Method for behavior pattern anomaly recognition under multi-dimensional security data fusion

Abstract

This invention discloses a method for identifying abnormal behavior patterns under multi-dimensional security data fusion, comprising: synchronously collecting multimodal security data in the target security area; mapping the data into a dynamic graph of instance relationships containing target entity nodes, behavior event nodes, and context environment nodes, and generating corresponding behavioral semantic vectors using cross-modal self-supervised comparative learning; establishing and updating a probabilistic behavioral benchmark model online based on historical normal behavioral semantic vectors; calculating the deviation probability of the current behavioral semantic vector relative to the probabilistic behavioral benchmark model; and outputting the abnormal behavior pattern identification result and providing the anomaly category and credibility when the deviation probability exceeds a preset threshold and remains stable within a continuous window. This invention effectively solves the problems of insufficient accuracy in abnormal behavior detection and poor model adaptability in existing technologies by uniformly collecting multimodal data and fusing cross-modal self-supervised features to construct a dynamically updated probabilistic behavioral benchmark model.

Description

Technical Field

[0001] This invention relates to the technical field of artificial intelligence and multimodal data fusion, and in particular to a method for identifying abnormal behavior patterns under multidimensional security data fusion. Background Technology

[0002] With the rapid development of IoT, AI and big data technologies, traditional security systems are gradually shifting towards intelligence, multi-source and real-time. Existing technologies typically rely on single means such as intelligent video analysis, access control management and environmental monitoring to identify and alarm on abnormal behavior of people in target areas. For example, abnormal personnel paths can be analyzed through video data or the entry and exit patterns of personnel can be analyzed through access control data.

[0003] CN117931846A discloses an intelligent access control management method based on access control device data fusion. By mining the spatiotemporal behavior paths of access control users, an anomaly detection model is constructed to achieve anomaly identification of user behavior. However, this method only constructs a spatiotemporal graph with the spatiotemporal trajectory of access control data as the core, lacking deep fusion of important modal data such as video, audio, and environmental perception. It cannot fully capture and characterize the global semantic features of abnormal behavior in complex scenarios, thus affecting the accuracy and robustness of recognition.

[0004] CN120014319A discloses an intelligent security anomaly recognition method based on deep learning. It relies on an edge cloud architecture to analyze video data in real time and identifies abnormal paths by determining regional warnings and target dwell time. Although this method uses deep learning for intelligent video analysis, its data source is singular, mainly relying on visual paths, and it ignores the important value of sound, spatial positioning and environmental parameters in behavioral anomaly recognition, resulting in the anomaly detection accuracy being limited by the limitations of visual recognition.

[0005] Furthermore, most of the aforementioned existing technologies have failed to establish a dynamically adaptive and updated behavioral benchmark model, nor have they considered the dynamic impact of normal behavioral data on the accuracy of anomaly detection. This results in insufficient adaptability of the anomaly detection model, making it difficult to achieve high reliability under long-term operation. In other words, existing technologies still suffer from over-reliance on single-modal data, lack of deep modal fusion and effective contextual correlation mining, which limits the accuracy, timeliness and stability of anomaly behavior identification.

[0006] Therefore, existing multi-dimensional security technologies still suffer from insufficient recognition accuracy and poor model adaptability in terms of deep data fusion and adaptive behavior benchmark updates. Our invention proposes a behavior pattern anomaly recognition method based on deep fusion of multi-dimensional security data. By uniformly collecting multi-modal data such as video, audio, spatial positioning, access control, and environmental parameters, and fusing cross-modal self-supervised features, a dynamically updated probabilistic behavior benchmark model is constructed, thereby effectively solving the problems of insufficient anomaly detection accuracy and poor model adaptability in existing technologies. Summary of the Invention

[0007] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section, as well as in the abstract and title of the present application, to avoid obscuring the purpose of this section, the abstract and title of the invention. Such simplifications or omissions shall not be used to limit the scope of the present invention.

[0008] In view of the aforementioned existing problems, the present invention is proposed.

[0009] To solve the above-mentioned technical problems, the present invention provides the following technical solution: simultaneously collecting multimodal security data of video, audio, spatial positioning, access control and environment in the target security area, and writing it into the edge buffer according to a unified spatiotemporal index;

[0010] Within the sliding time window, the multimodal security data is mapped into a dynamic graph of instance relationships containing target entity nodes, behavior event nodes, and context environment nodes, and corresponding behavioral semantic vectors are generated using cross-modal self-supervised contrastive learning.

[0011] Online establishment and updating of probabilistic behavior benchmark models based on historical normal behavior semantic vectors;

[0012] Calculate the deviation probability of the current behavior semantic vector relative to the probabilistic behavior benchmark model. When the deviation probability exceeds a preset threshold and remains stable within a continuous window, output the behavior pattern anomaly identification result and give the anomaly category and confidence level. Otherwise, use the current behavior semantic vector to update the probabilistic behavior benchmark model.

[0013] As a preferred embodiment of the behavioral pattern anomaly identification method for multi-dimensional security data fusion described in this invention, the multi-modal security data is written into an edge buffer according to a unified spatiotemporal index, including:

[0014] A global time synchronization protocol is used to synchronize each data acquisition node at the second level;

[0015] At the acquisition end, each data entry is appended with an index key consisting of a 64-bit timestamp and three-dimensional spatial coordinates.

[0016] A circular cache structure is established in the edge buffer using a first-in-first-out write method, and the index key is subjected to integrity verification and conflict resolution using a pre-write verification method.

[0017] As a preferred embodiment of the behavioral pattern anomaly identification method for multi-dimensional security data fusion described in this invention, the multi-modal security data is mapped into a dynamic graph of instance relationships containing target entity nodes, behavioral event nodes, and context environment nodes, including:

[0018] Instantiate different modal data into the same target entity node based on the same index key;

[0019] Behavioral event segments are divided based on temporal proximity, and behavioral event nodes are generated.

[0020] Context environment nodes are generated using environmental sensor metadata.

[0021] The nodes are connected by three types of edges: time edges, spatial edges, and semantic edges, resulting in a dynamic graph with time labels.

[0022] As a preferred embodiment of the behavioral pattern anomaly identification method for multi-dimensional security data fusion described in this invention, the step of generating corresponding behavioral semantic vectors using cross-modal self-supervised contrastive learning includes:

[0023] For each node-edge triplet, view pruning, mask perturbation, and temporal reversal enhancement are randomly performed to obtain positive and negative sample pairs;

[0024] The positive and negative sample pairs are co-embedded using a cross-modal graph encoder;

[0025] By employing a contrastive loss function to maximize the cosine similarity of positive samples and minimize the similarity of negative samples, behavioral semantic vectors of uniform length are obtained.

[0026] As a preferred embodiment of the behavioral pattern anomaly identification method under multi-dimensional security data fusion described in this invention, a probabilistic behavioral baseline model is established and updated online based on historical normal behavior semantic vectors, including:

[0027] Clustering based on density peaks is used to initially group the semantic vectors of historical normal behavior.

[0028] The probability distribution parameters of each cluster are estimated using an unsupervised Gaussian mixture model;

[0029] After each sliding window ends, the model parameters are incrementally updated using the maximum a posteriori estimate, and low-confidence clusters are merged according to a preset threshold.

[0030] As a preferred embodiment of the behavioral pattern anomaly identification method under multi-dimensional security data fusion described in this invention, calculating the deviation probability of the current behavioral semantic vector relative to the probabilistic behavioral benchmark model includes:

[0031] Calculate the Mahalanobis distance from the current action semantic vector to the centers of each Gaussian distribution;

[0032] The Mahalanobis distance is mapped to a probability distribution and compared with the empirical confidence interval of the corresponding cluster.

[0033] The final deviation probability is obtained by combining the results of the short-term moving average within the time window.

[0034] As a preferred embodiment of the behavioral pattern anomaly identification method for multi-dimensional security data fusion described in this invention, the step of outputting the behavioral pattern anomaly identification result and providing the anomaly category and confidence level includes:

[0035] The deviation probability of the current behavior semantic vector is compared with the set deviation threshold. If it is greater than the deviation threshold for K consecutive sliding windows, the current behavior is determined to be abnormal, where K≥3.

[0036] Cosine similarity is used to measure the similarity between the current behavior semantic vector and the center vectors of each category in the anomaly database, and the category with the highest similarity is selected as the anomaly category;

[0037] The credibility score is based on the value of the maximum similarity mapped by the Sigmoid function, and the anomaly record composed of anomaly category, credibility, timestamp and spatial coordinates is pushed to the security management platform.

[0038] As a preferred embodiment of the behavioral pattern anomaly identification method under multi-dimensional security data fusion described in this invention, otherwise the current behavioral semantic vector is used to update the probabilistic behavioral baseline model, including:

[0039] The semantic vectors of behaviors with a deviation probability lower than the deviation threshold are written into the normal sample buffer in chronological order.

[0040] When the number of samples in the normal sample buffer pool reaches the batch processing threshold M, the buffer pool samples and historical samples are weighted and fused according to the exponential decay factor to form an incremental dataset, where M≥128.

[0041] Based on the incremental dataset, the parameters of the probabilistic behavior baseline model are re-estimated using the Expectation-Maximization online algorithm.

[0042] The updated model parameters are synchronously written into the long-term model library, and the model version number is recorded for subsequent backtracking verification.

[0043] As a preferred embodiment of the behavioral pattern anomaly identification method under multi-dimensional security data fusion described in this invention, the following operations are performed on the low-weight cluster centers:

[0044] If the weight of a cluster is updated below the minimum weight threshold for 5 consecutive times, then the center of that cluster will be merged into the nearest high-confidence cluster with the nearest Mahalanobis distance.

[0045] If the combined weight is still below the minimum weight threshold, the cluster is deleted to avoid noise interference.

[0046] The beneficial effects of this invention are as follows: This invention significantly improves the detection accuracy, generalization ability, and adaptability and reliability of the system operation by using multimodal data synchronous fusion, dynamic graph semantic feature expression, adaptive probabilistic behavior benchmark update, and multi-scale probability deviation judgment steps. It effectively solves the problems of single-modal data limitations, insufficient accuracy of abnormal behavior detection, and poor model adaptability in the prior art. Attached Figure Description

[0047] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0048] Figure 1 This is a flowchart illustrating the method for identifying abnormal behavior patterns under multi-dimensional security data fusion as shown in this invention. Detailed Implementation

[0049] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0050] Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort should fall within the scope of protection of this invention.

[0051] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0052] According to an embodiment of the present invention, in combination Figure 1The flowchart shown illustrates a method for identifying abnormal behavior patterns under multi-dimensional security data fusion, which specifically includes the following steps:

[0053] S1. Simultaneously collect multimodal security data (video, audio, spatial positioning, access control, and environment) within the target security area and write it to the edge buffer according to a unified spatiotemporal index. Note that the following points should be noted in this step:

[0054] A global time synchronization protocol is used to synchronize each data acquisition node at the second level;

[0055] At the acquisition end, each data entry is appended with an index key consisting of a 64-bit timestamp and three-dimensional spatial coordinates.

[0056] A circular cache structure is established in the edge buffer using a first-in-first-out (FIFO) write method, and the index key is verified for integrity and conflict resolution using a pre-write check method.

[0057] Specifically, this embodiment also needs to be further explained that reference coordinate points are deployed in advance in the target security area such as buildings and parks, and a unified three-dimensional Cartesian coordinate system is established using laser ranging. The zero point of this coordinate system is bound to the reference origin of the time source to ensure that the spatial coordinates correspond one-to-one with the time reference.

[0058] The IEEE 1588-2008 Precision Time Protocol (PTP) combined timing method is selected to send second-level synchronization pulses to all acquisition nodes (HD video cameras, microphone arrays, UWB positioning tags, access controllers, and environmental sensors). Hardware timestamp registers are used on the node side to lock the sampling trigger time to ensure that the maximum time deviation of cross-modal data acquisition does not exceed 50ms; where:

[0059] Video: Each camera outputs a 2-second raw GOP at 25fps+H.265 encoding;

[0060] Audio: The microphone array is buffered in 512-sample blocks at 48kHz / 16-bit per frame;

[0061] Spatial positioning: UWB tags report (x, y, z) coordinates every 100ms;

[0062] Access control: The controller outputs <door number, personnel ID, action type, timestamp> for each card swipe event;

[0063] Environment: Sensors for temperature, humidity, CO2, and light intensity report values ​​every 1 second.

[0064] The acquisition node appends a 64-bit absolute timestamp (Unix Epoch millisecond precision) + 32-bit device ID + 3×32-bit spatial coordinates to each sampled data locally, forming a 256-bit index key;

[0065] Among them, the timestamp is the first element, which can be arranged in time order, and the device ID and coordinates are used for cross-modal entity matching;

[0066] In an optional implementation, integrity verification is performed by calculating the index key CRC-32 before data is written and comparing it with the CRC of the most recent record with the same timestamp in the edge buffer. If they do not match, the data is discarded and "DATA_CRC_ERR" is returned.

[0067] In an optional implementation, conflict resolution is performed as follows: if different device ID records already exist at the same timestamp, the record with higher priority is retained according to the device priority list (video > audio > location > access control > environment), and a conflict log is generated on the device side that discards the record.

[0068] Data blocks are written in a first-come, first-served (FFS) strategy within the memory-disk hybrid circular buffer at the edge node.

[0069] The buffer size is adaptively adjusted based on the node's computing power and link bandwidth. For example, it can be configured to have a high water level of 30 seconds and a low water level of 10 seconds. When the water level exceeds 80%, the edge-cloud data extraction task is triggered and the data is asynchronously uploaded to the cloud object storage.

[0070] Every 1MB of raw data written is registered in the metadata directory as a tuple of <time period, device ID, offset, CRC> for easy and fast retrieval.

[0071] The monitoring thread inspects the directory every 5 seconds. If it finds N (N≥5) consecutive DATA_CRC_ERR or conflict logs, it triggers device self-test and link re-handshake to ensure the health of the data source.

[0072] As an example, the target security area can be set as a three-story office building: 80m long × 40m wide × 12m high, with 16 4MP PTZ cameras, 8 microphone arrays, 8 UWB base stations, 12 access control points and at least 10 environmental sensors on each floor. The global timing server is located in the computer room and provides PTP pulses to all nodes through gigabit Ethernet + fiber optic ring network.

[0073] Preferably, by simultaneously collecting multimodal security data, including video, audio, spatial positioning, access control, and environmental parameters, in the target security area and writing it into the edge buffer according to a unified spatiotemporal index, efficient collaboration and precise alignment of different modal data in the spatiotemporal dimension are achieved. This effectively solves the problem of synchronizing and managing data from different types of sensors in a unified manner, avoids the spatiotemporal chaos and information fragmentation of data in traditional security systems, and ultimately achieves the beneficial effect of unified and orderly fusion management of multimodal data, laying a data foundation for subsequent accurate analysis.

[0074] S2. Within the sliding time window, the multimodal security data is mapped into a dynamic graph of instance relationships containing target entity nodes, behavior event nodes, and context environment nodes, and corresponding behavioral semantic vectors are generated using cross-modal self-supervised contrastive learning. Note that the following points should be noted in this step:

[0075] Set window length T w =5s, step size T s =1s, press T after system startup s Advance the start and end times of the window to ensure that adjacent windows have 80% data overlap in order to capture the temporal continuity of cross-modal events;

[0076] Read the multimodal data aligned in step S1 within the current window;

[0077] Based on a unified index key, records from different modalities that correspond to the same entity are merged into a target entity node;

[0078] When consecutive recording intervals Δt ≤ 0.5s, they are grouped into the same event segment; otherwise, they are split into new behavior event nodes.

[0079] Generate context environment nodes from environmental sensor snapshots aggregated at a 1-second granularity.

[0080] Create a directed time edge between the target entity node and the adjacent event node, with the edge attributes recording the start time stamp t0 and the duration τ;

[0081] If the three-dimensional distance d between two event nodes is less than or equal to 2m, create a spatial edge to represent the nearest neighbor movement;

[0082] When there is a contextual association between the environment node's state label and the event node, weighted semantic edges are created to obtain a dynamic graph G of instance relationships with time labels. t = (V, E);

[0083] For each node-edge triplet in the graph, three enhancement methods are randomly applied: view clipping, mask perturbation, and temporal reversal, to obtain positive sample pairs (x). + ,x);

[0084] Randomly sampled unrelated triples to generate negative sample pairs (x - ,x);

[0085] The positive and negative sample pairs are input into the cross-modal graph encoder, and the encoder uses a graph attention network at the bottom layer to adaptively fuse features from different modalities with weights.

[0086] After global average pooling, the output is a node embedding vector h with uniform dimensions. v And obtain the window-level behavioral semantic vector z through temporal aggregation. t ;

[0087] Using cosine similarity cos(·) as the metric, maximize minimize

[0088] Temperature regulation was used to compare the loss L CL Convergence is considered to occur when the loss decrease ΔL < 0.5% over 200 consecutive batches.

[0089] For z t Perform L2 normalization and add window timestamps, node counts, and metadata for major event types;

[0090] Standardized vectors Send to step S3 to update the probabilistic behavior baseline model.

[0091] Preferably, this step effectively improves the robustness and generalization ability of feature representation by comprehensively capturing the potential semantic relationships between different data sources, and ultimately achieves the beneficial effect that the behavioral semantic vector has higher semantic discriminativeness and more comprehensive behavioral scene representation, thereby significantly enhancing the accuracy of subsequent abnormal behavior recognition.

[0092] S3. Establish and update the probabilistic behavior baseline model online based on historical normal behavior semantic vectors. Note the following in this step:

[0093] During the initial system run, for consecutive K0 = 10 4 The density peak algorithm is applied to the semantic vectors of historical normal behavior, selecting the vectors with local maximum kernel density and large distance as cluster kernels, thus obtaining the initial cluster set {C1, C2, ..., C}. R};

[0094] For each initial cluster C r A unimodal Gaussian model is trained offline using the expectation-maximization method, and the mean vector u is output. r Covariance matrix V r With cluster weight ω r The triple is denoted as

[0095] At the end of each sliding window, batch Z of the behavioral semantic vectors output by the window. t Assign to the nearest cluster according to the maximum a posteriori criterion, calculate the increment statistic and apply an exponential decay coefficient ρ = 0.05 to the cluster. Perform online recursion to obtain

[0096] If a cluster has a weight within a consecutive L=5 windows... Then merge it into the nearest high-confidence cluster according to Mahalanobis distance. If the merged cluster is still below the threshold, then delete the cluster.

[0097] Set of parameters for all surviving clusters The models are merged to form the final probabilistic behavior benchmark model.

[0098] As an example, the comprehensive expression for the probabilistic behavior benchmark model is:

[0099]

[0100] Where Ψ is the semantic vector of the behavior to be evaluated, Υ is the total number of currently surviving clusters, and Ξ is the number of clusters. E Let Λ be the high-confidence subdomain of the E-th cluster in the feature space. E Let Ω be the mean vector of the E-th cluster. E Let Δ be the covariance matrix of the E-th cluster. E is the effective sample size of the Eth cluster after exponential decay of the weights, and N is the total number of newly included normal samples in the window, used for overall normalization.

[0101] Furthermore, the output M(ψ)∈(0,1] of the probabilistic behavior baseline model indicates that the behavior conforms to the baseline mode (normal) when M(ψ)≥0.65, the behavior is in the gray area (further observation is required) when M(ψ)∈(0.35,0.65), and the behavior is determined to be an abnormal behavior semantic vector when M(Ψ)≤0.35. In this case, the process will proceed to step S4 to calculate the deviation probability and trigger an alarm.

[0102] It should be noted that by adapting to the gradual changes in the behavior patterns of the security area in real time, the false alarms or missed alarms caused by the long-term use of static models in existing technologies are effectively avoided. This ensures that the model can always accurately reflect the latest behavioral characteristics of the security area, which is conducive to ensuring the long-term effectiveness and reliability of anomaly identification.

[0103] S4. Calculate the deviation probability of the current behavior semantic vector relative to the probabilistic behavior baseline model. When the deviation probability exceeds the preset threshold and remains stable within a continuous window, output the behavior pattern anomaly identification result and give the anomaly category and credibility. Otherwise, use the current behavior semantic vector to update the probabilistic behavior baseline model.

[0104] The following points need to be explained in this step:

[0105] When the window ends, the semantic vector x of the current behavior. t Calculate μ sequentially up to the center of each Gaussian cluster. r Mahalanobis distance Where γ∈{1,…,R}, ∑ r The cluster covariance matrix;

[0106] d r (x t Gamma-type nucleus Perform an incomplete integral mapping to obtain a single-cluster probability component; then compare this component with the corresponding cluster empirical confidence interval. The bias weight δ is obtained by comparison. r ;

[0107] Calculate the background quantization term χ by performing an exponentially decaying moving average on the minimum Mahalanobis distance sequence of the most recent W windows. t ;

[0108] For example, the current deviation probability P can be obtained by synthesizing the following formula. t :

[0109]

[0110] Let the dynamic threshold θ = median ξ {P ξ})+1.4826MAD({P ξ If P t If the condition is satisfied for K ≥ 3 consecutive sliding windows, then output the anomaly category and confidence level; otherwise, perform adaptive model update.

[0111] For example, the mathematical formula for calculating the anomaly category and its confidence level is as follows:

[0112]

[0113] Set category arg max l S c With credibility C t and <t,coord(x t Pushed to the security platform;

[0114] Where, x t Let R be the semantic vector of the current window behavior, and μ be the total number of existing Gaussian clusters. r With ∑ r Let d be the mean vector and covariance matrix of the r-th cluster, respectively. r (x t ) represents the Mahalanobis distance, α r ,β r Let Γ(α) be the gamma kernel shape and scale parameter of the r-th cluster. r ) is a complete gamma function, δ r For cluster bias weights, ω r For cluster weights, ρ(tq) returns the time interval tq and x. t-q The most recent cluster index, W is the short-term average window length, λ is the decay constant, ε is a small positive number to avoid zero denominator, P t Let θ be the deviation probability, θ be the dynamic deviation threshold, K be the number of consecutive test windows, and c be the number of consecutive test windows. l Let L be the center vector of the l-th class in the anomaly database, L be the total number of anomaly classes, and S be the center vector of the class l. c For maximum cosine similarity, Let C be the Sigmoid temperature coefficient, ζ be the similarity shift term, and C be the temperature coefficient. t For credibility scoring, M is the batch processing threshold, and coord(x) is the coord(x) value. t The corresponding spatial coordinates;

[0115] Furthermore, the deviation probability P of the output t ∈(0,1]: The larger the value, the greater the deviation from the baseline model. t ≤θ is considered a normal interval, θ <P t <0.9 is considered a gray area and needs to be observed further. t A value ≥0.9 is directly considered a high-risk anomaly; confidence level C. t ∈(0,1): The closer this value is to 1, the higher the confidence level of the anomaly category determination; the closer it is to 0, the lower the confidence level.

[0116] Furthermore, otherwise the current behavior semantic vector is used to update the probabilistic behavior baseline model, including:

[0117] Write the semantic vectors of behaviors with deviation probabilities below the deviation threshold into the normal sample buffer in chronological order;

[0118] When the number of samples in the normal sample buffer pool reaches the batch processing threshold M, the buffer pool samples and historical samples are weighted and fused according to the exponential decay factor to form an incremental dataset, where M≥128.

[0119] Based on the incremental dataset, the parameters of the probabilistic behavior baseline model are re-estimated using the Expectation-Maximization online algorithm, and the following operations are performed on the low-weight cluster centers:

[0120] If the weight of a cluster is updated below the minimum weight threshold for 5 consecutive times, then the center of that cluster will be merged into the nearest high-confidence cluster with the nearest Mahalanobis distance.

[0121] If the weight is still below the minimum weight threshold after merging, the cluster is deleted to avoid noise interference.

[0122] Finally, the updated model parameters are synchronously written into the long-term model library, and the model version number is recorded for subsequent backtracking verification.

[0123] Preferably, this embodiment establishes more stringent judgment rules by identifying abnormal behavior, reducing the probability of misjudgment in a single window, while allowing samples with low probability deviations to be used for continuous model optimization, ultimately achieving the beneficial effect of comprehensively improving the accuracy, reliability, and adaptability of anomaly detection.

[0124] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for behavior pattern anomaly recognition under multi-dimensional security data fusion, characterized in that, include: Multimodal security data, including video, audio, spatial positioning, access control, and environmental data, are simultaneously collected in the target security area and written to the edge buffer according to a unified spatiotemporal index. Within a sliding time window, the multimodal security data is mapped into a dynamic graph of instance relationships containing target entity nodes, behavioral event nodes, and context environment nodes. This includes: instantiating different modal data into the same target entity node based on the same index key; dividing behavioral event segments based on temporal proximity to generate behavioral event nodes; generating context environment nodes through environmental sensor metadata; and connecting each node according to three types of edges: time edges, spatial edges, and semantic edges, to obtain a dynamic graph with time labels. The system utilizes cross-modal self-supervised contrastive learning to generate corresponding behavioral semantic vectors, including: randomly performing view pruning, mask perturbation, and temporal reversal enhancement on each node-edge triplet to obtain positive and negative sample pairs; using a cross-modal graph encoder to co-embed the positive and negative sample pairs; and employing a contrastive loss function to maximize the cosine similarity of positive samples and minimize the similarity of negative samples to obtain behavioral semantic vectors of uniform length. The model establishes and updates a probabilistic behavior baseline model online based on historical normal behavior semantic vectors. This includes: initial clustering of historical normal behavior semantic vectors based on density peak clustering; estimating the probability distribution parameters of each cluster using an unsupervised Gaussian mixture model; incrementally updating the model parameters using maximum a posteriori estimation after each sliding window, and merging low-confidence clusters according to a preset threshold. Calculate the deviation probability of the current behavior semantic vector relative to the probabilistic behavior benchmark model. When the deviation probability exceeds a preset threshold and remains stable within a continuous window, output the behavior pattern anomaly identification result and give the anomaly category and confidence level. Otherwise, use the current behavior semantic vector to update the probabilistic behavior benchmark model. 2.The method for behavior pattern anomaly recognition under multi-dimensional security data fusion according to claim 1, characterized in that, The multimodal security data is written into the edge buffer according to a unified spatiotemporal index, including: A global time synchronization protocol is used to synchronize each data acquisition node at the second level; At the acquisition end, each data entry is appended with an index key consisting of a 64-bit timestamp and three-dimensional spatial coordinates. A circular cache structure is established in the edge buffer using a first-in-first-out write method, and the index key is subjected to integrity verification and conflict resolution using a pre-write verification method.

3. The method for behavior pattern anomaly recognition under multi-dimensional security data fusion according to claim 1, characterized in that, Calculating the deviation probability of the current behavior semantic vector relative to the probabilistic behavior benchmark model includes: Calculate the Mahalanobis distance from the current action semantic vector to the centers of each Gaussian distribution; The Mahalanobis distance is mapped to a probability distribution and compared with the empirical confidence interval of the corresponding cluster. The final deviation probability is obtained by combining the results of the short-term moving average within the time window.

4. The method of claim 1 or 3, wherein, The output behavior pattern anomaly identification results, along with the anomaly category and confidence level, include: The deviation probability of the current behavior semantic vector is compared with a set deviation threshold. If the deviation probability is greater than the deviation threshold for K consecutive sliding windows, the current behavior is determined to be abnormal, where K ≥ 3. Cosine similarity is used to measure the similarity between the current behavior semantic vector and the center vectors of each category in the anomaly database, and the category with the highest similarity is selected as the anomaly category; The credibility score is based on the value of the maximum similarity mapped by the Sigmoid function, and the anomaly record composed of anomaly category, credibility, timestamp and spatial coordinates is pushed to the security management platform.

5. The method for identifying abnormal behavior patterns under multi-dimensional security data fusion according to claim 4, characterized in that, Otherwise, the current behavior semantic vector is used to update the probabilistic behavior baseline model, including: The semantic vectors of behaviors with a deviation probability lower than the deviation threshold are written into the normal sample buffer in chronological order. When the number of samples in the normal sample buffer pool reaches the batch processing threshold M, the buffer pool samples and historical samples are weighted and fused according to the exponential decay factor to form an incremental dataset, where M ≥ 128. Based on the incremental dataset, the parameters of the probabilistic behavior baseline model are re-estimated using the Expectation-Maximization online algorithm. The updated model parameters are synchronously written into the long-term model library, and the model version number is recorded for subsequent backtracking verification.

6. The method for identifying abnormal behavior patterns under multi-dimensional security data fusion according to claim 5, characterized in that, Perform the following operations on the low-weight cluster centers: If the weight of a cluster is updated below the minimum weight threshold for 5 consecutive times, then the center of that cluster will be merged into the nearest high-confidence cluster with the nearest Mahalanobis distance. If the combined weight is still below the minimum weight threshold, the cluster is deleted to avoid noise interference.

Images