Abnormal behavior detection method, device and equipment for bank security and protection and medium

Abstract

The invention discloses a bank security abnormal behavior detection method and device, equipment and a medium, and relates to the field of machine learning, and the method comprises the steps: carrying out the preprocessing of a current original image in a monitoring video of a bank security scene, and obtaining a current target image; processing the current target image by using a feature extractor of the target image classification model to obtain an initial activation value; if the initial activation value is not smaller than the first preset threshold value, correcting the initial activation value to a preset activation value interval by using a Butterworth filter to obtain a target activation value; if the initial activation value is smaller than the first preset threshold value, determining the initial activation value as a target activation value; inputting the target activation value into a classifier of the target image classification model to output an abnormal behavior detection result; the abnormal behavior detection result represents that the operation behavior corresponding to the current target image belongs to or does not belong to the abnormal behavior in the bank security scene. And the accuracy of abnormal behavior detection of bank security and protection is improved.

Description

Technical Field

[0001] This invention relates to the field of machine learning, and in particular to methods, devices, equipment and media for detecting abnormal behavior in bank security. Background Technology

[0002] Out-of-distribution detection technology is an important research topic in the field of machine learning, aiming to identify anomaly categories not covered by the training set. It has important applications in bank ATM (Automated Teller Machine) and branch monitoring systems. It can accurately distinguish between in-distribution and out-of-distribution data, helping banks to detect abnormal behavior and warn of security risks in a timely manner. When the model detects out-of-distribution data, the system will immediately trigger an alarm (such as pushing real-time images to the security center or activating on-site audio and visual alarms) to shorten risk response time and reduce the incidence of serious incidents such as theft and robbery.

[0003] Machine learning models are used to monitor abnormal behavior images in real time within bank surveillance systems. However, excessive activation within the model can negatively impact out-of-distribution detection, causing the model to overconfidently predict out-of-distribution data as in-distribution data, resulting in low accuracy in abnormal behavior detection for bank security. While current out-of-distribution detection algorithms have identified abnormally high activation as the root cause of overconfident predictions of out-of-distribution samples, and typically attempt to widen the difference between in-distribution and out-of-distribution data by directly truncating or filtering out abnormally high activation, directly truncating excessively high activation leads to undercorrection, leaving a large amount of high activation remaining and causing many out-of-distribution data to still be misclassified as in-distribution data. Using low-pass filters to filter out excessively high activation can easily lead to overcorrection, causing the value of excessively high activation to drop directly to 0, resulting in the model incorrectly predicting in-distribution data as out-of-distribution data.

[0004] In conclusion, improving the accuracy of abnormal behavior detection in bank security is a problem that needs to be solved in this field. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a method, apparatus, equipment, and medium for detecting abnormal behavior in bank security systems, thereby improving the accuracy of abnormal behavior detection in bank security systems. The specific solution is as follows:

[0006] Firstly, this application discloses a method for detecting abnormal behavior in bank security systems, including:

[0007] Preprocess the original image in the surveillance video of the bank security scene to obtain the current target image;

[0008] The current target image is processed using the feature extractor of the target image classification model to obtain initial activation values;

[0009] If the initial activation value is not less than the first preset threshold, the initial activation value is corrected to the preset activation value range using a Butterworth filter to obtain the target activation value.

[0010] If the initial activation value is less than the first preset threshold, then the initial activation value is determined as the target activation value;

[0011] The target activation value is input into the classifier of the target image classification model to output the abnormal behavior detection result; wherein, the abnormal behavior detection result indicates that the operation behavior corresponding to the current target image belongs to the abnormal behavior in the bank security scene or that the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scene.

[0012] Optionally, before processing the current target image using the feature extractor of the target image classification model to obtain the initial activation value, the method further includes:

[0013] Training and testing sets are constructed using historical images from surveillance videos of bank security scenarios. The training set contains in-distribution data, and the testing set contains both in-distribution and out-of-distribution data. The in-distribution data corresponds to various compliant behaviors in the bank security scenario, and the out-of-distribution data corresponds to various abnormal behaviors in the bank security scenario.

[0014] Construct an initial image classification model with a ResNet50 architecture; wherein the initial image classification model includes a feature extractor and a classifier;

[0015] The initial image classification model is trained using the training set to obtain the trained image classification model;

[0016] The trained image classification model is evaluated using the test set. If the evaluation results indicate that the trained image classification model meets the preset stopping conditions, then the trained image classification model is determined as the target image classification model.

[0017] Optionally, training the initial image classification model using the training set to obtain a trained image classification model includes:

[0018] The training set is then standardized in size to obtain a standardized training set;

[0019] The standardized training set is subjected to data augmentation processing to obtain an augmented training set;

[0020] The initial image classification model is trained using the enhanced training set to obtain the trained image classification model.

[0021] Optionally, performing data augmentation on the standardized training set to obtain an augmented training set includes:

[0022] The rotation angle range is determined based on the installation angle deviation of the surveillance camera in the bank security scenario and the shaking angle during shooting. Then, each historical image in the standardized training set is randomly rotated based on the rotation angle range to obtain the first processed training set.

[0023] According to a preset pixel size, each sub-image is randomly extracted from each historical image in the standardized training set to obtain a second processed training set containing each of the sub-images;

[0024] Based on the brightness changes of the monitoring screen in the bank security scene under different lighting conditions, the brightness range and contrast interval are determined, and the brightness of each historical image in the standardized training set is randomly adjusted and the contrast is randomly scaled according to the brightness range and the contrast interval to obtain the third processed training set.

[0025] The first processed training set, the second processed training set, and the third processed training set are determined as the augmented training set.

[0026] Optionally, the correction formula for the Butterworth filter is:

[0027] ;

[0028] in, The target activation value, The first preset threshold, The second preset threshold is defined as the preset activation value range, which is not less than the second preset threshold and not greater than the first preset threshold. z is the initial activation value, and N is the order of the Butterworth filter.

[0029] Optionally, the step of inputting the target activation value into the classifier of the target image classification model to output the abnormal behavior detection result includes:

[0030] The target activation value is input into the classifier of the target image classification model to determine the maximum softmax probability based on the target activation value, and the abnormal behavior detection result is output according to the maximum softmax probability.

[0031] Optionally, the step of outputting the abnormal behavior detection result based on the maximum Softmax probability includes:

[0032] If the maximum Softmax probability is not less than the preset probability threshold, then the abnormal behavior detection result is output, indicating that the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scene.

[0033] If the maximum Softmax probability is less than a preset probability threshold, then an abnormal behavior detection result is output, indicating that the operation behavior corresponding to the current target image belongs to an abnormal behavior in a bank security scenario.

[0034] Secondly, this application discloses an abnormal behavior detection device for bank security, comprising:

[0035] The image preprocessing module is used to preprocess the current raw image in the surveillance video of the bank security scene to obtain the current target image;

[0036] The initial activation value output module is used to process the current target image using the feature extractor of the target image classification model to obtain the initial activation value;

[0037] An activation value correction module is used to correct the initial activation value to a preset activation value range using a Butterworth filter if the initial activation value is not less than a first preset threshold, so as to obtain a target activation value.

[0038] An activation value determination module is used to determine the initial activation value as the target activation value if the initial activation value is less than a first preset threshold.

[0039] The behavior result output module is used to input the target activation value into the classifier of the target image classification model to output the abnormal behavior detection result; wherein, the abnormal behavior detection result indicates that the operation behavior corresponding to the current target image belongs to the abnormal behavior in the bank security scenario or the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scenario.

[0040] Thirdly, this application discloses an electronic device, including:

[0041] Memory, used to store computer programs;

[0042] A processor is used to execute the computer program to implement the steps of the aforementioned disclosed method for detecting abnormal behavior in bank security.

[0043] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the aforementioned disclosed method for detecting abnormal behavior in bank security.

[0044] The beneficial effects of this application are as follows: This application preprocesses the current original image in the surveillance video of a bank security scene to obtain a current target image; it processes the current target image using the feature extractor of a target image classification model to obtain an initial activation value; if the initial activation value is not less than a first preset threshold, it uses a Butterworth filter to correct the initial activation value to a preset activation value range to obtain a target activation value; if the initial activation value is less than the first preset threshold, it determines the initial activation value as the target activation value; it inputs the target activation value into the classifier of the target image classification model to output an abnormal behavior detection result; wherein, the abnormal behavior detection result indicates that the operation behavior corresponding to the current target image belongs to an abnormal behavior in the bank security scene or that the operation behavior corresponding to the current target image does not belong to an abnormal behavior in the bank security scene. Therefore, this application preprocesses the original image in the bank security scene monitoring video to obtain the current target image, which can make the image meet the input specifications of the target image classification model. The feature extractor of the target image classification model processes the current target image to obtain initial activation values, providing basic feature data for subsequent activation value correction and abnormal behavior judgment. The initial activation value is obtained by comparing it with a first preset threshold and processing different cases. Only initial activation values ​​not less than the first preset threshold (i.e., over-activation) are corrected to a preset activation value range using a Butterworth filter. Initial activation values ​​less than the first preset threshold are directly retained, avoiding ineffective intervention on normal activation values. Simultaneously, the preset activation value range prevents under-correction or over-correction during the over-activation correction process, constraining the target activation value to a reasonable range to accurately reflect image features. The target activation value is input into the classifier of the target image classification model, which outputs abnormal behavior detection results. Based on accurate activation value features, it can determine whether the operation behavior corresponding to the current target image belongs to abnormal behavior in the bank security scene, thus providing a reliable basis for abnormal behavior identification in bank security scenes and helping banks to promptly identify abnormal situations in monitoring. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0046] Figure 1 This application discloses a flowchart of an abnormal behavior detection method for bank security.

[0047] Figure 2 This is a schematic diagram of the structure of an abnormal behavior detection device for bank security disclosed in this application;

[0048] Figure 3 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0050] Out-of-distribution detection technology is an important research topic in the field of machine learning. It aims to identify anomaly categories not covered by the training set and has important application significance in bank ATM and branch monitoring systems. It can accurately distinguish between in-distribution and out-of-distribution data, helping banks to detect abnormal behavior and warn of security risks in a timely manner. When the model detects out-of-distribution data, the system will immediately trigger an alarm (such as pushing real-time images to the security center and activating on-site audio and visual alarms) to shorten risk response time and reduce the incidence of serious incidents such as theft and robbery.

[0051] Machine learning models are used to monitor abnormal behavior images in real time within bank surveillance systems. However, excessive activation within the model can negatively impact out-of-distribution detection, causing the model to overconfidently predict out-of-distribution data as in-distribution data, resulting in low accuracy in abnormal behavior detection for bank security. While current out-of-distribution detection algorithms have identified abnormally high activation as the root cause of overconfident predictions of out-of-distribution samples, and typically attempt to widen the difference between in-distribution and out-of-distribution data by directly truncating or filtering out abnormally high activation, directly truncating excessively high activation leads to undercorrection, leaving a large amount of high activation remaining and causing many out-of-distribution data to still be misclassified as in-distribution data. Using low-pass filters to filter out excessively high activation can easily lead to overcorrection, causing the value of excessively high activation to drop directly to 0, resulting in the model incorrectly predicting in-distribution data as out-of-distribution data.

[0052] Therefore, this application provides a solution for detecting abnormal behavior in bank security systems, thereby improving the accuracy of such detection.

[0053] See Figure 1 As shown in the figure, this application discloses an abnormal behavior detection method for bank security, including:

[0054] Step S11: Preprocess the current original image in the surveillance video of the bank security scene to obtain the current target image.

[0055] First, the current raw image from the surveillance video in the bank security scenario is acquired. This raw image can be the current frame or multiple frames within a preset time period. Second, noise reduction, grayscale normalization, and size standardization preprocessing operations are performed on the raw image to filter out invalid information introduced by light interference, equipment noise, and image distortion, thus obtaining the current target image that meets the input requirements of the target image classification model. This preprocessing step can improve the accuracy and efficiency of subsequent feature extraction, reduce the interference of invalid information on activation value calculation, and lay a high-quality data foundation for the accuracy of abnormal behavior detection in the bank security scenario.

[0056] Step S12: Process the current target image using the feature extractor of the target image classification model to obtain the initial activation value.

[0057] The feature extractor F of a target image classification model with a ResNet50 architecture is used to perform deep feature mining on the preprocessed target image to obtain initial activation values ​​that can quantitatively characterize the image behavior features in a bank security scenario. The deep network structure based on the ResNet50 feature extractor can effectively capture the subtle features of abnormal behavior in bank security scenarios. The output initial activation value can accurately map the behavioral feature differences of the image, providing reliable data support for the threshold screening and correction of subsequent activation values, and improving the feature discrimination of abnormal behavior detection.

[0058] In this embodiment, before processing the current target image using the feature extractor of the target image classification model to obtain the initial activation value, the method further includes: constructing a training set and a test set using historical images from surveillance videos of a bank security scenario; wherein the training set contains in-distribution data, and the test set contains both in-distribution and out-of-distribution data, the in-distribution data corresponding to various compliant behaviors in the bank security scenario, and the out-of-distribution data corresponding to various abnormal behaviors in the bank security scenario; constructing an initial image classification model with a ResNet50 structure; wherein the initial image classification model includes a feature extractor and a classifier; training the initial image classification model using the training set to obtain a trained image classification model; and evaluating the performance of the trained image classification model using the test set. If the evaluation result indicates that the trained image classification model meets a preset stopping training condition, then the trained image classification model is determined as the target image classification model.

[0059] This method utilizes surveillance videos from ATMs and branch network cameras to collect data on bank security scenarios. A training set containing in-distribution data of corresponding compliant behaviors and a test set containing in-distribution data of corresponding compliant behaviors and out-of-distribution data of corresponding abnormal behaviors are constructed using historical images from these videos. An initial image classification model with a ResNet50 architecture, including a feature extractor and a classifier, is then built. This initial model is trained using the training set to obtain a trained image classification model. The performance of the trained model is then evaluated using the test set. If the evaluation results meet a preset stopping condition, it is designated as the target image classification model. This model construction and training process is specifically adapted to the behavioral characteristics of bank security scenarios. Through collaborative training and testing with in-distribution and out-of-distribution data, the model's ability to distinguish between compliant and abnormal behaviors in bank security scenarios is improved. The ResNet50-based model structure effectively extracts deep image features, reduces the risk of overfitting, and ensures the accuracy and stability of the target image classification model in detecting abnormal behaviors in bank security scenarios.

[0060] The data in the distribution specifically includes ten categories of compliant operations, with 20,000 images in each category. Of these, 15,000 images are included in the training set and the remaining 5,000 images are included in the test set. Specifically, the images are: (1) A customer inserts their card normally in front of an ATM; (2) A customer enters their password normally in front of an ATM; (3) A customer withdraws cash from an ATM and checks the amount; (4) Bank staff handle deposit and withdrawal transactions for customers at the counter; (5) Staff replenish cash in an ATM; (6) A customer queues in the waiting area to handle transactions; (7) An empty ATM room or branch lobby; (8) A customer submits documents and receipts at the counter; (9) Staff guide customers to operate an ATM; (10) Cleaning staff clean the branch normally.

[0061] The data outside the distribution specifically includes ten types of abnormal behavior operations, namely: (1) masked people use tools to damage the ATM machine shell; (2) multiple people surround customers in front of the ATM machine, suspected of coercing them to transfer money; (3) someone sticks foreign objects to block the passage of the ATM machine cash dispensing slot; (4) non-staff members attempt to disassemble the surveillance camera; (5) someone posts a fake transfer QR code next to the ATM machine screen; (6) people carrying controlled knives enter the business outlet; (7) someone posts a fake notice in the blind spot of the surveillance system saying "System upgrade, please transfer money to the designated account"; (8) non-maintenance personnel open the side cover or back door of the ATM machine without authorization; (9) multiple people gather in front of the counter and have a fierce argument with the staff; (10) customers linger in front of the ATM machine for a long time and behave strangely, such as repeatedly covering their faces.

[0062] In this embodiment, training the initial image classification model using the training set to obtain a trained image classification model includes: standardizing the size of the training set to obtain a standardized training set; performing data augmentation on the standardized training set to obtain an augmented training set; and training the initial image classification model using the augmented training set to obtain a trained image classification model.

[0063] The training set is standardized to fit the input specifications of the ResNet50 model. For example, all images are uniformly cropped or scaled to a fixed size of 224×224 to ensure that the image specifications input to ResNet50 are consistent. Data augmentation is then performed on the standardized training set to obtain an augmented training set. The initial image classification model is then trained using the augmented training set to obtain a trained image classification model. This step unifies the input format of training data through size standardization, eliminates feature extraction bias caused by differences in image size, expands the diversity of training data through data augmentation, improves the model's generalization ability to behavioral features under different angles and lighting conditions in bank security scenarios, reduces the risk of model overfitting, and ensures the stability and accuracy of subsequent abnormal behavior detection.

[0064] In this real-time example, the data augmentation processing of the standardized training set to obtain an augmented training set includes: determining a rotation angle range based on the installation angle deviation and shaking angle of the surveillance camera in the bank security scene, and randomly rotating each historical image in the standardized training set based on the rotation angle range to obtain a first processed training set; randomly cropping each sub-image from each historical image in the standardized training set according to a preset pixel size to obtain a second processed training set containing each sub-image; determining a brightness range and contrast interval based on the brightness changes of the surveillance screen in the bank security scene under different lighting conditions, and randomly adjusting the brightness and randomly scaling the contrast of each historical image in the standardized training set according to the brightness range and the contrast interval to obtain a third processed training set; and determining the first processed training set, the second processed training set, and the third processed training set as the augmented training set.

[0065] Based on the installation angle deviation and camera shake angle of the surveillance camera in the bank security scenario, a rotation angle range is determined. Then, based on this rotation angle range, each historical image in the standardized training set is randomly rotated to obtain a first processed training set. For example, the training set images are randomly rotated within a range of ±45° to simulate image tilt caused by installation angle deviation or slight shaking during shooting, improving the model's robustness to different angle scenarios. Next, sub-images are randomly cropped from each historical image in the standardized training set according to a preset pixel size to obtain a second processed training set containing these sub-images. For example, a 224×224 region is randomly cropped from the original image (the image size can be appropriately enlarged before cropping to retain more information), simulating the randomness of target positions in the surveillance footage (such as customer positioning shifts in front of ATMs or personnel movement within the branch). Finally, based on the brightness changes of the surveillance footage in the bank security scenario under different lighting conditions, a brightness range and contrast interval are determined. Based on these brightness ranges and contrast intervals, the brightness of each historical image in the standardized training set is randomly adjusted and the contrast is randomly scaled to obtain a third processed training set. For example, the image brightness is adjusted... Random adjustments within a certain range are made, while the contrast is randomly scaled between 0.9 and 1.1 times to simulate image changes under different lighting conditions in a monitoring scenario. The first, second, and third processed training sets are determined as the augmented training sets. This data augmentation process is specifically matched to the actual monitoring conditions of bank security scenarios. It simulates image angle changes caused by camera installation deviations and shaking by randomly rotating the camera, simulates the focusing requirements of local features in the monitoring image by randomly cropping the image, and simulates the differences in monitoring images under different lighting conditions at different times by adjusting brightness and contrast. This effectively expands the scene coverage dimension of the training data, improves the model's adaptability and generalization ability to complex conditions in bank security scenarios, reduces the model overfitting problem caused by a single scene, and ensures the stability and accuracy of abnormal behavior detection results.

[0066] Step S13: If the initial activation value is not less than the first preset threshold, the initial activation value is corrected to the preset activation value range using a Butterworth filter to obtain the target activation value.

[0067] If the initial activation value is not less than the first preset threshold, the Butterworth filter is used to correct the initial activation value to the preset activation value range to obtain the target activation value. This step uses the Butterworth filter to smooth the excessively high initial activation value, which can avoid the overactivation of local features caused by interference factors such as reflective counters and flashing electronic screens in bank security scenarios. It limits the activation value to a reasonable range, ensures the effectiveness of the activation value in representing behavioral features, reduces the probability of false positives in abnormal behavior detection, and improves the accuracy of detection results.

[0068] Two independent hyperparameters are set based on the activation percentile of the data within the distribution, with the first preset threshold. Second preset threshold , Greater than , It is the dividing line between normal activation and hyperactivation, used to define hyperactivation. This serves as a lower bound for correcting overactivation, preventing overcorrection. Precise control of the correction intensity is crucial when correcting overactivation. Insufficient correction will leave a large amount of overactivation in the model, failing to effectively address the model's overconfidence when dealing with out-of-distribution data. Conversely, excessive correction will over-suppress activation in-distribution data, causing the model to misclassify in-distribution data as out-of-distribution data.

[0069] In this embodiment, the correction formula for the Butterworth filter is:

[0070] ;

[0071] in, The target activation value, The first preset threshold, The second preset threshold is defined as the preset activation value range, which is not less than the second preset threshold and not greater than the first preset threshold. z is the initial activation value, and N is the order of the Butterworth filter.

[0072] The larger N is, the steeper the transition band between normal activation and overactivation. A constrained Butterworth filter can rapidly decay overactivation to […]. , Within this normal range, the purpose of this method is to reduce the model's confidence in out-of-distribution data while increasing the model's confidence in in-distribution data.

[0073] Step S14: If the initial activation value is less than the first preset threshold, then the initial activation value is determined as the target activation value.

[0074] If the initial activation value is less than the first preset threshold, the initial activation value is determined as the target activation value. The original data of the low activation value feature is directly used, which can retain the weak feature information of abnormal behavior in the bank security scenario, avoid destroying the integrity of effective features due to indiscriminate correction operations, reduce unnecessary calculation operations, improve the overall efficiency of abnormal behavior detection, and ensure the model's ability to identify low-discrimination abnormal behavior.

[0075] If the initial activation value is not less than the first preset threshold, the Butterworth filter is used to correct the initial activation value to the preset activation value range to obtain the target activation value; if the initial activation value is less than the first preset threshold, the initial activation value is determined as the target activation value, as shown in the HAct function:

[0076] ;

[0077] In the formula, This represents the activation value after correction using a Butterworth filter, where z represents the initial activation value. This represents the target activation value. In other words, if the initial activation value is not less than the first preset threshold, the activation value after being corrected by the Butterworth filter will be determined as the target activation value; otherwise, the initial activation value will be determined as the target activation value.

[0078] In this embodiment, HAct designs a constrained low-pass filter for correction. This filter can achieve gentle convergence for excessively high activation, which can avoid under-correction leading to missed detection of out-of-distribution risks, such as failing to identify abnormal behavior such as blocking the ATM cash dispenser, and also prevent over-correction leading to misjudgment of normal scenarios, such as misjudging a customer's normal withdrawal as abnormal. Thus, in the context of bank security protection, the boundary between normal operation and risky behavior can be defined more accurately.

[0079] Step S15: Input the target activation value into the classifier of the target image classification model to output the abnormal behavior detection result; wherein, the abnormal behavior detection result indicates that the operation behavior corresponding to the current target image belongs to the abnormal behavior in the bank security scene or the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scene.

[0080] In this embodiment, the step of inputting the target activation value into the classifier of the target image classification model to output the abnormal behavior detection result includes: inputting the target activation value into the classifier of the target image classification model to determine the maximum softmax probability based on the target activation value, and outputting the abnormal behavior detection result according to the maximum softmax probability.

[0081] The target activation value is input into the classifier C of the target image classification model to determine the maximum Softmax probability based on the target activation value. The specific formula is as follows:

[0082] ;

[0083] In the formula, This represents the maximum Softmax probability, i.e., the MSP score. The abnormal behavior detection result is output based on the maximum Softmax probability. This step uses the calculation of Softmax probability to realize the quantitative classification and judgment of the target activation value, which can accurately distinguish the feature probability distribution corresponding to compliant behavior and abnormal behavior in bank security scenarios. The selection of the maximum Softmax probability can improve the confidence of the classification result, reduce the classification ambiguity caused by feature fuzziness, and ensure the accuracy and reliability of the abnormal behavior detection result.

[0084] In this embodiment, the step of outputting the abnormal behavior detection result based on the maximum Softmax probability includes: if the maximum Softmax probability is not less than a preset probability threshold, then outputting an abnormal behavior detection result indicating that the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scenario; if the maximum Softmax probability is less than the preset probability threshold, then outputting an abnormal behavior detection result indicating that the operation behavior corresponding to the current target image belongs to the abnormal behavior in the bank security scenario.

[0085] If the maximum Softmax probability is not less than the preset probability threshold, the output is an abnormal behavior detection result indicating that the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scene. If the maximum Softmax probability is less than the preset probability threshold, the output is an abnormal behavior detection result indicating that the operation behavior corresponding to the current target image belongs to the abnormal behavior in the bank security scene, as shown below:

[0086] ;

[0087] In the formula, This indicates the result of abnormal behavior detection. This indicates a preset probability threshold.

[0088] In other words, if the maximum Softmax probability is not less than the preset probability threshold, the output abnormal behavior detection result is 1, which means that the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scene; if the maximum Softmax probability is less than the preset probability threshold, the output abnormal behavior detection result is 0, which means that the operation behavior corresponding to the current target image belongs to the abnormal behavior in the bank security scene.

[0089] By using a preset probability threshold to perform a binary judgment on the maximum Softmax probability, a clear judgment rule for abnormal behavior detection in bank security scenarios is constructed. This rule can accurately delineate the probability boundaries between compliant and abnormal behaviors, avoid classification bias caused by ambiguous probability intervals, and improve the certainty and consistency of abnormal behavior detection results. At the same time, the judgment logic is simple and efficient, and can meet the real-time detection needs of bank security scenarios.

[0090] The beneficial effects of this application are as follows: This application preprocesses the current original image in the surveillance video of a bank security scene to obtain a current target image; it processes the current target image using the feature extractor of a target image classification model to obtain an initial activation value; if the initial activation value is not less than a first preset threshold, it uses a Butterworth filter to correct the initial activation value to a preset activation value range to obtain a target activation value; if the initial activation value is less than the first preset threshold, it determines the initial activation value as the target activation value; it inputs the target activation value into the classifier of the target image classification model to output an abnormal behavior detection result; wherein, the abnormal behavior detection result indicates that the operation behavior corresponding to the current target image belongs to an abnormal behavior in the bank security scene or that the operation behavior corresponding to the current target image does not belong to an abnormal behavior in the bank security scene. Therefore, this application preprocesses the original image in the bank security scene monitoring video to obtain the current target image, which can make the image meet the input specifications of the target image classification model. The feature extractor of the target image classification model processes the current target image to obtain initial activation values, providing basic feature data for subsequent activation value correction and abnormal behavior judgment. The initial activation value is obtained by comparing it with a first preset threshold and processing different cases. Only initial activation values ​​not less than the first preset threshold (i.e., over-activation) are corrected to a preset activation value range using a Butterworth filter. Initial activation values ​​less than the first preset threshold are directly retained, avoiding ineffective intervention on normal activation values. Simultaneously, the preset activation value range prevents under-correction or over-correction during the over-activation correction process, constraining the target activation value to a reasonable range to accurately reflect image features. The target activation value is input into the classifier of the target image classification model, which outputs abnormal behavior detection results. Based on accurate activation value features, it can determine whether the operation behavior corresponding to the current target image belongs to abnormal behavior in the bank security scene, thus providing a reliable basis for abnormal behavior identification in bank security scenes and helping banks to promptly identify abnormal situations in monitoring.

[0091] See Figure 2 As shown in the figure, this application discloses an abnormal behavior detection device for bank security, including:

[0092] Image preprocessing module 11 is used to preprocess the current original image in the surveillance video of the bank security scene to obtain the current target image;

[0093] The initial activation value output module 12 is used to process the current target image using the feature extractor of the target image classification model to obtain the initial activation value;

[0094] The activation value correction module 13 is used to correct the initial activation value to a preset activation value range using a Butterworth filter if the initial activation value is not less than a first preset threshold, so as to obtain a target activation value.

[0095] The activation value determination module 14 is used to determine the initial activation value as the target activation value if the initial activation value is less than a first preset threshold.

[0096] The behavior result output module 15 is used to input the target activation value into the classifier of the target image classification model to output the abnormal behavior detection result; wherein, the abnormal behavior detection result indicates that the operation behavior corresponding to the current target image belongs to the abnormal behavior in the bank security scene or the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scene.

[0097] Furthermore, embodiments of this application also provide an electronic device. Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0098] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Specifically, it may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the abnormal behavior detection method for bank security performed by the electronic device disclosed in any of the foregoing embodiments.

[0099] In this embodiment, the power supply 23 is used to provide operating voltage for various hardware devices on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0100] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0101] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored on it include operating system 221, computer program 222 and data 223, etc., and the storage method can be temporary storage or permanent storage.

[0102] The operating system 221 manages and controls the various hardware devices and computer programs 222 on the electronic device to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system can be Windows, Unix, Linux, etc. The computer program 222, in addition to including a computer program capable of performing the abnormal behavior detection method for bank security executed by the electronic device as disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 223 may include data received by the electronic device from external devices, as well as data collected by its own input / output interface 25.

[0103] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned abnormal behavior detection method for bank security. The specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0104] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0105] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly in hardware, software modules executed by a processor, or a combination of both. The software module may be located in random access memory (RAM), memory, read-only memory (ROM), electrically programmable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), register, hard disk, removable disk, CD-ROM (Compact Disc Read-Only Memory), or any other form of storage medium known in the art.

[0106] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0107] The above provides a detailed description of the abnormal behavior detection method, device, equipment, and medium for bank security provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only intended to help understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for detecting abnormal behavior in bank security, characterized in that, include: Preprocess the original image in the surveillance video of the bank security scene to obtain the current target image; The current target image is processed using the feature extractor of the target image classification model to obtain initial activation values; If the initial activation value is not less than the first preset threshold, the initial activation value is corrected to the preset activation value range using a Butterworth filter to obtain the target activation value. If the initial activation value is less than the first preset threshold, then the initial activation value is determined as the target activation value; The target activation value is input into the classifier of the target image classification model to output the abnormal behavior detection result; wherein, the abnormal behavior detection result indicates that the operation behavior corresponding to the current target image belongs to the abnormal behavior in the bank security scene or that the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scene.

2. The abnormal behavior detection method for bank security according to claim 1, characterized in that, Before processing the current target image using the feature extractor of the target image classification model to obtain the initial activation value, the method further includes: Training and testing sets are constructed using historical images from surveillance videos of bank security scenarios. The training set contains in-distribution data, and the testing set contains both in-distribution and out-of-distribution data. The in-distribution data corresponds to various compliant behaviors in the bank security scenario, and the out-of-distribution data corresponds to various abnormal behaviors in the bank security scenario. Construct an initial image classification model with a ResNet50 architecture; wherein the initial image classification model includes a feature extractor and a classifier; The initial image classification model is trained using the training set to obtain the trained image classification model; The trained image classification model is evaluated using the test set. If the evaluation results indicate that the trained image classification model meets the preset stopping conditions, then the trained image classification model is determined as the target image classification model.

3. The abnormal behavior detection method for bank security according to claim 2, characterized in that, The step of training the initial image classification model using the training set to obtain the trained image classification model includes: The training set is then standardized in size to obtain a standardized training set; The standardized training set is subjected to data augmentation processing to obtain an augmented training set; The initial image classification model is trained using the enhanced training set to obtain the trained image classification model.

4. The abnormal behavior detection method for bank security according to claim 3, characterized in that, The process of performing data augmentation on the standardized training set to obtain an augmented training set includes: The rotation angle range is determined based on the installation angle deviation of the surveillance camera in the bank security scenario and the shaking angle during shooting. Then, each historical image in the standardized training set is randomly rotated based on the rotation angle range to obtain the first processed training set. According to a preset pixel size, each sub-image is randomly extracted from each historical image in the standardized training set to obtain a second processed training set containing each of the sub-images; Based on the brightness changes of the monitoring screen in the bank security scene under different lighting conditions, the brightness range and contrast interval are determined, and the brightness of each historical image in the standardized training set is randomly adjusted and the contrast is randomly scaled according to the brightness range and the contrast interval to obtain the third processed training set. The first processed training set, the second processed training set, and the third processed training set are determined as the augmented training set.

5. The abnormal behavior detection method for bank security according to any one of claims 1 to 4, characterized in that, The correction formula for the Butterworth filter is: ； in, The target activation value, The first preset threshold, The second preset threshold is defined as the preset activation value range, which is not less than the second preset threshold and not greater than the first preset threshold. z is the initial activation value, and N is the order of the Butterworth filter.

6. The abnormal behavior detection method for bank security according to claim 1, characterized in that, The step of inputting the target activation value into the classifier of the target image classification model to output the abnormal behavior detection result includes: The target activation value is input into the classifier of the target image classification model to determine the maximum softmax probability based on the target activation value, and the abnormal behavior detection result is output according to the maximum softmax probability.

7. The abnormal behavior detection method for bank security according to claim 6, characterized in that, The step of outputting the abnormal behavior detection result based on the maximum Softmax probability includes: If the maximum Softmax probability is not less than the preset probability threshold, then the abnormal behavior detection result is output, indicating that the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scene. If the maximum Softmax probability is less than a preset probability threshold, then an abnormal behavior detection result is output, indicating that the operation behavior corresponding to the current target image belongs to an abnormal behavior in a bank security scenario.

8. An abnormal behavior detection device for bank security, characterized in that, include: The image preprocessing module is used to preprocess the current raw image in the surveillance video of the bank security scene to obtain the current target image; The initial activation value output module is used to process the current target image using the feature extractor of the target image classification model to obtain the initial activation value; An activation value correction module is used to correct the initial activation value to a preset activation value range using a Butterworth filter if the initial activation value is not less than a first preset threshold, so as to obtain a target activation value. An activation value determination module is used to determine the initial activation value as the target activation value if the initial activation value is less than a first preset threshold. The behavior result output module is used to input the target activation value into the classifier of the target image classification model to output the abnormal behavior detection result; wherein, the abnormal behavior detection result indicates that the operation behavior corresponding to the current target image belongs to the abnormal behavior in the bank security scenario or the operation behavior corresponding to the current target image does not belong to the abnormal behavior in the bank security scenario.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the abnormal behavior detection method for bank security as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the abnormal behavior detection method for bank security as described in any one of claims 1 to 7.

Images