Distributed intelligent security facility based on light weight AI computing

Abstract

The application discloses a kind of distributed intelligent security facilities based on light weight AI calculation, it is related to security management technical field, including in each security area deployment edge computing node, access multimodal device, collect structured data and carry out pre-processing, the structured data includes image data, audio signal and environmental data;Low-illuminance enhancement is carried out to video image, based on enhanced image data, audio signal and environmental data, inference is carried out by light weight AI model deployed in edge node, model identifies personnel behavior, abnormal sound and environmental change, and identification result is standardized encapsulation as structured event.The application improves the response speed and deployment flexibility of system, enhances the identification ability to complex explicit and implicit abnormal behavior, significantly improves the real-time performance, stability and multi-scene adaptability of distributed intelligent security system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security and protection management, and particularly relates to a distributed intelligent security and protection facility based on light-weight AI calculation. BACKGROUND

[0002] In the development of modern security and protection systems, with the acceleration of urbanization and the improvement of public safety needs, the traditional centralized monitoring system has been difficult to meet the requirements of real-time, high reliability and dynamic response. Especially in large parks, industrial facilities, commercial buildings and remote areas, the traditional architecture generally relies on central servers to centrally process front-end video, audio, environment and other multi-modal data, resulting in problems such as response delay, network congestion and computing resource bottleneck in the system under high concurrency. In order to improve the intelligent level of the security and protection system, in recent years, artificial intelligence technology has been widely introduced into the security and protection field, and deep learning models are used for intelligent analysis of video images, environmental data, automatic identification of abnormal behavior, intrusion events and environmental anomalies. However, high-performance AI models often have problems such as heavy computing load, high deployment cost and high energy consumption, which are difficult to adapt to resource-limited front-end devices. In addition, the existing system generally lacks event correlation modeling and behavior chain tracking capabilities, and often can only detect single-point anomalies, cannot perform spatial-temporal linkage analysis, and is difficult to identify implicit complex threat behaviors such as "tail entry", "abnormal stay" and "frequent entry and exit". SUMMARY

[0003] In view of the above existing problems, the present application is proposed.

[0004] Therefore, the present application provides a distributed intelligent security and protection facility based on light-weight AI calculation, which solves the significant technical deficiencies of existing security and protection facilities in event structuring, edge intelligent analysis and behavior path identification, and is difficult to meet the systematic requirements of "distributed deployment, real-time response, multi-modal fusion and high robustness".

[0005] To solve the above technical problems, the present application provides the following technical solutions:

[0006] In a first aspect, the present application provides a distributed intelligent security and protection facility based on light-weight AI calculation, which comprises,

[0007] a data collection module for deploying edge computing nodes in each security and protection area, accessing multi-modal devices, collecting structured data and performing preprocessing, wherein the structured data includes image data, audio signals and environmental data;

[0008] An image enhancement and data reasoning module is configured to perform low-illumination enhancement on a video image, perform reasoning on the enhanced image data, an audio signal and environmental data by a lightweight AI model deployed in an edge node, identify personnel behavior, abnormal sound and environmental change, and encapsulate the identification result into a structured event;

[0009] A dominant abnormality identification module is configured to input the structured event, construct a dynamic graph structure at the edge, mine an interaction path between personnel and between personnel and a region by using a lightweight graph neural network model, and identify a dominant abnormal behavior;

[0010] A recessive abnormality identification module is configured to input the structured event into a counterfactual generator, generate a normal scene that should appear and compare the normal scene with the actual input, and identify a recessive abnormal behavior;

[0011] An abnormality judgment module is configured to judge a high-risk abnormal event in combination with the dominant abnormal behavior and the recessive abnormal behavior, intercept a key video segment, generate an event summary hash, generate a credible event block by elliptic curve encryption and a lightweight consensus mechanism, and synchronize to the cloud to complete right confirmation and evidence storage;

[0012] A display module is configured to display the identified event, a behavior chain, counterfactual reasoning result and event right confirmation information on a visual platform to form an interactive view.

[0013] As a preferred scheme of the distributed intelligent security and protection facility based on lightweight AI calculation, the low-illumination enhancement on the video image includes:

[0014] The collected image data is preprocessed to remove noise, converted into a unified color space and standardized in brightness and contrast, and the preprocessed image is processed in a main feature layer and a compensation layer;

[0015] The main feature layer processing includes edge enhancement on the denoised image by using a Laplacian operator, extracting edge information of the image by Laplacian filtering, and enhancing the contrast of the region;

[0016] The compensation layer processing includes converting the image from an RGB space to an HSV space, enhancing the saturation of the image by using an adaptive nonlinear stretching algorithm, obtaining illumination estimation of different scales by performing multi-scale Retinex on the image , correcting the color distortion of the image by using a color restoration function, combining the multi-scale Retinex with the color restoration module to obtain the final MSRCR image enhancement output ;

[0017] Based on the obtained images of the main feature layer and compensation layer, the layer fusion weights are optimized using the artificial bee colony optimization algorithm to determine the optimal combination of the main feature layer and compensation layer.

[0018] Based on the optimized weights, the main feature layer image and the compensation layer image are fused proportionally to obtain an optimized fused image. Global adaptive contrast correction is then applied to the image to optimize the contrast performance of the entire image, resulting in a low-light enhanced image.

[0019] As a preferred embodiment of the distributed intelligent security facility based on lightweight AI computing described in this invention, the step of performing inference through a lightweight AI model deployed in edge nodes, identifying personnel behavior, abnormal sounds, and environmental changes, and standardizing and encapsulating the identification results into structured events includes:

[0020] The image model YOLO-Nano, the audio model TinyAudioNet, and the environmental state rule model are deployed sequentially in the edge computing nodes to identify human behavior in images and detect abnormal sounds in audio.

[0021] The recognition results output by each model include image target type, location and confidence level, audio abnormal event label and confidence level, and environmental state abnormality type and state value. All results are uniformly encapsulated and event objects are generated according to the standard structured event format.

[0022] As a preferred embodiment of the distributed intelligent security facility based on lightweight AI computing described in this invention, the following steps are taken: Using structured events as input, a dynamic graph structure is constructed at the edge; a lightweight graph neural network model is used to mine the interaction paths between personnel and between personnel and areas; explicit abnormal behaviors are identified by extracting participating entities from structured events; a node set V of the graph is generated; an initial feature vector is constructed for each node; an edge set P is constructed through the subject-object relationship in the event; the interaction relationships between personnel and other entities are captured; a graph structure G=(V,P) is constructed based on the node set V and the edge set P; and an adjacency matrix O is constructed and normalized to generate a normalized adjacency matrix.

[0023] The normalized adjacency matrix is ​​input into the pre-trained GCN-Lite model, which outputs the interaction semantic vectors corresponding to each node in real time and inputs them into a lightweight Softmax classifier to obtain the probability distribution of multi-class behavior labels. Based on the category corresponding to the maximum probability value, the final predicted label is determined and the corresponding probability is recorded as a confidence index.

[0024] As a preferred scheme of the distributed intelligent security and protection facility based on lightweight AI calculation, the structured event input is input into the counterfactual generator, a normal scene that should appear is generated and compared with the actual input, and implicit abnormal behavior is identified by inputting the real-time collected structured behavior sequence into the trained Transformer model to generate the counterfactual event E' of the current time, and comparing it with the actual observed event E. If the counterfactual deviation S exceeds the preset threshold Q, it is determined that there is implicit abnormal behavior, and the node determined to be abnormal is encapsulated as a potential unobserved behavior object.

[0025] As a preferred scheme of the distributed intelligent security and protection facility based on lightweight AI calculation, the structured behavior event is jointly determined, and if the explicit behavior recognition module and the implicit abnormality recognition module both mark the event as abnormal, the event is marked as a high-risk abnormal event.

[0026] As a preferred scheme of the distributed intelligent security and protection facility based on lightweight AI calculation, the key video frame or image information in the time period corresponding to the high-risk abnormal event is extracted, the key frame is summarized and generated using a secure hash algorithm, and the hash value is calculated.

[0027] As a preferred scheme of the distributed intelligent security and protection facility based on lightweight AI calculation, the key video frame or image information in the time period corresponding to the high-risk abnormal event is extracted, the key frame is summarized and generated using a secure hash algorithm, and the hash value is calculated.

[0028] A lightweight Byzantine fault-tolerant consensus mechanism is used for fast block consensus, and after the block is chained, it is automatically synchronized to the cloud master node to complete event right confirmation.

[0029] As a preferred scheme of the distributed intelligent security and protection facility based on lightweight AI calculation, the identified event, behavior chain, counterfactual reasoning result and event right confirmation information are uniformly displayed on a visualization platform to form an interactive view, based on the set of abnormal events that have been right confirmed in the knowledge base, a real-time abnormal event stream view is generated, and the abnormal events occurring at the current time are dynamically refreshed based on the time axis as the main line.

[0030] As a preferred scheme of the distributed intelligent security facility based on lightweight AI calculation, wherein: the edge computing nodes are deployed in each security area, access to multi-modal devices, collect structured data and pretreatment, that is, an edge computing node is deployed in each physical security monitoring unit, each edge computing node is physically connected to multi-modal sensing devices, including visible light camera, infrared thermal imager, audio pickup, temperature and humidity sensor and access switch trigger, collects image data, audio signal and environmental data and pretreats, and finally obtains standardized structured data.

[0031] The present application has the advantages that: by introducing the event structured coding mechanism and the lightweight graph neural network modeling method, the present application realizes efficient integration and intelligent analysis of multi-source data in a distributed security environment, effectively solves the problems of information isolation, processing delay and difficulty in identifying abnormal behavior in the prior art, adopts a low-illumination image enhancement technology that fuses Retinex theory and multi-scale contrast enhancement, effectively improves the definition and structural detail expression ability of video images in a weak light environment, significantly enhances the accuracy and robustness of subsequent target detection and behavior recognition, compared with a traditional centralized security system, the present application supports real-time behavior reasoning and interaction path modeling at the edge node, greatly improves the system response speed and the accuracy of abnormal identification, reduces the consumption of computing resources, significantly enhances the adaptability, expandability and robustness of the security system in multiple scenarios, and provides a feasible solution for constructing an efficient, intelligent and collaborative distributed security system. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0033] Fig. 1 It is the structure diagram of the distributed intelligent security facility based on lightweight AI calculation in embodiment 1.

[0034] Fig. 2 It is the low-illumination image enhancement and fusion flowchart in embodiment 1.

[0035] Fig. 3 It is the explicit and implicit abnormality identification flowchart in embodiment 1.

[0036] Fig. 4 It is the trusted event evidence storage and visualization flowchart in embodiment 1. DETAILED DESCRIPTION

[0037] In order to make the above objectives, features and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0038] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the concept of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0039] Secondly, "one embodiment" or "embodiment" referred to herein means that a specific feature, structure or characteristic can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor is it an embodiment that is independent of or mutually exclusive with other embodiments.

[0040] Embodiment 1, reference Figs. 1-4 For the first embodiment of the present application, the embodiment provides a distributed intelligent security facility based on lightweight AI computing, comprising the following steps:

[0041] S1, a data collection module, for deploying edge computing nodes in each security area, accessing multi-modal devices, collecting structured data and performing preprocessing, the structured data including image data, audio signals and environmental data;

[0042] Specifically, deploying edge computing nodes in each security area, accessing multi-modal devices, collecting structured data and performing preprocessing means deploying an edge computing node in each physical security monitoring unit (such as floor, corridor, entrance), using Jetson Nano B01 as a standard hardware platform, with low power consumption, high performance, good AI compatibility, suitable for unstable network and space limited scenes, each node has a unique ID and is registered to the central control system, completing node initialization and device binding;

[0043] Each edge computing node is physically connected to multi-modal sensing devices, including visible light cameras, infrared thermal imagers, audio pickups, temperature and humidity sensors, and access switch triggers, all sensor devices communicate with Jetson Nano B01 through software drivers, and all edge nodes are synchronized by NTP protocol, each edge node sets a local high-precision RTC module as a backup time source to prevent drift when NTP fails, collection and scheduling are controlled by a local thread scheduler, different data streams are cached to a unified buffer according to the set sampling frequency (image: 30Hz, audio: 16kHz, infrared: 10Hz, sensor: 1Hz), synchronized and aligned to form a unified timestamp data frame;

[0044] All data frames are attached with current edge node number and accurate time stamp with a set time period as a sampling window, and stored in a structured format, and integrity and quality detection is performed on each structured data frame, including judging whether the image has the problems of occlusion, blur or overdarkness, whether the audio has the problem of mute interval, and whether the sensor data has the problem of jump or error reading; the data frame with the problem is marked but not deleted for subsequent model robustness training, and finally the standardized structured data is obtained, including image frame, audio feature frame and sensor state vector (temperature, humidity, infrared distance, access control state);

[0045] The audio feature frame is processed by mel spectrum transformation, specifically including pre-emphasis, framing and windowing operations on the original time domain audio signal to enhance high frequency components and ensure intra-frame smoothness, then, fast Fourier transform (FFT) is performed on each frame to convert the signal to the frequency domain, and then a set of mel filter banks (Mel Filter Bank) based on human auditory perception characteristics are used to weight the spectrum to obtain a frequency representation that is more consistent with auditory perception, and finally, the mel spectrum is logarithmized to form a log mel spectrum graph.

[0046] The application greatly enhances the perception breadth and fine-grained monitoring capability of the security system in complex environments by deploying multi-modal devices at edge nodes and collecting multi-source data such as images, audio, infrared, temperature and humidity, and access control state, and constructing unified structured data frames. The image can identify visible behavior, the audio can capture screams or abnormal sound, the infrared can be used for night and occlusion detection, the environmental data can assist in identifying loitering and environmental anomalies, and the access control information can be used for entry behavior discrimination. The selection of the above data is based on the characteristics of behavior diversity and anomaly concealment in the security scene, and the fusion of these data can effectively avoid single perception misjudgment, improve the recognition accuracy of complex events such as "tail intrusion" and "environmental anomaly stay", realize early warning and response to abnormal behavior, and build a more efficient, intelligent and reliable distributed security management system.

[0047] S2, image enhancement and data inference module, for low-illumination enhancement of video image, based on enhanced image data, audio signal and environmental data, inference is performed through the lightweight AI model deployed in the edge node, the model identifies personnel behavior, abnormal sound and environmental change, and the identification result is standardized and packaged as a structured event;

[0048] Specifically, the low-illumination enhancement of the video image includes:

[0049] The collected image data is preprocessed to remove noise, converted to a unified color space and standardized in brightness and contrast, including:

[0050] If the original image is in RGB format, color space conversion is performed to convert the image into a grayscale image; the grayscale processing helps to reduce the complexity of subsequent processing and avoid the influence of color distortion on the brightness enhancement and denoising steps;

[0051] A median filter method is used for denoising, which removes noise by replacing the value of each pixel with the median value in its neighborhood, especially suitable for the removal of salt and pepper noise;

[0052] The image is histogram equalized to enhance the contrast of the image and ensure that the brightness range of the image is expanded:

[0053]

[0054] In the formula, T(r) is the enhanced gray level value, r is the original gray value of the current pixel, p(l) is the pixel frequency of the gray level l, and L is the total number of gray levels;

[0055] The preprocessed image is subjected to main feature layer processing and compensation layer processing;

[0056] The main feature layer processing includes:

[0057] To further enhance the details, the Laplacian operator is used for edge enhancement on the denoised image, the edge information of the image is extracted through Laplacian filtering, and the contrast of these regions is enhanced, thereby improving the clarity of the image, especially in areas with rich details:

[0058]

[0059] In the formula, is the Laplacian value of the image, indicating the second derivative of the image, and respectively represent the second derivative of the image in the x and y directions;

[0060] The compensation layer processing includes: after completing the brightness enhancement and detail preservation, the image has become clearer and has higher contrast, then the image is converted from RGB space to HSV space (hue, saturation, brightness), which can separate the brightness (V) from the color (H, S), so as to adjust the brightness and color independently and avoid the mutual influence of the two;

[0061] An adaptive nonlinear stretching algorithm is used to enhance the saturation of the image to ensure that the colors are more vibrant, which adaptively stretches according to the mean and standard deviation of the RGB color channels of the image, so as to maintain color consistency in different areas and avoid color distortion caused by over-enhancement:

[0062]

[0063] wherein, is the saturation of the output image, is the saturation of the input image, and are the mean and standard deviation of the image RGB color channels;

[0064] By multi-scale Retinex on the image, different scale illumination estimates are obtained :

[0065]

[0066] wherein, is the two-dimensional Gaussian kernel function (blurring kernel) of the kth scale, simulating the light distribution of different granularity, is the weight coefficient corresponding to the scale, K is the number of scales used, I(x, y) is the pixel value of the input image, and represents the brightness of the image at position (x, y);

[0067] For the problem of color distortion, a color restoration function is used to correct the color distortion of the image:

[0068]

[0069] wherein, is the pixel value of the input image in a certain color channel (R / G / B), a is a coefficient for controlling the mapping ratio of input intensity, to avoid taking too small values when taking the logarithm, and β is an overall gain adjustment parameter, which controls the color intensity of the restored image, is the color restoration coefficient, which is used to adjust the image color;

[0070] The multi-scale Retinex (brightness enhancement) and the color restoration (color repair) module are combined to obtain the final MSRCR image enhancement output :

[0071]

[0072] Based on the obtained main feature layer and compensation layer image, an artificial bee colony optimization algorithm is used to optimize the layer fusion weight, to determine the best combination of the main feature layer and the compensation layer, which specifically includes:

[0073] A bee individual (i.e. initial solution) is generated to represent the weight of layer fusion, each individual represents a set of initial fusion weights, and the weight range is [0, 1], and through these initial weight combinations, optimization is performed:

[0074]

[0075] wherein, is the ith candidate fusion weight, P is the number of candidate weights, rand(0, 1) generates a random number between 0 and 1, and is used to initialize the fusion weight;

[0076] According to the fusion weight of the current bee individual, the fused image is calculated, and for each individual, according to its weight , the main feature layer and the compensation layer are fused:

[0077]

[0078] In the formula, is the main image pixel (main feature layer pixel), is the compensation image pixel (compensation layer pixel), is the u-th fused result image;

[0079] The difference between images is measured using the mean square error :

[0080]

[0081] In the formula, is the target image pixel, M represents the height of the image in the vertical direction, and N represents the width of the image in the horizontal direction;

[0082] In the exploration phase, the bee colony adjusts some weights by random selection, thereby exploring potential better solutions, and each individual will explore by randomly changing its weight in order to find the possible optimal solution :

[0083]

[0084] In the formula, is the disturbance factor, which is set by empirical method;

[0085] In the development phase, each bee individual performs local search around its current position according to its own experience, which helps to refine the solution space and further converge to the optimal solution :

[0086]

[0087] In the formula, is the best solution of the current individual, is the adjustment factor, which controls the speed of search, and is set by empirical method;

[0088] After multiple iterations of exploration and development phases, the individual with the smallest fitness is selected as the final optimal solution, i.e. the best image layer fusion weight:

[0089]

[0090] wherein, is the optimal fusion weight obtained, is the mean square error of the u-th fused image;

[0091] According to the optimized weight, the main feature layer image and the compensation layer image are proportionally fused, at this time, the brightness and detail enhancement effect of the main feature layer and the color and contrast enhancement effect of the compensation layer are combined, so as to obtain the optimized fused image:

[0092]

[0093] wherein, is the value of the final fused image at pixel point (x, y);

[0094] After the layer fusion, the global adaptive contrast correction is applied to the image, and the contrast performance of the whole image is optimized:

[0095]

[0096] wherein, L(x, y) is the brightness component of the original image or the fused image, is the maximum value of the brightness in the image, is a very small positive number, used to prevent zero or negative in logarithm, is the enhanced brightness value;

[0097] In the optimization of contrast, special attention is paid to the detail display of the low-illumination area, by improving the details of the dark area, the image of these areas is more clear, avoiding the loss of details due to brightness enhancement;

[0098] The fused image is output as the final result. At this time, the image should have good brightness, contrast, detail and color, especially in the low-illumination area, the details are fully presented, the quality of the final image is evaluated using quantitative indicators (such as information entropy, average gradient, PSNR, etc.), to ensure that the optimization of the image in brightness, detail, contrast and color meets the expectations, and finally the low-illumination enhanced image is obtained;

[0099] The image is color restored and light corrected by the MSRCR algorithm, which can effectively eliminate the uneven light problem in low-illumination images, enhance the details, and maintain the natural color transition of the image. The algorithm avoids the halo effect and color distortion that may occur in traditional Retinex algorithms while enhancing the details. Secondly, the artificial bee colony optimization algorithm automatically adjusts the fusion weight of the main feature layer and the compensation layer through global optimization, so that the brightness, contrast, color and details of the image can be balanced at different levels. Compared with traditional image fusion methods, the ABC optimization algorithm provides more precise adjustment to ensure that the contribution of each layer is reasonably distributed, thereby optimizing the overall visual effect of the image. Furthermore, through the conversion and adaptive nonlinear stretching of the HSV space, the scheme can independently adjust the color and brightness of the image, avoiding the mutual influence of the two, ensuring that the color enhancement is natural and distortion-free. In addition, the edge enhancement and detail preservation technology combined with the Laplacian operator can enhance the brightness of the image while preserving important details, avoiding detail loss. Overall, the scheme optimizes the details and color of low-illumination images through precise optimization algorithms and the effective combination of multiple technologies, resulting in an image with improved visual quality and avoiding color oversaturation, detail loss and halo effect problems in traditional methods, with higher flexibility and adaptability.

[0100] Further, through the inference of the lightweight AI model deployed in the edge node, the model identifies personnel behavior, abnormal sound and environmental changes, and standardizes the identification results into structured events including:

[0101] The image model YOLO-Nano, the audio model TinyAudioNet and the environmental state rule model are deployed in the edge computing node in sequence to identify personnel behavior in images, detect abnormal sound in audio, and determine whether there is a mutation event in the environmental state vector;

[0102] The image model YOLO-Nano adopts a lightweight convolutional neural network structure, the model input is a low-illumination enhanced image frame, and the output is the class label, bounding box position and confidence of each target object in the image. The model training uses a public human behavior recognition dataset combined with collected edge image samples to form a training set. During the training process, the weighted sum of classification loss and position regression loss is used as the loss function, and the Adam optimizer is used for gradient descent optimization. When the average precision of the validation set reaches a stable state, the iteration is stopped and the model parameters are exported for edge deployment;

[0103] The audio model TinyAudioNet inputs the audio feature frame processed by the mel spectrum transform, outputs the audio event label and confidence, and the training data is composed of label samples such as high-frequency noise, smashing sound and screaming sound collected in a simulated environment, adopts cross-entropy loss for multi-classification training, combines batch normalization to improve convergence stability, and exports the model parameters for edge deployment after training;

[0104] The environmental state rule model compares the state value threshold, and the input is a vector composed of temperature, humidity, infrared distance and access control state. Whether there is a mutation or a high-frequency switching event is judged by comparing a preset abnormal threshold. Specifically, it includes:

[0105] In terms of temperature monitoring, an allowed upper limit and a lower limit are set. When the current temperature value is higher than the set upper limit or lower than the lower limit, it is determined to be temperature abnormality;

[0106] In terms of humidity monitoring, a target reference value and a maximum allowed fluctuation range are set. When the difference between the current humidity value and the target reference value exceeds the fluctuation range, it is determined to be humidity change, which is an abnormal state;

[0107] In terms of infrared distance monitoring, it is monitored whether the current distance value is lower than the set minimum safety distance. For example, when the detection object is abnormally close to the equipment, wall or door and window, and there is no significant change (more than the safety distance) for multiple time points, it may indicate that someone is close to lurk, abnormal object shielding or illegal intrusion, and it is judged as infrared sensing abnormality;

[0108] In terms of access control monitoring, the change of access control state is recorded continuously. When it is detected that the access control is in the open state for a short time and there is obvious fluctuation in continuous time periods, it is determined to be abnormal behavior of frequent triggering of access control, which may imply illegal intrusion or repeated operation failure;

[0109] The above four abnormality judgment rules (all based on experience setting) are executed in parallel. Once any dimension triggers an abnormal condition, the corresponding abnormal event result is generated immediately. The result is output in the form of key-value pair, the key represents the category of abnormal event (such as temperature too high, humidity mutation, access control abnormality, etc.), and the value is the specific state value or detection parameter that triggers the abnormality;

[0110] The recognition results output by each model respectively include image target type, position and confidence, audio abnormal event label and confidence, and abnormal type and state value of environmental state. All results are uniformly packaged, and event objects are generated in accordance with the standard structured event format. Each event object contains event type, confidence, timestamp, location information, data source type and subject ID.

[0111] By deploying lightweight AI model combinations (YOLO-Nano, TinyAudioNet, and rule models) in edge computing nodes, multi-modal perception and reasoning analysis of personnel behavior, abnormal sounds, and environmental state are achieved, significantly improving the real-time performance and recognition accuracy of distributed intelligent security systems. Image models can effectively identify abnormal behavior in low-light scenarios, audio models can accurately detect high-risk events such as screams and breaking sounds, and rule models can efficiently monitor environmental changes such as sudden temperature and humidity changes, abnormal infrared distances, and frequent opening and closing of access control. All recognition results are encapsulated as structured events with standard formats, traceability, and linkage characteristics, facilitating subsequent platform scheduling, abnormal alarm, and intelligent decision-making, thereby ensuring system edge response capabilities while expanding the intelligent coverage depth and breadth of security systems.

[0112] S3, a dominant abnormality recognition module, is configured to input structured events, construct a dynamic graph structure at the edge, use a lightweight graph neural network model to mine interaction paths between personnel and between personnel and regions, and recognize dominant abnormal behaviors;

[0113] Specifically, structured events are input, a dynamic graph structure is constructed at the edge, and a lightweight graph neural network model is used to mine interaction paths between personnel and between personnel and regions to recognize dominant abnormal behaviors. From the structured event stream received by the edge node, the event object set in the recent continuous time window (the length of the time window (e.g., 30 seconds) needs to be set according to the average duration of scene behavior to ensure that the behavior context is not lost and interference noise is not introduced) is extracted, which specifically includes:

[0114] The structured events are sorted by timestamp, and events within T seconds (e.g., 30 seconds) before the current time are filtered to form a time window;

[0115] Each event includes: event type (e.g., "entering a region", "access control opening"), subject ID (e.g., personnel number), occurrence location, and confidence;

[0116] Weak events with confidence below a threshold (e.g., 0.6, set after experimental tuning) are removed to reduce false edge interference;

[0117] Participating entities (personnel, equipment, and regions) are extracted from structured events to generate a node set V of the graph, and an initial feature vector is constructed for each node, which specifically includes:

[0118] For each event:

[0119] If it is a personnel-related event, the personnel ID is extracted as a node;

[0120] If it involves access control, cameras, or region numbers, the corresponding device or region ID is extracted as a node;

[0121] Construct node features:

[0122] For personnel nodes, features include activity frequency in the past N seconds, average stay duration, number of abnormal triggers, etc.

[0123] For area nodes, features include current number of people, historical abnormal density, and entry and exit frequency, etc.

[0124] For device nodes such as access control cameras, features include trigger frequency and sensor activity rate, etc.

[0125] Build edge set P through the subject-object relationship in the event to capture the interaction between personnel and other entities, including:

[0126] If the event is "entering a certain area", establish a "personnel-area" edge, and the edge attribute includes the entry time and stay duration;

[0127] If the event is "access control opening", establish a "personnel-access control" edge;

[0128] If multiple people are detected in the same camera and the time overlaps, establish a "personnel-personnel" edge, representing simultaneous presence;

[0129] If the behavior path shows that the personnel passes through the access control to enter area B from area A, form a directed edge chain of "area A-access control-area B";

[0130] Each edge contains: behavior type (etype): such as "stay", "pass", "co-occur", etc., timestamp, behavior duration, edge weight : Can be set to logarithmic form , where Δt is the behavior duration, enhancing the importance of long-time behavior;

[0131] Based on node set V and edge set P, the graph structure G=(V,P) is constructed, and the adjacency matrix O is constructed;

[0132] In order to retain the self-owned feature information of each node, the unit matrix is added to the original adjacency matrix to obtain the enhanced matrix, that is, each node is connected to itself in addition to being connected to other nodes, to ensure that the intrinsic features are not lost in subsequent feature propagation. Calculate the degree value of each node to form the degree matrix, where each diagonal element represents the total connection strength of the corresponding node. Normalize the adjacency matrix, and the specific way is to divide the edge weight of each row by the degree value of the node corresponding to the row, thereby generating the normalized adjacency matrix. This normalization operation can make the graph convolution model avoid the dominance of high-frequency nodes in feature transmission during information propagation, ensuring the numerical stability and information balance during model training;

[0133] Based on the graph structure G, a lightweight graph convolutional neural network (GCN-Lite) model is used for node behavior semantic embedding propagation, a normalized adjacency matrix is used as the input of the first layer graph convolution, multiplied with the normalized adjacency matrix for propagation, and mapped to an intermediate embedding dimension d1 through the first layer training weight matrix, and then the local behavior semantics are extracted through the ReLU activation function to obtain the first layer output H1, H1 is input into the second layer GCN-Lite network, and further propagation is performed with the same normalized adjacency matrix, and is multiplied with the second layer weight matrix to map to the final embedding dimension d2, and the output is a node embedding matrix H2, wherein each row vector represents the deep behavior semantic embedding of the corresponding node in the graph interaction context;

[0134] In the model training phase, a small batch incremental learning strategy deployed on the edge node is adopted: the labeled abnormal behavior path in the historical structured event sequence is used as a supervision signal, a cross-entropy loss function is defined to classify multi-class behavior labels, and an Adam optimizer is used for parameter update, the embedding discriminability for typical abnormal patterns (such as tailing, wandering, and abnormal transfer) is evaluated in each training round, and when the training error tends to converge in continuous multiple cycles, that is, the error reduction amplitude is less than a set threshold (experimentally optimized), the training is terminated and the model parameters are frozen;

[0135] The normalized adjacency matrix is input into the trained GCN-Lite model, and the interaction semantic vector corresponding to each node is output in real time and input into a lightweight Softmax classifier to obtain a multi-class behavior label probability distribution, according to the class corresponding to the maximum probability value, the final predicted label is determined and the corresponding probability is recorded as a confidence index;

[0136] The multi-class behavior labels include but are not limited to: tailing into: unauthorized personnel following authorized personnel through the access control;

[0137] Boundary overstay: personnel stay in a sensitive area for too long;

[0138] Region frequent switching: personnel enter and exit multiple non-associated regions multiple times in a short time;

[0139] Unconventional path transfer: the path of personnel deviates from the conventional patrol or commuting trajectory.

[0140] By inputting the structured event stream into the edge node, locally constructing a dynamic graph structure and utilizing a GCN-Lite graph convolution network model for behavior semantic propagation, the method not only reduces the dependence on the central server and reduces the data transmission delay, but also fully excavates the interaction path between personnel and regions and equipment, effectively enhances the recognition accuracy of the system on explicit abnormal behaviors such as tailing, boundary crossing and frequent switching. In addition, the application adopts a lightweight model and a normalized graph structure, ensures the expression ability of the model, and takes into account the calculation burden of the edge node, realizes the overall optimization of the model in real-time performance, stability and deployability, and has good engineering feasibility and popularization value.

[0141] S4, an implicit abnormality recognition module, configured to input the structured event into a counterfactual generator, generate a normal scene that should appear and compare with the actual input, and recognize an implicit abnormal behavior;

[0142] Specifically, the structured event is input into the counterfactual generator to generate a normal scene that should appear and compare with the actual input to recognize an implicit abnormal behavior. The structured behavior event sequence is fused and encoded with a graph embedding semantic vector to form an input vector sequence Z, wherein each time step contains multi-dimensional features such as behavior label, region position, time stamp and duration, and the path context graph information is retained. Z is sent to a Transformer model, the multi-head self-attention mechanism of which is used to capture the long-term dependence between different time points, and the relative order of events in the time sequence is constructed by combining the position encoding mechanism, so as to learn the evolution law of node behavior in a normal scene.

[0143] The known normal behavior sequence in history is used as training data, and the input vector sequence Z is input into the Transformer model. The model outputs a behavior embedding representation that should appear at the current time but is not observed, i.e. a counterfactual event E', which has the same dimension as the actual event E and includes the predicted behavior type, the belonging region and the time information. The difference between the generated behavior and the real behavior is measured, and a counterfactual loss function is defined, i.e. the Euclidean distance between the predicted event and the real observed event. In the training process, the model parameters are constantly updated by using an Adam optimizer until the loss value on the validation set converges.

[0144] The real-time collected structured behavior sequence is input into the trained Transformer model to generate a counterfactual event E' of the current time, and compared with the actually observed event E. If the counterfactual deviation S exceeds a preset threshold Q (empirically set), it is determined that there is an implicit abnormal behavior.

[0145] This mechanism can effectively identify abnormal path breaks, hidden activities or trackless transfer behaviors caused by monitoring blind spots, log loss or behavior occlusion, etc.

[0146] The node determined as an anomaly will be encapsulated as a "potential unobserved behavior" object, including a personnel ID, a timestamp, a generated event and observed event content, a deviation value, and a risk level.

[0147] By introducing a Transformer-based counterfactual generation mechanism, the intelligence level and response capability of the security system in identifying implicit anomalies are significantly improved. Compared with the traditional method of relying on explicit trajectory comparison or rule triggering, the application fuses structured behavior events and graph embedding semantic vectors to capture multi-dimensional behavior characteristics and regional path context, and uses the powerful time modeling and attention mechanism of the Transformer model to realize deep learning and prediction of behavior evolution rules. This mechanism not only generates "proper events" in the long-term dependence of normal behavior, but also accurately identifies "unobserved but abnormal" behavior paths caused by blind area obstruction, log loss, or trajectory breakage. By calculating the counterfactual deviation and setting a judgment threshold, real-time identification and reporting of potential abnormal behavior is achieved, greatly enhancing the integrity, robustness, and forward-looking warning capability of the distributed security system, providing strong intelligent support for the optimal allocation of monitoring resources and subsequent risk disposal.

[0148] S5, an anomaly determination module, configured to determine high-risk abnormal events in combination with explicit abnormal behavior and implicit abnormal behavior, intercept key video segments and generate event summary hashes, generate trusted event blocks through elliptic curve encryption and lightweight consensus mechanism, and synchronize to the cloud to complete right confirmation and evidence storage;

[0149] Specifically, determining high-risk abnormal events in combination with explicit abnormal behavior and implicit abnormal behavior means jointly determining each structured behavior event. If both the explicit behavior recognition module and the implicit anomaly recognition module mark the event as abnormal, the event is marked as a high-risk abnormal event.

[0150] This stage realizes joint evaluation of observed behavior and unobserved behavior, improving the accuracy and coverage of anomaly detection.

[0151] Existing intelligent security systems generally have the problems of coarse recognition granularity, single model path, and high omission rate when dealing with abnormal behavior, especially in complex scenarios, it is difficult to accurately identify high-risk events under multi-source information fusion. The application improves the recognition ability of complex and composite threats by constructing a "explicit + implicit" dual-channel joint determination framework, which has a significant advantage in scenarios where personnel behavior is difficult to identify directly or camouflage behavior occurs frequently.

[0152] Further, the key video clip is intercepted and the event summary hash is generated. The key video frame or image information in the time period corresponding to the high-risk abnormal event is extracted, a security hash algorithm (such as SHA-256) is used to generate a summary of the key frame, and a hash value is calculated. The summary value uniquely identifies the image evidence of the event and has tamper resistance.

[0153] Further, the trusted event block is generated by elliptic curve encryption and lightweight consensus mechanism, and is synchronized to the cloud to complete the right storage. The event hash and structured event data are concatenated to form a message digest, and the private key in the edge node is used to perform digital signature based on the elliptic curve encryption algorithm (ECC) to generate a signature value. The signature can be verified by the public key to verify the source identity and content integrity, ensuring that the event source is reliable.

[0154] After signing, the event hash, structured event data, signature value, and event occurrence timestamp are packaged into an event block. The block structure not only retains the event content ontology, but also has a complete chain of evidence that can be verified in legal evidence.

[0155] A lightweight Byzantine fault-tolerant consensus mechanism (Light-PBFT) is used for fast block consensus to ensure that event data is written into the local private chain without tampering. Subsequently, the edge node automatically synchronizes the block to the cloud master node after on-chain, completes event right and remote evidence preservation, forms a distributed trusted evidence storage network, and realizes closed-loop reliable traceability management of high-risk events.

[0156] By combining elliptic curve digital signature and lightweight consensus mechanism, fast right and tamper-proof evidence storage of security event data in the edge computing environment are realized. Not only does this improve the response efficiency and data reliability of the system for high-risk events, but it also builds a trusted security data chain with legal effectiveness and distributed security characteristics. Compared with existing evidence storage methods that rely on central servers or traditional blockchains, this solution is more lightweight and flexible, significantly enhancing the adaptability and evidence-gathering ability of distributed intelligent security systems in complex scenarios.

[0157] S6, a display module for displaying the identified event, behavior chain, counterfactual reasoning result, and event right information on a visualization platform to form an interactive view, including the following steps:

[0158] Based on the set of abnormal events that have been righted in the knowledge base, a real-time abnormal event stream view is generated. The abnormal events occurring at the current time are dynamically refreshed along the time axis. Each event unit contains:

[0159] Abnormal behavior labels (such as tailing entry and frequent border crossing);

[0160] Corresponding personnel node ID and area ID;

[0161] Video summary frames (thumbnails);

[0162] Ownership status markers (on-chain signature verification results);

[0163] Trigger timestamp and duration;

[0164] Using the dynamic graph structure and node interaction embedding results output by the explicit anomaly identification module, a regional behavior chain path graph is dynamically constructed. This graph takes nodes as personnel and edges as inter-regional interaction paths, supporting the following functions:

[0165] Display the behavior trajectory of a certain person in different regions in the current and historical period;

[0166] Use color coding to distinguish normal / abnormal behavior paths;

[0167] Support clicking on any node to highlight its complete behavior chain and abnormal behavior occurrence period;

[0168] The graph structure view supports multi-level interaction, such as switching focus perspective "centered on region" or "centered on person", to meet the needs of complex behavior linkage analysis;

[0169] Call the "should appear but not observed" event image output by the implicit anomaly identification module, and form a comparison graph with the actual unobserved events. Display through side-by-side double windows, specific content includes:

[0170] Actual unobserved frames (such as camera obstruction);

[0171] Corresponding generated behavior image or atlas prediction summary frame;

[0172] Corresponding deviation score and abnormal type explanation;

[0173] Each high-risk abnormal event is accompanied by a trusted evidence display component, including:

[0174] On-chain event hash value;

[0175] Digital signature verification result (elliptic curve signature verification);

[0176] Video summary graph and behavior text summary;

[0177] Click to expand to view the complete behavior chain context, event trigger node, and abnormal behavior reasoning path.

[0178] By constructing real-time abnormal event flow view and regional behavior chain path diagram, the structured display and dynamic tracing of abnormal behavior in security scene are realized, and the real-time and linkage of abnormal identification are significantly improved. Combined with explicit abnormal identification and implicit prediction mechanism, not only obvious violation behavior can be captured, but also potential risks caused by shielding or blind area can be found, and the detection coverage is improved. At the same time, the event right mechanism ensures the credibility and traceability of security data, and enhances the evidence effectiveness of judicial and law enforcement applications. The overall system has the advantages of lightweight deployment, efficient calculation and strong security, and significantly optimizes the management effect of distributed intelligent security system.

[0179] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit it. Although the present application has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, which should be covered in the scope of the claims of the present application.

Claims

1. A distributed intelligent security facility based on lightweight AI computing, characterized in that: include, The data collection module is used to deploy edge computing nodes in various security areas, connect to multimodal devices, collect structured data and perform preprocessing. The structured data refers to data with a set time period as the sampling window, all data are appended with the current edge computing node number and a precise timestamp, and stored in a structured format, including image data, audio signals and environmental data. The image enhancement and data inference module is used to enhance video images in low light. Based on the enhanced image data, audio signals and environmental data, it performs inference through a lightweight AI model deployed in the edge nodes. The model identifies human behavior, abnormal sounds and environmental changes, and standardizes and encapsulates the recognition results into structured events. It generates event objects according to the standard structured event format. Each event object contains event type, confidence level, timestamp, location information, data source type and subject ID. The explicit anomaly identification module is used to construct a dynamic graph structure at the edge with structured events as input, and to use a lightweight graph neural network model to mine the interaction paths between people and between people and areas to identify explicit abnormal behaviors. The latent anomaly identification module is used to input structured events into the counterfactual generator, generate normal scenarios that should occur, and compare them with the actual input to identify latent abnormal behaviors. The anomaly detection module is used to determine high-risk abnormal events by combining explicit and implicit abnormal behaviors, extract key video clips and generate event digest hashes, generate trusted event blocks through elliptic curve encryption and lightweight consensus mechanism, and synchronize them to the cloud to complete the confirmation and evidence storage. The display module is used to uniformly display the identified events, behavioral chains, counterfactual reasoning results, and event ownership information on the visualization platform, forming an interactive view. The behavior chain is dynamically constructed by using the dynamic graph structure and interaction path output by the explicit anomaly identification module.

2. The distributed intelligent security facility based on lightweight AI computing as described in claim 1, characterized in that: The low-light enhancement of the video image includes: The acquired image data is preprocessed to remove noise, convert to a uniform color space, and standardize brightness and contrast. The preprocessed image is then processed by the main feature layer and the compensation layer. The main feature layer processing includes: using the Laplacian operator to enhance the edge of the denoised image, extracting the edge information of the image through Laplacian filtering, and enhancing the contrast of the region; The compensation layer processing includes: converting the image from RGB space to HSV space, using an adaptive nonlinear stretching algorithm to enhance the image saturation, and obtaining illumination estimates at different scales by performing multi-scale Retinex on the image. To address the problem of color distortion, a color restoration function is used. To correct image color distortion, a multi-scale Retinex module is combined with a color restoration module to obtain the final MSRCR image enhancement output. : ； Based on the obtained images of the main feature layer and compensation layer, the layer fusion weights are optimized using the artificial bee colony optimization algorithm to determine the optimal combination of the main feature layer and compensation layer. Based on the optimized weights, the main feature layer image and the compensation layer image are fused proportionally to obtain an optimized fused image. Global adaptive contrast correction is then applied to the image to optimize the contrast performance of the entire image, resulting in a low-light enhanced image.

3. The distributed intelligent security facility based on lightweight AI computing as described in claim 2, characterized in that: The inference process utilizes a lightweight AI model deployed in edge nodes. This model identifies human behavior, unusual sounds, and environmental changes, and then standardizes and encapsulates the identification results into structured events, including: The image model YOLO-Nano, the audio model TinyAudioNet, and the environmental state rule model are deployed sequentially in the edge computing nodes to identify human behavior in images, detect abnormal sounds in audio, and determine whether there are abrupt events in the environmental state vector. The recognition results output by each model include image target type, location and confidence level, audio abnormal event label and confidence level, and environmental state abnormality type and state value. All results are uniformly encapsulated and event objects are generated according to the standard structured event format. Each event object contains event type, confidence level, timestamp, location information, data source type and subject ID.

4. The distributed intelligent security facility based on lightweight AI computing as described in claim 3, characterized in that: The process involves taking structured events as input, constructing a dynamic graph structure at the edge, using a lightweight graph neural network model to mine interaction paths between people and between people and regions, identifying explicit abnormal behaviors, extracting participating entities from structured events, generating a set of nodes V of the graph, constructing an initial feature vector for each node, constructing an edge set P through the subject-object relationship in the event, capturing the interaction relationships between people and other entities, constructing a graph structure G=(V,P) based on the node set V and the edge set P, and constructing an adjacency matrix O and then normalizing it to generate a normalized adjacency matrix. The normalized adjacency matrix is ​​input into the pre-trained GCN-Lite model, which outputs the interaction semantic vectors corresponding to each node in real time and inputs them into a lightweight Softmax classifier to obtain the probability distribution of multi-class behavior labels. Based on the category corresponding to the maximum probability value, the final predicted label is determined and the corresponding probability is recorded as a confidence index.

5. The distributed intelligent security facility based on lightweight AI computing as described in claim 4, characterized in that: The process of inputting structured events into a counterfactual generator to generate a normal scenario that should occur and comparing it with the actual input to identify latent abnormal behavior refers to inputting the structured behavior sequence collected in real time into a trained Transformer model to generate the expected event counterfactual event E' at the current moment and comparing it with the actually observed event E. If the counterfactual deviation S exceeds a preset threshold Q, it is determined that there is latent abnormal behavior, and the nodes determined to be abnormal are encapsulated as potential unobserved behavior objects.

6. The distributed intelligent security facility based on lightweight AI computing as described in claim 5, characterized in that: The method of combining explicit and implicit abnormal behaviors to determine high-risk abnormal events refers to jointly determining each structured behavioral event. If both the explicit behavior identification module and the implicit abnormality identification module mark the event as abnormal, then the event is marked as a high-risk abnormal event.

7. The distributed intelligent security facility based on lightweight AI computing as described in claim 6, characterized in that: The process of extracting key video segments and generating event digest hashes refers to extracting key video frames or image information within the time period corresponding to high-risk abnormal events, using a secure hashing algorithm to generate a digest of the key frames, and calculating the hash value.

8. The distributed intelligent security facility based on lightweight AI computing as described in claim 7, characterized in that: The process of generating a trusted event block through elliptic curve cryptography and a lightweight consensus mechanism, and synchronizing it to the cloud for confirmation and evidence storage, involves concatenating the event hash with structured event data to form a message digest, using the private key in the edge node to perform digital signature based on the elliptic curve cryptography algorithm to generate a signature value, and encapsulating the event hash, structured event data, signature value, and event timestamp into an event block. A lightweight Byzantine fault-tolerant consensus mechanism is adopted for rapid block consensus. After the block is put on the chain, it is automatically synchronized to the cloud master node to complete the event ownership confirmation.

9. The distributed intelligent security facility based on lightweight AI computing as described in claim 8, characterized in that: The unified display of identified events, behavioral chains, counterfactual reasoning results, and event ownership information on a visualization platform to form an interactive view refers to generating a real-time abnormal event flow view based on the set of abnormal events with ownership confirmed in the knowledge base. The abnormal events occurring at the current moment are dynamically refreshed with the timeline as the main line. Each event unit includes: abnormal behavior tags. Corresponding personnel node ID and region ID; video summary frame; rights confirmation status marker; trigger timestamp and duration.

10. The distributed intelligent security facility based on lightweight AI computing as described in claim 9, characterized in that: The deployment of edge computing nodes in various security areas, access to multimodal devices, collection of structured data, and preprocessing refers to deploying one edge computing node in each physical security monitoring unit. Each edge computing node is physically connected to multimodal sensing devices, including visible light cameras, infrared thermal imagers, audio pickups, temperature and humidity sensors, and access control switch triggers, to collect image data, audio signals, and environmental data and perform preprocessing to ultimately obtain standardized structured data.

Images