personnel) is long, and the device collaboration success rate is low. For example, some devices do not adjust their working modes or data acquisition frequencies in a timely manner according to the instructions, and there is a certain false alarm rate. For example, the device misjudges the normal starting heat of the device as abnormal high temperature.

[0091] Step S152: Calculate the prediction error gradient of the abnormal propagation network model according to the execution effect data, and update the weight parameters of the graph convolutional layer and the temporal recurrent layer through the backpropagation algorithm.

[0092] Due to the high false alarm rate, it may be that the weight setting for judging the normal state features of the device in the graph convolutional layer is unreasonable. Adjust the weight parameters related to the normal operation features of the device in the graph convolutional layer through the backpropagation algorithm, so that the model is more accurate in judging the normal state and abnormal state of the device. Due to the long risk suppression response time, it may be that the time step setting in the temporal recurrent layer for predicting the risk evolution is inaccurate. Thus, adjust the weight parameters of the temporal recurrent layer to more accurately predict the speed and time nodes of the risk evolution.

[0093] Step S153: Reapply the updated abnormal propagation network model to the historical spatio-temporal feature vectors to generate a corrected cluster-level risk prediction result.

[0094] In this embodiment, re-enter the spatio-temporal feature vectors before the device cluster in the production workshop into the updated abnormal propagation network model to obtain a new risk prediction result. For example, the previously predicted risk outbreak probability was 30%, and after correction, it may become 25%.

[0095] Step S154: Compare the differences between the cluster-level risk prediction results before and after correction, and identify the device cluster with the largest prediction deviation as the optimization target for the cluster center.

[0096] If it is found that the prediction deviation of the device cluster in the production workshop is the largest, then take this device cluster as the optimization target for the cluster center.

[0097] Step S155: For the optimization target of the cluster center, perform interpolation calculation on the mean value of the spatio-temporal feature vectors of the optimization target of the cluster center and the feature vectors of adjacent clusters to generate a new cluster center and replace the original center.

[0098] Suppose the mean of the spatio-temporal feature vectors of the equipment clusters in the production workshop contains information such as the average deployment coordinates of the equipment, the average monitoring timestamps, the average environmental context correlation degree, and the average abnormal signal intensity. Interpolation calculation is performed on it and the feature vectors of the equipment clusters in the adjacent warehouse to obtain a new clustering center. This new clustering center synthesizes some features of the production workshop and the warehouse equipment clusters, and this new clustering center is used to replace the original clustering center of the production workshop equipment clusters.

[0099] Step S156, trigger a new round of equipment cluster division process until the prediction deviation of all clusters is lower than the convergence threshold.

[0100] For example, re-cluster all the security monitoring equipment in the industrial park according to the new clustering center, and similar evaluations and adjustments are also made for other equipment clusters. This process is repeated continuously until the prediction deviation of each equipment cluster is small enough and lower than the convergence threshold, so as to optimize the equipment cluster division and risk prediction capabilities of the entire security monitoring system, making the security monitoring in the industrial park more accurate and efficient, and being able to detect and respond to various potential security risks in a timely manner.

[0101] In a possible implementation manner, the method further includes: Step S210, introduce an adversarial training mechanism in the spatio-temporal feature fusion model, synthesize a simulated heterogeneous data stream containing random noise through a generative adversarial network, and input the simulated data stream and the real data stream into the spatio-temporal feature fusion model in a mixed manner.

[0102] In this embodiment, in the security monitoring system of the industrial park, the spatio-temporal feature fusion model plays a crucial role. To enhance its performance, an adversarial training mechanism is introduced. First, a simulated heterogeneous data stream containing random noise is synthesized through a generative adversarial network (GAN). In the industrial park, the synthesis of the simulated heterogeneous data stream takes into account the actual security monitoring situation. For example, for the simulation of the video frame sequence part, the GAN generates corresponding video frame sequences according to the common scenes, personnel and vehicle activity patterns in each area of the park (such as production workshops, warehouses, office areas, etc.), and at the same time adds random noise to simulate interference factors in the real environment, such as the camera image may be affected by light changes, slight jitters, etc. For the simulation of the infrared sensing signal, it is generated based on the heat source distribution and temperature change conditions of different devices during normal operation and possible abnormalities, and random noise is added, such as simulating the impact of temperature fluctuations around the warehouse caused by weather changes or other external factors on the infrared sensing signal. The simulation of the audio waveform is constructed according to the common sound sources in the park (such as personnel conversations, equipment operation sounds, etc.), and random noise is considered to simulate background noise interference in the environment. The simulation of the device status log is generated according to various status parameters during normal operation of the device and possible failure modes, and random noise is added to simulate possible inaccuracies or interference in the log record.

[0103] During a certain period of time, the security monitoring system of the park collects the real video frame sequence of the production workshop camera, the real infrared sensing signal of the infrared sensing device around the warehouse, the real audio waveform of the audio monitoring device in the office area, and the real device status logs of each security monitoring device, and at the same time mixes the synthesized simulated corresponding data streams with them. Such a mixed input enables the spatio-temporal feature fusion model to learn and optimize when processing both real data and simulated data.

[0104] Step S220, calculate the feature extraction error of the spatio-temporal feature fusion model for the simulated data stream, and use the feature extraction error as an adversarial loss function to optimize the parameters of the attention mechanism layer of the model.

[0105] Taking the video frame sequence as an example, the motion target trajectory and the motion direction consistency parameters are extracted from the simulated video frame sequence through optical flow analysis, and compared with the preset accurate values (set according to the actual situation of the simulation) to calculate the error in this part. For the infrared sensing signal, the error is obtained by comparing the heat source distribution density and the temperature gradient change rate extracted through frequency domain transformation with the standard values set during the simulation. Similar operations of comparing with the standard values and calculating the error are carried out for the abnormal sound source localization coordinates and the sudden change frequency of the sound pressure level obtained by decomposing the audio waveform and voiceprint features, as well as the device operation stability index and the fault warning interval obtained by parsing the device status log. The errors of each modal feature in the simulated data stream are combined, and the comprehensive feature extraction error is used as the parameter of the attention mechanism layer to optimize the model with the adversarial loss function.

[0106] Step S230, when the feature extraction error of the spatio-temporal feature fusion model for the simulated data stream is lower than a preset ratio of the real data stream error, it is determined that the spatio-temporal feature fusion model reaches the anti-noise training target.

[0107] Assume that the preset ratio is 80%. If the feature extraction error of the model for the simulated data stream is 70% of the real data stream error, then it can be considered that the model has reached the anti-noise training target. This means that when the model processes data containing noise, it can better extract accurate features, thereby improving the reliability and accuracy in the actual industrial park security monitoring.

[0108] In a possible implementation manner, the method further includes: Step S310, assign a dynamic risk level label to each device cluster, and the dynamic risk level label is generated by matching according to the cluster-level risk prediction result and the historical risk event library.

[0109] In the security monitoring of the industrial park, assigning a dynamic risk level label to each device cluster is an important link. This dynamic risk level label is generated by matching according to the cluster-level risk prediction result and the historical risk event library. For example, for a device cluster containing security monitoring devices around the production workshop, the cluster-level risk prediction result is obtained through the previous abnormal propagation network model analysis. If the prediction result shows that the risk of equipment failure in the workshop is high and the risk of personnel's illegal operation is medium, and then combined with the severity, frequency and other information of events such as equipment failure and personnel's illegal operation that have occurred in the production workshop in the historical risk event library, a corresponding risk level label, such as a high risk level, is matched for this device cluster. For a device cluster containing security monitoring devices in the office area, if the risk prediction result shows that there are no obvious abnormalities in the office area, combined with the situation that few serious security events have occurred in the office area in the historical risk event library, a low risk level label is matched for it.

[0110] Step S320, when it is detected that the risk level labels of multiple device clusters are upgraded simultaneously, start the cross-cluster risk linkage analysis process, and the process includes: Step S330, extract the spatio-temporal feature vectors of the risk clusters and the edge weight data in the abnormal propagation graph.

[0111] Step S340, identify the potential association paths between the risk clusters through the community discovery algorithm, and calculate the risk conduction intensity on the potential association paths.

[0112] Step S350, if the risk conduction intensity exceeds the linkage threshold, merge the clusters on the potential association paths into the concerned clusters, and generate a global collaborative response strategy.

[0113] The global collaborative response strategy includes: Elect a leading device node within the concerned clusters to uniformly schedule the monitoring resources of all security monitoring devices.

[0114] Establish a cross-cluster redundant data backup channel to enable seamless migration of critical data in case of device failures.

[0115] Adjust the clustering center positions of the concerned clusters to cover the spatio-temporal feature distribution ranges of all associated clusters.

[0116] When it is detected that the risk level labels of multiple device clusters are upgraded simultaneously, start the cross-cluster risk linkage analysis process. Suppose in an industrial park, the risk level labels of a device cluster containing production workshop equipment and a device cluster containing warehouse equipment are simultaneously upgraded from low risk to medium risk. First, extract the spatio-temporal feature vectors of the risk clusters (production workshop equipment cluster and warehouse equipment cluster) and the edge weight data in the abnormal propagation graph. The spatio-temporal feature vector of the production workshop equipment cluster includes the deployment coordinates of the equipment in the workshop, the monitoring timestamps, the environmental context correlation degree of the workshop (such as the production process busyness level, the storage situation of dangerous goods, etc.), and the abnormal signal intensity (such as the intensity corresponding to the abnormal increase in equipment temperature, the situation where personnel enter a specific area illegally, etc.). The spatio-temporal feature vector of the warehouse equipment cluster includes the deployment coordinates of the equipment in the warehouse, the monitoring timestamps, the environmental context correlation degree of the warehouse (such as the type of goods stored, the fire and moisture protection requirements, etc.), and the abnormal signal intensity (such as the abnormal temperature and humidity in the warehouse, the intensity corresponding to the potential safety hazards of goods storage). At the same time, extract the edge weight data in the abnormal propagation graph. For example, in the production workshop equipment cluster, the edge weight between the sensor monitoring the equipment temperature and the camera monitoring the personnel activities, and this weight reflects the correlation degree of the abnormal signals between the two (such as the reaction of personnel or whether the operation is compliant when the equipment temperature is abnormal), and in the warehouse equipment cluster, the edge weight between the sensor monitoring the warehouse humidity and the camera monitoring the goods handling, etc.

[0117] Then, the potential association paths between risk clusters are identified through community discovery algorithms, and the risk conduction intensity on the potential association paths is calculated. In an industrial park, there may be connections such as material transportation and equipment sharing between production workshops and warehouses. The community discovery algorithm will identify such potential association paths. For example, if the products produced in the production workshop need to be transported to the warehouse for storage, then the security monitoring devices on the transportation route connecting the production workshop and the warehouse constitute a potential association path. When calculating the risk conduction intensity on this path, the risk factors in the production workshop (such as equipment failures may lead to product quality problems, which in turn affect warehouse storage) and the risk factors in the warehouse (such as warehouse humidity problems may affect product quality and trace back to the production process in the production workshop) need to be considered, as well as the abnormal signal correlation between the security monitoring devices on the path (such as the abnormal situation of the transportation vehicle monitored by the camera on the transportation route and its association with the production workshop and the warehouse).

[0118] If the risk conduction intensity exceeds the linkage threshold, the clusters on the potential association path are merged into a concerned cluster, and a global collaborative response strategy is generated. Suppose the linkage threshold is 0.6. If the calculated risk conduction intensity on the potential association path between the production workshop and the warehouse is 0.7, then the equipment clusters in the production workshop and the warehouse are merged into a concerned cluster. For this concerned cluster, a global collaborative response strategy is generated. A leading device node is elected within the concerned cluster. For example, a camera located at the transportation hub between the production workshop and the warehouse is selected as the leading device node because this camera can monitor the shipment situation in the production workshop and the incoming goods situation in the warehouse simultaneously, and has a better global view. This leading device node uniformly schedules the monitoring resources of all security monitoring devices. For example, it adjusts the shooting angle and frequency of the cameras in the production workshop to better monitor the production process that may affect product quality, and at the same time adjusts the sensor monitoring parameters in the warehouse to ensure the safety of goods storage. A redundant data backup channel across clusters is established. For example, a high-speed data channel is established between the storage servers in the production workshop and the storage servers in the warehouse. When a device in the production workshop fails and causes data loss, critical data can be seamlessly migrated from the backup data in the warehouse, and vice versa. The position of the clustering center of the concerned cluster is adjusted to cover the spatio-temporal feature distribution range of all associated clusters. For example, the position of the clustering center is adjusted from the original location within the separate production workshop or warehouse to a balance point between the production workshop and the warehouse. This position can better reflect the spatio-temporal feature distribution of all devices in the merged concerned cluster, thereby optimizing subsequent security monitoring and risk analysis.

[0119] In a possible implementation manner, the method further includes: Constructing a hierarchical topology structure of the device cluster, where the hierarchical topology structure includes a physical layer, a feature layer, and a decision layer.

[0120] Among them, the physical layer records the device deployment coordinates and hardware connection relationships of the cluster.

[0121] The feature layer stores the spatio-temporal feature vectors and historical risk prediction results of the cluster.

[0122] The decision-making layer maintains the device collaborative response instructions and dynamic adjustment records.

[0123] Through the inter-layer mapping relationship between the topological structures, the following functions are realized: When the physical layer detects the failure of a device node, a standby device with the closest spatio-temporal features is selected from the feature layer to join the cluster.

[0124] When the execution effect of the instructions in the decision-making layer fails to meet the expectations, the spatio-temporal vector re-extraction process of the feature layer is triggered.

[0125] When the risk prediction result in the feature layer changes, the response instruction generation logic of the decision-making layer is synchronously updated.

[0126] In this embodiment, the physical layer mainly records the device deployment coordinates and hardware connection relationships of the cluster. In the industrial park, there are numerous security monitoring devices distributed in each area. For example, in the production workshop, cameras are installed in every corner, entrance, and exit of the workshop, as well as near key equipment. Each camera has its precise deployment coordinates, such as the position 3 meters above the ground in the southeast corner of the workshop. These cameras are connected to other devices through wired or wireless networks to form specific hardware connection relationships. For example, several cameras are connected to the same switch and then to the security monitoring center of the park. For infrared sensing devices, they may be deployed around electrical equipment or in areas where flammable items are stored in the workshop. They also have clear deployment coordinates and have hardware connections with relevant monitoring devices or servers for data transmission. Audio monitoring devices are distributed in places such as the office area and public areas, and their deployment coordinates are also accurately recorded. The hardware connection relationship ensures that the audio waveform data collected by them can be smoothly transmitted to the processing center.

[0127] The spatio-temporal feature vectors of the feature layer storage cluster and the historical risk prediction results. Taking the cluster containing the production workshop equipment as an example, its spatio-temporal feature vectors include the equipment deployment coordinates (which have been detailedly recorded in the previous physical layer), the monitoring timestamps (such as the time marks corresponding to the data collected by a certain camera at a specific moment), the environmental context correlation degree (for the production workshop, this involves the correlation between factors such as the busyness of the production process, the operating status of the equipment, and the activity patterns of the personnel and the security monitoring), and the abnormal signal intensity (for example, the signal intensity corresponding to abnormal situations such as a sudden increase in the temperature of a certain equipment in the workshop or unauthorized entry of personnel into restricted areas). At the same time, the feature layer also stores the historical risk prediction results, which are obtained through the previous risk analysis process. For example, during a certain period in the past, according to the operating data of the equipment in the production workshop, the personnel activities, etc., it was predicted that the equipment failure risk was at a medium level and the risk of unauthorized operation by personnel was relatively low. These historical data provide important reference bases for subsequent security decisions.

[0128] The decision-making layer maintains the equipment collaborative response instructions and the dynamic adjustment records. When an abnormal situation occurs in the production workshop, the decision-making layer will generate equipment collaborative response instructions. For example, if a camera in the workshop detects that a certain equipment is smoking, the decision-making layer will generate instructions according to the pre-set rules, requiring the nearby infrared sensing equipment to increase the monitoring frequency, other cameras to adjust the shooting angles to focus on the smoking equipment, and at the same time notify the broadcast system in the workshop to issue an alarm. The decision-making layer will also record the dynamic adjustment situations of these instructions, such as the initial set increase in the monitoring frequency of the infrared sensing equipment is not enough, and the increase amplitude is further adjusted according to the subsequent situation and other adjustment records.

[0129] Multiple functions are realized through the inter-layer mapping relationship between the topological structures. When the physical layer detects the failure of a device node, a standby device with the closest spatio-temporal features is selected from the feature layer to join the cluster. Suppose a camera in a certain corner of the production workshop suddenly fails (the physical layer detects the device failure). In the feature layer, the system will search for the standby camera with the closest spatio-temporal features to this faulty camera. This standby camera may be similar to the faulty camera in terms of deployment coordinates, with partially overlapping monitored areas, and the data collected during normal operation is similar to the faulty camera in terms of environmental context correlation degree, abnormal signal intensity, etc. After finding this standby camera, it is added to the device cluster to ensure that there are no loopholes in the security monitoring of the production workshop.

[0130] When the execution effect of the instructions from the decision-making layer fails to meet the expectations, the process of re-extracting the spatio-temporal vectors in the feature layer is triggered. For example, the decision-making layer issues an instruction requiring the cameras and infrared sensing devices in the workshop to cooperate in monitoring a suspected faulty device, but the actual execution effect is not good, and it fails to accurately determine whether the device is really faulty. At this time, the feature layer will be triggered to re-extract the spatio-temporal feature vectors of the relevant device. Re-perform optical flow analysis on the video frame sequence of the camera to obtain more accurate moving target trajectories and motion direction consistency parameters, and re-perform frequency domain transformation on the infrared sensing signals to obtain more accurate heat source distribution density and temperature gradient change rates, etc., providing a more reliable data basis for subsequent risk analysis.

[0131] When the risk prediction result in the feature layer changes, synchronously update the response instruction generation logic in the decision-making layer. For example, based on the newly collected data and analysis results, the feature layer adjusts the fault risk prediction of a certain device in the production workshop from low risk to high risk. After receiving this change, the decision-making layer will synchronously update its response instruction generation logic. Originally, for low-risk situations, only regular inspection of the device status may be required. Now, for high-risk situations, the decision-making layer will generate more stringent instructions, such as immediately stopping the device operation and dispatching technicians for a comprehensive inspection, etc.

[0132] In a possible implementation manner, the method further includes: Integrate an interpretability analysis module in the anomaly propagation network model for visualizing the basis for risk prediction decisions.

[0133] The interpretability analysis module performs the following operations: Extract the high-dimensional feature activation maps of the cluster nodes in the graph convolutional layer and generate human-readable semantic labels through dimensionality reduction mapping.

[0134] Record the focus of attention of the time recurrent layer at different time steps to form a visual time axis of the risk evolution path.

[0135] Mark the contribution percentage of each influencing factor in the process of generating the device cooperation response instructions.

[0136] When the manual review module puts forward corrective opinions on the automatically generated response instructions, reverse-adjust the annotation rules of the interpretability analysis module according to the corrective opinions.

[0137] In the security monitoring system of the industrial park, integrating the interpretability analysis module into the anomaly propagation network model helps to improve the transparency and manageability of risk prediction.

[0138] The operations performed by the interpretability analysis module first involve extracting the high-dimensional feature activation maps of the cluster nodes in the graph convolutional layer and generating human-understandable semantic labels through dimensionality reduction mapping. In the anomaly propagation network model corresponding to the equipment cluster containing the production workshop equipment, the graph convolutional layer processes data such as the spatio-temporal feature vectors of the cluster nodes. For the equipment nodes in the production workshop, their high-dimensional feature activation maps contain various complex feature information of the equipment, such as the activation states after the operations of the equipment operating parameters, the associated features with other equipment, etc. in the graph convolutional layer. Through the dimensionality reduction mapping technology, these high-dimensional and difficult-to-understand feature information are transformed into human-understandable semantic labels. For example, after the dimensionality reduction mapping of the high-dimensional feature activation map of a certain equipment node, the generated semantic label may be "the operating temperature of the equipment is close to the critical value and the activities of the associated equipment are frequent", which enables the security personnel to intuitively understand the state characteristics of the equipment.

[0139] Record the focus of attention of the time-recurrent layer at different time steps to form a visual time axis of the risk evolution path. In the security monitoring of the production workshop, when the time-recurrent layer analyzes the risk evolution of the equipment cluster, it will focus on different factors at different time steps. For example, at the initial time step, it may focus on the startup status of the equipment, the arrival situation of the personnel, etc.; as time goes by, when the equipment has been running for a period of time, it may focus on factors such as the temperature change and operating efficiency of the equipment. The interpretability analysis module records these focuses of attention at different time steps to form a visual time axis. The security personnel can clearly see how the risk evolves over time through this time axis, such as the development process from the normal startup of the equipment to the gradual increase in temperature and then to the risk state that may affect the production process.

[0140] Mark the contribution percentage of each influencing factor in the process of generating the equipment collaborative response instruction. When an abnormal situation occurs in the production workshop and the decision-making layer generates an equipment collaborative response instruction, there are multiple influencing factors involved. The interpretability analysis module will mark the contribution percentage of these influencing factors. For example, when a certain equipment in the workshop smokes and triggers the equipment collaborative response instruction, the factor of the abnormal increase in the temperature of the equipment may account for 50% of the contribution, because it is the main reason directly leading to the smoke; the layout and operating status of the surrounding equipment may account for 20% of the contribution, because it may affect the diffusion of the smoke and the safety of other equipment; the operation situation of the personnel may account for 10% of the contribution, and 20% may be other environmental factors, etc. Such marking helps the security personnel understand the basis for generating the equipment collaborative response instruction.

[0141] When the manual review module puts forward corrective opinions on the automatically generated response instructions, the annotation rules of the interpretability analysis module are adjusted backward according to the corrective opinions. Suppose the manual review module believes that in the case of the device smoking before, the contribution of the factor of the abnormal temperature rise of the device should be higher, for example, increased to 70%. The interpretability analysis module will adjust its annotation rules backward according to this corrective opinion. In the subsequent analysis of similar situations, the contribution of each influencing factor will be marked more accurately, making the generation basis of the device collaborative response instructions more reasonable and transparent.

[0142] In a possible implementation manner, the method further includes: Establish an evolution mechanism for the device cluster, where the evolution mechanism includes: Periodically collect new monitoring data patterns of devices in the cluster and identify event types that have not been monitored.

[0143] When the occurrence frequency of the unmonitored event type exceeds the set learning threshold, trigger the incremental learning process of the spatio-temporal feature fusion model.

[0144] In the incremental learning process, freeze most of the layers of the original parameters of the anomaly propagation network model, and only fine-tune the last fully connected network and the attention mechanism weights.

[0145] Re-extract the spatio-temporal feature vectors through the anomaly propagation network model updated by the incremental learning, and trigger the dynamic reorganization of the device cluster.

[0146] Record the change in the model performance after each incremental learning. When the performance improvement amplitude is lower than the degradation threshold, roll back to the anomaly propagation network model of the previous stable version.

[0147] In the security monitoring scenario of the industrial park, establishing an evolution mechanism for the device cluster helps the system continuously adapt to new security requirements and changes.

[0148] Periodically collect new monitoring data patterns of devices in the cluster and identify event types that have not been monitored. In the device cluster of the production workshop, the security monitoring devices will collect data periodically. For example, with the upgrade of the production process, new devices are introduced into the workshop, and these new devices may generate some new monitoring data patterns. The camera may capture the appearance features of the new devices in unique operating states, the infrared sensing device may detect different heat source distribution patterns of the new devices, and the audio monitoring device may collect new sound frequencies emitted by the new devices during operation. By analyzing these new monitoring data patterns, identify event types that have not been monitored. For example, a new device generates a low-frequency vibration sound in a specific operating state, and this sound has not been included in the scope of security monitoring before, so it is identified as an event type that has not been monitored.

[0149] When the occurrence frequency of an unmonitored event type exceeds the set learning threshold, the incremental learning process of the spatio-temporal feature fusion model is triggered. Suppose the set learning threshold is 3 times a day. If the low-frequency vibration sound generated by this new device is detected 5 times a day, it exceeds the set threshold. At this time, the incremental learning process of the spatio-temporal feature fusion model will be triggered. In this incremental learning process, most of the layers of the original parameters of the anomaly propagation network model are frozen, and only the last fully connected network and the attention mechanism weights are fine-tuned. This is done to learn and adapt to the newly emerging event type based on the existing model knowledge. For example, in the security monitoring of a production workshop, the layers where the parameters related to the normal operation characteristics of the devices and the common personnel activity patterns learned previously are frozen, while the last fully connected network related to the new event type (which may involve classifying and judging new features such as new sound frequencies) and the attention mechanism weights (adjusting the degree of attention to the features of the new event type) are fine-tuned.

[0150] The anomaly propagation network model updated through incremental learning reextracts the spatio-temporal feature vectors and triggers the dynamic reorganization of the device cluster. After incremental learning, the updated anomaly propagation network model is used to reextract the spatio-temporal feature vectors of the devices in the production workshop device cluster. For example, reanalyze the video frame sequence of the camera, infrared sensing signals, audio waveforms, and device status logs, etc., to obtain spatio-temporal feature vectors containing information about the new event type. Then, based on these new spatio-temporal feature vectors, the dynamic reorganization of the device cluster is triggered. Other devices with a higher association degree with the new device may be recombined to form a new device cluster structure for better monitoring and management of the new security situation.

[0151] Record the change in the model performance after each incremental learning. When the improvement amplitude of the performance is lower than the degradation threshold, roll back to the previous stable version of the anomaly propagation network model. After each incremental learning, the system will record in detail the change in the model performance. For example, measure the improvement amplitude of the performance by comparing indicators such as the accuracy of the new model in predicting risks in the production workshop and the recognition accuracy of the new event type. Suppose the degradation threshold is 10%. If the improvement amplitude of the model performance after incremental learning is only 5%, which is lower than the degradation threshold, it means that this incremental learning may not have achieved the expected effect and may even have a negative impact on the model performance. At this time, the system will roll back to the previous stable version of the anomaly propagation network model to ensure the stability and reliability of the security monitoring system.

[0152] Figure 2 FIG. shows the hardware structure diagram of the artificial intelligence-based intelligent security data analysis and decision-making system 100 provided by the embodiment of the present invention for implementing the above artificial intelligence-based intelligent security data analysis and decision-making method, as Figure 2As shown, the artificial intelligence-based intelligent security data analysis and decision-making system 100 may include a processor 110, a machine-readable storage medium 120, a bus 130, and a communication unit 140.

[0153] The machine-readable storage medium 120 may store data and / or instructions. In some embodiments, the machine-readable storage medium 120 may store data obtained from an external terminal. In some embodiments, the machine-readable storage medium 120 may store data and / or instructions used by the artificial intelligence-based intelligent security data analysis and decision-making system 100 to execute or use to complete the exemplary methods described in the present invention.

[0154] In a specific implementation process, one or more processors 110 execute computer-executable instructions stored in the machine-readable storage medium 120, so that the processor 110 can execute the artificial intelligence-based intelligent security data analysis and decision-making method in the above method embodiments. The processor 110, the machine-readable storage medium 120, and the communication unit 140 are connected through the bus 130, and the processor 110 can be used to control the transceiver actions of the communication unit 140.

[0155] For the specific implementation process of the processor 110, reference may be made to the various method embodiments executed by the artificial intelligence-based intelligent security data analysis and decision-making system 100 described above. Their implementation principles and technical effects are similar, and will not be elaborated here in this embodiment.

[0156] In addition, an embodiment of the present invention also provides a readable storage medium, in which computer-executable instructions are preset. When the processor executes the computer-executable instructions, the artificial intelligence-based intelligent security data analysis and decision-making method as described above is implemented.

[0157] It should be noted that, in order to simplify the description of the present invention disclosure and thus help the understanding of one or more embodiments of the invention, in the foregoing description of the embodiments of the present invention, sometimes multiple features are merged into one embodiment, drawing, or description thereof.

Claims

1. An intelligent security data analysis and decision-making method based on artificial intelligence, characterized in that: The method comprises: Collect heterogeneous data streams uploaded in real time by multiple security monitoring devices in the target area, including video frame sequences, infrared sensor signals, audio waveforms, and device status logs; Perform multimodal feature extraction on the heterogeneous data stream through a spatiotemporal feature fusion model to generate a spatiotemporal feature vector corresponding to each security monitoring device, wherein the spatiotemporal feature vector includes device deployment coordinates, monitoring timestamp, environmental context relevance, and abnormal signal strength; Based on the spatiotemporal feature vector, dynamically cluster the multiple security monitoring devices using an adaptive clustering algorithm to generate multiple device clusters, wherein the similarity of the security monitoring devices in the same device cluster in the spatiotemporal feature vector is greater than the similarity of the devices across clusters; For each device cluster, the abnormal signal correlation of the security monitoring devices in the device cluster is analyzed through the abnormal propagation network model to generate cluster-level risk prediction results and device coordinated response instructions; According to the cluster-level risk prediction results, the node weights of the abnormal propagation network model are dynamically adjusted, and the cluster centers of the adaptive clustering algorithm are updated to optimize subsequent cluster divisions.

2. The intelligent security data analysis and decision-making method based on artificial intelligence according to claim 1 is characterized in that: The multimodal feature extraction is performed on the heterogeneous data stream through the spatiotemporal feature fusion model to generate a spatiotemporal feature vector corresponding to each security monitoring device, including: Performing optical flow analysis on the video frame sequence to extract moving target trajectory and moving direction consistency parameters; Performing frequency domain transformation on the infrared sensor signal to extract the heat source distribution density and temperature gradient change rate; Decomposing the audio waveform by voiceprint features to extract the abnormal sound source location coordinates and the sound pressure level mutation frequency; Performing time series analysis on the device status log to extract device operation stability indicators and fault warning intervals; Inputting the moving target trajectory, heat source distribution density, abnormal sound source positioning coordinates and equipment operation stability index into the encoder layer of the spatiotemporal feature fusion model to generate a primary feature representation; Calculating the contribution weights of different modal features in the primary feature representation through the attention mechanism layer of the spatiotemporal feature fusion model, and dynamically weighted fusion the different modal features according to the contribution weights; The weighted fused features are spliced ​​with the motion direction consistency parameter, the temperature gradient change rate, the sound pressure level mutation frequency and the fault warning interval to generate the spatiotemporal feature vector.

3. The intelligent security data analysis and decision-making method based on artificial intelligence according to claim 2 is characterized in that: The method of dynamically clustering the plurality of security monitoring devices based on the spatiotemporal feature vector using an adaptive clustering algorithm to generate a plurality of device clusters includes: Initialize the cluster center of the adaptive clustering algorithm to the feature vectors corresponding to the first K security monitoring devices with the highest abnormal signal strength in the spatiotemporal feature vector, where K is the preset number of initial clusters; Calculate the cosine similarity between the spatiotemporal feature vector of each security monitoring device and all cluster centers, and assign the device to a temporary cluster based on the similarity threshold; For each temporary cluster, the mean and variance of the spatiotemporal feature vectors of the security monitoring devices within the temporary cluster are counted. If the variance is greater than the set variance threshold, the temporary cluster is split into two subclusters and a new cluster center is added; Recalculate the similarity between all security monitoring devices and the updated cluster center according to the split sub-clusters, and iteratively perform the allocation and splitting operations until the internal variances of all clusters are lower than the set variance threshold; Adjacent clusters whose spatiotemporal feature vector similarity is greater than the set merging threshold are merged, and isolated clusters whose number of devices is lower than the minimum size threshold are deleted to generate multiple stable device clusters.

4. The intelligent security data analysis and decision-making method based on artificial intelligence according to claim 3 is characterized in that: The abnormal signal correlation of the security monitoring equipment in the equipment cluster is analyzed by the abnormal propagation network model to generate cluster-level risk prediction results and equipment coordinated response instructions, including: Constructing an anomaly propagation graph with device clusters as nodes, wherein the weights of the edges in the anomaly propagation graph are jointly determined by the temporal synchronization and spatial proximity of the anomaly signals between devices; Inputting the spatiotemporal feature vector of each device cluster into the graph convolution layer of the anomaly propagation network model to extract potential risk features of cluster nodes; Analyzing the evolution pattern of potential risk characteristics at consecutive time steps through the time recursive layer of the anomaly propagation network model, and predicting the probability of risk outbreak of cluster nodes in the future time window; If the risk outbreak probability exceeds the preset probability, the device collaborative response instruction generation process is triggered, and the device collaborative response instruction generation process specifically includes: Assign the roles of master and auxiliary devices according to the deployment coordinates and monitoring capabilities of the security monitoring devices in the device cluster; Based on the real-time data feedback from the main control device, dynamically adjust the working mode and data collection frequency of the auxiliary equipment; Generate cross-device collaborative warning signal transmission paths to ensure low-latency synchronization of warning information between devices in the cluster; The dynamically adjusting the node weights of the abnormal propagation network model and updating the clustering centers of the adaptive clustering algorithm to optimize subsequent cluster divisions include: Collecting execution effect data of the device collaborative response instruction, wherein the execution effect data includes risk suppression response time, device collaboration success rate and false alarm rate; Calculating the prediction error gradient of the abnormal propagation network model according to the execution effect data, and updating the weight parameters of the graph convolution layer and the time recursive layer through the back propagation algorithm; Reapply the updated anomaly propagation network model to the historical spatiotemporal feature vectors to generate revised cluster-level risk prediction results; Compare the differences in cluster-level risk prediction results before and after correction, and identify the equipment cluster with the largest prediction deviation as the cluster center optimization target; For the cluster center optimization target, interpolate the spatiotemporal feature vector mean of the cluster center optimization target with the feature vectors of adjacent clusters to generate a new cluster center and replace the original center; A new round of device clustering is triggered until the prediction deviations of all clusters are below the convergence threshold.

5. The intelligent security data analysis and decision-making method based on artificial intelligence according to claim 4 is characterized in that: The method further comprises: An adversarial training mechanism is introduced into the spatiotemporal feature fusion model, a simulated heterogeneous data stream containing random noise is synthesized by generating an adversarial network, and the simulated data stream is mixed with the real data stream and input into the spatiotemporal feature fusion model; Calculate the feature extraction error of the spatiotemporal feature fusion model for the simulated data stream, and use the feature extraction error as an attention mechanism layer parameter of the adversarial loss function optimization model; When the feature extraction error of the spatiotemporal feature fusion model for the simulated data stream is lower than a preset proportion of the real data stream error, it is determined that the spatiotemporal feature fusion model has achieved the anti-noise training goal.

6. The intelligent security data analysis and decision-making method based on artificial intelligence according to claim 5 is characterized in that: The method further comprises: Assign a dynamic risk level label to each device cluster, wherein the dynamic risk level label is generated by matching the cluster-level risk prediction results and the historical risk event library; When it is detected that the risk level labels of multiple device clusters are upgraded at the same time, a cross-cluster risk linkage analysis process is initiated, which includes: Extract the spatiotemporal feature vectors of risk clusters and edge weight data in the anomaly propagation graph; Identify potential association paths between risk clusters through a community discovery algorithm, and calculate the risk transmission intensity on the potential association paths; If the risk transmission intensity exceeds the linkage threshold, the clusters on the potential association path are merged into a focus cluster, and a global coordinated response strategy is generated; The global coordinated response strategy includes: Elect the leading device node in the focus cluster to centrally dispatch the monitoring resources of all security monitoring devices; Establish redundant data backup channels across clusters to enable seamless migration of critical data in the event of device failure; The cluster center position of the focus cluster is adjusted to cover the spatiotemporal feature distribution range of all associated clusters.

7. The intelligent security data analysis and decision-making method based on artificial intelligence according to claim 6 is characterized in that: The method further comprises: Constructing a hierarchical topology structure of a device cluster, wherein the hierarchical topology structure includes a physical layer, a feature layer, and a decision layer; The physical layer records the device deployment coordinates and hardware connection relationships of the cluster; The feature layer stores the spatiotemporal feature vectors and historical risk prediction results of the cluster; The decision-making layer maintains equipment coordinated response instructions and dynamic adjustment records; The following functions are achieved through the inter-layer mapping relationship between topological structures: When the physical layer detects that a device node fails, it selects a backup device with the closest temporal and spatial characteristics from the feature layer to join the cluster; When the execution effect of the instructions of the decision layer does not meet expectations, the spatiotemporal vector re-extraction process of the feature layer is triggered; When the risk prediction results of the feature layer change, the response instruction generation logic of the decision layer is updated synchronously.

8. The intelligent security data analysis and decision-making method based on artificial intelligence according to claim 7 is characterized in that: The method further comprises: Integrate an interpretable analysis module into the anomaly propagation network model to visualize the basis for risk prediction decisions; The interpretability analysis module performs the following operations: Extract high-dimensional feature activation maps of cluster nodes in the graph convolution layer and generate human-understandable semantic labels through dimensionality reduction mapping; Record the focus of the time recursive layer at different time steps to form a visual timeline of the risk evolution path; The contribution percentage of each influencing factor in the process of generating collaborative response instructions of the marking equipment; When the manual review module proposes revision opinions on the automatically generated response instructions, the labeling rules of the explainability analysis module are reversely adjusted according to the revision opinions.

9. The intelligent security data analysis and decision-making method based on artificial intelligence according to claim 8 is characterized in that: The method further comprises: An evolution mechanism of a device cluster is established, wherein the evolution mechanism includes: Periodically collect new monitoring data patterns from devices within the cluster to identify event types that have not been monitored before; When the occurrence frequency of the unmonitored event type exceeds a set learning threshold, triggering the incremental learning process of the spatiotemporal feature fusion model; In the incremental learning process, most layers of the original parameters of the abnormal propagation network model are frozen, and only the last layer of the fully connected network and the attention mechanism weights are fine-tuned; Re-extracting the spatiotemporal feature vectors of the abnormal propagation network model updated by the incremental learning, and triggering the dynamic reorganization of the device cluster; Record the changes in model performance after each incremental learning. When the performance improvement is lower than the degradation threshold, roll back to the previous stable version of the anomaly propagation network model.

10. An intelligent security data analysis and decision-making system based on artificial intelligence, characterized in that: The artificial intelligence-based intelligent security data analysis and decision-making system includes a processor and a memory, the memory is connected to the processor, the memory is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the memory to implement the artificial intelligence-based intelligent security data analysis and decision-making method described in any one of claims 1 to 9 above.

Images