Security management method, system and equipment

Abstract

The invention provides a security management method, system and equipment. The method comprises the following steps: acquiring security monitoring data of a smart community and a park; based on the security and protection monitoring data, an environment monitoring model and an inspection monitoring model are adopted to carry out anomaly recognition, and an anomaly recognition result is obtained; based on the abnormal recognition result, performing space-time correlation analysis by using a space-time correlation analysis model to obtain a space-time correlation analysis result; if the time-space correlation analysis result is that the target area is abnormal, generating a security early warning report of the smart community and the park; wherein the environment monitoring model is integrated with an isolated forest model, an LSTM model and a local abnormal factor algorithm. According to the method and the system, anomaly identification and time-space correlation analysis are carried out by comprehensively applying multiple models, potential safety hazards in the smart community and the park can be comprehensively and accurately found, a security early warning report can be generated in time, a decision basis is provided for management personnel, the security management efficiency and accuracy are effectively improved, and the safety of the community and the park is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of smart community and park security management, and in particular to a security management method, system and equipment. Background Art

[0002] With the acceleration of urbanization, the construction of smart communities and parks has gradually become an important part of modern urban management. Traditional security management methods mainly rely on manual inspections and simple monitoring equipment, which are difficult to cope with complex environmental changes and diverse security threats.

[0003] Existing security systems usually operate independently and lack comprehensive analysis of environmental data and inspection data, resulting in problems such as untimely warnings and high false alarm rates. Summary of the Invention

[0004] To overcome the shortcomings of the above-mentioned traditional security management methods, which mainly rely on manual inspections and simple monitoring equipment and are difficult to cope with complex environmental changes and diverse security threats, and the security systems usually operate independently and lack comprehensive analysis of environmental data and inspection data, resulting in untimely warnings and high false alarm rates, the present invention provides a security management method, including:

[0005] Obtain security monitoring data for smart communities and parks;

[0006] Based on the security monitoring data, anomaly identification is performed using an environmental monitoring model and an inspection monitoring model to obtain an anomaly identification result;

[0007] Based on the anomaly recognition result, performing spatiotemporal correlation analysis using a spatiotemporal correlation analysis model to obtain a spatiotemporal correlation analysis result;

[0008] If the spatiotemporal correlation analysis result indicates that an abnormality occurs in the target area, a security warning report for the smart community and park is generated;

[0009] Among them, the environmental monitoring model integrates the isolation forest model, the long short-term memory network LSTM model and the local anomaly factor algorithm.

[0010] Optionally, the abnormality identification is performed based on the security monitoring data using an environmental monitoring model and a patrol monitoring model, and the abnormality identification result obtained includes:

[0011] Based on the sensor data in the security monitoring data, an environmental anomaly recognition result is obtained by using an environmental monitoring model;

[0012] Based on the robot data in the security monitoring data, a patrol anomaly recognition is performed using a patrol monitoring model to obtain a patrol anomaly recognition result.

[0013] Optionally, the environmental anomaly identification is performed using an environmental monitoring model based on the sensor data in the security monitoring data, and the environmental anomaly identification result obtained includes:

[0014] Using the isolation forest model of the environmental monitoring model, identifying environmental anomaly locations on sensor data in the security monitoring data to obtain environmental anomaly location identification results;

[0015] Using the LSTM model of the environmental monitoring model, performing environmental anomaly prediction on the sensor data to obtain an environmental anomaly prediction result;

[0016] Based on the environmental anomaly prediction result and the sensor data, anomaly identification is performed using the local anomaly factor algorithm of the environmental monitoring model to obtain an environmental anomaly detection result;

[0017] The environmental anomaly recognition result is obtained based on the environmental anomaly location recognition result and the environmental anomaly detection result.

[0018] Optionally, the use of the isolation forest model of the environmental monitoring model to identify environmental anomaly locations on sensor data in the security monitoring data, and obtaining an environmental anomaly location identification result includes:

[0019] constructing a data space based on the sensor data in the security monitoring data, wherein the data space includes a plurality of sensor data points, each sensor data point including a detection location and corresponding sensor data;

[0020] Based on randomly selected features and segmentation values, the data space is segmented to obtain a plurality of isolated trees;

[0021] Based on each sensor data point, according to the path length of the sensor data point in each isolated tree, using an anomaly score calculation function to obtain an anomaly score of each sensor data point;

[0022] The environmental abnormality location identification result is obtained based on the abnormality score of each sensor data point and a preset abnormality score threshold.

[0023] Optionally, the performing of anomaly identification using a local anomaly factor algorithm of the environmental monitoring model based on the environmental anomaly prediction result and the sensor data to obtain an environmental anomaly detection result includes:

[0024] Constructing a data set based on the environmental anomaly prediction result and the sensor data, the data set comprising a plurality of data points, each data point comprising a detection location and corresponding detection data, the detection data being a predicted value in the environmental anomaly prediction result or an observed value in the sensor data;

[0025] Based on the distance between each two data points, the reachable distance calculation function is used to obtain the reachable distance between each two data points;

[0026] Based on the reachable distance between each two data points, a local reachable density calculation function is used to obtain the local reachable density of each data point;

[0027] Based on the local reachable density of each data point, a local anomaly factor calculation function is used to obtain a local anomaly factor of each data point;

[0028] Obtaining the environmental anomaly detection result based on the local anomaly factor of each data point and a preset local anomaly factor threshold;

[0029] The reachable distance between each two data points is achieved by the following formula:

[0030]

[0031] in, represents the reachable distance between data point p and data point o, k_distance(o) represents the distance from data point o to the kth nearest neighbor, and d(p,o) represents the distance between data point p and data point o;

[0032] The local reachable density of each data point is realized by the following formula:

[0033]

[0034] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from the data point p does not exceed k_distance(o), Represents the reachable distance between data point p and data point o;

[0035] The local anomaly factor of each data point is realized by the following formula:

[0036]

[0037] Among them, LOF k (p) represents the local anomaly factor of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachable density of data point o, lrd k (p) represents the local reachability density of data point p.

[0038] Optionally, the patrol anomaly identification is performed using a patrol monitoring model based on the robot data in the security monitoring data, and the patrol anomaly identification result obtained includes:

[0039] Using the encoder of the inspection and monitoring model, image data in the robot data is compressed to obtain image features;

[0040] Reconstructing the image features using the decoder of the inspection and monitoring model to obtain reconstructed image data;

[0041] Using a reconstruction error calculation function in an output layer of the inspection and monitoring model, an error calculation is performed on the image data in the robot data and the reconstructed image data to obtain a reconstruction error;

[0042] Obtaining the inspection anomaly identification result based on the reconstruction error and a preset error threshold;

[0043] The reconstruction error is achieved by the following formula:

[0044]

[0045] Among them, L recon represents the reconstruction error, n represents the number of image data included in the robot data, x i represents the i-th image data, represents the reconstructed image data corresponding to the i-th image data.

[0046] Optionally, the performing of spatiotemporal correlation analysis using a spatiotemporal correlation analysis model based on the abnormality identification result to obtain the spatiotemporal correlation analysis result includes:

[0047] Based on the environmental abnormality time in the environmental abnormality recognition result and the inspection abnormality time in the inspection abnormality recognition result, a time correlation analysis is performed using a time correlation function to obtain a time correlation analysis result;

[0048] Based on the environmental anomaly position in the environmental anomaly recognition result and the inspection anomaly position in the inspection anomaly recognition result, a spatial correlation analysis is performed using a spatial correlation function to obtain a spatial correlation analysis result;

[0049] Based on the temporal correlation analysis result and the spatial correlation analysis result, a comprehensive correlation analysis is performed using a temporal-spatial comprehensive scoring function to obtain a comprehensive correlation score;

[0050] Obtaining the spatiotemporal correlation analysis result based on the comprehensive correlation score and a preset score threshold;

[0051] The time correlation analysis result is achieved by the following formula:

[0052] Δt ij =|t i -t j |;

[0053] Among them, t i Indicates the abnormal time of the environment, t j Indicates the abnormal inspection time, Δt ij represents the time correlation analysis result;

[0054] The spatial correlation analysis results are achieved through the following formula:

[0055] Δl ij =Distance(l i ,l j );

[0056] Among them, l i Indicates the abnormal location of the environment, l j Indicates the abnormal location of the inspection, Distance is the Euclidean distance algorithm, ΔI ij represents the spatial correlation analysis result;

[0057] The comprehensive relevance score is achieved by the following formula:

[0058]

[0059] Among them, S ij represents the comprehensive association score, w t is the preset time-related weight, Δt ij represents the time correlation analysis result, σ t Represents the preset time-correlated Gaussian kernel width parameter, w l is the preset spatial association weight, Δl ij represents the spatial correlation analysis results, σ l Represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0060] Optionally, after generating the security warning report for the smart community and park, the method further includes:

[0061] Acquire access control images of the smart community and park, where the access control images contain people or vehicles;

[0062] Based on the access control image, an access control recognition model is used to perform recognition to obtain a target access object;

[0063] The target access object is matched with a preset whitelist. If the match is successful, the door is controlled to be opened and the access time of the target access object is recorded.

[0064] On the other hand, the present invention also provides a security management system, comprising:

[0065] The acquisition module is used to obtain security monitoring data within smart communities and parks;

[0066] An anomaly identification module is used to identify anomalies based on the security monitoring data using an environmental monitoring model and a patrol monitoring model to obtain an anomaly identification result;

[0067] A spatiotemporal correlation analysis module is used to perform spatiotemporal correlation analysis based on the abnormality recognition result using a spatiotemporal correlation analysis model to obtain a spatiotemporal correlation analysis result;

[0068] An early warning module is configured to generate a security early warning report for the smart community and park if the spatiotemporal correlation analysis results indicate an abnormality in the target area;

[0069] Among them, the environmental monitoring model integrates the isolation forest model, the long short-term memory network LSTM model and the local anomaly factor algorithm.

[0070] Optionally, the anomaly identification module is specifically used to identify environmental anomalies based on the sensor data in the security monitoring data using an environmental monitoring model to obtain an environmental anomaly identification result; and to identify patrol anomalies based on the robot data in the security monitoring data using a patrol monitoring model to obtain a patrol anomaly identification result.

[0071] Optionally, the anomaly identification module is specifically used to use the isolation forest model of the environmental monitoring model to identify the environmental anomaly location of the sensor data in the security monitoring data to obtain an environmental anomaly location identification result; use the LSTM model of the environmental monitoring model to predict environmental anomalies on the sensor data to obtain an environmental anomaly prediction result; based on the environmental anomaly prediction result and the sensor data, use the local anomaly factor algorithm of the environmental monitoring model to identify anomalies to obtain an environmental anomaly detection result; based on the environmental anomaly location identification result and the environmental anomaly detection result, obtain the environmental anomaly identification result.

[0072] Optionally, the anomaly identification module is specifically used to construct a data space based on the sensor data in the security monitoring data, where the data space includes multiple sensor data points, and each sensor data point includes a detection location and corresponding sensor data; based on randomly selected features and segmentation values, the data space is segmented to obtain multiple isolated trees; based on each sensor data point, according to the path length of the sensor data point in each isolated tree, an anomaly score calculation function is used to obtain the anomaly score of each sensor data point; based on the anomaly score of each sensor data point and a preset anomaly score threshold, the environmental abnormal location identification result is obtained.

[0073] Optionally, the anomaly identification module is specifically used to construct a data set based on the environmental anomaly prediction result and the sensor data, the data set including multiple data points, each data point including a detection location and corresponding detection data, the detection data being a predicted value in the environmental anomaly prediction result or an observed value in the sensor data; based on the distance between each two data points, using a reachable distance calculation function, obtaining a reachable distance between each two data points; based on the reachable distance between each two data points, using a local reachable density calculation function, obtaining a local reachable density of each data point; based on the local reachable density of each data point, using a local anomaly factor calculation function, obtaining a local anomaly factor of each data point; based on the local anomaly factor of each data point and a preset local anomaly factor threshold, obtaining the environmental anomaly detection result;

[0074] The reachable distance between each two data points is achieved by the following formula:

[0075]

[0076] in, represents the reachable distance between data point p and data point o, k_distance(o) represents the distance from data point o to the kth nearest neighbor, and d(p,o) represents the distance between data point p and data point o;

[0077] The local reachable density of each data point is realized by the following formula:

[0078]

[0079] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from the data point p does not exceed k_distance(o), Represents the reachable distance between data point p and data point o;

[0080] The local anomaly factor of each data point is realized by the following formula:

[0081]

[0082] Among them, LOF k (p) represents the local anomaly factor of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachable density of data point o, lrd k (p) represents the local reachability density of data point p.

[0083] Optionally, the anomaly recognition module is specifically configured to use an encoder of the inspection and monitoring model to perform image compression on the image data in the robot data to obtain image features; use a decoder of the inspection and monitoring model to perform image reconstruction on the image features to obtain reconstructed image data; use a reconstruction error calculation function in an output layer of the inspection and monitoring model to perform error calculation on the image data in the robot data and the reconstructed image data to obtain a reconstruction error; and obtain the inspection anomaly recognition result based on the reconstruction error and a preset error threshold;

[0084] The reconstruction error is achieved by the following formula:

[0085]

[0086] Among them, L recon represents the reconstruction error, n represents the number of image data included in the robot data, x i represents the i-th image data, represents the reconstructed image data corresponding to the i-th image data.

[0087] Optionally, the spatiotemporal correlation analysis module is specifically configured to perform a temporal correlation analysis using a temporal correlation function based on the environmental anomaly time in the environmental anomaly recognition result and the inspection anomaly time in the inspection anomaly recognition result to obtain a temporal correlation analysis result; perform a spatial correlation analysis using a spatial correlation function based on the environmental anomaly position in the environmental anomaly recognition result and the inspection anomaly position in the inspection anomaly recognition result to obtain a spatial correlation analysis result; perform a comprehensive correlation analysis using a time-space comprehensive scoring function based on the temporal correlation analysis result and the spatial correlation analysis result to obtain a comprehensive correlation score; and obtain the spatiotemporal correlation analysis result based on the comprehensive correlation score and a preset scoring threshold;

[0088] The time correlation analysis result is achieved by the following formula:

[0089] Δt ij =|t u -t j |;

[0090] Among them, t i Indicates the abnormal time of the environment, t j Indicates the abnormal inspection time, Δt ij represents the time correlation analysis result;

[0091] The spatial correlation analysis results are achieved through the following formula:

[0092] Δl ij =Distance(l i ,l j );

[0093] Among them, l i Indicates the abnormal location of the environment, l j Indicates the abnormal location of the inspection, Distance is the Euclidean distance algorithm, ΔI ij represents the spatial correlation analysis result;

[0094] The comprehensive relevance score is achieved by the following formula:

[0095]

[0096] Among them, S ij represents the comprehensive association score, w t is the preset time-related weight, Δt ij represents the time correlation analysis result, σ t Represents the preset time-correlated Gaussian kernel width parameter, w l is the preset spatial association weight, Δl ij represents the spatial correlation analysis results, σ l Represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0097] Optionally, the security management system further includes:

[0098] The access control management module is used to obtain the access control images of the smart community and the park, wherein the access control images contain people or vehicles; based on the access control images, the access control recognition model is used to identify the target access object; the target access object is matched with a preset whitelist. If the match is successful, the access control is controlled to open, and the access time of the target access object is recorded.

[0099] On the other hand, the present invention also provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus;

[0100] The memory is used to store one or more programs;

[0101] When the one or more programs are executed by the at least one processor, a security management method as described above is implemented.

[0102] On the other hand, the present invention also provides a readable storage medium having an execution program stored thereon, and when the execution program is executed, a security management method as described in any one of the above is implemented.

[0103] Compared with the prior art, the present invention has the following beneficial effects:

[0104] The present invention provides a security management method, system, and device, comprising: obtaining security monitoring data of a smart community and a park; based on the security monitoring data, using an environmental monitoring model and an inspection monitoring model to perform anomaly identification to obtain anomaly identification results; based on the anomaly identification results, using a spatiotemporal correlation analysis model to perform spatiotemporal correlation analysis to obtain spatiotemporal correlation analysis results; if the spatiotemporal correlation analysis results indicate that an anomaly has occurred in a target area, generating a security early warning report for the smart community and the park; wherein the environmental monitoring model integrates an isolation forest model, a long short-term memory network (LSTM) model, and a local anomaly factor algorithm. The present invention can collect security monitoring data within the smart community and the park in real time, and by comprehensively applying multiple models to perform anomaly identification and spatiotemporal correlation analysis, it can comprehensively and accurately discover safety hazards in the smart community and the park, and timely generate a security early warning report to provide a decision-making basis for management personnel, effectively improve the efficiency and accuracy of security management, and ensure the safety of the community and the park. BRIEF DESCRIPTION OF THE DRAWINGS

[0105] Figure 1 A schematic flow chart of a security management method of the present invention;

[0106] Figure 2 This is a schematic structural diagram of a security management system of the present invention;

[0107] Figure 3 Schematic diagram of the structure of the electronic device of the present invention. DETAILED DESCRIPTION

[0108] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0109] Example 1:

[0110] The present invention provides a security management method, the flow chart of which is as follows: Figure 1Shown, including:

[0111] Step 101: Obtain security monitoring data of the smart community and park;

[0112] Step 102: Based on the security monitoring data, anomaly identification is performed using the environmental monitoring model and the inspection monitoring model to obtain anomaly identification results;

[0113] Step 103: Based on the anomaly recognition result, perform spatiotemporal correlation analysis using a spatiotemporal correlation analysis model to obtain a spatiotemporal correlation analysis result;

[0114] Step 104: If the spatiotemporal correlation analysis result indicates that an anomaly has occurred in the target area, a security warning report for the smart community and park is generated;

[0115] Among them, the environmental monitoring model integrates the isolation forest model, the long short-term memory network LSTM model and the local anomaly factor algorithm.

[0116] An embodiment of the present invention provides a security management method applied to an electronic device, which may be a personal computer (PC), a server, or the like.

[0117] In a large-scale smart community or park project, an efficient security management system must be built. First, security monitoring data must be acquired through multiple channels. This data comes from a wide range of sources, including sensors in key areas within the park and patrol robots.

[0118] For example, in smart communities and campuses, electronic devices collect real-time environmental data through sensors installed throughout the communities and campuses. These sensors include temperature and humidity sensors, noise sensors, and hazardous gas sensors, which monitor the temperature, humidity, noise level, and hazardous gas concentration within the communities, respectively. Simultaneously, patrol robots within the communities and campuses regularly patrol along pre-set routes, collecting video data as robot data through cameras. Electronic devices use this collected sensor and robot data as security monitoring data.

[0119] Sensors periodically transmit sensor data to electronic devices via the IoT network. For example, temperature and humidity sensors collect data every five minutes, noise sensors monitor noise levels in real time, and hazardous gas sensors measure gas concentrations every ten minutes. Inspection robots perform scheduled patrols daily, with cameras capturing video data at 30 frames per second. This video data is then transmitted to electronic devices in real time via a high-speed network.

[0120] The electronic device inputs sensor data into an environmental monitoring model for analysis. This environmental monitoring model integrates, but is not limited to, an isolation forest model, a long short-term memory (LSTM) model, and a local anomaly factor algorithm. The isolation forest model identifies anomaly locations based on sensor data, identifying potentially problematic environmental anomaly locations. The LSTM model and local anomaly factor algorithm monitor environmental anomalies based on the sensor data, generating environmental anomaly detection results. Finally, the environmental anomaly location identification results and environmental anomaly detection results are output as environmental anomaly identification results.

[0121] The electronic device inputs the robot data, which consists of image data captured by the robot's camera during patrols, into the inspection and monitoring model for analysis. The inspection and monitoring model uses an encoder to compress the image data to obtain image features. The decoder then reconstructs the image, calculating the reconstruction error between the original and reconstructed image data. It then determines whether an inspection anomaly exists based on a preset error threshold and outputs the inspection anomaly identification result.

[0122] The electronic device obtains the environmental anomaly recognition result output by the environmental monitoring model and the inspection anomaly recognition result output by the inspection monitoring model, and performs spatiotemporal correlation analysis using the spatiotemporal correlation analysis model.

[0123] For example, electronic devices can use a spatiotemporal correlation analysis model to perform temporal correlation analysis, analyzing the relationship between the time of environmental anomalies and the time of inspection anomalies to determine whether they occurred within a similar time period. The spatiotemporal correlation analysis model can also be used to perform spatial correlation analysis, analyzing the distance between the location of environmental anomalies and the location of inspection anomalies to determine whether they are in the same or nearby areas. Based on the temporal and spatial correlation analysis results, the electronic device can then determine whether an anomaly exists in a target area. If an anomaly exists in a target area, a security warning report is generated.

[0124] In order to improve the speed of discovering abnormal events, accurately determine the nature and severity of abnormal events, realize high automation of data collection, analysis and early warning processes, and reduce manual intervention, based on the above embodiment, in an embodiment of the present invention, the above-mentioned abnormality identification is performed based on security monitoring data using an environmental monitoring model and an inspection monitoring model, and the abnormality identification results obtained include:

[0125] Based on the sensor data in the security monitoring data, the environmental monitoring model is used to identify environmental anomalies and obtain environmental anomaly identification results;

[0126] Based on the robot data in the security monitoring data, the inspection monitoring model is used to perform inspection anomaly recognition and obtain the inspection anomaly recognition results.

[0127] In the present invention, the security monitoring data acquired by the electronic device includes sensor data and robot data, wherein the sensor data is environmental data collected by the sensor within a certain period of time, such as temperature, humidity, etc., and the robot data is image data collected by the robot, which can be directly captured by the camera deployed on the robot, or captured from the video.

[0128] In the present invention, the electronic device inputs sensor data from security monitoring data into an environmental monitoring model, which then identifies environmental anomalies based on the sensor data, generating an environmental anomaly identification result. The environmental anomaly identification result includes, but is not limited to, the anomaly location, anomaly time, and anomaly type.

[0129] Furthermore, the electronic device inputs the robot data from the security monitoring data into the patrol monitoring model, which then performs patrol anomaly identification based on the robot data to generate patrol anomaly identification results, including but not limited to the anomaly location, anomaly time, and anomaly type.

[0130] In order to improve the speed of discovering abnormal events, accurately determine the nature and severity of abnormal events, realize the high automation of data collection, analysis and early warning process, and reduce manual intervention, based on the above embodiments, in an embodiment of the present invention, the above-mentioned sensor data in the security monitoring data is used to identify environmental anomalies using an environmental monitoring model, and the environmental anomaly identification results obtained include:

[0131] Using the isolation forest model of the environmental monitoring model, the sensor data in the security monitoring data is used to identify the environmental anomaly location and obtain the environmental anomaly location identification result;

[0132] Using the LSTM model of the environmental monitoring model, environmental anomaly prediction is performed on sensor data to obtain environmental anomaly prediction results;

[0133] Based on the environmental anomaly prediction results and sensor data, the local anomaly factor algorithm of the environmental monitoring model is used to identify anomalies and obtain environmental anomaly detection results;

[0134] Based on the environmental anomaly location recognition result and the environmental anomaly detection result, an environmental anomaly recognition result is obtained.

[0135] In the present invention, the environmental monitoring model includes but is not limited to the isolation forest model, the LSTM model and the local anomaly factor algorithm.

[0136] Among them, the environmental monitoring model uses the isolation forest model to quickly locate the abnormal position, uses the LSTM model to predict environmental anomalies, and combines the local anomaly factor algorithm for comprehensive judgment.

[0137] Specifically, the Isolation Forest model constructs and randomly partitions the data space, calculating the anomaly score for each sensor data point to identify the location of environmental anomalies. The LSTM model predicts possible future environmental anomalies based on sensor data. Finally, the Local Anomaly Factor algorithm combines the environmental anomaly predictions with the sensor data to further confirm the presence of anomalies.

[0138] For example, during an actual operation, the Isolation Forest model identified an abnormally high temperature in a certain area based on sensor data. Using LSTM model predictions and local anomaly factor algorithm detection, the system confirmed an environmental anomaly in that area. The system then generated a detailed security warning report and notified relevant personnel to address the issue promptly.

[0139] In order to improve the speed of discovering abnormal events, accurately determine the nature and severity of abnormal events, achieve high automation of data collection, analysis and early warning processes, and reduce manual intervention, based on the above embodiments, in an embodiment of the present invention, the isolation forest model of the environmental monitoring model is used to identify environmental abnormality locations of sensor data in security monitoring data, and the environmental abnormality location identification results obtained include:

[0140] Based on the sensor data in the security monitoring data, a data space is constructed. The data space includes multiple sensor data points. Each sensor data point contains a detection location and corresponding sensor data.

[0141] Based on randomly selected features and split values, the data space is split to obtain multiple isolated trees;

[0142] Based on each sensor data point, according to the path length of the sensor data point in each isolated tree, the anomaly score calculation function is used to obtain the anomaly score of each sensor data point;

[0143] Based on the anomaly score of each sensor data point and the preset anomaly score threshold, the environmental anomaly location identification result is obtained.

[0144] In the present invention, electronic devices construct a data space based on sensor data from security monitoring data. The data space includes multiple sensor data points, each of which contains a detection location and corresponding sensor data. The isolation forest model randomly selects a parameter type from the sensor data as a feature, such as smoke concentration, and sets a partition value to partition the data space. For example, points with smoke concentrations greater than a certain value are partitioned to one side, and points with smoke concentrations less than the value are partitioned to the other side, forming two subspaces. Similar partitioning operations are then performed on each subspace until each subspace contains only one data point, thereby constructing multiple isolation trees.

[0145] For each sensor data point, the path length in each isolation tree is calculated. This path length refers to the number of edges from the data point to the root node. Using the anomaly score calculation function, the anomaly score for each sensor data point is calculated based on the path length. Generally, anomalous sensor data points with shorter path lengths in the isolation tree have higher anomaly scores.

[0146] If the anomaly score of a sensor data point exceeds the preset anomaly score threshold, the system determines that the monitoring location corresponding to that sensor data point is abnormal and uses this determination as the environmental anomaly location identification result. For example, if the anomaly score of a sensor data point in a warehouse area is high, the system may determine that the warehouse area is abnormal.

[0147] In order to improve the speed of discovering abnormal events, accurately determine the nature and severity of abnormal events, achieve high automation of data collection, analysis and early warning processes, and reduce manual intervention, based on the above embodiments, in an embodiment of the present invention, the above-mentioned local abnormal factor algorithm of the environmental monitoring model is used to perform abnormality identification based on environmental abnormality prediction results and sensor data, and the environmental abnormality detection results obtained include:

[0148] Based on the environmental anomaly prediction results and sensor data, a data set is constructed. The data set contains multiple data points. Each data point contains a detection location and corresponding detection data. The detection data is the predicted value in the environmental anomaly prediction results or the observed value in the sensor data.

[0149] Based on the distance between each two data points, the reachable distance calculation function is used to obtain the reachable distance between each two data points;

[0150] Based on the reachable distance between every two data points, the local reachable density calculation function is used to obtain the local reachable density of each data point;

[0151] Based on the local reachable density of each data point, the local anomaly factor calculation function is used to obtain the local anomaly factor of each data point;

[0152] Based on the local anomaly factor of each data point and the preset local anomaly factor threshold, the environmental anomaly detection result is obtained;

[0153] The reachable distance between every two data points is achieved through the following formula:

[0154]

[0155] in, represents the reachable distance between data point p and data point o, k_distance(o) represents the distance from data point o to the kth nearest neighbor, and d(p,o) represents the distance between data point p and data point o;

[0156] The local reachable density of each data point is achieved by the following formula:

[0157]

[0158] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from the data point p does not exceed k_distance(o), Represents the reachable distance between data point p and data point o;

[0159] The local outlier factor for each data point is implemented by the following formula:

[0160]

[0161] Among them, LOF k (p) represents the local anomaly factor of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachable density of data point o, lrd k (p) represents the local reachability density of data point p.

[0162] In the present invention, the local anomaly factor algorithm is composed of multiple functions, including but not limited to: a reachable distance calculation function, a local reachable density calculation function, and a local anomaly factor calculation function. Among them, the reachable distance calculation function is used to calculate the reachable distance between two data points. The reachable distance takes into account the local density around the data point. The reachable distance between data points with a closer distance and higher local density is smaller; the local reachable density calculation function is used to calculate the local reachable density of the data point. The local reachable density reflects the density of the data point in its neighborhood. The lower the local reachable density, the more likely the data point is an anomaly. The local anomaly factor calculation function is used to calculate the local anomaly factor of each data point. The local anomaly factor reflects the probability that the data point is anomaly. The larger the local anomaly factor, the higher the probability that the corresponding data point is anomaly.

[0163] Specifically, the electronic device constructs a data set based on the environmental anomaly prediction results and sensor data. The data set contains multiple data points. Each data point contains a detection location and corresponding detection data. The detection data is the predicted value in the environmental anomaly prediction result or the observed value in the sensor data.

[0164] The electronic device substitutes the distance between each two data points into the reachable distance calculation function to calculate the reachable distance between each two data points; substitutes the reachable distance between each two data points into the local reachable density calculation function to calculate the local reachable density of each data point; and substitutes the local reachable density of each data point into the local anomaly factor calculation function to calculate the local anomaly factor of each data point. When the local anomaly factor of a data point exceeds the preset local anomaly factor threshold, the electronic device determines that the detection location corresponding to the data point is abnormal and uses the determination result as the environmental anomaly detection result.

[0165] For example, the reachable distance between every two data points is achieved by the following formula:

[0166]

[0167] in, represents the reachable distance between data point p and data point o, k_distance(o) represents the distance from data point o to the kth nearest neighbor, and d(p,o) represents the distance between data point p and data point o. The distance between data point p and data point o can be calculated using the Euclidean distance algorithm.

[0168] For example, the local reachability density of each data point is implemented by the following formula:

[0169]

[0170] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from the data point p does not exceed k_distance(o), Represents the reachable distance between data point p and data point o.

[0171] For example, the local anomaly factor of each data point is implemented by the following formula:

[0172]

[0173] Among them, LOF k (p) represents the local anomaly factor of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachable density of data point o, lrd k (p) represents the local reachability density of data point p.

[0174] In order to improve the speed of discovering abnormal events, accurately determine the nature and severity of abnormal events, realize the high automation of data collection, analysis and early warning process, and reduce manual intervention, based on the above embodiments, in an embodiment of the present invention, the above-mentioned robot data in the security monitoring data is used to perform inspection anomaly identification using the inspection monitoring model, and the inspection anomaly identification results obtained include:

[0175] Using the encoder of the inspection monitoring model, the image data in the robot data is compressed to obtain image features;

[0176] Using the decoder of the inspection and monitoring model, image features are reconstructed to obtain reconstructed image data;

[0177] Using the reconstruction error calculation function in the output layer of the inspection monitoring model, the error between the image data and the reconstructed image data in the robot data is calculated to obtain the reconstruction error;

[0178] Based on the reconstruction error and the preset error threshold, the inspection anomaly recognition result is obtained;

[0179] The reconstruction error is realized by the following formula:

[0180]

[0181] Among them, L recon represents the reconstruction error, n represents the number of image data contained in the robot data, x i represents the i-th image data, represents the reconstructed image data corresponding to the i-th image data.

[0182] In the security management process of a smart community and park, in order to realize the abnormal identification of image data during the inspection process, the inspection monitoring model adopts an encoder + decoder structure.

[0183] Specifically, inspection robots capture a large number of images during the inspection process, including images of equipment appearance, channel conditions, and personnel activities. After the electronic device acquires the robot data, it inputs the robot data into the inspection monitoring model. The encoder of the inspection monitoring model can use the structure of convolutional neural networks (CNN) to perform operations such as convolution and pooling on the image data in the input robot data, compressing the image to extract high-level image features. For example, the encoder uses multiple convolutional layers to gradually extract image features such as edges, textures, and shapes, compressing the image data in the robot data into a low-dimensional image feature.

[0184] The decoder uses a deconvolutional neural network (DeCNN) structure to perform deconvolution and upsampling on the image features output by the encoder to reconstruct the image data. This reconstructs the image features into reconstructed image data of the same size as the image data in the robot data. During the reconstruction process, the decoder learns how to recover the detailed information of the image data in the robot data from the image features.

[0185] The inspection monitoring model then uses the reconstruction error calculation function in its output layer to calculate the error between the image data and the reconstructed image data in the robot data. If the calculated reconstruction error exceeds a preset error threshold, the inspection monitoring model determines that the image data is abnormal and outputs the result as the inspection anomaly identification result. For example, a large reconstruction error in an image may indicate equipment damage, abnormal human behavior, or environmental anomalies.

[0186] For example, the reconstruction error is implemented by the following formula:

[0187]

[0188] Among them, L recon represents the reconstruction error, n represents the number of image data contained in the robot data, x i represents the i-th image data, represents the reconstructed image data corresponding to the i-th image data.

[0189] In order to improve the speed of discovering abnormal events, accurately determine the nature and severity of abnormal events, realize high automation of data collection, analysis and early warning processes, and reduce manual intervention, based on the above embodiments, in an embodiment of the present invention, the above-mentioned spatiotemporal correlation analysis is performed based on the abnormality identification results using the spatiotemporal correlation analysis model, and the spatiotemporal correlation analysis results obtained include:

[0190] Based on the environmental anomaly time in the environmental anomaly recognition result and the inspection anomaly time in the inspection anomaly recognition result, a time correlation function is used to perform time correlation analysis to obtain a time correlation analysis result;

[0191] Based on the environmental anomaly position in the environmental anomaly recognition result and the inspection anomaly position in the inspection anomaly recognition result, a spatial correlation function is used to perform spatial correlation analysis to obtain a spatial correlation analysis result;

[0192] Based on the results of temporal correlation analysis and spatial correlation analysis, a comprehensive correlation analysis is performed using the temporal-spatial comprehensive scoring function to obtain a comprehensive correlation score.

[0193] Based on the comprehensive correlation score and the preset score threshold, the spatiotemporal correlation analysis results are obtained;

[0194] The time correlation analysis result is achieved through the following formula:

[0195] Δt ij =|t i -t j |;

[0196] Among them, t i Indicates the environmental abnormality time, t j Indicates inspection abnormality time, Δt ij represents the results of temporal correlation analysis;

[0197] The results of spatial association analysis are achieved through the following formula:

[0198] Δl ij =Distance(l i ,l j );

[0199] Among them, l i Indicates the location of environmental abnormality, l j Indicates the inspection abnormality location, Distance is the Euclidean distance algorithm, ΔI ij Indicates the results of spatial association analysis;

[0200] The comprehensive relevance score is achieved through the following formula:

[0201]

[0202] Among them, S ij represents the comprehensive correlation score, w t is the preset time-related weight, Δt ij represents the result of time correlation analysis, σ t Represents the preset time-correlated Gaussian kernel width parameter, w l is the preset spatial association weight, Δl ij represents the results of spatial correlation analysis, σ l Represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0203] In the security management of smart communities and parks, in order to accurately determine whether an abnormality occurs in the target area, the present invention adopts a spatiotemporal correlation analysis model to perform correlation analysis on the environmental anomaly recognition results and the inspection anomaly recognition results.

[0204] Specifically, a temporal correlation function is used to analyze temporal correlation based on the time of the environmental anomaly and the time of the inspection anomaly, resulting in a temporal correlation analysis result. Then, a spatial correlation function is used to analyze spatial correlation based on the location of the environmental anomaly and the inspection anomaly, resulting in a spatial correlation analysis result. Finally, the temporal and spatial correlation analysis results are combined to generate a comprehensive correlation score using a comprehensive scoring function. If this comprehensive correlation score exceeds a preset scoring threshold, an anomaly is determined to exist at the target location.

[0205] For example, suppose that within a certain period of time, the electronic equipment system obtains multiple anomaly identification results using the environmental monitoring model and the inspection monitoring model. The environmental anomaly identification results include the time and location of the environmental anomaly. For example, a temperature anomaly is detected in a certain computer room at 2:00 PM on October 10, 2023, and the location is computer room A. Inspection anomaly identification results include the time and location of the inspection anomaly. For example, a patrol robot captures an image of a faulty device in computer room A at 2:10 PM on October 10, 2023, and identifies it as an inspection anomaly. The location of the anomaly is also computer room A.

[0206] First, based on the environmental anomaly time and the inspection anomaly time, a time correlation function is used to perform time correlation analysis to determine that the time correlation analysis results of the two anomalies are less than the preset time correlation threshold (for example, 30 minutes), indicating that the environmental anomaly and the inspection anomaly are relatively close in time.

[0207] Then, based on the location of the environmental anomaly and the inspection anomaly, a spatial correlation function was used to perform spatial correlation analysis. Since both anomalies were located in room A, the spatial correlation analysis result was less than the preset spatial correlation threshold (for example, 100 meters), indicating that the environmental anomaly and the inspection anomaly were spatially located in the same area.

[0208] Next, based on the results of the temporal and spatial correlation analyses, a comprehensive correlation analysis was performed using the temporal-spatial comprehensive scoring function. Assuming a preset temporal correlation weight of 0.6, a temporal correlation Gaussian kernel width of 15 minutes, a spatial correlation weight of 0.4, and a spatial correlation Gaussian kernel width of 50 meters, the comprehensive correlation score was 0.57.

[0209] Finally, the comprehensive correlation score of 0.57 is compared with the preset score threshold (for example, 0.5). Since 0.57>0.5, it is determined that an abnormality occurs in the target area (computer room A) and a security warning report is generated.

[0210] For example, the time correlation analysis result is the time difference, which is achieved by the following formula:

[0211] Δt ij =|t i -tj |;

[0212] Among them, t i Indicates the environmental abnormality time, t j Indicates inspection abnormality time, Δt ij represents the results of temporal correlation analysis;

[0213] For example, the result of spatial association analysis is spatial distance, which is achieved through the following formula:

[0214] Δl ij =Distance(l i ,l j );

[0215] Among them, l i Indicates the location of environmental abnormality, l j Indicates the inspection abnormality location, Distance is the Euclidean distance algorithm, ΔI ij Indicates the results of spatial association analysis;

[0216] For example, the comprehensive relevance score is implemented by the following formula:

[0217]

[0218] Among them, S ij represents the comprehensive correlation score, w t is the preset time-related weight, Δt ij represents the result of time correlation analysis, σ t Represents the preset time-correlated Gaussian kernel width parameter, w l is the preset spatial association weight, Δl ij represents the results of spatial correlation analysis, σ l Represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0219] In order to improve the speed of discovering abnormal events, accurately determine the nature and severity of abnormal events, achieve high automation of data collection, analysis and early warning processes, and reduce manual intervention, based on the above embodiments, in an embodiment of the present invention, after generating the security early warning report for the smart community and park, the method further includes:

[0220] Obtain access control images of smart communities and parks, which contain people or vehicles;

[0221] Based on the access control image, the access control recognition model is used to identify the target access object;

[0222] The target access object is matched with the preset whitelist. If the match is successful, the access control is controlled and the access time of the target access object is recorded.

[0223] In smart communities and campuses, the access control module collects access control images based on deployed cameras. This module includes a facial recognition module and a vehicle dynamic recognition module. The facial recognition module uses cameras to collect images of people, while the vehicle dynamic recognition module uses cameras to collect images of vehicles. In other words, the access control images collected by the access control module contain either people or vehicles.

[0224] Based on the access control image, the electronic device uses the access control recognition model to identify the target access person and match the target access person with a preset whitelist. If a match is successful, the access control is controlled and the access time of the target access person is recorded. The access control recognition model is derived from a combination of a facial recognition model and a vehicle recognition model.

[0225] Specifically, if the access control image contains a person, the facial recognition model within the access control recognition module is used to perform facial recognition on the access control image to identify the target access person. For example, when an employee enters the campus, the camera captures their facial image. The system uses the facial recognition model to extract facial features and compares them with a preset whitelist of people. If the facial recognition access control module determines that the identified person is on the whitelist, the access control system automatically opens and records the person's entry and exit time.

[0226] For example, if employee A enters the campus at 8:00 AM, the facial recognition access control module automatically opens the door after identifying them and records their entry time. When employee A leaves the campus at 6:00 PM, the facial recognition access control module identifies them again and records their departure time. If the facial recognition access control module determines that the identified person is not on the whitelist, it generates an exception message and alerts security management personnel to conduct an inspection.

[0227] If the access control image contains a vehicle, the vehicle recognition model in the access control recognition module is used to identify the vehicle in the access control image and determine the target access object. For example, when an authorized delivery vehicle enters the community, the camera captures its license plate image. The vehicle dynamic recognition module extracts the license plate information using the vehicle recognition model and compares it with a preset vehicle whitelist. If the vehicle dynamic recognition module determines that the identified vehicle is on the whitelist, it automatically controls the access control and records the vehicle's entry and exit time.

[0228] For example, if delivery vehicle B enters the community at 10:00 AM, the vehicle dynamic recognition module recognizes its license plate, automatically opens the door, and records the entry time. When vehicle B leaves the community at 11:00 AM, the vehicle dynamic recognition module recognizes it again and records the departure time. If the vehicle dynamic recognition module determines that the recognized vehicle is not on the whitelist, it generates an exception message and alerts security management personnel to conduct an inspection.

[0229] The present invention is described below with a specific embodiment, which includes the following steps:

[0230] (1) Obtain security monitoring data of smart communities and parks.

[0231] (2) Using the isolation forest model of the environmental monitoring model, the sensor data in the security monitoring data is used to identify the environmental anomaly location and obtain the environmental anomaly location identification results.

[0232] (3) Using the LSTM model of the environmental monitoring model, environmental anomaly prediction is performed on sensor data to obtain environmental anomaly prediction results.

[0233] (4) Based on the environmental anomaly prediction results and sensor data, the local anomaly factor algorithm of the environmental monitoring model is used to identify anomalies and obtain the environmental anomaly detection results.

[0234] (5) Based on the environmental anomaly location recognition result and the environmental anomaly detection result, the environmental anomaly recognition result is obtained.

[0235] (6) Based on the robot data in the security monitoring data, the inspection monitoring model is used to perform inspection anomaly recognition and obtain the inspection anomaly recognition results.

[0236] (7) Based on the anomaly recognition results, the spatiotemporal correlation analysis model is used to perform spatiotemporal correlation analysis to obtain the spatiotemporal correlation analysis results.

[0237] (8) If the spatiotemporal correlation analysis results indicate that an abnormality has occurred in the target area, a security warning report for the smart community and park will be generated.

[0238] The present invention can collect security monitoring data in smart communities and parks in real time. By comprehensively applying multiple models to perform anomaly identification and spatiotemporal correlation analysis, it can comprehensively and accurately discover safety hazards in smart communities and parks, and generate security early warning reports in a timely manner, providing management personnel with a basis for decision-making, effectively improving the efficiency and accuracy of security management, and ensuring the safety of communities and parks.

[0239] This invention relates to an integrated security management system and method for smart communities and industrial parks. By building a unified data management platform, it enables interconnected communication and centralized management of security equipment within communities and industrial parks. The system includes a facial recognition access control module, a vehicle dynamic recognition module, an environmental anomaly detection module, and an intelligent security patrol module. Based on edge computing and artificial intelligence technologies, the system can process massive amounts of data in real time and generate security warning reports. This system provides a cross-regional, multifunctional security solution widely applicable to the intelligent management needs of modern communities and industrial parks, improving regional security efficiency and service experience.

[0240] Example 2:

[0241] Based on the same inventive concept, the present invention also provides a security management system, the structural diagram of which is shown in FIG. Figure 2 Shown, including:

[0242] Acquisition module 201, used to obtain security monitoring data within the smart community and park;

[0243] Anomaly identification module 202, for performing anomaly identification based on security monitoring data using an environmental monitoring model and an inspection monitoring model to obtain anomaly identification results;

[0244] The spatiotemporal correlation analysis module 203 is configured to perform spatiotemporal correlation analysis based on the anomaly recognition result using the spatiotemporal correlation analysis model to obtain a spatiotemporal correlation analysis result;

[0245] The early warning module 204 is used to generate a security early warning report for the smart community and park if the spatiotemporal correlation analysis result indicates that an abnormality has occurred in the target area;

[0246] Among them, the environmental monitoring model integrates the isolation forest model, the long short-term memory network LSTM model and the local anomaly factor algorithm.

[0247] In a specific implementation, the anomaly identification module 202 is specifically used to identify environmental anomalies based on sensor data in security monitoring data using an environmental monitoring model to obtain environmental anomaly identification results; and to identify patrol anomalies based on robot data in security monitoring data using a patrol monitoring model to obtain patrol anomaly identification results.

[0248] In a specific implementation, the anomaly identification module 202 is specifically used to use the isolation forest model of the environmental monitoring model to identify the environmental anomaly location of the sensor data in the security monitoring data to obtain the environmental anomaly location identification result; use the LSTM model of the environmental monitoring model to predict the environmental anomaly of the sensor data to obtain the environmental anomaly prediction result; based on the environmental anomaly prediction result and the sensor data, use the local anomaly factor algorithm of the environmental monitoring model to identify the anomaly to obtain the environmental anomaly detection result; based on the environmental anomaly location identification result and the environmental anomaly detection result, obtain the environmental anomaly identification result.

[0249] In a specific implementation, the anomaly identification module 202 is specifically configured to construct a data space based on sensor data in the security monitoring data, where the data space includes multiple sensor data points, each of which includes a detection location and corresponding sensor data; segment the data space based on randomly selected features and segmentation values to obtain multiple isolated trees; obtain an anomaly score for each sensor data point based on the path length of the sensor data point in each isolated tree using an anomaly score calculation function; and obtain an environmental anomaly location identification result based on the anomaly score of each sensor data point and a preset anomaly score threshold.

[0250] In a specific implementation, the anomaly identification module 202 is specifically configured to construct a data set based on the environmental anomaly prediction result and the sensor data, where the data set includes multiple data points, each data point includes a detection location and corresponding detection data, and the detection data is a predicted value in the environmental anomaly prediction result or an observed value in the sensor data; based on the distance between each two data points, a reachable distance calculation function is used to obtain the reachable distance between each two data points; based on the reachable distance between each two data points, a local reachable density calculation function is used to obtain the local reachable density of each data point; based on the local reachable density of each data point, a local anomaly factor calculation function is used to obtain the local anomaly factor of each data point; based on the local anomaly factor of each data point and a preset local anomaly factor threshold, an environmental anomaly detection result is obtained;

[0251] The reachable distance between every two data points is achieved through the following formula:

[0252]

[0253] in, represents the reachable distance between data point p and data point o, k_distance(o) represents the distance from data point o to the kth nearest neighbor, and d(p,o) represents the distance between data point p and data point o;

[0254] The local reachable density of each data point is achieved by the following formula:

[0255]

[0256] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from the data point p does not exceed k_distance(o), Represents the reachable distance between data point p and data point o;

[0257] The local outlier factor for each data point is implemented by the following formula:

[0258]

[0259] Among them, LOF k (p) represents the local anomaly factor of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachable density of data point o, lrd k (p) represents the local reachability density of data point p.

[0260] In a specific implementation, the anomaly recognition module 202 is specifically configured to use an encoder of the inspection and monitoring model to perform image compression on image data in the robot data to obtain image features; use a decoder of the inspection and monitoring model to perform image reconstruction on the image features to obtain reconstructed image data; use a reconstruction error calculation function in an output layer of the inspection and monitoring model to perform error calculation on the image data in the robot data and the reconstructed image data to obtain a reconstruction error; and obtain an inspection anomaly recognition result based on the reconstruction error and a preset error threshold.

[0261] The reconstruction error is realized by the following formula:

[0262]

[0263] Among them, L recon represents the reconstruction error, n represents the number of image data contained in the robot data, x i represents the i-th image data, represents the reconstructed image data corresponding to the i-th image data.

[0264] In a specific implementation, the spatiotemporal correlation analysis module 203 is specifically configured to perform a temporal correlation analysis based on the environmental anomaly time in the environmental anomaly recognition result and the inspection anomaly time in the inspection anomaly recognition result using a temporal correlation function to obtain a temporal correlation analysis result; perform a spatial correlation analysis based on the environmental anomaly position in the environmental anomaly recognition result and the inspection anomaly position in the inspection anomaly recognition result using a spatial correlation function to obtain a spatial correlation analysis result; perform a comprehensive correlation analysis based on the temporal correlation analysis result and the spatial correlation analysis result using a time-space comprehensive scoring function to obtain a comprehensive correlation score; and obtain a spatiotemporal correlation analysis result based on the comprehensive correlation score and a preset scoring threshold.

[0265] The time correlation analysis result is achieved through the following formula:

[0266] Δt ij =|t i -t j |;

[0267] Among them, t i Indicates the environmental abnormality time, t j Indicates inspection abnormality time, Δt ij represents the results of temporal correlation analysis;

[0268] The results of spatial association analysis are achieved through the following formula:

[0269] Δl ij =Distance(l i ,l j );

[0270] Among them, l i Indicates the location of environmental abnormality, l j Indicates the inspection abnormality location, Distance is the Euclidean distance algorithm, ΔI ij Indicates the results of spatial association analysis;

[0271] The comprehensive relevance score is achieved through the following formula:

[0272]

[0273] Among them, S ij represents the comprehensive correlation score, w t is the preset time-related weight, Δt ij represents the result of time correlation analysis, σ t Represents the preset time-correlated Gaussian kernel width parameter, w l is the preset spatial association weight, Δl ij represents the results of spatial correlation analysis, σ lRepresents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0274] In a specific implementation, the security management system further includes:

[0275] The access control management module 205 is used to obtain access control images of smart communities and parks, which may contain people or vehicles; based on the access control images, an access control recognition model is used to identify the target access object; the target access object is matched with a preset whitelist. If the match is successful, the access control is controlled to open and the access time of the target access object is recorded.

[0276] Example 3:

[0277] like Figure 3 As shown, the present invention also provides an electronic device, which may be a computer, a single-chip microcomputer, a smart mobile device, or the like. The electronic device in this embodiment may include a processor, a memory, a transceiver component, and the like. The memory, processor, and transceiver component are connected via a bus; the memory may be used to store an execution program, which may include instructions; and the processor may be used to execute the instructions stored in the memory. The memory may also be used to store data, which may be accessed and / or modified during the execution of the instructions.

[0278] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the storage medium to implement the corresponding method flow or corresponding function, so as to implement the steps of a security management method in the above embodiment.

[0279] Example 4:

[0280] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the storage medium here can include both built-in storage media in the electronic device and, of course, extended storage media supported by the electronic device. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space. These instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of a security management method in the above embodiment.

[0281] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0282] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0283] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0284] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0285] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art may still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the scope of protection of the pending claims.

Claims

1. A security management method, characterized in that: include: Obtain security monitoring data for smart communities and parks; Based on the security monitoring data, anomaly identification is performed using an environmental monitoring model and an inspection monitoring model to obtain an anomaly identification result; Based on the anomaly recognition result, performing spatiotemporal correlation analysis using a spatiotemporal correlation analysis model to obtain a spatiotemporal correlation analysis result; If the spatiotemporal correlation analysis result indicates that an abnormality occurs in the target area, a security warning report for the smart community and park is generated; Among them, the environmental monitoring model integrates the isolation forest model, the long short-term memory network LSTM model and the local anomaly factor algorithm.

2. The method according to claim 1, wherein Based on the security monitoring data, the environmental monitoring model and the inspection monitoring model are used to perform abnormality identification, and the abnormality identification results obtained include: Based on the sensor data in the security monitoring data, an environmental anomaly recognition result is obtained by using an environmental monitoring model; Based on the robot data in the security monitoring data, a patrol anomaly recognition is performed using a patrol monitoring model to obtain a patrol anomaly recognition result.

3. The method according to claim 2, wherein The environmental anomaly identification is performed based on the sensor data in the security monitoring data using the environmental monitoring model to obtain the environmental anomaly identification result, which includes: Using the isolation forest model of the environmental monitoring model, identifying environmental anomaly locations on sensor data in the security monitoring data to obtain environmental anomaly location identification results; Using the LSTM model of the environmental monitoring model, performing environmental anomaly prediction on the sensor data to obtain an environmental anomaly prediction result; Based on the environmental anomaly prediction result and the sensor data, anomaly identification is performed using the local anomaly factor algorithm of the environmental monitoring model to obtain an environmental anomaly detection result; The environmental anomaly recognition result is obtained based on the environmental anomaly location recognition result and the environmental anomaly detection result.

4. The method according to claim 3, wherein The isolation forest model of the environmental monitoring model is used to identify abnormal environmental locations of sensor data in the security monitoring data, and the abnormal environmental location identification result obtained includes: constructing a data space based on the sensor data in the security monitoring data, wherein the data space includes a plurality of sensor data points, each sensor data point including a detection location and corresponding sensor data; Based on randomly selected features and segmentation values, the data space is segmented to obtain a plurality of isolated trees; Based on each sensor data point, according to the path length of the sensor data point in each isolated tree, using an anomaly score calculation function to obtain an anomaly score of each sensor data point; The environmental abnormality location identification result is obtained based on the abnormality score of each sensor data point and a preset abnormality score threshold.

5. The method according to claim 3 or 4, wherein: The method of performing anomaly identification based on the environmental anomaly prediction result and the sensor data using the local anomaly factor algorithm of the environmental monitoring model to obtain an environmental anomaly detection result includes: Constructing a data set based on the environmental anomaly prediction result and the sensor data, the data set comprising a plurality of data points, each data point comprising a detection location and corresponding detection data, the detection data being a predicted value in the environmental anomaly prediction result or an observed value in the sensor data; Based on the distance between each two data points, the reachable distance calculation function is used to obtain the reachable distance between each two data points; Based on the reachable distance between each two data points, a local reachable density calculation function is used to obtain the local reachable density of each data point; Based on the local reachable density of each data point, a local anomaly factor calculation function is used to obtain a local anomaly factor of each data point; Obtaining the environmental anomaly detection result based on the local anomaly factor of each data point and a preset local anomaly factor threshold; The reachable distance between each two data points is achieved by the following formula: in, represents the reachable distance between data point p and data point o, k_distance(o) represents the distance from data point o to the kth nearest neighbor, and d(p,o) represents the distance between data point p and data point o; The local reachable density of each data point is realized by the following formula: Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), reach distk (p,o) represents the reachable distance between data point p and data point o; The local anomaly factor of each data point is realized by the following formula: Among them, LOF k (p) represents the local anomaly factor of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachable density of data point o, lrd k (p) represents the local reachability density of data point p.

6. The method according to claim 2, wherein The patrol anomaly identification is performed based on the robot data in the security monitoring data using the patrol monitoring model, and the patrol anomaly identification result obtained includes: Using the encoder of the inspection and monitoring model, image data in the robot data is compressed to obtain image features; Reconstructing the image features using the decoder of the inspection and monitoring model to obtain reconstructed image data; Using a reconstruction error calculation function in an output layer of the inspection and monitoring model, an error calculation is performed on the image data in the robot data and the reconstructed image data to obtain a reconstruction error; Obtaining the inspection anomaly identification result based on the reconstruction error and a preset error threshold; The reconstruction error is achieved by the following formula: Among them, L recon represents the reconstruction error, n represents the number of image data included in the robot data, x i represents the i-th image data, represents the reconstructed image data corresponding to the i-th image data.

7. The method according to claim 1 or 2, wherein: Based on the abnormality recognition result, the spatiotemporal correlation analysis is performed using the spatiotemporal correlation analysis model to obtain the spatiotemporal correlation analysis result including: Based on the environmental abnormality time in the environmental abnormality recognition result and the inspection abnormality time in the inspection abnormality recognition result, a time correlation analysis is performed using a time correlation function to obtain a time correlation analysis result; Based on the environmental anomaly position in the environmental anomaly recognition result and the inspection anomaly position in the inspection anomaly recognition result, a spatial correlation analysis is performed using a spatial correlation function to obtain a spatial correlation analysis result; Based on the temporal correlation analysis result and the spatial correlation analysis result, a comprehensive correlation analysis is performed using a temporal-spatial comprehensive scoring function to obtain a comprehensive correlation score; Obtaining the spatiotemporal correlation analysis result based on the comprehensive correlation score and a preset score threshold; The time correlation analysis result is achieved by the following formula: Δt ij =|t i -t j |; Among them, t i Indicates the abnormal time of the environment, t j Indicates the abnormal inspection time, Δt ij represents the time correlation analysis result; The spatial correlation analysis results are achieved through the following formula: Δl ij =Distance(l i ,l j ); Among them, l i Indicates the abnormal location of the environment, l j Indicates the abnormal location of the inspection, Distance is the Euclidean distance algorithm, ΔI ij represents the spatial correlation analysis result; The comprehensive relevance score is achieved by the following formula: Among them, S ij represents the comprehensive association score, w t is the preset time-related weight, Δt ij represents the time correlation analysis result, σ t Represents the preset time-correlated Gaussian kernel width parameter, w l is the preset spatial association weight, Δl ij represents the spatial correlation analysis results, σ l Represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

8. The method according to claim 1, wherein After generating the security warning report for the smart community and park, the method further includes: Acquire access control images of the smart community and park, where the access control images contain people or vehicles; Based on the access control image, an access control recognition model is used to perform recognition to obtain a target access object; The target access object is matched with a preset whitelist. If the match is successful, the door is controlled to be opened and the access time of the target access object is recorded.

9. A security management system, characterized in that: include: The acquisition module is used to obtain security monitoring data within smart communities and parks; An anomaly identification module is used to identify anomalies based on the security monitoring data using an environmental monitoring model and a patrol monitoring model to obtain an anomaly identification result; A spatiotemporal correlation analysis module is used to perform spatiotemporal correlation analysis based on the abnormality recognition result using a spatiotemporal correlation analysis model to obtain a spatiotemporal correlation analysis result; An early warning module is configured to generate a security early warning report for the smart community and park if the spatiotemporal correlation analysis results indicate an abnormality in the target area; Among them, the environmental monitoring model integrates the isolation forest model, the long short-term memory network LSTM model and the local anomaly factor algorithm.

10. An electronic device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the integrated security management method for smart communities and parks as described in any one of claims 1 to 8 is implemented.

Images