A GIS-based location flow anomaly detection method, device and medium

Abstract

The application discloses a GIS-based position flow anomaly detection method and device and a medium. The method comprises the following steps: after receiving position flow data, the position flow data is gridded based on a quadtree grid, and the latitude and longitude coordinates are converted into decimal numbers; the area position of the position flow data in the quadtree grid is detected according to the decimal numbers; the residence time anomaly detection and the trajectory deviation anomaly detection are respectively performed in combination with a time window queue; and finally, the anomaly detection result is sent to a warning center. The application adopts a GeoSOT grid encoding technology, simplifies the traditional complex spatial geometry operation into numerical size comparison, combines a dynamic sliding time window with the lightweight processing of the gridded trajectory data, greatly reduces the calculation amount, effectively solves the real-time deficiency problem of the traditional method, and realizes the rapid response detection of the position flow anomaly.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of position flow data anomaly detection, and in particular to a GIS-based position flow anomaly detection method, device and medium. BACKGROUND

[0002] Flow data is a continuously generated, real-time, dynamically changing data set, with characteristics such as real-time arrival, time sequence, infinity and adaptability.

[0003] Position flow is a data stream that describes the change of user position, and is also flow data itself. It records the position information of a user within a period of time, and is used to analyze the user's movement pattern, behavior characteristics, and provide personalized services. Position flow can be obtained in various ways, including GPS positioning, WiFi signal positioning, and base station positioning. After obtaining the position information, data cleaning, data mining, and visualization are usually required to extract useful information.

[0004] The sliding time window algorithm is a commonly used flow data analysis method for processing trends in time series data. This algorithm maintains a fixed-size time window, constantly sliding and updating the data within the window, and calculates relevant statistical indicators in real time to detect changes and anomalies in the data.

[0005] The GIS grid system usually uses earth subdivision technology to subdivide the earth's surface to form a multi-level grid with similar shapes, seamless and non-overlapping space, and continuous scale. Common ones include GARS grid, Google Earth grid, and domestic GeoSOT grid (equidistant latitude and longitude coding grid) and others. In the geographic information system (GIS), the grid coding system is used to efficiently store, retrieve and manage spatial data, to achieve accurate subdivision and fast positioning of the earth's surface, and to support various spatial analysis and applications.

[0006] In the prior art, position flow anomaly detection relies on traditional spatial geometric calculation or single-dimensional time series analysis, and there are two major core pain points: one is high computational complexity, when directly performing area range judgment or trajectory matching operations based on latitude and longitude coordinates, complex geometric operations need to be frequently executed, which is difficult to meet the real-time processing requirements; the second is single detection dimension, often only paying attention to whether the position exceeds a fixed area, ignoring multi-dimensional abnormal scenarios such as excessive residence time, trajectory deviation from the predetermined path, and abnormal moving speed, and cannot fully cover the security monitoring needs in actual applications.

[0007] Therefore, how to integrate the time series analysis capability of the sliding time window and the spatial calculation advantage of the GIS grid coding, and construct a low-complexity, multi-dimensional real-time position flow anomaly detection scheme, has become a technical problem to be solved in the field of flow data processing and geographic information application. SUMMARY

[0008] In view of the above problems, the present application aims to provide a GIS-based location flow anomaly detection method, device and medium, which solves the problems of high calculation complexity and single detection dimension in the prior art.

[0009] The first aspect is a GIS-based location flow anomaly detection method, comprising:

[0010] S1, receiving location flow data, griding the location flow data based on a quadtree grid, and converting latitude and longitude coordinates into decimal numbers;

[0011] S2, detecting the location of the location flow data in the quadtree grid area according to the decimal numbers of the location flow data;

[0012] S3, combining a time window queue to perform residence time anomaly detection on the gridded location flow data;

[0013] S4, combining a time window queue to perform trajectory deviation anomaly detection on the gridded location flow data;

[0014] S5, sending the anomaly detection to an early warning center.

[0015] In an embodiment of the present application, when receiving the location flow data in S1, the Netty platform is adopted, which is compatible with http, https, tcp and udp network transmission protocols.

[0016] In an embodiment of the present application, the quadtree grid in S1 adopts a 32-level deep GeoSOT grid.

[0017] In an embodiment of the present application, the conversion of the latitude and longitude coordinates into decimal numbers in S1 comprises:

[0018] The received latitude and longitude coordinates of the location flow data are binary encoded according to the 32-level GeoSOT grid, and then converted into decimal numbers.

[0019] In an embodiment of the present application, the detection of the location of the location flow data in the grid area in S2 comprises the steps of:

[0020] S21, determining the grid level of the location flow data;

[0021] S22, calculating the binary number of the grid code of the location flow data according to the reverse Z order,

[0022] S23, performing AND operation on the binary number and the high bit code of the grid level,

[0023] S24, converting the operation result into the corresponding decimal number of the location flow data;

[0024] S25, compare the position flow data decimal number with the numerical size of the grid area, and determine the grid area position of the position flow data.

[0025] In one embodiment of the present application, the step of S3, the residence time anomaly detection on the grid position flow data, comprises the steps of:

[0026] S31, determine the grid corresponding to the residence area of the position flow data;

[0027] S32, merge the position flow data of the newly received point into the grid data of the same level;

[0028] S33, continuously record the residence time of the position flow data in the same grid area within the window;

[0029] S34, when the residence time exceeds the set threshold, trigger the residence time anomaly.

[0030] In one embodiment of the present application, the step of S4, the trajectory deviation anomaly detection on the grid position flow data, comprises the steps of:

[0031] S41, save the position flow data as a trajectory grid through a trajectory queue;

[0032] S42, generate an approximate trajectory through a non-Bézier curve simulation trajectory grid;

[0033] S43, judge whether the position flow data is within the predetermined trajectory grid;

[0034] S44, trigger the trajectory deviation anomaly for the position flow data deviating from the predetermined trajectory grid.

[0035] In one embodiment of the present application, the trajectory deviation anomaly detection comprises a speed anomaly detection.

[0036] The second aspect: an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to realize the steps of the method provided in the first aspect.

[0037] The third aspect: a non-transitory computer readable storage medium, having a computer program stored thereon, wherein the computer program is executable on a processor to realize the steps of the method provided in the first aspect.

[0038] The beneficial effects of the present application are:

[0039] 1.The application adopts GeoSOT grid encoding technology to convert latitude and longitude coordinates into decimal values, simplifies the traditional area range judgment, trajectory matching and other operations relying on complex spatial geometry operations into efficient numerical size comparison, and greatly reduces the calculation amount of position stream data by combining dynamic sliding time window with lightweight processing of grid trajectory data, effectively solving the real-time deficiency problem caused by complex geometry operation in traditional methods, realizing rapid response detection of position stream anomaly, and significantly reducing the calculation complexity.

[0040] 2.The method integrates area range detection, residence time anomaly detection, trajectory deviation detection and speed anomaly detection, etc., aiming at the defect of single detection dimension in traditional methods. Through grid trajectory queue storage and time sequence correlation analysis, it can not only judge whether the position is out of bounds, but also monitor whether the residence time in the grid is over-standard, whether the actual trajectory deviates from the preset path, and whether the moving speed exceeds the device threshold, forming a multi-dimensional collaborative anomaly detection closed loop, fully adapting to the safety monitoring scene in actual application, building a multi-dimensional collaborative detection system, and realizing comprehensive coverage of monitoring requirements.

[0041] 3.The platform is based on Spring Cloud framework and B / S architecture. While reducing the calculation complexity through grid encoding at the algorithm layer, it also improves the multi-protocol data access efficiency with the help of Netty high-performance communication framework, supports real-time reception of multi-source position stream data such as GPS, WiFi, base station, and optimizes trajectory queue storage through quadtree grid merging to avoid memory overflow problem. The collaborative optimization of algorithm and architecture not only guarantees the real-time detection efficiency, but also improves the expansion and adaptation ability of the system to multi-source data and multi-scene application, realizing the collaborative optimization of algorithm and architecture. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 It is a flowchart of the method of the application;

[0043] Figure 2 It is a principle flowchart of the method of the application;

[0044] Figure 3 It is a position stream data access diagram of the application;

[0045] Figure 4 It is a GeoSOT grid Z sequence inverted index diagram of the application;

[0046] Figure 5 It is a sliding window t0 to t1 diagram of the application;

[0047] Figure 6 It is a stack and corresponding grid diagram of the application;

[0048] Figure 7 It is a residence timeout stack cleaning diagram of the application;

[0049] Figure 8 Grid data stream record update schematic diagram for the same grid of the present application;

[0050] Figure 9 Grid and corresponding trajectory queue schematic diagram for the present application.

[0051] Figure 10 Adjacent grid corresponding trajectory queue schematic diagram for the present application;

[0052] Figure 11 Non-adjacent grid corresponding trajectory queue schematic diagram for the present application;

[0053] Figure 12 Trajectory queue quadtree merging schematic diagram for the present application;

[0054] Figure 13 Structure schematic diagram of the electronic device of the present application. DETAILED DESCRIPTION

[0055] Embodiments of the present application are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar symbols represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the accompanying drawings are exemplary, only for explaining the present application, and cannot be understood as limiting the present application.

[0056] In the prior art, position stream anomaly detection relies on traditional spatial geometric calculation or single-dimensional time series analysis, which has the problems of high computational complexity, and when directly judging the region range, trajectory matching and other operations based on latitude and longitude coordinates, complex geometric operations need to be frequently executed, which is difficult to meet the real-time processing requirements; the detection dimension is single, often only paying attention to whether the position exceeds the fixed region, ignoring the multi-dimensional abnormal scenarios such as long residence time, trajectory deviation from the predetermined path, and abnormal moving speed, and cannot comprehensively cover the safety monitoring needs in actual applications.

[0057] Embodiment 1:

[0058] To solve the above problems, the present embodiment provides a GIS-based position stream anomaly detection method, Figure 1 Flowchart of the method of the present embodiment, Figure 2 The principle flowchart of the method, the method comprises:

[0059] S1, receiving position stream data, grid encoding the position stream data based on a quadtree grid, and converting latitude and longitude coordinates into decimal numbers.

[0060] As Figure 3As shown, the present application is based on the Spring Cloud framework to develop a location flow data anomaly detection platform, adopts a B / S network architecture scheme, uses the Netty platform to improve the efficiency of interface access, and the Netty platform supports socket, http, https, tcp or udp network transmission protocols, can realize different format data reporting, data query, area detection, trajectory anomaly detection and residence point analysis and other functions.

[0061] Further, in terms of data processing, massive location flow data can be efficiently stored and managed, distributed file systems and database technologies are used to ensure data security and integrity.

[0062] Further, for different formats of data reporting, the platform will perform strict format verification and data cleaning to remove invalid or incorrect data and ensure the accuracy of subsequent analysis.

[0063] The latitude and longitude position flow data received by the Netty platform is binary coded according to the quadtree grid, and then converted to a decimal number.

[0064] For example, the latitude and longitude of the location flow data is (120.34, 23.23), which is converted to the corresponding 32-level GeoSOT grid (global equal latitude and longitude subdivision grid), binary is 0000010111011010100001101100101011010000000000000000000000000000, corresponding to the decimal number 421797720743739392.

[0065] S2, according to the decimal number of the location flow data, detect the location flow data in the quadtree grid area, specifically:

[0066] First, determine the grid level of the location flow data.

[0067] According to the accuracy requirements and actual application scenarios of the data, select the appropriate grid level. Different grid levels correspond to different spatial resolutions, the higher the level, the finer the grid division, the more accurate the location representation, but at the same time the data volume and computational complexity will also increase accordingly.

[0068] Then, calculate the binary number of the location flow data grid code according to the reverse Z sorting.

[0069] Reverse Z sorting is a special sorting method that can effectively encode the location information in two-dimensional space, so that adjacent positions also have certain correlation in coding. The binary code calculated by this sorting method can more accurately reflect the position relationship of the location flow data in the quadtree grid.

[0070] Then, the binary number is ANDed with the grid level high bit coding.

[0071] The specific sub-region of the position stream data in the quadtree grid is further determined by the result of the AND operation. This is because the grid level high bit coding represents the basic division information of the grid at a specific level. After the AND operation with the binary number, some unnecessary low bit information is filtered out, and the key level corresponding part is focused on.

[0072] Then, the operation result is converted into the corresponding position stream data decimal number.

[0073] For example, for a grid at level 25, with row number 7885184 and column number 1521408, the corresponding range is longitude (120.34~120.340017), latitude range (23.23~23.230017), level high bit coding is 11111111111111111111111110000000, dimension binary number coding is 00001011100110000000000000000000, longitude binary number coding is 00111100001010001100000000000000, longitude and latitude conversion binary number is 0000010111011010100001101100101011010000000000000000000000000000, and conversion decimal number is 421797720743739392.

[0074] After the post-level grid code is processed by adding 0, the corresponding binary range of the grid is 0000010111011010100001101100101011010000000000000000000000000000~0000010111011010100001101100101011010000000000000011111111111111, and the corresponding decimal number range is 421797720743739392~421797720743755775.

[0075] In this way, the decimal number becomes the unique identifier of the position stream data in the quadtree grid at this level, and through this unique identifier, the device can quickly and accurately locate the specific position of the position stream data in the quadtree grid. When performing position stream anomaly detection, this unique identifier can be used to efficiently compare position stream data at different time points.

[0076] Finally, the position stream data decimal number is compared with the numerical value of the grid region to determine the grid region position of the position stream data.

[0077] Compare the decimal number of the position stream data with the numerical value range of the grid area to determine whether the position stream data of the point is within the grid area.

[0078] For example, for the judgment of the position stream data (120.34, 23.23) and the grid area range (longitude: 120.34~120.340017, latitude: 23.23~23.230017), after being gridified by GeoSOT, it is transformed into a decimal number judgment. Since 421797720743739392 ≤ 421797720743739392 <4217977>20743755775, the position stream data is within the area range and is normal data; otherwise, it is abnormal data and triggers an alarm.

[0079] S3. Combine the time window queue to perform abnormal detection of the residence time for the gridified position stream data.

[0080] As Figure 5 shown, by dynamically sliding the time window, record the gridified trajectory data to provide abnormal detection of the residence time, and complete the detection by recording the residence time within the grid. Specifically:

[0081] First, determine the grid corresponding to the residence area of the position stream data. Convert the position stream data into the corresponding grid number to accurately identify the specific grid where the position stream data resides.

[0082] Then, merge the position stream data of the newly received point upward into grid data of the same level to uniformly process and analyze position information of different precisions. Through this merging operation, the scattered position stream data can be integrated into representative grid data, reducing the data complexity.

[0083] Then, continuously record the residence time of the position stream data within the same grid area in the window. The start time (the moment when the first one enters this grid) and the end time (the moment when the last one leaves this grid) of the same area (grid) within the window can be continuously recorded to calculate the residence time.

[0084] Finally, when the residence time exceeds the set threshold, trigger an abnormal residence time.

[0085] Compare the calculated residence time with the preset normal residence time threshold. If the residence time exceeds the normal threshold range, it is determined that there is an abnormal residence time in the position stream data within this grid area, and an alarm is triggered.

[0086] Application example:

[0087] As Figure 5 and Figure 6As shown in the sliding window period t0, p0 and p1 are two data in t0, and p0 and p1 are put into the residence point stack, and p0 and p1 are constructed into a grid g0.

[0088] As shown in the sliding window period t0, p0 and p1 are two data in t0, and p0 and p1 are put into the residence point stack, and p0 and p1 are constructed into a grid g0. Figure 5 As shown, the window slides to the right once, and there are p1 and p2 in the window period t1, and p2 is newly received data, and p2 is grid encoded, and whether p2 is in the grid g0 is judged according to the area range detection.

[0089] As shown, the window slides to the right once, and there are p1 and p2 in the window period t1, and p2 is newly received data, and p2 is grid encoded, and whether p2 is in the grid g0 is judged according to the area range detection. Figure 7 As shown, if p2 is not in the grid g0, a new residence area grid g1 is formed with p2, the grid g0 where p0 and p1 are located forms a residence point record, the residence time from p0 to p1 is calculated, and when the residence time exceeds the set threshold, a pre-warning is triggered. The residence stack is emptied and p2 is newly put in.

[0090] As shown, if p2 is not in the grid g0, a new residence area grid g1 is formed with p2, the grid g0 where p0 and p1 are located forms a residence point record, the residence time from p0 to p1 is calculated, and when the residence time exceeds the set threshold, a pre-warning is triggered. The residence stack is emptied and p2 is newly put in. Figure 8 As shown, if p2 is in the grid g0, the last record (p1) in the grid g0 is popped out and p2 is put in, that is, the residence point start time point record of the current grid g0 is updated to p0 to p2, and the grid g0 residence time is updated, and when the residence time exceeds the set threshold, a pre-warning is triggered.

[0091] Then the sliding window moves to the right, and the above method is used for backward processing.

[0092] S4, in combination with the time window queue, the grided position flow data is subjected to trajectory deviation anomaly detection.

[0093] The trajectory deviation detection algorithm supports speed anomaly detection and trajectory deviation detection. A trajectory queue is used to save the driving trajectory, considering the infinity of the position flow, the trajectory queue here stores not individual incoming position flow data, but trajectory grids, and the final trajectory will be composed of individual grids, and a rough trajectory is generated by non-Bézier curve simulation. Therefore, the real-time trajectory deviation detection is performed by pre-setting the path, griding the path to obtain a grid trajectory setting path, when the position flow data uploaded by the device is received in sequence, the position flow data is converted into a grid, and whether it is in the set trajectory grid is judged. If not, it is considered that the device deviates from the predetermined trajectory, and a pre-warning is triggered. At the same time, the set grid trajectory path is also in order, and when the device path order is wrong, a pre-warning will also be triggered. Specifically:

[0094] First, the position flow data is saved as a trajectory grid through the trajectory queue, and the grid encoding technology is used to convert the position flow data into the corresponding trajectory grid identifier, so that the position information can be abstracted and organized efficiently. Then, according to the preset rules and algorithms, the trajectory grid is analyzed and processed.

[0095] Then, the approximate trajectory is generated by simulating the trajectory grid through non-Bézier curve, which can reduce the complexity and time cost of calculation while ensuring the basic form of the trajectory.

[0096] Then, it is judged whether the position flow data is in the predetermined trajectory grid, and the generated approximate trajectory is compared with the preset grid trajectory setting path. In the comparison process, each key node and the overall trend of the trajectory are analyzed in detail.

[0097] Finally, the position flow data deviating from the predetermined trajectory grid triggers the trajectory deviation anomaly.

[0098] If the grid corresponding to the position flow data is in the preset grid trajectory setting path, and the trajectory order is consistent with the preset order, it is determined that the equipment is running normally, and no early warning is triggered; if the grid corresponding to the position flow data is not in the preset grid trajectory setting path, or the trajectory order does not match the preset order, it is determined that the equipment deviates from the predetermined trajectory, and the early warning mechanism is triggered immediately.

[0099] Application example:

[0100] As shown in Figure 9 the sliding window period t0, the position flow data p0 and p1 constitute the corresponding grid g0, the grid g0 is encoded and put into the trajectory queue.

[0101] As shown in Figure 10 , the sliding window is moved to the right to obtain t1, which contains p1 and p2, and it is judged whether the grid where p2 is located is adjacent to grid g0 or p2 is inside grid g0.

[0102] As shown in Figure 10 , if the grid g1 where p2 is located is adjacent to g0, the trajectory g0 to g1 is formed, it is needed to judge whether g1 is in the set trajectory, if not, the early warning is triggered, and the relative order of g0 and g1 should also be in accordance with the order in the set trajectory, otherwise, the early warning is triggered. Put the grid g1 into the trajectory queue, slide the window backward, and process the subsequent position flow data in a loop.

[0103] Further, as shown in Figure 11 , if the grid g1 where p2 is located is not adjacent to g0, the edge distance L of the grid is quickly obtained through grid division, the distance range of g0 to g1 is L L, the interval time t, the speed range L / t L / t, combined with the actual device type, according to the relationship between the calculated speed range and the threshold speed set by the device, whether to trigger the speed anomaly early warning is judged.

[0104] As the current trajectory g0 to g1, need to determine, g1 whether in the set trajectory, if not in trigger warning, while g0 and g1 the relative order should also be in accordance with the order of the set trajectory, otherwise, trigger warning. Put g1 grid to the trajectory queue.

[0105] When p2 is inside the grid g0, no new grid is formed, i.e. no new trajectory point is generated, and no operation is performed.

[0106] Finally, the sliding window is moved backward, and the subsequent position stream data is processed in a loop.

[0107] Further, as shown in Figure 12 As the sliding window moves backward, when the number of trajectory forming grids is too large, certain strategies are needed to avoid the problem of insufficient memory caused by too large trajectory queue. When the specified number (e.g. 5000 grids) or the specified time interval (e.g. one day, 1 hour, etc.) is reached, the grids in the queue are subjected to an upward quadtree merging operation, and the topmost root node is the first-level grid. After merging, the trajectory queue is emptied, the merged grids are stored, and the trajectory is generated in a loop.

[0108] S5, send the anomaly detection to the warning center.

[0109] After receiving the anomaly data pushed by the anomaly detection module, the warning center first performs standardization processing on the anomaly information, and uniformly encapsulates it into structured data containing core fields such as anomaly type (region boundary crossing, residence timeout, trajectory deviation, speed anomaly, etc.), anomaly device ID, anomaly occurrence time, anomaly position (original latitude and longitude and corresponding grid code), anomaly details (such as residence timeout duration, trajectory deviation distance, speed exceeding threshold value), etc.

[0110] Then, the warning center classifies the anomaly data according to the preset warning level rules.

[0111] For example, high-risk region boundary crossing, overspeed of more than 50% is determined as level one warning, and ordinary region residence timeout within 30 minutes is determined as level three warning.

[0112] For different levels of warning, the system triggers the corresponding response mechanism: for level one warning, the relevant personnel are immediately sent through multiple channels such as platform Web pop-up window, mobile terminal APP push or SMS notification, and the historical trajectory, recent activity record and other data of the abnormal device are automatically associated for quick checking.

[0113] For level two warning, the relevant personnel are reminded through the Web message center and APP push, and are required to feedback the processing progress within the specified time (such as within 1 hour).

[0114] For level three warning, only the system warning log is recorded for subsequent regular statistical analysis.

[0115] At the same time, the early warning center stores all abnormal early warning information to the abnormal log database of the data layer, supports query, screening and export according to the equipment ID, abnormal type, time range and other dimensions.

[0116] In addition, the early warning center also automatically generates abnormal early warning statistical report, displays the abnormal type distribution, high-frequency abnormal equipment, key abnormal area and other information in a certain period (day, week, month), and displays the information through the visual chart (column chart, pie chart, heat map) on the platform UI end, so as to provide data support for management decision.

[0117] The application further provides an electronic device, Figure 13 The structure schematic diagram of the electronic device provided by the embodiment of the application is shown in the figure, and the electronic device can include a processor, a communications interface, a memory and a communications bus. Figure 13 The processor, the communications interface and the memory can complete mutual communication through the communications bus. The processor can call the logical instructions in the memory, for example, to execute the following method:

[0118] S1, receiving position flow data, griding the position flow data based on a quadtree grid, and converting the latitude and longitude coordinates into a decimal number;

[0119] S2, detecting the position flow data in the quadtree grid area position according to the decimal number of the position flow data;

[0120] S3, combining the time window queue, and performing residence time abnormality detection on the gridded position flow data;

[0121] S4, combining the time window queue, and performing trajectory deviation abnormality detection on the gridded position flow data;

[0122] S5, sending the abnormality detection to the early warning center.

[0123] In addition, the logic instructions in the memory described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0124] The embodiments of the present application also provide a non-transitory computer readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method provided by the above-mentioned embodiments, for example, comprising:

[0125] S1, receiving position flow data, griding the position flow data based on a quadtree grid, and converting latitude and longitude coordinates into decimal numbers;

[0126] S2, detecting the position of the position flow data in the quadtree grid region according to the decimal numbers of the position flow data;

[0127] S3, combining the time window queue to perform residence time anomaly detection on the gridded position flow data;

[0128] S4, combining the time window queue to perform trajectory deviation anomaly detection on the gridded position flow data;

[0129] S5, sending the anomaly detection to a warning center.

[0130] The device embodiments described above are only schematic, wherein the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0131] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in the various embodiments or some parts of the embodiments.

[0132] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A location flow anomaly detection method based on GIS, characterized in that, include: S1. Receive location stream data, grid the location stream data based on a quadtree grid, and convert latitude and longitude coordinates into decimal numbers; S2. Detect the position of the position stream data in the quadtree grid region based on the decimal number of the position stream data; S3. Combine time window queues to detect abnormal dwell time of gridded location stream data; S4. Combine time window queues to perform trajectory deviation anomaly detection on gridded location stream data; S5. Send the anomaly detection to the early warning center; In step S3, the residence time anomaly detection of the gridded location stream data includes the following steps: S31. Determine the grid corresponding to the location stream data residence area; S32. Merge the location stream data of the new receiving point into grid data of the same level; S33. Continuously record the dwell time of location stream data within the same grid area in the window; S34. When the dwell time exceeds the set threshold, a dwell time abnormality is triggered; In the sliding window period t0, p0 and p1 are two data points within t0. p0 and p1 are placed into the dwell point stack, and p0 and p1 form a grid g0. When the window slides to the right once, within the window period t1, there are two data points p1 and p2, where p2 is the newly received data. p2 is grid-encoded, and based on the area range detection, it is determined whether p2 is within grid g0. If p2 is not within grid g0, p2 forms a new dwell area grid g1. The grid g0 containing p0 and p1 forms a dwell point record. The dwell time from p0 to p1 is calculated. When the dwell time exceeds the set threshold, an abnormal dwell time warning is triggered. In step S4, trajectory deviation anomaly detection is performed on the gridded location stream data, including the following steps: S41. Save the position stream data as a trajectory grid using a trajectory queue; S42. Generate an approximate trajectory by simulating the trajectory grid using non-Bezier curves; S43. Compare the generated approximate trajectory with the preset gridded trajectory setting path to determine whether the position flow data is within the predetermined trajectory grid. S44. For position stream data that deviates from the predetermined trajectory grid, trigger trajectory deviation anomaly.

2. The method according to claim 1, characterized in that, When receiving location stream data in S1, the Netty platform is used, which is compatible with HTTP, HTTPS, TCP, and UDP network transmission protocols.

3. The method according to claim 1, characterized in that, The quadtree mesh in S1 uses a GeoSOT mesh with a depth of 32 levels.

4. The method according to claim 3, characterized in that, The conversion of latitude and longitude coordinates to decimal numbers in S1 includes: The received location stream data latitude and longitude are encoded in binary according to a 32-level GeoSOT grid, and then converted into decimal numbers.

5. The method according to claim 3, characterized in that, The step S2, detecting the location of the location stream data within the grid region, includes the following steps: S21. Determine the location stream data grid hierarchy; S22. Calculate the binary number of the position stream data grid code in reverse Z order. S23. Perform a bitwise AND operation between the binary number and the high-order bits of the grid level encoding. S24. Convert the calculation result into the corresponding position stream data decimal number; S25. Compare the decimal number of the position stream data with the numerical value of the grid region to determine the position of the grid region of the position stream data.

6. The method according to claim 1, characterized in that, The trajectory deviation anomaly detection includes speed anomaly detection.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 6.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 6.

Images