Security management method, system and device

Abstract

This invention provides a security management method, system, and equipment. The method includes: acquiring security monitoring data from smart communities and parks; based on the security monitoring data, using an environmental monitoring model and an inspection monitoring model to identify anomalies and obtain anomaly identification results; based on the anomaly identification results, using a spatiotemporal correlation analysis model to perform spatiotemporal correlation analysis and obtain spatiotemporal correlation analysis results; if the spatiotemporal correlation analysis results indicate an anomaly in the target area, generating a security early warning report for the smart community and park; wherein, the environmental monitoring model integrates an isolated forest model, an LSTM model, and a local anomaly factor algorithm. This invention, by comprehensively utilizing multiple models for anomaly identification and spatiotemporal correlation analysis, can comprehensively and accurately discover security risks in smart communities and parks, promptly generate security early warning reports, provide decision-making basis for managers, effectively improve the efficiency and accuracy of security management, and ensure the safety of communities and parks.

Description

Technical Field

[0001] This invention relates to the field of smart community and park security management technology, specifically to a security management method, system and equipment. Background Technology

[0002] With the acceleration of urbanization, the construction of smart communities and industrial parks has gradually become an important part of modern urban management. Traditional security management methods mainly rely on manual inspections and simple monitoring equipment, which are difficult to cope with complex environmental changes and diverse security threats.

[0003] Existing security systems typically operate independently, lacking comprehensive analysis of environmental and inspection data, leading to problems such as untimely warnings and high false alarm rates. Summary of the Invention

[0004] To overcome the shortcomings of traditional security management methods that rely primarily on manual inspections and simple monitoring equipment, making it difficult to cope with complex environmental changes and diverse security threats, and because security systems typically operate independently and lack comprehensive analysis of environmental and inspection data, resulting in untimely warnings and high false alarm rates, this invention provides a security management method comprising:

[0005] Obtain security monitoring data from smart communities and industrial parks;

[0006] Based on the security monitoring data, anomaly identification is performed using an environmental monitoring model and an inspection monitoring model to obtain anomaly identification results.

[0007] Based on the anomaly identification results, a spatiotemporal correlation analysis model is used to perform spatiotemporal correlation analysis to obtain the spatiotemporal correlation analysis results.

[0008] If the spatiotemporal correlation analysis results indicate an anomaly in the target area, a security early warning report for the smart community and park will be generated.

[0009] The environmental monitoring model integrates the isolated forest model, the long short-term memory network (LSTM) model, and the local anomaly factor algorithm.

[0010] Optionally, based on the security monitoring data, the anomaly identification is performed using an environmental monitoring model and an inspection monitoring model, and the anomaly identification results include:

[0011] Based on the sensor data in the security monitoring data, an environmental monitoring model is used to identify environmental anomalies and obtain the environmental anomaly identification results.

[0012] Based on the robot data in the security monitoring data, an inspection monitoring model is used to identify inspection anomalies and obtain inspection anomaly identification results.

[0013] Optionally, the step of using an environmental monitoring model to identify environmental anomalies based on sensor data from the security monitoring data, and obtaining environmental anomaly identification results, includes:

[0014] Using the isolated forest model of the environmental monitoring model, the location of environmental anomalies in the sensor data of the security monitoring data is identified to obtain the environmental anomaly location identification result.

[0015] Using the LSTM model of the environmental monitoring model, environmental anomaly prediction is performed on the sensor data to obtain the environmental anomaly prediction result.

[0016] Based on the environmental anomaly prediction results and the sensor data, the local anomaly factor algorithm of the environmental monitoring model is used to identify anomalies and obtain environmental anomaly detection results.

[0017] Based on the environmental anomaly location identification result and the environmental anomaly detection result, the environmental anomaly identification result is obtained.

[0018] Optionally, the step of using the isolated forest model of the environmental monitoring model to identify environmental anomaly locations in the sensor data of the security monitoring data, and obtaining the environmental anomaly location identification results, includes:

[0019] Based on the sensor data in the security monitoring data, a data space is constructed. The data space includes multiple sensor data points, and each sensor data point contains a detection location and the corresponding sensor data.

[0020] Based on randomly selected features and segmentation values, the data space is segmented to obtain multiple isolated trees;

[0021] Based on each sensor data point, and according to the path length of the sensor data point in each isolated tree, the anomaly score of each sensor data point is obtained using an anomaly score calculation function;

[0022] Based on the anomaly score of each sensor data point and the preset anomaly score threshold, the environmental anomaly location identification result is obtained.

[0023] Optionally, the step of using the local anomaly factor algorithm of the environmental monitoring model to identify anomalies based on the environmental anomaly prediction results and the sensor data, and obtaining environmental anomaly detection results, includes:

[0024] Based on the environmental anomaly prediction results and the sensor data, a dataset is constructed. The dataset contains multiple data points, and each data point contains a detection location and corresponding detection data. The detection data is the predicted value in the environmental anomaly prediction results or the observed value in the sensor data.

[0025] Based on the distance between any two data points, the reachable distance between any two data points is obtained using the reachable distance calculation function;

[0026] Based on the reachability distance between every two data points, the local reachability density of each data point is obtained using the local reachability density calculation function;

[0027] Based on the local reachability density of each data point, the local anomaly factor of each data point is obtained using the local anomaly factor calculation function.

[0028] The environmental anomaly detection result is obtained based on the local anomaly factor and the preset local anomaly factor threshold for each data point;

[0029] The reachability distance between any two data points is achieved using the following formula:

[0030]

[0031] in, Let represent the reachable distance between data point p and data point o, k_distance(o) represent the distance from data point o to its kth nearest neighbor, and d(p,o) represent the distance between data point p and data point o.

[0032] The local reachability density of each data point is achieved by the following formula:

[0033]

[0034] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o). This represents the reachable distance between data point p and data point o;

[0035] The local anomaly factor for each data point is achieved using the following formula:

[0036]

[0037] Among them, LOF k (p) represents the local outlier of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachability density of data point o, lrd k (p) represents the local reachability density of data point p.

[0038] Optionally, the step of using a patrol monitoring model to identify patrol anomalies based on the robot data in the security monitoring data, and obtaining the patrol anomaly identification results, includes:

[0039] Using the encoder of the inspection and monitoring model, image data in the robot data is compressed to obtain image features;

[0040] Using the decoder of the inspection and monitoring model, the image features are reconstructed to obtain reconstructed image data;

[0041] Using the reconstruction error calculation function in the output layer of the inspection and monitoring model, the image data and the reconstructed image data in the robot data are used to calculate the error and obtain the reconstruction error.

[0042] Based on the reconstruction error and the preset error threshold, the inspection anomaly identification result is obtained;

[0043] The reconstruction error is achieved through the following formula:

[0044]

[0045] Among them, L recon The reconstruction error is represented by n, which represents the number of image data contained in the robot data, and x represents the number of image data contained in the robot data. i This represents the i-th image data. This represents the reconstructed image data corresponding to the i-th image data.

[0046] Optionally, the step of performing spatiotemporal correlation analysis using a spatiotemporal correlation analysis model based on the anomaly identification results to obtain the spatiotemporal correlation analysis results includes:

[0047] Based on the environmental anomaly time in the environmental anomaly identification result and the inspection anomaly time in the inspection anomaly identification result, a time correlation analysis is performed using a time correlation function to obtain the time correlation analysis result.

[0048] Based on the environmental anomaly location in the environmental anomaly identification result and the inspection anomaly location in the inspection anomaly identification result, spatial correlation analysis is performed using a spatial correlation function to obtain the spatial correlation analysis result.

[0049] Based on the time correlation analysis results and the spatial correlation analysis results, a comprehensive correlation analysis is performed using the time-space comprehensive scoring function to obtain a comprehensive correlation score;

[0050] Based on the comprehensive correlation score and the preset score threshold, the spatiotemporal correlation analysis results are obtained;

[0051] The time correlation analysis results are achieved through the following formula:

[0052] Δt ij =|t i -t j |;

[0053] Among them, t i The time of the environmental anomaly is represented by t. j The abnormal inspection time, Δt ij This indicates the results of the time correlation analysis;

[0054] The spatial correlation analysis results are achieved through the following formula:

[0055] Δl ij =Distance(l i ,l j );

[0056] Among them, l i Indicates the location of the environmental anomaly, l j This indicates the location of the inspection anomaly, where Distance is the Euclidean distance, and ΔI is the distance calculated using the Euclidean distance algorithm. ij This indicates the results of the spatial correlation analysis;

[0057] The comprehensive correlation score is achieved using the following formula:

[0058]

[0059] Among them, S ij The comprehensive correlation score, w t For the preset time-related weights, Δt ij This represents the result of the time correlation analysis, σ. t This represents the preset time-correlated Gaussian kernel width parameter, w. l For the preset spatial correlation weight, Δl ij σ represents the spatial correlation analysis result. l This represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0060] Optionally, after generating the security early warning report for the smart community and park, the method further includes:

[0061] Acquire access control images of the smart community and park, wherein the access control images contain people or vehicles;

[0062] Based on the access control image, an access control recognition model is used to identify the target access object;

[0063] The target access object is matched with a preset whitelist. If the match is successful, the access control is opened and the access time of the target access object is recorded.

[0064] On the other hand, the present invention also provides a security management system, comprising:

[0065] The acquisition module is used to acquire security monitoring data within smart communities and parks;

[0066] Anomaly identification module is used to identify anomalies based on the security monitoring data, using an environmental monitoring model and an inspection monitoring model, and to obtain anomaly identification results.

[0067] The spatiotemporal correlation analysis module is used to perform spatiotemporal correlation analysis based on the anomaly identification results using a spatiotemporal correlation analysis model, and obtain the spatiotemporal correlation analysis results.

[0068] The early warning module is used to generate a security early warning report for smart communities and parks if the spatiotemporal correlation analysis results indicate that an anomaly has occurred in the target area.

[0069] The environmental monitoring model integrates the isolated forest model, the long short-term memory network (LSTM) model, and the local anomaly factor algorithm.

[0070] Optionally, the anomaly identification module is specifically used to identify environmental anomalies based on sensor data in the security monitoring data using an environmental monitoring model, and obtain environmental anomaly identification results; and to identify inspection anomalies based on robot data in the security monitoring data using an inspection monitoring model, and obtain inspection anomaly identification results.

[0071] Optionally, the anomaly identification module is specifically used to: utilize the isolated forest model of the environmental monitoring model to identify the location of environmental anomalies in the sensor data of the security monitoring data, and obtain an environmental anomaly location identification result; utilize the LSTM model of the environmental monitoring model to predict environmental anomalies in the sensor data, and obtain an environmental anomaly prediction result; based on the environmental anomaly prediction result and the sensor data, utilize the local anomaly factor algorithm of the environmental monitoring model to identify anomalies, and obtain an environmental anomaly detection result; and based on the environmental anomaly location identification result and the environmental anomaly detection result, obtain the environmental anomaly identification result.

[0072] Optionally, the anomaly identification module is specifically used to construct a data space based on sensor data in the security monitoring data. The data space includes multiple sensor data points, and each sensor data point contains a detection location and corresponding sensor data. Based on randomly selected features and segmentation values, the data space is segmented to obtain multiple isolated trees. Based on each sensor data point, according to the path length of the sensor data point in each isolated tree, an anomaly score is obtained using an anomaly score calculation function. Based on the anomaly score of each sensor data point and a preset anomaly score threshold, the environmental anomaly location identification result is obtained.

[0073] Optionally, the anomaly identification module is specifically used to construct a dataset based on the environmental anomaly prediction result and the sensor data. The dataset contains multiple data points, and each data point contains a detection location and corresponding detection data. The detection data is the predicted value in the environmental anomaly prediction result or the observed value in the sensor data. Based on the distance between each pair of data points, a reachable distance calculation function is used to obtain the reachable distance between each pair of data points. Based on the reachable distance between each pair of data points, a local reachability density calculation function is used to obtain the local reachability density of each data point. Based on the local reachability density of each data point, a local anomaly factor calculation function is used to obtain the local anomaly factor of each data point. Based on the local anomaly factor of each data point and a preset local anomaly factor threshold, the environmental anomaly detection result is obtained.

[0074] The reachability distance between any two data points is achieved using the following formula:

[0075]

[0076] in, Let represent the reachable distance between data point p and data point o, k_distance(o) represent the distance from data point o to its kth nearest neighbor, and d(p,o) represent the distance between data point p and data point o.

[0077] The local reachability density of each data point is achieved by the following formula:

[0078]

[0079] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o). This represents the reachable distance between data point p and data point o;

[0080] The local anomaly factor for each data point is achieved using the following formula:

[0081]

[0082] Among them, LOF k (p) represents the local outlier of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachability density of data point o, lrd k (p) represents the local reachability density of data point p.

[0083] Optionally, the anomaly identification module is specifically used to: compress the image data in the robot data using the encoder of the inspection and monitoring model to obtain image features; reconstruct the image features using the decoder of the inspection and monitoring model to obtain reconstructed image data; calculate the error between the image data in the robot data and the reconstructed image data using the reconstruction error calculation function in the output layer of the inspection and monitoring model to obtain the reconstruction error; and obtain the inspection anomaly identification result based on the reconstruction error and a preset error threshold.

[0084] The reconstruction error is achieved through the following formula:

[0085]

[0086] Among them, L recon The reconstruction error is represented by n, which represents the number of image data contained in the robot data, and x represents the number of image data contained in the robot data. i This represents the i-th image data. This represents the reconstructed image data corresponding to the i-th image data.

[0087] Optionally, the spatiotemporal correlation analysis module is specifically used to perform time correlation analysis using a time correlation function based on the environmental anomaly time in the environmental anomaly identification result and the inspection anomaly time in the inspection anomaly identification result, to obtain a time correlation analysis result; to perform spatial correlation analysis using a spatial correlation function based on the environmental anomaly location in the environmental anomaly identification result and the inspection anomaly location in the inspection anomaly identification result, to obtain a spatial correlation analysis result; to perform comprehensive correlation analysis using a time-space comprehensive scoring function based on the time correlation analysis result and the spatial correlation analysis result, to obtain a comprehensive correlation score; and to obtain the spatiotemporal correlation analysis result based on the comprehensive correlation score and a preset scoring threshold.

[0088] The time correlation analysis results are achieved through the following formula:

[0089] Δt ij =|t u -t j |;

[0090] Among them, t i The time of the environmental anomaly is represented by t. j The abnormal inspection time, Δt ij This indicates the results of the time correlation analysis;

[0091] The spatial correlation analysis results are achieved through the following formula:

[0092] Δl ij =Distance(l i ,l j );

[0093] Among them, l i Indicates the location of the environmental anomaly, l j This indicates the location of the inspection anomaly, where Distance is the Euclidean distance, and ΔI is the distance calculated using the Euclidean distance algorithm. ij This indicates the results of the spatial correlation analysis;

[0094] The comprehensive correlation score is achieved using the following formula:

[0095]

[0096] Among them, S ij The comprehensive correlation score, w t For the preset time-related weights, Δt ij This represents the result of the time correlation analysis, σ. t This represents the preset time-correlated Gaussian kernel width parameter, w. l For the preset spatial correlation weight, Δl ij σ represents the spatial correlation analysis result. l This represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0097] Optionally, the security management system further includes:

[0098] The access control management module is used to acquire access control images of the smart community and park, which contain people or vehicles; based on the access control images, an access control recognition model is used to identify the target access object; the target access object is matched with a preset whitelist, and if the match is successful, the access control is controlled to open, and the access time of the target access object is recorded.

[0099] On the other hand, the present invention also provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus;

[0100] The memory is used to store one or more programs;

[0101] When the one or more programs are executed by the at least one processor, a security management method as described in any one of the above statements is implemented.

[0102] On the other hand, the present invention also provides a readable storage medium having an executable program stored thereon, wherein when the executable program is executed, it implements a security management method as described in any one of the above-mentioned methods.

[0103] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0104] This invention provides a security management method, system, and equipment. The method includes: acquiring security monitoring data from smart communities and parks; based on the security monitoring data, using an environmental monitoring model and an inspection monitoring model to perform anomaly identification, obtaining anomaly identification results; based on the anomaly identification results, using a spatiotemporal correlation analysis model to perform spatiotemporal correlation analysis, obtaining spatiotemporal correlation analysis results; if the spatiotemporal correlation analysis results indicate an anomaly in the target area, generating a security early warning report for the smart community and park; wherein, the environmental monitoring model integrates an isolated forest model, a long short-term memory network (LSTM) model, and a local anomaly factor algorithm. This invention can collect security monitoring data in smart communities and parks in real time, and by comprehensively using multiple models for anomaly identification and spatiotemporal correlation analysis, it can comprehensively and accurately discover security risks in smart communities and parks, generate security early warning reports in a timely manner, provide decision-making basis for managers, effectively improve the efficiency and accuracy of security management, and ensure the safety of communities and parks. Attached Figure Description

[0105] Figure 1 This is a flowchart illustrating a security management method according to the present invention;

[0106] Figure 2 This is a schematic diagram of the structure of a security management system according to the present invention;

[0107] Figure 3 This is a schematic diagram of the electronic device of the present invention. Detailed Implementation

[0108] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0109] Example 1:

[0110] The present invention provides a security management method, the flowchart of which is shown below. Figure 1As shown, it includes:

[0111] Step 101: Obtain security monitoring data for smart communities and parks;

[0112] Step 102: Based on security monitoring data, use environmental monitoring models and inspection monitoring models to identify anomalies and obtain anomaly identification results;

[0113] Step 103: Based on the anomaly identification results, perform spatiotemporal correlation analysis using a spatiotemporal correlation analysis model to obtain the spatiotemporal correlation analysis results;

[0114] Step 104: If the spatiotemporal correlation analysis results indicate an anomaly in the target area, a security early warning report for the smart community and park will be generated.

[0115] The environmental monitoring model integrates the isolated forest model, the long short-term memory network (LSTM) model, and the local anomaly factor algorithm.

[0116] The security management method provided in this embodiment of the invention is applied to electronic devices, such as personal computers (PCs), servers, etc.

[0117] In a large-scale smart community and park project, an efficient security management system needs to be built. First, security monitoring data is acquired through multiple channels, including sensors in key areas of the park and patrol robots.

[0118] For example, in smart communities and parks, electronic devices collect real-time environmental data through sensors installed throughout the community and park. These sensors include temperature and humidity sensors, noise sensors, and hazardous gas sensors, used to monitor temperature, humidity, noise levels, and hazardous gas concentrations within the community, respectively. Simultaneously, patrol robots within the smart community and park patrol regularly along preset routes, collecting video data via cameras as robot data. The electronic devices then use the collected sensor data and robot data as security monitoring data.

[0119] In this system, sensors periodically transmit sensor data to electronic devices via an Internet of Things (IoT) network. For example, a temperature and humidity sensor collects data every five minutes, a noise sensor monitors noise levels in real time, and a hazardous gas sensor detects gas concentrations every ten minutes. Inspection robots patrol regularly each day, and cameras capture video data at thirty frames per second, which is then transmitted in real time to electronic devices via a high-speed network.

[0120] Electronic devices input sensor data into an environmental monitoring model for analysis. This model integrates, but is not limited to, the Isolation Forest model, the Long Short-Term Memory (LSTM) network model, and the Local Anomaly Factor algorithm. The Isolation Forest model identifies anomaly locations based on sensor data, determining the locations of potential environmental anomalies. The LSTM model and the Local Anomaly Factor algorithm monitor environmental anomalies based on sensor data, obtaining anomaly detection results. Finally, the anomaly location identification results and the anomaly detection results are combined and output as the final environmental anomaly identification result.

[0121] The electronic equipment inputs robot data into the inspection and monitoring model for analysis. This robot data consists of image data collected by the robot's camera during its patrol. The inspection and monitoring model uses an encoder to compress the image data collected by the robot to obtain image features, and then uses a decoder to reconstruct the image. It calculates the reconstruction error between the original image data and the reconstructed image data, determines whether there are any inspection anomalies based on a preset error threshold, and outputs the inspection anomaly identification result.

[0122] The electronic equipment acquires the environmental anomaly identification results output by the environmental monitoring model and the inspection anomaly identification results output by the inspection monitoring model, and performs spatiotemporal correlation analysis using the spatiotemporal correlation analysis model.

[0123] For example, electronic devices can perform time correlation analysis using a spatiotemporal correlation analysis model to analyze the relationship between environmental anomalies and inspection anomalies, determining whether they occurred within similar time periods. They can also perform spatial correlation analysis using the same model to analyze the distance between the locations of environmental anomalies and inspection anomalies, determining whether they are in the same or similar areas. Then, based on the results of both time and spatial correlation analysis, the electronic device determines whether an anomaly has occurred in a target area. If an anomaly is found in a target area, a security alert report is generated.

[0124] To improve the speed of anomaly detection, accurately determine the nature and severity of anomalies, and achieve a high degree of automation in data collection, analysis, and early warning processes while reducing manual intervention, based on the above embodiments, in this embodiment of the invention, the anomaly identification is performed using environmental monitoring models and patrol monitoring models based on security monitoring data. The resulting anomaly identification results include:

[0125] Based on sensor data from security monitoring data, an environmental monitoring model is used to identify environmental anomalies and obtain environmental anomaly identification results.

[0126] Based on robot data from security monitoring data, an inspection monitoring model is used to identify inspection anomalies and obtain inspection anomaly identification results.

[0127] In this invention, the security monitoring data acquired by the electronic device includes sensor data and robot data. The sensor data is environmental data collected by sensors over a certain period of time, such as temperature and humidity. The robot data is image data collected by the robot. The image data can be directly captured by a camera deployed on the robot or extracted from video.

[0128] In this invention, the electronic device inputs sensor data from security monitoring data into an environmental monitoring model. Based on this sensor data, the environmental monitoring model identifies environmental anomalies and obtains an environmental anomaly identification results. These results include, but are not limited to, anomaly location, anomaly time, and anomaly type.

[0129] In addition, electronic devices input robot data from security monitoring data into the inspection and monitoring model. This model then identifies inspection anomalies based on the robot data, yielding anomaly identification results. These results include, but are not limited to, anomaly location, anomaly time, and anomaly type.

[0130] To improve the speed of anomaly detection and accurately determine the nature and severity of anomalies, a high degree of automation in data collection, analysis, and early warning processes has been achieved, reducing manual intervention. Based on the above embodiments, in this embodiment of the invention, the environmental anomaly identification is performed using an environmental monitoring model based on sensor data from security monitoring data. The environmental anomaly identification results include:

[0131] Using the isolated forest model of the environmental monitoring model, the location of environmental anomalies is identified in the sensor data of the security monitoring data, and the results of the environmental anomaly location identification are obtained.

[0132] Using the LSTM model of the environmental monitoring model, environmental anomaly prediction is performed on sensor data to obtain environmental anomaly prediction results.

[0133] Based on the environmental anomaly prediction results and sensor data, the local anomaly factor algorithm of the environmental monitoring model is used to identify anomalies and obtain environmental anomaly detection results.

[0134] Based on the results of environmental anomaly location identification and environmental anomaly detection, the environmental anomaly identification result is obtained.

[0135] In this invention, the environmental monitoring model includes, but is not limited to, the isolated forest model, the LSTM model, and the local anomaly factor algorithm.

[0136] Among them, the environmental monitoring model quickly locates anomalies using the isolated forest model, predicts environmental anomalies using the LSTM model, and makes a comprehensive judgment by combining the local anomaly factor algorithm.

[0137] Specifically, the Isolation Forest model constructs and randomly partitions a data space, calculating anomaly scores for each sensor data point to identify the locations of environmental anomalies. The LSTM model then predicts potential future environmental anomalies based on sensor data. Finally, the Local Anomaly Factor algorithm combines the environmental anomaly predictions with the sensor data to further confirm the existence of anomalies.

[0138] For example, in a real-world test, the isolated forest model detected an abnormal temperature rise in a certain area using sensor data. After LSTM model prediction and local anomaly detection algorithms, the system confirmed the presence of environmental anomalies in the area. Subsequently, the system generated a detailed security alert report and notified relevant personnel to take timely action.

[0139] To improve the speed of anomaly detection and accurately determine the nature and severity of anomalies, and to achieve a high degree of automation in the data collection, analysis, and early warning process, reducing manual intervention, based on the above embodiments, in this embodiment of the invention, the isolated forest model of the environmental monitoring model is used to identify the location of environmental anomalies in the sensor data of security monitoring data. The environmental anomaly location identification results include:

[0140] Based on sensor data in security monitoring data, a data space is constructed. The data space includes multiple sensor data points. Each sensor data point contains a detection location and the corresponding sensor data.

[0141] Based on randomly selected features and segmentation values, the data space is segmented to obtain multiple isolated trees;

[0142] Based on each sensor data point, and according to the path length of the sensor data point in each isolated tree, the anomaly score of each sensor data point is obtained using the anomaly score calculation function.

[0143] Based on the anomaly score of each sensor data point and the preset anomaly score threshold, the result of environmental anomaly location identification is obtained.

[0144] In this invention, the electronic device constructs a data space based on sensor data from security monitoring data. The data space includes multiple sensor data points, and each sensor data point contains a detection location and corresponding sensor data. The Isolation Forest model randomly selects a parameter type from the sensor data as a feature, such as smoke concentration, and sets a segmentation value to divide the data space. For example, points with smoke concentrations greater than a certain value are assigned to one side, and points with concentrations less than that value are assigned to the other side, forming two subspaces. Then, similar segmentation operations are performed on each subspace until each subspace contains only one data point, thereby constructing multiple isolation trees.

[0145] For each sensor data point, calculate its path length in each isolated tree. This path length refers to the number of edges traversed from the data point to the root node. Then, using an anomaly score calculation function, obtain the anomaly score for each sensor data point based on its path length. Generally, anomalous sensor data points have shorter path lengths in the isolated tree and thus higher anomaly scores.

[0146] If the anomaly score of a sensor data point exceeds a preset anomaly score threshold, the system determines that there is an anomaly at the monitoring location corresponding to that sensor data point, and uses this determination as the environmental anomaly location identification result. For example, if the anomaly score of sensor data points in a warehouse area is high, the system determines that there may be an anomaly in that warehouse area.

[0147] To improve the speed of anomaly detection and accurately determine the nature and severity of anomalies, a high degree of automation in data collection, analysis, and early warning processes has been achieved, reducing manual intervention. Based on the aforementioned embodiments, in this embodiment of the invention, the anomaly identification is performed using a local anomaly factor algorithm of an environmental monitoring model, based on environmental anomaly prediction results and sensor data, to obtain environmental anomaly detection results, including:

[0148] Based on environmental anomaly prediction results and sensor data, a dataset is constructed. The dataset contains multiple data points. Each data point contains a detection location and the corresponding detection data. The detection data is the predicted value in the environmental anomaly prediction results or the observed value in the sensor data.

[0149] Based on the distance between any two data points, the reachable distance between any two data points is obtained using the reachable distance calculation function;

[0150] Based on the reachability distance between every two data points, the local reachability density of each data point is obtained using the local reachability density calculation function;

[0151] Based on the local reachability density of each data point, the local anomaly factor of each data point is obtained using the local anomaly factor calculation function.

[0152] Based on the local anomaly factor of each data point and the preset local anomaly factor threshold, the environmental anomaly detection results are obtained;

[0153] The reachability distance between any two data points is calculated using the following formula:

[0154]

[0155] in, Let represent the reachable distance between data point p and data point o, k_distance(o) represent the distance from data point o to its kth nearest neighbor, and d(p,o) represent the distance between data point p and data point o.

[0156] The local reachability density of each data point is achieved by the following formula:

[0157]

[0158] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o). This represents the reachable distance between data point p and data point o;

[0159] The local outlier factor for each data point is achieved using the following formula:

[0160]

[0161] Among them, LOF k (p) represents the local outlier of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachability density of data point o, lrd k (p) represents the local reachability density of data point p.

[0162] In this invention, the local anomaly factor algorithm consists of multiple functions, including but not limited to: a reachability distance calculation function, a local reachability density calculation function, and a local anomaly factor calculation function. The reachability distance calculation function calculates the reachability distance between two data points, taking into account the local density around the data point; data points that are closer together and have higher local density have smaller reachability distances. The local reachability density calculation function calculates the local reachability density of a data point, reflecting the density of the data point in its neighborhood; the lower the local reachability density, the more likely the data point is to be an anomaly. The local anomaly factor calculation function calculates the local anomaly factor for each data point, reflecting the probability that the data point is an anomaly; the larger the local anomaly factor, the higher the probability that the corresponding data point is an anomaly.

[0163] Specifically, the electronic device constructs a dataset based on the environmental anomaly prediction results and sensor data. The dataset contains multiple data points, and each data point contains a detection location and corresponding detection data. The detection data is the predicted value in the environmental anomaly prediction results or the observed value in the sensor data.

[0164] The electronic device substitutes the distance between every two data points into the reachability distance calculation function to calculate the reachability distance between each two data points; it then substitutes the reachability distance between each two data points into the local reachability density calculation function to calculate the local reachability density of each data point; finally, it substitutes the local reachability density of each data point into the local anomaly factor calculation function to calculate the local anomaly factor of each data point. When the local anomaly factor of a data point exceeds a preset local anomaly factor threshold, the electronic device determines that there is an anomaly at the detection location corresponding to that data point and uses the determination result as the environmental anomaly detection result.

[0165] For example, the reachability distance between any two data points is calculated using the following formula:

[0166]

[0167] in, Let represent the reachability distance between data point p and data point o, k_distance(o) represent the distance from data point o to its k-th nearest neighbor, and d(p,o) represent the distance between data point p and data point o. This distance between data point p and data point o can be calculated using the Euclidean distance algorithm.

[0168] For example, the local reachability density of each data point is achieved using the following formula:

[0169]

[0170] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o). This represents the reachable distance between data point p and data point o.

[0171] For example, the local outlier factor for each data point is achieved using the following formula:

[0172]

[0173] Among them, LOF k (p) represents the local outlier of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachability density of data point o, lrd k (p) represents the local reachability density of data point p.

[0174] To improve the speed of anomaly detection and accurately determine the nature and severity of anomalies, a high degree of automation in data collection, analysis, and early warning processes has been achieved, reducing manual intervention. Based on the above embodiments, in this embodiment of the invention, the robot data from security monitoring data is used to perform anomaly identification using an inspection monitoring model. The anomaly identification results include:

[0175] Using the encoder of the inspection and monitoring model, image data in the robot data is compressed to obtain image features;

[0176] The image features are reconstructed using the decoder of the inspection and monitoring model to obtain reconstructed image data;

[0177] Using the reconstruction error calculation function in the output layer of the inspection and monitoring model, the error is calculated on the image data and reconstructed image data in the robot data to obtain the reconstruction error.

[0178] Based on the reconstruction error and the preset error threshold, the inspection anomaly identification results are obtained;

[0179] The reconstruction error is achieved through the following formula:

[0180]

[0181] Among them, L recon The value represents the reconstruction error, where n represents the number of image data points contained in the robot data, and x represents the reconstruction error. i This represents the i-th image data. This represents the reconstructed image data corresponding to the i-th image data.

[0182] In the security management process of a smart community and park, in order to achieve anomaly identification of image data during the inspection process, the inspection monitoring model adopts an encoder + decoder structure.

[0183] Specifically, the inspection robot captures a large number of images during its inspection process, including equipment appearance, passageway conditions, and personnel activities. After acquiring the robot data, the electronic equipment inputs it into the inspection monitoring model. The encoder of this model can employ a Convolutional Neural Network (CNN) structure to perform convolution and pooling operations on the image data in the input robot data, compressing the images and extracting high-level image features. For example, the encoder uses multiple convolutional layers to progressively extract features such as edges, textures, and shapes from the image, compressing the image data from the robot data into a low-dimensional image feature set.

[0184] The decoder employs a deconvolutional neural network (DeCNN) structure to perform deconvolution and upsampling operations on the image features output by the encoder, reconstructing the image features into reconstructed image data of the same size as the image data in the robot data. During the reconstruction process, the decoder learns how to recover the detailed information of the image data in the robot data from the image features.

[0185] Next, the reconstruction error calculation function in the output layer of the inspection and monitoring model is used to calculate the error between the image data and the reconstructed image data in the robot data. When the calculated reconstruction error exceeds a preset error threshold, the inspection and monitoring model determines that the image data is abnormal and outputs the determination result as the inspection anomaly identification result. For example, if the reconstruction error of an image is large, it may indicate that there are problems such as equipment damage, abnormal personnel behavior, or environmental anomalies in the image.

[0186] For example, the reconstruction error is achieved using the following formula:

[0187]

[0188] Among them, L recon The value represents the reconstruction error, where n represents the number of image data points contained in the robot data, and x represents the reconstruction error. i This represents the i-th image data. This represents the reconstructed image data corresponding to the i-th image data.

[0189] To improve the speed of anomaly detection and accurately determine the nature and severity of anomalies, and to achieve a high degree of automation in the data collection, analysis, and early warning process, reducing manual intervention, based on the above embodiments, in this embodiment of the invention, the spatiotemporal correlation analysis is performed using a spatiotemporal correlation analysis model based on the anomaly identification results. The spatiotemporal correlation analysis results include:

[0190] Based on the environmental anomaly time in the environmental anomaly identification results and the inspection anomaly time in the inspection anomaly identification results, time correlation analysis is performed using a time correlation function to obtain the time correlation analysis results.

[0191] Based on the locations of environmental anomalies in the environmental anomaly identification results and the locations of inspection anomalies in the inspection anomaly identification results, spatial correlation analysis is performed using spatial correlation functions to obtain spatial correlation analysis results.

[0192] Based on the results of time correlation analysis and spatial correlation analysis, a comprehensive correlation analysis is performed using a time-space comprehensive scoring function to obtain a comprehensive correlation score;

[0193] Based on the comprehensive correlation score and the preset score threshold, the spatiotemporal correlation analysis results are obtained;

[0194] The time correlation analysis results are achieved using the following formula:

[0195] Δt ij =|t i -t j |;

[0196] Among them, t i t represents the time of environmental anomalies. j Indicates the time of abnormal inspection, Δt ij This indicates the results of the time correlation analysis;

[0197] Spatial correlation analysis results are achieved through the following formula:

[0198] Δl ij =Distance(l i ,l j );

[0199] Among them, l i Indicates the location of an environmental anomaly, l j This indicates the location of the inspection anomaly, where Distance is calculated using the Euclidean distance algorithm, and ΔI is the distance between the inspected locations. ij This indicates the results of the spatial correlation analysis;

[0200] The comprehensive correlation score is achieved using the following formula:

[0201]

[0202] Among them, S ij Indicates the overall correlation score, w t For the preset time-related weights, Δt ij This represents the result of the time correlation analysis, σ. t This represents the preset time-correlated Gaussian kernel width parameter, w. l For the preset spatial correlation weight, Δl ij This represents the spatial correlation analysis result, σ. l This represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0203] In the security management of smart communities and parks, in order to accurately determine whether there are any anomalies in the target area, this invention uses a spatiotemporal correlation analysis model to perform correlation analysis on the environmental anomaly identification results and the inspection anomaly identification results.

[0204] Specifically, based on the time of environmental anomalies and the time of inspection anomalies, a time correlation function is used to analyze the time correlation, yielding the time correlation analysis results. Then, based on the locations of environmental anomalies and inspection anomalies, a spatial correlation function is used to analyze the spatial correlation, yielding the spatial correlation analysis results. Finally, the time correlation analysis results and the spatial correlation analysis results are combined, and a comprehensive scoring function is used to obtain a comprehensive correlation score. If this comprehensive correlation score exceeds a preset scoring threshold, an anomaly is determined to exist at the target location.

[0205] For example, suppose that within a certain period, the electronic equipment system obtains multiple anomaly identification results through environmental monitoring models and inspection monitoring models. The environmental anomaly identification results include the time and location of the environmental anomaly. For instance, a temperature anomaly is detected in a computer room area, with the anomaly time being 14:00 on October 10, 2023, and the anomaly location being computer room A. The inspection anomaly identification results include the inspection anomaly time and location. For instance, the inspection robot captures an image of equipment malfunctioning in computer room A at 14:10 on October 10, 2023, identifying it as an inspection anomaly, with the anomaly location also being computer room A.

[0206] First, based on the environmental anomaly time and the inspection anomaly time, a time correlation analysis is performed using a time correlation function. If the time correlation analysis results of the two anomalies are less than the preset time correlation threshold (e.g., 30 minutes), it indicates that the environmental anomaly and the inspection anomaly are relatively close in time.

[0207] Then, based on the locations of environmental anomalies and inspection anomalies, spatial correlation analysis is performed using a spatial correlation function. Since both anomalies are located in computer room A, the spatial correlation analysis result is less than the preset spatial correlation threshold (e.g., 100 meters), indicating that the environmental anomalies and inspection anomalies are located in the same spatial area.

[0208] Next, based on the results of temporal and spatial correlation analysis, a comprehensive correlation analysis is performed using a time-space integrated scoring function. Assuming the preset temporal correlation weight is 0.6, the temporal correlation Gaussian kernel width parameter is 15 minutes, the spatial correlation weight is 0.4, and the spatial correlation Gaussian kernel width parameter is 50 meters, the comprehensive correlation score is 0.57.

[0209] Finally, the comprehensive correlation score of 0.57 is compared with the preset score threshold (e.g., 0.5). Since 0.57 > 0.5, it is determined that the target area (computer room A) is abnormal, and a security warning report is generated.

[0210] For example, the result of time correlation analysis is the time difference, which is achieved through the following formula:

[0211] Δt ij =|t i -tj |;

[0212] Among them, t i t represents the time of environmental anomalies. j Indicates the time of abnormal inspection, Δt ij This indicates the results of the time correlation analysis;

[0213] For example, the spatial association analysis result is spatial distance, which is achieved using the following formula:

[0214] Δl ij =Distance(l i ,l j );

[0215] Among them, l i Indicates the location of an environmental anomaly, l j This indicates the location of the inspection anomaly, where Distance is calculated using the Euclidean distance algorithm, and ΔI is the distance between the inspected locations. ij This indicates the results of the spatial correlation analysis;

[0216] For example, the comprehensive correlation score is achieved using the following formula:

[0217]

[0218] Among them, S ij Indicates the overall correlation score, w t For the preset time-related weights, Δt ij This represents the result of the time correlation analysis, σ. t This represents the preset time-correlated Gaussian kernel width parameter, w. l For the preset spatial correlation weight, Δl ij This represents the spatial correlation analysis result, σ. l This represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0219] To improve the speed of anomaly detection and accurately determine the nature and severity of anomalies, and to achieve a high degree of automation in the data collection, analysis, and early warning process, reducing manual intervention, in this embodiment of the invention, after generating the security early warning report for smart communities and parks, the method further includes:

[0220] Acquire access control images of smart communities and parks, which contain images of people or vehicles;

[0221] Based on the access control image, an access control recognition model is used to identify the target access object;

[0222] The system matches the target access object against a preset whitelist. If a match is found, the access control is opened, and the access time of the target access object is recorded.

[0223] In smart communities and industrial parks, access control modules collect images from deployed cameras. These modules include facial recognition and vehicle motion recognition modules. The facial recognition module captures images of people through the camera, while the vehicle motion recognition module captures images of vehicles through the camera. In other words, the access control images captured by the access control module contain either people or vehicles.

[0224] The electronic device uses an access control image and an access control recognition model to identify the target access object and matches it with a preset whitelist. If a match is successful, the access control is opened, and the access time of the target access object is recorded. The access control recognition model is a combination of a face recognition model and a vehicle recognition model.

[0225] Specifically, if the access control image contains a person, the facial recognition model within the access control system is used to perform facial recognition on the image to identify the target person. For example, when an employee enters the park, the camera captures their facial image. The system extracts facial features using the facial recognition model and compares them with a pre-defined personnel whitelist. If the facial recognition access control module determines that the identified person is on the whitelist, it will automatically open the access control and record the person's entry and exit time.

[0226] For example, if employee A enters the park at 8:00 AM, the facial recognition access control module will automatically open the door after recognizing their identity and record their entry time. When employee A leaves the park at 6:00 PM, the facial recognition access control module will again recognize them and record their departure time. If the facial recognition access control module determines that the identified person is not on the whitelist, it will generate an exception message and alert security management personnel to conduct an investigation.

[0227] If the access control image contains a vehicle, the vehicle recognition model within the access control recognition model is used to identify the vehicle in the image and determine the target access object. For example, when an authorized delivery vehicle enters the community, the camera captures its license plate image. The vehicle dynamic recognition module extracts the license plate information using the vehicle recognition model and compares it with a preset vehicle whitelist. If the vehicle dynamic recognition module determines that the identified vehicle is on the whitelist, it will automatically control the access control to open and record the vehicle's entry and exit times.

[0228] For example, delivery vehicle B enters the community at 10:00 AM. The vehicle dynamic recognition module identifies its license plate, automatically opens the gate, and records its entry time. When vehicle B leaves the community at 11:00 AM, the vehicle dynamic recognition module identifies it again and records its departure time. If the vehicle dynamic recognition module determines that the identified vehicle is not on the whitelist, it will generate an exception message and alert security management personnel to conduct an inspection.

[0229] The present invention will now be described with reference to a specific embodiment, which includes the following steps:

[0230] (1) Obtain security monitoring data for smart communities and parks.

[0231] (2) Using the isolated forest model of the environmental monitoring model, the sensor data in the security monitoring data is used to identify the location of environmental anomalies and obtain the results of the identification of environmental anomalies.

[0232] (3) Using the LSTM model of the environmental monitoring model, environmental anomaly prediction is performed on the sensor data to obtain the environmental anomaly prediction results.

[0233] (4) Based on the environmental anomaly prediction results and sensor data, the local anomaly factor algorithm of the environmental monitoring model is used to identify anomalies and obtain environmental anomaly detection results.

[0234] (5) Based on the results of environmental anomaly location identification and environmental anomaly detection, the results of environmental anomaly identification are obtained.

[0235] (6) Based on the robot data in the security monitoring data, the inspection monitoring model is used to identify inspection anomalies and obtain the inspection anomaly identification results.

[0236] (7) Based on the anomaly identification results, spatiotemporal correlation analysis is performed using a spatiotemporal correlation analysis model to obtain the spatiotemporal correlation analysis results.

[0237] (8) If the spatiotemporal correlation analysis results indicate that an anomaly has occurred in the target area, a security early warning report for the smart community and park will be generated.

[0238] This invention can collect security monitoring data in smart communities and parks in real time. By comprehensively using multiple models for anomaly identification and spatiotemporal correlation analysis, it can comprehensively and accurately discover security risks in smart communities and parks, generate security early warning reports in a timely manner, provide decision-making basis for managers, effectively improve the efficiency and accuracy of security management, and ensure the safety of communities and parks.

[0239] This invention relates to an integrated security management system and method for smart communities and industrial parks. By constructing a unified data management platform, it achieves interconnectivity and centralized management of security equipment within the community and industrial park. The system includes a facial recognition access control module, a vehicle dynamic recognition module, an environmental anomaly detection module, and an intelligent security patrol module. Based on edge computing and artificial intelligence technologies, the system can process massive amounts of data in real time and generate security early warning reports. This system provides a cross-regional, multi-functional security solution, widely applicable to the intelligent management needs of modern communities and industrial parks, improving regional security efficiency and service experience.

[0240] Example 2:

[0241] Based on the same inventive concept, this invention also provides a security management system, the structural diagram of which is shown below. Figure 2 As shown, it includes:

[0242] Module 201 is used to acquire security monitoring data within the smart community and park.

[0243] Anomaly identification module 202 is used to identify anomalies based on security monitoring data, using environmental monitoring models and inspection monitoring models, and to obtain anomaly identification results.

[0244] The spatiotemporal correlation analysis module 203 is used to perform spatiotemporal correlation analysis based on the anomaly identification results and using the spatiotemporal correlation analysis model to obtain the spatiotemporal correlation analysis results.

[0245] The early warning module 204 is used to generate a security early warning report for smart communities and parks if the spatiotemporal correlation analysis results indicate that an anomaly has occurred in the target area.

[0246] The environmental monitoring model integrates the isolated forest model, the long short-term memory network (LSTM) model, and the local anomaly factor algorithm.

[0247] In one specific implementation, the anomaly identification module 202 is specifically used to identify environmental anomalies based on sensor data in the security monitoring data and an environmental monitoring model to obtain environmental anomaly identification results; and to identify inspection anomalies based on robot data in the security monitoring data and an inspection monitoring model to obtain inspection anomaly identification results.

[0248] In one specific implementation, the anomaly identification module 202 is specifically used to identify the location of environmental anomalies in the sensor data of the security monitoring data using the isolated forest model of the environmental monitoring model, and obtain the environmental anomaly location identification result; to predict environmental anomalies in the sensor data using the LSTM model of the environmental monitoring model, and obtain the environmental anomaly prediction result; based on the environmental anomaly prediction result and the sensor data, to identify anomalies using the local anomaly factor algorithm of the environmental monitoring model, and obtain the environmental anomaly detection result; and based on the environmental anomaly location identification result and the environmental anomaly detection result, to obtain the environmental anomaly identification result.

[0249] In one specific implementation, the anomaly identification module 202 is specifically used to construct a data space based on sensor data in security monitoring data. The data space includes multiple sensor data points, and each sensor data point contains a detection location and corresponding sensor data. Based on randomly selected features and segmentation values, the data space is segmented to obtain multiple isolated trees. Based on each sensor data point, according to the path length of the sensor data point in each isolated tree, an anomaly score is obtained using an anomaly score calculation function. Based on the anomaly score of each sensor data point and a preset anomaly score threshold, the environmental anomaly location identification result is obtained.

[0250] In one specific implementation, the anomaly identification module 202 is specifically used to construct a dataset based on environmental anomaly prediction results and sensor data. The dataset contains multiple data points, and each data point contains a detection location and corresponding detection data. The detection data is the predicted value in the environmental anomaly prediction results or the observed value in the sensor data. Based on the distance between every two data points, the reachable distance between every two data points is obtained using a reachable distance calculation function. Based on the reachable distance between every two data points, the local reachability density of each data point is obtained using a local reachability density calculation function. Based on the local reachability density of each data point, the local anomaly factor of each data point is obtained using a local anomaly factor calculation function. Based on the local anomaly factor of each data point and a preset local anomaly factor threshold, the environmental anomaly detection result is obtained.

[0251] The reachability distance between any two data points is calculated using the following formula:

[0252]

[0253] in, Let represent the reachable distance between data point p and data point o, k_distance(o) represent the distance from data point o to its kth nearest neighbor, and d(p,o) represent the distance between data point p and data point o.

[0254] The local reachability density of each data point is achieved by the following formula:

[0255]

[0256] Among them, lrd k (p) represents the local reachability density of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o). This represents the reachable distance between data point p and data point o;

[0257] The local outlier factor for each data point is achieved using the following formula:

[0258]

[0259] Among them, LOF k (p) represents the local outlier of data point p, N k (p) is the set of all points whose distance from data point p does not exceed k_distance(o), lrd k (o) represents the local reachability density of data point o, lrd k (p) represents the local reachability density of data point p.

[0260] In one specific implementation, the anomaly identification module 202 is specifically used to compress the image data in the robot data using the encoder of the inspection and monitoring model to obtain image features; to reconstruct the image features using the decoder of the inspection and monitoring model to obtain reconstructed image data; to calculate the error between the image data in the robot data and the reconstructed image data using the reconstruction error calculation function in the output layer of the inspection and monitoring model to obtain the reconstruction error; and to obtain the inspection anomaly identification result based on the reconstruction error and a preset error threshold.

[0261] The reconstruction error is achieved through the following formula:

[0262]

[0263] Among them, L recon The value represents the reconstruction error, where n represents the number of image data points contained in the robot data, and x represents the reconstruction error. i This represents the i-th image data. This represents the reconstructed image data corresponding to the i-th image data.

[0264] In one specific implementation, the spatiotemporal correlation analysis module 203 is specifically used to perform time correlation analysis using a time correlation function based on the environmental anomaly time in the environmental anomaly identification results and the inspection anomaly time in the inspection anomaly identification results, to obtain time correlation analysis results; based on the environmental anomaly location in the environmental anomaly identification results and the inspection anomaly location in the inspection anomaly identification results, to perform spatial correlation analysis using a spatial correlation function, to obtain spatial correlation analysis results; based on the time correlation analysis results and the spatial correlation analysis results, to perform comprehensive correlation analysis using a time-space comprehensive scoring function, to obtain a comprehensive correlation score; and based on the comprehensive correlation score and a preset scoring threshold, to obtain the spatiotemporal correlation analysis results.

[0265] The time correlation analysis results are achieved using the following formula:

[0266] Δt ij =|t i -t j |;

[0267] Among them, t i t represents the time of environmental anomalies. j Indicates the time of abnormal inspection, Δt ij This indicates the results of the time correlation analysis;

[0268] Spatial correlation analysis results are achieved through the following formula:

[0269] Δl ij =Distance(l i ,l j );

[0270] Among them, l i Indicates the location of an environmental anomaly, l j This indicates the location of the inspection anomaly, where Distance is calculated using the Euclidean distance algorithm, and ΔI is the distance between the inspected locations. ij This indicates the results of the spatial correlation analysis;

[0271] The comprehensive correlation score is achieved using the following formula:

[0272]

[0273] Among them, S ij Indicates the overall correlation score, w t For the preset time-related weights, Δt ij This represents the result of the time correlation analysis, σ. t This represents the preset time-correlated Gaussian kernel width parameter, w. l For the preset spatial correlation weight, Δl ij This represents the spatial correlation analysis result, σ. lThis represents the preset spatial correlation Gaussian kernel width parameter, and exp() represents the natural exponential function.

[0274] In one specific implementation, the security management system also includes:

[0275] The access control management module 205 is used to acquire access control images of the smart community and park, which contain people or vehicles; based on the access control images, an access control recognition model is used to identify the target access object; the target access object is matched with a preset whitelist, and if the match is successful, the access control is controlled to open, and the access time of the target access object is recorded.

[0276] Example 3:

[0277] like Figure 3 As shown, the present invention also provides an electronic device, which may be a computer device, a microcontroller device, a smart mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, processor, and transceiver component are connected via a bus; the memory can be used to store executable programs, and an exemplary executable program may include instructions; the processor is used to execute the instructions stored in the memory. The memory can also be used to store data, which can be accessed and / or modified when instructions are executed.

[0278] The processor may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, and it is suitable for implementing one or more instructions. Specifically, it is suitable for loading and executing one or more instructions in the storage medium to implement the corresponding method flow or corresponding function, so as to realize the steps of a security management method in the above embodiments.

[0279] Example 4:

[0280] Based on the same inventive concept, this invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory). An electronic device readable storage medium is a memory device within an electronic device used to store programs and data. It is understood that the storage medium here can include both the built-in storage medium within the electronic device and extended storage media supported by the electronic device. The storage medium provides storage space, which stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more executable programs (including program code). It should be noted that the storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. Loading and executing one or more instructions stored in the storage medium by the processor can implement the steps of a security management method described in the above embodiments.

[0281] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0282] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0283] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0284] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0285] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that after reading the present invention, they can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the scope of protection of the claims pending approval.

Claims

1. A security management method characterized by comprising: include: Obtain security monitoring data from smart communities and industrial parks; Based on the security monitoring data, anomaly identification is performed using an environmental monitoring model and an inspection monitoring model to obtain anomaly identification results. Based on the anomaly identification results, a spatiotemporal correlation analysis model is used to perform spatiotemporal correlation analysis to obtain the spatiotemporal correlation analysis results. If the spatiotemporal correlation analysis results indicate an anomaly in the target area, a security early warning report for the smart community and park will be generated. The environmental monitoring model integrates the isolated forest model, the Long Short-Term Memory (LSTM) network model, and the local anomaly factor algorithm. Based on the security monitoring data, anomaly identification is performed using an environmental monitoring model and an inspection monitoring model, and the anomaly identification results include: Using the isolated forest model of the environmental monitoring model, the sensor data in the security monitoring data is used to identify the location of environmental anomalies, and the results of the environmental anomaly location identification are obtained. Using the LSTM model of the environmental monitoring model, environmental anomaly prediction is performed on the sensor data to obtain the environmental anomaly prediction result. Based on the environmental anomaly prediction results and the sensor data, a dataset is constructed. The dataset contains multiple data points, and each data point contains a detection location and corresponding detection data. The detection data is the predicted value in the environmental anomaly prediction results or the observed value in the sensor data. Based on the distance between any two data points, the reachable distance between any two data points is obtained using the reachable distance calculation function; Based on the reachability distance between every two data points, the local reachability density of each data point is obtained using the local reachability density calculation function; Based on the local reachability density of each data point, the local anomaly factor of each data point is obtained using the local anomaly factor calculation function. The environmental anomaly detection result is obtained based on the local anomaly factor and the preset local anomaly factor threshold for each data point; Based on the environmental anomaly location identification result and the environmental anomaly detection result, the environmental anomaly identification result is obtained; Based on the robot data in the security monitoring data, an inspection monitoring model is used to identify inspection anomalies and obtain inspection anomaly identification results. Based on the anomaly identification results, spatiotemporal correlation analysis is performed using a spatiotemporal correlation analysis model to obtain the spatiotemporal correlation analysis results, including: Based on the environmental anomaly time in the environmental anomaly identification result and the inspection anomaly time in the inspection anomaly identification result, time correlation analysis is performed using a time correlation function to obtain the time correlation analysis result. Based on the environmental anomaly location in the environmental anomaly identification result and the inspection anomaly location in the inspection anomaly identification result, spatial correlation analysis is performed using a spatial correlation function to obtain the spatial correlation analysis result. Based on the time correlation analysis results and the spatial correlation analysis results, a comprehensive correlation analysis is performed using the time-space comprehensive scoring function to obtain a comprehensive correlation score; The spatiotemporal correlation analysis results are obtained based on the comprehensive correlation score and the preset score threshold.

2. The method of claim 1, wherein, The isolated forest model of the environmental monitoring model is used to identify environmental anomaly locations in the sensor data of the security monitoring data, and the environmental anomaly location identification results include: Based on the sensor data in the security monitoring data, a data space is constructed. The data space includes multiple sensor data points, and each sensor data point contains a detection location and the corresponding sensor data. Based on randomly selected features and segmentation values, the data space is segmented to obtain multiple isolated trees; Based on each sensor data point, and according to the path length of the sensor data point in each isolated tree, the anomaly score of each sensor data point is obtained using an anomaly score calculation function; Based on the anomaly score of each sensor data point and the preset anomaly score threshold, the environmental anomaly location identification result is obtained.

3. The method as described in claim 1 or 2, characterized in that, The reachability distance between every two data points is achieved by the following formula: ； wherein, denotes the reachable distance of data point p and data point o, denotes the distance of data point o to the kth nearest neighbor, denotes the distance between data point p and data point o; The local reachability density of each data point is achieved by the following formula: ； wherein, represents the local reachable density of data point p, is the set of all points at a distance of from data point p, represents the reachable distance of data point p and data point o; The local anomaly factor for each data point is achieved using the following formula: ； wherein, represents the local outlier factor of data point p, is the set of all distance data points p not more than from data point p, represents the local reachable density of data point o, represents the local reachable density of data point p.

4. The method of claim 1, wherein, The inspection anomaly identification results obtained by using the inspection monitoring model based on the robot data in the security monitoring data include: Using the encoder of the inspection and monitoring model, image data in the robot data is compressed to obtain image features; Using the decoder of the inspection and monitoring model, the image features are reconstructed to obtain reconstructed image data; Using the reconstruction error calculation function in the output layer of the inspection and monitoring model, the image data and the reconstructed image data in the robot data are used to calculate the error and obtain the reconstruction error. Based on the reconstruction error and the preset error threshold, the inspection anomaly identification result is obtained; The reconstruction error is achieved through the following formula: ； wherein, denotes the reconstruction error, denotes a number of image data contained in the robot data, denotes the i-th image data, denotes the reconstruction image data corresponding to the i-th image data.

5. The method of claim 1, wherein, The time correlation analysis results are obtained through the following formula: ； wherein, represents the environment abnormal time, represents the inspection abnormal time, represents the time correlation analysis result; The spatial correlation analysis results are achieved through the following formula: ； wherein, represents the environment abnormal position, represents the inspection abnormal position, is a Euclidean distance algorithm, represents the space correlation analysis result; The comprehensive correlation score is achieved using the following formula: ； in, This indicates the comprehensive correlation score. For the preset time-related weights, This indicates the results of the time correlation analysis. This indicates the preset time-correlated Gaussian kernel width parameter. For the preset spatial association weights, This indicates the spatial correlation analysis results. This represents the preset spatial correlation Gaussian kernel width parameter. This represents the natural exponential function.

6. The method as described in claim 1, characterized in that, After generating the security early warning report for the smart community and park, the method further includes: Acquire access control images of the smart community and park, wherein the access control images contain people or vehicles; Based on the access control image, an access control recognition model is used to identify the target access object; The target access object is matched with a preset whitelist. If the match is successful, the access control is opened and the access time of the target access object is recorded.

7. A security management system, characterized in that, include: The acquisition module is used to acquire security monitoring data within smart communities and parks; Anomaly identification module is used to identify anomalies based on the security monitoring data, using an environmental monitoring model and an inspection monitoring model, and to obtain anomaly identification results. The spatiotemporal correlation analysis module is used to perform spatiotemporal correlation analysis based on the anomaly identification results using a spatiotemporal correlation analysis model, and obtain the spatiotemporal correlation analysis results. The early warning module is used to generate a security early warning report for smart communities and parks if the spatiotemporal correlation analysis results indicate that an anomaly has occurred in the target area. The environmental monitoring model integrates the isolated forest model, the long short-term memory network (LSTM) model, and the local anomaly factor algorithm. The anomaly identification module is specifically used to identify environmental anomaly locations in the sensor data of the security monitoring data using the isolated forest model of the environmental monitoring model, and obtain environmental anomaly location identification results; to predict environmental anomalies in the sensor data using the LSTM model of the environmental monitoring model, and obtain environmental anomaly prediction results; to construct a dataset based on the environmental anomaly prediction results and the sensor data, the dataset containing multiple data points, each data point containing a detection location and corresponding detection data, the detection data being either the predicted value in the environmental anomaly prediction results or the observed value in the sensor data; and to determine the reachability distance based on the distance between every two data points. The system calculates the reachability distance between every two data points using a distance calculation function; based on the reachability distance between every two data points, it calculates the local reachability density of each data point using a local reachability density calculation function; based on the local reachability density of each data point, it calculates the local anomaly factor of each data point using a local anomaly factor calculation function; based on the local anomaly factor of each data point and a preset local anomaly factor threshold, it obtains the environmental anomaly detection result; based on the environmental anomaly location identification result and the environmental anomaly detection result, it obtains the environmental anomaly identification result; based on the robot data in the security monitoring data, it uses an inspection monitoring model to identify inspection anomalies and obtains the inspection anomaly identification result. The spatiotemporal correlation analysis module is specifically used to perform time correlation analysis using a time correlation function based on the environmental anomaly time in the environmental anomaly identification result and the inspection anomaly time in the inspection anomaly identification result, to obtain a time correlation analysis result; to perform spatial correlation analysis using a spatial correlation function based on the environmental anomaly location in the environmental anomaly identification result and the inspection anomaly location in the inspection anomaly identification result, to obtain a spatial correlation analysis result; to perform comprehensive correlation analysis using a time-space comprehensive scoring function based on the time correlation analysis result and the spatial correlation analysis result, to obtain a comprehensive correlation score; and to obtain the spatiotemporal correlation analysis result based on the comprehensive correlation score and a preset scoring threshold.

8. An electronic device, characterized in that, include: At least one processor and memory; The memory and the at least one processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the integrated security management method for smart communities and parks as described in any one of claims 1-6 is implemented.

Images