Intelligent Internet of Things public security management and control system and method based on multi-source data fusion

Abstract

The invention provides an intelligent Internet of Things public security management and control system and method based on multi-source data fusion, and belongs to the technical field of Internet of Things security. According to the system, unified collection and standardized processing of multi-source data are achieved by recognizing a system operation scene and loading corresponding model parameters and response strategies, and a unified semantic representation structure is constructed. And the system executes anomaly detection at an edge node, completes risk scoring and grading alarm judgment in combination with a semantic structure and anomaly feature information, and generates a control response instruction based on strategy matching. Meanwhile, dynamic optimization of the scoring model and identity authentication, behavior auditing and data compliance export in the operation process are supported. The system has intelligent identification, adaptive analysis and response closed loop capabilities, and improves the precision and credibility of public security management in the Internet of Things environment.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and particularly to an intelligent Internet of Things public security control system and method based on multi-source data fusion. Background Art

[0002] With the rapid development of Internet of Things technology, a large number of sensing terminals, video surveillance devices, network communication nodes, and environmental monitoring units have been deployed in the field of public security to achieve real-time perception and control of key scenarios such as urban operation, industrial site, transportation, and energy facilities. These sensing devices continuously generate operation data of multiple types and structures, and thus the public security control system gradually develops towards multi-source perception, data fusion, and intelligent response.

[0003] Currently, during the operation of many Internet of Things security systems, the analysis and scoring of various security indicators are generally carried out by means of rule engines, linear scoring, threshold judgment, etc., and alarm judgment and response control are combined based on the scoring results. Typical practices include: setting fixed upper and lower limit intervals for each risk indicator for normalized scoring; setting scoring weights according to expert experience; and adopting fixed alarm strategies and control command templates for response. However, the existing technologies still have great limitations in the following aspects: there is a lack of a unified processing mechanism for multi-source heterogeneous data, and the data fusion ability is limited; most of the scoring mechanisms are based on static models and lack the dynamic adaptation ability to changes in the system environment; the weight setting method is single and cannot reflect the relative risk sensitivity of each indicator under different operating states; there is a lack of effective suppression strategies for abnormal disturbances, the scoring process is highly sensitive to sudden abnormalities, affecting the stability of the results; there is a lack of linkage logic between the alarm level and the control strategy, resulting in lagged response or low precision of strategy matching; most of the scoring models cannot automatically evolve according to feedback information, and there is a risk of accuracy decline during long-term operation.

[0004] Therefore, the existing Internet of Things public security control system urgently needs a technical solution that can support multi-source data fusion, an adaptive scoring mechanism, strong anomaly robustness, and has the ability of response strategy linkage and model self-optimization to meet the requirements of real-time perception, intelligent judgment, and reliable disposal of public security events in a complex dynamic environment. Summary of the Invention

[0005] Aiming at the problems existing in the existing Internet of Things public security control system, such as difficulties in multi-source data fusion, rigidity of the scoring mechanism, insufficient environmental adaptability, disconnection of alarm response, inability of the model to self-evolve, and lack of trustworthy governance of the system, the present invention provides an intelligent Internet of Things public security control system and method based on multi-source data fusion.

[0006] To achieve the above object, the present invention is realized through the following technical solutions: An intelligent Internet of Things public security control system based on multi-source data fusion, comprising: A scenario adaptation and configuration module, configured to identify the current system operation scenario, and load a scoring model parameter configuration file and a response policy template corresponding to the operation scenario; An adaptive acquisition module, configured to uniformly acquire and preprocess multi-source data from physical sensors, video monitoring terminals, device log systems, environmental monitoring units, and network communication nodes, and generate standardized data with a unified structure; A semantic fusion module, configured to extract entity, attribute, and relationship information from the standardized data, convert it into semantic triples, and construct a unified semantic representation structure; An edge anomaly processing module, configured to perform local anomaly detection operations on the standardized data at an edge computing node, and output anomaly output information, where the anomaly output information includes an anomaly identification mark, an anomaly score value, and characteristic index parameters associated with the anomaly event; A security scoring module, configured to receive the unified semantic representation structure and the anomaly output information, and based on a scoring index system and preset rules, construct a scoring model based on the scoring model parameter configuration file for fusion analysis, and output a risk scoring result; An intelligent alarm module, configured to perform hierarchical alarm judgment according to the risk scoring result, and generate corresponding control response operation instructions based on the response policy template; A model optimization module, configured to update the scoring model parameters according to historical data and feedback information; A trusted governance module, configured to implement user identity authentication, operation behavior auditing, and structured data export, and realize trusted management of the system operation process.

[0007] As a preferred solution of the present invention, the scenario adaptation and configuration module includes: A scenario recognition unit, configured to recognize the type of the current system operation scenario through device category identifiers, deployment parameters, or user marking information; A standard preparation and loading unit, configured to load a scoring model parameter configuration file corresponding to the recognized operation scenario type according to the recognized operation scenario type, where the scoring model parameters include: types of risk indicators participating in scoring, and normalization function types, risk scoring thresholds, initial weights, and risk sensitivity coefficients corresponding to each risk indicator; A policy template matching unit, configured to automatically load a corresponding response policy template according to the operation scenario type, where the response policy template includes a control action sequence, signal channel parameters, and communication protocol adaptation items; An ontology structure adaptation unit, configured to automatically load an ontology description file conforming to the OWL or RDF semantic format according to the scenario definition, and update semantic label and namespace configuration data.

[0008] As a preferred embodiment of the present invention, the adaptive acquisition module includes: A protocol recognition unit, configured to recognize the communication protocol type based on the field features or initial data frames in the initialization handshake message of the access data source, and call the corresponding parser from a preset protocol driver library to achieve compatible parsing of MQTT, Modbus, OPC-UA, HTTP, and custom protocols; A time synchronization unit, configured to unify the timestamps of each data source using the NTP protocol of the master node, and perform linear interpolation on the data with a sampling interval exceeding a preset threshold through a sliding time window; A data structure conversion unit, which encapsulates the formats of the collected image data, text data, and sensor numerical data. Among them, the image data extracts image entity information through the YOLOv7 model, the text data extracts keywords, syntactic fragments, and context features by the BERT model, the sensor numerical data is normalized and tagged with signal type labels, and the data after format encapsulation forms standardized data with a unified structure.

[0009] As a preferred embodiment of the present invention, the semantic fusion module includes: A device status modeling unit, configured to convert the sensor numerical data tagged with signal type labels into corresponding device status triples based on the template matching method, including device identification, attribute category, and current value; A text semantic extraction unit, configured to call a preset large language model to perform semantic entity extraction and relationship recognition on the keywords, syntactic fragments, and context features extracted from the text data, and construct behavior semantic triples, including action subject, attribute change, and status identification fields; An image semantic extraction unit, configured to input the image entity information into a pre-trained object detection model, identify key devices or behavior objects, and map the recognition results to entity nodes in the semantic graph according to the label mapping table, and construct visual semantic triples, including visual entities, actions or positions, and spatial objects; A knowledge graph reasoning unit, configured to uniformly organize the device status triples, behavior semantic triples, and visual semantic triples, construct a unified semantic representation structure, and perform entity relationship vector learning based on the graph embedding algorithm TransE to complete the missing relationships, and only retain the entity relationships with an inference confidence higher than the set threshold for graph update.

[0010] As a preferred embodiment of the present invention, the edge anomaly processing module includes: A data screening unit, configured to perform data quality detection on the received standardized data, including calculating the field missing rate, sampling frequency offset, and mean fluctuation index, and removing the data samples with quality lower than the set threshold; Anomaly detection unit, which is used to perform differential judgment based on the deviation relationship between the historical statistical mean within the sliding time window and the current sampled value, and filter out possible abnormal data in combination with a preset threshold; the anomaly detection unit further supports deploying a lightweight one-dimensional convolutional neural network model at the edge node to identify anomalies in the change patterns of multivariate data, and the parameters of the lightweight one-dimensional convolutional neural network model are periodically synchronized and updated by the central node; Data annotation unit, which is used to calculate the anomaly confidence for the detected abnormal data, and generate an anomaly score value through a non-linear attenuation function based on the anomaly confidence value, and the anomaly score value is used to annotate the quality level of the abnormal data, including multiple levels such as high quality, medium quality, and low quality.

[0011] As a preferred solution of the present invention, The security scoring module includes the following units and constructs a scoring model in the following order: Weight adjustment unit, which is used to dynamically correct the initial weights of each risk indicator according to the deviation between the current environmental state parameters of the system and the reference standard value to output dynamic weights , and the calculation formula is: ; where: is the current observed value of the th environmental parameter, is the reference standard value of the th environmental parameter; is the weight adjustment coefficient of the th environmental parameter for the th entity on the th risk indicator; is the hyperbolic tangent function, which is used to limit the environmental deviation within the interval and suppress abnormal fluctuations; Indicator scoring unit, which is used to perform non-linear normalization evaluation on the observed values of each risk indicator, and combine the dynamic weights to output the original score value is the risk sensitivity coefficient; is a very small constant to avoid the denominator being zero; Anomaly correction unit, used to correct anomaly scores based on the output of edge anomaly processing module , the original score value Perform nonlinear suppression correction and output the final score value , the calculation formula is: ; in: For the The abnormal score value of the risk indicator, is the abnormal tolerance coefficient, which indicates the system's tolerance to the The tolerance level for abnormality of each risk indicator; is the abnormal control weight coefficient, which is used to adjust the suppression strength; Total score calculation unit, used to calculate the final score of each risk indicator By dynamic weight Perform weighted summation to generate the final fused risk score result , the formula is: ; in: is the total number of risk indicators.

[0012] As a preferred solution of the present invention, the intelligent alarm module includes: A graded alarm judgment unit is used to judge the risk according to the risk scoring result. The risk score is based on the set risk threshold and the warning level is divided. When the risk score is less than the first threshold, the system enters the early warning state; Between the first threshold and the second threshold, and the risk score result When the corresponding abnormal score alarm limit is exceeded, the system enters the alarm state; when the risk score result When it is not lower than the second threshold, the system enters an emergency state; A policy matching unit, used to retrieve matching policy parameters from a response policy template according to the current alarm level, including condition-action response rules, control mode fields, and target device mapping parameters, for dynamically triggering system control policies; The control instruction sending unit is used to generate a structured control response operation instruction based on the MQTT protocol or the Modbus-TCP protocol, including a control type, a device identification and an action parameter control field, and send the control response operation instruction to the target device, determine whether the control response operation instruction is successfully executed based on the feedback information returned by the target device, and generate a control closed-loop record when the execution is successful.

[0013] As a preferred embodiment of the present invention, The model optimization module includes: A feature attribution unit, configured to calculate the contribution degree of the input parameters of the scoring model to the original scoring value based on the SHAP algorithm ; An incremental learning unit, configured to locally update the following parameters of the scoring model by combining small-batch data input and a gradient update mechanism without re-totally training: dynamic weight ; risk sensitivity coefficient ; anomaly tolerance coefficient and anomaly control weight coefficient ; The gradient update is based on the contribution degree result output by the feature attribution unit, and preferentially adjusts the parameters that have a significant impact on the score.

[0014] As a preferred embodiment of the present invention, the trusted governance module includes: An identity authentication unit, configured to perform access identity authentication between the user and the module based on an access control policy and the OAuth2.0 protocol; An operation auditing unit, configured to record policy configuration changes, model updates, and control response operation instructions, and add timestamp identifiers and chained signature information to key operations; An operation evidence storage unit, configured to calculate a digest of the execution result of the control response operation instruction, generate a digest value based on a hash function, and store the digest result in a distributed ledger through a blockchain node; A data export unit, configured to provide a RESTful interface to export historical alarm data and policy adjustment records according to a time interval or event type, and attach corresponding structured evaluation fields and audit metadata.

[0015] An intelligent Internet of Things public security control method based on multi-source data fusion includes the following steps: Step 1: Identify the running scenario of the current system, load the scoring model parameter configuration file and response policy template corresponding to the running scenario, and provide a parameter basis for scoring and control; Step 2: Collect multi-source data from physical sensors, video monitoring terminals, device log systems, environmental monitoring units, and network communication nodes, and perform protocol parsing, time synchronization, and format encapsulation on the collected data to generate standardized data with a unified structure; Step 3: Perform semantic processing on the standardized data, extract entity, attribute, and relationship information, construct semantic triples, and construct a unified semantic representation structure with the triples as the input of the scoring model; Step 4: Input the standardized data into the edge anomaly processing module, perform local anomaly detection, and generate anomaly output information, where the anomaly output information includes an anomaly identification flag, an anomaly score value, and associated feature index parameters; Step 5: Parse the score model parameter configuration file, extract the score metrics, normalization function type, risk threshold, metric weights, and score sensitivity coefficients required for the current operating scenario, and construct a score model; Step 6: Input the unified semantic representation structure and the anomaly output information into the score model, perform fusion analysis, and output the risk score values of each metric and the overall risk score result of the system; Step 7: Based on the risk score result, perform hierarchical alarm judgment, and generate control response operation instructions according to the response strategy template to achieve the linkage execution of the preset control devices; Step 8: Use the historical score data generated during the operation and the feedback information confirmed manually to update the index parameters in the score model parameter configuration file; Step 9: Record the system operation behavior, perform user identity authentication and behavior auditing, and export structured data for system management and external interface calls.

[0016] The beneficial effects of the present invention are as follows: the present invention, through modular architecture design, opens up the whole process path from scene recognition, data collection, semantic modeling, risk analysis, alarm response to behavior governance in the process of public safety management and control of the Internet of Things. The system can accurately load the corresponding scoring model parameters and response strategies according to the current operating environment, and realize scene-oriented adaptive deployment; by integrating multi-source data collection mechanism, the problem of standardized processing of heterogeneous equipment data is solved; relying on the construction method of semantic triples and unified semantic structure, the system has the ability to understand the association of cross-modal data, and provides semantic support for subsequent anomaly detection and risk assessment. After introducing the edge anomaly processing module, the system has the ability to identify and annotate field-level anomalies, which significantly improves the response agility and boundary security prevention and control capabilities to emergencies. In the risk assessment stage, the scoring mechanism designed by the present invention can integrate semantic entity states and abnormal feature indicators, and perform multi-factor fusion analysis on various risk indicators according to preset rules, and output risk scoring results with discrimination and robustness, effectively avoiding the problem that traditional scoring models are overly sensitive to mutation values ​​or single-point anomalies. The scoring results will drive the intelligent alarm module to automatically determine the current risk level, and link the loaded response strategy template to match the control plan to ensure that the system can implement corresponding control responses under different alarm levels, forming an analysis-driven active prevention and control path. During the operation of the system, it also has the ability to optimize the model based on feedback data, and can continuously update and correct the scoring parameters to adapt to environmental changes and data distribution drift. At the same time, the system integrates trusted governance capabilities such as identity authentication, operation auditing and data export to provide compliance and traceability guarantees for the entire management and control process. The management and control system provided by the present invention has significant improvements in fusion capabilities, scoring accuracy, response efficiency and evolvability, and can effectively support multi-source perception, intelligent judgment and closed-loop response requirements in complex public safety scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them: Figure 1 It is a schematic diagram of the overall architecture of the system of the present invention; Figure 2 This is a safety scoring flow chart in an embodiment of the present invention; Figure 3 It is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the following will clearly and completely describe the technical solutions of the embodiments of the present invention with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the described embodiments of the present invention fall within the scope of protection of the present invention.

[0019] To facilitate the understanding of the present invention, the following definitions are given for some terms involved in the specification. Unless otherwise specified, those skilled in the art should understand that the meanings of these terms in the present invention are limited within the scope of the technical content described in this application: Abnormal score value: It refers to the value obtained by the system through quantitative evaluation of the detected abnormal data, reflecting the degree of data abnormality. The higher the value, the more serious the abnormality.

[0020] Risk sensitivity coefficient: It is used to adjust the response intensity of the scoring function to the change of indicators. The larger the value, the more sensitive the scoring function is to abnormal changes.

[0021] Control response operation instruction: It refers to the control command generated by the system according to the risk level, including the control type, target device, and action parameters, and is used to trigger specific control operations.

[0022] As Figure 1 shown, it is an embodiment of the present invention. This embodiment provides an intelligent Internet of Things public security management and control system based on multi-source data fusion, including: (1) Scenario adaptation configuration module It is used to identify the current system operation scenario and load the scoring model parameter configuration file and response strategy template corresponding to the operation scenario; The scenario adaptation configuration module includes: Scenario recognition unit, which is used to identify the type of the current system operation scenario through device category identification, deployment parameters, or user marking information; Standard preparation loading unit, which is used to load the scoring model parameter configuration file corresponding to the identified operation scenario type according to the identified operation scenario type. The scoring model parameters include: the types of risk indicators participating in the scoring, and the corresponding normalization function type, risk score threshold, initial weight, and risk sensitivity coefficient for each risk indicator; Policy template matching unit, which is used to automatically load the corresponding response strategy template according to the operation scenario type. The response strategy template includes a control action sequence, signal channel parameters, and communication protocol adaptation items; Ontology structure adaptation unit, which is used to automatically load the ontology description file conforming to the OWL or RDF semantic format according to the scenario definition and update the semantic label and namespace configuration data.

[0023] In an embodiment of the present invention, the scenario adaptation configuration module is used to automatically identify the current scenario and load the corresponding scoring model parameters and response strategy template when the system starts or the operating environment changes, so as to realize dynamic adaptation of the model and control logic.

[0024] The system identifies the current operating scenario by collecting device identification, deployment parameters and user configuration information, and calls the corresponding model configuration file from the parameter library based on the scenario label, including the scoring indicator set, normalization function type, weight initial value and risk sensitivity coefficient, etc., to drive the scoring module to perform on-demand calculations.

[0025] Subsequently, the system matches the response strategy template corresponding to the scenario, loads the control instruction sequence, communication parameters and protocol settings, and realizes the linkage between the scoring results and the control response. To ensure semantic consistency, the system will also call the semantic ontology file associated with the scenario (in OWL or RDF format), complete the update of the label namespace and attribute definition, and support subsequent data semantic fusion.

[0026] The module has capabilities such as runtime perception, on-demand loading, and adaptive configuration, and can achieve efficient deployment and policy linkage in complex environments. Different from traditional static configuration solutions, it improves scoring accuracy and response adaptability.

[0027] (2) Adaptive acquisition module It is used to uniformly collect and preprocess multi-source data from physical sensors, video surveillance terminals, equipment log systems, environmental monitoring units, and network communication nodes to generate standardized data with a unified structure; The adaptive acquisition module comprises: The protocol identification unit is used to identify the communication protocol type based on the field characteristics or initial data frame in the initialization handshake message of the access data source, and call the corresponding parser from the preset protocol driver library to achieve compatible parsing of MQTT, Modbus, OPC-UA, HTTP and custom protocols; A time synchronization unit is used to unify the timestamps of various data sources using the NTP protocol of the master control node, and to perform linear interpolation on data whose sampling interval exceeds a preset threshold through a sliding time window; The data structure conversion unit formats the collected image data, text data, and sensor numerical data. The image data uses the YOLOv7 model to extract image entity information, the text data uses the BERT model to extract keywords, syntactic fragments, and context features, and the sensor numerical data is normalized and annotated with signal type labels. The format-encapsulated data forms standardized data with a unified structure.

[0028] In an embodiment of the present invention, the adaptive acquisition module is used to uniformly acquire and preprocess multi-source data from various Internet of Things terminals. After the system accesses the data, it first automatically analyzes the communication protocol type through a protocol recognition mechanism and loads the corresponding decoding module to achieve compatible access to a variety of standard and customized protocols.

[0029] Subsequently, the system unifies the timestamps of each data source through a time synchronization unit, and uses a sliding time window for alignment and interpolation to solve the timing deviation caused by different sampling frequencies and delays.

[0030] The multi-modal data is encapsulated in format in the structure conversion unit. The image data extracts target information, the text data extracts semantic triples, and the sensor data completes index normalization annotation. Finally, a standardized data structure with time, semantic, and source identifiers is uniformly generated for direct invocation by subsequent modules.

[0031] Through this module, the system realizes heterogeneous protocol recognition, multi-source time alignment, and semantic unified structure generation, providing standardized and time-sequence consistent data support for semantic fusion and scoring analysis.

[0032] (3) Semantic fusion module It is used to extract entity, attribute, and relationship information from the standardized data, convert it into semantic triples, and construct a unified semantic representation structure; The semantic fusion module includes: The device state modeling unit is used to convert the sensor numerical data with signal type labels added into corresponding device state triples based on the template matching method, including device identification, attribute category, and current value; The text semantic extraction unit is used to call a preset large language model to perform semantic entity extraction and relationship recognition on keywords, syntactic fragments, and context features extracted from text data, and construct behavior semantic triples, including action subject, attribute change, and status identification fields; The image semantic extraction unit is used to input the image entity information into a pre-trained object detection model, identify key devices or behavior objects, and map the recognition results to entity nodes in the semantic graph according to the label mapping table to construct visual semantic triples, including visual entities, actions or positions, and spatial objects; The knowledge graph reasoning unit is used to uniformly organize the device state triples, behavior semantic triples, and visual semantic triples, construct a unified semantic representation structure, and perform entity relationship vector learning based on the graph embedding algorithm TransE to complete the missing relationships, and only retain the entity relationships with inference confidence higher than the set threshold for graph update.

[0033] In this embodiment, the semantic fusion module is used to convert the device identification, attributes, and status information in the structured data into semantic triples and construct a unified semantic representation structure. The system organizes the data into the format of "subject-attribute-value" based on template rules or model recognition, supporting semantic mapping of multiple data types.

[0034] The text data extracts entities and relationships through a language model, and the image data identifies key objects through a detection model, both of which are converted into semantic nodes. The fusion result forms a graph structure, and the entity relationships are complemented through graph inference algorithms to enhance semantic association and cross-modal understanding capabilities.

[0035] (4) Edge anomaly handling module It is used to perform local anomaly detection operations on the standardized data at the edge computing node and output anomaly output information, where the anomaly output information includes anomaly identification marks, anomaly score values, and characteristic index parameters associated with the anomaly event. The edge anomaly handling module includes: A data screening unit, which is used to perform data quality detection on the received standardized data, including calculating the field missing rate, sampling frequency offset, and mean fluctuation index, and removing data samples with quality lower than the set threshold. An anomaly detection unit, which is used to perform differential judgment based on the deviation relationship between the historical statistical mean and the current sampling value within a sliding time window, and screen out possible abnormal data in combination with a preset threshold; the anomaly detection unit further supports deploying a lightweight one-dimensional convolutional neural network model at the edge node to identify the change patterns of multivariate data, and the parameters of the lightweight one-dimensional convolutional neural network model are periodically synchronized and updated by the central node. A data annotation unit, which is used to calculate the anomaly confidence level for the detected abnormal data and generate an anomaly score value through a non-linear attenuation function based on the anomaly confidence level value. The anomaly score value is used to label the quality level of the abnormal data, including multiple levels such as high quality, medium quality, and low quality.

[0036] In this embodiment, the edge anomaly handling module is deployed at the edge node to perform real-time quality detection and anomaly identification on the standardized data at the data acquisition end, reducing system latency and bandwidth occupancy.

[0037] The module first judges the sampling integrity and fluctuation characteristics through data screening and removes data samples that do not meet the quality standards. Subsequently, based on the sliding time window, it analyzes the deviation relationship between the historical and current values and combines threshold calculation to identify potential anomalies.

[0038] On this basis, the module calls a lightweight convolutional neural network model to analyze the change patterns among multivariate data and further determine the types and characteristics of abnormal events. The model parameters can be updated synchronously by the central node periodically to improve the generalization ability and adaptability of the edge model.

[0039] The detected abnormal data will be calculated for confidence scores by the annotation unit, and output in high, medium, and low levels based on the deviation degree and the model judgment confidence, for reference by the subsequent scoring module.

[0040] (5) Security Scoring Module It is used to receive the unified semantic representation structure and the abnormal output information, construct a scoring model based on the scoring index system and preset rules, and perform fusion analysis based on the scoring model parameter configuration file to output the risk scoring result; In the embodiment of the present invention, the security scoring module realizes the dynamic quantitative evaluation of various risk indicators through a multi-stage scoring mechanism. This module is based on the standardized structure input and abnormal output, and performs scoring calculations in combination with the scenario-related parameter configuration file.

[0041] As Figure 2 shown, the security scoring module includes the following units and constructs the scoring model in the following order: Step S201: Weight Adjustment Unit Dynamically adjust the weight of each indicator according to the difference between the current value and the reference standard value of each risk indicator.

[0042] Optimize the weight of each indicator by calculating the adjustment factor, so that the model can be adjusted in real time according to environmental changes.

[0043] In a specific embodiment, according to the current environmental state parameters of the system and the reference standard value of the deviation, dynamically correct the initial weights of each risk indicator , and output the dynamic weight , and the calculation formula is: ; Where: is the current observed value of the th environmental parameter, and the reference standard value of the th environmental parameter; the adjustment coefficient of the th environmental parameter for the weight of the th indicator; is the hyperbolic tangent function, which is used to limit the environmental deviation in the interval and suppress abnormal fluctuations; Step S202: Indicator Scoring Unit Perform frequency division on the dynamically adjusted risk indicators; Based on the adjusted weights, scores are assigned to each risk indicator. This process ensures high accuracy and comparability of the final scores by converting various data into unified score values.

[0044] In a specific embodiment, the observed values of each risk indicator are evaluated by non-linear normalization and combined with the dynamic weights to output the original score value The calculation formula is: ; Where: is the current observed value of the th entity on the , is the preset upper threshold and lower threshold of the th indicator; is the risk sensitivity coefficient, which controls the sensitivity of the score to the threshold boundary; is a very small constant to avoid a zero denominator; Step S203: Abnormality correction unit Identify and correct the score deviation caused by abnormalities;

[0045] In a specific embodiment, based on the abnormal score value output by the edge abnormality processing module , perform non-linear suppression correction on the original score value to output the final score value The calculation formula is: ; Where: is the abnormal score value of the th indicator, is the abnormal tolerance coefficient, indicating the tolerance degree of the system to the abnormality of the th indicator; is the abnormal control weight coefficient, used to adjust the suppression intensity, for further strengthening the suppression of abnormal values; Step S204: Total score calculation unit Finally, the corrected scores of each indicator are aggregated according to the weights to obtain the total risk score of the system. This score reflects the current overall risk status of the system and is an important basis for decision-making and response mechanisms.

[0046] In a specific embodiment, the final scores of each indicator are Generate the overall risk score of the system through weighted summation , and the formula is: ; Where: is the total number of risk indicators.

[0047] In this embodiment, by comprehensively considering multi-source data and different environmental conditions, and using the collaborative work of multiple modules such as weight adjustment, indicator scoring, anomaly correction, and total scoring, the accuracy and response speed of the Internet of Things public security management control system are significantly improved. Especially in the dynamic fusion and real-time monitoring of multi-source data, it has higher intelligence and adaptability compared with the prior art. This embodiment can comprehensively evaluate the potential safety hazards that may occur in the environment in real time and accurately, and provide effective management and control strategies, which can effectively reduce the probability of public security incidents and improve the public security level.

[0048] (6) Intelligent alarm module It is used to perform hierarchical alarm judgment according to the risk score result, and generate corresponding control response operation instructions based on the response strategy template; The intelligent alarm module includes: Hierarchical alarm judgment unit, which is used to divide the alarm level according to the risk score result and the set risk threshold. Among them, when the risk score result is less than the first threshold, the system enters the early warning state; when the risk score result is between the first threshold and the second threshold, and the risk score result exceeds the corresponding abnormal score alarm limit value, the system enters the alarm state; when the risk score result is not lower than the second threshold, the system enters the emergency state; Policy matching unit, which is used to retrieve matching policy parameters from the response strategy template according to the current alarm level, including condition-action response rules, control mode fields, and target device mapping parameters, for dynamically triggering the system control strategy;

[0049] (7) Model optimization module It is used to update the scoring model parameters according to historical data and feedback information; The model optimization module includes: A feature attribution unit, which is used to identify the key input dimensions that cause score changes by using the feature importance ranking result output by a trained random forest model or calculating the input parameters in each scoring model based on the SHAP algorithm, including: the current observation value , the risk sensitivity coefficient , the preset initial weight to the original score value ; An incremental learning unit, which is used to locally update the non-linear function parameters and weight correction terms in the scoring model by combining the small-batch data input method and the gradient update mechanism without re-training the whole model; the scoring model is a combined structure that performs normalized scoring on each index and integrates a weight correction mechanism; A policy adaptive correction unit, which is used to reconfigure the mapping relationship between the configured alarm level and the response action according to the deviation trend of the key indicators involved in the risk score result; A knowledge graph update unit, which is used to access the newly added semantic triples through the semantic graph interface, perform entity injection operations and conflict triple screening, and update the connection relationship between semantic nodes.

[0050] (8) Trusted governance module It is used to implement user identity authentication, operation behavior auditing and structured data export, and realize the trusted management of the system operation process.

[0051] The trusted governance module includes: An identity authentication unit, which is used to perform access identity authentication between users and modules based on the access control policy and the OAuth2.0 protocol; An operation auditing unit, which is used to record policy configuration changes, model updates and control response operation instructions, and add timestamp identification and chain signature information to key operations; An operation evidence storage unit, which is used to calculate the summary of the execution result of the control response operation instruction, generate a summary value based on the hash function, and store the summary result in the distributed ledger through the blockchain node; A data export unit, which is used to provide a RESTful interface to export historical alarm data and policy adjustment records according to the time interval or event type, and attach the corresponding structured evaluation fields and audit metadata.

[0052] As Figure 3 shown, in the intelligent Internet of Things public security control system based on multi-source data fusion described in the present invention, a complete control method is proposed to realize data-driven security situation recognition, risk judgment, response control and compliance governance in the actual deployment scenario. This method can be applied to fields such as urban traffic, campus security, park management, and intelligent industry.

[0053] The method includes the following steps: Step 1: Identify the operating scenario of the current system, load the scoring model parameter configuration file and response strategy template corresponding to the operating scenario, and provide a parameter basis for scoring and control; Step 2: Collect multi-source data from physical sensors, video monitoring terminals, device log systems, environmental monitoring units, and network communication nodes, and perform protocol parsing, time synchronization, and format encapsulation on the collected data to generate standardized data with a unified structure; Step 3: Perform semantic processing on the standardized data, extract entity, attribute, and relationship information, construct semantic triples, and construct a unified semantic representation structure with the triples as the input of the scoring model; Step 4: Input the standardized data into the edge anomaly processing module to perform local anomaly detection and generate anomaly output information, where the anomaly output information includes anomaly identification marks, anomaly score values, and associated feature index parameters; Step 5: Parse the scoring model parameter configuration file, extract the scoring indicators, normalization function types, risk thresholds, indicator weights, and scoring sensitivity coefficients required for the current operating scenario, and construct a scoring model; Step 6: Input the unified semantic representation structure and anomaly output information into the scoring model to perform fusion analysis and output the risk score values of each indicator and the overall risk scoring result of the system; Step 7: Based on the risk scoring result, perform hierarchical alarm judgment, and generate control response operation instructions according to the response strategy template to achieve the linkage execution of preset control devices; Step 8: Use the historical scoring data generated during operation and the feedback information confirmed by humans to update the indicator parameters in the scoring model parameter configuration file; Step 9: Record the system operation behavior, perform user identity authentication and behavior auditing, and export structured data for system management and external interface calls.

[0054] In summary, the present invention constructs a modular and scalable system architecture around the entire process of "data standardization, semantic fusion, anomaly detection, risk scoring, intelligent response, and model optimization", which has high scene adaptability, evaluation accuracy, and response coordination. By introducing a dynamic non-linear scoring mechanism, environmental perception weight adjustment, anomaly robustness correction, and ontology-driven semantic structure mapping, the present invention breaks through the technical bottlenecks in existing public safety scoring models that rely on fixed weights, linear scoring, and manual rule configuration, and significantly improves the system's ability to identify and respond to public safety risks in complex dynamic scenarios. The system structure of the present invention is clear, the parameters are adjustable, and the algorithms are implementable, and it is applicable to various public safety application scenarios such as urban governance, traffic control, industrial sites, and energy systems, with good engineering feasibility and promotion value, and has significant social benefits and industrial application prospects.

[0055] In the description of this specification, the description with reference to terms such as "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. In addition, without contradiction, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0056] Any process or method description shown in the flowchart or described in other ways herein can be understood as representing a module, segment, or part of code including one or more executable instructions for implementing a specific logical function or process. And the scope of the preferred embodiments of the present application includes additional implementations, where the functions may be executed in a substantially simultaneous manner or in the reverse order according to the functions involved, rather than in the order shown or discussed.

[0057] As mentioned above, the above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of various changes or substitutions, and these should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An intelligent Internet of Things public security control system based on multi-source data fusion, characterized in that Including: A scene adaptation configuration module, which is used to identify the current system operation scene and load a scoring model parameter configuration file and a response policy template corresponding to the operation scene; An adaptive acquisition module, which is used to uniformly acquire and preprocess multi-source data from physical sensors, video monitoring terminals, device log systems, environmental monitoring units, and network communication nodes, and generate standardized data with a unified structure; A semantic fusion module, which is used to extract entity, attribute, and relationship information from the standardized data, transform it into semantic triples, and construct a unified semantic representation structure; An edge anomaly processing module, which is used to perform local anomaly detection operations on the standardized data at an edge computing node and output anomaly output information, where the anomaly output information includes an anomaly identification mark, an anomaly score value, and characteristic index parameters associated with the anomaly event; A security scoring module, which is used to receive the unified semantic representation structure and the anomaly output information, and based on a scoring index system and preset rules, construct a scoring model based on the scoring model parameter configuration file for fusion analysis and output a risk scoring result; An intelligent alarm module, which is used to perform hierarchical alarm judgment according to the risk scoring result and generate corresponding control response operation instructions based on the response policy template; A model optimization module, which is used to update the scoring model parameters according to historical data and feedback information; A trusted governance module, which is used to implement user identity authentication, operation behavior auditing, and structured data export.

2. The intelligent Internet of Things public security control system based on multi-source data fusion according to claim 1, wherein The scene adaptation configuration module includes: A scene recognition unit, which is used to identify the operation scene type in which the current system is located through device category identifiers, deployment parameters, or user marking information; A standard preparation and loading unit, which is used to load a scoring model parameter configuration file corresponding to the identified operation scene type according to the identified operation scene type, and the scoring model parameters include: the types of risk indicators participating in scoring, and the normalization function type, risk scoring threshold, initial weight, and risk sensitivity coefficient corresponding to each risk indicator; A policy template matching unit, which is used to automatically load a corresponding response policy template according to the operation scene type, and the response policy template includes a control action sequence, signal channel parameters, and communication protocol adaptation items; An ontology structure adaptation unit, which is used to automatically load an ontology description file conforming to the OWL or RDF semantic format according to the scene definition and update the semantic label and namespace configuration data.

3. The intelligent Internet of Things public security control system based on multi-source data fusion according to claim 1, wherein The adaptive acquisition module includes: A protocol recognition unit, which is used to identify the communication protocol type based on the field characteristics or initial data frames in the initialization handshake message of the access data source, and call the corresponding parser from a preset protocol driver library to achieve compatible parsing of MQTT, Modbus, OPC-UA, HTTP, and custom protocols; A time synchronization unit, which is used to unify the timestamps of each data source using the NTP protocol of the master control node, and perform linear interpolation on data with a sampling interval exceeding a preset threshold through a sliding time window. The data structure conversion unit formats the collected image data, text data, and sensor numerical data. The image data uses the YOLOv7 model to extract image entity information, the text data uses the BERT model to extract keywords, syntactic fragments, and context features, and the sensor numerical data is normalized and annotated with signal type labels. The format-encapsulated data forms standardized data with a unified structure.

4. The intelligent Internet of Things public security control system based on multi-source data fusion according to claim 3, wherein The semantic fusion module includes: The device state modeling unit is used to convert the sensor value data with the signal type label into the corresponding device state triplet based on the template matching method, including the device identification, the attribute category and the current value; The text semantic extraction unit is used to call the preset large language model to extract semantic entities and identify relationships from keywords, syntactic fragments and context features extracted from text data, and construct behavioral semantic triples, including action subjects, attribute changes and state identification fields; The image semantic extraction unit is used to input the image entity information into the pre-trained target detection model, identify key equipment or behavior objects, and map the recognition results to entity nodes in the semantic map according to the label mapping table to construct visual semantic triples, including visual entities, actions or positions, and spatial objects; The knowledge graph reasoning unit is used to uniformly organize the device state triples, behavior semantic triples and visual semantic triples, construct a unified semantic representation structure, and perform entity relationship vector learning based on the graph embedding algorithm TransE to complete missing relationships, and only retain entity relationships with reasoning confidence higher than a set threshold for graph updating.

5. The intelligent Internet of Things public security control system based on multi-source data fusion according to claim 4, wherein The edge exception processing module includes: A data screening unit is used to perform data quality detection on the received standardized data, including calculating the field missing rate, sampling frequency offset and mean fluctuation index, and eliminating data samples whose quality is lower than a set threshold; An anomaly detection unit is used to perform differential judgment based on the deviation relationship between the historical statistical mean and the current sampling value in the sliding time window, and screen out possible abnormal data in combination with a preset threshold; the anomaly detection unit further supports the deployment of a lightweight one-dimensional convolutional neural network model on the edge node to identify anomalies in the change pattern of multivariate data, and the lightweight one-dimensional convolutional neural network model periodically and synchronously updates parameters through the central node; The data annotation unit is used to calculate the anomaly confidence of the detected abnormal data, and generate an anomaly score value based on the anomaly confidence value through a nonlinear attenuation function. The anomaly score value is used to annotate the quality level of the abnormal data, including multiple levels of high quality, medium quality and low quality.

6. The intelligent Internet of Things public security control system based on multi-source data fusion according to claim 5, characterized in that, The safety scoring module includes the following units and constructs a scoring model in the following order: A weight adjustment unit, which is used to calculate the deviation from the reference standard value and dynamically correct the initial weights of each risk indicator to output dynamic weights . The calculation formula is as follows: ； Wherein: is the current observed value of the th environmental parameter, is the reference standard value of the th environmental parameter; is the weight adjustment coefficient of the th environmental parameter for the th entity on the th risk indicator; is the hyperbolic tangent function, which is used to limit the environmental deviation within an interval and suppress abnormal fluctuations; An index scoring unit is used to perform non-linear normalization evaluation on the observed values of each risk index and combine the dynamic weights to output an original score value The calculation formula is: ； in: For the The entity in The current observed value of each risk indicator; , For the The entity in The upper and lower risk score thresholds for each risk indicator; is the risk sensitivity coefficient; is a very small constant to avoid the denominator being zero; Anomaly correction unit, for based on the anomaly score value output by the edge anomaly processing module , perform non-linear suppression correction on the original score value and output the final score value , and the calculation formula is: ； Wherein: is the abnormal score value of the th risk indicator, is the abnormal tolerance coefficient, indicating the tolerance degree of the system to the abnormality of the th risk indicator; is the abnormal control weight coefficient, used to adjust the suppression intensity; The total score calculation unit is used to perform weighted summation according to the dynamic weights to generate the finally fused risk score result , and the formula is: ； Wherein: is the total number of risk indicators.

7. The intelligent Internet of Things public security control system based on multi-source data fusion according to claim 6, characterized in that, The intelligent alarm module comprises: The grading alarm judgment unit is used to classify the alarm level according to the risk scoring result and the set risk threshold. Among them, when the risk scoring result is less than the first threshold, the system enters the early warning state; when the risk scoring result is between the first threshold and the second threshold, and the risk scoring result exceeds the corresponding abnormal scoring alarm limit value, the system enters the alarm state; when the risk scoring result is not lower than the second threshold, the system enters the emergency state; A policy matching unit, used to retrieve matching policy parameters from a response policy template according to the current alarm level, including condition-action response rules, control mode fields, and target device mapping parameters, for dynamically triggering system control policies; The control instruction issuing unit is used to generate a structured control response operation instruction based on the MQTT protocol or the Modbus-TCP protocol, including control type, device identification, and action parameter control fields, and issue the control response operation instruction to the target device, judge whether the control response operation instruction is successfully executed according to the feedback information returned by the target device, and generate a control closed-loop record when the execution is successful.

8. The intelligent Internet of Things public security control system based on multi-source data fusion according to claim 6, characterized in that The model optimization module includes: A feature attribution unit, which is used to calculate the contribution degree of the input parameters of the scoring model to the original scoring value based on the SHAP algorithm ; An incremental learning unit for locally updating the following parameters of the scoring model by combining mini-batch data input and a gradient update mechanism without re-training the entire model: dynamic weights ; risk sensitivity coefficient ; anomaly tolerance coefficient and anomaly control weight coefficient ; Based on the contribution degree results output by the feature attribution unit, the gradient update preferentially adjusts the parameters that significantly affect the scoring.

9. The intelligent Internet of Things public security control system based on multi-source data fusion according to claim 1, characterized in that, The trusted governance module includes: The identity authentication unit is used to perform access identity authentication between the user and the module based on the access control policy and the OAuth2.0 protocol; The operation auditing unit is used to record policy configuration changes, model updates, and control response operation instructions, and add timestamp identifiers and chain signature information to key operations; The operation evidence storage unit is used to calculate the summary of the execution result of the control response operation instruction, generate a summary value based on the hash function, and deposit the summary result into the distributed ledger through the blockchain node; The data export unit is used to provide a RESTful interface to export historical alarm data and policy adjustment records according to the time interval or event type, and attach corresponding structured evaluation fields and audit metadata.

10. The control method of the intelligent Internet of Things public security control system based on multi-source data fusion according to any one of claims 1-9, characterized in that, It includes the following steps: Step 1: Identify the running scenario of the current system, load the scoring model parameter configuration file and the response policy template corresponding to the running scenario, and provide parameter basis for scoring and control; Step 2: Collect multi-source data from physical sensors, video monitoring terminals, device log systems, environmental monitoring units, and network communication nodes, and perform protocol parsing, time synchronization, and format encapsulation on the collected data to generate standardized data with a unified structure; Step 3: Perform semantic processing on the standardized data, extract entity, attribute, and relationship information, construct semantic triples, and construct a unified semantic representation structure with the triples as the input of the scoring model; Step 4: Input the standardized data into the edge anomaly processing module to perform local anomaly detection and generate anomaly output information, where the anomaly output information includes anomaly identification markers, anomaly scoring values, and associated feature index parameters; Step 5: Parse the scoring model parameter configuration file, extract the scoring metrics, normalization function types, risk thresholds, metric weights, and scoring sensitivity coefficients required for the current running scenario, and construct a scoring model; Step 6: Input the unified semantic representation structure and the anomaly output information into the scoring model to perform fusion analysis, and output the risk scoring values of each metric and the overall risk scoring result of the system; Step 7: Based on the risk scoring result, perform hierarchical alarm judgment, and generate a control response operation instruction according to the response policy template to realize the linkage execution of the preset control device; Step 8: Use the historical scoring data generated during the operation and the feedback information confirmed manually to update the metric parameters in the scoring model parameter configuration file; Step 9: Record the system operation behavior, perform user identity authentication and behavior auditing, and export structured data for system management and external interface calls.

Images