A management method and system for access control data based on big data

Abstract

This application discloses a management method and system for access control data based on big data, which belongs to the field of computer technology. By integrating multi-dimensional analysis of card swiping operation characteristics, physiological data, action paths and behavior patterns, combined with a dynamic risk assessment model, it can effectively identify security threats such as the forced use of legitimate cards and abnormal behavior of internal personnel. It has the advantages of multi-dimensional security assessment, dynamic risk identification and abnormal behavior tracking.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and system for managing access control data based on big data. Background Art

[0002] Access control systems play a central role in the security management of confidential areas. Card-based authentication mechanisms are widely used to control access. The basic principle of these systems is that after a user swipes their card at an access point, the system identifies the card information and matches it against a pre-stored authorization list. If a match is found, access is granted. These solutions primarily rely on the validity of the card itself and pre-set static permission rules (such as authorized areas and timetables) for access control, supplemented by basic card swipe records (such as time and location) for retrospective verification.

[0003] However, these traditional access control solutions have significant limitations. A core issue is that security assessments are overly simplistic and static, relying heavily on pre-set permission rules and the authenticity of card information, making it difficult to proactively identify potential security threats. The system is often unable to effectively perceive and analyze the dynamic context behind user card swiping behavior (such as sudden changes in swiping habits or the concentration of people in the current area). Furthermore, it lacks a comprehensive consideration of user behavior itself (such as operating methods and physiological state) as well as the trajectory of activities before and after entering a secure area. This results in a significant lack of ability to identify complex security risks such as abnormal behavior disguised as legitimate authority, insider threats, or coerced access, which can easily lead to security vulnerabilities and delayed responses.

[0004] Therefore, this field urgently needs a more intelligent and dynamic access control data management method that can go beyond simple permission matching and, by integrating multi-dimensional contextual information and behavioral data, proactively assess the potential risks behind each access request in real time, thereby significantly improving the security protection level of confidential areas and effectively responding to complex and changing security threats. Summary of the Invention

[0005] The present application provides a method and system for managing access control data based on big data, which can improve the security level of confidential areas. The technical solution is as follows:

[0006] In one aspect, a method for managing access control data based on big data is provided, the method comprising:

[0007] In response to the target object's card swiping operation on the target access control in the target confidential area, determine whether the access control card used in the card swiping operation has access authority and determine whether there is a security risk based on the card information of the access control card and the spatial information of the target confidential area. The card information includes the current card swiping time and the card swiping time mode of the access control card. The spatial information is used to indicate the distribution of personnel in the target confidential area, and the card swiping time mode is used to indicate the card swiping time habit of the access control card. When the access control card has access authority and there is a security risk, open the target access control and determine the first suspicious degree of the target object based on the card swiping method of the access control card on the target access control, the target object's physiological data and the card swiping reference information. The reference information includes the card swiping posture and the standing position when swiping the card; when the first suspicious degree is greater than or equal to the first suspicious degree threshold, the second suspicious degree of the target object is determined based on the first action path, second action path, first object image and second object image of the target object, the first action path is the action path outside the target confidential area before reaching the target access control, the second action path is the action path within the target confidential area after passing the target access control, the first object image is the object image when swiping the card, and the second object image is the object image after passing the target access control; based on the first suspicious degree and the second suspicious degree, determine whether to trigger an alarm for the target object, and the alarm is used to indicate that there is a security risk for the target object.

[0008] Furthermore, the present application also proposes that the personnel distribution situation includes historical personnel distribution and current personnel distribution, and determines whether there are security risks based on the card information of the access control card and the spatial information of the target confidential area, including: determining the time abnormality degree corresponding to the card swiping operation based on the current card swiping time and the card swiping time pattern; determining the personnel distribution abnormality degree corresponding to the current card swiping time based on the current card swiping time, historical personnel distribution and current personnel distribution; determining the target abnormality degree corresponding to the card swiping operation based on the time abnormality degree and the personnel distribution abnormality degree; when the target abnormality degree is greater than or equal to the abnormality degree threshold, determining that there is a security risk, and the abnormality degree threshold is determined based on the security level of the target confidential area; when the target abnormality degree is less than the abnormality degree threshold, determining that there is no security risk.

[0009] Furthermore, the present application also proposes to determine the degree of abnormality of the personnel distribution corresponding to the current card swiping time based on the current card swiping time, historical personnel distribution and current personnel distribution, including: determining the reference personnel distribution based on the current card swiping time and historical personnel distribution; determining the degree of abnormality of the personnel distribution corresponding to the current card swiping time based on the reference personnel distribution and the current personnel distribution.

[0010] Furthermore, the present application also proposes that physiological data is collected through a non-contact physiological data sensor, and the physiological data includes heart rate and body temperature. Based on the swiping method of the access control card on the target access control, the physiological data of the target object and the swiping reference information, the first suspicion level of the target object is determined, including: determining a first initial suspicion level based on the swiping method and the swiping posture, the first initial suspicion level is the suspicion level associated with the swiping method and the swiping posture; determining a second initial suspicion level based on the heart rate, body temperature, the swiping posture and the standing position, the second initial suspicion level is the suspicion level associated with the physiological data and the swiping reference information; determining the first suspicion level based on the first initial suspicion level and the second initial suspicion level.

[0011] Furthermore, the present application also proposes that the card swiping method includes the card swiping position and the card swiping trajectory, and based on the card swiping method and the card swiping posture, a first initial suspicious degree is determined, including: determining the suspicious degree of the card swiping position based on the distance between the card swiping position and multiple reference card swiping positions, the multiple reference card swiping positions are obtained by clustering multiple historical card swiping positions of the access control card on the target access control, and the reference card swiping position is the cluster center; determining the suspicious degree of the card swiping trajectory based on the trajectory similarity between the card swiping trajectory and multiple reference card swiping trajectories, the multiple reference card swiping trajectories are obtained by fitting multiple historical card swiping trajectories of the access control card on the target access control; determining the posture type of the card swiping posture; determining the suspicious posture based on the posture type and the posture similarity between the card swiping posture and multiple historical card swiping postures. degree, multiple historical card swiping postures are card swiping postures used by the object using the access control card when swiping the card on the target access control; based on the suspicious degree of the position, the suspicious degree of the card swiping trajectory and the suspicious degree of the posture, a first initial suspicious degree is determined; based on the heart rate, body temperature, card swiping posture and standing position, a second initial suspicious degree is determined, including: determining the suspicious degree of the state of the target object based on the heart rate and body temperature; determining the suspicious degree of the posture of the target object based on the card swiping method, card swiping trajectory and standing position; determining the second initial suspicious degree based on the suspicious degree of the state and the suspicious degree of the posture; determining the first suspicious degree based on the first initial suspicious degree and the second initial suspicious degree, including: weighted fusion of the first initial suspicious degree and the second initial suspicious degree to obtain the first suspicious degree.

[0012] Furthermore, the present application also proposes to determine the second suspicious degree of the target object based on the first action path, the second action path, the first object image and the second object image, including: determining the suspicious degree of the first action path of the target object based on the first action path and multiple first reference action paths, the multiple first reference action paths are regular action paths to reach the target access control, and the regular action path refers to the action path used most times; determining multiple candidate positions passed by the second action path and the stay time at each candidate position; determining the suspicious degree of the second action path of the target object based on the multiple candidate positions and the stay time at each candidate position; determining the expression change information and movement change information of the target object based on the first object image and the second object image; determining the suspicious degree of the target object's performance based on the expression change information and movement change information of the target object; determining the second suspicious degree of the target object based on the suspicious degree of the first action path, the suspicious degree of the second action path and the suspicious degree of performance.

[0013] Furthermore, the present application also proposes to determine the degree of suspicion of the first action path of the target object based on the first action path and multiple first reference action paths, including: determining the path similarity between the first action path and each first reference action path; determining the first reference action path with the highest path similarity with the first action path among the multiple first reference action paths as the first target reference action path; determining the degree of suspicion of the action path corresponding to the first target reference action path as the degree of suspicion of the first action path; determining the degree of suspicion of the second action path of the target object based on multiple candidate locations and the stay time at each candidate location, including: determining the action sensitivity of the target object based on the importance level of each candidate location; determining the degree of interest of the target object in each candidate location based on the number of arrivals and the stay time at each candidate location; and determining the degree of suspicion of the target object from the perspective of the target object based on the degree of interest of the target object in each candidate location. A target position is determined from among multiple candidate positions, where the target position is the candidate position with the highest interest level among the multiple candidate positions; based on the action sensitivity and the target position, a degree of suspicion of the second action path of the target object is determined; based on the expression change information and the motion change information of the target object, a degree of suspicion of the performance of the target object is determined, including: extracting features from the expression change information and the motion change information to obtain expression change features and motion change features of the target object; fusing the expression change features with the motion change features to obtain target change features of the target object; mapping the target change features to obtain a degree of suspicion of the performance; determining a second degree of suspicion of the target object based on the degree of suspicion of the first action path, the degree of suspicion of the second action path, and the degree of suspicion of the performance, including: weighted fusing the degree of suspicion of the first action path, the degree of suspicion of the second action path, and the degree of suspicion of the performance to obtain the second degree of suspicion of the target object.

[0014] Furthermore, the present application also proposes to determine whether to trigger an alarm for the target object based on a first degree of suspicion and a second degree of suspicion, including: fusing the first degree of suspicion and the second degree of suspicion to obtain a first fused degree of suspicion; when the first fused degree of suspicion is greater than or equal to the second degree of suspicion threshold, determining the third degree of suspicion of the target object based on the first behavior sequence, the second behavior sequence and the third action path of the target object, the first behavior sequence includes multiple behaviors of the target object in the target confidential area, the second behavior sequence includes multiple behaviors of the target object after leaving the target confidential area, and the third action path is the action path outside the target confidential area after leaving the target access control; fusing the first degree of suspicion, the second degree of suspicion and the third degree of suspicion to obtain a second fused degree of suspicion; when the second fused degree of suspicion is greater than or equal to the third degree of suspicion threshold, determining to trigger an alarm for the target object; when the second fused degree of suspicion is less than the third degree of suspicion threshold, determining not to trigger an alarm for the target object.

[0015] Furthermore, the present application also proposes to determine the third suspicious degree of the target object based on the first behavior sequence, second behavior sequence and third action path of the target object, including: determining the suspicious degree of the first behavior of the target object based on the first behavior sequence and the second behavior sequence; determining the suspicious degree of the second behavior of the target object based on the second behavior sequence and the behavioral norms of the target confidential area; determining the suspicious degree of the third action path of the target object based on the third action path and multiple third reference action paths, where the multiple third reference action paths are regular action paths for leaving the target access control, and the regular action path refers to the action path that is used the most times; determining the third suspicious degree of the target object based on the suspicious degree of the first behavior, the suspicious degree of the second behavior and the suspicious degree of the third action path.

[0016] Furthermore, the present application also proposes to determine the suspicious degree of the first behavior of the target object based on the first behavior sequence and the second behavior sequence, including: determining the first behavior pattern of the target object based on the first behavior sequence; determining the second behavior pattern of the target object based on the second behavior sequence; determining the suspicious degree of the first behavior of the target object based on the behavior pattern difference information between the first behavior pattern and the second behavior pattern; determining the suspicious degree of the second behavior of the target object based on the second behavior sequence and the behavior norms of the target confidential area, including: determining the degree of behavioral deviation between the second behavior sequence and the behavior norms; determining the suspicious degree of the second behavior of the target object based on the behavioral deviation degree; determining the suspicious degree of the third action path of the target object based on the third action path and multiple third reference action paths, including: determining the path similarity between the third action path and each third reference action path; determining the third reference action path with the highest path similarity to the third action path among the multiple third reference action paths as the second target reference action path; and determining the suspicious degree of the action path corresponding to the second target reference action path as the suspicious degree of the third action path.

[0017] In one aspect, a management system for access control data based on big data is provided, the system comprising:

[0018] a security risk determination module for, in response to a target subject swiping a card at a target access control station in a target confidential area, determining whether the access card used in the swiping operation has access permission and determining whether a security risk exists based on card information of the access card and spatial information of the target confidential area, wherein the card information includes a current swipe time and a swipe time pattern of the access card, the spatial information is used to indicate the distribution of personnel in the target confidential area, and the swipe time pattern is used to indicate the swipe time habits of the access card;

[0019] a first suspicion level determination module configured to, if the access card has access authorization and there is a safety hazard, open the target access control and determine a first suspicion level of the target object based on a swiping method of the access card on the target access control, physiological data of the target object, and swiping reference information, wherein the swiping reference information includes a swiping posture and a standing position when the card is swiped;

[0020] a second suspicion level determination module, wherein, when the first suspicion level is greater than or equal to a first suspicion level threshold, the module determines a second suspicion level of the target object based on a first movement path, a second movement path, a first object image, and a second object image of the target object, wherein the first movement path is a movement path outside the target confidential area before reaching the target access control station, the second movement path is a movement path within the target confidential area after passing through the target access control station, the first object image is an image of the object when the card is swiped, and the second object image is an image of the object after passing through the target access control station;

[0021] A triggering judgment module is used to determine whether to trigger an alarm for the target object based on the first suspicious degree and the second suspicious degree, where the alarm is used to indicate that there is a security risk with respect to the target object.

[0022] On the one hand, a computer device is provided, which includes one or more processors and one or more memories, wherein at least one computer program is stored in the one or more memories, and the computer program is loaded and executed by the one or more processors to implement the big data-based access control data management method.

[0023] On the one hand, a computer-readable storage medium is provided, in which at least one computer program is stored. The computer program is loaded and executed by a processor to implement the method for managing access control data based on big data.

[0024] On the one hand, a computer program product or computer program is provided, which includes a program code, which is stored in a computer-readable storage medium. A processor of a computer device reads the program code from the computer-readable storage medium, and the processor executes the program code, so that the computer device executes the above-mentioned big data-based access control data management method.

[0025] From the above, it can be seen that the access control data management method and system based on big data provided by this application, through the integration of multi-dimensional analysis of card swiping operation characteristics, physiological data, action paths and behavior patterns, combined with dynamic risk assessment models, can effectively identify security threats such as the forced use of legitimate cards and abnormal behavior of internal personnel. It has the advantages of multi-dimensional security assessment, dynamic risk identification and abnormal behavior tracking. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0027] Figure 1 This is a schematic diagram of an implementation environment of a method for managing access control data based on big data provided by an embodiment of the present application;

[0028] Figure 2 This is a flow chart of a method for managing access control data based on big data provided by an embodiment of the present application;

[0029] Figure 3 This is a flow chart for determining safety hazards provided by an embodiment of the present application;

[0030] Figure 4 This is a flow chart for determining a first degree of suspicion provided by an embodiment of the present application;

[0031] Figure 5 This is a flow chart for determining a second degree of suspicion provided by an embodiment of the present application;

[0032] Figure 6 This is a flowchart of an alarm trigger judgment provided by an embodiment of the present application;

[0033] Figure 7 This is a schematic diagram of the structure of a management system for access control data based on big data provided by an embodiment of the present application;

[0034] Figure 8 This is a structural diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0036] In this application, the terms "first", "second", etc. are used to distinguish identical or similar items with substantially the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there any limitation on the quantity and execution order.

[0037] Access control data: Access control data refers to all information generated, collected and processed by the access control system during operation, including personnel identity information, entry and exit records, permission settings, etc.

[0038] Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to achieve better results.

[0039] Machine learning (ML) is a multidisciplinary field that encompasses probability theory, statistics, approximation theory, convex analysis, and algorithmic complexity theory. It specifically studies how computers can simulate or implement human learning behaviors to acquire new knowledge or skills and reorganize existing knowledge sub-models to continuously improve their performance. Machine learning is at the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications span all areas of AI. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and learning through demonstration.

[0040] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0041] Figure 1 This is a schematic diagram of the implementation environment of a method for managing access control data based on big data provided by an embodiment of the present application, see Figure 1 , the implementation environment may include an access control system 110 and a server 140 .

[0042] The access control system 110 is connected to the server 140 via a wireless network or a wired network. The access control system 110 is installed and runs an application program that supports the management of access control data based on big data.

[0043] Server 140 is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. Server 140 can provide backend services for applications running on access control system 110.

[0044] Access control systems commonly use card-based authentication mechanisms to control access. These systems implement access control by identifying card information and matching it with a pre-stored authorization list. These systems rely on static rules and retrospective mechanisms. Traditional solutions suffer from a single security assessment dimension and an inability to perceive dynamic contexts. This makes it difficult to identify anomalous behavior or insider threats disguised as legitimate authority, resulting in delayed and reactive security protection.

[0045] To address these issues, the inventors discovered that traditional access control systems focus solely on card validity while ignoring behavioral characteristics and contextual relevance. Analyzing multiple security incidents, they found that abnormal access behavior is often accompanied by sudden changes in card swiping habits, abnormal physiological states, and unusual path trajectories. Consequently, they proposed combining temporal pattern analysis, spatial occupant distribution, physiological data monitoring, and behavioral trajectory tracking to construct a dynamic risk assessment model. Through progressive data fusion, security risk prediction is introduced during the authorization verification phase, and multi-dimensional behavioral analysis is superimposed during the post-access phase, forming a hierarchical security assessment mechanism.

[0046] Therefore, this application proposes a method for access control data management based on big data, see Figure 2 , taking the access control system as an example, it includes:

[0047] 201. Responding to a card swiping operation by a target object at a target access control area in a target confidential area, determining whether the access control card has access permission, and determining security risks based on the card information and spatial information;

[0048] 202. When there is a security risk, open the access control and calculate a first suspicious degree based on the card swiping method, physiological data, and card swiping reference information;

[0049] 203. When the first suspicious level exceeds the limit, a second suspicious level is calculated based on the movement path and image changes before and after entering the area;

[0050] 204. Finally, it is determined whether to trigger an alarm based on the dual degree of suspicion.

[0051] Among them, the target access control is the access control that needs to be passed through to enter the target confidential area, and the target access control belongs to the access control system. The card swiping time pattern refers to the historical card swiping time pattern of the access control card holder. The typical card swiping time period can be extracted through time series analysis to detect whether the current card swiping time deviates from the normal habit. Spatial information includes real-time personnel distribution data in the confidential area, which is collected through heat maps or cameras to determine whether there is an abnormal gathering risk in the current area. The card swiping method covers the contact trajectory characteristics of the card and the card reader, and the details of the card swiping action can be recorded by pressure sensors and motion trajectory capture devices. Physiological data includes heart rate and body temperature indicators collected non-contactly, and non-sensing measurement is achieved using infrared sensors or millimeter wave radars. The action path records the movement trajectory of the target object through a video tracking system, and extracts path features in combination with a computer vision algorithm. The computer vision algorithm can be an algorithm in the relevant technology, and the embodiments of this application do not limit this. The object image uses a face recognition camera to capture changes in facial expressions and movements, and extracts micro-expression features through an image analysis algorithm.

[0052] Specifically, when the target object swipes the card, the system (short for access control system, the same below) first verifies the card permissions and analyzes the degree of deviation between the current swipe time and the historical pattern. At the same time, it obtains the real-time distribution of people in the confidential area to determine whether there is any abnormal gathering. If a comprehensive assessment shows that there is a safety hazard, the system allows passage but starts behavioral monitoring. The first degree of suspicion is calculated by analyzing the trajectory pressure characteristics, standing position offset, and heart rate and body temperature fluctuations of the card swiping action. When the value exceeds the threshold, the target's movement path before and after entering the confidential area is further tracked to compare the differences in the regular path pattern. The amplitude of changes in facial expressions and the abnormality of body movements during the swipe and after entry are simultaneously analyzed to comprehensively calculate the second degree of suspicion. Finally, the evaluation results of the two stages are weighted and fused to dynamically determine whether a security alarm is triggered.

[0053] Compared to related technologies, existing solutions only perform permission matching and basic logging, failing to correlate temporal patterns with spatial states and lacking continuous monitoring of physiological characteristics and behavioral trajectories. This solution dynamically integrates multi-dimensional data, including card swiping habits, regional population density, physiological indicators, operational characteristics, and path trajectories, to construct a progressive risk assessment model. This approach incorporates a security risk prediction mechanism during the permission verification phase and superimposes multi-dimensional behavioral analysis during the post-access phase, forming a hierarchical security assessment system that significantly improves the accuracy of identifying abnormal access behavior.

[0054] Through the above technical solutions, this application effectively solves the problem of the single security assessment dimension of traditional access control systems. Through the correlation analysis of time patterns and spatial states, it can proactively identify abnormal access requests during unconventional time periods. Combined with the dynamic monitoring of physiological data and behavioral characteristics, it can accurately identify coercive operations or identity theft. The dual verification mechanism of movement path and expression changes enhances the ability to detect abnormal activities of internal personnel. The multi-stage suspicion level fusion decision model realizes a graded response to security risks, improving the level of security protection while ensuring normal traffic efficiency.

[0055] This application further proposes a method for making a comprehensive judgment based on the card information of the access card and the spatial information of the target confidential area when determining that there is a security risk. Figure 3 , taking the access control system as an example, the specific implementation includes:

[0056] 301. Determine the degree of time anomaly based on the current card swiping time and the card swiping time pattern.

[0057] 302. Calculate the degree of abnormality in personnel distribution by combining the current card swiping time, historical personnel distribution and current personnel distribution.

[0058] 303. The two abnormality levels are weighted and fused to obtain the target abnormality level. Finally, the presence of a safety hazard is determined based on the abnormality level threshold dynamically set according to the safety level.

[0059] The card swipe time pattern refers to the periodic temporal patterns formed in the historical swipe records of access control card holders. Typical swipe time periods can be extracted using a time series clustering algorithm. Historical personnel distribution refers to the historical personnel density data within the target confidential area during the same time period and can be stored as a heat map. Current personnel distribution is collected through a real-time sensor network, such as infrared counters or video analysis systems. The degree of temporal anomaly is calculated by comparing the deviation between the current card swipe time and the historical swipe time pattern, for example, using a Gaussian distribution model to calculate the probability of an anomaly at a given point in time. The degree of personnel distribution anomaly is calculated by comparing the current personnel distribution with the historical distribution, for example, using the KL divergence to measure distribution differences. The target anomaly degree is calculated using a linearly weighted approach to integrate temporal and spatial anomaly indicators, with the weight coefficient dynamically adjusted based on the security level of the area. Anomaly thresholds are set based on the security level of the confidential area, for example, with higher thresholds for core areas and lower thresholds for general areas.

[0060] Specifically, when a user swipes a card, the system first analyzes whether the current swipe time is consistent with the typical usage pattern of the card. If the swipe time is in a non-high-frequency time period, a time anomaly flag is triggered. At the same time, the system retrieves the historical personnel distribution data of the confidential area during that time period and compares it with the current real-time monitored personnel distribution. If the current personnel density deviates significantly from the historical average level, a spatial anomaly flag is triggered. The system combines the temporal and spatial anomaly indicators according to the preset weight coefficient to generate a comprehensive anomaly score. After comparing this score with the dynamic threshold, it determines whether there are security risks. For example, in areas with a higher security level, even if the degree of anomaly of a single indicator is relatively low, the comprehensive score may still exceed the threshold and trigger an alarm.

[0061] Compared to related technologies, traditional access control systems only verify the validity of card permissions and lack comprehensive analysis of the regularity of card swipe times and the dynamic changes in regional population distribution. Existing solutions are unable to identify unusual use of valid cards during unusual time periods, nor can they detect security risks posed by sudden changes in crowd concentration. This solution integrates temporal pattern analysis with spatial distribution monitoring to establish a multi-dimensional dynamic risk assessment model, effectively addressing the limitations of single-dimensional detection.

[0062] Through the above-mentioned technical solution, this application achieves accurate identification of spatiotemporal anomalies in card swiping operations, resolving the problem of traditional access control systems' single-dimensional assessment of security risks. By dynamically integrating temporal and spatial anomaly indicators, it can effectively detect abnormal usage scenarios of legitimate cards. At the same time, it adjusts the judgment threshold based on the security level to ensure risk assessment adaptability for areas with different confidentiality levels. This method significantly improves the access control system's ability to proactively detect potential security threats, avoiding missed or false alarms caused by static detection rules.

[0063] This application further proposes a technical means for determining a reference personnel distribution based on the current card swiping time and historical personnel distribution, and determining the degree of abnormality of the personnel distribution corresponding to the current card swiping time based on the reference personnel distribution and the current personnel distribution.

[0064] The current card swipe time refers to the specific moment when the target person swipes their card. This can be achieved by obtaining timestamp data from the access control system's built-in clock module, which is then used for comparison and analysis with historical card swipe time patterns. The historical personnel distribution refers to past data on the concentration of people within the target confidential area during the same time period. This can be achieved using periodic statistical results stored in the access control system or historical density distribution data collected by sensors. This is used to establish a time-based personnel distribution benchmark model. The reference personnel distribution refers to the expected personnel distribution at the current time point based on historical data. This can be generated by fitting historical data using a time series prediction algorithm and serves as a benchmark for comparison with real-time data. The current personnel distribution refers to the real-time monitored location and number of people within the target confidential area. This can be dynamically collected using an infrared sensor array or video surveillance system to reflect the actual spatial distribution. The degree of personnel distribution anomaly is a quantitative indicator of the deviation between real-time data and historical benchmarks. This can be achieved using Euclidean distance calculations or probability distribution difference algorithms to objectively assess the degree of anomaly in the concentration.

[0065] Specifically, the reference population distribution is an expected value generated by time-aligning historical population distribution data. For example, if the current card swipe time is 10:00 AM on a weekday, the population distribution data for the past 30 weekdays at 10:00 AM is extracted and the reference population distribution for that time point is generated using mean calculation or sliding window averaging. The current population distribution is collected via a real-time sensor network, forming a spatial distribution matrix containing the number of people in each area. The degree of abnormality in the population distribution is calculated by comparing the reference distribution matrix with the real-time distribution matrix area by area, calculating the absolute difference in the number of people in each area, and then taking a weighted sum of the differences across all areas. The weights are dynamically adjusted based on the importance of the area. The resulting weighted sum is the quantified value of the degree of abnormality in the population distribution. When this value exceeds a preset threshold, a safety hazard is determined.

[0066] Compared to related technologies, traditional solutions only judge whether the current number of people exceeds a fixed threshold and are unable to distinguish differences in crowd gathering patterns across different time periods. For example, the natural increase in crowd density during lunch breaks can be misjudged as an anomaly. However, this solution, by introducing dynamic reference values ​​generated by historical data, can accurately identify gathering behaviors that deviate from normal time patterns. The static threshold method used in related technologies cannot adapt to the cyclical changes in crowd flow, resulting in a high false alarm rate. However, this solution establishes a dynamic benchmark in the time dimension, effectively reducing the probability of misjudgment caused by time period differences.

[0067] Through the above-mentioned technical solution, this application overcomes the technical deficiency of traditional access control systems, which are unable to dynamically assess abnormal crowd gatherings based on temporal patterns. Specifically, this solution can accurately distinguish between fluctuations in crowd density during normal periods and real safety hazards. For example, when a high-density crowd gathering that does not conform to historical patterns is detected during non-peak hours on weekdays, an alarm mechanism can be accurately triggered. This also avoids misjudging the sparse crowd conditions during special holiday periods as normal. By establishing a dynamic reference benchmark, the system possesses time-sensitive judgment capabilities.

[0068] This application further proposes that physiological data be collected through a non-contact physiological data sensor, wherein the physiological data include heart rate and body temperature. Figure 4 , taking the access control system as an example, the following steps are included:

[0069] 401. Determine a first initial suspiciousness level based on the card swiping method and card swiping posture;

[0070] 402. Determine a second initial suspicion level based on the heart rate, body temperature, card swiping posture, and standing position;

[0071] 403. Determine a first suspicion level based on the first initial suspicion level and the second initial suspicion level.

[0072] Among them, non-contact physiological data sensors refer to devices that can collect physiological indicators without direct contact with the target object. Specifically, they can be implemented using infrared thermal imaging sensors or millimeter-wave radar sensors. They are used to obtain the user's heart rate and body temperature data in real time, avoiding interference with normal card swiping operations while capturing potential physiological abnormalities. The card swiping method refers to the physical operation characteristics of the user when performing a card swiping action on the access control device. Specifically, it can include the card swiping position and card swiping trajectory. Behavioral abnormalities are identified by analyzing the spatial operation pattern of the user when swiping the card. The card swiping posture refers to the body posture of the user when holding and swiping the card. Specifically, a camera can be used to capture images and identify them through a posture estimation algorithm to detect abnormal postures that are inconsistent with the user's historical habits. The standing position refers to the spatial coordinates of the user's feet relative to the access control device when swiping the card. Specifically, it can be measured using a pressure-sensitive floor mat or a laser positioning device to determine whether the user is in the normal operation area.

[0073] Specifically, when a user swipes their card, contactless sensors simultaneously collect heart rate and body temperature data. For example, millimeter-wave radar is used to detect chest movement frequency to calculate heart rate, while infrared thermal imaging measures body surface temperature. The card swipe location is recorded by the access control device's built-in touch sensor, and the swipe trajectory is generated into continuous path data using a trajectory tracking algorithm. Simultaneously, a camera captures an image of the user's upper body, and a convolutional neural network is used to identify the angle of the card-holding hand and body inclination to determine the swiping posture. A pressure mat records the coordinates of the user's feet. The calculation of the first initial suspicion level involves: calculating the Euclidean distance between the current swiping location and the cluster center of the user's historical swiping locations; a greater distance indicates a higher suspicion level; performing dynamic time warping on the current swiping trajectory and the user's historical trajectory fitting curve; a lower similarity indicates a higher suspicion level; and comparing the current swiping posture with the user's historical posture database; a greater difference indicates a higher suspicion level. The calculation of the second initial suspicion level involves: establishing a model for the normal range of heart rate and body temperature, raising the suspicion level when the detected values ​​exceed the threshold; analyzing the distance of the standing position from the normal area, and conducting a comprehensive assessment based on the spatial rationality of the swiping posture. Finally, the two types of suspicion levels are linearly fused through preset weights to generate a comprehensive suspicion index that reflects multi-dimensional behavioral characteristics.

[0074] Compared to related technologies, existing access control systems only verify card permissions and record swipe times, failing to detect physiological anomalies or behavioral deviations during user operations. For example, traditional solutions cannot identify a cardholder's elevated heart rate due to stress during duress, nor can they detect subtle deviations when an attacker mimics the swipe path of a legitimate user. This solution, by integrating contactless physiological monitoring with multimodal behavioral analysis, effectively identifies abnormal access behaviors disguised as normal operations while maintaining seamless verification.

[0075] Through the above technical solution, this application can detect physiological fluctuations and abnormal operational behavior of users during card swiping in real time, solving the problem of identifying masquerading attacks caused by traditional access control systems relying solely on static permission verification. Through multi-dimensional data fusion analysis, it can accurately distinguish normal operations from abnormal situations such as coercion and masquerade, improving the real-time and accuracy of security risk assessments and preventing illegal intruders from using legitimate cards to carry out covert attacks.

[0076] The present application further proposes that a card swiping method includes a card swiping position and a card swiping trajectory, and a first initial suspicious degree is determined based on the card swiping method and the card swiping posture, including: determining the suspicious degree of the card swiping position based on the distance between the card swiping position and multiple reference card swiping positions, the multiple reference card swiping positions are obtained by clustering multiple historical card swiping positions of the access control card on the target access control, and the reference card swiping position is the cluster center; determining the suspicious degree of the card swiping trajectory based on the trajectory similarity between the card swiping trajectory and multiple reference card swiping trajectories, the multiple reference card swiping trajectories are obtained by fitting multiple historical card swiping trajectories of the access control card on the target access control; determining the posture type of the card swiping posture; determining the suspicious degree of the card swiping posture based on the posture type and the distance between the card swiping posture and multiple historical card swiping postures The suspicious degree of the posture is determined based on the posture similarity between the postures, and the multiple historical card swiping postures are the card swiping postures used by the object using the access control card when swiping the card on the target access control; the first initial suspicious degree is determined based on the suspicious degree of the position, the suspicious degree of the card swiping trajectory and the suspicious degree of the posture; the second initial suspicious degree is determined based on the heart rate, body temperature, card swiping posture and standing position, including: determining the suspicious degree of the state of the target object based on the heart rate and body temperature; determining the suspicious degree of the posture of the target object based on the card swiping method, card swiping trajectory and standing position; determining the second initial suspicious degree based on the suspicious degree of the state and the suspicious degree of the posture; and weighted fusion of the first initial suspicious degree and the second initial suspicious degree to obtain the first suspicious degree.

[0077] The swipe location refers to the physical coordinate point where the user touches the access control reader with their card. This can be achieved by using image recognition technology or a pressure sensor array to capture the coordinates of the swipe contact area. By comparing the distance difference between the current swipe location and the center of the historical swipe location cluster, abnormal operations that deviate from the normal swipe pattern can be detected. The swipe trajectory refers to the spatial path formed by the movement of the card during the swipe process. This can be achieved by using a motion capture sensor to record the coordinate sequence of the card's movement trajectory. By calculating the similarity difference between the current trajectory and the historical fitted trajectory, abnormal swipe actions can be identified. The posture type refers to the classification label of the user's body posture when swiping the card. This can be achieved by using a three-dimensional posture estimation algorithm to analyze the joint angles of the surveillance video. By matching the similarity of the current posture with the historical posture library, abnormal postures in disguised or coerced states can be detected. The posture suspiciousness refers to the abnormal spatial correlation between the user's standing position and the swipe action trajectory. This can be achieved by using a spatial coordinate system conversion algorithm to calculate the relative position relationship between the body's center of gravity and the swipe trajectory. By analyzing posture coordination, deliberate concealment can be identified.

[0078] Specifically, this solution constructs a suspicion assessment model through the fusion of multi-dimensional dynamic features. First, the coordinates of the current card swipe location are collected, and the Euclidean distance between it and the cluster center of historical card swipe locations is calculated. A larger distance indicates a higher suspicion level. Next, the coordinate sequence of the current card swipe trajectory is extracted and matched against the fitted curve of the historical card swipe trajectory using dynamic time warping similarity. The lower the similarity, the higher the suspicion level. Simultaneously, a gesture recognition algorithm is used to classify the user's swiping gesture. If the current gesture type does not appear in the historical gesture library or the skeletal similarity with the historical gesture falls below a threshold, the gesture suspicion level is triggered. A weighted sum of these three indicators is used to generate a first initial suspicion level. Furthermore, an infrared thermal imager is used to capture the user's heart rate and body temperature data. If the heart rate exceeds the normal range or the body temperature fluctuates abnormally, the state suspicion level is increased. Posture coordination is calculated by combining the spatial offset between the user's standing position and the card swipe trajectory. A larger offset indicates a higher suspicion level. Finally, the first initial suspicion level is linearly fused with the second initial suspicion level according to preset weights to generate a comprehensive first suspicion level value.

[0079] Compared to related technologies, traditional access control systems only verify card permissions and record swipe times, failing to capture the dynamic characteristics of user behavior. For example, related technologies lack quantitative analysis of behavioral characteristics such as card swipe position deviation, trajectory anomalies, and sudden changes in posture, and even fail to correlate physiological data with behavioral posture. This solution, through multi-sensor data fusion and machine learning models, enables multi-dimensional dynamic monitoring of user operating habits, physiological state, and behavioral coordination, capable of identifying anomalous operating patterns that disguise legitimate permissions.

[0080] Through the above technical solution, this application effectively solves the problem of missed detection of abnormal behaviors caused by the single permission verification mechanism of traditional access control systems. By integrating the dynamic feature analysis of card swiping location, trajectory, and posture with the physiological state detection of heart rate and body temperature, it can accurately identify security threats such as forced access and identity fraud. For example, when an attacker steals a legitimate card but uses an unconventional posture to swipe the card, the system can detect the anomaly through posture type matching and trajectory similarity analysis; when the user's heart rate rises abnormally due to coercion, the system can trigger an early warning in combination with posture coordination detection. This solution significantly improves the access control system's dynamic perception of potential security risks and the recognition accuracy of complex abnormal patterns.

[0081] This application further proposes a method for determining a second suspicious degree of a target object based on the first action path, the second action path, the first object image, and the second object image. Figure 5 , taking the access control system as an example, the specific implementation includes:

[0082] 501. Determine the suspiciousness level of the first action path based on a comparison between the first action path and a plurality of conventional action paths;

[0083] 502. Determine the suspiciousness level of the second action path based on the candidate locations and their stay time in the second action path;

[0084] 503. Determine the suspiciousness of the performance based on the expression and movement change information extracted from the first object image and the second object image;

[0085] 504. Finally, the suspicion levels of the three dimensions are integrated to obtain the second suspicion level.

[0086] The "normal movement path" refers to the extraction of the most frequently occurring path patterns after clustering analysis of the historical movement trajectories of card swipers before reaching the target access control station. This can be achieved using the DBSCAN clustering algorithm combined with trajectory similarity calculation, and is used to identify abnormal behavior that deviates from the normal path. The "candidate location" refers to the set of coordinate points that the target subject passes through within the confidential area after passing the access control station. Specifically, an indoor positioning system can be used to record the movement trajectory and extract coordinate points where the dwell time exceeds a set threshold for analyzing abnormal dwell behavior. The dwell time refers to the length of time the target subject resides at a single candidate location. This can be calculated by timestamp difference and is used to assess the degree of attention paid to sensitive areas. Expression change information refers to the differences in facial expression features between the target subject swiping the card and after entering the access control station. Specifically, a convolutional neural network can be used to extract the motion vectors of facial key points to capture emotional fluctuations. Movement change information refers to the differences in the target subject's body movements between the time of swiping the card and after entering the access control station. Specifically, the OpenPose algorithm can be used to extract the motion trajectories of skeletal joints to identify abnormal body movements.

[0087] Specifically, when the target object swipes the card to enter the confidential area, its external movement path is first matched with the conventional path library for similarity. For example, if an employee usually goes straight from the main entrance along the corridor to the laboratory access control, but detoured to the unauthorized area and then turned back before swiping the card this time, the system will mark the path as deviating from the normal pattern. After entering the confidential area, the system continues to track its movement trajectory. When it detects repeated stops in the core equipment area and a single stop lasting more than 15 minutes, the suspicion index is automatically increased based on the security level of the area. At the same time, by comparing the video data at the moment of swiping the card and after entering, if it detects an increase of 60% in facial muscle tension and an abnormal increase in the frequency of hand shaking, the system determines that there is a sudden change in physiological state. After these three types of features are standardized, they are fused according to the preset weights to generate a comprehensive suspicion level score, which triggers a graded early warning mechanism.

[0088] Compared to related technologies, traditional access control systems only record entry and exit paths but lack behavioral pattern analysis, making them unable to identify unusual trajectories disguised as legitimate routes. For example, existing solutions cannot determine whether detouring to a non-work area and then returning to the access control system is abnormal, nor can they quantify whether the length of time spent in sensitive areas complies with regulations. This solution, by establishing a path pattern library, a dwell time model, and a physiological signature analysis model, enables multi-dimensional detection of unusual trajectories, unusual dwell times, and disguised behaviors, addressing the vulnerability of single-dimensional assessments to interference.

[0089] Through the above technical solution, this application can effectively identify abnormal access behaviors disguised as legitimate identities, such as outsiders following in and then detouring to unauthorized areas. It can also accurately detect potential threats that overstay in sensitive areas, such as insiders illegally accessing confidential equipment. Furthermore, by capturing sudden changes in facial expressions and movements before and after entry, it can promptly detect abnormalities in people under duress, such as abnormal physiological characteristics exhibited by people held hostage after entering.

[0090] This application further proposes a method for assessing the degree of suspicion based on the target object's path and behavioral dynamics before and after entering a confidential area. This method includes: determining the path suspicion by calculating the similarity between the target object's path before entry and the conventional path; calculating the path suspicion based on the target object's duration and frequency of visits to sensitive areas after entry; extracting the target object's facial expressions and movement changes before and after swiping the card to generate a performance suspicion level; and finally, forming a comprehensive assessment result by weighted fusion of the three types of suspicion levels.

[0091] The first action path refers to the target object's movement trajectory outside the confidential area before reaching the target access control. This can be achieved using a positioning system or video trajectory tracking technology to determine whether the access path conforms to normal behavior patterns. The second action path refers to the target object's movement trajectory within the confidential area after passing through the access control. The coordinate sequence can be collected through an indoor positioning system to identify abnormal access behavior in the area. The candidate location refers to the set of coordinate points actually reached by the target object within the confidential area. This is achieved by dividing the area into grids using geo-fencing technology and is used to quantify access characteristics of sensitive areas. The dwell time refers to the length of time the target object remains at each candidate location. This can be achieved by calculating the timestamp difference and is used to identify abnormal dwelling behavior. Expression change information refers to the difference in facial expression between the target object before and after swiping the card and entering. This can be achieved by extracting facial muscle movement features using a convolutional neural network to capture micro-expression changes under duress. Movement change information refers to the difference in the target object's body movements before and after the access control operation. This can be achieved by extracting joint movement trajectories using a skeletal key point tracking algorithm and is used to identify unnatural behavior patterns.

[0092] Specifically, when the target object passes through the access control and enters the confidential area, the system first performs a path matching analysis on its movement trajectory before entering. By calculating the similarity between the trajectory and the set of historical conventional paths, the closest conventional path is selected as a benchmark, and the path suspicion level value is generated based on the matching deviation. After entering the confidential area, the system continues to track the movement trajectory of the target object, identifying the location of the sensitive areas it visits and the length of time it stays there. By establishing a regional sensitivity grading model, the suspicion level of the action path is calculated based on the frequency and duration of the target object's stay in the sensitive area. At the same time, the system uses the video analysis module to extract the differences in the target object's facial features at the moment of swiping the card and after entering, as well as the changes in the continuity of the body movements, and maps them to the degree of suspicion after feature fusion. Finally, the three types of suspicion levels are linearly weighted according to the preset weights, and the second suspicion level value of the comprehensive evaluation is output.

[0093] Compared with related technologies, traditional access control systems only record basic information such as card swipe time and location, lacking the ability to continuously track the dynamic characteristics of access paths. Existing solutions are unable to analyze abnormal deviations from the path before entry, such as suspicious behavior such as circumventing monitoring blind spots or repeated wandering. By integrating complete path data before and after entry and combining it with access characteristics of sensitive areas, this solution can effectively identify abnormal movement patterns that disguise legitimate authority. In addition, related technologies do not consider the physiological and behavioral characteristics of the target object. By analyzing the dynamic changes in expression and movement, this solution can capture involuntary physiological reactions under duress, thus compensating for the shortcomings of traditional permission verification mechanisms.

[0094] Through the above technical solution, the present application can accurately identify abnormal lingering behavior after entering a confidential area under disguised legal authority, such as repeatedly wandering around or overstaying in a sensitive equipment area. It can effectively detect the behavioral patterns of insiders illegally accessing unauthorized areas, such as bypassing conventional paths to access high-security areas. By analyzing the mutation characteristics of expressions and movements, unnatural behavior of people under duress can be discovered in a timely manner, avoiding security vulnerabilities caused by traditional access control systems that rely solely on physical cards. This solution realizes a multi-dimensional dynamic assessment of complex security risks, significantly improving the accuracy of identifying internal threats and abnormal access behaviors.

[0095] This application further proposes that when the initial fusion suspicion level reaches a threshold, the target object's behavior sequence inside and outside the confidential area and its path after leaving the confidential area are further analyzed, and the secondary fusion suspicion level is used to determine whether to trigger an alarm. Figure 6 , specifically including:

[0096] 601. The first suspicious degree and the second suspicious degree are combined to obtain a first combined suspicious degree;

[0097] 602. When the first fused suspicion level exceeds the second suspicion level threshold, a third suspicion level is determined based on the target object's behavior sequence in the confidential area, the behavior sequence after leaving the confidential area, and the action path;

[0098] 603. Fusing the first, second, and third suspicion levels a second time to obtain a second fused suspicion level; and determining whether to trigger an alarm based on whether the second fused suspicion level exceeds a third suspicion level threshold.

[0099] Among them, the first behavior sequence refers to multiple behavior records of the target object in the confidential area, which can be specifically implemented by a behavior log collection module to capture the target object's operating behavior in the sensitive area. The second behavior sequence refers to the behavior record of the target object after leaving the confidential area, which can be specifically implemented by an external monitoring device to track the target object's interaction with the external environment. The third action path refers to the movement trajectory outside the confidential area after leaving the target access control, which can be specifically implemented by video tracking to analyze the target object's action intentions after leaving. The second suspicious degree threshold refers to the critical value that triggers subsequent behavioral analysis, which can be specifically implemented by a dynamic threshold algorithm to automatically adjust the threshold size according to the security level. The third suspicious degree threshold refers to the global risk critical value that triggers the final alarm, which can be specifically implemented by a multi-dimensional risk assessment model to comprehensively judge the overall security risk level.

[0100] Specifically, when the suspicious degree of the target object's card swiping behavior and the suspicious degree of the action path are initially integrated to reach the preset risk level, the system will start continuous tracking of subsequent behaviors. For example, after the target object enters the confidential area, the system records its operation frequency and length of stay on each sensitive device to form a first behavior sequence, and collects its contact records with external personnel after leaving to form a second behavior sequence. By comparing the deviation between the historical behavior pattern and the current behavior sequence, the third suspicious degree is calculated. Furthermore, the system matches the movement trajectory of the target object after leaving the confidential area with the regular path for similarity. If it is found that it detoured to an unauthorized area, the evaluation value of the third suspicious degree is increased. Finally, the suspicious degrees of the three stages are weighted and fused, and the alarm mechanism is triggered when the comprehensive evaluation value exceeds the global threshold.

[0101] Compared with related technologies, traditional access control systems only judge risks based on single card swipe behaviors and static permission rules, and are unable to identify abnormal behavior after authorization. This solution establishes a multi-stage risk assessment mechanism by dynamically tracking the complete behavior chain of the target object before entry, during stay, and after departure. For example, related technologies lack the ability to monitor the behavior of legitimate cardholders who stay in sensitive areas for a long time after entering, while this solution can effectively identify the risk of abnormal stay by analyzing the length of stay and the frequency of operations. At the same time, traditional solutions have no mechanism to track the behavioral trajectory after leaving, but this solution, by integrating external action path data, can detect high-risk behaviors such as cardholders interacting with external devices immediately after leaving.

[0102] Through the above technical solution, this application can significantly reduce false alarms caused by single misjudgments of behavior, while also improving the ability to identify persistent security threats. For example, when a cardholder's swiping posture is abnormal but subsequent behavior is within specifications, the system can avoid false alarm triggering through a secondary assessment. Furthermore, when a cardholder frequently visits unauthorized areas after entering and their movements after leaving are abnormal, the system can accurately identify potential risks. This solution effectively addresses the lack of post-authorization behavior monitoring in traditional access control systems, achieving an upgrade in security assessment from single-point detection to full-process monitoring.

[0103] This application further proposes a technical solution for determining a third level of suspicion based on the target object's first behavioral sequence, second behavioral sequence, and third behavioral path. Specifically, this solution includes: determining the first level of suspicion by comparing the first behavioral sequence with the second behavioral sequence; determining the second level of suspicion by combining the second behavioral sequence with the behavioral norm; determining the third level of suspicion by analyzing the similarity between the third behavioral path and the conventional path; and finally, combining these three levels of suspicion to obtain the third level of suspicion.

[0104] The first behavior sequence refers to the target subject's behavioral records within the confidential area. This can be achieved using log data that associates timestamps with behavior types, such as device operation records and file access records. This feature is used to capture user behavior patterns within the confidential area and provide a data foundation for subsequent behavioral pattern mutation analysis.

[0105] The second behavior sequence refers to the set of behavioral records of the target subject after leaving the confidential area. This can be achieved using operational behavior sequence data collected by IoT devices, such as terminal operation records and network access records. This feature is used to track subsequent behavior after the user leaves and identify anomalies in cross-regional behavior.

[0106] Among them, the third action path refers to the movement trajectory outside the confidential area after leaving the target access control, which can be achieved by video acquisition and analysis, and specifically by using the video tracking method in related technologies.

[0107] Behavioral norms refer to security operating standards defined within confidential areas. These can be implemented using a structured rule base or behavioral flowcharts, such as data operation specifications and equipment usage procedures. This feature provides a benchmark for behavioral compliance verification and supports the automatic identification of explicit violations.

[0108] Specifically, after the target completes their activities within the confidential area and leaves, the system continuously collects data on their subsequent behavior. First, a clustering algorithm analyzes the differences in behavioral patterns between the first behavioral sequence (e.g., file copying, device operation) and the second behavioral sequence (e.g., network upload, terminal operation). For example, if a user downloads a sensitive file and immediately performs a large-scale data transfer, the system generates a suspiciousness score for the first behavior. Second, the second behavioral sequence is matched against behavioral specifications, for example, by detecting whether necessary data encryption steps are performed. The suspiciousness of the second behavior is determined by counting illegal operations. Simultaneously, trajectory similarity is calculated for the third behavioral path. For example, if the user detoured to an unauthorized area after leaving or remained in the computer room corridor for an extended period, the suspicion of the third behavioral path is determined by the degree of deviation from the normal path. Finally, a weighted fusion of these three suspiciousness scores is used to assess the risk of the user's ongoing behavior after leaving the premises.

[0109] Compared to related technologies, traditional access control systems only record single card swipe events and lack continuous monitoring of user behavior after leaving the premises. Existing solutions cannot identify behavioral chain risks, such as a user operating a device normally within a secure area but transmitting abnormal data after leaving the premises. They also cannot detect suspicious movements where the exit path deviates from the normal route. This solution achieves closed-loop monitoring of user behavior throughout its entire lifecycle by building a cross-regional behavioral sequence association analysis model and combining it with a dynamic path trajectory matching mechanism.

[0110] Through the above-mentioned technical solution, this application effectively addresses the problem of traditional access control systems' inadequate continuous behavior monitoring. Specifically, it can identify the associated risks between compliant operations within confidential areas and abnormal behavior after leaving, such as the combined threat of normal access and abnormal data leakage; automatically detect explicit violations of operational procedures, such as failure to perform data erasure procedures; and promptly identify suspicious movements that deviate from conventional paths, such as detours around sensitive areas. These technical effects collectively enhance the temporal coverage and behavioral relevance of security risk assessments.

[0111] The present application further proposes determining the suspicious degree of the first behavior of the target object based on the first behavior sequence and the second behavior sequence, determining the suspicious degree of the second behavior of the target object based on the second behavior sequence and the behavioral norms of the target confidential area, determining the suspicious degree of the third action path of the target object based on the third action path and multiple third reference action paths, and determining the third suspicious degree of the target object based on the suspicious degree of the first behavior, the suspicious degree of the second behavior, and the suspicious degree of the third action path.

[0112] Among them, the first behavior sequence refers to a collection of multiple behaviors of the target object in the target confidential area arranged in chronological order. Specifically, it can be implemented by using the data of the stop location, operation device type and interaction duration collected by the behavior sensor, which is used to reflect the activity pattern of the target object in the confidential area. The second behavior sequence refers to a collection of multiple behaviors of the target object after leaving the target confidential area, which is arranged in chronological order. Specifically, it can be implemented by using the behavior data recorded by the mobile terminal operation log or the external monitoring system, which is used to capture the behavioral continuity characteristics after the target object leaves. The third action path refers to the movement trajectory of the target object outside the target confidential area after leaving the target access control. Specifically, it can be generated by indoor positioning system or video trajectory tracking technology, which is used to analyze the path compliance in the departure stage. The third reference action path is a set of conventional paths with the highest frequency of use based on historical data statistics. Specifically, the typical trajectory pattern can be extracted through the path clustering algorithm as a benchmark for judging the abnormality of the path.

[0113] Specifically, during the behavior analysis phase within the confidential area, pattern mining is performed on the first behavior sequence to extract behavioral patterns within the sensitive area, such as the location distribution of frequently accessed devices or fixed operational procedures. Simultaneously, during the post-departure behavior analysis phase, the second behavior sequence is analyzed for temporal features to identify any subsequent actions that are logically linked to the confidential area behavior. By comparing the pattern differences between the two behavior sequences, logical inconsistencies in cross-regional behavior can be detected, such as the abnormal behavior of immediately transferring data to an external network device after entering the confidential area to perform a data export operation. During the regulatory compliance assessment, the second behavior sequence is matched against a predefined behavioral rule library for the confidential area, such as prohibiting the operation of specific devices during unauthorized hours or restricting file transfers. The degree of behavioral deviation is determined by calculating the number of violations and weighting their severity. During the path compliance assessment, a dynamic time warping algorithm is used to calculate the similarity between the third action path and the regular path, identifying suspicious movement patterns such as detours around monitoring blind spots, repeated backtracking, or unusual stops. Finally, a linear weighted fusion of three indicators is used to form a quantitative assessment of post-departure behavior risk.

[0114] It should be noted that the above description is illustrated using the access control system as an example of the execution entity. In other possible implementations, the access control system can also collect data and send the collected data to the server, which will perform specific data processing tasks. This embodiment of the present application does not limit this.

[0115] All of the above optional technical solutions can be combined in any way to form optional embodiments of the present application, and will not be described in detail here.

[0116] Compared to related technologies, traditional access control systems only record entry and exit times and location information, lacking continuous tracking and analysis of user behavior sequences. Existing solutions are unable to establish correlation analysis between behaviors within and outside of confidential areas, and are unable to effectively identify legitimate users who conduct illegal cross-region operations. Conventional path monitoring is often limited to trajectory detection during the entry phase and does not cover post-exit movement path analysis, resulting in abnormal exit behavior becoming a security blind spot. This solution achieves closed-loop monitoring of the entire user behavior chain by constructing a cross-region behavior sequence analysis model, combining standard matching with path similarity detection.

[0117] Figure 7 This is a schematic diagram of a management system for access control data based on big data provided by an embodiment of the present application. Figure 7 The system includes: a safety hazard determination module 701, a first suspicion level determination module 702, a second suspicion level determination module 703 and a trigger judgment module 704.

[0118] The security hazard determination module 701 is used to determine whether the access card used in the swiping operation has access permission in response to the target object's card swiping operation on the target access control in the target confidential area, and to determine whether there is a security hazard based on the card information of the access card and the spatial information of the target confidential area. The card information includes the current swiping time and swiping time pattern of the access card. The spatial information is used to indicate the distribution of personnel in the target confidential area, and the swiping time pattern is used to indicate the swiping time habit of the access card.

[0119] The first suspicion level determination module 702 is used to open the target access control and determine the first suspicion level of the target object based on the card swiping method of the access control card on the target access control, the target object's physiological data and card swiping reference information when the access control card has access permission and there is a safety hazard. The card swiping reference information includes the card swiping posture and the standing position when swiping the card.

[0120] The second suspicious level determination module 703 determines the second suspicious level of the target object based on the first movement path, the second movement path, the first object image and the second object image of the target object, when the first suspicious level is greater than or equal to the first suspicious level threshold, wherein the first movement path is the movement path outside the target confidential area before reaching the target access control, the second movement path is the movement path within the target confidential area after passing through the target access control, the first object image is the object image when swiping the card, and the second object image is the object image after passing through the target access control.

[0121] The triggering judgment module 704 is configured to determine whether to trigger an alarm for the target object based on the first suspicion level and the second suspicion level, where the alarm is used to indicate that the target object has a security risk.

[0122] It should be noted that the management system for access control data based on big data provided in the above embodiment only uses the division of the above functional modules as an example to illustrate the management of access control data. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device can be divided into different functional modules to complete all or part of the functions described above. In addition, the management system for access control data based on big data provided in the above embodiment and the embodiment of the method for managing access control data based on big data belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0123] Figure 8 This is a schematic diagram of the structure of a server provided in an embodiment of the present application. The server 800 may have relatively large differences due to different configurations or performances, and may include one or more processors (Central Processing Units, CPU) 801 and one or more memories 802, wherein the one or more memories 802 store at least one computer program, and the at least one computer program is loaded and executed by the one or more processors 801 to implement the methods provided in the above-mentioned various method embodiments. Of course, the server 800 may also have components such as a wired or wireless network interface, a keyboard, and an input / output interface for input and output. The server 800 may also include other components for implementing device functions, which will not be described in detail here.

[0124] In an exemplary embodiment, a computer-readable storage medium is also provided, such as a memory including a computer program. The computer program can be executed by a processor to implement the method for managing access control data based on big data in the above embodiment. For example, the computer-readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc (CD-ROM), a magnetic tape, a floppy disk, or an optical data storage device.

[0125] In an exemplary embodiment, a computer program product or computer program is also provided, which includes a program code, which is stored in a computer-readable storage medium. The processor of a computer device reads the program code from the computer-readable storage medium, and the processor executes the program code, so that the computer device executes the above-mentioned big data-based access control data management method.

[0126] In some embodiments, the computer program involved in the embodiments of the present application may be deployed and executed on a computer device, or on multiple computer devices located at one location, or on multiple computer devices distributed at multiple locations and interconnected through a communication network. Multiple computer devices distributed at multiple locations and interconnected through a communication network may constitute a blockchain system.

[0127] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or may be accomplished by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0128] The above are only optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for managing access control data based on big data, characterized in that: The method comprises: In response to a target subject swiping a card at a target access control station in a target confidential area, determining whether the access card used in the swiping operation has access permission and determining whether there is a security risk based on the card information of the access card and spatial information of the target confidential area, the card information including the current swipe time and swipe time pattern of the access card, the spatial information indicating the distribution of people in the target confidential area, and the swipe time pattern indicating the swipe time habits of the access card; If the access card has access privileges and there is a potential safety hazard, the target access control is opened and a first suspicious degree of the target object is determined based on a swiping method of the access card on the target access control, physiological data of the target object, and swiping reference information, the swiping reference information including a swiping posture and a standing position when the card is swiped; If the first suspicion level is greater than or equal to a first suspicion level threshold, determining a second suspicion level of the target object based on a first movement path, a second movement path, a first object image, and a second object image of the target object, wherein the first movement path is a movement path outside the target confidential area before reaching the target access control station, the second movement path is a movement path within the target confidential area after passing through the target access control station, the first object image is an image of the object when the card is swiped, and the second object image is an image of the object after passing through the target access control station; Based on the first suspicion level and the second suspicion level, it is determined whether to trigger an alarm for the target object, where the alarm is used to indicate that there is a security risk with respect to the target object.

2. The method according to claim 1, characterized in that The personnel distribution includes historical personnel distribution and current personnel distribution. The determining whether there is a security risk based on the card information of the access card and the spatial information of the target confidential area includes: Determining a time anomaly degree corresponding to the card swiping operation based on the current card swiping time and the card swiping time pattern; Determine the abnormality level of the personnel distribution corresponding to the current card swiping time based on the current card swiping time, the historical personnel distribution, and the current personnel distribution; Determining a target abnormality level corresponding to the card swiping operation based on the time abnormality level and the personnel distribution abnormality level; If the target abnormality level is greater than or equal to an abnormality level threshold, determining that a security risk exists, wherein the abnormality level threshold is determined based on the security level of the target confidential area; When the target abnormality level is less than the abnormality level threshold, it is determined that there is no safety hazard.

3. The method according to claim 2, characterized in that The determining, based on the current card swiping time, the historical personnel distribution, and the current personnel distribution, of the abnormality degree of the personnel distribution corresponding to the current card swiping time includes: Determine a reference personnel distribution based on the current card swiping time and the historical personnel distribution; Based on the reference personnel distribution and the current personnel distribution, the abnormality degree of the personnel distribution corresponding to the current card swiping time is determined.

4. The method according to claim 1, wherein The physiological data is collected by a contactless physiological data sensor, and the physiological data includes heart rate and body temperature. The determining of the first suspiciousness level of the target object based on the swiping method of the access card on the target access control, the physiological data of the target object, and the card swiping reference information includes: Determining a first initial suspicion level based on the card swiping method and the card swiping posture, where the first initial suspicion level is a suspicion level associated with the card swiping method and the card swiping posture; determining a second initial suspicion level based on the heart rate, the body temperature, the card swiping posture, and the standing position, where the second initial suspicion level is a suspicion level associated with the physiological data and the card swiping reference information; The first suspicion level is determined based on the first initial suspicion level and the second initial suspicion level.

5. The method according to claim 4, characterized in that The card swiping method includes a card swiping position and a card swiping trajectory, and determining a first initial suspicious degree based on the card swiping method and the card swiping posture includes: Determine the suspicious degree of the card swiping position based on the distance between the card swiping position and multiple reference card swiping positions, where the multiple reference card swiping positions are obtained by clustering multiple historical card swiping positions of the access control card on the target access control, and the reference card swiping position is the cluster center; determine the suspicious degree of the card swiping trajectory based on the trajectory similarity between the card swiping trajectory and the multiple reference card swiping trajectories, where the multiple reference card swiping trajectories are obtained by fitting multiple historical card swiping trajectories of the access control card on the target access control; determine the posture type of the card swiping posture; determine the suspicious degree of the posture based on the posture type and the posture similarity between the card swiping posture and multiple historical card swiping postures, where the multiple historical card swiping postures are card swiping postures used by the object using the access control card when swiping the card on the target access control; determine the first initial suspicious degree based on the suspicious degree of the position, the suspicious degree of the card swiping trajectory, and the suspicious degree of the posture; The determining of a second initial suspicion level based on the heart rate, the body temperature, the card swiping posture, and the standing position includes: Determining a suspicious degree of the target object's state based on the heart rate and the body temperature; determining a suspicious degree of the target object's posture based on the card swiping method, the card swiping trajectory, and the standing position; and determining a second initial suspicious degree based on the suspicious degree of the state and the suspicious degree of the posture; The determining the first suspicion level based on the first initial suspicion level and the second initial suspicion level includes: The first initial suspicion level and the second initial suspicion level are weightedly fused to obtain the first suspicion level.

6. The method according to claim 1, characterized in that The determining a second suspiciousness level of the target object based on the first motion path, the second motion path, the first object image, and the second object image includes: Determining a suspiciousness level of the first motion path of the target object based on the first motion path and a plurality of first reference motion paths, wherein the plurality of first reference motion paths are regular motion paths to the target access control, and the regular motion path is the motion path that is used the most times; determining a plurality of candidate locations that the second motion path passes through and a dwell time at each of the candidate locations; and determining a degree of suspicion of the second motion path of the target object based on the plurality of candidate locations and the dwell time at each of the candidate locations; Determining expression change information and action change information of the target object based on the first object image and the second object image; determining a suspicious degree of the target object's behavior based on the expression change information and action change information of the target object; A second suspicious degree of the target object is determined based on the first action path suspicious degree, the second action path suspicious degree, and the performance suspicious degree.

7. The method according to claim 6, characterized in that The determining, based on the first action path and a plurality of first reference action paths, a suspicious degree of the first action path of the target object includes: determining a path similarity between the first action path and each first reference action path; determining a first reference action path having the highest path similarity with the first action path among the plurality of first reference action paths as a first target reference action path; and determining a degree of suspicion of the action path corresponding to the first target reference action path as a degree of suspicion of the first action path; The determining, based on the plurality of candidate locations and the dwell time at each candidate location, a suspicious degree of the second action path of the target object includes: Determining the target object's action sensitivity based on the importance level of each candidate location; determining the target object's interest in each candidate location based on the number of arrivals and residence time at each candidate location; determining a target location from the multiple candidate locations based on the target object's interest in each candidate location, the target location being the candidate location with the highest interest among the multiple candidate locations; determining the suspiciousness of the target object's second action path based on the action sensitivity and the target location; The determining the suspiciousness of the target object's behavior based on the expression change information and the action change information of the target object includes: Extracting features from the expression change information and the action change information to obtain expression change features and action change features of the target object; fusing the expression change features and the action change features to obtain target change features of the target object; and mapping the target change features to obtain the suspicious degree of the performance; The determining of the second suspicious degree of the target object based on the suspicious degree of the first action path, the suspicious degree of the second action path, and the suspicious degree of the performance includes: The first action path suspicion level, the second action path suspicion level, and the performance suspicion level are weighted and fused to obtain a second suspicion level of the target object.

8. The method according to claim 1, characterized in that The determining whether to trigger an alarm for the target object based on the first suspicion level and the second suspicion level includes: fusing the first suspicion level and the second suspicion level to obtain a first fused suspicion level; When the first fusion suspicion level is greater than or equal to a second suspicion level threshold, determining a third suspicion level of the target object based on a first behavior sequence, a second behavior sequence, and a third action path of the target object, wherein the first behavior sequence includes multiple behaviors of the target object within the target confidential area, the second behavior sequence includes multiple behaviors of the target object after leaving the target confidential area, and the third action path is a path of action outside the target confidential area after leaving the target access control area; fusing the first suspicion level, the second suspicion level, and the third suspicion level to obtain a second fused suspicion level; If the second fusion suspicion level is greater than or equal to a third suspicion level threshold, determining to trigger an alarm for the target object; If the second fusion suspicion level is less than the third suspicion level threshold, it is determined not to trigger an alarm for the target object.

9. The method according to claim 8, characterized in that The determining of a third suspiciousness level of the target object based on the first behavior sequence, the second behavior sequence, and the third action path of the target object includes: Determining a suspicious degree of the first behavior of the target object based on the first behavior sequence and the second behavior sequence; Determining a suspicious degree of the second behavior of the target object based on the second behavior sequence and the behavior norm of the target confidential area; Determining a suspiciousness level of the third motion path of the target object based on the third motion path and multiple third reference motion paths, wherein the multiple third reference motion paths are regular motion paths for leaving the target access control area, and the regular motion path is the motion path that is used most frequently; A third suspicious degree of the target object is determined based on the first behavior suspicious degree, the second behavior suspicious degree, and the third action path suspicious degree.

10. A management system for access control data based on big data, characterized in that: The system comprises: a security risk determination module for, in response to a target subject swiping a card at a target access control station in a target confidential area, determining whether the access card used in the swiping operation has access permission and determining whether a security risk exists based on card information of the access card and spatial information of the target confidential area, wherein the card information includes a current swipe time and a swipe time pattern of the access card, the spatial information is used to indicate the distribution of personnel in the target confidential area, and the swipe time pattern is used to indicate the swipe time habits of the access card; a first suspicion level determination module configured to, if the access card has access authorization and there is a safety hazard, open the target access control and determine a first suspicion level of the target object based on a swiping method of the access card on the target access control, physiological data of the target object, and swiping reference information, wherein the swiping reference information includes a swiping posture and a standing position when the card is swiped; a second suspicion level determination module, wherein, when the first suspicion level is greater than or equal to a first suspicion level threshold, the module determines a second suspicion level of the target object based on a first movement path, a second movement path, a first object image, and a second object image of the target object, wherein the first movement path is a movement path outside the target confidential area before reaching the target access control station, the second movement path is a movement path within the target confidential area after passing through the target access control station, the first object image is an image of the object when the card is swiped, and the second object image is an image of the object after passing through the target access control station; A triggering judgment module is used to determine whether to trigger an alarm for the target object based on the first suspicious degree and the second suspicious degree, where the alarm is used to indicate that there is a security risk with respect to the target object.

Images