AI-based security and protection monitoring abnormal behavior recognition system

Abstract

The invention discloses an AI-based security and protection monitoring abnormal behavior recognition system. The system comprises a multi-source sensing layer, an edge preprocessing layer, an AI decision-making layer, a linkage execution layer, a dynamic environment adaptation module and an equipment state monitoring module. The multi-source sensing layer collects image data, environment parameters and equipment operation parameters of a monitoring scene; the edge preprocessing layer is used for carrying out noise reduction, feature alignment and format unification on the acquired data; the AI decision-making layer fuses the preprocessed data with an environment interference compensation value output by the dynamic environment adaptation module and an equipment deviation correction value output by the equipment state monitoring module, and generates a behavior anomaly degree and a risk level by improving a deep learning model; the linkage execution layer triggers a response action according to the risk level; according to the system, the problem of abnormal recognition misjudgment caused by coupling interference of a dynamic environment and an equipment state is solved, and the recognition accuracy and the scene adaptability are improved.

Description

Technical Field

[0001] This invention relates to the field of security monitoring technology, specifically to an AI-based security monitoring abnormal behavior recognition system. Background Technology

[0002] In the field of security monitoring, AI-driven abnormal behavior recognition systems have become the mainstream technology. Their core requirement is to automatically identify abnormal behaviors in monitored scenarios using intelligent algorithms and trigger timely response actions. However, existing technologies face a key bottleneck in practical applications: the coupled influence of dynamic environmental interference and equipment degradation leads to low reliability in abnormal behavior feature extraction, ultimately resulting in a high false positive rate.

[0003] Specifically, the environment of a surveillance scene is not constant. For example, rain can blur images, backlighting can cause overexposure of targets, and fog can reduce image contrast. These environmental factors directly interfere with the target features in the image data, making it difficult for algorithms to accurately extract behavioral contours and motion trajectories. At the same time, surveillance equipment will deteriorate in condition over long-term operation. For example, the focal length of the camera may shift due to vibration, the light transmittance of the lens may decrease due to dust accumulation, and the noise of the sensor may increase due to aging. These equipment problems will further distort the features of the collected data and exacerbate the error in feature extraction.

[0004] Existing systems typically address these issues with single-dimensional optimization methods, such as adding simple image filtering modules to handle environmental noise at the algorithm level, or periodically manually calibrating the equipment status. However, this isolated solution cannot handle the coupled interference between the environment and the equipment. When rain and camera focal length shift coexist, the filtering algorithm struggles to distinguish whether the blur is caused by rain or focal length shift, and manual calibration cannot keep up with the dynamic changes in the equipment status in real time. Ultimately, this results in a false positive rate for abnormal behavior recognition consistently exceeding 15%, failing to meet the requirements of high-precision security monitoring.

[0005] Based on the above problems, there is an urgent need for an AI security monitoring system that can collaboratively handle dynamic environmental interference and equipment condition degradation, and achieve accurate adaptation of feature extraction and anomaly judgment. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of existing technologies by proposing an AI-based security monitoring abnormal behavior recognition system. This system includes a multi-source perception layer, an edge preprocessing layer, an AI decision-making layer, a linkage execution layer, a dynamic environment adaptation module, and a device status monitoring module. The multi-source perception layer is connected to the edge preprocessing layer, which in turn is connected to the AI ​​decision-making layer. The AI ​​decision-making layer is also connected to the linkage execution layer. The dynamic environment adaptation module is connected to the multi-source perception layer, the edge preprocessing layer, and the AI ​​decision-making layer, respectively. The device status monitoring module is also connected to the multi-source perception layer, the edge preprocessing layer, and the AI ​​decision-making layer, respectively. The multi-source perception layer acquires images of the monitored scene. The data, environmental parameters, and equipment operating parameters are collected. The edge preprocessing layer performs noise reduction, feature alignment, and format unification on the collected data. The dynamic environment adaptation module analyzes environmental parameters in real time and outputs environmental interference compensation values. The equipment status monitoring module monitors equipment operating parameters and outputs equipment deviation correction values. The AI ​​decision layer integrates the processed data output by the edge preprocessing layer, the environmental interference compensation values ​​output by the dynamic environment adaptation module, and the equipment deviation correction values ​​output by the equipment status monitoring module, and generates behavior anomaly degree and risk level through a built-in improved deep learning model. The linkage execution layer receives the risk level output by the AI ​​decision layer and triggers corresponding response actions.

[0007] Preferably, the multi-source sensing layer includes a high-definition network camera, an infrared thermal imaging sensor, an environmental parameter sensor, and a device status acquisition unit; the high-definition network camera acquires RGB image data of the monitored scene and supports multi-frame rate switching; the infrared thermal imaging sensor acquires thermal imaging data of the monitored scene for target detection in low-light or occluded scenes; the environmental parameter sensor acquires light intensity, rainfall intensity, fog concentration, and temperature parameters of the monitored scene; the device status acquisition unit acquires the focal length offset, lens contamination level, and sensor noise intensity of the high-definition network camera, and acquires the detector response time and signal attenuation rate of the infrared thermal imaging sensor.

[0008] Further optimized, the noise reduction processing of the edge preprocessing layer adopts an adaptive bilateral filtering algorithm, which dynamically adjusts the size and weight of the filtering kernel according to the pixel grayscale differences of the image data; the feature alignment adopts a spatiotemporal calibration algorithm, which matches the heterogeneous data collected by the high-definition network camera and the infrared thermal imaging sensor based on timestamps and spatial coordinates; the format unification converts the data output by different types of sensors into JSON format, retaining the data acquisition time, sensor identification and parameter unit information during the conversion process, and the processed data is transmitted to the AI ​​decision layer through a high-speed Ethernet interface.

[0009] Further optimized, the environmental parameter analysis of the dynamic environment adaptation module includes illumination interference analysis, meteorological interference analysis, and temperature impact analysis; illumination interference analysis determines whether there are backlit or excessively dark scenes based on illumination intensity parameters and outputs an illumination compensation coefficient; meteorological interference analysis determines the impact of weather on image clarity based on rainfall intensity and fog concentration parameters and outputs a meteorological attenuation coefficient; temperature impact analysis determines the impact of ambient temperature on sensor sensitivity based on temperature parameters and outputs a temperature correction coefficient; the environmental interference compensation value is a weighted sum of the illumination compensation coefficient, meteorological attenuation coefficient, and temperature correction coefficient, and the weighting coefficients are dynamically adjusted according to the environmental characteristics of the monitoring scene.

[0010] More preferably, the equipment condition monitoring module calculates the equipment deviation correction value η using the following formula: ; Where η is the equipment deviation correction value, ranging from 0 to 1, and is dimensionless; α, β, and γ are weighting coefficients, and α+β+γ=1, which correspond to the influence weights of focal length shift, lens contamination, and sensor noise, respectively, and are dimensionless; Δf is the actual focal length shift of the high-definition network camera, in millimeters. This is the maximum allowable focal length offset for a high-definition network camera, in millimeters. This refers to the cumulative usage time of the high-definition network camera, expressed in hours. δ is the equipment aging factor, dimensionless, characterizing the degree of influence of usage time on focal length stability; δ is the lens contamination degree, characterized by the percentage decrease in lens transmittance, dimensionless. The lens contamination threshold is the critical percentage decrease in lens transmittance, and it is dimensionless. The lens cleaning cycle angular frequency, expressed in radians per day, characterizes the periodic change of lens contamination over time. The current cleaning cycle time is in days; N is the actual noise level of the sensor in decibels. The maximum allowable noise level for the sensor, expressed in decibels; This is the difference between the actual operating temperature and the rated operating temperature of the sensor, expressed in degrees Celsius. The temperature sensitivity coefficient is dimensionless and characterizes the degree of influence of temperature deviation on sensor noise.

[0011] More preferably, the AI ​​decision-making layer calculates the behavioral anomaly degree A using the following formula: The AI ​​decision-making layer calculates the behavioral anomaly degree A using the following formula: ; Where A is the corrected abnormality degree, which ranges from 0 to 10 and is dimensionless. The larger the value, the higher the degree of abnormality. η represents the initial behavior anomaly score, output by the improved deep learning model based on uncorrected data, with a value ranging from 0 to 10 and being dimensionless; η is the equipment deviation correction value, which is also dimensionless. Δv is the velocity influence coefficient, dimensionless, characterizing the impact of target movement speed deviation on anomaly degree; Δv is the difference between the actual movement speed of the target and the normal speed threshold in the monitoring scene, in meters per second. This is a sign function; it outputs 1 when the value inside the parentheses is positive and -1 when it is negative, and is dimensionless. D is the deviation distance between the actual trajectory of the target and the preset normal trajectory, in meters. The average deviation distance of the historical normal trajectory is in meters; L is the duration of the target behavior, in seconds. The standard duration of normal behavior, in seconds; is the behavioral complexity coefficient, dimensionless, representing the impact of behavioral complexity on anomaly correction; C is the complexity score of the target behavior, calculated based on the joint motion amplitude and frequency of the target action, with a value range of 0 to 5, dimensionless.

[0012] For further optimization, the AI ​​decision-making layer calculates the risk level R using the following formula: ; Where R is the risk level, with a value ranging from 0 to 100. It is dimensionless, and the larger the value, the higher the risk. This is the start time of behavior detection, in seconds. is the end time of behavior detection, in seconds; A is the corrected behavior anomaly degree, dimensionless. The risk weights for each scenario are set according to the type of monitoring scenario, such as ω=0.8 for school areas and ω=0.5 for parking lot areas, and are dimensionless. H is the potential hazard coefficient, dimensionless, representing the degree of harm that the target behavior may cause; H is the potential hazard score of the target behavior, calculated based on the degree of threat the behavior poses to personnel and property, with a value ranging from 0 to 8, dimensionless. is the distance attenuation coefficient, dimensionless, characterizing the impact of the distance between the target and the key monitoring area on risk; d is the straight-line distance between the target and the key monitoring area, in meters; the integral term calculates the cumulative risk value during the behavior detection period, which serves as the final risk level.

[0013] Further optimized, the improved deep learning model for the AI ​​decision layer is based on the YOLOv8 framework. Spatial attention and channel attention modules are added to the model's Neck layer. The spatial attention module strengthens the feature weights of the target region by calculating the spatial correlation of image pixels. The channel attention module suppresses the feature output of redundant channels by calculating the importance of each channel of the feature map. The model training process adopts a hybrid loss function, which is a weighted sum of CIoU loss and Focal loss with a weight ratio of 6:4, to improve the detection accuracy of small targets and occluded targets.

[0014] Further optimized, the response actions of the linkage execution layer include local audible and visual alarms, remote platform push notifications, monitoring screen capture, video recording and storage, and linkage with related devices; local audible and visual alarms are implemented through external audible and visual alarms, with the alarm volume and light flashing frequency adjusted according to the risk level; remote platform push notifications send screenshots of abnormal behavior, behavior descriptions, and risk levels to the security monitoring platform via 4G / 5G networks; monitoring screen capture triggers high-definition network cameras to capture continuous frames, and the captured images are stored on the local hard drive; video recording and storage initiates a loop overwrite protection for the video recordings during the period in which the abnormal behavior occurs, preventing the recordings from being overwritten; linkage with related devices triggers access control locking, lighting activation, or fire equipment preparation actions according to the monitoring scenario.

[0015] Further preferred features include a security protection module, which is connected to the multi-source perception layer, edge preprocessing layer, AI decision-making layer, and linkage execution layer. The security protection module uses an asymmetric encryption algorithm to encrypt the data transmitted between modules, with an encryption key length of 2048 bits. It uses the SHA256 hash algorithm to verify the integrity of the transmitted data and generate a 256-bit hash value. It monitors the access behavior of each module in real time, and when abnormal access is detected, it triggers an alarm mechanism. The alarm information is pushed to the operation and maintenance personnel via SMS and email, and the abnormal access link is temporarily blocked.

[0016] Technical Effects: This invention addresses the misjudgment problem caused by the coupling interference between dynamic environment and device status in existing technologies by adding a dynamic environment adaptation module and a device status monitoring module. This constructs a full-link collaborative architecture encompassing multi-source perception, collaborative preprocessing, and AI fusion decision-making. The dynamic environment adaptation module and the device status monitoring module output compensation and correction values, respectively. The AI ​​decision-making layer uses these two parameters to correct the abnormality and risk level of behavior, achieving deep collaboration between the environment, device, and algorithm. The improved deep learning model enhances feature extraction accuracy through attention mechanisms and hybrid loss functions. The security protection module ensures data transmission and access security. The overall system significantly improves the accuracy and scene adaptability of abnormal behavior recognition, meeting the needs of complex security monitoring scenarios. Attached Figure Description

[0017] Figure 1 This is a flowchart of the AI-based security monitoring abnormal behavior recognition system of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] Please see Figure 1 Traditional technical solutions have the following technical problems: Existing security monitoring abnormal behavior recognition systems rely only on a one-way link of image acquisition-algorithm recognition-alarm, without considering the coupling interference of dynamic environment and equipment status degradation. The acquired data is prone to distortion, and there is a lack of coordination mechanism between modules, making it impossible to correct the interference in real time, resulting in a high misjudgment rate of abnormality judgment.

[0020] Based on this, please refer to Figure 1 This embodiment provides an AI-based security monitoring abnormal behavior recognition system, including a multi-source perception layer, an edge preprocessing layer, an AI decision-making layer, and a linkage execution layer. The multi-source perception layer is connected to the edge preprocessing layer, the edge preprocessing layer is connected to the AI ​​decision-making layer, and the AI ​​decision-making layer is connected to the linkage execution layer. It also includes a dynamic environment adaptation module and a device status monitoring module. The dynamic environment adaptation module is connected to the multi-source perception layer, the edge preprocessing layer, and the AI ​​decision-making layer, respectively. The device status monitoring module is also connected to the multi-source perception layer, the edge preprocessing layer, and the AI ​​decision-making layer, respectively. The multi-source perception layer collects image data and environmental parameters of the monitoring scene. The system collects and processes data including equipment operating parameters; the edge preprocessing layer performs noise reduction, feature alignment, and format unification on the collected data; the dynamic environment adaptation module analyzes environmental parameters in real time and outputs environmental interference compensation values; the equipment status monitoring module monitors equipment operating parameters and outputs equipment deviation correction values; the AI ​​decision layer integrates the processed data output by the edge preprocessing layer, the environmental interference compensation values ​​output by the dynamic environment adaptation module, and the equipment deviation correction values ​​output by the equipment status monitoring module, and generates behavior anomaly degree and risk level through a built-in improved deep learning model; the linkage execution layer receives the risk level output by the AI ​​decision layer and triggers corresponding response actions.

[0021] This technical solution adopts a distributed acquisition-edge processing-cloud collaboration hardware architecture. The multi-source perception layer accesses the edge preprocessing layer via RS485 or 4G / 5G networks. Image data is transmitted using the RTSP protocol, and parameter data is transmitted using the MQTT protocol to ensure real-time data transmission. The edge preprocessing layer uses the Huawei Atlas200IDKA2 edge computing gateway, equipped with an Ascend 310 NPU. The dynamic environment adaptation module and device status monitoring module are integrated into this gateway via a PCIe interface, enabling low-latency interaction with other modules, with an interaction latency of no more than 50 milliseconds. The edge preprocessing layer connects to the Huawei Atlas800AI server of the AI ​​decision layer via a gigabit industrial Ethernet. The processed data is transmitted via an internal high-speed bus at a rate of 1Gbps. The AI ​​decision layer loads an improved deep learning model, receives environmental interference compensation values ​​and device deviation correction values, and generates behavioral anomaly and risk levels within 300 milliseconds, which are then transmitted to the linkage execution layer via the TCP / IP protocol. The linkage execution layer uses an STM32F407 control unit, which triggers a response action upon receiving the risk level and simultaneously transmits the execution status back through a feedback interface, forming a closed-loop control. The entire system's module connections and data flow logic are clear, with each module working collaboratively. The entire chain, from data acquisition to decision execution, has clear hardware support and software logic. This solution solves the problem of misjudgment caused by coupling interference, achieves deep collaboration between modules, improves the real-time performance and accuracy of abnormal behavior identification, and meets high-precision security requirements.

[0022] Traditional technical solutions have the following technical problems: existing multi-source perception layers only deploy a single high-definition camera, lack the ability to collect environmental parameters and device status, fail to detect targets in low light or occluded scenes, and cannot determine the source of data distortion, resulting in a lack of reliable data foundation for subsequent algorithm recognition.

[0023] Based on this, the multi-source sensing layer includes a high-definition network camera, an infrared thermal imaging sensor, an environmental parameter sensor, and a device status acquisition unit; the high-definition network camera acquires RGB image data of the monitored scene and supports multi-frame rate switching; the infrared thermal imaging sensor acquires thermal imaging data of the monitored scene for target detection in low-light or occluded scenes; the environmental parameter sensor acquires light intensity, rainfall intensity, fog concentration, and temperature parameters of the monitored scene; the device status acquisition unit acquires the focal length offset, lens contamination level, and sensor noise intensity of the high-definition network camera, and acquires the detector response time and signal attenuation rate of the infrared thermal imaging sensor.

[0024] In this technical solution, the high-definition network camera used is the Hikvision DS-2CD3T46WD-L, which supports adaptive switching of frame rate from 1 to 30fps. In backlight scenes, it switches to 10fps and enables 120dB wide dynamic range, while in low-light scenes, it switches to 30fps and enables 0.001lux starlight mode to ensure image quality under different lighting conditions. The infrared thermal imaging sensor used is the FLIRAX8, with a resolution of 640×512, a detection distance of 50 meters, and a spectral response range of 7.5 to 13 micrometers. It activates at night or in foggy or hazy weather, outputting pixel values ​​corresponding to target temperature data from -20℃ to 150℃, which is complementary to RGB data. The environmental parameter sensor uses a Sensirion SHT35 and Aosong AQM2010 integrated module, with a sampling interval of 500 milliseconds, a light intensity range of 0 to 100,000 lux, a rainfall intensity range of 0 to 50 mm / h, a fog concentration range of 0 to 1000 μg / m³, and a temperature range of -40℃ to 85℃, ensuring comprehensive capture of environmental changes. The device status acquisition unit reads the focal length offset of the high-definition camera via an RS485 interface with an accuracy of 0.01mm. It detects lens contamination levels using a Hamamatsu S1336-18K transmittance sensor with a range of 0-30%, and reads noise intensity via a noise detection pin with a range of 0-60dB. Simultaneously, it acquires the detector response time and signal attenuation rate of the infrared sensor via an I2C interface, ensuring accurate acquisition of device status parameters. This solution, through diversified sensor deployment, solves the problems of detection failure due to low light obstruction and unclear sources of data distortion, providing comprehensive and reliable raw data for subsequent interference correction.

[0025] Traditional technical solutions have the following technical problems: existing edge preprocessing layers use fixed parameter filtering, which cannot adapt to the noise characteristics of different scenarios; heterogeneous data are not spatiotemporally aligned, resulting in feature misalignment; inconsistent data formats increase the burden on the AI ​​decision-making layer; and preprocessing efficiency is low and data quality is poor.

[0026] Based on this, the noise reduction processing of the edge preprocessing layer adopts an adaptive bilateral filtering algorithm, which dynamically adjusts the size and weight of the filtering kernel according to the pixel grayscale difference of the image data; the feature alignment adopts a spatiotemporal calibration algorithm, which matches the heterogeneous data collected by the high-definition network camera and the infrared thermal imaging sensor based on timestamps and spatial coordinates; the format unification converts the data output by different types of sensors into JSON format, retaining the data acquisition time, sensor identification and parameter unit information during the conversion process, and the processed data is transmitted to the AI ​​decision layer through a high-speed Ethernet interface.

[0027] This technical solution relies on the Huawei Atlas200IDKA2 edge computing gateway, with software developed in C++ and running on an Ubuntu 20.04 system. An adaptive bilateral filtering algorithm traverses image pixels, calculating the gray-level difference within a 3×3 neighborhood. When the gray-level difference is less than 20, a 9×9 filter kernel with a weight of 0.8 to 1.0 is used to enhance smoothing; when it is greater than or equal to 20, a 5×5 filter kernel with a weight of 0.1 to 0.5 is used to preserve edges, resulting in better noise removal. The spatiotemporal calibration algorithm synchronizes the timestamps of each sensor using a Ublox NEO-7M GPS module, with an error not exceeding 10 milliseconds. Spatial calibration uses a 20mm×20mm checkerboard calibration board to extract the corner coordinates of RGB and thermal imaging images, establishing a coordinate mapping through perspective transformation, with an alignment accuracy not exceeding 1 pixel. When the format is unified, the JSON structure includes the acquisition time, sensor ID, parameter type, parameter value, and unit field. RGB images are compressed using JPEG at a ratio of 10:1, while parameter data is uncompressed. The processed data is transmitted via a gigabit Ethernet interface at a rate of 100Mbps with a latency not exceeding 200ms to avoid format compatibility issues. This solution addresses the issues of incomplete noise removal and feature misalignment in traditional preprocessing, improving data quality and transmission efficiency, and providing high-quality input for AI decision-making.

[0028] Traditional technical solutions have the following technical problems: existing systems only use simple image enhancement to process environmental interference, without quantifying the degree of influence of environmental factors, without distinguishing different interference mechanisms, and the correction of environmental interference is blind and cannot accurately compensate for data distortion.

[0029] Based on this, the environmental parameter analysis of the dynamic environment adaptation module includes illumination interference analysis, meteorological interference analysis, and temperature impact analysis. Illumination interference analysis determines whether there are backlit or excessively dark scenes based on illumination intensity parameters and outputs an illumination compensation coefficient. Meteorological interference analysis determines the impact of weather on image clarity based on rainfall intensity and fog concentration parameters and outputs a meteorological attenuation coefficient. Temperature impact analysis determines the impact of ambient temperature on sensor sensitivity based on temperature parameters and outputs a temperature correction coefficient. The environmental interference compensation value is a weighted sum of the illumination compensation coefficient, meteorological attenuation coefficient, and temperature correction coefficient, and the weighting coefficients are dynamically adjusted according to the environmental characteristics of the monitoring scene.

[0030] The dynamic environment adaptation module of this technical solution is integrated into the edge computing gateway. In the light interference analysis, when the light intensity is greater than 80,000 lux, K is used. light =0.8-0.000005×(illuminance-80000) to calculate the compensation coefficient. When it is less than 1000 lux, use K. light =0.5 + 0.00005 × light intensity, set to 1.0 for normal lighting conditions. K is used for meteorological interference analysis. weather=1.0 - 0.02 × rainfall intensity - 0.001 × fog concentration. The Retinex algorithm is triggered to enhance the image when the rainfall intensity is greater than 20 mm / h or the fog concentration is greater than 500 μg / m³. Temperature effect analysis uses K0. temp =1.0-0.005×|T-25| Calculate the correction factor, where T is the ambient temperature and 25℃ is the rated operating temperature. Environmental interference compensation value K env Weights are assigned based on the scene: for outdoor scenes, lighting has a weight of 0.4, weather 0.3, and temperature 0.3; for indoor scenes, temperature has a weight of 0.5, lighting 0.3, and weather 0.2. K env Updated every second and pushed to the AI ​​decision-making layer via a dedicated interface, with a latency of no more than 50ms. This solution addresses the problem of blind correction due to environmental interference by using multi-dimensional quantification and scenario-based weighting, achieving precise compensation and improving data reliability.

[0031] Traditional technical solutions have the following technical problems: existing systems rely on manual periodic inspections and assessments of equipment status, which cannot quantify the impact of equipment deviations on data in real time, do not consider the coupling effect of multiple equipment factors, lack scientific basis for equipment deviation correction, and are prone to misjudgment.

[0032] Based on this, the equipment status monitoring module calculates the equipment deviation correction value η using the following formula: ; Where η is the equipment deviation correction value, ranging from 0 to 1, and is dimensionless; α, β, and γ are weighting coefficients, and α+β+γ=1, corresponding to the influence weights of focal length shift, lens contamination, and sensor noise, respectively, and are dimensionless; Δf is the actual focal length shift of the high-definition network camera, in millimeters. This represents the maximum allowable focal length offset of the camera, in millimeters. The cumulative usage time of the camera, in hours; δ represents the equipment aging coefficient, which is dimensionless; δ represents the degree of lens contamination, characterized by the percentage decrease in light transmittance, which is also dimensionless. ω is the lens contamination threshold, i.e., the critical percentage decrease in light transmittance, which is dimensionless; ω is the lens cleaning cycle angular frequency, in radians per day. The current cleaning cycle time is in days; N is the actual noise level of the sensor in decibels. The maximum allowable noise level for the sensor, expressed in decibels; This is the difference between the actual operating temperature and the rated operating temperature of the sensor, expressed in degrees Celsius. The temperature sensitivity coefficient is dimensionless.

[0033] In the formula, α, β, and γ are weighting coefficients, dynamically allocated according to the scene, corresponding to the proportions of influence from focal length shift, lens contamination, and sensor noise, respectively. In the first term, Δf and f... max The ratio reflects the degree of focal length shift, and the exponential term This reflects the attenuation of the effect of equipment aging on offset; the longer the usage time, the lower the weight of this factor. In the second item, δ / S th The proportion representing the relative threshold of lens contamination, cosine function cos(ω·t) cycle The simulation shows the cyclical changes in pollution during the cleaning cycle, with a weak impact in the early stages and a gradual increase in intensity later. In the third item... The exponential term reflects the proportion of noise relative to the limit. This reflects the amplified impact of temperature deviation on noise; the greater the temperature deviation, the higher the noise weight. The three parts are superimposed to form a comprehensive correction value, quantifying the impact of equipment status on the data.

[0034] In this technical solution, α, β, and γ are initially set to 0.4, 0.3, and 0.3, respectively, and can be adjusted according to the scenario. Set to 2 millimeters; Calibrated to 0.0001 by accelerated aging test; δ range 0 to 30%, S th Set at 20%; ω is calculated as 2π / 7 radians / day based on a 7-day cleaning cycle; t cycle Values ​​range from 0 to 7 days; N lim Set to 40 dB; k2 was calibrated to 0.01 via temperature experiment; T dev Measuring range: -20℃ to 40℃. In practical applications, when the camera has been used for 5000 hours with a Δf = 1 mm, the first term is calculated as 0.4 × (1 - 1 / 2 × e) (-0.0001×5000) )≈0.2787; 3 days after lens cleaning, when δ=10%, the second term is 0.3×(1-10% / 20%×cos(2π / 7×3))≈0.4352; when the sensor temperature is 35℃ and N=35 dB, the third term is 0.3×(1-35 / 40×e)≈0.2787; (-0.01×10) The final result is η≈0.0624; therefore, η≈0.7763, indicating that the impact of equipment deviation is relatively small. This scheme quantifies equipment deviation through a multi-factor coupling formula, solving the problem of non-real-time manual evaluation and providing a scientific basis for AI decision-making.

[0035] Traditional technical solutions have the following technical problems: existing AI decision-making layers only output a fixed anomaly degree based on image features, without combining equipment deviation and target motion characteristics. The anomaly degree cannot reflect the actual degree of anomaly, which is prone to misjudgment or omission.

[0036] Based on this, the AI ​​decision-making layer calculates the abnormality degree A of the behavior using the following formula: ; Where A is the corrected abnormality degree, which ranges from 0 to 10 and is dimensionless. The larger the value, the higher the degree of abnormality. η represents the initial behavior anomaly score, output by the improved deep learning model based on uncorrected data, with a value ranging from 0 to 10 and being dimensionless; η is the equipment deviation correction value, which is also dimensionless. Δv is the velocity influence coefficient, dimensionless, characterizing the impact of target movement speed deviation on anomaly degree; Δv is the difference between the actual movement speed of the target and the normal speed threshold in the monitoring scene, in meters per second. This is a sign function; it outputs 1 when the value inside the parentheses is positive and -1 when it is negative, and is dimensionless. D is the deviation distance between the actual trajectory of the target and the preset normal trajectory, in meters. The average deviation distance of the historical normal trajectory is in meters; L is the duration of the target behavior, in seconds. The standard duration of normal behavior, in seconds; is the behavioral complexity coefficient, dimensionless, representing the impact of behavioral complexity on anomaly correction; C is the complexity score of the target behavior, calculated based on the joint motion amplitude and frequency of the target action, with a value range of 0 to 5, dimensionless.

[0037] In this technical solution Outputs from improved YOLOv8 models, such as "climbing" behavior. =8.5; k3 is set to 0.8, normal speed threshold is 1.5 m / s, Δv is calculated through inter-frame displacement; the sign function is in Output 1 if true, -1 otherwise; D is calculated by converting pixel coordinates to actual coordinates. Based on 30 days of historical data statistics; L calculates the "wandering" behavior by measuring the time difference between the start and end frames of the behavior. =60 seconds; k4 is set to 0.5, C is scored according to joint movement characteristics, and the "fighting" behavior is C=4.0. In the school corridor "climbing" scene, η=0.7763, Δv=0.7 m / s, D=1.2 m, Davg=0.3 m, L=180 seconds, C=4.0, and substituting them into the calculation, we get A≈10.0, which accurately reflects the high degree of anomaly.

[0038] The formula uses the initial anomaly degree Based on this, adjustments are made using the equipment deviation correction value η to eliminate equipment status interference. In the speed influence term, k3 is a coefficient, Δv reflects the deviation of the target speed from the normal threshold, and the sign function is determined by the direction of the trajectory deviation; the more abnormal the speed and the greater the trajectory deviation, the more significant the correction of this term. In the duration term, The exponential term reflects the deviation of the duration of the behavior from the standard value. This reduces the impact of the duration of complex behavior (high C value), consistent with the real-world pattern that longer-lasting complex behaviors are more likely to be abnormal. The four-term product ultimately reflects the actual degree of abnormality in the behavior, taking into account both equipment status and target motion characteristics.

[0039] This solution addresses the problem of isolated anomaly calculation through multi-dimensional correction, ensuring that anomalies align with actual behavior and providing a reliable basis for risk assessment.

[0040] Traditional technical solutions have the following technical problems: existing systems determine risk levels based on a single anomaly threshold, without considering the duration of the behavior, scene characteristics, and distance between the target and key areas. The risk level cannot reflect the actual degree of harm, and inappropriate responses are likely to occur.

[0041] Based on this, the AI ​​decision-making layer calculates the risk level R using the following formula: ; Where R represents the risk level, with a value ranging from 0 to 100, and is dimensionless; This is the start time of behavior detection, in seconds. t represents the end time of behavior detection, in seconds; A represents the corrected behavior anomaly score, derived from the AI ​​decision-making layer's behavior anomaly score calculation, dimensionless; ω represents the scene risk weight, set according to the monitoring scene type, dimensionless; k5 represents the potential hazard coefficient, dimensionless; H represents the potential hazard score of the target behavior, calculated based on the threat level, ranging from 0 to 8, dimensionless; k6 represents the distance attenuation coefficient, dimensionless; d represents the straight-line distance between the target and the key monitoring area, in meters; the integral term calculates the cumulative risk value within the behavior detection period. In this technical solution, t... s With t e The interval represents the duration of the behavior, such as "climbing" lasting 10 seconds; ω is set to 0.8 in the school area and 0.5 in the parking lot; k5 is set to 1.2; H is scored according to the degree of threat, with "knife fight" having H=8.0; k6 is set to 0.1386; d is obtained through image coordinate transformation. In the "climbing" scenario in the school area, A=10.0, ω=0.8, H=7.0, d=1.5 meters, and the integral calculation yields R≈100.0, indicating extremely high risk; the same behavior in the parking lot has R≈71.0, indicating high risk, and the response level is adapted to the scenario.

[0042] The formula is in time integral form, with the integration interval [t]. s ,t e The duration of the corresponding behavior reflects the cumulative effect of risk over time. In the first part of the integrand, A·ω, ω is the scenario weight, making the anomaly degree account for a higher proportion in high-risk scenarios (such as schools). The second part... In the text, H represents the potential hazard score, and the index term... The risk level is determined by distance decay; the closer the target is to the key area (the smaller d is), the more significant the harm. The two parts are combined and integrated, taking into account the degree of anomaly, scene characteristics, potential hazards, and distance factors, to form the final risk level, achieving a quantitative assessment of the actual harm caused by the behavior.

[0043] This scheme addresses the problem of one-sided risk assessment by combining time accumulation with multiple factors, ensuring that risk levels align with actual hazards and providing a basis for tiered response.

[0044] Traditional technical solutions have the following technical problems: existing AI models have low detection accuracy for small targets and occluded targets, feature extraction does not enhance the target area, target localization is inaccurate, and the accuracy of anomaly calculation is affected.

[0045] Based on this, the improved deep learning model for the AI ​​decision layer is optimized using the YOLOv8 framework. A spatial attention module and a channel attention module are added to the model's Neck layer. The spatial attention module strengthens the feature weights of the target region by calculating the spatial correlation of image pixels. The channel attention module suppresses redundant channel feature outputs by calculating the importance of each channel in the feature map. The model training process employs a hybrid loss function, which is a weighted sum of CIoU loss and Focal loss with a weight ratio of 6:4, to improve the detection accuracy of small and occluded targets. This technical solution uses the YOLOv8 framework for modeling and TensorFlow 2.10 for training and inference, and the hardware is a Huawei Atlas 800 server. The spatial attention module receives a 20×20×256 feature map, which is then processed by global averaging and max pooling, two 1×1 convolutions, and a sigmoid function to generate a 20×20×1 weight map, strengthening the target region features. The channel attention module generates a 1×1×256 weight vector through global average pooling, two 1×1 convolutions, and a sigmoid function, suppressing redundant channels. In the hybrid loss function, CIoU loss optimizes bounding box regression, and Focal loss addresses class imbalance. The training dataset uses COCO plus 50,000 custom security images, iterates for 100 rounds, has an initial learning rate of 0.01, and finally achieves mAP@0.5 of 92.3%, with significant improvements in accuracy for small targets and occluded targets.

[0046] This solution addresses the issue of low detection accuracy for small and occluded targets by employing an attention mechanism and a hybrid loss function, thereby improving the accuracy of target localization and classification.

[0047] Traditional technical solutions have the following technical problems: the existing linkage execution layer has a single response action, does not respond according to risk level, lacks linkage with related equipment, has low response efficiency, and abnormal data is easily covered up, affecting subsequent traceability.

[0048] Based on this, the response actions of the linkage execution layer include local audible and visual alarms, remote platform push notifications, monitoring screen capture, video recording and storage, and linkage with related devices. Local audible and visual alarms are implemented through external audible and visual alarms, with the alarm volume and light flashing frequency adjusted according to the risk level. Remote platform push notifications send screenshots of abnormal behavior, behavior descriptions, and risk levels to the security monitoring platform via 4G / 5G networks. Monitoring screen capture triggers high-definition network cameras to capture continuous frames, and the captured images are stored on the local hard drive. Video recording and storage initiates a loop overwrite protection mechanism for the video recordings during the period in which the abnormal behavior occurs, preventing the recordings from being overwritten. Linkage with related devices triggers access control locking, lighting activation, or fire equipment preparation actions based on the monitoring scenario. The technical solution uses an STM32F407 control unit for the linkage execution layer, connected to an external GST-HX-M8501 audible and visual alarm, with a volume of 110dB and a flashing frequency of 2Hz in high-risk situations. Remote push is achieved using a Huawei ME909s-8214G / 5G module, pushing data to the Hikvision iVMS-8700 platform via the MQTT protocol. Capture triggers a camera to capture 5 frames of 4K images, storing them on a 1TB local hard drive. Recording and linkage in school scenarios trigger the locking of a ZKTeco F28 access control system and the control of lighting via an Omron G5LE relay; in parking lots, it triggers the closing of a Jieshun JSKT-2019 gate. The execution status is then transmitted back to the AI ​​decision-making layer. This solution addresses the issues of single-response and data loss through hierarchical response and multi-device linkage, achieving anomaly response and data retention, thus enhancing the practical value of security.

[0049] Traditional technical solutions have the following technical problems: existing systems use simple symmetric encryption for data transmission, which makes the key easy to leak; they lack data integrity verification and abnormal access monitoring, making data easy to be tampered with and leaked; and unauthorized access affects system security.

[0050] Based on this, a security protection module is also included, which is connected to the multi-source perception layer, edge preprocessing layer, AI decision-making layer, and linkage execution layer. The security protection module uses an asymmetric encryption algorithm to encrypt the data transmitted between the modules, with an encryption key length of 2048 bits. It uses the SHA256 hash algorithm to perform integrity verification on the transmitted data and generate a 256-bit hash value. It monitors the access behavior of each module in real time, and when abnormal access is detected, it triggers an alarm mechanism. The alarm information is pushed to the operation and maintenance personnel via SMS or email, and the abnormal access link is temporarily blocked.

[0051] This technical solution uses the national standard SM2 chip for security protection modules and RSA-2048 for asymmetric encryption. The private key is stored in an encrypted partition, and the public key is distributed to each module. Encryption and decryption delays are no more than 10 milliseconds and 15 milliseconds respectively. The SHA256 hash algorithm generates a 256-bit hash value, which is verified by the receiving end, resulting in an extremely low collision probability. Anomaly monitoring includes an IP whitelist, a 10-times / second access frequency limit, and allows only encrypted protocols. Monitoring frequency is 10 times / second, and SMS / email alerts are sent upon anomalies with a delay of no more than 10 seconds. Abnormal links are temporarily blocked for 30 minutes, and logs are retained for 30 days. This solution addresses data and access security deficiencies through high-strength encryption and anomaly monitoring, ensuring the confidentiality, integrity, and availability of the system.

[0052] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. An AI-based security monitoring abnormal behavior recognition system, comprising a multi-source perception layer, an edge preprocessing layer, an AI decision-making layer, and a linkage execution layer, wherein the multi-source perception layer is connected to the edge preprocessing layer, the edge preprocessing layer is connected to the AI ​​decision-making layer, and the AI ​​decision-making layer is connected to the linkage execution layer, characterized in that, It also includes a dynamic environment adaptation module and a device status monitoring module. The dynamic environment adaptation module is connected to the multi-source perception layer, the edge preprocessing layer, and the AI ​​decision-making layer, respectively. The device status monitoring module is also connected to the multi-source perception layer, the edge preprocessing layer, and the AI ​​decision-making layer, respectively. The multi-source perception layer collects image data, environmental parameters, and device operating parameters of the monitored scene. The edge preprocessing layer performs noise reduction, feature alignment, and format unification on the collected data. The dynamic environment adaptation module analyzes environmental parameters in real time and outputs environmental interference compensation values. The device status monitoring module monitors device operating parameters and outputs device deviation correction values. The AI ​​decision-making layer integrates the processed data output by the edge preprocessing layer, the environmental interference compensation values ​​output by the dynamic environment adaptation module, and the device deviation correction values ​​output by the device status monitoring module, and generates behavior anomaly degree and risk level through a built-in improved deep learning model. The linkage execution layer receives the risk level output by the AI ​​decision-making layer and triggers corresponding response actions.

2. The AI-based security monitoring abnormal behavior recognition system according to claim 1, characterized in that, The multi-source sensing layer includes a high-definition network camera, an infrared thermal imaging sensor, an environmental parameter sensor, and a device status acquisition unit. The high-definition network camera acquires RGB image data of the monitored scene and supports multi-frame rate switching. The infrared thermal imaging sensor acquires thermal imaging data of the monitored scene for target detection in low-light or occluded scenes. The environmental parameter sensor acquires light intensity, rainfall intensity, fog concentration, and temperature parameters of the monitored scene. The device status acquisition unit acquires the focal length offset, lens contamination level, and sensor noise intensity of the high-definition network camera, and acquires the detector response time and signal attenuation rate of the infrared thermal imaging sensor.

3. The AI-based security monitoring abnormal behavior recognition system according to claim 1, characterized in that, The noise reduction process of the edge preprocessing layer adopts an adaptive bilateral filtering algorithm, which dynamically adjusts the size and weight of the filtering kernel according to the pixel grayscale difference of the image data. Feature alignment employs a spatiotemporal calibration algorithm to match heterogeneous data collected by high-definition network cameras and infrared thermal imaging sensors based on timestamps and spatial coordinates; format unification converts data output from different types of sensors into JSON format, preserving the data acquisition time, sensor identification, and parameter unit information during the conversion process; the processed data is transmitted to the AI ​​decision-making layer via a high-speed Ethernet interface.

4. The AI-based security monitoring abnormal behavior recognition system according to claim 1, characterized in that, The environmental parameter analysis of the dynamic environment adaptation module includes light interference analysis, meteorological interference analysis, and temperature influence analysis. The light interference analysis determines whether there is a backlit or dark scene based on the light intensity parameter and outputs the light compensation coefficient. The meteorological interference analysis determines the influence of weather on image clarity based on the rainfall intensity and fog concentration parameters and outputs the meteorological attenuation coefficient. Temperature impact analysis determines the influence of ambient temperature on sensor sensitivity based on temperature parameters and outputs a temperature correction coefficient; the environmental interference compensation value is a weighted sum of the illumination compensation coefficient, meteorological attenuation coefficient, and temperature correction coefficient, with the weighting coefficients dynamically adjusted according to the environmental characteristics of the monitoring scene.

5. The AI-based security monitoring abnormal behavior recognition system according to claim 1, characterized in that, The equipment status monitoring module calculates the equipment deviation correction value η using the following formula: ； Where η is the equipment deviation correction value, ranging from 0 to 1, and is dimensionless; α, β, and γ are weighting coefficients, and α+β+γ=1, which correspond to the influence weights of focal length shift, lens contamination, and sensor noise, respectively, and are dimensionless; Δf is the actual focal length shift of the high-definition network camera, in millimeters. This is the maximum allowable focal length offset for a high-definition network camera, in millimeters. This refers to the cumulative usage time of the high-definition network camera, expressed in hours. δ is the equipment aging factor, dimensionless, characterizing the degree of influence of usage time on focal length stability; δ is the lens contamination degree, characterized by the percentage decrease in lens transmittance, dimensionless. The lens contamination threshold is the critical percentage decrease in lens transmittance, and it is dimensionless. The lens cleaning cycle angular frequency, expressed in radians per day, characterizes the periodic change of lens contamination over time. The current cleaning cycle time is in days; N is the actual noise level of the sensor in decibels. The maximum allowable noise level for the sensor, expressed in decibels; This is the difference between the actual operating temperature and the rated operating temperature of the sensor, expressed in degrees Celsius. The temperature sensitivity coefficient is dimensionless and characterizes the degree of influence of temperature deviation on sensor noise.

6. The AI-based security monitoring abnormal behavior recognition system according to claim 5, characterized in that, The AI ​​decision-making layer calculates the abnormality degree A of the behavior using the following formula: ； Where A is the corrected abnormality degree, which ranges from 0 to 10 and is dimensionless. The larger the value, the higher the degree of abnormality. The initial abnormality score is output by the improved deep learning model based on uncorrected data, and its value ranges from 0 to 10 and is dimensionless. This is a dimensionless correction value for equipment deviation. The velocity influence coefficient is dimensionless and characterizes the impact of the target's movement speed deviation on the anomaly degree. The difference between the actual moving speed of the target and the normal speed threshold in the monitored scene, expressed in meters per second; This is a sign function; it outputs 1 when the value inside the parentheses is positive and -1 when it is negative, and is dimensionless. D is the deviation distance between the actual trajectory of the target and the preset normal trajectory, in meters. The average deviation distance of the historical normal trajectory is in meters; L is the duration of the target behavior, in seconds. The standard duration of normal behavior, in seconds; is the behavioral complexity coefficient, dimensionless, representing the impact of behavioral complexity on anomaly correction; C is the complexity score of the target behavior, calculated based on the joint motion amplitude and frequency of the target action, with a value range of 0 to 5, dimensionless.

7. The AI-based security monitoring abnormal behavior recognition system according to claim 6, characterized in that, The AI ​​decision-making layer calculates the risk level R using the following formula: ； Where R is the risk level, with a value ranging from 0 to 100. It is dimensionless, and the larger the value, the higher the risk. This is the start time of behavior detection, in seconds. is the end time of behavior detection, in seconds; A is the corrected behavior anomaly degree, dimensionless. Risk weights are assigned based on the type of monitoring scenario, such as school areas. =0.8, Parking Area =0.5, dimensionless; Potential hazard coefficient, dimensionless, characterizes the degree of harm that the target behavior may cause; H is the potential hazard score of the target behavior, calculated based on the degree of threat the behavior poses to people and property, with a value ranging from 0 to 8, dimensionless; is the distance attenuation coefficient, dimensionless, characterizing the impact of the distance between the target and the key monitoring area on risk; d is the straight-line distance between the target and the key monitoring area, in meters; the integral term calculates the cumulative risk value during the behavior detection period, which serves as the final risk level.

8. The AI-based security monitoring abnormal behavior recognition system according to claim 1, characterized in that, The improved deep learning model for AI decision-making is based on the YOLOv8 framework and incorporates spatial attention and channel attention modules in the model's Neck layer. The spatial attention module enhances the feature weights of the target region by calculating the spatial correlation of image pixels; the channel attention module suppresses the feature output of redundant channels by calculating the importance of each channel of the feature map; the model training process adopts a hybrid loss function, which is a weighted sum of CIoU loss and Focal loss with a weight ratio of 6:4, to improve the detection accuracy of small targets and occluded targets.

9. The AI-based security monitoring abnormal behavior recognition system according to claim 1, characterized in that, The response actions of the linkage execution layer include local audible and visual alarms, remote platform push notifications, monitoring screen capture, video recording and storage, and linkage with related devices. Local audible and visual alarms are implemented through external audible and visual alarms, with the alarm volume and light flashing frequency adjusted according to the risk level. Remote platform push notifications send screenshots of abnormal behavior, behavior descriptions, and risk levels to the security monitoring platform via 4G / 5G networks. Monitoring screen capture triggers high-definition network cameras to capture continuous frames, and the captured images are stored on the local hard drive. Video storage enables loop overwrite protection for video recordings during the period of abnormal behavior to prevent recordings from being overwritten; associated devices trigger access control locking, lighting activation, or fire equipment preparatory actions based on the monitoring scenario.

10. The AI-based security monitoring abnormal behavior recognition system according to claim 1, characterized in that, It also includes a security protection module, which is connected to the multi-source perception layer, edge preprocessing layer, AI decision-making layer, and linkage execution layer. The security protection module uses an asymmetric encryption algorithm to encrypt the data transmitted between modules, with an encryption key length of 2048 bits. It uses the SHA256 hash algorithm to verify the integrity of the transmitted data and generate a 256-bit hash value. It monitors the access behavior of each module in real time. When abnormal access is detected, an alarm mechanism is triggered. The alarm information is pushed to the operation and maintenance personnel via SMS and email, and the abnormal access link is temporarily blocked.

Images