Abnormal behavior risk assessment method and system and storage medium

Abstract

The invention discloses an abnormal behavior risk assessment method and system and a storage medium, and relates to the technical field of artificial intelligence, and the abnormal behavior risk assessment method comprises the steps: collecting video stream data of an entry and exit site; extracting risk related features from the video stream data; inputting the risk related features into a pre-trained risk assessment model to obtain a risk assessment result which is output by the risk assessment model and contains a risk level; wherein the risk assessment model is obtained according to the following mode: collecting multi-dimensional sample data; extracting sample risk features from the multi-dimensional sample data by adopting feature engineering; determining a risk level label of the risk-related feature; and a model which is obtained by training a preset machine learning model based on the sample risk features with the risk level labels and is used for outputting a risk assessment result. By applying the method, the accuracy of abnormal behavior risk assessment can be improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular, to a method, system, and storage medium for abnormal behavior risk assessment. Background Art

[0002] Currently, in the situation of a sharp increase in the number of inbound and outbound passengers, complex purposes and identities, and an increasing variety of carried luggage and items, it is necessary to strengthen the assessment of risks of abnormal behaviors such as carrying undeclared items into the country. The current detection methods mainly rely on manual identification. Since the observers cannot approach closely and the large number of passengers passing through customs at the same time makes this method less accurate. Moreover, during the process of manually identifying the abnormal behaviors of passengers, nervous signs are often wrongly associated with abnormal behaviors, and relying solely on these signs cannot accurately assess whether there is a risk of abnormal behavior. Some scholars (Samantha Mann et al., 2020) designed a behavioral experiment to simulate carrying undeclared items into the country. According to the summary report of the simulation experiment, although the simulated personnel would consciously show nervous expressions and actions, most of them would choose a large number of different strategies and behaviors (such as listening to music, making phone calls, or not making eye contact, etc.) to blend into the crowd to cover up abnormal behaviors, making typical abnormal behaviors not easy to quantify and making it more difficult to accurately identify. Also, some studies have shown that there is a positive correlation between the nervousness level of passengers passing through customs in the real environment and the degree of criminal risk (Ekman, 1985; O’Sullivan, Frank, Hurley, & Tiwana, 2009). Therefore, direct observation is still one of the most efficient ways to identify smuggling behaviors and is still widely used in the existing technology.

[0003] Therefore, a technical solution is needed to improve the accuracy of abnormal behavior risk assessment during the inbound and outbound process. Summary of the Invention

[0004] The present invention aims to at least solve one of the technical problems in the related technologies to some extent. For this purpose, an object of the present invention is to provide a method, system, and storage medium for abnormal behavior risk assessment to improve the accuracy of abnormal behavior risk assessment.

[0005] According to the first aspect of the embodiments of the present invention, an abnormal behavior risk assessment method is provided, and the method includes:

[0006] Collect video stream data at the inbound and outbound location;

[0007] Extract risk-related features from the video stream data;

[0008] Input the risk-related features into a pre-trained risk assessment model to obtain a risk assessment result including a risk level output by the risk assessment model;

[0009] Among them, the risk assessment model is obtained in the following manner: collecting multi-dimensional sample data; extracting sample risk features from the multi-dimensional sample data by using feature engineering; determining risk level labels for the risk-related features; and training a preset machine learning model based on the sample risk features with risk level labels to obtain a model for outputting risk assessment results.

[0010] According to a second aspect of an embodiment of the present invention, there is provided an abnormal behavior risk assessment system, the system comprising: a video stream acquisition end, a video stream recognition module, a data label update module, a risk assessment module, and a monitoring end; among them,

[0011] The video stream acquisition end is configured to collect video stream data of an entry / exit location;

[0012] The video stream recognition module is configured to extract risk-related features from the video stream data;

[0013] The risk assessment module is configured to input the risk-related features into a pre-trained risk assessment model to obtain a risk assessment result including a risk level output by the risk assessment model;

[0014] Among them, the risk assessment model is obtained in the following manner: collecting multi-dimensional sample data; extracting sample risk features from the multi-dimensional sample data by using feature engineering; the data label update module determines risk level labels for the risk-related features; and training a preset neural network model based on the sample risk features with risk level labels to obtain a model for outputting risk assessment results;

[0015] The monitoring end is configured to display the risk assessment result.

[0016] According to a third aspect of an embodiment of the present invention, there is provided a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned abnormal behavior risk assessment method is implemented.

[0017] In the solution provided by the embodiments of the present invention, by collecting multi-dimensional sample data, the data collection process for training the risk assessment model is improved, and the situation of missing feature information in the extracted sample risk features is reduced. As a result, the model training effect is better, the range of identifying abnormal behaviors is more comprehensive, and the obtained risk assessment result is more accurate, thereby improving the accuracy of the risk assessment of abnormal behaviors. Moreover, using the risk assessment model to replace manual identification can reduce the requirements for personnel professionalism and expert experience, improve the efficiency of risk assessment, has a fast training speed for the data set, and is simple to implement. Through the processing of feature engineering, the quality of the obtained sample risk features can be improved, and it has a certain robustness to noise and outliers in the input data, and can resist the interference of noise to a certain extent. In this way, when extracting risk-related features from video stream data, the model has obtained the evaluation ability of multi-dimensional risk features, thereby improving the stability of risk assessment.

[0018] Additional aspects and advantages of the present invention will be given in part in the following description, become apparent in part from the following description, or be learned through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is a schematic flowchart of the first method for risk assessment of abnormal behaviors provided by the embodiments of the present invention;

[0020] Figure 2 is a schematic flowchart of the second method for risk assessment of abnormal behaviors provided by the embodiments of the present invention;

[0021] Figure 3 is a schematic structural diagram of an abnormal behavior risk assessment system provided by the embodiments of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0022] The embodiments of the present invention will be described in detail below. Examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the present invention and should not be construed as limiting the present invention.

[0023] The following will describe the method, system, and storage medium for risk assessment of abnormal behaviors according to the embodiments of the present invention with reference to the accompanying drawings.

[0024] In one embodiment of the present invention, refer to Figure 1 , and a method for risk assessment of abnormal behaviors is provided, including steps S101 - S103.

[0025] S101: Collect video stream data of the entry and exit locations.

[0026] S102: Extract risk-related features from the video stream data.

[0027] S103: Input the risk-related features into a pre-trained risk assessment model to obtain a risk assessment result including a risk level output by the risk assessment model.

[0028] Among them, the risk assessment model is obtained in the following manner: Collect multi-dimensional sample data; Use feature engineering to extract sample risk features from the multi-dimensional sample data; Determine the risk level labels of the risk-related features; A model for outputting a risk assessment result obtained by training a preset machine learning model based on the sample risk features with risk level labels.

[0029] The device for collecting video stream data can be a shooting device such as a camera or a webcam. By setting the above shooting device at the entry-exit location, collection can be achieved.

[0030] The collected video stream data contains multiple video frames. From these video frames, face recognition can be performed to obtain an image area related to the entry-exit personnel, so that the image area contains the face, gait, expression, clothing, and behavior recognized by the camera; Extract the image features of the image area to obtain risk-related features.

[0031] The method for extracting image features can be Scale-Invariant Feature Transform (SIFT), Histogram of Oriented Gradients (HOG), etc. The embodiments of the present invention do not limit this.

[0032] In the risk assessment result, evaluation parameters representing different types of risks can be set. For example, the model outputs two parameters A and B. Parameter A represents the risk of carrying heavy metal objects, and parameter B represents the risk of carrying undeclared items, etc. In this way, scoring can be performed using the parameters. And, a score threshold can be set for the evaluation parameters of each type of risk. When there is a parameter with a score greater than the score threshold, the risk assessment result includes a risk level. And it can be set that the more types of risks represented by the parameters greater than the score threshold, the higher the risk level.

[0033] In the risk assessment result, in addition to the scores of individual parameters, a comprehensive risk score can also be generated based on each parameter. The comprehensive risk score can be the sum, average, median, etc. of each score. The embodiments of the present invention do not limit this.

[0034] After obtaining the sample risk characteristics, a machine learning algorithm can be selected for model training. For example, the random forest algorithm can be used to train the model to output the probabilities of one or more classification tasks. Each task corresponds to a type of risk, and the level of probability corresponds to the magnitude of the parameter. The model parameters can be optimized and the model performance can be evaluated by methods such as cross-validation. This strategy of randomly selecting samples and features effectively reduces the overfitting risk of a single decision tree and increases the diversity.

[0035] Among them, the risk level label can be obtained by receiving manual annotation.

[0036] A machine learning model refers to a mathematical model that is learned from data through a machine learning algorithm and can make predictions or decisions on unknown data.

[0037] In one embodiment, the machine learning model is a random forest model; the random forest model contains decision trees that output risk prediction results of different anomaly types, and the risk assessment result is determined based on the risk prediction results of each decision tree.

[0038] In this embodiment, the random forest algorithm can be applied for model training. The specific steps are as follows: Randomly sample with replacement from the multi-dimensional sample data to construct multiple subsets. On each subset, train a decision tree based on the sample risk characteristics generated by the subset. Each decision tree is used to output the prediction result of an anomaly type or a type of data. Among them, the decision trees corresponding to different anomaly types have different weights. In the prediction stage, let each decision tree make a prediction on the input, and then obtain the final risk assessment result by voting or averaging. For missing data features, the classification accuracy can still be maintained based on the random forest algorithm.

[0039] Adjust the model parameters of each decision tree in the random forest model according to the error between the risk level in the final prediction result and the risk level represented by the risk level label, so as to optimize the random forest model.

[0040] Due to having different weights, when voting or averaging, a certain anomaly type can be set, for example, the decision tree corresponding to the anomaly type of luggage with special items has a greater influence. In this way, dynamic adjustment can be made according to the characteristic changes of abnormal behaviors in different periods.

[0041] Or the machine learning algorithm can also be a deep learning algorithm, and the corresponding trained machine learning model is a neural network model; or, a supervised learning algorithm such as a support vector machine can also be used.

[0042] Among them, the multi-dimensional sample data can include the feature types of the following five modules: macro social and economic environment risks, abnormal behavior risks of entry-exit personnel, social networks and organizational structures, risks of customs clearance items and transportation routes, and individual risk assessment indicators.

[0043] In this case, when training the model, feature processing can be carried out module by module, and based on the features of each processed module, different sub-models can be trained respectively for processing.

[0044] For example, the random forest model obtained by applying the random forest algorithm. The random forest model contains multiple sub-models. Each sub-model outputs a sub-prediction result for the sample risk features of a certain feature type, and the risk assessment result is determined based on each sub-prediction result.

[0045] The training method of each sub-model is similar to the specific steps of applying the random forest algorithm for model training before. The difference is that different features are applied to different sub-models during training, and the decision trees for the risk prediction results of different abnormal types are trained separately in different sub-models.

[0046] Finally, the risk assessment result is the weighted result of each random forest model. Among them, the weights used to obtain the weighted result are updated according to the contribution degrees of the machine learning models of each module. The update time interval is a preset time interval, such as once a day or once a week to update the weights. In the Python program, the River library can be used to achieve the update.

[0047] The contribution degree can be represented by the SHAP (SHapley Additive exPlanations) value. Specifically, for each module, by calculating the marginal contribution of the features input to the corresponding machine learning model of the module, the weighted average value of the marginal contribution is the SHAP value.

[0048] And after obtaining the contribution degree, a contribution degree report containing the contribution degrees of each module can be output for manual re-weight adjustment.

[0049] In the type of macro social and economic environment risks, the specific data types can include market demand and supply data, such as the amplitudes of demand fluctuations and price fluctuations; it can also include regional social and economic environment data, such as the unemployment rate, etc.

[0050] In the type of abnormal behavior risks of entry-exit personnel, the specific abnormal types can include:

[0051] (1) Abnormal facial types, which can specifically include highly anti-counterfeit portraits. This type includes features such as facial features with different degrees of occlusion, such as portraits of people wearing glasses, hats, masks, headscarves, and veils. Human facial feature information is an important feature for distinguishing people. It can help customs quickly and accurately identify persons involved in crimes and suspicious passengers, and improve inspection efficiency and safety. Facial features with different degrees of occlusion can be used to identify smugglers with disguises. For example, in order to avoid being recognized by the face recognition system, people deliberately lower the brim of their hats and wear sunglasses and masks when passing through customs. Then, face recognition technology can be used to extract various types of features such as facial features without occlusion, facial features with sunglasses, facial features with masks, and facial features with hats for recognition. Each feature corresponds to a different recognition type. For example, the facial features without occlusion are labeled as the unobstructed face recognition type during training, and so on.

[0052] It may also include portraits with various types of clothing, which may include coats, skirts, different styles of pants, etc.

[0053] (2) Abnormal gait type, which may include stride length and frequency. When objects are hidden in the body, clothes, shoes, etc., certain gait abnormalities will occur, so gait features can be extracted for identification.

[0054] (3) Abnormal gesture types, which may specifically include gesture postures, such as a thumbs-up or a positive gesture indicating OK, and may also include some negative gestures. Different gesture postures may be represented by different values.

[0055] (4) Abnormal luggage types, which may include the volume and shape changes of luggage such as backpacks, handbags, and trolleys, such as full in and empty out, empty in and full out, and too much luggage.

[0056] (5) Abnormal behavior types, including the presence of deliberate covering of the face, frequent turning back, trajectory drifting, pushing, turning back, etc., specifically including: facial features under sunglasses, facial features under masks, facial features under hats, turning back movement features, entry and exit behavior features, and behavior features of multiple people traveling together.

[0057] (6) Group abnormality type refers to abnormal behavior of multiple people in coordination with each other, including the following characteristics: clothing characteristics indicating similar clothing colors, accessories characteristics indicating similar accessories, carrying characteristics indicating similar backpacks or luggage, and gesture characteristics.

[0058] (7) Abnormal limb types, including abnormal limb features extracted from abnormal limb forms, including limb forms indicating pointing, falling, punching, pulling, pushing, and kicking.

[0059] (8) Human feature types, including human features obtained based on gender recognition, age stage recognition, and human orientation recognition.

[0060] In the social network and organizational structure type, the specific data types can include:

[0061] (1) Social network complexity;

[0062] (2) Social circle member information;

[0063] (3) Social circle member history.

[0064] In the customs clearance items and transportation route risk type, the specific data types can include:

[0065] (1) Types and values of items, including types of high-risk items and quantities;

[0066] (2) Transportation methods and spatio-temporal characteristics, including transportation methods, route complexity, and abnormal time patterns;

[0067] In the individual risk and evaluation index type, the specific data can include:

[0068] (1) Personnel background characteristics, such as identity information and work experience;

[0069] (2) Historical behavior records;

[0070] (3) Psychological characteristics and behavior tendencies.

[0071] In the solution provided by the embodiments of the present invention, by collecting multi-dimensional sample data, the data collection process for training the risk assessment model is improved, and the situation of missing feature information in the extracted sample risk features is reduced, so that the model training effect is better, the range of identifying abnormal behaviors is more comprehensive, and the obtained risk assessment results are more accurate, improving the accuracy of risk assessment for abnormal behaviors. Moreover, using the risk assessment model to replace manual identification can reduce the requirements for personnel professionalism and expert experience, improve the efficiency of risk assessment, has a fast training speed for the data set, and is simple to implement. Through the processing of feature engineering, the quality of the obtained sample risk features can be improved, and it has a certain robustness to noise and outliers in the input data, and can resist the interference of noise to a certain extent. In this way, when extracting risk-related features from video stream data, the model has obtained the evaluation ability of multi-dimensional risk features, thus improving the stability of risk assessment.

[0072] In one embodiment, step S102 can be completed based on edge computing, that is, after the video stream data is collected by the shooting device, risk-related features are extracted in the local device of the shooting device to achieve the effect of reducing latency.

[0073] In one embodiment, before using feature engineering to extract sample risk features from multi-dimensional sample data, the method further includes:

[0074] Processing the multi-dimensional sample data in at least one of the following ways:

[0075] Unifying data formats, data integration, and data cleaning.

[0076] Unifying data formats includes: unifying data from different data sources into a standardized format, such as CSV format, SQL database format, etc.

[0077] Data integration includes integrating data from different sources into a comprehensive database to form complete data records. For example, combining customs clearance records with item inspection data to form a complete customs clearance information record.

[0078] In one embodiment of the present invention, data cleaning includes at least one of the following processing procedures:

[0079] Missing value processing, duplicate data processing, and data consistency checking.

[0080] Missing value processing includes deleting missing values or filling in missing values.

[0081] If the missing values of certain features are relatively severe, records containing missing values can be selected for deletion; filling in missing values is to use appropriate methods to fill in the missing values, such as filling in with the mean, median, forward filling, etc., or inferring the missing values based on other features.

[0082] Duplicate data processing includes checking and deleting duplicate records. Duplicate data may be generated due to errors in the data collection or transmission process.

[0083] Data consistency checking includes checking time consistency and format consistency.

[0084] Checking time consistency includes: checking the consistency of timestamp data. For example, the time in the customs clearance record must conform to the regular time interval, and the item inspection time must match the customs clearance time.

[0085] In addition, outliers in the multi-dimensional sample data can also be processed.

[0086] In one embodiment, using feature engineering to extract sample risk features from multi-dimensional sample data includes:

[0087] Obtaining the numerical features of the multi-dimensional sample data;

[0088] Successively performing feature selection, feature construction, and feature scaling on the numerical features to obtain sample risk features.

[0089] Methods for obtaining numerical features include: label encoding or one-hot encoding of multi-dimensional sample data. Taking label encoding as an example, for the transportation methods included in the multi-dimensional sample data, the transportation methods can be encoded by the frequency of occurrence in the multi-dimensional sample data, such as road transportation is encoded as 0.6, railway transportation is encoded as 0.3, and air transportation is encoded as 0.1.

[0090] There are different types of multi-dimensional sample data. By simply setting an encoded interval range for each type, different types of data can generate non-overlapping codes.

[0091] In feature engineering, feature selection can include:

[0092] (1) Filtering method: Use statistical tests (such as chi-square test, Pearson correlation coefficient) to select features related to the target variable (abnormal behavior risk). For example, by calculating the correlation between known features that represent abnormal behavior risk and various numerical features, select those features that are more strongly correlated with abnormal behavior (such as customs clearance frequency, cargo type, personnel background, etc.).

[0093] (2) Packaging method: Use models (such as decision trees, LASSO regression, etc.) to automatically select features and evaluate which features are most important for assessing the risk of abnormal behavior.

[0094] (3) Embedding method: Use models with feature selection capabilities (such as random forest, L1 regularized regression model, etc.) to perform automated feature selection.

[0095] In feature engineering, feature construction can be performed in the following ways:

[0096] Obtaining behavioral pattern features from numerical features;

[0097] Synthesize the behavior pattern features to obtain synthetic features;

[0098] Obtaining centrality index and social circle overlap in numerical features, and constructing social network features based on the obtained centrality index and social circle overlap;

[0099] Get geographic numerical information from numerical features and construct spatiotemporal features based on the geographic numerical information.

[0100] Behavioral pattern features can be the frequency of customs clearance of entry and exit personnel, changes in the types of items carried, the length of customs clearance time, etc., which can be synthesized into the frequency of carrying abnormal items, that is, related features are represented by one feature. Synthetic features can retain the core numerical information pointing to risks in the features and reduce the number of features that the model needs to process, thereby improving training efficiency.

[0101] Centrality metrics can be represented by parameters such as degree centrality and closeness centrality. The overlap degree of social circles can be represented by Jaccard similarity. The above parameters and similarities are combined into a feature vector according to a certain parameter sequence, which is the social network feature.

[0102] Spatio-temporal features can be features such as path length, transportation time, and path stability extracted from geographical numerical information. Additionally, after extracting the numerical values, the complexity or outliers of the path can be calculated as spatio-temporal features.

[0103] In feature engineering, the implementation methods of feature scaling are normalization and standardization, which scale numerical features to the same dimension range to avoid certain features dominating model training. For example, using the standardization method to adjust the mean of each feature to 0 and the standard deviation to 1, or using the normalization method to limit the feature values to the interval [0,1].

[0104] In this way, the sample risk features can be set-type features that include synthetic features, social network features, and spatio-temporal features.

[0105] In an embodiment of the present invention, second sample data that is updated in real time can also be obtained;

[0106] Retrain the risk assessment model based on the second sample data.

[0107] The second sample data is the same type of data as the multi-dimensional sample data. For example, new entry-exit customs clearance records, etc. The second sample data can be updated at regular intervals, and any dimension of the data can be updated, such as new entry-exit personnel abnormal behavior risk type data or social network data, or all dimensions of the data can be updated.

[0108] The implementation method of retraining the risk assessment model is the same as the method of training the risk assessment model with multi-dimensional sample data before.

[0109] In this way, the risk assessment model can adjust the model parameters and prediction strategies according to real-time feedback and the occurrence of actual abnormal behaviors, enabling the model to continuously adapt to new data and changing abnormal behavior patterns, helping to identify abnormal behaviors, giving early warnings, and taking effective countermeasures.

[0110] In an embodiment of the present invention, the trigger condition for obtaining the second sample data and retraining the risk assessment model can be set as: the change in the value distribution of customs clearance items exceeds a preset threshold. Customs clearance items refer to the dynamic evolution of goods or personal items declared through customs in the context of international trade or cross-border logistics in terms of category structure, unit price range, total value ratio, etc. over time. For example, if the proportion of chips or biological agents increases by more than the preset threshold, or the proportion of daily necessities decreases by more than the preset threshold, both reach the trigger condition.

[0111] In one embodiment of the present invention, the box plot method or the Z-score method is used to detect outliers in multi-dimensional sample data;

[0112] If there are outliers, potential high-risk behavior characteristics corresponding to the outliers and having independent annotations are generated;

[0113] Sample risk characteristics including potential high-risk behavior characteristics are generated.

[0114] In this way, during model training, outliers are emphasized through annotations, enhancing the model's ability to identify potential high-risk behaviors. Additionally, if the outliers are data entry errors, the outliers can be selected for deletion or replaced with appropriate values. By reasonably handling outliers, the impact of outliers on model training and evaluation results can be controlled.

[0115] The above risk assessment model uses a deep learning framework, such as TensorFlow. Before integration, the trained model is saved in a format suitable for the production environment, specifically using the SavedModel format. And the model can be converted into a format suitable for efficient inference (such as ONNX) which can help run efficiently on different hardware platforms (CPU, GPU, TPU, etc.).

[0116] In one embodiment, after obtaining the risk assessment result output by the risk assessment model, the risk level in the risk assessment result can be obtained and displayed in real time on a monitoring device.

[0117] The following Figure 2 illustrates the overall process of the abnormal behavior risk assessment method through the embodiments shown.

[0118] Among them, a comprehensive discipline risk assessment index system is established, and the system includes five types of multi-dimensional sample data. The establishment focuses on the personnel case database and the database, where the multi-dimensional sample data is stored; data standardization and integration are carried out to process inconsistent data, integrate the data into the comprehensive database, and implement the processing of missing, outlier, and duplicate data to complete the data consistency check.

[0119] In one embodiment, the multi-dimensional sample data included in the case database can specifically include various feature dimensions and annotation dimensions, as shown in Tables 1-2 below.

[0120] Table 1

[0121]

[0122]

[0123] Table 2

[0124]

[0125]

[0126] Among them, different dimensions can be used to represent features or annotations. In Table 1, age, occupation, number of historical violations, psychological stress score, item risk level, transportation mode, route complexity, social network complexity, number of criminal contacts, abnormal behavior score, luggage risk score, macro environment risk, customs clearance frequency, dressing style, whether being a water carrier, types of smuggled goods, smuggling experience (in years), whether involved in a smuggling network, and whether using disguise are used as features, and customs clearance route risk score, water carrier behavior score, comprehensive risk score, and risk level are used as annotations.

[0127] In Table 1, non-numerical feature dimensions are numerically encoded to obtain numerical features when extracting sample risk features, so as to form a feature vector representing sample risk features with other features represented by numerical values.

[0128] In one embodiment, the feature dimensions may further include the number of entry and exit times within a period of time. For example, the number of entry and exit times within a single day, one week, half a month, or one month.

[0129] In one embodiment, the multi-dimensional sample data included in the case base can be processed by hash encryption.

[0130] Through feature selection, irrelevant or redundant features can be removed, an effective model can be reconstructed, and feature data normalization can be performed.

[0131] Train a risk assessment model, optimize model parameters through cross-validation, and evaluate model performance.

[0132] For example, for machine learning trained by the random forest algorithm, the cross-validation method includes K-fold cross-validation. The multi-dimensional sample data is divided into a training set and a test set in a ratio of 7:3 or 8:2, and is divided into K subsets. Each time, K-1 subsets are used to train the model, and the remaining one subset is used for testing. This is repeated until the completion conditions of the random forest model are met. For example, all decision tree subtrees reach the target values of parameters during training, such as the maximum depth or the minimum sample splitting threshold, etc.

[0133] Moreover, the risk assessment model can be verified offline, verified in real time, and evaluated by experts.

[0134] Offline verification includes using historical data to backtest the risk assessment model to verify the accuracy of the prediction results.

[0135] Real-time verification includes deploying the model to the actual entry and exit environment for real-time data verification and model update.

[0136] The cross - disciplinary expert evaluation involves experts in multiple fields such as organizational criminology, sociology, economics, data science, etc. to evaluate the model results, ensuring the multi - disciplinary comprehensiveness of the model.

[0137] After the evaluation is completed, the model is integrated into the production server, connected to the video stream feature extraction interface, and real - time risk identification and display are achieved by combining the collected real - time feature data with the database, including using the trained and verified risk assessment model to output the risk levels of entry - exit personnel, and comparing the characteristics of entry - exit personnel with known risk levels in the database.

[0138] When integrating into the production server, an inference engine can be deployed. For example, inference engines such as TensorFlow Serving or TorchServe can be used.

[0139] When deploying the inference engine, appropriate acceleration options can be selected according to the server hardware configuration (CPU or GPU) to improve the inference speed. In high - concurrency scenarios, a model server cluster (e.g., deployed through Docker containers) can be used to ensure the inference ability.

[0140] During integration, the risk assessment model is integrated into a RESTful or gRPC API service, and clients (such as the front - end interface, other systems) can call this API through HTTP requests for risk assessment.

[0141] The specific API service can be Flask / FastAPI. For smaller models, both Flask and FastAPI are lightweight web frameworks suitable for rapid API service development.

[0142] In larger - scale systems, the Kubernetes container orchestration platform can be used to manage the cluster of model services, ensuring high availability and load balancing.

[0143] The real - time inference of the model will be based on the video stream data transmitted by the camera, evaluate the risk score of each pedestrian, which is the risk assessment parameter in the foregoing embodiments, and return the risk assessment results.

[0144] When new data flows in, the database is updated in real - time, and the model is retrained regularly to optimize the parameters.

[0145] In one embodiment of the present invention, referring to Figure 3 , an abnormal behavior risk assessment system is further provided, including: a video stream acquisition end, a video stream recognition module, a data label update module, a risk assessment module, and a monitoring end; wherein,

[0146] A video stream acquisition terminal, which is used to acquire video stream data at the entry and exit locations;

[0147] A video stream recognition module, which is used to extract risk-related features from the video stream data;

[0148] A risk assessment module, which is used to input the risk-related features into a pre-trained risk assessment model to obtain a risk assessment result including a risk level output by the risk assessment model;

[0149] Among them, the risk assessment model is obtained in the following way: collect multi-dimensional sample data; use feature engineering to extract sample risk features from the multi-dimensional sample data; a data label update module determines the risk level label of the risk-related features; a model for outputting a risk assessment result obtained by training a preset neural network model based on the sample risk features with risk level labels;

[0150] A monitoring terminal, which is used to display the risk assessment result.

[0151] The monitoring terminal includes Figure 3 the monitoring large screen and the control terminal in . The control terminal is connected to the monitoring large screen. After obtaining the risk level and the score of the evaluation parameter indicating the risk, if the risk level and the score indicate the existence of a risk, a prompt message can be sent for security inspection force deployment.

[0152] For the risk assessment results corresponding to the monitoring terminal and indicating different risk levels, security inspection gates can be set to perform synchronous light prompts. For example, lights of different colors are used, such as green indicating a low risk level, orange indicating a medium risk level, and red indicating a high risk level.

[0153] In Figure 3 the multi-dimensional sample data in the case database and the database server are dynamically updated and stored.

[0154] The multi-dimensional sample data in the case database is used to update the model regularly, that is, to train the above-mentioned risk assessment model, that is, to perform comprehensive risk assessment model training. The trained model is integrated into the computing server through system integration and is called through the API service.

[0155] The multi-dimensional sample data stored in the database server can be used to combine the collected real-time feature data with the database to realize real-time risk identification of entry and exit personnel.

[0156] Figure 3 Each switch in is used to perform data transmission. Specifically, it can be set to send the actual seized abnormal behavior results back to the database every day and update the model every week.

[0157] In one embodiment of the present invention, a computer-readable storage medium is further provided, on which a computer program is stored. When the computer program is executed by a processor, the abnormal behavior risk assessment method described in any one of the above embodiments is implemented.

[0158] In various embodiments of the systems and technologies described above in this article, the data and features involved are from publicly available data sets.

[0159] It should be noted that the logic and / or steps represented in the flowchart or described in other ways herein, for example, can be considered as a definite sequence list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch instructions from the instruction execution system, apparatus, or device and execute the instructions), or in combination with these instruction execution systems, apparatus, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer diskette case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or other appropriate processing as necessary, and then stored in a computer memory.

[0160] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application specific integrated circuits having appropriate combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

[0161] In the description of this specification, the description with reference to terms such as "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0162] In the description of the present invention, it should be understood that the orientation or positional relationships indicated by terms such as "center", "longitudinal", "transverse", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "clockwise", "counterclockwise", "axial", "radial", "circumferential", etc. are based on the orientation or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus should not be construed as a limitation of the present invention.

[0163] In addition, the terms "first" and "second" are only used for descriptive purposes and should not be construed as indicating or implying relative importance or implicitly indicating the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include at least one of such features. In the description of the present invention, the meaning of "a plurality" is at least two, such as two, three, etc., unless otherwise specifically defined.

[0164] In the present invention, unless otherwise clearly specified and limited, terms such as "mounted", "connected", "connected to", "fixed" should be understood in a broad sense. For example, it may be a fixed connection, a detachable connection, or integrated; it may be a mechanical connection or an electrical connection; it may be directly connected or indirectly connected through an intermediate medium, and it may be the internal communication of two elements or the interaction relationship between two elements, unless otherwise clearly limited. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0165] In the present invention, unless otherwise clearly specified or limited, the first feature being "on" or "under" the second feature may mean that the first and second features are in direct contact, or the first and second features are indirectly in contact through an intermediate medium. Further, the first feature being "above", "over" and "on top of" the second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the horizontal height of the first feature is higher than that of the second feature. The first feature being "under", "below" and "beneath" the second feature may mean that the first feature is directly below or obliquely below the second feature, or simply means that the horizontal height of the first feature is less than that of the second feature.

[0166] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those of ordinary skill in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. An abnormal behavior risk assessment method, characterized in that The method includes: Collecting video stream data at the entry and exit locations; Extracting risk-related features from the video stream data; Inputting the risk-related features into a pre-trained risk assessment model to obtain a risk assessment result including a risk level output by the risk assessment model; Among them, the risk assessment model is obtained in the following manner: collecting multi-dimensional sample data; using feature engineering to extract sample risk features from the multi-dimensional sample data; determining risk level labels for the risk-related features; training a preset machine learning model based on the sample risk features with risk level labels to obtain a model for outputting risk assessment results.

2. The method according to claim 1, wherein The machine learning model is a random forest model; the random forest model includes decision trees that output risk prediction results of different abnormal types, and the risk assessment result is determined based on the risk prediction results of each decision tree.

3. The method according to claim 2, characterized in that The random forest model includes multiple sub-models, each sub-model outputs a sub-prediction result for the sample risk features of a feature type, and the risk assessment result is determined based on each sub-prediction result.

4. The method according to claim 1, characterized in that, Before using feature engineering to extract sample risk features from the multi-dimensional sample data, the method further includes: Processing the multi-dimensional sample data in at least one of the following ways: Unifying data formats, data integration, and data cleaning.

5. The method according to claim 1, characterized in that The using feature engineering to extract sample risk features from the multi-dimensional sample data includes: Obtaining numerical features of the multi-dimensional sample data; Successively performing feature selection, feature construction, and feature scaling on the numerical features to obtain sample risk features.

6. The method according to claim 1, wherein The method further includes: Obtaining second sample data with real-time updates; Re-training the risk assessment model based on the second sample data; And / or, The using feature engineering to extract sample risk features from the multi-dimensional sample data includes: Detecting outliers in the multi-dimensional sample data using the box plot method or the Z-score method; If there are such outliers, generating potential high-risk behavior features corresponding to the outliers with independent annotations; Generating sample risk features including the potential high-risk behavior features; And / or, After obtaining the risk assessment result output by the risk assessment model, the method further includes: Obtaining the risk level in the risk assessment result and displaying it in real time on a monitoring device.

7. The method according to claim 4, characterized in that, The data cleaning includes at least one of the following processing procedures: Missing value processing, duplicate data processing, and data consistency check.

8. The method according to claim 5, characterized in that, The sample risk features are set-type features including synthetic features, social network features, and spatio-temporal features; The feature construction is carried out in the following manner: Obtaining behavior pattern features in the numerical features; Synthesizing the behavior pattern features to obtain the synthetic features; Obtaining centrality indicators and social circle overlap degrees in the numerical features, and constructing social network features based on the obtained centrality indicators and social circle overlap degrees; Obtaining geographical numerical information in the numerical features, and constructing spatio-temporal features based on the geographical numerical information.

9. An abnormal behavior risk assessment system, characterized in that, The system includes: a video stream acquisition end, a video stream recognition module, a data label update module, a risk assessment module, and a monitoring end; wherein, the video stream acquisition end is used to acquire video stream data at the entry and exit locations; the video stream recognition module is used to extract risk-related features from the video stream data; the risk assessment module is used to input the risk-related features into a pre-trained risk assessment model to obtain a risk assessment result including a risk level output by the risk assessment model; wherein, the risk assessment model is obtained in the following manner: acquiring multi-dimensional sample data; extracting sample risk features from the multi-dimensional sample data by using feature engineering; the data label update module determining a risk level label for the risk-related features; a model obtained by training a preset neural network model based on the sample risk features with risk level labels and used to output a risk assessment result; the monitoring end is used to display the risk assessment result.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the abnormal behavior risk assessment method according to any one of claims 1-8.

Images