Security monitoring system and method for smart city

Abstract

The invention discloses a security monitoring system and method for a smart city, and the method comprises the steps: deploying a multi-source sensing device in a public region, collecting data, and constructing a city topological graph; node input and output and stock are calculated, cross-regional flow residual errors are obtained, and statistical test is executed; inputting the suspected anomaly into an anti-fact interpreter, and generating a minimum intervention vector and an interpretation result meeting constraints; when the abnormal intensity exceeds a threshold value, an intervention optimizer is called to select a strategy, security intervention measures are executed, and a result is output; when intervention is executed, a proof package is generated, wherein the proof package comprises event hash, a timestamp, a signature and zero-knowledge proof, and the platform is synchronized; and comparing an intervention result with a real label, and using the result as data feedback for residual error detection, explanation and intervention continuous updating. According to the invention, through fusion of multi-source sensing data, city topology modeling, anti-fact interpretation and intervention optimization, accurate detection, interpretable analysis and efficient intelligent disposal of abnormal events in a smart city are realized.

Description

Technical Field

[0001] This invention relates to the field of smart city security monitoring technology, and in particular to a security monitoring system and method for smart cities. Background Technology

[0002] Currently, with the continuous advancement of smart city construction, city-level security monitoring and risk early warning systems are gradually becoming important infrastructure for improving urban governance capabilities and ensuring public safety. In existing technologies, most urban security monitoring methods rely primarily on video surveillance data or single sensor data for anomaly detection and analysis. Their feature extraction and multi-source data fusion capabilities are limited, leading to high false alarm rates, insufficient positioning accuracy, and poor response timeliness when facing complex urban topologies and multi-dimensional risk scenarios. For example, while some existing machine learning-based monitoring methods can train on historical data and perform pattern recognition, they often lack the ability to consistently verify anomalies across different regions and struggle to dynamically intervene and optimize under resource or time constraints. Therefore, they fail to meet the dual requirements of real-time performance and robustness for urban security monitoring.

[0003] Traditional anomaly detection methods mostly rely on static threshold judgments or statistical modeling. When anomalies are influenced by multiple complex factors, the reliability of the detection results is difficult to guarantee. Especially in urban topology, complex coupling and interaction relationships exist between different areas. Existing technologies often ignore the conservation and consistency constraints between regions, which can easily lead to biases in the local judgment of anomalies, thereby reducing the accuracy of the overall judgment. Existing anomaly interpretation mechanisms mostly remain at the level of result visualization and simple source tracing, lacking in-depth explanatory capabilities based on counterfactual reasoning and minimal intervention strategies. This makes it difficult for users to intuitively understand the causes of anomalies and their optimal response under multiple constraints.

[0004] In terms of intervention optimization, existing technologies typically generate intervention plans through preset rules or static optimization models. However, under resource and time constraints, they cannot achieve dynamic adjustment and efficient solution. Furthermore, they lack intelligent rule engines for priority ranking and adaptive constraint selection mechanisms, making it difficult for the system to provide a highly credible sequence of intervention actions in a timely manner when emergencies occur, resulting in delays and risk spread in urban safety protection.

[0005] Therefore, how to provide a security monitoring system and method for smart cities is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a security monitoring system and method for smart cities. This invention fully utilizes multimodal data acquisition, conservation consistency detection, counterfactual anomaly interpretation, and priority rule engines to describe in detail the entire process of achieving high-precision identification, interpretable tracing, and dynamic intervention decision-making for anomalies in complex urban topological environments. This invention possesses advantages such as strong multi-source information fusion capabilities, high anomaly detection accuracy, intuitive and reliable interpretation results, and efficient and reasonable intervention optimization, significantly enhancing city-level intelligent security protection capabilities and real-time response capabilities.

[0007] A smart city security monitoring method according to an embodiment of the present invention includes:

[0008] Video cameras, audio collectors, infrared sensors, and environmental monitoring equipment are deployed in public areas of smart cities to collect multi-source data, process the multi-source data, and construct a city topology map with a node-edge structure.

[0009] Based on the city topology map and multi-source data, the input flow, output flow and stock change of each node are calculated in each time window to obtain the cross-regional flow conservation residual. Statistical tests are performed, and when the statistical test results exceed the threshold, they are marked as suspected abnormal events.

[0010] Input the suspected anomaly into the counterfactual interpreter, generate a minimum intervention vector based on physical and topological constraints, calculate the anomaly intensity value, and output the anomaly interpretation result corresponding to the minimum intervention vector;

[0011] When the abnormal intensity value exceeds the preset threshold, the intervention optimizer is activated. Based on the abnormal intensity value and the corresponding event type, the most suitable intervention strategy is selected from the available intervention methods, and the intervention strategy is executed to obtain the corresponding intervention results. The intervention results include the arrival of security personnel, the deployment of drone patrols, or the adjustment of the angle of surveillance cameras.

[0012] While implementing the intervention strategy, an intervention proof package is generated, which includes an event fingerprint hash, intervention timestamp, threshold signature, and zero-knowledge proof. The intervention proof package is then synchronized to the security command platform and relevant departments.

[0013] The intervention results are compared with the corresponding true event labels, and the comparison results are used as data input. The statistical test of cross-regional flow conservation residuals, the generation of minimum intervention vectors for counterfactual interpreters, and the strategy selection and execution of intervention optimizers are continuously updated and optimized in a multi-regional scope.

[0014] Optionally, the multi-source data specifically includes personnel flow data, vehicle operation data, audio signal data, infrared sensing data, and environmental status data.

[0015] Optionally, the processing of multi-source data specifically includes time synchronization, format standardization, noise filtering, and missing value completion of multi-source data. The construction of a node-edge structured urban topology map refers to the establishment of urban topology structure by using monitoring points, entrances and exits, and key traffic locations as nodes, and pedestrian paths and vehicle passageways as edges, to establish connectivity between nodes.

[0016] Optionally, the statistical test is performed, and when the statistical test result exceeds a threshold, it is marked as a suspected abnormal event, including:

[0017] Define the structure of the city topology map and the time window for processing. The city topology map consists of a set of nodes composed of monitoring points, entrances and exits and key traffic locations, and a set of access edges connecting the nodes. The time window is a continuous interval of start and end times.

[0018] Based on the processed multi-source data, the number of people and vehicles passing through each edge or the equivalent flow are counted within a time window to obtain edge-level flow records.

[0019] For each node, the input flow of the node is obtained by accumulating the edge-level flow of all incoming edges connected to the node within the time window, and the output flow of the node is obtained by accumulating the edge-level flow of all leaving edges connected to the node. The node stock data at the beginning and end of the time window are counted separately, and the change in the node stock is calculated.

[0020] For each node, the input flow is subtracted from the output flow and the change in stock is deducted to obtain the cross-regional flow conservation residual of the node, and a residual list is formed in the order of node number.

[0021] Perform statistical tests on the residual list, calculate the statistical test value for the corresponding time window and compare it with a preset threshold. When the statistical test value reaches or exceeds the preset threshold, output a suspected abnormal event record.

[0022] Optionally, the calculation of the anomaly intensity value, outputting the anomaly interpretation result corresponding to the minimum intervention vector, includes:

[0023] Determine the processing time window, obtain multi-source data and urban topology map, and read the residual list and statistical test values ​​to form an input set of suspected abnormal events;

[0024] The search space and constraints of the counterfactual interpreter are set. The constraints include physical constraints and topological constraints. The physical constraints limit the upper limit of speed, the consistency of illumination and the order of occlusion. The topological constraints limit the connectivity, the direction of travel and the area boundaries in the city topology map.

[0025] Under constraints, perform a counterfactual search for each suspected anomalous event to obtain the minimum intervention vector that makes the suspected anomalous event normal within the time window.

[0026] Record the composition of the minimum intervention vector, including:

[0027] Object-level adjustment amount is defined as the number of objects that need to be removed or added.

[0028] Cross-node traffic correction is defined as the percentage increase or decrease in traffic between adjacent nodes;

[0029] Perception resource adjustment parameters are defined as adjustment values ​​for camera viewpoint, focal length, coverage area, or drone patrol trajectory.

[0030] Based on the amplitude information of the recorded minimum intervention vector and combined with statistical test values, a single value is synthesized according to preset weights as the anomaly intensity value. The anomaly intensity value is then compared with a preset threshold to form a severity level, generating an anomaly interpretation result and binding it to the corresponding suspected anomaly event.

[0031] Optionally, the counterfactual interpreter includes:

[0032] Scene encoding subunit: Encodes multi-source data and urban topology map to generate scene representation. The scene encoding subunit uses graph attention network combined with multimodal feature splicing algorithm to extract features and perform structured modeling of multi-source data and urban topology map.

[0033] Counterfact generation subunit: Generates counterfact candidates that satisfy physical and topological constraints based on scene representation. The counterfact generation subunit adopts a conditional diffusion generation network and combines differentiable rendering constraints to ensure lighting consistency, occlusion relationship and geometric continuity.

[0034] Minimal intervention solution subunit: The minimum intervention vector is obtained from the counterfactual candidates and the corresponding anomaly interpretation result and anomaly intensity value are output. The minimum intervention solution subunit is solved by the alternating direction multiplier method under physical constraints and topological constraints.

[0035] Optionally, when the anomaly intensity value exceeds a preset threshold, the intervention optimizer is activated to select the most suitable intervention strategy from the available intervention methods based on the anomaly intensity value and the corresponding event type, and executes the intervention strategy to obtain the corresponding intervention result, including:

[0036] Read the anomaly intensity value, event type, and anomaly interpretation results; statistically analyze the test values ​​and the set of nodes involved in suspected anomalies; and simultaneously obtain the city topology map.

[0037] List available intervention methods and form an intervention candidate set, including security personnel dispatch, drone patrol and surveillance camera linkage, and generate a resource and time constraint list.

[0038] Based on the anomaly intensity value, event type, and anomaly interpretation results, and in conjunction with the resource and time constraint list, the risk reduction effect, expected response delay, resource consumption, and coverage matching degree of each candidate intervention measure are evaluated according to the preset decision rules, and a ranked candidate list is generated.

[0039] Select the target intervention strategy that ranks highest under the constraints from the candidate list and generate the corresponding set of execution parameters;

[0040] Instructions are issued and executed according to the determined target intervention strategy and set of execution parameters. The start and end timestamps of the execution, the set of nodes covered or affected, the failure and retry situation during the execution process, and the on-site feedback information are recorded to obtain the intervention results. The intervention results and related execution information are archived as an intervention result summary.

[0041] Optionally, the intervention optimizer includes:

[0042] Priority and Rule Engine: It adopts a method based on multi-level rule matching and hierarchical weighted sorting. It performs multi-level matching of candidate intervention methods through the rule base to form a candidate set under rule constraints. It calculates weighted scores according to anomaly intensity, event urgency and resource consumption. It performs hierarchical sorting by combining rule matching results and weighted scores, and outputs a candidate list with priority.

[0043] Constraint Selection Engine: Under resource and time constraints, selects the target intervention strategy and execution parameter set from the candidate list. When the available computing time meets the exact solution conditions, integer linear programming is used to determine the target intervention strategy and execution parameters. When the time budget is limited, a greedy approximation based on submodular functions is used to generate the intervention action sequence and corresponding execution parameters.

[0044] Execution Interface: Issues instructions to security personnel, drones, and surveillance cameras according to the target intervention strategy and execution parameter set, and collects start and end timestamps, affected node set, instruction receipt number, and failure retry record to form an intervention result summary.

[0045] Optionally, generating an intervention proof package while executing the intervention strategy includes:

[0046] Based on the intervention result summary, anomaly intensity value and anomaly interpretation results, time window identifier and node set, and city topology map, event time anchors and topology anchors are generated;

[0047] The residual list is compressed and encoded to generate a consistency commitment summary, while the anomaly interpretation results are structured and discretized to form an interpretation binding summary;

[0048] The target intervention strategy and execution parameters are ordered and serialized to generate action sequence fingerprints, which are then linked with event time anchors and topological anchors to form a disposal link index.

[0049] Call the execution interface of the intervention optimizer, collect instruction receipt number and authorized entity identifier, trigger cross-department dual-domain witness signing process, complete threshold signing in the command domain and the local domain respectively and aggregate them into a joint witness signature, generate a lightweight witness token and record the supplementary signing time limit when the complete signing conditions cannot be met;

[0050] Selective disclosure proof data is generated for three indicators: response time, resource consumption, and coverage. The selective disclosure proof data proves that the three indicators meet preset constraints without exposing plaintext parameters, and is bound to the consistency commitment summary and the explanation binding summary.

[0051] The event time anchor, topological anchor, consistency commitment summary, explanation binding summary, action sequence fingerprint, joint witness signature, and selective disclosure proof data are assembled into an intervention proof package and archived.

[0052] A smart city security monitoring system according to an embodiment of the present invention includes the following modules:

[0053] The data acquisition and topology construction module is used to collect and process multi-source data to build a city topology map.

[0054] The anomaly detection module is used to calculate node traffic changes, extract cross-regional traffic conservation residuals and perform statistical tests, and mark suspected anomaly events.

[0055] The anomaly interpretation module is used to generate the minimum intervention vector under constraints, calculate the anomaly intensity value, and output the anomaly interpretation result.

[0056] The intervention module is used to select and execute intervention strategies based on the abnormality intensity value and event type, and obtain intervention results;

[0057] The trusted proof module is used to generate an intervention proof package while executing the intervention strategy and synchronize it to the security platform and relevant departments;

[0058] The feedback module is used to compare the intervention results with the true labels of the events, and to continuously update and optimize the statistical test of the cross-regional flow conservation residuals, the generation of the minimum intervention vector, and the selection and execution of intervention strategies.

[0059] The beneficial effects of this invention are:

[0060] This invention establishes a multi-source heterogeneous data fusion acquisition and processing system by deploying video cameras, audio collectors, infrared sensors, and environmental monitoring equipment in public areas of smart cities. Based on a node-edge structure, it constructs a city topology map that accurately reflects the dynamic relationships between monitoring points, entrances / exits, and traffic corridors. Furthermore, it utilizes statistical verification of cross-regional traffic conservation residuals to achieve fine-grained anomaly detection, effectively overcoming the shortcomings of traditional single-data-source-based methods, such as high false alarm rates and insufficient coverage in complex urban scenarios.

[0061] This invention combines a counterfactual interpreter and an intervention optimizer. Upon detecting a suspected anomaly, it generates a minimum intervention vector based on physical and topological constraints, calculates the anomaly intensity value, and provides an interpretable explanation of the anomaly's source. When the anomaly intensity value exceeds a threshold, the system automatically invokes an appropriate intervention strategy, achieving a closed-loop linkage from anomaly detection and cause explanation to intervention execution. This improves the timeliness and effectiveness of urban public safety incident response, avoiding delays and uncertainties caused by relying solely on manual decision-making.

[0062] This invention establishes a feedback update mechanism by comparing intervention results with real labels. This mechanism enables continuous optimization of the statistical testing of cross-regional traffic conservation residuals, the generation of minimum intervention vectors, and the selection and execution of intervention strategies across multiple regions. This ability to continuously learn and iteratively update gives the system adaptive evolutionary characteristics in long-term operation. It not only improves the accuracy and robustness of anomaly detection and intervention decisions but also maintains stable and reliable operation in the face of dynamically changing urban environments and new emergencies. Attached Figure Description

[0063] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0064] Figure 1 This is a flowchart of a security monitoring method for smart cities proposed in this invention;

[0065] Figure 2 This is a schematic diagram of the structure of a security monitoring system for smart cities proposed in this invention. Detailed Implementation

[0066] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0067] refer to Figure 1 A security monitoring method for smart cities includes:

[0068] Video cameras, audio collectors, infrared sensors, and environmental monitoring equipment are deployed in public areas of smart cities to collect multi-source data, process the multi-source data, and construct a city topology map with a node-edge structure.

[0069] Based on the city topology map and multi-source data, the input flow, output flow and stock change of each node are calculated in each time window to obtain the cross-regional flow conservation residual. Statistical tests are performed, and when the statistical test results exceed the threshold, they are marked as suspected abnormal events.

[0070] Input the suspected anomaly into the counterfactual interpreter, generate a minimum intervention vector based on physical and topological constraints, calculate the anomaly intensity value, and output the anomaly interpretation result corresponding to the minimum intervention vector;

[0071] When the abnormal intensity value exceeds the preset threshold, the intervention optimizer is activated. Based on the abnormal intensity value and the corresponding event type, the most suitable intervention strategy is selected from the available intervention methods, and the intervention strategy is executed to obtain the corresponding intervention results. The intervention results include the arrival of security personnel, the deployment of drone patrols, or the adjustment of the angle of surveillance cameras.

[0072] While implementing the intervention strategy, an intervention proof package is generated, which includes an event fingerprint hash, intervention timestamp, threshold signature, and zero-knowledge proof. The intervention proof package is then synchronized to the security command platform and relevant departments.

[0073] The intervention results are compared with the corresponding true event labels, and the comparison results are used as data input. The statistical test of cross-regional flow conservation residuals, the generation of minimum intervention vectors for counterfactual interpreters, and the strategy selection and execution of intervention optimizers are continuously updated and optimized in a multi-regional scope.

[0074] In this embodiment, the multi-source data specifically includes personnel flow data, vehicle operation data, audio signal data, infrared sensing data, and environmental status data.

[0075] In this embodiment, the processing of multi-source data specifically includes time synchronization, format standardization, noise filtering, and missing value completion of multi-source data. The construction of a node-edge structured urban topology map refers to the establishment of urban topology structure by using monitoring points, entrances and exits, and key traffic locations as nodes, and pedestrian paths and vehicle passageways as edges, to establish connectivity between the nodes.

[0076] In this embodiment, the step of performing statistical testing, and marking a suspected abnormal event when the statistical test result exceeds a threshold, includes:

[0077] Define the structure of the city topology map and the time window for processing. The city topology map consists of a set of nodes composed of monitoring points, entrances and exits and key traffic locations, and a set of access edges connecting the nodes. The time window is a continuous interval of start and end times.

[0078] Based on the processed multi-source data, the number of people and vehicles passing through each edge or the equivalent flow are counted within a time window to obtain edge-level flow records.

[0079] For each node, the input flow of the node is obtained by accumulating the edge-level flow of all incoming edges connected to the node within the time window, and the output flow of the node is obtained by accumulating the edge-level flow of all leaving edges connected to the node. The node stock data at the beginning and end of the time window are counted separately, and the change in the node stock is calculated.

[0080] For each node, the input flow is subtracted from the output flow and the change in stock is deducted to obtain the cross-regional flow conservation residual of the node, and a residual list is formed in the order of node number.

[0081] Statistical tests are performed on the residual list. The statistical test value for the corresponding time window is calculated and compared with a preset threshold. When the statistical test value reaches or exceeds the preset threshold, a suspected abnormal event record is output. The suspected abnormal event record includes a time window identifier, a node identifier, and the corresponding residual value. The calculation of the statistical test value for the corresponding time window is specifically as follows:

[0082] Based on the input flow, output flow, and inventory changes of each node, the flow residual of each node within the time window is calculated. The flow residual is the difference between the inflow and outflow of the node, and is corrected by the inventory changes to obtain the residual value of each node.

[0083] The Z-test method is used to statistically calculate the flow residuals of all nodes within the time window. The statistical test value is generated by calculating the mean and standard deviation of the sample residuals.

[0084] This invention combines urban topology and multi-source data to achieve efficient and accurate anomaly detection and processing, improving the response speed and accuracy of public safety monitoring in smart cities. By defining the urban topology structure, the system can clearly identify and monitor key nodes and access edges, further refining the flow data of each node and edge to ensure data comprehensiveness and accuracy. Using a time window approach for real-time flow statistics, it can promptly capture any flow anomalies exceeding normal ranges, avoiding misjudgments and omissions caused by incomplete or delayed data in large-scale scenarios using traditional methods. Through the calculation method of cross-regional flow conservation residuals, the system considers the comprehensive impact of input and output flow and stock changes at each node, ensuring that anomaly detection not only relies on a single comparison of flow values ​​but also incorporates internal node state changes, enhancing its ability to cope with multiple factors in complex urban scenarios. The Z-test method is used to statistically verify the residual list, improving the reliability of anomaly detection, reducing false alarms, and ensuring the system's effectiveness in high-density areas or complex environments.

[0085] In this embodiment, the calculation of the anomaly intensity value and the output of the anomaly interpretation result corresponding to the minimum intervention vector include:

[0086] Determine the processing time window, obtain multi-source data and urban topology map, and read the residual list and statistical test values ​​to form an input set of suspected abnormal events;

[0087] The search space and constraints for the counterfactual interpreter are defined. These constraints include physical and topological constraints. Physical constraints limit the upper limit of speed, illumination consistency, and occlusion order. Topological constraints limit the connectivity, travel direction, and region boundaries in the city topology map. The search space includes:

[0088] The node input and output flow, stock changes, and cross-node flow increase / decrease ratios are used to adjust the flow conservation residual.

[0089] Physical constraints, including illumination consistency, speed limits, and occlusion sequence, are used to ensure that intervention adjustments conform to actual environmental limitations.

[0090] The connectivity, traffic directions, and regional boundaries in the city topology map ensure that intervention measures conform to the structure of the city topology map and traffic rules.

[0091] Under constraints, a counterfactual search is performed for each suspected anomalous event to obtain the minimum intervention vector that allows the suspected anomalous event to be judged as normal within the time window. Specifically, the counterfactual search for each suspected anomalous event involves:

[0092] When each suspected anomaly occurs, determine the search space and constraints corresponding to the suspected anomaly to ensure that the search process complies with physical and topological constraints;

[0093] Under constraints, by using counterfactual reasoning, the parameters related to the abnormal event are gradually adjusted, the minimum amount of change is calculated, and the abnormal event is restored to a normal state.

[0094] Based on the calculated adjustment amount, find the minimum intervention strategy so that suspected abnormal events can be judged as normal within the defined time window, and generate the minimum intervention vector.

[0095] Record the composition of the minimum intervention vector, including:

[0096] Object-level adjustment amount is defined as the number of objects that need to be removed or added.

[0097] Cross-node traffic correction is defined as the percentage increase or decrease in traffic between adjacent nodes;

[0098] Perception resource adjustment parameters are defined as adjustment values ​​for camera viewpoint, focal length, coverage area, or drone patrol trajectory.

[0099] Based on the amplitude information of the recorded minimum intervention vector and combined with statistical test values, a single value is synthesized according to preset weights as the anomaly intensity value. The anomaly intensity value is then compared with a preset threshold to form a severity level. An anomaly interpretation result is generated and bound to the corresponding suspected anomaly event. The anomaly interpretation result includes object-level adjustment amount, cross-node traffic correction amount, and sensing resource adjustment parameters.

[0100] This invention improves the detection and intervention effectiveness of anomaly events in smart city security monitoring systems by introducing multi-dimensional counterfactual reasoning and constraint setting. By constructing a multi-source data processing framework based on the city's topology map, combined with traffic residuals and statistical tests, the system can detect anomalies in real time and provide reasonable explanations. Innovatively, the counterfactual search not only considers traffic changes but also integrates physical and topological constraints, ensuring that intervention measures conform to actual environmental limitations and avoiding misjudgments and over-interventions caused by neglecting environmental factors in traditional methods. The proposed minimum intervention vector calculation method gradually adjusts relevant parameters during the counterfactual reasoning process, accurately generating a minimum intervention strategy that restores anomalies to a normal state. Through meticulous recording of intervention results, including object-level adjustments, traffic corrections, and sensing resource adjustment parameters, the system can dynamically optimize for specific scenarios, improving the accuracy and timeliness of anomaly handling. By calculating the anomaly intensity value based on the intervention vector and comparing it with the threshold, this invention can effectively distinguish the severity of abnormal events, provide more operable decision support, optimize the existing security monitoring process, improve the system's adaptability and intelligence level, effectively reduce the false alarm rate, and enhance the efficiency and accuracy of smart city public safety management.

[0101] In this embodiment, the counterfactual interpreter includes:

[0102] Scene encoding subunit: Encodes multi-source data and city topology maps to generate scene representations. This scene encoding subunit employs a graph attention network combined with a multimodal feature concatenation algorithm to extract features and perform structured modeling of the multi-source data and city topology maps. Specifically:

[0103] Convolutional neural networks are used to extract features from video, audio, and sensor data respectively, and the features are concatenated into a unified multimodal feature.

[0104] Graph attention network is used to perform weighted aggregation of node features in the city topology graph, and important features are extracted based on the topology and the connection relationship between nodes.

[0105] Multimodal data features are concatenated with topological graph node features, and a comprehensive feature representation is generated through structured modeling to capture the spatial and structural relationships between data.

[0106] Counterfact generation subunit: Based on scene representation, it generates counterfactual candidates that satisfy physical and topological constraints. This counterfactual generation subunit employs a conditional diffusion generation network combined with differentiable rendering constraints to ensure lighting consistency, occlusion relationships, and geometric continuity. Specifically:

[0107] The multimodal features in the scene representation and the city topology information are used as conditional inputs and passed to the conditional diffusion generation network.

[0108] Conditional diffusion generative networks generate counterfactual candidates step by step through a diffusion process. The diffusion process simulates the impact of different intervention strategies on the original event based on the multimodal features of the input and the structural information of the city topology map, generating multiple counterfactual candidates.

[0109] By controlling the conditional inputs during the diffusion process, different counterfactual candidates are generated, each representing a different intervention scheme and simulating different scenario changes;

[0110] Minimal intervention solution subunit: This subunit calculates the minimum intervention vector from the counterfactual candidates and outputs the corresponding anomaly interpretation result and anomaly intensity value. The minimum intervention solution subunit is solved using the alternating direction multiplier method under both physical and topological constraints. Specifically:

[0111] Construct an optimization problem that includes intervention vectors and constraints, and transform the counterfactual candidate into minimizing the objective function. The goal is to reduce the difference between the intervention effect and the original event, while ensuring that physical and topological constraints are met.

[0112] The optimization problem is decomposed into two sub-problems: one is the optimization of the intervention vector, and the other is the optimization of physical and topological constraints. In each iteration, the intervention vector is optimized, and then the parameters related to the constraints are optimized, alternating between the two.

[0113] Through the iterative process of the alternating direction multiplier method, the intervention vector and Lagrange multipliers are gradually adjusted until the intervention scheme satisfies all constraints and the optimization objective converges. Finally, the minimum intervention vector is output, and the anomaly intensity value is calculated to generate the anomaly interpretation result.

[0114] This invention enhances the intelligence and accuracy of smart city security monitoring by combining feature extraction and counterfactual reasoning with multi-source data and urban topology maps. The scene encoding subunit effectively extracts features from video, audio, and sensor data using graph attention networks and multimodal feature concatenation algorithms, and combines this with urban topology map information to provide more comprehensive input data, enhancing the adaptability of anomaly detection. The counterfactual generation subunit utilizes conditional diffusion generation networks and differentiable rendering constraints to ensure that the generated counterfactual candidates conform to illumination consistency, occlusion relationships, and geometric continuity, thereby simulating the impact of different intervention schemes and improving the system's ability to handle complex scenarios. The minimum intervention solution subunit optimizes the intervention vector using the alternating direction multiplier method, ensuring that the intervention scheme meets the constraints and reducing the differences in the original events, thus improving the accuracy and efficiency of anomaly correction.

[0115] In this embodiment, when the anomaly intensity value exceeds a preset threshold, the intervention optimizer is activated. Based on the anomaly intensity value and the corresponding event type, the most suitable intervention strategy is selected from the available intervention methods, and the intervention strategy is executed to obtain the corresponding intervention result, including:

[0116] Read the anomaly intensity value, event type, and anomaly interpretation results; statistically analyze the test values ​​and the set of nodes involved in suspected anomalies; and simultaneously obtain the city topology map.

[0117] List available intervention methods and form an intervention candidate set. The intervention methods include security personnel dispatch, drone patrol and surveillance camera linkage. At the same time, generate a resource and time limit constraint list, which includes the upper limit of available security personnel, the upper limit of available drones, the upper limit of adjustable cameras and the maximum response time.

[0118] Based on the anomaly intensity value, event type, and anomaly interpretation results, and in conjunction with a list of resource and time constraints, each candidate intervention measure is evaluated according to preset decision rules for risk reduction effect, expected response delay, resource consumption, and coverage matching degree, generating a ranked candidate list. The preset decision rules specifically include:

[0119] Risk reduction effectiveness rule: Evaluate the risk reduction effect of each intervention on abnormal events. Calculate the effectiveness of the intervention in reducing the impact of abnormalities based on the abnormality intensity value and event type. The more significant the effect, the higher the score, and the more priority should be given to its implementation.

[0120] Expected response delay rule: Assess the response delay of each intervention measure, and select the intervention measure with the shortest response delay based on the urgency of the event and the execution time of the intervention measure. The shorter the delay, the higher the score, and the higher the priority for execution.

[0121] Resource consumption rule: Assess the resource consumption of each intervention, including the use of manpower, materials and equipment, and score the intervention based on the degree of resource consumption. Interventions with low resource consumption but good results will be given priority.

[0122] Coverage matching rule: Assess the degree of matching between the coverage of intervention measures and the scale and impact of the event. Scores are given based on the type, scale and scope of impact of the event. Intervention measures that can fully cover the scope of the event score higher and are given priority.

[0123] Select the target intervention strategy that ranks highest under the constraints from the candidate list and generate the corresponding set of execution parameters. The set of execution parameters includes the location and number of security personnel, the take-off point and patrol path of the drone and its dwell time, and the azimuth, pitch, zoom and linkage sequence of the surveillance camera.

[0124] Instructions are issued and executed according to the determined target intervention strategy and execution parameter set. The start and end timestamps of the execution, the set of nodes covered or affected, the failure retry situation and on-site feedback information during the execution process are recorded to obtain the intervention results. The intervention results and related execution information are archived as an intervention result summary. The intervention result summary includes at least the start and end times, the set of affected nodes, the identification of the executors and equipment, and the instruction receipt number.

[0125] This invention improves the response speed and accuracy of smart city security monitoring in handling abnormal events by introducing a multi-dimensional evaluation and decision-making mechanism. Real-time reading of anomaly intensity values, event types, and topology data, combined with statistical testing, enables precise determination of the location and characteristics of abnormal events, providing comprehensive information input for intervention. The candidate set of intervention methods not only considers security personnel dispatch, drone patrols, and surveillance camera linkage, but also incorporates detailed constraints on resources and time limits, ensuring the selection of the most appropriate intervention method under limited resources. Pre-set decision rules evaluate each intervention method from multiple dimensions, including risk reduction effect, expected response delay, resource consumption, and coverage matching, comprehensively assessing the effectiveness and feasibility of intervention measures. This ensures the optimal solution is prioritized, avoiding bias caused by a single factor and improving the scientific and rational nature of decision-making. By selecting the optimal intervention strategy from the candidate list and generating specific execution parameters, precise guidance for intervention execution can be provided. Real-time feedback and recording during the intervention process allow for continuous optimization, ensuring that abnormal events are effectively handled in the shortest possible time, improving the response efficiency of smart city security, and enhancing adaptability and flexibility to complex environments.

[0126] In this embodiment, the intervention optimizer includes:

[0127] Priority and Rule Engine: Based on the read anomaly intensity value, event type, and anomaly interpretation results, combined with resource and time constraints, candidate intervention methods are scored and ranked. A method based on multi-level rule matching and hierarchical weighted ranking is adopted. The candidate intervention methods are matched at multiple levels through the rule base to form a candidate set under rule constraints. Weighted scores are calculated according to anomaly intensity, event urgency, and resource consumption. Hierarchical ranking is performed by combining the rule matching results and weighted scores, and a candidate list with priority is output.

[0128] Constraint Selection Engine: Under resource and time constraints, the engine selects a target intervention strategy and execution parameter set from a candidate list. When the available computation time meets the exact solution conditions, integer linear programming is used to determine the target intervention strategy and execution parameters. When the time budget is limited, a greedy approximation based on submodular functions is used to generate the intervention action sequence and corresponding execution parameters. Specifically, the process of using integer linear programming to determine the target intervention strategy and execution parameters when the available computation time meets the exact solution conditions is as follows:

[0129] The problem of choosing intervention strategies is transformed into an integer linear programming problem, with the goal of minimizing intervention costs and maximizing the effect of anomaly repair, while constraining available resources and time limits.

[0130] Using an integer linear programming solver, the optimal combination of intervention strategy and execution parameters is calculated based on resource and time constraints.

[0131] Based on the solution results, the optimal intervention strategy is determined and corresponding execution parameters are generated, such as the location of security personnel, the path of the drone, and the camera adjustment angle.

[0132] When time budget is limited, a greedy approximation based on submodular functions is used to generate the intervention action sequence and corresponding execution parameters, specifically as follows:

[0133] Define a gain function for each intervention action to represent the benefit of performing the intervention action, and ensure that the gain function has the submodular property, that is, the gain gradually decreases with each additional intervention action;

[0134] In each iteration, the intervention action with the greatest current gain is selected, and the sequence of intervention actions is gradually constructed, while ensuring that the risk reduction effect is maximized under the constraints of resources and time limits.

[0135] Assign corresponding execution parameters to each selected intervention action to form a complete sequence of intervention actions and a set of execution parameters;

[0136] Execution Interface: Issues instructions to security personnel, drones, and surveillance cameras according to the target intervention strategy and execution parameter set, and collects start and end timestamps, affected node set, instruction receipt number, and failure retry record to form an intervention result summary.

[0137] This implementation improves the efficiency and accuracy of anomaly handling in smart city security monitoring systems by employing multi-level rule matching, weighted sorting, integer linear programming, and greedy approximation algorithms. The priority and rule engine uses a multi-level rule base to match and weight candidate intervention methods, combining anomaly intensity, event urgency, and resource consumption to prioritize the most suitable intervention strategy, thereby reducing response time and ensuring effective handling. The constraint selection engine combines integer linear programming and greedy approximation methods to accurately solve intervention strategies or generate near-optimal solutions under time and resource constraints. Integer linear programming provides optimal solutions when resources and time are sufficient, while greedy approximation quickly generates effective intervention sequences, ensuring maximum effectiveness even under resource constraints. The execution interface ensures the traceability and effectiveness of intervention measures by issuing commands and recording execution information. This invention can efficiently handle complex anomalies, improve processing accuracy and response speed, and enhance the adaptability and flexibility of smart city security.

[0138] In this embodiment, generating an intervention proof package while executing the intervention strategy includes:

[0139] Based on the intervention result summary, abnormal intensity value and abnormal interpretation result, time window identifier and node set, and city topology map, event time anchor and topology anchor are generated. The event time anchor is used to uniquely identify the time window and execution period, and the topology anchor is used to uniquely identify the affected node and connectivity relationship.

[0140] The residual list is compressed and encoded to generate a consistency commitment summary. At the same time, the anomaly interpretation results are structured and discretized to form an interpretation binding summary. The consistency commitment summary and the interpretation binding summary are used together as fingerprint inputs for evidence elements.

[0141] The target intervention strategy and execution parameters are ordered and serialized to generate action sequence fingerprints, which are then linked with event time anchors and topological anchors to form a disposal link index.

[0142] Call the execution interface of the intervention optimizer, collect instruction receipt number and authorized entity identifier, trigger cross-department dual-domain witness signing process, complete threshold signing in the command domain and the local domain respectively and aggregate them into a joint witness signature, generate a lightweight witness token and record the supplementary signing time limit when the complete signing conditions cannot be met;

[0143] Selective disclosure proof data is generated for three indicators: response time, resource consumption, and coverage. This selective disclosure proof data proves that the three indicators meet preset constraints without exposing plaintext parameters, and is bound to a consistency commitment digest and an explanation binding digest. Specifically, the generation of selective disclosure proof data involves:

[0144] Encrypt the three indicators of response time, resource consumption and coverage to avoid exposing plaintext data and protect sensitive information;

[0145] Using zero-knowledge proof technology, selectively disclosed proof data is generated to prove that three indicators meet preset constraints without revealing the actual data.

[0146] Selective disclosure of supporting data is linked to a summary of the consistency commitment and an explanation binding summary to ensure consistency between data verification and explanation;

[0147] The event time anchor, topological anchor, consistency commitment summary, explanation binding summary, action sequence fingerprint, joint witness signature, and selective disclosure proof data are assembled into an intervention proof package and archived.

[0148] This invention enhances the effectiveness of smart city security monitoring systems in terms of abnormal event intervention and data credibility by introducing a multi-layered proof mechanism. The intervention proof package ensures the traceability and verifiability of intervention through event time anchors and topological anchors, and improves the transparency and data reliability of event handling by combining consistency commitment summaries and explanation binding summaries. The chained association of action sequence fingerprints with time anchors and topological anchors ensures a complete record of the intervention execution process, and the legality and compliance of intervention measures are ensured through a cross-departmental joint witnessing and signing process. Selective disclosure of proof data, using zero-knowledge proof technology, protects the privacy of key indicators while proving compliance with preset constraints, avoiding the leakage of sensitive information. The generation of the intervention proof package makes the intervention process traceable, enhances the system's transparency and credibility, and improves the accuracy and efficiency of event response.

[0149] In this embodiment, comparing the intervention results with the corresponding true event labels and using the comparison results as data input, and continuously updating and optimizing the statistical test of cross-regional traffic conservation residuals, the minimum intervention vector of the counterfactual interpreter, and the strategy selection and execution of the intervention optimizer across multiple regions, includes:

[0150] After implementing the intervention strategy, collect the intervention results and compare them with the true label of the event to assess whether the intervention measures resolved the abnormal event and record the remediation status;

[0151] The comparison results were used as data input to analyze the differences between the intervention results and the true labels, to focus on the changes in the cross-regional flow conservation residuals, and to record the relevant data.

[0152] Based on the comparison results, the statistical test rules for flow conservation residuals are updated, and the thresholds and tolerances are adjusted to more accurately label anomalous events.

[0153] Based on the comparison results, the minimum intervention vector of the counterfactual interpreter is adjusted, the strategy selection of the intervention optimizer is optimized, and the efficiency and accuracy of future event handling are improved.

[0154] refer to Figure 2 A smart city security monitoring system includes the following modules:

[0155] The data acquisition and topology construction module is used to collect and process multi-source data to build a city topology map.

[0156] The anomaly detection module is used to calculate node traffic changes, extract cross-regional traffic conservation residuals and perform statistical tests, and mark suspected anomaly events.

[0157] The anomaly interpretation module is used to generate the minimum intervention vector under constraints, calculate the anomaly intensity value, and output the anomaly interpretation result.

[0158] The intervention module is used to select and execute intervention strategies based on the abnormality intensity value and event type, and obtain intervention results;

[0159] The trusted proof module is used to generate an intervention proof package while executing the intervention strategy and synchronize it to the security platform and relevant departments;

[0160] The feedback module is used to compare the intervention results with the true labels of the events, and to continuously update and optimize the statistical test of the cross-regional flow conservation residuals, the generation of the minimum intervention vector, and the selection and execution of intervention strategies.

[0161] Example 1:

[0162] To verify the feasibility of this invention in practice, it was applied to a scenario of anomaly monitoring and intervention driven by multi-source data in a smart city public area. In a specific smart city public area, the city center business district, subway entrance plaza, and entrances to large shopping malls were selected as pilot areas. These locations are characterized by high pedestrian traffic, a high probability of incidents, and are typical. Video cameras, audio collectors, infrared sensors, and environmental monitoring equipment were deployed within the pilot areas to construct a city topology map with wide coverage and clear node relationships. Nodes in the topology map correspond to monitoring points or entrances / exits, and edges correspond to traffic channels or pedestrian channels, accurately reflecting population flow and area interaction. The system first statistically analyzes the input flow, output flow, and inventory changes of each node in each time window, calculating residuals based on the principle of flow conservation. If the residual exceeds the statistical test threshold, it is automatically marked as a suspected anomaly.

[0163] During the evening rush hour on July 12th, the input flow monitoring at the subway entrance plaza was 1520 people / 5 minutes, and the output flow was 1280 people / 5 minutes. According to conventional flow conservation, this should maintain balance, but the actual residual reached 240 people, exceeding the statistical test threshold of 180 people. The system input this anomaly into the counterfactual interpreter, and combined with topological and physical constraints, generated a minimum intervention vector. The interpretation results showed that the residual was mainly caused by the crowd gathering in a specific area and not being dispersed in a timely manner. Further calculation showed an anomaly intensity value of 0.82, higher than the preset threshold of 0.75.

[0164] Upon receiving anomaly intensity values, the intervention optimizer automatically selects the most suitable intervention strategy based on the corresponding event type and available methods. In this scenario, the system prioritizes dispatching drones to patrol the subway entrance plaza and uses camera angle adjustments to manage crowd flow. Intervention results show that after 5 minutes, the anomaly residual decreased to 95 people, and the anomaly intensity value dropped to 0.43, significantly below the threshold. The system generates an intervention proof package containing event fingerprint hashes, intervention timestamps, threshold signatures, and zero-knowledge proofs, and synchronizes it to the security command platform and relevant departments.

[0165] After the intervention was completed, the system compared the intervention results with the actual event labels and found that there was indeed an abnormal gathering of people after the concert. The comparison results were fed back to the system, which continuously updated the statistical test of the cross-regional traffic conservation residuals, the minimum intervention vector of the counterfactual interpreter, and the strategy selection of the intervention optimizer.

[0166] Table 1. Statistical Table of the Effectiveness of Handling Anomaly Events from Multi-Source Data in Urban Public Areas

[0167] time Place Input traffic (number of users / 5 minutes) Output flow (person-times / 5 minutes) Calculate the residuals (person-times). Abnormal intensity value Intervention strategies Post-intervention residuals (per person) Post-intervention intensity value Processing time (minutes) Actual cause of the event July 12, 19:00 subway entrance plaza 1520 1280 240 0.82 Drone patrol + camera adjustment 95 0.43 5 Concert ends July 23, 18:30 Main road of the business district 890 710 180 0.77 Security personnel arrived 70 0.41 7 Promotional activities attract crowds August 05, 20:15 Large shopping mall entrance 1020 800 220 0.81 drone patrol 85 0.39 6 Shopping mall promotional activities August 18, 17:45 subway entrance plaza 1340 1105 235 0.79 Camera angle adjustment 100 0.46 5 Sudden traffic delays cause people to be stranded September 03, 19:20 Main road of the business district 960 740 220 0.83 Security personnel on site + drone patrol 90 0.44 8 Temporary gatherings for festival activities

[0168] As shown in Table 1, in the two events on July 12th and July 23rd, the system accurately captured abnormal flow residuals of 240 and 180 people respectively through real-time monitoring of the difference between input and output flow, and calculated high abnormality intensity values. For typical sudden large-scale crowd events such as concert exits and promotional event gatherings, the system quickly initiated intervention strategies: in the former, combining drone patrols with camera angle adjustments, and in the latter, directly deploying security personnel to the scene, effectively reducing the abnormality intensity values ​​to 0.43 and 0.41 respectively, with response times controlled within 7 minutes. This fully demonstrates the system's real-time and targeted intervention capabilities in complex crowd flow scenarios.

[0169] In the cases of August 5th and August 18th, which occurred at the entrances and exits of large shopping malls and subway plazas respectively, the congestion was characterized by localized crowds due to promotions or traffic delays. When the system detected residuals of 220 and 235 people and anomaly intensity values ​​approaching 0.80, it quickly selected low-cost intervention methods such as drone patrols or camera angle adjustments. After intervention, the residuals decreased to below 100 people, and the anomaly intensity value also decreased to below 0.46. This demonstrates that the system can select appropriate intervention methods based on the characteristics of different scenarios, reducing manpower and resource consumption while ensuring efficiency, showcasing the advantages of intelligent scheduling.

[0170] During a festive event on the main thoroughfare of the commercial district on September 3rd, there were 220 instances of abnormal activity, with an anomaly intensity value reaching 0.83, indicating a high-risk situation. The system promptly employed a joint intervention strategy involving security personnel and drones, resolving the issue in just 8 minutes and reducing the anomaly intensity value to 0.44. This ultimately prevented safety hazards caused by excessive crowd gathering, highlighting the system's robustness and collaborative handling capabilities in scenarios with multiple overlapping factors. This demonstrates the system's ability to achieve rapid response and continuous optimization in different types of abnormal events, thereby significantly improving the intelligence and reliability of public safety management.

[0171] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A security monitoring method for smart cities, characterized in that, include: Video cameras, audio collectors, infrared sensors, and environmental monitoring equipment are deployed in public areas of smart cities to collect multi-source data, process the multi-source data, and construct a city topology map with a node-edge structure. Based on the city topology map and multi-source data, the input flow, output flow and stock change of each node are calculated in each time window to obtain the cross-regional flow conservation residual. Statistical tests are performed, and when the statistical test results exceed the threshold, they are marked as suspected abnormal events. Input the suspected anomaly into the counterfactual interpreter, generate a minimum intervention vector based on physical and topological constraints, calculate the anomaly intensity value, and output the anomaly interpretation result corresponding to the minimum intervention vector; When the abnormal intensity value exceeds the preset threshold, the intervention optimizer is activated. Based on the abnormal intensity value and the corresponding event type, the most suitable intervention strategy is selected from the available intervention methods, and the intervention strategy is executed to obtain the corresponding intervention results. The intervention results include the arrival of security personnel, the deployment of drone patrols, or the adjustment of the angle of surveillance cameras. While implementing the intervention strategy, an intervention proof package is generated, which includes an event fingerprint hash, intervention timestamp, threshold signature, and zero-knowledge proof. The intervention proof package is then synchronized to the security command platform and relevant departments. The intervention results are compared with the corresponding true event labels, and the comparison results are used as data input. The statistical test of cross-regional flow conservation residuals, the generation of minimum intervention vectors for counterfactual interpreters, and the strategy selection and execution of intervention optimizers are continuously updated and optimized in a multi-regional scope.

2. The security monitoring method for smart cities according to claim 1, characterized in that, The multi-source data specifically includes personnel flow data, vehicle operation data, audio signal data, infrared sensing data, and environmental status data.

3. The security monitoring method for smart cities according to claim 1, characterized in that, The processing of multi-source data specifically includes time synchronization, format standardization, noise filtering, and missing value completion. The construction of a node-edge structured urban topology map refers to establishing the connection relationship between each node and forming an urban topology structure, with monitoring points, entrances and exits, and key traffic locations as nodes, and pedestrian paths and vehicle passageways as edges.

4. The security monitoring method for smart cities according to claim 1, characterized in that, The statistical test is performed, and when the statistical test result exceeds a threshold, it is marked as a suspected abnormal event, including: Define the structure of the city topology map and the time window for processing. The city topology map consists of a set of nodes composed of monitoring points, entrances and exits and key traffic locations, and a set of access edges connecting the nodes. The time window is a continuous interval of start and end times. Based on the processed multi-source data, the number of people and vehicles passing through each edge or the equivalent flow are counted within a time window to obtain edge-level flow records. For each node, the input flow of the node is obtained by accumulating the edge-level flow of all incoming edges connected to the node within the time window, and the output flow of the node is obtained by accumulating the edge-level flow of all leaving edges connected to the node. The node stock data at the beginning and end of the time window are counted separately, and the change in the node stock is calculated. For each node, the input flow is subtracted from the output flow and the change in stock is deducted to obtain the cross-regional flow conservation residual of the node, and a residual list is formed in the order of node number. Perform statistical tests on the residual list, calculate the statistical test value for the corresponding time window and compare it with a preset threshold. When the statistical test value reaches or exceeds the preset threshold, output a suspected abnormal event record.

5. A security monitoring method for smart cities according to claim 1, characterized in that, The calculation of the anomaly intensity value outputs the anomaly interpretation result corresponding to the minimum intervention vector, including: Determine the processing time window, obtain multi-source data and urban topology map, and read the residual list and statistical test values ​​to form an input set of suspected abnormal events; The search space and constraints of the counterfactual interpreter are set. The constraints include physical constraints and topological constraints. The physical constraints limit the upper limit of speed, the consistency of illumination and the order of occlusion. The topological constraints limit the connectivity, the direction of travel and the area boundaries in the city topology map. Under constraints, perform a counterfactual search for each suspected anomalous event to obtain the minimum intervention vector that makes the suspected anomalous event normal within the time window. Record the composition of the minimum intervention vector, including: Object-level adjustment amount is defined as the number of objects that need to be removed or added. Cross-node traffic correction is defined as the percentage increase or decrease in traffic between adjacent nodes; Perception resource adjustment parameters are defined as adjustment values ​​for camera viewpoint, focal length, coverage area, or drone patrol trajectory. Based on the amplitude information of the recorded minimum intervention vector and combined with statistical test values, a single value is synthesized according to preset weights as the anomaly intensity value. The anomaly intensity value is then compared with a preset threshold to form a severity level, generating an anomaly interpretation result and binding it to the corresponding suspected anomaly event.

6. A security monitoring method for smart cities according to claim 5, characterized in that, The counterfactual interpreter includes: Scene encoding subunit: Encodes multi-source data and urban topology map to generate scene representation. The scene encoding subunit uses graph attention network combined with multimodal feature splicing algorithm to extract features and perform structured modeling of multi-source data and urban topology map. Counterfact generation subunit: Generates counterfact candidates that satisfy physical and topological constraints based on scene representation. The counterfact generation subunit adopts a conditional diffusion generation network and combines differentiable rendering constraints to ensure lighting consistency, occlusion relationship and geometric continuity. Minimal intervention solution subunit: The minimum intervention vector is obtained from the counterfactual candidates and the corresponding anomaly interpretation result and anomaly intensity value are output. The minimum intervention solution subunit is solved by the alternating direction multiplier method under physical constraints and topological constraints.

7. A security monitoring method for smart cities according to claim 1, characterized in that, When the abnormal intensity value exceeds a preset threshold, the intervention optimizer is activated. Based on the abnormal intensity value and the corresponding event type, the most suitable intervention strategy is selected from the available intervention methods, and the intervention strategy is executed to obtain the corresponding intervention result, including: Read the anomaly intensity value, event type, and anomaly interpretation results; statistically analyze the test values ​​and the set of nodes involved in suspected anomalies; and simultaneously obtain the city topology map. List available intervention methods and form an intervention candidate set, including security personnel dispatch, drone patrol and surveillance camera linkage, and generate a resource and time constraint list. Based on the anomaly intensity value, event type, and anomaly interpretation results, and in conjunction with the resource and time constraint list, the risk reduction effect, expected response delay, resource consumption, and coverage matching degree of each candidate intervention measure are evaluated according to the preset decision rules, and a ranked candidate list is generated. Select the target intervention strategy that ranks highest under the constraints from the candidate list and generate the corresponding set of execution parameters; Instructions are issued and executed according to the determined target intervention strategy and set of execution parameters. The start and end timestamps of the execution, the set of nodes covered or affected, the failure and retry situation during the execution process, and the on-site feedback information are recorded to obtain the intervention results. The intervention results and related execution information are archived as an intervention result summary.

8. A security monitoring method for smart cities according to claim 7, characterized in that, The intervention optimizer includes: Priority and Rule Engine: It adopts a method based on multi-level rule matching and hierarchical weighted sorting. It performs multi-level matching of candidate intervention methods through the rule base to form a candidate set under rule constraints. It calculates weighted scores according to anomaly intensity, event urgency and resource consumption. It performs hierarchical sorting by combining rule matching results and weighted scores, and outputs a candidate list with priority. Constraint Selection Engine: Under resource and time constraints, selects the target intervention strategy and execution parameter set from the candidate list. When the available computing time meets the exact solution conditions, integer linear programming is used to determine the target intervention strategy and execution parameters. When the time budget is limited, a greedy approximation based on submodular functions is used to generate the intervention action sequence and corresponding execution parameters. Execution Interface: Issues instructions to security personnel, drones, and surveillance cameras according to the target intervention strategy and execution parameter set, and collects start and end timestamps, affected node set, instruction receipt number, and failure retry record to form an intervention result summary.

9. A security monitoring method for smart cities according to claim 1, characterized in that, The process of generating an intervention proof package while executing the intervention strategy includes: Based on the intervention result summary, anomaly intensity value and anomaly interpretation results, time window identifier and node set, and city topology map, event time anchors and topology anchors are generated; The residual list is compressed and encoded to generate a consistency commitment summary, while the anomaly interpretation results are structured and discretized to form an interpretation binding summary; The target intervention strategy and execution parameters are ordered and serialized to generate action sequence fingerprints, which are then linked with event time anchors and topological anchors to form a disposal link index. Call the execution interface of the intervention optimizer, collect instruction receipt number and authorized entity identifier, trigger cross-department dual-domain witness signing process, complete threshold signing in the command domain and the local domain respectively and aggregate them into a joint witness signature, generate a lightweight witness token and record the supplementary signing time limit when the complete signing conditions cannot be met; Selective disclosure proof data is generated for three indicators: response time, resource consumption, and coverage. The selective disclosure proof data proves that the three indicators meet preset constraints without exposing plaintext parameters, and is bound to the consistency commitment summary and the explanation binding summary. The event time anchor, topological anchor, consistency commitment summary, explanation binding summary, action sequence fingerprint, joint witness signature, and selective disclosure proof data are assembled into an intervention proof package and archived.

10. A security monitoring system for smart cities, used to implement the security monitoring method for smart cities as described in any one of claims 1 to 9, characterized in that, Includes the following modules: The data acquisition and topology construction module is used to collect and process multi-source data to build a city topology map. The anomaly detection module is used to calculate node traffic changes, extract cross-regional traffic conservation residuals and perform statistical tests, and mark suspected anomaly events. The anomaly interpretation module is used to generate the minimum intervention vector under constraints, calculate the anomaly intensity value, and output the anomaly interpretation result. The intervention module is used to select and execute intervention strategies based on the abnormality intensity value and event type, and obtain intervention results; The trusted proof module is used to generate an intervention proof package while executing the intervention strategy and synchronize it to the security platform and relevant departments; The feedback module is used to compare the intervention results with the true labels of the events, and to continuously update and optimize the statistical test of the cross-regional flow conservation residuals, the generation of the minimum intervention vector, and the selection and execution of intervention strategies.

Images