Abnormality detection method, device and computer program product

Abstract

The embodiment of the invention provides an anomaly detection method and device and a computer program product, and is applied to the technical field of artificial intelligence. The method comprises the following steps: acquiring acquisition information sent by a plurality of acquisition devices deployed at different positions of a network in real time, wherein the acquisition devices are used for carrying out video shooting and audio acquisition on vehicles, personnel and money boxes in an anomaly detection process; determining a current execution stage and a detection mode corresponding to the current execution stage; the detection mode of each execution stage is determined by a configuration file corresponding to the website; the collected information is detected according to the detection mode, and if it is detected that the current execution stage is abnormal, alarm information corresponding to the current execution stage is output; and if it is detected that the current execution stage is successfully executed, skipping to the detection of the next execution stage until the exception detection process is completed. Therefore, automatic real-time detection of abnormal conditions is realized, the abnormal detection efficiency, accuracy and real-time performance are improved, and the safety risk is reduced.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an anomaly detection method, device, and computer program product. Background Art

[0002] With the continuous development of technologies such as the Internet and artificial intelligence, the digital transformation of various fields such as finance continues to deepen.

[0003] In related technologies, the cash management services of banks and other financial institutions, such as cash handovers through armored vehicles, usually rely on manual operations and manual risk verification. However, manual risk verification is inefficient and inaccurate. At the same time, manual verification is not real-time and there is a certain information lag, which leads to certain security risks in cash management services. Summary of the Invention

[0004] The embodiments of the present application provide an anomaly detection method, device, and computer program product that can automatically detect anomalies in cash management services, improve the efficiency and accuracy of anomaly detection, and at the same time provide higher real-time performance and reduce security risks.

[0005] In a first aspect, an embodiment of the present application provides an anomaly detection method, comprising:

[0006] Real-time acquisition of data from multiple collection devices deployed at different locations of the network. The collection devices are used to capture video and audio of vehicles, personnel, and cash boxes during anomaly detection.

[0007] Determining a current execution stage and a detection mode corresponding to the current execution stage; wherein the abnormality detection process corresponding to the network point includes multiple execution stages, and the detection mode of each execution stage is determined by a configuration file corresponding to the network point, and the detection mode of each execution stage is used to indicate: a detection object and a determination method corresponding to the execution stage, the detection object being at least one of a vehicle, a person, and a cash box, and the determination method being used to determine whether an abnormality exists in the execution stage and / or whether the execution stage has been successfully completed;

[0008] Detecting the collected information according to the detection mode, and if an abnormality is detected in the current execution stage, outputting alarm information corresponding to the current execution stage;

[0009] If it is detected that the current execution phase is successfully completed, the process jumps to the detection of the next execution phase until the abnormality detection process is completed.

[0010] In a second aspect, an embodiment of the present application provides an anomaly detection device, comprising:

[0011] An acquisition module, used to acquire, in real time, collected information sent by multiple collection devices deployed at different locations of the network. The collection devices are used to capture video and audio of vehicles, personnel, and cash boxes during the anomaly detection process;

[0012] a determination module, configured to determine a current execution stage and a detection mode corresponding to the current execution stage; wherein the abnormality detection process corresponding to the network point includes multiple execution stages, and the detection mode of each execution stage is determined by a configuration file corresponding to the network point, and the detection mode of each execution stage is used to indicate: a detection object and a determination method corresponding to the execution stage, wherein the detection object is at least one of a vehicle, a person, and a cash box, and the determination method is used to determine whether an abnormality exists in the execution stage and / or whether the execution stage has been successfully completed;

[0013] an output module, configured to detect the collected information according to the detection mode, and output alarm information corresponding to the current execution stage if an abnormality is detected in the current execution stage;

[0014] The jump module is used to jump to the detection of the next execution stage if it is detected that the current execution stage is successfully completed, until the abnormality detection process is completed.

[0015] In a third aspect, an embodiment of the present application provides an anomaly detection device, comprising: a memory, a processor;

[0016] The memory stores computer-executable instructions;

[0017] The processor executes the computer-executable instructions stored in the memory, so that the processor performs the anomaly detection method as described in any one of the first aspects above.

[0018] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the anomaly detection method as described in any one of the first aspects above.

[0019] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the anomaly detection method as described in any one of the first aspects above.

[0020] The anomaly detection method, device and computer program product provided in the embodiments of the present application obtain in real time the collection information sent by multiple collection devices deployed at different locations of the network point, and the collection devices are used to perform video shooting and audio collection of vehicles, personnel and cash boxes during the anomaly detection process; determine the current execution stage and the detection mode corresponding to the current execution stage; wherein the anomaly detection process corresponding to the network point includes multiple execution stages, and the detection mode of each execution stage is determined by the configuration file corresponding to the network point, and the detection mode of each execution stage is used to indicate: the detection object and judgment method corresponding to the execution stage, the detection object is at least one of the vehicle, personnel and cash box, and the judgment method is used to determine whether there is an anomaly in the execution stage and / or whether the execution stage is successfully executed; the collection information is detected according to the detection mode, and if an anomaly is detected in the current execution stage, an alarm information corresponding to the current execution stage is output; if it is detected that the current execution stage is successfully executed, the detection of the next execution stage is jumped to until the anomaly detection process is completed. In this application, the electronic device can, based on the actual situation of the outlets, obtain collected information and perform anomaly detection in accordance with the corresponding detection mode at different execution stages. When an anomaly occurs in the current execution stage, it can output alarm information in real time, thereby realizing automatic real-time detection of abnormal situations in the cash management business process, which can improve the efficiency and accuracy of anomaly detection in the cash management business. At the same time, the real-time performance of anomaly detection is higher, reducing the security risks in the cash management business. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0022] Figure 1 Schematic diagram of the application scenario provided for this application;

[0023] Figure 2 A flowchart of an anomaly detection method provided in this application;

[0024] Figure 3 A schematic diagram of a process for determining detection modes at different execution stages provided by this application;

[0025] Figure 4 A schematic diagram of a process for determining a configuration file provided for this application;

[0026] Figure 5 A schematic diagram of the process of anomaly detection in the current execution phase provided by this application;

[0027] Figure 6 A schematic diagram of the execution logic of an anomaly detection system provided in this application;

[0028] Figure 7A schematic diagram of the structure of an anomaly detection device provided in this application;

[0029] Figure 8 A schematic diagram of the structure of an anomaly detection device provided in this application.

[0030] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0031] To enable those skilled in the art to better understand the technical solution of the present application, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are only used to explain the present application and are not intended to limit the present application.

[0032] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0033] In addition, this application involves artificial intelligence analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and the use of artificial intelligence technology for automated decision-making, and a technical solution for making decisions that have a significant impact on personal rights and interests based on the results of automated decision-making. The application provides users with corresponding operation entrances for users to choose to agree or reject the results of automated decision-making; if the user chooses to reject, the expert decision-making process will be entered.

[0034] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned. They should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0035] It should be noted that the anomaly detection method, device, and computer program product of the present application can be used in the field of artificial intelligence technology, and can also be used in any field other than the field of artificial intelligence technology. The present application does not limit the specific application field of the anomaly detection method, device, and computer program product. The anomaly detection method, device, and computer program product of the present application mainly involve machine learning, deep learning, neural networks, pattern recognition, pattern classification, pattern clustering, signal pattern recognition, object recognition, and object recognition based on audio and video streams. Of course, other artificial intelligence technologies can also be used, and the embodiments of the present application do not limit this.

[0036] In related technologies, cash management businesses such as cash handover usually rely on manual operation and manual verification, which lead to problems such as irregular operation and cash security risks. Manual verification is inefficient and has a high error rate. In addition, manual verification is not real-time and there is information lag. Security risks such as irregular behavior during manual operation cannot be warned in real time, resulting in a lack of systematic security protection for cash management businesses such as cash handover, which leads to certain security risks in cash management businesses.

[0037] In order to solve the above problems, the present application provides an anomaly detection method, device and computer program product. The electronic device acquires the collected information sent by multiple collection devices deployed at different locations of the outlets in real time, and then determines the detection mode corresponding to the current execution stage in each execution stage of the cash management business. The detection mode can be determined according to the configuration file of the actual outlet, and is used to indicate the detection object and judgment method corresponding to each execution stage; thereafter, the electronic device can detect the collected information according to the detection mode. If there is an anomaly in the current execution stage, the alarm information corresponding to the current execution stage is output. If it is detected that the current execution stage is successfully executed, it jumps to the anomaly detection of the next execution stage until the entire anomaly detection process is completed. In this way, the electronic device performs anomaly detection on each execution stage of the cash management business according to the detection mode determined by the configuration file in combination with the actual situation of the outlet, which can realize automatic and rapid detection of anomalies in the cash management business process, improve the efficiency and accuracy of anomaly detection, and at the same time have higher real-time performance, reducing the security risks in the cash management business process.

[0038] Figure 1 This is a schematic diagram of the application scenario provided by this application. Figure 1 In the example, a user 101 and an electronic device 102 are included. Figure 1 As shown, in the related art, anomaly detection for cash handover and cash management services usually relies on manual operation and manual verification. This anomaly detection method is not efficient and accurate, and its real-time performance is not high, and there are certain security risks.

[0039] In the embodiment of the present application, the electronic device 102 obtains the collection information sent by the collection device deployed in the branch, and detects the collection information of the current execution stage according to the detection mode of each execution stage. If an abnormality exists, the alarm information corresponding to the current execution stage is output. This can realize the automatic detection of abnormal situations in the cash management business process, improve the efficiency and accuracy of abnormality detection, and also improve the real-time performance of abnormality detection, thereby reducing the security risks in the cash business management process. It should be noted that the application scenario of the present application can be the cash management business of various bank branches, specifically referring to the cash handover scenario, etc. Of course, it can also be applied to other scenarios, and the embodiment of the present application is not limited to this.

[0040] The following is a detailed description of the solutions shown in this application through specific embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be repeated in different embodiments.

[0041] Figure 2 This is a flowchart of an anomaly detection method provided in this application. Figure 2 , the anomaly detection method may include:

[0042] S201. Acquire in real time the collected information sent by multiple collection devices deployed at different locations of the network, where the collection devices are used to capture videos and collect audio of vehicles, personnel, and cash boxes during anomaly detection.

[0043] The execution subject of the embodiments of the present application can be an electronic device, such as a mobile phone, a computer, or a wearable device, or an anomaly detection device provided in the electronic device. The anomaly detection device can be implemented by software or by a combination of software and hardware. For ease of understanding, the following description takes the execution subject as an electronic device as an example.

[0044] In the embodiments of this application, "branch points" may refer to various bank branches in actual scenarios. Collection devices may refer to, for example, video capture devices and audio recording devices. The capture devices may include cameras, and the audio recording devices may include audio sensors. The embodiments of this application do not limit the specific types of collection devices. Collection information may refer to video and audio streams captured and uploaded by the collection devices, such as video footage and ambient sounds in cash handover scenarios.

[0045] In this step, data collection equipment can be deployed in key areas of bank branches to address cash management activities such as cash handovers. These areas can include cash box handover areas, personnel access lanes, and cash truck parking areas. This comprehensive deployment of data collection equipment across bank branches ensures comprehensive, real-time monitoring of cash management operations, enabling real-time video and audio capture and upload of actual scenes. Electronic devices can access the data collected and uploaded by the data collection equipment in real time, and subsequently perform anomaly detection on cash management operations based on this data, ensuring the security of cash management operations.

[0046] S202. Determine the current execution stage and the detection mode corresponding to the current execution stage; wherein, the abnormality detection process corresponding to the network point includes multiple execution stages, and the detection mode of each execution stage is determined by the configuration file corresponding to the network point. The detection mode of each execution stage is used to indicate: the detection object and judgment method corresponding to the execution stage, the detection object is at least one of a vehicle, a person, and a cash box, and the judgment method is used to determine whether there is an abnormality in the execution stage and / or whether the execution stage is successfully executed.

[0047] In the embodiments of the present application, the "execution stage" may refer to each execution stage of the anomaly detection process for a cash handover scenario, specifically including the vehicle identification execution stage, the personnel identification execution stage, the cash box movement execution stage, and the cash box handover execution stage. The "current execution stage" may refer to the currently ongoing execution stage of the anomaly detection process for a cash handover scenario. The "detection mode" may refer to the anomaly detection method corresponding to each execution stage of the anomaly detection process, specifically including the detection object and the method for determining whether an anomaly exists in the execution stage.

[0048] In the embodiment of the present application, different execution stages of the abnormality detection process may correspond to different detection modes, and the detection mode may be determined based on the configuration file of the branch. Users (such as staff of the bank branch, etc.) may flexibly configure the configuration file based on the actual situation of the bank branch. For example, the configuration file may include the detection objects and judgment methods corresponding to the execution stage, wherein the detection objects may include at least one of vehicles, personnel, and cash boxes, and the judgment methods may include a judgment method for determining whether there is an abnormality in the execution stage, and may also include a judgment method for determining whether the execution stage is successfully completed. Of course, the configuration file may also include other configuration contents, such as the judgment method of each execution stage, etc., which can be flexibly set based on actual needs, and the embodiment of the present application does not limit this.

[0049] In this step, after obtaining the collection information reported by the collection device, the electronic device can determine the current execution stage corresponding to the abnormality detection process of the cash handover scenario, and determine the detection mode corresponding to the current execution stage according to the configuration file of the branch. Subsequently, it can be determined whether there is an abnormality in the current execution stage according to the detection mode.

[0050] S203: Detect the collected information according to the detection mode. If an abnormality is detected in the current execution stage, output alarm information corresponding to the current execution stage.

[0051] In an embodiment of the present application, the alarm information may refer to the pre-set warning information corresponding to each execution stage, specifically referring to alarm text, alarm image, alarm sound or alarm video animation, etc. The embodiment of the present application does not limit the specific type of alarm information.

[0052] In this step, after determining the current execution stage of the abnormality detection process and the detection mode of the current execution stage, the electronic device can detect the collected information uploaded by the collection device according to the detection mode to determine whether there is an abnormality in the current execution stage. Specifically, it can detect at least one of the detection objects of vehicles, personnel and cash boxes according to the detection mode, and determine whether there is an abnormality in the current execution stage according to the judgment method in the configuration file, such as whether the vehicle information in the collected information is consistent with the pre-stored target vehicle information, whether the facial information in the collected information matches the pre-stored target facial information, whether there is an abnormality in the movement trajectory of the cash box, etc. If there is an abnormality, the electronic device can output the alarm information corresponding to the current execution stage. Specifically, the alarm information can be output in the form of a pop-up window in the electronic device, or the alarm information can be sent to the mobile terminal of at least one staff member of the bank branch to facilitate the staff to quickly deal with the abnormal situation.

[0053] In the embodiment of the present application, the collected information sent by the collection device may include audio information. In a possible implementation, the abnormality detection process in step S203 may specifically include the following steps:

[0054] At each execution stage of the anomaly detection process, audio recognition is performed on the audio information sent by the acquisition device; when there is an abnormal sound in the audio information corresponding to the current execution stage, it is determined that an abnormality exists in the current execution stage.

[0055] In the embodiments of the present application, abnormal sounds may refer to arguments, conflicts, and alarm sounds that exist in actual scenarios. The electronic device can perform audio detection on the audio information at each execution stage of the abnormality detection process. If the audio information corresponding to the current execution stage contains abnormal sounds, the electronic device can determine that the current execution stage is abnormal and output an alarm message. This ensures that sound perception detection is performed throughout the cash handover scenario, ensuring the security of cash handover.

[0056] S204: If it is detected that the current execution phase is successfully completed, jump to the detection of the next execution phase until the abnormality detection process is completed.

[0057] In an embodiment of the present application, the electronic device may jump to the detection of the next execution stage according to the detection mode corresponding to the current execution stage. If it is detected that the current execution stage is successfully executed, for example, the vehicle recognition is normal in the vehicle recognition execution stage, and the face recognition is passed in the face recognition execution stage, etc., the electronic device may complete the entire abnormality detection process and realize automatic abnormality detection for cash handover scenarios.

[0058] The anomaly detection method provided in the embodiment of the present application obtains in real time the collection information sent by multiple collection devices deployed at different locations of the network point, and the collection devices are used to perform video shooting and audio collection on vehicles, personnel, and cash boxes during the anomaly detection process; determine the current execution stage and the detection mode corresponding to the current execution stage; wherein the anomaly detection process corresponding to the network point includes multiple execution stages, and the detection mode of each execution stage is determined by the configuration file corresponding to the network point, and the detection mode of each execution stage is used to indicate: the detection object and judgment method corresponding to the execution stage, the detection object is at least one of the vehicle, personnel, and cash box, and the judgment method is used to determine whether there is an anomaly in the execution stage and / or whether the execution stage is successfully completed; the collection information is detected according to the detection mode, and if an anomaly is detected in the current execution stage, the alarm information corresponding to the current execution stage is output; if it is detected that the current execution stage is successfully completed, the detection of the next execution stage is jumped to until the anomaly detection process is completed. In this application, the electronic device can, based on the actual situation of the outlets, obtain collected information and perform anomaly detection in accordance with the corresponding detection mode at different execution stages. When an anomaly occurs in the current execution stage, it can output alarm information in real time, thereby realizing automatic real-time detection of abnormal situations in the cash management business process, which can improve the efficiency and accuracy of anomaly detection in the cash management business. At the same time, the real-time performance of anomaly detection is higher, reducing the security risks in the cash management business.

[0059] Based on the above embodiments, Figure 3 A flowchart of the detection mode determination process at different execution stages provided by this application. Figure 3 ,include:

[0060] S301. If a target type of vehicle is detected at a network point through information collection, it is determined to enter the vehicle identification execution phase; wherein the target type matches the anomaly detection process.

[0061] In this embodiment of the present application, the target type may refer to the type of vehicle that triggers the anomaly detection process. The electronic device acquires collected information in real time and identifies vehicles in the video stream based on target detection technology. When a vehicle of the target type is determined to be present at the outlet, the electronic device may initiate an anomaly detection process for cash handover scenarios and enter the vehicle identification execution phase.

[0062] S302. In the vehicle identification execution phase, the vehicle information of the vehicle is identified, and when the vehicle information matches the target vehicle information corresponding to the abnormality detection process, it is determined that the vehicle identification execution phase is completed and jumps to the personnel identification execution phase; if there is no match, it is confirmed that there is an abnormality in the vehicle identification execution phase.

[0063] In the embodiments of the present application, vehicle information may refer to vehicle feature information collected in the collected information, specifically including vehicle type and license plate number, where vehicle type may include vehicle size, vehicle color, and vehicle type. Target vehicle information may refer to target vehicle information corresponding to the anomaly detection process, specifically including target vehicle information configured in the network configuration file.

[0064] In this step, during the vehicle identification execution phase of the anomaly detection process, the electronic device can obtain vehicle information of the vehicle in the collected information through target detection technologies such as deep learning algorithms, and then perform feature matching on the vehicle information with the target vehicle information corresponding to the anomaly detection process. Specifically, the feature similarity between the two can be calculated. If the vehicle information does not match the target vehicle information, for example, the similarity is less than a preset similarity threshold, the electronic device can determine that an anomaly exists in the vehicle identification execution phase and can output an alarm message corresponding to the vehicle identification execution phase. If the vehicle information matches the target vehicle information, for example, the similarity is greater than or equal to a preset similarity threshold, the electronic device can determine that an anomaly exists in the vehicle identification execution phase and can jump to the next execution phase, i.e., the personnel identification execution phase, to perform anomaly detection.

[0065] In an embodiment of the present application, during the vehicle identification execution phase, the electronic device compares and matches the actually collected vehicle information with the pre-stored target vehicle information, and outputs an alarm message if the two fail to match. In this way, the legitimacy of the cash transport vehicle is verified based on technologies such as license plate recognition, ensuring that only authorized cash transport vehicles can participate in the handover process, thereby ensuring the overall security of the cash handover scenario.

[0066] S303: During the personnel identification execution phase, determine the number of personnel, personnel type, and facial information of each person.

[0067] S304. When the number of personnel, type of personnel and facial information respectively match the target number of personnel, target type of personnel and target facial information corresponding to the abnormality detection process, jump to the cash box movement execution stage.

[0068] In the embodiments of the present application, the personnel identification execution phase may refer to the execution phase of identifying personnel in a cash handover scenario during an anomaly detection process. The number of personnel, type of personnel, and facial information may refer to the actual number of personnel, actual type of personnel, and actual facial information of each person detected and identified by the electronic device from the video stream of the collected information, wherein the actual type of personnel includes the characteristics of the personnel's clothing and the characteristics of the items they carry. The number of target personnel, type of target personnel, and target facial information may refer to pre-configured information corresponding to the anomaly detection process, specifically the number of target personnel, type of target personnel, and target facial information included in the configuration file of the branch.

[0069] In this step, after the vehicle identification execution phase is completed, the electronic device enters the personnel identification execution phase. It can first perform target detection and face recognition on the video stream in the collected information based on deep learning algorithms such as convolutional neural networks (CNN), such as residual networks (ResNet) or lightweight deep neural network models (MobileNet), to determine the number of people, the type of people, and the facial information of each person in the collected information. The electronic device can then match the number of people with the target number of people corresponding to the anomaly detection process, match the type of people with the target type of people, and match the facial information with the target facial information. If all three are successfully matched, it is determined that the personnel identification execution phase is completed and the electronic device can jump to the next execution phase.

[0070] S305. If the number of personnel does not match the number of target personnel, or the type of personnel does not match the type of target personnel, or the facial information does not match the target facial information, it is confirmed that there is an abnormality in the personnel recognition execution stage.

[0071] In the embodiment of the present application, if the number of people does not match the target number of people, or the type of people does not match the target type of people, or the facial information does not match the target facial information, the electronic device can determine that there is an abnormality in the person recognition execution phase and output an alarm message. In this way, the electronic device can ensure the security of the cash handover scenario by identifying and matching the number of people, type of people, and facial information in the cash handover scenario and outputting an alarm message when there is an abnormality in the person recognition process.

[0072] In the embodiment of the present application, the electronic device uses technologies such as facial recognition to identify people in cash handover scenarios, which can ensure that the identities of all people involved in the cash handover are strictly verified, and that every person entering the handover link is authorized and verified, which can ensure the legitimacy of the handover personnel, and thus can ensure the security of the handover process, greatly improving the security of the bank's cash management business.

[0073] S306. During the cash box movement execution phase, the movement trajectory of the personnel and the cash box are determined, and the real-time distance between the cash box and the target location and the real-time status of the cash box are determined.

[0074] S307. If the movement trajectory of the personnel matches the movement trajectory of the target personnel, the movement trajectory of the cash box matches the movement trajectory of the target cash box, the real-time distance meets the preset change condition and the cash box is in the closed state, then it is determined that the cash box movement execution phase is completed and jumps to the cash box handover execution phase.

[0075] In the embodiment of the present application, the cash box movement execution phase may refer to the execution phase of abnormality detection for the cash box movement process in the cash handover scenario. The personnel movement trajectory may refer to the actual movement trajectory of the personnel in the cash handover scenario. The cash box movement trajectory may refer to the actual movement trajectory of the cash box (a cash box for storing cash and a cash bag, etc.) in the cash handover scenario. The target location may refer to a specific location where the cash box is handed over at the branch. The real-time distance may refer to the actual distance between the cash box and the target location. The real-time status of the cash box may refer to the actual opening status of the cash box, which may specifically include status information such as whether the cash box lock is intact and whether the cash box is open.

[0076] In this step, after completing the person identification phase, the electronic device can enter the cash drawer movement phase. Based on deep learning algorithms in computer vision, such as YOLO and Faster R-CNN, the electronic device can perform target detection on objects in the video stream, identifying objects such as people, cash drawers, and cash bags. This can determine the actual movement trajectories of people and cash drawers in the cash handover scenario, as well as the real-time distance between the cash drawer and the target location and the cash drawer's real-time status.

[0077] Afterwards, the electronic device can match the movement trajectory of the person with the movement trajectory of the target person, match the movement trajectory of the cash box with the movement trajectory of the target cash box, and determine whether the change trend of the real-time distance meets the preset change condition. The preset change condition can be that the real-time distance between the cash box and the target location is getting smaller and smaller. In addition, the electronic device can also determine whether the real-time status of the cash box is closed. If the movement trajectory of the person matches the movement trajectory of the target person, the movement trajectory of the cash box matches the movement trajectory of the target cash box, the real-time distance meets the preset change condition, and the real-time status of the cash box is always closed, the electronic device can determine that the cash box movement execution phase is completed, and the electronic device can jump to the cash box handover execution phase.

[0078] S308. If the movement trajectory of the personnel does not match the movement trajectory of the target personnel, or the movement trajectory of the cash box does not match the movement trajectory of the target cash box, or the real-time distance does not meet the preset change condition, or the cash box is in an open state, it is determined that there is an abnormality in the cash box movement execution stage.

[0079] In an embodiment of the present application, during the cash box movement execution stage, if the personnel movement trajectory does not match the target personnel movement trajectory, or the cash box movement trajectory does not match the target cash box movement trajectory, or the real-time distance does not meet the preset change condition (cash handover), and the real-time status of the cash box is not in a closed state, then the electronic device can determine that there is an abnormality in the cash box movement execution stage, and the electronic device can output the alarm information corresponding to the cash box movement execution stage.

[0080] In an embodiment of the present application, the electronic device can output alarm information in a timely manner when an abnormal situation occurs through trajectory matching, distance detection and cash box status detection during the cash box movement execution phase, thereby ensuring real-time detection of abnormal situations in cash handover scenarios and being able to promptly respond to situations such as irregular cash box transportation.

[0081] S309. During the cash box handover execution phase, the personnel's action information is collected.

[0082] S310. If the action information matches the target action information corresponding to the abnormality detection process, it is determined that the cash box handover execution phase is completed; if the action information does not match the target action information, it is determined that an abnormality exists in the cash box handover execution phase.

[0083] In the embodiment of the present application, the action information may refer to the actual action behavior information of the person in the cash handover scenario. The target action information may refer to the pre-stored action information corresponding to the abnormality detection process, specifically the target action information pre-configured in the configuration file.

[0084] In this step, during the cash box handover execution phase, the electronic device can first determine the dynamic behavioral characteristics of the personnel in the video stream in the collected information through behavior recognition technologies such as the Spatial-Temporal Graph Convolutional Network (ST-GCN) or the Long Short-Term Memory Network (LSTM) in deep learning, classify and judge the dynamic behavioral characteristics of the personnel, and obtain the personnel's motion information. Afterwards, the electronic device can match the actual motion information of the personnel in the cash handover scene with the target motion information corresponding to the anomaly detection process. If the two do not match, the electronic device can determine that there is an anomaly in the cash box handover execution phase and can output the corresponding alarm information for the cash box handover execution phase; if the two match, the electronic device can determine that the cash box handover execution phase is normal.

[0085] In an embodiment of the present application, during the cash box handover execution stage of the abnormality detection process, the electronic device uses behavior recognition technology to perform real-time analysis of the actions of people in the cash handover scenario, obtains the actual action information of the people, and then matches the action information with the target action information. This can effectively capture the dynamic features in the collected information, realize real-time analysis of people's behavior and actions, and further identify risky behaviors and irregular operations, and issue real-time warnings when the action information does not match the target action information, thereby ensuring the safety of the cash handover scenario.

[0086] It should be noted that the anomaly detection process in the embodiment of the present application may also include other execution stages, and other detection modes may be adopted accordingly. Specifically, it can be flexibly configured through the configuration file based on the actual situation of the network point, and the embodiment of the present application does not limit this.

[0087] Based on the above embodiments, Figure 4 A flow chart of a configuration file determination process provided by this application. Figure 4 As shown, the profile determination process includes:

[0088] S401. In response to a user's configuration operation on a preset interactive interface, obtain a configuration file corresponding to the outlet; the configuration items in the preset interactive interface include at least one of a target cash box movement trajectory, a target cash box status, and model information.

[0089] In an embodiment of the present application, the preset interactive interface may refer to a pre-set user interaction page, which may include at least one configuration item such as the target cash box movement trajectory, the target cash box status, and model information. Model information may refer to the model information called by each execution stage of the anomaly detection process. Specifically, for each execution stage of the anomaly detection process, different types of model information may be set in the electronic device. Different types of model information may provide different levels of computing speed, adapt to different device parameters, or adopt different calculation models, etc. The user may determine the model information used in each execution stage of the anomaly detection process in the preset interactive interface according to the actual needs of the outlet.

[0090] In this step, before the abnormality detection process is executed, the electronic device can display a preset interactive interface. The user can configure the various configuration items involved in the abnormality detection process by performing configuration operations in the preset interactive interface based on the actual needs of the outlet. The electronic device responds to the user's configuration operation and can generate a configuration file corresponding to the abnormality detection process. Subsequently, the detection mode of each execution stage of the abnormality detection process can be determined based on the configuration file. It should be noted that the electronic device can display more configuration items in the preset interactive interface, such as the target type of vehicle, target vehicle information, the number of target personnel, the type of target personnel, the target facial information, the movement trajectory of the target personnel, the target location, and the target action information, etc., to meet the different configuration requirements of the outlet. Of course, other configuration items can also be included, and the embodiments of the present application are not limited to this.

[0091] In this embodiment of the present application, the electronic device determines a configuration file corresponding to the branch in response to a user's configuration operation on a preset interactive interface. Subsequently, during the anomaly detection process, the electronic device can use this configuration file to determine the detection modes corresponding to different execution stages. This allows the user to configure the anomaly detection process based on the actual needs of the branch, improving the flexibility and accuracy of anomaly detection in cash handover scenarios.

[0092] Based on the above embodiments, Figure 5 This is a flowchart of anomaly detection in the current execution phase provided by this application. Figure 5 As shown, the anomaly detection process in the current execution phase includes:

[0093] S501. In each execution stage of the anomaly detection process, extract video feature information and audio feature information corresponding to the collected information.

[0094] In embodiments of the present application, video feature information may refer to video features corresponding to the video stream in the collected information, and may specifically include personnel feature information, cash box feature information (for example), and vehicle feature information in the video stream in the collected information. Personnel feature information may include the number of personnel, personnel type, facial information, and personnel movement trajectory. Cash box feature information may include the real-time status of the cash box, the real-time distance between the cash box and the target location, and the cash box movement trajectory. Vehicle feature information may include vehicle information. Audio feature information may refer to audio features corresponding to the audio stream in the collected information.

[0095] In this step, at each stage of anomaly detection, the electronic device can perform risk assessment and anomaly detection based on an intelligent target language model. The electronic device can first extract video and audio feature information from the collected information sent by the acquisition device, achieving multimodal data acquisition and ensuring the comprehensiveness and accuracy of subsequent anomaly detection.

[0096] S502: Input the video feature information, audio feature information, and target business rules corresponding to the network point into the target language model to obtain risk identification results.

[0097] S503: If there is an abnormality in the risk identification result, it is determined that there is an abnormality in the current execution stage.

[0098] In the embodiments of this application, the target business rules may refer to the business rules corresponding to the branch, specifically the branch's cash management business regulatory documents, etc. The target language model may refer to a pre-trained large language model, specifically various intelligent dialogue models, etc. The embodiments of this application do not limit the specific type of the target language model.

[0099] In this step, the electronic device can input the video feature information, audio feature information, and target business rules of the current execution phase into the target language model, perform anomaly detection using the target language model, and determine the risk identification result corresponding to the current execution phase. If an anomaly is found in the risk identification result, the electronic device can determine that an anomaly exists in the current execution phase. In this way, in this embodiment of the present application, the electronic device uses the target language model to perform comprehensive analysis and detection of multimodal collected information, which can improve the accuracy and comprehensiveness of anomaly detection in cash handover scenarios and ensure further exploration of potential risks.

[0100] Based on the above embodiments, Figure 6 This is a schematic diagram of the execution logic of an anomaly detection system provided by this application. Figure 6As shown, the anomaly detection process can be implemented by an anomaly detection system in an electronic device. This system receives data from data collection devices such as high-definition cameras and audio sensors, and simultaneously communicates with the bank's information system and supervisory nodes to implement identity verification and real-time alerts. Depending on its function, the anomaly detection system in an electronic device can include an identity verification module, a business rule determination module, a cash status monitoring module, an abnormal behavior detection module, a multimodal data fusion analysis module, and an intelligent situation assessment and optimization module.

[0101] Specifically, the identity verification module in the anomaly detection system can be used to perform the vehicle and person identification phases of the anomaly detection process. Based on the video stream captured by the high-definition camera, the identity verification module can extract vehicle and facial images. It can then perform vehicle and facial recognition on these images. This allows electronic devices to authenticate vehicles and people in cash handover scenarios, ensuring the security of cash handover transactions.

[0102] The business rule identification module, based on intelligent agent technology using a pre-trained target language model, can determine the target business rules related to cash management at bank branches, ensuring the accuracy of subsequent anomaly detection and, in turn, the compliance of cash transfer operations. It can also adapt to different branches, providing greater flexibility. The business rule identification module can also be used to display a preset interactive interface, where users can perform configuration operations. Based on these configuration operations, the business rule identification module can generate a configuration file corresponding to the branch. This allows the anomaly detection system to determine the detection mode for the current execution phase based on this configuration file at different execution stages, ensuring the accuracy of anomaly detection in cash transfer scenarios.

[0103] The cash status monitoring module can use target detection technologies such as deep learning algorithms to track and detect detection objects such as cash boxes, personnel and vehicles in the video stream. During the cash box movement execution stage, it can detect the movement trajectory of personnel, the movement trajectory of the cash box, the real-time distance between the cash box and the target location, and the real-time status of the cash box. At the same time, during the cash box handover execution stage, it can also continuously detect the real-time status of the cash box, realize real-time feedback of the detection objects in the video stream, ensure the accuracy and compliance of operations in the entire cash handover scenario, reduce the risk of human operation errors, and improve the transparency and traceability of cash handover operations.

[0104] The abnormal behavior detection module in the anomaly detection system can be used to dynamically analyze and judge personnel behavior during the anomaly detection process, determine the personnel's action information, and then determine whether the personnel have performed abnormal operations by matching this action information with pre-configured target action information. This enables rapid and effective detection of abnormal behaviors such as non-standard operations. At each execution stage of the anomaly detection process, if an anomaly exists in the current execution stage, the anomaly detection system can output the corresponding alarm information for the current execution stage. For example, the alarm information can be output to the supervisory post node to ensure timely response and rapid disposal of abnormal situations in cash handover scenarios, ensuring the safety of the entire cash management process.

[0105] The multimodal data fusion analysis module in the anomaly detection system can obtain multimodal data by extracting audio feature information from the audio stream, video feature information from the video stream, and other sensor data (such as temperature, light, etc.) at each execution stage of anomaly detection. The multimodal data and the target business rules of the bank branch are then input into the target language model to obtain risk identification results. If there are anomalies in the risk identification results, the corresponding alarm information for the current execution stage is output. In this way, the anomaly detection system can achieve multi-angle perception and analysis of cash handover scenarios. Through mutual confirmation and cross-validation of different data sources, it can comprehensively assess the overall situation and potential risks of cash handover scenarios, enhance the overall assessment effect of the cash handover site, and improve the accuracy and robustness of the anomaly detection system.

[0106] In addition, the intelligent situation judgment and optimization module in the anomaly detection system can use the intelligent situation judgment capabilities of the target language model, combined with deep learning and natural language processing technology to conduct a comprehensive analysis of multimodal data, identify potential risks in cash handover scenarios, and provide corresponding optimization suggestions. Specifically, during operation, the anomaly detection system can autonomously adjust the handover process and strategy based on the analysis results of multimodal data and changes in business situations. This adaptive adjustment mechanism enables the anomaly detection system to dynamically respond to different business needs and risk factors, improving the flexibility and reliability of the overall business process. For example, when encountering a possible high-risk operation, the anomaly detection system can output how to adjust the handover process or the monitoring intensity to prevent safety hazards.

[0107] For example, based on real-time analysis of multimodal data, the anomaly detection system can determine abnormal patterns of personnel operations, or detect non-compliant operations in the cash handover process. The anomaly detection system can output optimization suggestions based on these abnormal patterns and potential risks, so that the business rule identification module can adjust the cash handover process. For example, a personnel verification link can be added on the basis of the original cash handover business process, etc., which is not limited in the embodiments of the present application. In this way, the anomaly detection system in the electronic device judges the current business situation through comprehensive analysis of multimodal data, and promptly puts forward improvement or adjustment suggestions based on the potential risks and abnormal patterns in the cash handover business, thereby optimizing the cash management business process. The anomaly detection system not only has passive security monitoring functions, but also has active process optimization capabilities, which can reduce potential risks, improve the overall intelligence level of the cash handover scene operation, and ensure the efficiency and safety of the cash handover process.

[0108] It should be noted that the anomaly detection system in the electronic device may need to adopt one or more modules in different execution stages of the anomaly detection process. The data flow and module settings in different execution stages can be flexibly configured based on actual needs, and the embodiments of the present application do not limit this.

[0109] In the embodiment of the present application, the anomaly detection system integrates collection equipment, bank information system, face recognition, license plate recognition, target detection, behavior recognition, trajectory tracking, target language model, etc. Through the collaborative work of multiple modules, it can realize automatic anomaly detection and real-time warning of cash handover scenarios, thereby improving the security of cash management business; in addition, the anomaly detection system uses the automatic decision-making mechanism of the intelligent agent. When an abnormal situation is detected, the anomaly detection system can quickly respond and make decisions, thereby minimizing manual intervention and improving the automation level and security of the entire cash management business. There is no need for manual risk verification at bank branches, which improves the efficiency and accuracy of anomaly detection; at the same time, through adaptive adjustment, the anomaly detection system can automatically adapt to different business scenarios and adjust strategies in real time to cope with the ever-changing operating environment and potential risks. This multi-module collaborative mechanism not only improves the response speed of the anomaly detection system, but also enhances the response capability of the anomaly detection system under complex operating conditions, and improves the universality of the anomaly detection system.

[0110] In terms of implementation effect, the anomaly detection system of the electronic device in the embodiment of the present application can greatly improve the security and operational efficiency of the cash management business of bank branches. Through automation and intelligent means, it reduces manual intervention, and can make the accuracy rate of personnel identity verification reach more than 99%, the accuracy rate of license plate recognition reach more than 99%, the accuracy rate of target detection reach more than 90%, and the accuracy rate of behavior recognition reach more than 85%. The response time is controlled within 10 seconds, ensuring the security of cash handover scenarios, significantly reducing the need for manual verification, and also improving the operational efficiency of cash handover scenarios.

[0111] Figure 7 This is a schematic diagram of the structure of an abnormality detection device provided in this application. Figure 4 , the abnormality detection device 70 may include:

[0112] Acquisition module 71, for acquiring in real time the collected information sent by multiple collection devices deployed at different locations of the network, the collection devices are used to capture video and collect audio of vehicles, personnel, and cash boxes during the anomaly detection process;

[0113] Determination module 72 is configured to determine the current execution phase and the detection mode corresponding to the current execution phase. The abnormality detection process corresponding to the network point includes multiple execution phases. The detection mode for each execution phase is determined by the configuration file corresponding to the network point. The detection mode for each execution phase is used to indicate: a detection object corresponding to the execution phase and a determination method. The detection object is at least one of a vehicle, a person, or a cash box. The determination method is used to determine whether an abnormality exists in the execution phase and / or whether the execution phase has been successfully completed.

[0114] The output module 73 is used to detect the collected information according to the detection mode, and if an abnormality is detected in the current execution stage, output an alarm message corresponding to the current execution stage;

[0115] The jump module 74 is used to jump to the detection of the next execution stage if it is detected that the current execution stage is successfully completed, until the abnormality detection process is completed.

[0116] In a possible implementation, the determination module 72 is specifically configured to:

[0117] If a target type of vehicle is detected at the site through the collected information, the vehicle identification execution phase is determined to be entered; wherein the target type matches the anomaly detection process;

[0118] In the vehicle identification execution phase, the vehicle information of the vehicle is identified, and when the vehicle information matches the target vehicle information corresponding to the abnormality detection process, it is determined that the vehicle identification execution phase is completed and jumps to the personnel identification execution phase; if there is no match, it is confirmed that there is an abnormality in the vehicle identification execution phase.

[0119] In a possible implementation, the determination module 72 is specifically configured to:

[0120] During the personnel identification execution phase, the number of personnel, personnel types, and facial information of each person are determined;

[0121] When the number of personnel, type of personnel, and facial information respectively match the target number of personnel, target type of personnel, and target facial information corresponding to the anomaly detection process, the process jumps to the cash box movement execution phase;

[0122] If the number of people does not match the target number of people, or the type of people does not match the target type of people, or the facial information does not match the target facial information, it is confirmed that there is an abnormality in the personnel recognition execution stage.

[0123] In a possible implementation, the determination module 72 is specifically configured to:

[0124] During the cash box movement execution phase, determine the movement trajectory of personnel and cash box, and determine the real-time distance between the cash box and the target location and the real-time status of the cash box;

[0125] If the movement trajectory of the personnel matches the movement trajectory of the target personnel, the movement trajectory of the cash box matches the movement trajectory of the target cash box, the real-time distance meets the preset change conditions, and the cash box is in the closed state, then the cash box movement execution phase is determined to be completed and jumps to the cash box handover execution phase;

[0126] If the movement trajectory of the personnel does not match the movement trajectory of the target personnel, or the movement trajectory of the cash box does not match the movement trajectory of the target cash box, or the real-time distance does not meet the preset change conditions, or the cash box is in an open state, it is determined that there is an abnormality in the cash box movement execution stage.

[0127] In a possible implementation, the determination module 72 is specifically configured to:

[0128] During the cash box handover execution phase, collect personnel action information;

[0129] If the action information matches the target action information corresponding to the anomaly detection process, the cash box handover execution phase is determined to be completed;

[0130] If the action information does not match the target action information, it is determined that there is an abnormality in the cash box handover execution stage.

[0131] In one possible implementation, the method further includes:

[0132] At each execution stage of the anomaly detection process, audio recognition is performed on the audio information sent by the acquisition device;

[0133] When there is abnormal sound in the audio information corresponding to the current execution stage, it is determined that there is abnormality in the current execution stage.

[0134] In one possible implementation, the device 70 is further configured to:

[0135] In response to a user's configuration operation on a preset interactive interface, a configuration file corresponding to the outlet is obtained; the configuration items in the preset interactive interface include at least one of a target cash box movement trajectory, a target cash box status, and model information.

[0136] In one possible implementation, the device 70 is further configured to:

[0137] In each execution stage of the anomaly detection process, video feature information and audio feature information corresponding to the collected information are extracted;

[0138] Input the video feature information, audio feature information, and target business rules corresponding to the network point into the target language model to obtain risk identification results;

[0139] If there is an abnormality in the risk identification result, it is determined that there is an abnormality in the current execution stage.

[0140] The anomaly detection device 70 provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar and will not be repeated here.

[0141] Figure 8 This is a schematic diagram of the structure of an anomaly detection device provided in this application. Figure 8 The abnormality detection device 80 may include a memory 81 and a processor 82. For example, the memory 81 and the processor 82 are connected to each other via a bus 83.

[0142] The memory 81 is used to store program instructions;

[0143] The processor 82 is configured to execute the program instructions stored in the memory to implement the anomaly detection method shown in the above embodiment.

[0144] Figure 8 The abnormality detection device 80 shown can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar and will not be repeated here.

[0145] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the above-mentioned anomaly detection method.

[0146] An embodiment of the present application may also provide a computer program product, including a computer program, which, when executed by a processor, can implement the above-mentioned anomaly detection method.

[0147] It should be noted that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0148] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM). It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) is integrated into the processor. It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0149] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0150] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0151] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0152] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0153] Regarding the various modules / units contained in the various devices and products described in the above embodiments, they can be software modules / units, hardware modules / units, or partly software modules / units and partly hardware modules / units. Each device and product can be applied to or integrated into a chip, a chip module or a terminal device. For example, for each device and product applied to or integrated into a chip, the various modules / chips contained therein can be all implemented in the form of hardware such as circuits, or at least part of the modules / units can be implemented in the form of software programs, which run on a processor integrated inside the chip, and the remaining modules / units can be implemented in the form of hardware such as circuits.

[0154] In this application, the term "include" and its variations may refer to non-restrictive inclusion; the term "or" and its variations may refer to "and / or". In this application, the terms "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In this application, "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship.

[0155] The above are only some embodiments of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as within the scope of protection of the present application.

Claims

1. A method for detecting anomalies, characterized in that: include: Real-time acquisition of data from multiple collection devices deployed at different locations of the network. The collection devices are used to capture video and audio of vehicles, personnel, and cash boxes during anomaly detection. Determining a current execution stage and a detection mode corresponding to the current execution stage; wherein the abnormality detection process corresponding to the network point includes multiple execution stages, and the detection mode of each execution stage is determined by a configuration file corresponding to the network point, and the detection mode of each execution stage is used to indicate: a detection object and a determination method corresponding to the execution stage, the detection object being at least one of a vehicle, a person, and a cash box, and the determination method being used to determine whether an abnormality exists in the execution stage and / or whether the execution stage has been successfully completed; Detecting the collected information according to the detection mode, and if an abnormality is detected in the current execution stage, outputting alarm information corresponding to the current execution stage; If it is detected that the current execution phase is successfully completed, the process jumps to the detection of the next execution phase until the abnormality detection process is completed.

2. The method according to claim 1, characterized in that The determining of the current execution stage and the detection mode corresponding to the current execution stage includes: If a target type of vehicle is detected at the network point through the collected information, it is determined to enter the vehicle identification execution phase; wherein the target type matches the anomaly detection process; In the vehicle identification execution phase, the vehicle information of the vehicle is identified, and when the vehicle information matches the target vehicle information corresponding to the abnormality detection process, it is determined that the vehicle identification execution phase is completed and jumps to the personnel identification execution phase; if there is no match, it is confirmed that there is an abnormality in the vehicle identification execution phase.

3. The method according to claim 1, characterized in that The determining of the current execution stage and the detection mode corresponding to the current execution stage includes: During the personnel identification execution phase, the number of personnel, personnel types, and facial information of each person are determined; When the number of personnel, the type of personnel, and the facial information respectively match the target number of personnel, the target type of personnel, and the target facial information corresponding to the anomaly detection process, jumping to the cash box movement execution phase; If the number of personnel does not match the target number of personnel, or the type of personnel does not match the target type of personnel, or the facial information does not match the target facial information, it is confirmed that there is an abnormality in the personnel recognition execution stage.

4. The method according to claim 1, wherein The determining of the current execution stage and the detection mode corresponding to the execution stage includes: During the cash box movement execution phase, the movement trajectory of the personnel and the cash box is determined, and the real-time distance between the cash box and the target location and the real-time status of the cash box are determined; If the movement trajectory of the person matches the movement trajectory of the target person, the movement trajectory of the cash box matches the movement trajectory of the target cash box, the real-time distance meets the preset change condition, and the cash box is in a closed state, then the cash box movement execution phase is determined to be completed, and the process jumps to the cash box handover execution phase; If the personnel movement trajectory does not match the target personnel movement trajectory, or the cash box movement trajectory does not match the target cash box movement trajectory, or the real-time distance does not meet the preset change condition, or the cash box is in an open state, it is determined that there is an abnormality in the cash box movement execution stage.

5. The method according to claim 1, characterized in that The determining of the current execution stage and the detection mode corresponding to the execution stage includes: During the cash box handover execution phase, the personnel's action information is collected; If the action information matches the target action information corresponding to the abnormality detection process, it is determined that the cash box handover execution phase is completed; If the action information does not match the target action information, it is determined that an abnormality exists in the cash box handover execution phase.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: At each execution stage of the anomaly detection process, performing audio recognition on the audio information sent by the acquisition device; When there is abnormal sound in the audio information corresponding to the current execution stage, it is determined that there is abnormality in the current execution stage.

7. The method according to any one of claims 1 to 5, characterized in that The method further comprises: In response to a user's configuration operation on a preset interactive interface, a configuration file corresponding to the outlet is obtained; the configuration items in the preset interactive interface include at least one of a target cash box movement trajectory, a target cash box status, and model information.

8. The method according to any one of claims 1 to 5, characterized in that The method further comprises: In each execution stage of the anomaly detection process, extracting video feature information and audio feature information corresponding to the collected information; Inputting the video feature information, the audio feature information, and the target business rules corresponding to the network point into a target language model to obtain a risk identification result; If the risk identification result is abnormal, it is determined that the current execution stage is abnormal.

9. An abnormality detection device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the abnormality detection method according to any one of claims 1 to 8.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the anomaly detection method according to any one of claims 1 to 8 is implemented.

Images