Building security data distributed storage management method and system

Abstract

The invention provides a building security data distributed storage management method and system, and relates to the technical field of building security data management. The method comprises the following steps: acquiring security and protection data; when an access request for the hot data is detected, identifying cold data in business logic association with the hot data through a preset security and protection data business association map; the preheating priority of the cold data is determined, and asynchronous migration of the cold data from the cold data storage node to the hot data storage node is triggered; and in the cold data migration process, upgrading the heat mark of the cold data, and after the cold data migration is completed, carrying out degradation processing on the heat mark of the cold data. The method aims to solve the problem of cold and hot data management efficiency caused by business relevance in distributed storage of building security and protection data, and potential access requirements are effectively pre-judged, so that prolonging of query response time and repeated migration of cold and hot data are avoided, consumption of storage resources is reduced, and system performance is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of building security data management, in particular to a building security data distributed storage management method and system. BACKGROUND

[0002] With the continuous expansion of modern commercial buildings, the security systems deployed therein are increasingly complex, integrating a variety of security devices including high-definition video surveillance cameras, intelligent access control controllers, fire sensors, intrusion detectors, etc. These devices continuously generate massive amounts of security data every day, such as uninterrupted video recording streams, access card swiping records, alarm event logs triggered by various sensors, and system operation status data. In order to efficiently and economically manage these vast data resources, current building security systems generally adopt a distributed storage architecture. This architecture typically includes two main types of storage nodes: one is a hot data storage node that deploys high-performance solid-state drives (SSDs), characterized by fast read and write speeds, and is dedicated to storing data that needs to be frequently and quickly accessed to ensure system response performance; the other is a cold data storage node that deploys large-capacity, low-cost mechanical hard drives (HDDs), characterized by low storage cost, and is designed to archive and access low-frequency historical data over a long period of time to optimize overall storage costs.

[0003] To achieve efficient use of storage resources, existing security systems typically have a set of cold and hot data classification management strategies based on data access frequency. The core logic of this strategy is to continuously monitor the access patterns of each piece of data: when the system detects that a data unit (e.g., a video file or a log record) is accessed frequently within a preset time window (e.g., within the last 30 days) or is newly generated data, it is determined to be hot data and is ensured to be stored on a solid-state drive hot data node. Conversely, if the data's access frequency remains below a preset threshold after the time window has passed, the system will mark it as cold data and automatically trigger a data migration process to move it from a high-cost solid-state drive node to a low-cost mechanical hard drive node, thereby freeing up high-performance storage space for newly generated or more active data. When cold data's access frequency increases again for some reason, the system can also re-identify it as hot data and move it back to the solid-state drive node, thereby ensuring the fast availability of important data.

[0004] However, in the actual operation scenario of the building security system, the access mode of security data is more complex than the access frequency of a single data unit. There is an inherent business correlation among security data. For example, a fire alarm event in a building involves not only the alarm log generated by the fire detector, but also the multi-channel video monitoring recording in the incident area and the personnel evacuation path, the access control record during personnel escape, and the operation status log of the fire-fighting equipment. These different types of data at different time points collectively constitute a complete description of the fire alarm event. The existing cold and hot data classification management method based on data access frequency mainly focuses on the access frequency of a single independent data unit and fails to fully identify and utilize this inherent business correlation. This means that when the system judges the cold and hot of an alarm event, it may only rely on the access frequency of the alarm log itself, ignoring the cold and hot state of the video, access control and other data associated with the log and their potential access demand.

[0005] This limitation brings significant problems in actual security business operations. For example, in a sudden investigation of a building internal device failure, the security department needs to trace and analyze the operation records of the failed device in the past two months, the video recording of the relevant area, and the access records of all maintenance personnel during the period. These data are scattered in different storage nodes, and due to the long time, some video recordings and historical operation logs have been automatically downgraded to cold data and stored in mechanical hard disk nodes. When the investigator initiates a complex query spanning multiple data types and covering multiple time periods through the event trace function provided by the system by inputting the device identifier and time range, the system may first locate the latest device failure alarm record (which may still be hot data), but in order to analyze the failure cause comprehensively, the system needs to further load the associated historical operation logs and video recordings which have become cold data.

[0006] In this business correlation driven complex query scenario, the drawbacks of the existing cold and hot data classification method are exposed. Since the system only makes cold and hot judgments based on the access frequency of independent data units, it cannot predict and understand the potential access demand for "cold" associated data triggered by "hot" alarm events or queries. When the query request actually arrives, the system needs to read a large number of historical video and log files from the mechanical hard disk cold data node. Although these cold data are accessed due to business correlation, their reading speed is much lower than that of the solid state disk hot data node, resulting in a significant extension of the response time of the entire query. The security personnel cannot perform real-time analysis and decision-making while waiting for the data loading process, which seriously affects the response efficiency and investigation progress of the event.

[0007] More seriously, when these cold data are read due to the association query, the data access monitoring module of the system detects the increase of their access frequency. According to its established judgment logic that "high frequency access is hot data", the system may mistakenly identify these historical data that should be in the cold storage state for a long time as "independent hot spot data", and trigger a large-scale data migration from the mechanical hard disk cold data node to the solid state disk hot data node. This migration process not only occupies a large amount of internal network bandwidth and node input / output resources of the storage system, causing performance interference to the new monitoring video stream being written in real time, but also quickly occupies the limited solid state disk hot data storage space. Due to the limited capacity of the solid state disk, in order to accommodate these data, the system may be forced to downgrade a part of the recent data generated within 30 days that truly needs high-performance access and migrate to the mechanical hard disk cold data node, thereby further reducing the operation efficiency of the security personnel when conducting daily inspection and recent event backtracking.

[0008] Once the equipment failure investigation task is completed, the historical data that are moved to the solid state disk due to the association query will have their independent access frequency quickly fall back. After the system detects that the access frequency of the data returns to a low level, it will again trigger data migration to move the data from the solid state disk hot data node back to the mechanical hard disk cold data node. This "cold-hot-cold" cycle migration mode caused by temporary access driven by business association is completely caused by the insufficient recognition of the system to the data association. Each migration is accompanied by a large amount of consumption of network bandwidth, input / output resources and computing resources, and potential interference to real-time business. This repetitive and unnecessary resource consumption not only increases the operating cost of the system, but also reduces the utilization efficiency of the overall storage resources and the stability of the system. SUMMARY

[0009] The purpose of the present application is to provide a building security data distributed storage management method and system, aiming to solve the cold and hot data management efficiency problem caused by business association in building security data distributed storage, effectively predict the potential access demand for associated cold data driven by hot events or hot queries, thereby avoiding the extension of query response time and the repeated migration of cold and hot data, and reducing the consumption of storage resources and improving the performance of the system.

[0010] In a first aspect, the present application provides a building security data distributed storage management method, comprising the following steps: obtaining security data; the security data includes hot data and cold data with a hotness label; the hotness label represents the access heat of the corresponding data, and the access heat of the hot data is higher than that of the cold data; The monitoring and identification module is configured to monitor an access request for the security data, and when detecting an access request for the hot data, identify, according to an identifier of the hot data, cold data that is in business logic association with the hot data through a preset security data business association graph. The evaluation and migration module is configured to determine a preheating priority of the cold data according to a close degree of association between the cold data and the hot data, a business importance of the cold data, and a preset preheating data volume limit, and trigger asynchronous migration of the cold data from a cold data storage node to a hot data storage node. The level control module is configured to upgrade the hotness label of the cold data in the cold data migration process, and after the cold data migration is completed, downgrade the hotness label of the cold data according to a preset time or a change in hot data access hotness.

[0011] The core advantage of the building security data distributed storage management method provided by the application is that it is changed from passive response to active prediction, and the cold data that may be accessed is preheated based on business association, so that the efficiency of security event investigation is significantly improved, and the utilization of storage resources is optimized.

[0012] In a second aspect, the application provides a building security data distributed storage management system, comprising: The acquisition module is configured to acquire security data; the security data comprises hot data and cold data with hotness labels; the hotness label represents access hotness of corresponding data, and the access hotness of the hot data is higher than that of the cold data; The monitoring and identification module is configured to monitor an access request for the security data, and when detecting an access request for the hot data, identify, according to an identifier of the hot data, cold data that is in business logic association with the hot data through a preset security data business association graph. The evaluation and migration module is configured to determine a preheating priority of the cold data according to a close degree of association between the cold data and the hot data, a business importance of the cold data, and a preset preheating data volume limit, and trigger asynchronous migration of the cold data from a cold data storage node to a hot data storage node. The level control module is configured to upgrade the hotness label of the cold data in the cold data migration process, and after the cold data migration is completed, downgrade the hotness label of the cold data according to a preset time or a change in hot data access hotness.

[0013] From the above, the building security data distributed storage management method provided by the application solves the problem that the business correlation between security data cannot be recognized and utilized in the cold and hot hierarchical management of existing building security data by introducing a business correlation graph. Before the security personnel initiates a complex query, the associated cold data is actively preheated to the solid state hard disk hot data node through the prediction of hot data access. This makes the required data already in the high-performance storage medium when the query actually arrives, significantly shortens the waiting time for reading cold data from the mechanical hard disk, and improves the efficiency of the security personnel in event tracing and analysis. At the same time, through the active preheating based on the business correlation graph, the passive and lagging migration is changed into active and predictive migration. The system only preheats the data that may be accessed frequently due to business correlation, avoids unnecessary and short-term access caused by repeated migration, thereby reducing the consumption of network bandwidth and input / output resources inside the storage system, and improving the utilization efficiency of storage resources and system stability. Finally, the system can understand the logical relationship between security data. When a hot event or hot query occurs, the system no longer only depends on the independent access frequency of a single data unit, but identifies the potential access demand for associated cold data behind it, so as to prepare data in advance, so that the cold and hot data management strategy is more in line with the actual operation mode of building security business.

[0014] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent from the description, or can be learned by practice of the present application according to the embodiments. The objects and other advantages of the present application will be achieved and obtained by means of the structure particularly pointed out in the written description and the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 A flow chart of the building security data distributed storage management method provided by the embodiments of the present application.

[0016] Figure 2 A structural schematic diagram of the building security data distributed storage management system provided by the embodiments of the present application.

[0017] Label explanation: 100, acquisition module; 200, monitoring and identification module; 300, evaluation and migration module; 400, level control module. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0019] Reference Attachment Figure 1 The present invention provides a distributed storage management method for building security data, comprising the following steps: Obtain security data; security data includes hot data and cold data with heat tags; heat tags represent the access popularity of the corresponding data, and the access popularity of hot data is higher than that of cold data; Monitor access requests to security data. When a request to access hot data is detected, cold data with business logic associations to the hot data is identified based on the identifier of the hot data and through a preset security data business association graph. The security data business association graph is constructed based on the metadata of the security data, which includes data type, event identifier, device identifier, timestamp, geographic region identifier, and personnel identifier. The security data business association graph uses security data units as nodes and business logic relationships between data units as edges. Business logic relationships include event association, spatiotemporal association, and entity association. Based on the closeness of the correlation between cold data and hot data, the business importance of cold data, and the preset preheating data volume limit, the preheating priority of cold data is determined, and the asynchronous migration of cold data from cold data storage nodes to hot data storage nodes is triggered; During the cold data migration process, the heat mark of the cold data is upgraded. After the cold data migration is completed, the heat mark of the cold data is downgraded according to the preset time or the change in the access heat of the hot data.

[0020] The hotness label refers to an identifier representing the access hotness of corresponding data, which can be implemented by a numerical value, a level, or a state bit, such as a numerical range of 0-100, a high / medium / low level, or a hot / cold state, mainly to distinguish the access activity of security data. The security data business association graph refers to a graph structure constructed according to the meta information of security data, which can be implemented by a knowledge graph, a relationship graph, or a semantic network, such as a graph constructed based on a graph database, mainly to identify the business logic association between security data units. The association tightness refers to the relevance strength of cold data and hot data in business logic, which can be implemented by similarity calculation, path length analysis, or semantic matching degree evaluation, such as a numerical value calculated based on meta information matching degree or graph path length, mainly to quantify the business relevance of cold data and hot data. The business importance refers to the value or criticality of cold data in the security business scenario, which can be implemented by a preset weight, an event urgency level, or a user configuration, such as a priority given according to the event type or data type, mainly to evaluate the support degree of cold data for the current security business. The preheating data volume limit refers to the upper limit of the total amount of cold data allowed to be migrated from the cold data storage node to the hot data storage node, which can be implemented by a storage capacity threshold, a data entry quantity limit, or a bandwidth limit, such as setting a reserved space for the hot storage node or a daily migration data volume, mainly to control the occupation of hot storage resources. Asynchronous migration refers to the process of data migration that does not block the execution of the main business process, which can be implemented by a background task, a message queue, or an independent thread, such as a background data transmission task triggered by a message queue, mainly to avoid interference with the real-time performance of the system caused by data migration. Hotness label degradation processing refers to the operation of restoring the hotness label of preheated cold data to the cold data state under certain conditions, which can be implemented by a timing task, access frequency monitoring, or business process state judgment, such as triggering at the end of the preheating window or when the associated business process is not active, mainly to avoid long-term occupation of hot storage space by preheated data.

[0021] The working principle of this invention is that by parsing metadata as security data is stored and constructing a dynamically updated business association graph, the system can understand the inherent business logic relationships between different security data units. When the security system detects an access request for a specific hot data item (such as the latest alarm event log), it no longer views the data in isolation. Instead, it proactively queries the business association graph, starting with the hot data item and identifying all cold data items with close business connections to it (such as historical video and access control records). The system then assesses the pre-warming priority of these related cold data items based on pre-defined policies (such as correlation level, business importance, and resource constraints), and triggers the asynchronous pre-migration of these high-priority cold data items from cold data nodes with slow speed and high capacity mechanical hard drives to hot data nodes with high speed and limited capacity solid-state drives. Through this "active pre-warming" mechanism, when security personnel initiate complex queries related to the incident, the required data is already stored in high-performance storage media, significantly reducing query response time and avoiding the repeated migration of hot and cold data and the waste of resources caused by passive access in traditional methods.

[0022] The core innovation of this application lies in that, by introducing a security data business association graph, the associated cold data caused by hot data access requests can be predicted and identified, and the preheating priority of cold data is determined and asynchronous migration is triggered based on the degree of association between cold data and hot data, the business importance of cold data and the preset preheating data volume limit. At the same time, after the migration is completed, the heat mark of the cold data is downgraded according to the preset time or the change in the access heat of hot data, thereby solving the access delay and unnecessary data cyclic migration problems caused by the failure to identify data business association in the prior art, and improving the security data access efficiency and storage resource utilization efficiency.

[0023] Specifically, this method first obtains building security data, and divides it into hot data and cold data according to its access popularity, and assigns corresponding heat tags to lay the foundation for subsequent refined management. When the system monitors access requests to hot data, this indicates that there is an active business scenario. At this time, the system is no longer just concerned with the hot data being accessed itself, but based on the identification of the hot data, it actively identifies the cold data that has a business logic association with the hot data through the preset security data business association map. The map is constructed based on the metadata of the security data, and can reveal business logic relationships such as event association, spatiotemporal association, and entity association between different security data units, so that the system can predict the user's potential access needs for associated cold data.

[0024] After identifying the associated cold data, the system enters the decision-making phase. It comprehensively considers the closeness of the association between cold data and hot data, the business importance of the cold data itself, and the system's preset preheating data volume limit to determine the preheating priority of the cold data. This multi-dimensional consideration ensures that limited hot storage resources are used efficiently, with priority given to migrating associated cold data that is likely to be accessed and has high business value. Once the priority is determined, the system triggers the asynchronous migration of cold data from the cold data storage node to the hot data storage node, ensuring that data is transmitted in the background and avoiding interference with current system performance.

[0025] During the cold data migration process, the system synchronously upgrades the hotness labels of the cold data to ensure that they receive fast access support on the hot storage node. More importantly, after the migration is complete, the system continuously monitors and, based on the preset time or changes in the access hotness of the associated hot data, appropriately downgrades the hotness labels of these cold data. This means that when the associated business scenario is no longer active or the preheating demand decreases, these data can be re-identified as cold data and timely migrated back to the cold storage node, thereby avoiding unnecessary long-term occupation of hot storage space and effectively reducing resource waste and the overhead of repeated migration, improving the overall utilization efficiency of storage resources and the stability of the system.

[0026] Through the above scheme, the present application effectively solves the problem in the prior art that, due to the inability to fully identify and utilize the business association between security data, the access response time of cold data is prolonged in a business association-driven composite query scenario. The present application improves the response speed and efficiency of security data access by pre-judging and preheating associated cold data. At the same time, by downgrading the hotness labels of preheated cold data, unnecessary data circular migration caused by temporary access is avoided, thereby reducing system resource consumption, optimizing storage resource utilization, and improving the overall stability and operational efficiency of the system.

[0027] In some embodiments, the access request to the security data is monitored, and when an access request to hot data is detected, the step of identifying cold data that has a business logic association with the hot data according to the identification of the hot data through the preset security data business association graph includes: The access request to the security data is monitored, and when an access request to hot data is detected, the identification of the hot data and the access context information of the access request are obtained; According to the identification of the hot data, the initial cold data set that has a business logic association with the hot data is identified through the preset security data business association graph; According to the access context information, the initial cold data set is evaluated in terms of association degree in combination with the meta information of each cold data in the initial cold data set, to obtain the association degree of each cold data with the current access business scenario of the hot data; According to the correlation degree and the preset correlation degree threshold, the cold data meeting the correlation degree threshold is filtered from the initial cold data set as cold data for subsequent processing.

[0028] The access context information refers to the support information reflecting the current access intention and business scenario of the user that can be obtained by the system when initiating an access request for the hot data, which can be embodied in the form of a specific time range, device type, event type, geographic area or personnel identification of the user query. The initial cold data set refers to the set of cold data preliminarily identified by the system through the security data business association graph in association with the hot data according to the identification of the hot data, which can include cold data of different types and sources. The meta information refers to the data describing the attributes of the data, which can be embodied in the form of data type, event identification, device identification, timestamp, geographic area identification or personnel identification. The correlation degree evaluation refers to the quantitative calculation process of the matching degree of each cold data in the set with the current hot data access business scenario according to the access context information and the meta information of each cold data in the initial cold data set, which can be realized by using a rule-based matching algorithm, a similarity calculation model or a machine learning model. The correlation degree refers to the result of the correlation degree evaluation, indicating the matching degree of the cold data with the current hot data access business scenario, which can be a numerical value, a level or a percentage. The correlation degree threshold refers to the preset standard for filtering cold data, only the cold data meeting or exceeding the threshold will be further processed, which can be a fixed numerical value, an adjustable numerical value or a level set based on the importance of the business.

[0029] The application proposes an improved cold data identification method. When the system monitors the access request for security data, once the access to hot data is detected, in addition to obtaining the identification of hot data, the access context information of the access request is further obtained. The access context information reflects the specific intention and business scenario of the user's current access to hot data, providing an important basis for subsequent refinement screening. Subsequently, the system identifies an initial cold data set that has a business logic association with the hot data according to the identification of the hot data and using a preset security data business association graph. This initial set contains potential related cold data, ensuring the coverage of associated data. The key of the application lies in the introduction of the association degree evaluation of the initial cold data set. The system uses the previously obtained access context information and combines the meta information of each cold data in the initial cold data set to evaluate the association degree of each cold data in the set, thereby quantifying the matching degree of the cold data and the current hot data access business scenario. For example, if the access context information indicates that the user is querying events in a specific time period, the cold data with a high matching degree of the timestamp and the time period will obtain a high association degree. This evaluation mechanism enables the system to further focus on the depth and accuracy of the current business scenario from the generality of business logic association, identifying cold data that is truly valuable to the current user operation. Finally, the system screens cold data that meets the association degree threshold from the initial cold data set according to the association degree obtained by the evaluation and the preset association degree threshold, as cold data for subsequent processing. This screening step effectively excludes cold data that has a business logic association with hot data but has a low association degree with the current access business scenario. In this way, the application adds a refinement screening mechanism based on access context information on the basis of identifying cold data according to the business association graph, making the subsequent cold data preheating migration more accurate. This not only reduces unnecessary cold data migration, improves the use of hot storage space, reduces network bandwidth and computing resource consumption, but also, in combination with the overall process of the building security data distributed storage management method, ensures that only cold data highly related to the current business scenario is preheated, thereby improving the efficiency and response speed of the entire system and avoiding performance degradation caused by preheating of a large amount of redundant data.

[0030] In a specific embodiment, suppose a building security system detects an access request for a fire alarm log (hot data). The system first obtains the identifier of the fire alarm log and the access context information of the access request. For example, this access context information may include the specific time range of the user's query (e.g., 10 minutes before and after the alarm occurred), the geographic area of ​​the query (e.g., the floor and area where the alarm occurred), and the event type of the query (e.g., "fire incident investigation"). Next, based on the identifier of the fire alarm log and using a pre-built security data business association graph, the system identifies an initial set of cold data that has a business logic association with the fire alarm log. This set may include historical video recordings of the area, access control card swipe records, fire equipment operation logs, and other sensor data. This data may be stored in cold data nodes due to low access frequency. The system then uses the obtained access context information, combined with the metadata of each cold data item in the initial cold data set, to evaluate the relevance of each cold data item in the set. For example, for a historical video record, the system extracts metadata such as its timestamp, device identifier, and geographic area identifier. If the access context information indicates that the query time range is 10 minutes before and after the alarm occurs, then video records with timestamps within this range will receive a high degree of relevance. If the query geographic area is the area where the alarm occurred, then video records with a matching geographic area identifier will also receive a high degree of relevance. The system can calculate a relevance score, for example, by weighting the average of time matching, geographic matching, and event type matching. Finally, based on the calculated relevance and a preset relevance threshold, the system filters out cold data from the initial cold data set that meets the threshold. For example, if the threshold is set to 0.7, then only cold data with a relevance score of 0.7 or higher (such as video records and access control records that match the alarm time period and area) will be identified as cold data for subsequent pre-processing. Cold data with low relevance (such as historical device logs unrelated to the alarm event) will not be pre-processed.

[0031] The application can ensure that only the cold data highly related to the current hot data access business scene is used for subsequent processing, improve the accuracy and efficiency of cold data preheating, avoid resource waste, improve the use of hot storage space, reduce the consumption of network bandwidth and computing resources, and thus improve the efficiency and response speed of the entire distributed storage management system.

[0032] In some embodiments, according to the access context information, the correlation degree of each cold data in the initial cold data set is evaluated by combining the meta information of each cold data in the initial cold data set, and the step of obtaining the correlation degree of each cold data and the current access business scene of the hot data includes: For each cold data in the initial cold data set, at least one query intention element is obtained from the access context information, and the meta information element corresponding to the query intention element is extracted from the meta information of the cold data; the query intention element includes query time range, query geographic area, query event type, query device identifier or query personnel identifier; According to the preset matching rule, the element matching degree of the cold data on each pair of combinations of the query intention element and the meta information element is calculated; According to the preset weight, the element matching degrees of the cold data on each element are weighted and aggregated to obtain the correlation degree of the cold data and the current access business scene of the hot data.

[0033] The query intent element refers to the specific information dimension that can explicitly reflect the business purpose or query focus of the user or system access request for hot data from the context information accompanying the request. It can be obtained by natural language processing technology from text description or directly obtained through structured query parameters. The meta information element refers to the structured data carried by the cold data itself to describe its content, attributes or source, which can be obtained by extracting from the file header, database field or independent metadata storage of the cold data. The preset matching rule refers to the algorithm or logic set used to quantitatively evaluate the similarity or relevance between the query intent element and the meta information element, which can be implemented by using the methods of exact matching, range overlap calculation, fuzzy matching algorithm or semantic similarity calculation. The element matching degree refers to the quantitative value obtained by comparing a pair of query intent elements and meta information elements according to the preset matching rule, which is used to represent the matching degree between them, which can be represented by a floating point number between 0 and 1, where 1 represents complete matching and 0 represents complete mismatch. The preset weight refers to the relative importance coefficient assigned to each element matching degree when multiple element matching degrees are comprehensively evaluated, which can be obtained by expert experience setting, historical data analysis or machine learning model training. Weighted aggregation refers to the comprehensive calculation of multiple element matching degrees according to their corresponding preset weights to obtain a single comprehensive evaluation value, which can be implemented by using weighted average, weighted sum or more complex aggregation function. The correlation degree refers to the quantitative index that can comprehensively reflect the correlation between the cold data and the current hot data access business scenario, which can be represented by a numerical value, and the higher the numerical value, the stronger the relevance.

[0034] After identifying the initial cold data set associated with the hot data in terms of business logic, in order to more accurately assess the relevance of these cold data to the current hot data access business scenario, first, for each cold data in the initial cold data set, at least one query intent element is obtained from the access context information, and the meta information element corresponding to the query intent element is extracted from the meta information of the cold data. This process will abstract the access context information into specific query intent, such as query time range, query geographic area, query event type, query device identifier or query personnel identifier, while extracting the corresponding meta information from the cold data, thereby laying the foundation for subsequent quantitative evaluation. Subsequently, according to the preset matching rule, the element matching degree of the cold data on each pair of combination of query intent element and meta information element is calculated. This step quantifies the matching degree between query intent and cold data in different dimensions through standardized rules, avoids subjective judgment, and ensures the objectivity of the evaluation. Finally, according to the preset weight, the element matching degrees of the cold data on each element are weighted and aggregated to obtain the relevance of the cold data to the current access business scenario of the hot data. Since different query intent elements have different importance in a specific business scenario, through weighted aggregation, the system can flexibly reflect the relevance of the cold data in the overall business scenario, thereby obtaining a comprehensive relevance value. It is precisely due to this multi-dimensional, quantitative and weighted evaluation mechanism that the present scheme can overcome the limitations of relying solely on rough correspondence to evaluate relevance, so that the cold data selected from the initial cold data set can more accurately meet the actual business needs of users, avoiding unnecessary preheating of cold data or missing important cold data, thereby significantly improving the efficiency and accuracy of subsequent cold data preheating. This refined relevance evaluation further optimizes the process of identifying and selecting cold data for subsequent processing when detecting access requests for hot data, making the entire building security data distributed storage management method more intelligent and efficient in responding to complex business query requirements.

[0035] In one specific embodiment, assume that a security personnel needs to trace back an abnormal event happened in a specific area of a building, for example, a suspicious person breaking-in event. The security personnel initiates a query through the system, and the query request access context information includes "query time range: 14:00-15:00 on October 26, 2023", "query geographic area: floor 3 of area A of the building", "query event type: person breaking-in", "query device identifier: access control camera 001", and "query person identifier: unknown person". The system first identifies an initial cold data set that is logically associated with the current hot data (e.g., the latest alarm record) according to the identifier of the hot data and the security data business association graph. The set can include video recordings, access control card swiping records, sensor alarm logs, etc. in the area during the time period. For each cold data in the initial cold data set, for example, a cold-stored video file, the system obtains query intent elements from the access context information, such as "query time range", "query geographic area", "query event type", etc. At the same time, corresponding meta-information elements are extracted from the meta-information of the video file, such as the "recording timestamp", "recording geographic location", "video content type", etc. of the video. Then, the system calculates the element matching degree of the video file on each combination of query intent elements and corresponding meta-information elements according to the preset matching rules. For example, for "query time range" and "recording timestamp", if the video recording timestamp is completely within the query time range, the matching degree can be calculated as 1.0; if partially overlapping, the matching degree is calculated according to the overlap ratio. For "query geographic area" and "recording geographic location", the matching degree can be calculated according to the distance or area inclusion relationship of geographic coordinates. For "query event type" and "video content type", the matching degree can be calculated according to the preset semantic association rules. Finally, the system aggregates the element matching degrees by weighting according to the preset weights. For example, in a person breaking-in event, the weights of "query time range" and "query geographic area" can be set higher, while the weight of "query device identifier" can be relatively lower. Through this weighted aggregation, the system can obtain the relevance of the video file to the current suspicious person breaking-in event business scenario. This relevance value will be used for subsequent screening to ensure that only cold data with strong relevance to the event will be preheated, thereby avoiding unnecessary resource consumption and improving the efficiency of event response.

[0036] The scheme can realize accurate evaluation of the current access business scene correlation degree of cold data and hot data by obtaining specific query intention elements from access context information, performing multi-dimensional and quantitative matching with meta-information elements of cold data, and then performing weighted aggregation through preset weights. This solves the problem of inaccurate or incomplete correlation degree evaluation in traditional methods, avoids unnecessary preheating of cold data, and ensures that important cold data is not missed. Therefore, the scheme significantly improves the efficiency and accuracy of preheating cold data of the system, so that the preheated cold data can more accurately meet the actual business needs of users, thereby optimizing the overall performance and resource utilization efficiency of the security data management system.

[0037] In some embodiments, the step of determining the preheating priority of the cold data according to the correlation closeness of the cold data and the hot data, the business importance of the cold data, and the preset preheated data volume limit comprises: obtaining real-time security event information; the real-time security event information includes event type, event occurrence time, and event occurrence area; According to the real-time security event information, identify the cold data that has business logic correlation with the real-time security event in the security data business correlation graph; According to the type of the real-time security event and the correlation degree of the cold data and the real-time security event, dynamically adjust the business importance of the cold data; According to the correlation closeness of the cold data and the hot data, the adjusted business importance of the cold data, and the preset preheated data volume limit, determine the preheating priority of the cold data.

[0038] Real-time security event information refers to description data of abnormal situations or emergencies that need to be immediately concerned or handled, which is monitored and reported by the security system in real time, which can be obtained in the form of structured event report, alarm log or sensor trigger data. Dynamic adjustment of the business importance of cold data refers to the process of real-time correction or update of the preset business value of cold data according to the changes of external environment or system internal state, which can be realized by rule-based weight calculation, machine learning model prediction or expert system evaluation. The correlation degree of cold data and real-time security event refers to the correlation strength of cold data and specific real-time security event in time, space, entity or business logic, which can be calculated by similarity quantification, graph path analysis or semantic matching.

[0039] The method provided by the present application aims to optimize the determination process of cold data preheating priority. The method first acquires real-time security event information, which includes event type, event occurrence time and event occurrence area, providing important context for subsequent data identification and importance adjustment. Based on these real-time event information, the system uses a preset security data business association graph to identify cold data that has business logic association with the current real-time security event. The association graph takes security data units as nodes and the business logic relationship between data units as edges, which can efficiently filter out historical video, access control records, sensor data and other related data from massive cold data. After identifying the associated cold data, the system no longer relies solely on the original static business importance of the cold data, but dynamically adjusts the business importance of the cold data according to the type of the real-time security event, such as fire alarm, intrusion or equipment failure, and the degree of association between the cold data and the event, such as time, space or entity matching degree. This adjustment mechanism enables the system to flexibly increase or decrease the business importance of related cold data according to the changes in the current security situation, ensuring the timely availability of data required for emergency response. Finally, the system considers the original association degree between the cold data and the hot data, the dynamically adjusted business importance of the cold data after the real-time event, and the system's preset storage resource limit to determine the preheating priority of the cold data. By taking into account the dynamically adjusted business importance, the system can more accurately assess which cold data is most needed to be preheated in the current security scenario, and under limited resources, prioritize the migration of those data that are critical to event response and analysis.

[0040] The present scheme is combined with the basic scheme. The basic scheme monitors access requests to hot data and identifies cold data that has a business logic association with the hot data using a security data business association graph, thereby determining the preheating priority of the cold data according to the closeness of the association between the cold data and the hot data, the business importance of the cold data, and a preset preheated data volume limit. On this basis, the present scheme further introduces a perception and response mechanism for real-time security events. When a real-time security event occurs, even if there is no direct hot data access trigger, the system can actively obtain event information and identify cold data related to the event using the same security data business association graph. Subsequently, the system dynamically enhances the business importance of these cold data according to the type of the event and the degree of association between the cold data and the event. This dynamic adjustment mechanism enables the system to predict and respond to data requirements in emergency situations, rapidly increasing the priority of critical cold data that may otherwise be overlooked due to low access frequency, thereby preheating these data to hot data storage nodes before or at the initial stage of event response. This complements the passive preheating mechanism in the basic scheme, which mainly relies on hot data access triggers, enabling the system to provide more active and timely support for critical data in the face of sudden security events, significantly improving the efficiency and accuracy of emergency response to security events.

[0041] In one specific embodiment, the building security system can be configured with an event monitoring module that continuously receives real-time event notifications from the fire alarm system, intrusion detection system, or equipment failure monitoring system. For example, when the fire alarm system detects a fire in a certain area and triggers an alarm, the event monitoring module immediately obtains a real-time security event information containing the event type "fire", the event occurrence time as the current timestamp, and the event occurrence area "A zone 10th floor". After the system receives this information, it will immediately start the cold data correlation identification process. The security data business correlation graph maintained inside the system stores the meta-information of all security data units in the building and their business logic relationships. For example, this graph can contain all historical video recordings of "A zone 10th floor", access records of the access control system in this area, maintenance logs of fire equipment, and inspection records of relevant personnel, etc. data nodes, and connected by edges such as time, space, or event correlation. The system will quickly identify the cold data that has a business logic correlation with this fire event in the graph according to the event information "fire", "A zone 10th floor", and the current time, etc. For example, all video recordings of "A zone 10th floor" within 30 minutes before the fire and 10 minutes after the fire, historical data of all fire sensors in this area, and access records of all personnel in "A zone 10th floor" during the fire period. After identifying these associated cold data, the system will dynamically adjust the business importance of these cold data according to the type of real-time security event ("fire" event usually has high urgency) and the correlation degree of cold data with the event (for example, the accuracy of matching video recordings with fire occurrence time and location). For example, the business importance of the historical video recordings originally marked as low importance will be significantly improved. Finally, the system will consider the business importance of these adjusted cold data, their correlation with the current hot data (if any), and the system's preset preheating data volume limit, to recalculate and determine the preheating priority of these cold data. The cold data with the highest priority, such as important video clips during the fire, will be migrated from the cold data storage node to the hot data storage node asynchronously to ensure that security personnel can quickly access these important information during emergency response.

[0042] The scheme can accurately identify and prioritize preheating of cold data that becomes critical due to a sudden security event, by obtaining real-time security event information and dynamically adjusting the business importance of cold data according to the event type and the degree of association between cold data and the event. This enables timely migration of event-related historical video, access control records, sensor data and other cold data from cold data storage nodes to hot data storage nodes in emergency situations such as fires and intrusions, ensuring that security personnel can quickly access the required data during emergency response and event analysis, significantly improving emergency response speed and decision-making efficiency. At the same time, through the dynamic adjustment mechanism, the system can reasonably allocate limited preheating storage resources, avoiding unnecessary preheating and improving storage resource utilization efficiency.

[0043] In some embodiments, the step of dynamically adjusting the business importance of the cold data according to the type of the real-time security event and the degree of association between the cold data and the real-time security event comprises: For the event type of the real-time security event, obtain a preset event quantification parameter; the event quantification parameter includes an event emergency level, an event potential harm level, and an event response time limit; According to the meta information of the cold data and the occurrence time and area of the real-time security event, calculate the degree of association between the cold data and the real-time security event in the time dimension and the space dimension; According to the data type of the cold data and the event potential harm level, evaluate the business support degree of the cold data for the real-time security event; According to the event emergency level, the event response time limit, the degree of association between the cold data and the real-time security event in the time dimension and the space dimension, and the business support degree of the cold data for the real-time security event, calculate a business importance adjustment factor of the cold data; When there are multiple real-time security events associated with the cold data, identify the spatio-temporal overlap relationship or business logic association relationship between the multiple real-time security events, and according to the spatio-temporal overlap relationship or business logic association relationship and the business importance adjustment factor of the cold data for each event, aggregate to obtain a final business importance adjustment factor of the cold data; According to the final business importance adjustment factor, adjust the business importance of the cold data.

[0044] The event quantification parameter refers to a set of values or indicators used to measure and evaluate the inherent characteristics of real-time security events, which can be obtained by pre-configured values, statistical analysis based on historical data, or expert system rules. The event emergency level refers to the urgency of immediate response after the occurrence of the event, which can be represented by numerical classification (such as 1-5 levels) or descriptive labels (such as "low", "medium", "high", "urgent"). The event potential harm level refers to the severity of the loss or impact that the event may cause, which can be quantified by economic loss assessment, personnel casualty risk assessment, or system function interruption risk assessment. The event response time limit refers to the time limit that must be completed after the occurrence of the event, which can be set by specific time units (such as minutes, hours) or time periods. The correlation degree of cold data and real-time security events in time and space dimensions refers to the matching or proximity of the time stamp or geographic region identifier of cold data and the occurrence time or occurrence region of real-time security events in space-time, which can be determined by time difference, spatial distance, or geographic region inclusion relationship. The business support degree of cold data to real-time security events refers to the real role and value of cold data in solving or analyzing specific real-time security events, which can be evaluated by pre-set weight based on data type and event harm level, expert experience evaluation, or machine learning model prediction. The business importance adjustment factor of cold data refers to the multiplier or adder that modifies the original business importance of cold data according to the characteristics of real-time security events and the correlation degree of cold data and events, which can be generated by weighted summation, product, or rule-based lookup table calculation model. The spatio-temporal overlap relationship or business logic correlation relationship refers to the intersection of multiple real-time security events in occurrence time and occurrence region, or the mutual dependence or influence in business processing flow and logic, which can be identified by time interval intersection judgment, geographic region overlap analysis, or business flow graph analysis. The final business importance adjustment factor of cold data refers to the aggregated value that finally modifies the business importance of cold data when cold data is associated with multiple real-time security events, considering the influence of all related events, which can be calculated by weighted average, maximum value selection, or specific aggregation algorithm.

[0045] The present scheme realizes real-time and detailed adjustment of the business importance of cold data through a series of logical and clear steps, ensuring accurate identification and priority preheating of cold data that plays an important role in event response when real-time security events occur.

[0046] Firstly, the system obtains preset event quantification parameters for the current occurring real-time security event, which include event emergency level, event potential harm level and event response time limit. These parameters provide a fundamental and quantifiable basis for subsequent evaluation of the importance of cold data, making the initial evaluation of different types of events have a unified standard and fact-based. On this basis, the system calculates the correlation degree of cold data and real-time security event in time dimension and space dimension according to the meta-information of cold data (such as time stamp, geographical area identifier) and the occurrence time and occurrence area of real-time security event. This calculation step quantifies the direct relevance of cold data in time and space with the event, thereby screening out cold data with real meaning in the spatio-temporal context of the event. Further, the system evaluates the business support degree of cold data for real-time security event according to the data type of cold data (such as video, log) and the event potential harm level. This evaluation focuses on the real role and value of cold data in solving specific types of events, ensuring that data that provides the most support for event handling is given priority.

[0047] Subsequently, the system comprehensively utilizes the event emergency level, the event response time limit, the correlation degree of cold data and real-time security event in time dimension and space dimension, and the business support degree of cold data for real-time security event to calculate the business importance adjustment factor of cold data. This step is a key comprehensive evaluation that weights and integrates multiple factors such as the urgency of the event itself, the spatio-temporal relevance of data and event, and the business support capability of data for event, thereby obtaining an adjustment factor that can reflect the current business importance of cold data in multiple aspects. In some multi-factor scenarios, when there are multiple real-time security events associated with cold data, the system identifies the spatio-temporal overlap relationship or business logic association relationship between these events. Based on these relationships and the business importance adjustment factor of cold data for each event, the system aggregates to obtain the final business importance adjustment factor of cold data. This aggregation mechanism solves the multi-factor nature of cold data that may be associated with multiple events at the same time, avoids repeated calculation or omission of importance, and ensures that the evaluation in the multi-event context is logical and efficient. Finally, the system adjusts the business importance of cold data according to this final business importance adjustment factor.

[0048] Through the above detailed real-time adjustment mechanism, the business importance of cold data can accurately reflect its real value and priority in the current real-time security event context. This, combined with the method of determining the cold data preheating priority according to the closeness of the association between cold data and hot data, the business importance of cold data, and the preset preheating data volume limit in the prior scheme, makes the decision-making process of cold data preheating more accurate. Specifically, when a real-time security event occurs, the present scheme can real-time improve the business importance of core cold data according to the characteristics of the event and the multi-dimensional association of cold data, so that these data obtain a higher weight in the subsequent preheating priority determination process. This ensures that under the limitation of the preheating data volume, the system can preferentially select and migrate those cold data that are important for event response and analysis core, avoiding preheating delay or resource waste caused by inaccurate cold data importance evaluation, and significantly improving the response efficiency and investigation progress of security events.

[0049] To further illustrate the implementation details of the present scheme, a specific application scenario can be considered: suppose a fire alarm event occurs in area A of a building, and the system receives a fire alarm information, which contains the event type "fire alarm", the occurrence time 10:00 am, and the occurrence area A. The system first acquires the preset event quantification parameters for the "fire alarm" event type. For example, the event emergency level of "fire alarm" can be set as "high", the event potential harm level as "extremely high", and the event response time limit as "5 minutes".

[0050] Next, the system will identify the cold data associated with the fire alarm event. For example, there may be a video recording of camera 1 in area A before and after the fire alarm (cold data A), a card swiping record of access control 2 in area A at 09:50 am (cold data B), and a maintenance record of fire extinguisher 3 in area A three months ago (cold data C). The system will calculate the association degree of these cold data with the fire alarm event in the time dimension and the space dimension according to the meta information of the cold data and the occurrence time and occurrence area of the fire alarm event. For example, cold data A highly overlaps with the fire alarm event in time and is completely consistent in space, so its association degree can be calculated as a high value. Cold data B is slightly earlier than the fire alarm in time and consistent in space, so its association degree can be calculated as a medium value. Cold data C is much earlier than the fire alarm in time and consistent in space, so its association degree can be calculated as a low value.

[0051] Subsequently, the system evaluates the business support degree of the cold data to the fire alarm event according to the data type of the cold data and the potential hazard level of the event. For example, for a fire alarm event with a "very high" potential hazard level, the video recording (cold data A) can provide direct visual evidence of the scene, and its business support degree can be evaluated as "high". The access card record (cold data B) can assist in confirming the personnel access situation, and its business support degree can be evaluated as "medium". The fire extinguisher maintenance record (cold data C) is associated with the area, but has low direct support to the real-time fire alarm response, and can be evaluated as "low".

[0052] Then, the system calculates the business importance adjustment factor of each cold data by integrating the event emergency level (high), the event response time limit (5 minutes), the time and space correlation degree of the cold data to the fire alarm event (high, medium, low), and the business support degree of the cold data to the fire alarm event (high, medium, low). For example, the adjustment factor of cold data A can be calculated as 0.9, the adjustment factor of cold data B can be calculated as 0.6, and the adjustment factor of cold data C can be calculated as 0.2.

[0053] In some cases, if a fire alarm event and a personnel intrusion event occur simultaneously in area A, and cold data A (video recording) is associated with both events. The system will identify the spatio-temporal overlap relationship (occurring in the same area, time period intersection) or business logic association relationship (there may be a logic of intrusion leading to fire) between the two events. The system will aggregate the final business importance adjustment factor of cold data A according to these relationships and the respective business importance adjustment factors of cold data A to the fire alarm event and the intrusion event. For example, if the adjustment factor of the fire alarm event is 0.9 and the adjustment factor of the intrusion event is 0.7, the system can use weighted average or maximum value to aggregate a higher final adjustment factor, such as 0.95.

[0054] Finally, the system adjusts the business importance of the cold data according to the final business importance adjustment factor. For example, the business importance of cold data A will be significantly improved, the business importance of cold data B will be improved, and the business importance of cold data C will be limited. In this way, in subsequent determination of the cold data preheating priority, cold data A will have the highest priority, ensuring that it can be preheated first, thereby providing timely and core important on-site video information for security personnel to assist in rapid response and handling of the fire alarm event.

[0055] The scheme solves the problem that the importance of cold data cannot accurately and timely reflect the real value and urgency of the cold data in real-time security events by introducing multi-dimensional quantitative parameters and real-time evaluation mechanism. By obtaining event quantitative parameters according to the event type, and calculating the correlation degree of cold data and events in space and time and the business support degree of events, the real value of cold data in a specific event background can be evaluated in multiple aspects and based on facts. Further, by calculating the business importance adjustment factor and aggregating in a multi-event correlation scenario, the accuracy and multi-aspect of cold data importance evaluation are ensured, and the delay of core information acquisition is avoided. Finally, according to the adjusted business importance, the system can preferentially warm up the cold data that plays an important role in event response and analysis, thereby significantly improving the response efficiency and investigation progress of security events.

[0056] In some embodiments, after the cold data migration is completed, the step of performing downgrade processing on the hotness label of the cold data according to the preset time or the change of the hotness of the hot data includes: After the cold data migration is completed, obtaining the business process identifier associated with the cold data and the current state information of the business process; Monitoring user operation behaviors associated with the business process identifier; the user operation behaviors include continuous access to the cold data, generation of a report related to the business process, or update of the state of the business process; Monitoring system events associated with the business process identifier; the system events include a new sensor alarm or a response of a linkage device; According to the user operation behaviors, the system events, and the current state information of the business process, evaluating the activity level of the business process and determining the maintenance requirement of the business process for the hotness label of the cold data; According to the preset time, the change of the hotness of the hot data, and the maintenance requirement of the business process for the hotness label of the cold data, performing downgrade processing on the hotness label of the cold data.

[0057] A business process identifier is a symbol or code used to uniquely identify a specific business process. It can be implemented using a globally unique identifier, event number, or custom string sequence. The current state of a business process refers to the stage or progress of the business process at a specific point in time. It can be implemented using enumerated values ​​(such as "under investigation," "report writing," or "pending review"), state nodes in a state machine model, or a combination of timestamps and stage descriptions. User operation behavior refers to the actions taken by users to interact with business processes through system interfaces or interfaces. It can be implemented using logging, API call monitoring, or user interface event capture. System events refer to business process-related events automatically triggered by the security system or its associated devices. They can be implemented using message queue monitoring, sensor data stream analysis, or device status change notifications. The activity level of a business process refers to whether the business process is currently in progress or requires continuous attention. It can be implemented using rule-based reasoning, machine learning model evaluation, or expert system judgment. The business process's need to maintain the heat mark of cold data refers to the necessity of keeping the associated cold data in a hot storage state during the active business process. This can be achieved by using Boolean marks, priority values, or dynamic evaluation results based on business rules.

[0058] The scheme of the present application, after the completion of cold data migration, no longer relies only on the preset time or data access heat change to make the downgrade judgment, but first acquires the business process identifier associated with the cold data and the current state information of the business process. This step is the basis for understanding the real business value of the data, which associates the originally isolated data with the specific security business scenarios (such as event investigation, security inspection, etc.) it serves, and provides important business context information for subsequent evaluation of data activity by obtaining the unique identifier of the business process and the current stage or state it is in. On this basis, the system will monitor the user operation behavior and system events associated with the business process identifier in parallel. User operation behavior, such as continuous access to cold data, generation of business process related reports, or updating of business process status, directly reflects the input and progress of security personnel on the business process. Even if the data itself is not directly accessed, if the user is writing a report or updating the process status, it indicates that the business process is still advancing and the data still has business value. At the same time, system events, such as new sensor alarms or responses of linked devices, provide an automated and objective judgment of the activity of the business process. These system-level feedbacks usually mean that the actual security events that the business process is dealing with are still developing or need continuous attention. By combining user's subjective operation and system's objective events, the system can more comprehensively evaluate the real-time activity state of the business process. Subsequently, the system comprehensively evaluates the activity level of the business process according to these user operation behaviors, system events, and current state information of the business process, and intelligently determines the maintenance requirements of the business process for the cold data heat label. This comprehensive judgment mechanism can effectively identify data that, although the independent access frequency is not high, still needs to maintain a hot state due to business needs. For example, a security event investigation process may last for several weeks, during which the access frequency of specific video clips may fluctuate, but as long as the investigation report is still being written or there are new related alarms, the process is considered active, and its associated data should maintain the heat label. Finally, when performing cold data heat label downgrade processing, the system combines the traditional downgrade basis (preset time, heat data access heat change) with the newly determined maintenance requirements of the business process for the cold data heat label. This means that even if the data meets the traditional downgrade conditions (such as reaching the preset time or the access heat decreasing), if the business process is still active and has the need to maintain the heat label for the cold data, the downgrade processing will not be performed immediately. This multi-dimensional, business-aware judgment mechanism makes the cold data downgrade decision more accurate and avoids the "cold-hot-cold" cycle migration caused by the incomplete business process. In this way, the scheme of the present application forms a more perfect closed loop with the previous data preheating and migration mechanism, ensuring the efficient usability of security data throughout the business life cycle, thereby improving the overall efficiency and stability of the distributed storage management of building security data.

[0059] In one specific embodiment, assume that a building security system detects a nighttime intrusion event and has pre-warmed the initial cold data (e.g., historical surveillance videos, access records) related to the event to the hot storage nodes. After the cold data migration is completed, the system immediately obtains the business process identification (e.g., “Event ID: 20231026-001”) associated with the intrusion event investigation business process and the current state information of the business process (e.g., “Investigation Stage: Preliminary Forensics”). Subsequently, the system continuously monitors the user operation behaviors associated with the business process identification. For example, if the security personnel repeatedly plays back a specific surveillance video clip of the intrusion occurrence period through the security management platform, or frequently modifies and saves a draft of the investigation report related to the event in the event report module, or updates the status of the event from “Preliminary Forensics” to “In-depth Analysis” in the system, these behaviors will be recorded and recognized by the system as user operation behaviors. At the same time, the system also monitors the system events associated with the business process identification. For example, if after the intrusion event occurs, the system detects new sensor alarms (e.g., the infrared detector is triggered again) or linkage device responses (e.g., the alarm is sounded again) related to the same area or the same intruder in the following days, these will be recognized as system events. Then, the system comprehensively evaluates the activity level of the intrusion event investigation business process according to these user operation behaviors, system events, and current state information of the business process. For example, if the security personnel continuously access related data, frequently update reports, and there are new related alarms, the system will judge that the business process is in a high activity state. Based on this activity level, the system determines the maintenance requirement of the cold data hotness label of the business process, such as setting it to “high maintenance requirement”. Finally, when the system performs the cold data hotness label downgrade processing, it will comprehensively consider the preset time (e.g., the data has been in the hot storage node for more than 7 days), the hot data access hotness change (e.g., the access frequency of this video clip has decreased in the past 24 hours), and the maintenance requirement of the cold data hotness label of the business process. Even if the video clip meets the traditional downgrade conditions, but since the intrusion event investigation business process is still in an active state and has a “high maintenance requirement” for this data, the system will not immediately downgrade the hotness label of this video clip, but will continue to keep it in the hot storage node to ensure that the security personnel can quickly access it during the investigation process.

[0060] The scheme of the present application solves the problem that the preheated cold data may be prematurely degraded due to the rigidity of the degradation strategy in the building security complex event investigation scene by introducing the evaluation of the activity level of the business process. By obtaining the business process identifier and state information associated with the cold data and monitoring user operation behavior and system events, the system can comprehensively judge the real activity level of the business process, thereby avoiding the mistakes caused by judging only according to the preset time or data access frequency. This intelligent degradation decision mechanism effectively avoids the "cold-heat-cold" cycle migration caused by the fact that the business process has not ended, significantly reduces the unnecessary storage resource repeated migration consumption, and reduces the occupation of the system internal network bandwidth and node input and output resources. At the same time, it ensures that in the persistent business process such as security investigation, the key data can be continuously kept in the hot storage state, avoids the security personnel from facing data migration delay again in subsequent operations, thereby guaranteeing the coherence of security work, improving the emergency response and investigation efficiency, and enhancing the overall stability and resource utilization efficiency of the building security data distributed storage management.

[0061] Reference is made to the accompanying drawings Figure 2 The present application provides a building security data distributed storage management system, comprising: The acquisition module 100 is configured to acquire security data, wherein the security data comprises hot data and cold data with a hotness label; the hotness label represents the access hotness of the corresponding data, and the access hotness of the hot data is higher than that of the cold data; The monitoring and identifying module 200 is configured to monitor the access request for the security data, and when detecting the access request for the hot data, identify the cold data having a business logic association with the hot data through a preset security data business association graph according to the identifier of the hot data; The evaluation and migration module 300 is configured to determine the preheating priority of the cold data according to the association closeness between the cold data and the hot data, the business importance of the cold data, and a preset preheated data amount limit, and trigger the asynchronous migration of the cold data from the cold data storage node to the hot data storage node; The level control module 400 is configured to upgrade the hotness label of the cold data during the migration of the cold data, and after the migration of the cold data is completed, downgrade the hotness label of the cold data according to the preset time or the change of the access hotness of the hot data.

[0062] In this document, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any such actual relationship or order between such entities or actions.

[0063] The above merely illustrates the embodiments of the present application but should not be taken as limitations to the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A building security data distributed storage management method, characterized in that, The method comprises the following steps: obtaining security data; the security data comprises hot data and cold data containing a hotness label; the hotness label represents the access hotness of the corresponding data, and the access hotness of the hot data is higher than that of the cold data; monitoring an access request for the security data, and when detecting an access request for the hot data, identifying, according to the identification of the hot data, cold data that has a business logic association with the hot data through a preset security data business association graph; determining a preheating priority of the cold data according to the association closeness between the cold data and the hot data, the business importance of the cold data, and a preset preheating data volume limit, and triggering asynchronous migration of the cold data from a cold data storage node to a hot data storage node; during the migration of the cold data, upgrading the hotness label of the cold data, and after the migration of the cold data is completed, performing downgrade processing on the hotness label of the cold data according to a preset time or a change in the access hotness of the hot data.

2. The method of claim 1, wherein, The security data business association graph is constructed according to meta information of the security data, and the meta information comprises data types, event identifications, device identifications, time stamps, geographic region identifications, and personnel identifications.

3. The method of claim 1, wherein the method further comprises: The security data business association graph takes security data units as nodes and business logic relationships between the data units as edges; the business logic relationships comprise event associations, space-time associations, and entity associations.

4. The method of claim 1, wherein the method further comprises: The step of monitoring an access request for the security data, and when detecting an access request for the hot data, identifying, according to the identification of the hot data, cold data that has a business logic association with the hot data through a preset security data business association graph comprises: monitoring an access request for the security data, and when detecting an access request for the hot data, obtaining the identification of the hot data and access context information of the access request; identifying, according to the identification of the hot data, an initial cold data set that has a business logic association with the hot data through a preset security data business association graph; performing association degree evaluation on the initial cold data set according to the access context information and the meta information of each cold data in the initial cold data set to obtain the association degree of each cold data with a current access business scenario of the hot data; according to the association degree and a preset association degree threshold, screening cold data that satisfies the association degree threshold from the initial cold data set as cold data for subsequent processing.

5. The method of claim 4, wherein, The step of performing association degree evaluation on the initial cold data set according to the access context information and the meta information of each cold data in the initial cold data set to obtain the association degree of each cold data with a current access business scenario of the hot data comprises: for each cold data in the initial cold data set, obtaining at least one query intention element from the access context information, and extracting a meta information element corresponding to the query intention element from the meta information of the cold data; according to a preset matching rule, calculating an element matching degree of the cold data on each pair of combinations of the query intention element and the meta information element; according to a preset weight, performing weighted aggregation on the element matching degrees of the cold data on each element to obtain the association degree of the cold data with the current access business scenario of the hot data.

6. The method of claim 5, wherein, The query intention element comprises a query time range, a query geographic region, a query event type, a query device identification, or a query personnel identification.

7. The method of claim 1, wherein the method further comprises: The step of determining the preheating priority of the cold data according to the closeness of the association between the cold data and the hot data, the business importance of the cold data, and the preset preheating data volume limit comprises: Obtaining real-time security event information; According to the real-time security event information, identifying cold data that has a business logic association with the real-time security event in the security data business association graph; According to the type of the real-time security event and the association degree between the cold data and the real-time security event, dynamically adjusting the business importance of the cold data; According to the closeness of the association between the cold data and the hot data, the adjusted business importance of the cold data, and the preset preheating data volume limit, determining the preheating priority of the cold data.

8. The method of claim 7, wherein, The step of dynamically adjusting the business importance of the cold data according to the type of the real-time security event and the association degree between the cold data and the real-time security event comprises: For the event type of the real-time security event, obtaining a preset event quantification parameter; the event quantification parameter includes an event emergency level, an event potential harm level, and an event response time limit; According to the meta information of the cold data and the occurrence time and area of the real-time security event, calculating the association degree of the cold data and the real-time security event in the time dimension and the space dimension; According to the data type of the cold data and the event potential harm level, evaluating the business support degree of the cold data for the real-time security event; According to the event emergency level, the event response time limit, the association degree of the cold data and the real-time security event in the time dimension and the space dimension, and the business support degree of the cold data for the real-time security event, calculating a business importance adjustment factor of the cold data; When there are multiple real-time security events associated with the cold data, identifying the spatio-temporal overlap relationship or the business logic association relationship between the multiple real-time security events, and according to the spatio-temporal overlap relationship or the business logic association relationship and the business importance adjustment factor of the cold data for each event, aggregating to obtain a final business importance adjustment factor of the cold data; According to the final business importance adjustment factor, adjusting the business importance of the cold data.

9. The method of claim 1, wherein the method further comprises: After the cold data migration is completed, the step of performing downgrade processing on the hotness label of the cold data according to the preset time or the change in the hotness of the hot data access comprises: ​ After the cold data migration is completed, obtaining a business process identifier associated with the cold data and current state information of the business process; Monitoring user operation behavior associated with the business process identifier; Monitoring system events associated with the business process identifier; According to the user operation behavior, the system event, and the current state information of the business process, evaluating the activity level of the business process and determining the maintenance demand of the business process for the hotness label of the cold data; According to the preset time, the change in the hotness of the hot data access, and the maintenance demand of the business process for the hotness label of the cold data, performing downgrade processing on the hotness label of the cold data.

10. A building security data distributed storage management system, characterized in that, Comprise: An acquisition module is configured to acquire security data, wherein the security data comprises hot data and cold data with hotness labels; the hotness label represents the access hotness of the corresponding data, and the access hotness of the hot data is higher than that of the cold data; The monitoring and identifying module is configured to monitor an access request for the security data, and when detecting an access request for hot data, identify, according to an identifier of the hot data, cold data that is in a business logic association with the hot data through a preset security data business association graph; The evaluation migration module is configured to determine a preheating priority of the cold data according to a closeness of association between the cold data and the hot data, a business importance of the cold data, and a preset preheating data volume limit, and trigger asynchronous migration of the cold data from a cold data storage node to a hot data storage node; The level control module is configured to upgrade a hotness label of the cold data during the migration of the cold data, and after the migration of the cold data is completed, downgrade the hotness label of the cold data according to a preset time or a change in hot data access hotness.

Images