Entrance guard data anomaly detection method and system based on machine learning

Abstract

The invention relates to the technical field of access control safety monitoring and access management, and discloses an access control data anomaly detection method and system based on machine learning. The method comprises the following steps: firstly, acquiring access control card swiping records, personnel identifiers, card swiping moments and access control node data, forming a passing time sequence, constructing a passing topological graph, further generating a personnel passing path sequence with timestamps, and recording key parameters; extracting core features of the path sequence, dividing clusters through a clustering algorithm, and constructing a personalized passing reference model; and finally, calculating a characteristic deviation degree based on the reference model, marking a suspicious path, checking abnormal behavior segments segment by segment in combination with the shortest path length and a preset passing speed, counting abnormal frequency and repetition times, and generating a threat personnel list and an alarm record. According to the invention, accurate portraying and multi-dimensional abnormity identification of the passing behavior are realized based on machine learning, the accuracy of access control passing abnormity detection can be improved, the false report and missing report rate can be effectively reduced, and the reliability of access management and safety monitoring can be enhanced.

Description

Technical Field

[0001] This invention relates to the field of access control security monitoring technology, and in particular to a method and system for detecting anomalies in access control data based on machine learning. Background Technology

[0002] Access control systems are a core component of building security systems, widely used in office parks, residential communities, industrial plants, and other settings. They achieve precise control over personnel entering and exiting by verifying their identity and access permissions. While access control systems have accumulated a large amount of card-swipe data as their intelligence level has improved, traditional methods for detecting anomalies still have significant limitations.

[0003] Current mainstream access control anomaly detection methods mostly rely on fixed rules for judgment, such as simple logic like unauthorized access at night or card swiping by unfamiliar personnel. These methods have two major problems: First, they lack adaptability, failing to incorporate personalized judgment standards based on different people's daily access habits, easily misjudging normal personalized access behavior as abnormal; second, they have a single detection dimension, focusing only on the authorization verification of a single access event, ignoring the correlation analysis of multi-dimensional features such as access paths and time intervals, leading to a high rate of false negatives and false negatives.

[0004] Meanwhile, the passage behaviors of people in complex scenarios are diverse and interconnected, making it difficult for traditional methods to capture the common patterns of group passage and the differences in individual passage characteristics. For example, within the same office park, the passage paths and frequencies of employees and visitors differ significantly, and fixed rules cannot dynamically adapt to these differences. Furthermore, the passage behaviors of abnormal individuals often exhibit periodic and repetitive characteristics, and traditional methods lack the depth to mine these characteristics, making accurate identification difficult. Therefore, how to utilize machine learning technology to mine the deep features of passage data and build dynamically adaptable anomaly detection models has become crucial to improving the intelligence level of access control security monitoring. Summary of the Invention

[0005] This invention provides a machine learning-based method and system for detecting anomalies in access control data, which solves the problems of poor adaptability and single detection dimension in traditional access control anomaly detection, and improves the accuracy and intelligence level of anomaly detection.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides a method for detecting anomalies in access control data based on machine learning, comprising:

[0007] Collect access control card swipe records, personnel identification, card swipe time and corresponding access control node, and group them by personnel identification and sort them in ascending order by card swipe time to obtain the passage time sequence of each person;

[0008] Based on the access control nodes, the physical connectivity between nodes is analyzed, and node pairs that can pass through each other physically are selected to construct a weighted undirected passage topology graph.

[0009] Based on the passage time sequence, the nodes corresponding to each time point are connected sequentially on the passage topology map to form a personnel passage path sequence with timestamps. At the same time, the actual elapsed time of adjacent card swipe events in the personnel passage path sequence and the shortest path length of the corresponding nodes in the passage topology map are recorded.

[0010] The core feature attributes of the personnel passage path sequence are extracted, and a preset clustering algorithm is used to divide each personnel passage path sequence into clusters. Based on the mean or median of the feature attributes of each cluster, a passage benchmark model corresponding to each cluster is constructed.

[0011] Input a single personnel passage path sequence into the passage benchmark model of the corresponding cluster, calculate the feature deviation of the path, and if the feature deviation exceeds a preset deviation threshold, mark the corresponding personnel passage path sequence as a suspicious path containing potentially abnormal subsequences.

[0012] Combining the shortest path length with the preset travel speed, the suspicious path is checked segment by segment to determine the rationality of the travel time of each segment. Unreasonable segments are identified as abnormal behavior segments, and a list of abnormal path segments is compiled.

[0013] Based on the list of abnormal path segments, the statistical personnel count the frequency of abnormal segments and the number of times the same type of abnormality is repeated within a preset observation period. When the frequency of abnormality exceeds the average level of the cluster and the number of repetitions reaches the set repetition threshold, it is included in the list of threatening personnel and an alarm record is automatically generated.

[0014] The core feature attributes include path length, travel time, and node jump frequency.

[0015] In one optional implementation, the step of collecting access control card swipe records, personnel identification, card swipe time, and corresponding access control nodes, and grouping them by personnel identification and sorting them in ascending order by card swipe time to obtain the passage time sequence of each person includes:

[0016] The access control data acquisition mechanism is activated to capture access control card swipe records and extract the personnel identifier, card swipe time, and corresponding access control node associated with the access control card swipe records.

[0017] Based on the extracted personnel identifiers, the verified access control card swipe records are classified, and the access control card swipe records and swipe times corresponding to the same personnel identifier are integrated into an independent data set;

[0018] Each independent data set is sorted in ascending order according to the time of card swipe to form the passage time sequence for each person.

[0019] In one optional implementation, the step of analyzing the physical connectivity between nodes based on the access control node, filtering physically directly passable node pairs, and constructing a weighted undirected passage topology graph includes:

[0020] Based on the access control nodes, combined with the physical layout of the building and the distribution of access channels, the physical connectivity between each access control node is analyzed one by one, and the pairs of nodes that can be directly accessed and the pairs of nodes that cannot be accessed are identified, thus forming the node connectivity analysis results.

[0021] Based on the node connectivity analysis results, access control node pairs that are physically directly accessible are selected, and node pairs that cannot be directly accessed are removed to obtain the effective access relationships between nodes.

[0022] Based on the effective access relationships between the nodes, each access control node is used as a vertex of the topology graph and the direct access relationships between nodes are used as edges. The weights of the edges are set in combination with the physical distance between the nodes to form the topology graph composition information.

[0023] Based on the topology graph composition information, a weighted undirected access topology graph is constructed.

[0024] In one optional implementation, the step of sequentially connecting the corresponding nodes at each time point on the traffic topology map according to the traffic time sequence to form a timestamped personnel traffic path sequence, and simultaneously recording the actual elapsed time of adjacent card-swiping events in the personnel traffic path sequence and the shortest path length of the corresponding nodes in the traffic topology map, includes:

[0025] Obtain the passage time series and the passage topology map, extract the access control node information corresponding to each time point in the passage time series, and establish the association mapping between time points and access control nodes;

[0026] Based on the aforementioned association mapping, the access control nodes corresponding to each time point are connected sequentially on the access topology map in chronological order to form a sequence of personnel access paths with timestamps.

[0027] Traverse the sequence of personnel access paths, extract the timestamps corresponding to two adjacent card swipe events, and calculate the actual elapsed time of the two card swipe events;

[0028] For the access control nodes corresponding to the two card swipe events, locate the corresponding node positions in the access topology map, and calculate and record the shortest path length between the two nodes.

[0029] In one optional implementation, the step of extracting the core feature attributes of the personnel passage path sequence and using a preset clustering algorithm to divide each personnel passage path sequence into clusters, and constructing a passage benchmark model corresponding to each cluster based on the mean or median of the feature attributes of each cluster, includes:

[0030] Traverse the personnel passage path sequence, extract the core feature attributes including path length, passage time and node jump frequency one by one, and normalize the extracted core feature attributes, remove redundant feature terms and integrate them to form a feature attribute set.

[0031] Based on the set of feature attributes, a preset clustering algorithm is invoked, and the clustering distance threshold and the initial range of the number of clusters are set.

[0032] The established clustering algorithm automatically classifies the travel path sequences of each person, divides them into clusters based on the similarity of the feature attribute set, and determines the path sequences contained in each cluster and the distribution range of cluster features.

[0033] For each cluster, feature attributes of all personnel travel path sequences within the cluster are extracted, and the mean or median of each feature attribute is calculated. The mean or median is used as the cluster feature benchmark, and combined with the common features of personnel travel path sequences within the cluster, a travel benchmark model corresponding to each cluster is constructed.

[0034] In one optional implementation, the step of inputting a single personnel passage path sequence into the passage benchmark model of the corresponding cluster, calculating the feature deviation of the path, and marking the corresponding personnel passage path sequence as a suspicious path containing potentially abnormal subsequences if the feature deviation exceeds a preset deviation threshold includes:

[0035] Obtain the sequence of individual personnel passage paths and determine the cluster to which they belong, and retrieve the passage benchmark model corresponding to the cluster;

[0036] The single path sequence is input into the corresponding traffic benchmark model, and the core feature attributes of the single path sequence are extracted and compared with the cluster feature benchmark in the corresponding traffic benchmark model to calculate the feature deviation.

[0037] A preset deviation threshold is retrieved, and the calculated feature deviation degree is compared with the preset deviation threshold. If the feature deviation degree exceeds the preset deviation threshold, the path sequence is marked as a suspicious path containing potentially abnormal subsequences.

[0038] In one optional implementation, the suspicious path is checked segment by segment by combining the shortest path length and the preset travel speed to determine the reasonableness of the travel time of each segment. Unreasonable segments are identified as abnormal behavior segments, and a list of abnormal path segments is compiled, including:

[0039] The suspicious path, the shortest path length, and the preset travel speed are obtained to determine the road segment range formed by each adjacent node in the suspicious path and the corresponding actual travel time.

[0040] Based on the shortest path length and preset travel speed of each road segment, the reasonable travel time range of each road segment is calculated, and the deviation range between the actual travel time and the reasonable travel time of each road segment is compared segment by segment, and the comparison results are output.

[0041] Based on the comparison results, the rationality of the travel time of each road segment is judged, and road segments whose actual travel time exceeds the reasonable travel time deviation range are identified as abnormal behavior segments.

[0042] Summarize all identified abnormal behavior segments, record the node information, actual passage time, and deviation range corresponding to each abnormal behavior segment, and form a list of abnormal path segments.

[0043] In one optional implementation, based on the list of abnormal path segments, the frequency of abnormal segments and the number of repetitions of the same type of abnormality within a preset observation period are statistically analyzed. When the frequency of abnormality exceeds the average level of its cluster and the number of repetitions reaches a set repetition threshold, the individual is added to the threat personnel list and an alarm record is automatically generated, including:

[0044] Obtain the list of abnormal path segments, the average level of abnormal frequency and the number of abnormal repetitions of the cluster to which the personnel belong, and associate the corresponding personnel information with the type identifier of the abnormal path segments;

[0045] Based on a preset observation period, the total frequency of occurrence of abnormal path segments for each person is counted according to the personnel dimension, and the number of repetitions of the same type of abnormality is counted according to the abnormality type, thus forming the personnel abnormality statistics results.

[0046] Based on the personnel anomaly statistics, the frequency of anomalies for each person is compared with the average level of their respective cluster, and the matching of the number of repetitions of the same type of anomaly with the set repetition threshold is checked.

[0047] When the frequency of an anomalies by a person exceeds the average level of their cluster and the number of repetitions of the same type of anomaly reaches a set threshold, the corresponding person will be added to the list of threat persons, and an alarm record containing the person's information, anomaly details, and the basis for the judgment will be automatically generated.

[0048] Secondly, the present invention also provides a machine learning-based access control data anomaly detection system, comprising:

[0049] Access sequence construction module: Collects access control card swipe records, personnel identification, card swipe time and corresponding access control node, and groups them by personnel identification and sorts them in ascending order by card swipe time to obtain the access time sequence of each person;

[0050] Topology graph construction module: Based on the access control nodes, analyze the physical connectivity between nodes, filter the nodes that can pass through each other physically, and construct a weighted undirected passage topology graph;

[0051] Path sequence generation module: Based on the passage time sequence, it sequentially connects the corresponding nodes of each time point on the passage topology map to form a personnel passage path sequence with timestamps, and records the actual elapsed time of adjacent card swipe events in the personnel passage path sequence and the shortest path length of the corresponding nodes in the passage topology map;

[0052] The benchmark model construction module extracts the core feature attributes of the personnel passage path sequence and uses a preset clustering algorithm to divide each personnel passage path sequence into clusters. Based on the mean or median of the feature attributes of each cluster, a passage benchmark model corresponding to each cluster is constructed.

[0053] Suspicious Path Marking Module: Input a single personnel passage path sequence into the passage benchmark model of the corresponding cluster, calculate the feature deviation of the path, and if the feature deviation exceeds a preset deviation threshold, mark the corresponding personnel passage path sequence as a suspicious path containing potentially abnormal subsequences;

[0054] Abnormal road segment verification module: Combining the shortest path length and preset travel speed, the module verifies each segment of the suspicious path, determines the rationality of the travel time of each segment, identifies unreasonable segments as abnormal behavior segments, and compiles them into a list of abnormal path segments.

[0055] Threat Personnel Determination Module: Based on the list of abnormal path segments, the module counts the frequency of abnormal segments and the number of times the same type of abnormality is repeated within a preset observation period. When the frequency of abnormality exceeds the average level of the cluster and the number of repetitions reaches the set repetition threshold, the module is added to the list of threat personnel and an alarm record is automatically generated.

[0056] The core feature attributes include path length, travel time, and node jump frequency.

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] (1) Achieve accurate profiling and personalized adaptation of traffic behavior. By extracting the core feature attributes of the traffic path sequence, clustering algorithms are used to divide the traffic into clusters, and a traffic benchmark model is constructed based on the mean or median of the cluster features. This process avoids the limitations of traditional fixed detection rules in adapting to diverse traffic behaviors, allowing the anomaly detection standard to fit the traffic habits of different groups, and greatly improving the relevance and adaptability of the detection standard.

[0059] (2) Achieving accurate location and source tracing of anomalies across multiple dimensions. A three-tiered progressive detection logic is constructed: "path feature deviation screening - road segment travel time verification - personnel anomaly frequency statistics". First, suspicious paths are identified through a benchmark model. Then, abnormal road segments are verified segment by segment in combination with the shortest path length and preset travel speed. Finally, the frequency and number of repetitions of anomalies are counted. This mechanism solves the shortcomings of traditional detection, which only focuses on a single dimension and has difficulty in anomaly source tracing. It provides clear guidance for safety handling and improves the accuracy of anomaly location.

[0060] (3) Achieve efficient identification and false alarm control of risky behaviors. Based on the list of abnormal path segments, a dual judgment standard of "average level of the cluster + repetition threshold of the same type of abnormality" is adopted to count the frequency and number of repetitions of abnormalities within a preset observation period. This process effectively filters out accidental behavioral deviations, accurately identifies high-frequency repetitive anomalies with potential security risks, solves the problems of high false alarm rate and difficulty in distinguishing between accidental deviations and malicious anomalies in traditional detection, and significantly improves the reliability of security monitoring.

[0061] (4) Possesses dynamic adaptation and continuous optimization capabilities. Relying on the adaptability of machine learning algorithms, the access baseline model can dynamically update cluster features and detection parameters as personnel access habits change and access control layout is adjusted, without the need for frequent manual rule adjustments. This feature solves the defect of traditional fixed detection rules lagging behind changes in actual scenarios, ensuring that the system maintains high detection accuracy throughout long-term operation and adapts to the long-term use needs of access control systems.

[0062] (5) Achieve accurate and efficient preliminary screening of anomalies. By extracting core features such as path length, travel time, and node jump frequency, the feature deviation between a single path sequence and the corresponding cluster benchmark model is calculated, and suspicious paths are quickly marked. This process avoids the inefficiency caused by traditional broad screening, improves the overall efficiency of anomaly detection while ensuring the accuracy of screening, and lays the foundation for subsequent refined verification. Attached Figure Description

[0063] Figure 1 This is a flowchart illustrating a machine learning-based access control data anomaly detection method provided in an embodiment of the present invention.

[0064] Figure 2 This is a schematic diagram of the structure of an access control data anomaly detection system based on machine learning provided in an embodiment of the present invention. Detailed Implementation

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0066] Reference Figure 1 This invention provides a machine learning-based method for detecting anomalies in access control data, comprising the following steps:

[0067] S11: Collect access control card swipe records, personnel identification, card swipe time and corresponding access control node, and group them by personnel identification and sort them in ascending order by card swipe time to obtain the passage time sequence of each person;

[0068] S12, Based on the access control node, analyze the physical connectivity between nodes, filter out node pairs that can pass directly in physical terms, and construct a weighted undirected passage topology graph;

[0069] S13, according to the passage time sequence, connect the corresponding nodes of each time point in sequence on the passage topology map to form a personnel passage path sequence with timestamps, and at the same time record the actual elapsed time of adjacent card swipe events in the personnel passage path sequence and the shortest path length of the corresponding node in the passage topology map;

[0070] S14, extract the core feature attributes of the personnel passage path sequence, and use a preset clustering algorithm to divide each personnel passage path sequence into clusters. Based on the mean or median of the feature attributes of each cluster, construct the passage benchmark model corresponding to each cluster.

[0071] S15, input the single personnel passage path sequence into the passage benchmark model of the corresponding cluster, calculate the feature deviation degree of the path, and if the feature deviation degree exceeds the preset deviation threshold, mark the corresponding personnel passage path sequence as a suspicious path containing potential abnormal subsequences.

[0072] S16. Combining the shortest path length with the preset travel speed, the suspicious path is checked segment by segment to determine the rationality of the travel time of each segment. Unreasonable segments are identified as abnormal behavior segments, and a list of abnormal path segments is compiled.

[0073] S17. Based on the list of abnormal path segments, the frequency of abnormal segments and the number of times the same type of abnormality is repeated within the preset observation period are counted. When the frequency of abnormality exceeds the average level of the cluster and the number of repetitions reaches the set repetition threshold, the personnel are included in the list of threat personnel and an alarm record is automatically generated.

[0074] In step S11, access control card swipe records, personnel identification, card swipe time and corresponding access control node are collected, and the data are grouped by personnel identification and sorted in ascending order by card swipe time to obtain the passage time sequence of each person.

[0075] In one implementation, this embodiment relies on the access control security monitoring system of a large office park. The park deploys 15 access control terminals (hereinafter referred to as "access control nodes"), covering core areas such as office building entrances, floor corridors, and meeting rooms. The access control system adopts contactless IC card verification technology, paired with an AC-8000 access control controller (supporting RS485 communication interface, data transmission rate of 9600bps), which can complete data capture and storage within 1 second after a card swipe event is triggered, ensuring the real-time nature and integrity of the original data.

[0076] After the access control data acquisition mechanism is activated, the access control controller continuously captures the raw data of each card swipe event through the communication link with each access control terminal. The data is stored in JSON format on the local server in the park. Each piece of raw data contains four core fields: "card_id" (unique IC card identifier), "swipe_time" (card swipe time, in the format "YYYY-MM-DD HH:MM:SS"), "device_id" (access control device number), and "node_coordinate" (access control node, set based on the park's plane coordinate system, unit: meters). When extracting key information from the raw data, "card_id" is converted into a unified personnel identifier: employee identifiers are standardized as "EMP-XXX" (XXX is a 3-digit number), short-term visitor identifiers are "VIS-S-XXX", and long-term visitor identifiers are "VIS-L-XXX", ensuring clear differentiation of personnel identities; at the same time, the card swipe time and corresponding access control node are extracted, where the access control node is a preset fixed value, for example, the coordinates of the access control at the entrance of the office building on the 1st floor (device_id:D001) are (12.5, 30.8), the coordinates of the access control at the R&D department passage on the 3rd floor (device_id: D007) are (45.2, 28.6), and the coordinates of the access control at the entrance of the underground parking garage (device_id: D12) are (8.3, 15.9).

[0077] To ensure the accuracy of subsequent data processing, the extracted information needs to be verified for completeness: First, the personnel identification format is verified, and invalid data that does not conform to the preset specifications is removed, such as two data entries identified as "EMP-12" (less than 3 digits) and "VIS-567" (without the "S" or "L" type prefix); Second, the reasonableness of the card swipe time is verified, and abnormal records with future times or deviations from the system time exceeding 10 minutes are excluded. In this collection period, a total of 3 invalid data entries caused by the clock deviation of the access control terminal were removed; Third, the validity of the access control nodes is verified, confirming that the extracted coordinates all belong to the preset set of 15 access control nodes, and no invalid coordinate data was found in this collection.

[0078] Based on the verified personnel identification, all valid card-swipe records are categorized and aggregated. All card-swipe records corresponding to the same personnel identification are integrated into an independent data set to ensure centralized management of access data for a single individual. For example, employee "EMP-089" (R&D department employee) has 42 valid card-swipe records within a 30-day collection period, covering all scenarios of access behavior, including entering the park during the morning peak, moving between floors, using meeting rooms, having lunch, and leaving the park during the evening peak. Short-term visitor "VIS-S-156" (visit for technical exchange) has 3 valid card-swipe records, corresponding to access events at the office building entrance, the second-floor meeting room, and the office building exit, clearly reflecting the complete trajectory of a single visit.

[0079] Each independent dataset is sorted in ascending order according to the time of card swipe. Timestamp comparison is used to ensure that the data arrangement is completely consistent with the actual passage time of the personnel, thus forming the passage time sequence of each person. Taking the access time sequence of "EMP-089" on a certain workday as an example, its specific format is as follows: Card swipe time "2024-06-01 08:07:23" corresponds to access control node D001 (12.5, 30.8); card swipe time "2024-06-01 08:10:15" corresponds to access control node D007 (45.2, 28.6); card swipe time "2024-06-01 10:30:42" corresponds to access control node D009 (52.8, 40.3); card swipe time "2024-06-01 12:05:18" corresponds to access control node D010 (38.6, 35.7); card swipe time "2024-06-01 17:50:36" corresponds to access control node D001. (12.5, 30.8). This sequence fully reconstructs the passage trajectory of "EMP-089" on that day, providing structured data support for subsequent passage topology map construction, path sequence generation, and refined access management.

[0080] In step S12, based on the access control node, the physical connectivity between nodes is analyzed, and node pairs that can pass through each other physically are selected to construct a weighted undirected passage topology graph.

[0081] In one embodiment, taking into account the 15 access control nodes and the constructed personnel passage time sequence collected in step S11, this embodiment completes the construction of a weighted undirected passage topology map based on the spatial location information of each access control node and combined with the physical layout of the park buildings and the distribution of passage channels. This provides a spatial topology basis for the subsequent generation of personnel passage path sequences and anomaly detection, while also adapting to the spatial control requirements of park access management.

[0082] Based on the preset coordinates of 15 access control nodes (such as D001(12.5, 30.8), D002(18.3, 32.1), D007(45.2, 28.6), D12(8.3, 15.9), etc.), a node connectivity analysis was conducted in conjunction with the physical layout of the park's buildings and the distribution of access routes. The maximum effective length of direct access routes within the park was set to 60 meters. Simultaneously, based on the building floor plan, it was determined whether there were physical obstacles such as walls, elevator shafts, or equipment rooms between two access control nodes: if the straight-line distance between two nodes was ≤60 meters and there were no physical obstacles, it was determined that direct passage was possible; if the straight-line distance exceeded 60 meters or there were insurmountable physical obstacles, it was determined that passage was not possible. For example, the straight-line distance between D001(12.5,30.8) (the entrance to the office building on the 1st floor) and D002(18.3,32.1) (the lobby passage on the 1st floor) is calculated to be 5.9 meters. The two are in an open lobby passage with no physical obstructions, so they are considered to be directly passable. The straight-line distance between D007(45.2,28.6) (the passage to the R&D department on the 3rd floor) and D12(8.3,15.9) (the entrance to the underground parking garage) is 38.7 meters, but they need to pass through the 3rd floor floor slab, the stairwell between the 1st and 2nd floors, and the firewall of the underground parking garage, which presents multiple physical obstructions, so they are considered to be not passable. Although the straight-line distance between D003(12.8,35.2) (the elevator hall on the 1st floor) and D008(12.8,40.5) (the elevator hall on the 2nd floor) is only 3.2 meters, they need to be connected by an elevator and there is no direct pedestrian passage, so they are also considered to be not passable. Following the above rules, the physical connectivity between all access control nodes was analyzed one by one. A total of 32 sets of direct access node associations and 88 sets of inaccessible node associations were identified, forming a complete node connectivity analysis result. This result is stored in the form of a two-dimensional association matrix, where "1" represents direct access and "0" represents inaccessibility.

[0083] Based on the node connectivity analysis results, 32 pairs of physically directly passable access control nodes were selected, while 88 pairs of impassable nodes were simultaneously removed, resulting in valid node access relationships. Each valid access relationship is recorded in a structured format of "node device number + node coordinates - corresponding node device number + corresponding node coordinates", such as "D001(12.5,30.8)-D002(18.3,32.1)", "D002(18.3,32.1)-D003(25.6,38.9)", "D007(45.2,28.6)-D008(48.5,35.1)", etc., ensuring that the association information of each directly passable node pair is complete and traceable.

[0084] Each access control node is used as a vertex in the graph, and the direct passage relationships between nodes are used as edges. Edge weights are assigned based on the physical distance between nodes, with the weight value equal to the straight-line distance between two nodes (unit: meters). The specific calculation uses the formula for the distance between two points in a Cartesian coordinate system: Where (x1, y1) are the coordinates of the previous node, and (x2, y2) are the coordinates of the next node. For example, the straight-line distance between D001 (12.5, 30.8) and D002 (18.3, 32.1) is calculated to be 5.9 meters, so the weight of the corresponding edge is set to 5.9; the straight-line distance between D007 (45.2, 28.6) and D008 (48.5, 35.1) is calculated to be 7.25 meters, so the weight of the corresponding edge is set to 7.25. Through the above calculations, the edge weights corresponding to all valid passage relationships are configured, forming a complete topology graph structure containing vertices, edges, and weights.

[0085] The topology graph structure information is imported into a graph theory analysis tool (using Python's networkx library) to construct a weighted undirected access topology graph. This graph uses vertices to identify access control nodes (vertices are labeled with access control device numbers), undirected edges to indicate direct access relationships between nodes, and edge weights to indicate physical distances between nodes. It visually presents the connectivity and spatial distance relationships of all access control nodes within the park, providing visual support for path permission control in access management. For example, the shortest path from D001(12.5,30.8) to D008(48.5,35.1) is, according to the topology analysis, D001(12.5,30.8)→D002(18.3,32.1)→D003(25.6,38.9)→D008(48.5,35.1). The total path weight (total length) is 5.9(D001-D002)+7.3(D002-D003)+6.5(D003-D008)=19.7 meters. This topology map can be directly used for subsequent operations such as generating personnel travel path sequences, calculating the shortest path length, and checking abnormal road sections.

[0086] In step S13, according to the passage time sequence, the nodes corresponding to each time point are connected sequentially on the passage topology map to form a personnel passage path sequence with timestamps. At the same time, the actual elapsed time of adjacent card swipe events in the personnel passage path sequence and the shortest path length of the corresponding node in the passage topology map are recorded.

[0087] In one implementation, the topology map of 15 access control nodes (including vertex, edge and weight information) constructed in step S12, as well as the passage time sequence of each person (such as the structured time series data of employee "EMP-089" and short-term visitor "VIS-S-156"), is used to generate a time-stamped personnel passage path sequence by associating the time series data with the spatial topology information. The actual elapsed time of adjacent card swipe events and the shortest path length between nodes are accurately recorded, providing core basic data for feature extraction, anomaly detection and access management decisions of subsequent machine learning models.

[0088] First, the passage time series and complete passage topology map for all personnel are obtained. Two types of structured data are accessed via a data interface: the passage time series are stored as a structured list, with each entry containing fields such as "Personnel Identifier," "Card Swipe Time," "Access Control Node Number," and "Access Control Node Coordinates"; the passage topology map is stored as a graph structure, containing a set of vertices (access control node coordinates and device numbers), a set of edges (directly accessible node pairs), and edge weights (straight-line distances between nodes). For each passage time series, the access control node information (including device number and coordinates) corresponding to each time point is extracted, establishing a mapping between "Card Swipe Time - Access Control Node Number - Access Control Node Coordinates" to ensure accurate binding of time and spatial information. Taking the passage time sequence of short-term visitor "VIS-S-156" as an example, the specific mapping is as follows: the card swipe time "2024-06-03 09:15:28" corresponds to access control node D001 (12.5, 30.8), the card swipe time "2024-06-03 09:18:05" corresponds to access control node D009 (52.8, 40.3), and the card swipe time "2024-06-03 11:30:12" corresponds to access control node D001 (12.5, 30.8). The mapping relationship is stored through a hash table, which supports efficient querying and provides fast data support for the subsequent path sequence generation.

[0089] Based on the above association mapping, the access control nodes corresponding to each time point are connected sequentially on the access topology map according to the order of card swipe time, forming a personnel access path sequence with timestamps. The path sequence of “VIS-S-156” is presented in the form of a time-series link, as follows: 09:15:28 Pass through to D001(12.5,30.8) → 09:18:05 Pass through to D009(52.8,40.3) → 11:30:12 Return to D001(12.5,30.8). The link clearly marks the passage time and spatial coordinates of each node, completely restoring the actual passage trajectory. Moreover, the structure is simple and easy to traverse and calculate, providing a basis for trajectory tracing in access management.

[0090] Then, the entire path sequence of all personnel is traversed. For each sequence, the timestamps corresponding to two adjacent card swipe events are extracted one by one. The actual elapsed time is calculated using the time difference method and recorded in the link attribute of the path sequence. The timestamp format is uniformly "YYYY-MM-DD HH:MM:SS". During calculation, it is first converted to Unix timestamps (second-level precision), and then the time interval is obtained through difference calculation. Taking the path sequence "VIS-S-156" as an example, the timestamps of the first group of adjacent card swipe events are converted to 1685764528 seconds (09:15:28) and 1685764685 seconds (09:18:05), with a time difference of 157 seconds (2 minutes and 37 seconds); the timestamps of the second group of adjacent timestamps are converted to 1685764685 seconds and 1685772612 seconds (11:30:12), with a time difference of 7927 seconds (2 hours, 12 minutes, and 7 seconds). The calculated actual elapsed time is bound to the corresponding link segment to form an association record of "previous node - subsequent node - actual elapsed time", ensuring accurate matching of time parameters and path segments.

[0091] Finally, for each group of adjacent card-swiping events corresponding to the access control nodes, the vertex positions of the access control nodes in the access topology graph are located. The shortest path algorithm (Dijkstra's algorithm) in graph theory is called to calculate the shortest path length between the two nodes and record it in the link attribute. The core logic of Dijkstra's algorithm is: taking the starting node as the source node, traversing all reachable nodes in the topology graph, calculating the shortest path from the source node to each node based on the edge weight (physical distance), and terminating at the target node. Taking the first pair of adjacent nodes D001(12.5,30.8) and D009(52.8,40.3) in the path sequence “VIS-S-156” as an example, after locating the two nodes in the topology graph, the algorithm automatically retrieves all reachable paths: D001(12.5,30.8)→D002(18.3,32.1)→D003(25.6,38.9)→D009(52.8,40.3) (total weight 5.9+7.3+6.5=19.7 meters), D001(12.5,30.8)→D004(20.1,28.5)→D008(48.5,35.1)→D009(52.8,40.3) (total weight 8.2+9.1+7.8=25.1 meters). The shortest path length was determined by considering factors such as distance (in meters), and the path with the lowest weight (19.7 meters) was selected as the shortest path. The shortest path between the second group of adjacent nodes D009 (52.8, 40.3) and D001 (12.5, 30.8) was the same as the forward path, also with a length of 19.7 meters. After binding the calculation results with the corresponding link segments, each path segment contained two core parameters: "actual elapsed time" and "shortest path length." This provided direct data support for subsequent machine learning models to extract features such as "average travel speed" and "path time deviation," ensuring the completeness and accuracy of the model input data. It also provided a quantitative basis for identifying abnormal behavior in access management.

[0092] In step S14, the core feature attributes of the personnel passage path sequence are extracted, and a preset clustering algorithm is used to divide each personnel passage path sequence into clusters. Based on the mean or median of the feature attributes of each cluster, a passage benchmark model corresponding to each cluster is constructed.

[0093] In one implementation, the system takes the 1280 personnel access path sequences generated in step S13 (covering 1200 employees and 80 visitors in the park; each sequence includes complete parameters such as path segments, actual travel time, and shortest path length). This embodiment relies on machine learning technology to complete core feature extraction, unsupervised clustering classification, and access benchmark model construction, providing quantitative judgment basis for subsequent anomaly detection. The entire process follows the requirements for sufficiency of disclosure of machine learning algorithms in the latest patent examination guidelines, clearly defining the algorithm type, parameter settings, optimization logic, and implementation details, while adapting to the differentiated control needs of different groups in access management.

[0094] First, core feature extraction and data preprocessing were carried out. All travel path sequences were traversed, and three core feature attributes were extracted for each sequence to ensure that the features accurately represent the patterns of personnel travel behavior: Path length is the sum of the shortest path lengths of all adjacent nodes in the sequence (unit: meters). For example, the path length of a certain path sequence for employee "EMP-089" is 5.9 meters (D001(12.5,30.8)→D002(18.3,32.1)) + 8.2 meters (D002(18.3,32.1)→D007(45.2,28.6)) + 6.5 meters (D007(45.2,28.6)→D009(52.8,40.3)) + 12.3 meters (D009(52.8,40.3)→D001(12.5,30.8)) = 32.9 meters. Meters; the passage time is the time difference between the first and last card swipe events in the sequence (unit: minutes). The passage time for the path sequence "EMP-089" is 17:50:36 - 08:07:23 = 583 minutes; the node jump frequency is the number of times different access control nodes are switched in the sequence. The jump frequency for the path sequence "EMP-089" is 4 times (D001(12.5,30.8)→D002(18.3,32.1)→D007(45.2,28.6)→D009(52.8,40.3)→D001(12.5,30.8)). For the three types of extracted feature attributes, standardization processing is performed before training the machine learning model. The Min-Max standardization method is used to map each feature value to the [0,1] interval to eliminate the difference in units. The standardization formula is as follows:

[0095]

[0096] Among them, X norm X represents the standardized feature values, and X represents the original feature values. min X is the minimum value of this feature across all path sequences. maxThis represents the maximum value of the feature across all path sequences. For example, the original path length is 32.9 meters, which, after standardization, is (32.9-5.2) / (86.7-5.2)≈0.34. Pearson correlation coefficient analysis of feature association shows that the correlation coefficients for the three types of features are 0.62 for path length and travel time, 0.58 for path length and node jump frequency, and 0.49 for travel time and node jump frequency, all less than 0.7, indicating no redundant features and no need for removal. The Isolation Forest algorithm is used to detect and remove 12 path sequences containing abnormal features (such as abnormal data where the path length exceeds the normal range by 3 times). Finally, a 1268×3 feature attribute matrix is ​​formed (rows represent path sequences, and columns represent the three core features) to ensure the quality of the data input to the machine learning model.

[0097] Based on the preprocessed feature attribute matrix, the preset unsupervised machine learning K-means clustering algorithm is called to automatically classify all path sequences. This algorithm achieves intelligent grouping of unlabeled access data by iteratively optimizing the cluster center, which is suitable for the scenario requirement of "no preset classification standard and natural clustering based on data features" and fits the logic of differentiated control by group in access management. The key parameters and optimization criteria during clustering are as follows: Euclidean distance is used to quantify the similarity between feature vectors of path sequences; the initial range of the number of clusters is set to 3-6. The Elbow Method is used to analyze the trend of the sum of squared errors (SSE) with the number of clusters. When the number of clusters increases from 3 to 4, the SSE decreases by 35%, and when it increases from 4 to 5, the SSE decreases by only 8%. Therefore, the optimal number of clusters is determined to be 4; the clustering distance threshold is set to Euclidean distance ≤ 0.25 to determine whether a path sequence belongs to a certain cluster center; to avoid local optima, the algorithm initialization uses the K-means++ strategy to optimize the selection of the initial cluster centers, and the number of iterations is set to 100 to ensure that the clustering results are stable and reliable.

[0098] After clustering, four clusters with clear physical meanings are output. The distribution range and path sequences of each cluster are as follows: Cluster 1 (core employee group) contains 820 path sequences, corresponding to 580 core employees. Its characteristics include long path length (mean 42.3 meters), stable travel time (mean 215 minutes), and high node jump frequency (mean 7.8 times). The travel scenarios cover multiple core areas such as the R&D department, meeting rooms, and server rooms, and the highest access management privileges are granted. Cluster 2 (ordinary employee group) contains 310 path sequences, corresponding to 410 ordinary employees. Its characteristics include medium path length (mean 28.6 meters), moderate travel time (mean 132 minutes), and moderate node jump frequency (mean 4.5 times). The travel scenarios mainly cover office areas, canteens, and elevator lobbies, and the moderate access management privileges are granted. Cluster 3 (short-term visitor group) contains 78 path sequences, corresponding to 48 short-term visitors. Its characteristics include short path length (mean 15.7 meters). The first group (12-18 meters) has short travel time (average 45 minutes) and low node jump frequency (average 2.2 times). The travel scenarios are mostly single paths of "entrance → meeting room → exit". Access management permissions are restricted. Based on kernel density estimation (KDE), the probability density of path length in the range of 12-18 meters is 70%. The second group (long-term visitor group) contains 28 path sequences, corresponding to 22 long-term visitors. Its characteristics are medium path length (average 26.8 meters), unstable travel time (average 98 minutes), and medium node jump frequency (average 3.7 times). The travel scenarios cover office areas and cooperative department areas. Access management permissions are between those of ordinary employees and short-term visitors.

[0099] Finally, a unique access benchmark model is constructed for each cluster. This model is a machine learning statistical model that learns the characteristic patterns of normal access paths within the cluster to form a judgment benchmark, providing a quantitative standard for defining abnormal behavior in access management. The specific construction process is as follows: Extract three types of core feature attribute data for all path sequences within each cluster, and calculate the mean (to characterize the cluster feature central tendency) and standard deviation (to characterize the cluster feature dispersion) of each feature attribute. For example, the feature benchmarks for cluster 3 (short-term visitor group) are: mean path length 15.7 meters (standard deviation 3.2 meters), mean travel time 45 minutes (standard deviation 8.5 minutes), and mean node jump frequency 2.2 times (standard deviation 0.6 times). To improve the model's generalization ability, the kernel density estimation (KDE) method is introduced to construct the probability density distribution function of each feature, describing the distribution pattern of the feature within the cluster. For example, the probability density of path length in the 12-18 meter range in cluster 3 reaches 70%. Combined with the common features of path sequences within the cluster (such as cluster 1...), The passage time is concentrated on weekdays from 9:00 to 18:00 (the path of cluster 3 does not jump across floors). The feature benchmark, standard deviation, probability density distribution function and common rules are integrated to form a unique passage benchmark model for each cluster. The model storage format is "cluster identifier - feature benchmark vector - feature standard deviation vector - feature probability density distribution model - common rules", which ensures that it can be quickly called and compared during subsequent anomaly detection.

[0100] In step S15, a single personnel passage path sequence is input into the passage benchmark model of the corresponding cluster, and the characteristic deviation degree of the path is calculated. If the characteristic deviation degree exceeds a preset deviation threshold, the corresponding personnel passage path sequence is marked as a suspicious path containing potentially abnormal subsequences.

[0101] In one implementation, building upon the four cluster access benchmark models constructed in step S14 (including core employee group, ordinary employee group, short-term visitor group, and long-term visitor group; the models include feature benchmark vectors, standard deviation, probability density distribution, and common rules), this embodiment focuses on anomaly screening of single personnel access path sequences. Through machine learning-driven cluster affiliation determination, feature deviation calculation, and threshold comparison, suspicious path marking is completed. The algorithm logic, parameter settings, and calculation details are clearly defined throughout the process, providing accurate support for risk warning in access management.

[0102] First, obtain the sequence of a single personnel passage path to be detected. Taking a passage path of a short-term visitor "VIS-S-218" in the park as an example, this sequence is generated in real time through the access control system. The specific passage trajectory is as follows: 10:05:33 Pass through D001(12.5,30.8) → 10:08:17 Pass through D009(52.8,40.3) → 13:45:22 Pass through D012(68.3,22.5) → 14:10:15 Return to D001(12.5,30.8). According to the core feature extraction criteria set in step S14, three core feature attributes were extracted from the sequence: path length, travel time, and node jump frequency. The path length is D001(12.5,30.8)→D009(52.8,40.3) (41.2 meters) + D009(52.8,40.3)→D012(68.3,22.5) (18.7 meters) + D012(68.3,22.5)→D001(12.5,30.8) (56.3 meters) = 116.2 meters; the travel time is 14:10:15 - 10:05:33 = 244 minutes and 42 seconds (244.7 minutes); the node jump frequency is 3. The sequence is (D001(12.5,30.8)→D009(52.8,40.3)→D012(68.3,22.5)→D001(12.5,30.8)). The extracted feature attributes are normalized using the same Min-Max standardization process as during the model training phase, mapping them to the [0,1] interval, resulting in a normalized feature vector of [0.92, 0.17, 0.18].

[0103] Next, the cluster to which the path sequence belongs is determined. The K-Nearest Neighbors (KNN) classification algorithm from machine learning is used to determine cluster affiliation. This algorithm calculates the distance between the sample to be detected and the centers of each cluster, assigning the sample to the nearest cluster. This aligns with the requirement of "classification based on feature similarity" and also fits the logic of group-based control in access management. The algorithm parameters are set as follows: K is set to 3 (determined based on cross-validation to balance classification accuracy and noise resistance), Euclidean distance is used as the distance metric, and the weights are set to a distance-weighted mode where "the closer the distance, the greater the weight." The Euclidean distances between the feature vector to be detected [0.92, 0.17, 0.18] and the feature vectors of the four cluster centers are calculated: the distance to the center of cluster 1 (core employee group) is: The distance to the center of cluster 2 (ordinary employees) is approximately 0.83, the distance to the center of cluster 3 (short-term visitors) is approximately 0.76, and the distance to the center of cluster 4 (long-term visitors) is approximately 0.81. Since the distance to cluster 3 is the smallest, and two of the three nearest neighbor samples belong to cluster 3, the cluster to which this path sequence belongs is determined to be the short-term visitor cluster. The access baseline model corresponding to cluster 3 is retrieved through the model call interface. The core parameters of the model are: feature baseline vector [0.28, 0.15, 0.12] (the mean of standardized path length, travel time, and node jump frequency), feature standard deviation vector [0.08, 0.06, 0.05], and common rule "the path has no cross-floor jumps, and the travel time is ≤60 minutes". This rule matches the access management permissions of short-term visitors.

[0104] The path sequence is input into the travel baseline model of cluster 3, and the model automatically triggers the feature comparison and deviation calculation process. The feature deviation is calculated using weighted Euclidean distance, and the weight allocation is determined based on the discriminative power (information gain) of each feature within the cluster: path length weight 0.4, travel time weight 0.4, and node jump frequency weight 0.2. The weighted Euclidean distance formula is as follows:

[0105]

[0106] Where Deviation is the feature deviation degree, n is the number of core features (n=3 in this embodiment), and w i Let x be the weight of the i-th feature. i μ is the standardized value of the i-th feature in the path sequence to be detected. i is the standardized mean of the i-th feature in the cluster baseline model.

[0107] The calculation process by substituting the parameters is as follows:

[0108] Path length deviation: ;

[0109] Travel time deviation item: ;

[0110] Node jump frequency deviation term: ;

[0111] .

[0112] Subsequently, the preset deviation threshold set for cluster 3 was retrieved. This threshold was determined by statistically analyzing the characteristic deviation distribution of all normal path sequences within cluster 3: the kernel density estimation (KDE) method was used to fit the probability distribution of deviation of normal paths, and the 95th quantile of the distribution was taken as the threshold. This ensures that the false positive rate of normal paths is less than 5%, while effectively capturing abnormal paths. The calculated 95th quantile of the characteristic deviation for cluster 3 is 0.35, meaning the preset deviation threshold is set to 0.35. The calculated characteristic deviation of 0.406 is compared with the preset threshold of 0.35. Since 0.406 > 0.35, and the path sequence also violates the common rule of "travel time ≤ 60 minutes" for cluster 3 (conflicting with short-term visitor access management permissions), the model determines that the path sequence contains a potentially abnormal subsequence, automatically marking it as a suspicious path, and recording the deviation calculation result, threshold, and violation rule, providing tracing information for subsequent abnormal road segment verification.

[0113] In step S16, the suspicious path is checked segment by segment by combining the shortest path length and the preset travel speed to determine the rationality of the travel time of each segment. Unreasonable segments are identified as abnormal behavior segments, and a list of abnormal path segments is compiled to provide accurate abnormal behavior tracing basis for subsequent identification of threat personnel and access management.

[0114] In one embodiment, the suspicious path (the travel path sequence of short-term visitor "VIS-S-218") marked in step S15, as well as the core parameters such as the shortest path length and actual travel time of each adjacent node recorded in the path sequence, are used to conduct a detailed segment-by-segment verification of the suspicious path by combining a preset travel speed. Unreasonable travel segments are identified and a list of abnormal path segments is compiled, providing accurate abnormal behavior tracing basis for subsequent threat personnel identification.

[0115] First, obtain the marked suspicious paths, the shortest path length for each road segment, and the preset travel speed. The suspicious route is the complete travel trajectory of "VIS-S-218", which is divided into three segments: the first segment is D001(12.5,30.8)→D009(52.8,40.3), the second segment is D009(52.8,40.3)→D012(68.3,22.5), and the third segment is D012(68.3,22.5)→D001(12.5,30.8). The core parameters of each segment are as follows: the shortest path length of the first segment is 41.2 meters, and the actual travel time is 10:08:17 - 10:05:33 = 2 minutes and 44 seconds (164 seconds); the shortest path length of the second segment is 18.7 meters, and the actual travel time is 13:45:22 - 10:08:17 = 3 hours, 37 minutes and 5 seconds (13025 seconds). The shortest path length for the third segment is 56.3 meters, and the actual travel time is 14:10:15 - 13:45:22 = 24 minutes and 53 seconds (1493 seconds). The preset travel speed is set at 1.2 meters per second based on the survey results of normal walking speed of people in the park. Considering the individual differences in walking speed and the influence of the environment, a fluctuation range of ±30% is allowed. The reasonable travel time range is calculated by the following formula:

[0116]

[0117]

[0118] Among them, T low The lower limit of reasonable passage time (unit: seconds), T high The maximum reasonable travel time is defined as follows: L is the shortest path length of the road segment (unit: meters), v is the preset travel speed (unit: meters / second), and α is the floating ratio (α=0.3 in this embodiment).

[0119] Based on the above formula, the reasonable travel time range for each road segment is calculated as follows:

[0120] First segment: Baseline reasonable time = 41.2 m ÷ 1.2 m / s ≈ 34.3 seconds, reasonable passage time range is 34.3 × (1 - 0.3) ≈ 24.0 seconds to 34.3 × (1 + 0.3) ≈ 44.6 seconds;

[0121] Second section: Baseline reasonable time = 18.7 m ÷ 1.2 m / s ≈ 15.6 seconds, reasonable passage time range is 15.6 × (1 - 0.3) ≈ 10.9 seconds to 15.6 × (1 + 0.3) ≈ 20.3 seconds;

[0122] The third section: The baseline reasonable time = 56.3 meters ÷ 1.2 meters / second ≈ 46.9 seconds, and the reasonable passage time range is 46.9×(1-0.3)≈32.8 seconds to 46.9×(1+0.3)≈61.0 seconds.

[0123] After calculation, the reasonable travel time range for each road segment is associated with and stored with the road segment information, forming structured data of "road segment identifier - shortest path length - baseline reasonable time - reasonable time range," providing a clear basis for segment-by-segment comparison. The actual travel time is compared with the reasonable travel time range segment by segment in sequence to determine the reasonableness of each segment's travel time: The first segment's actual travel time was 164 seconds, far exceeding the reasonable time limit of 44.6 seconds, a significant deviation, and was therefore determined to be unreasonable; the second segment's actual travel time was 13025 seconds, a huge difference from the reasonable time limit of 20.3 seconds, completely inconsistent with normal travel logic, and was also determined to be unreasonable; the third segment's actual travel time was 1493 seconds, similarly far exceeding the reasonable time limit of 61.0 seconds, and was also determined to be unreasonable.

[0124] During the comparison process, the time deviation of each road segment was recorded simultaneously. The deviation rate was calculated as (actual travel time - baseline reasonable time) ÷ baseline reasonable time × 100%. The deviation rate for the first segment was (164 - 34.3) ÷ 34.3 × 100% ≈ 378.1%, for the second segment it was (13025 - 15.6) ÷ 15.6 × 100% ≈ 83393.6%, and for the third segment it was (1493 - 46.9) ÷ 46.9 × 100% ≈ 3083.4%. The quantitative results of the deviation rates further verified the degree of abnormality in the travel time of each road segment. Based on the comparison results and deviation analysis, all three road segments were identified as abnormal behavior segments, and anomaly markers and deviation rate attributes were added to each abnormal segment. This achieved accurate marking of abnormal road segments and provided clear guidance for anomaly tracing in access management.

[0125] Finally, all identified abnormal behavior segments are summarized, and complete information for each abnormal behavior segment is recorded to form a list of abnormal path segments. The list is stored in a structured table format (in actual applications, it is implemented in the form of a database table or a structured document). Each abnormal record contains 9 core fields: "Abnormal Road Segment Identifier", "Start Node (Number + Coordinates)", "End Node (Number + Coordinates)", "Shortest Path Length (meters)", "Actual Travel Time (seconds)", "Reasonable Travel Time Range (seconds)", "Benchmark Reasonable Time (seconds)", "Deviation Rate (%)", and "Abnormal Type". Taking the abnormal path segment list of "VIS-S-218" as an example, one record is as follows: Abnormal road segment identifier "AB-218-001", starting node "D001 (12.5, 30.8)", ending node "D009 (52.8, 40.3)", shortest path length 41.2, actual travel time 164, reasonable travel time range "24.0-44.6", baseline reasonable time 34.3, deviation rate 378.1%, and abnormality type "road segment travel time too long". This list fully presents the key information and abnormality level of each abnormal behavior segment, providing accurate and traceable basic data support for subsequent abnormal frequency statistics, threat personnel identification, and access management and handling based on machine learning statistical models.

[0126] In step S17, based on the list of abnormal path segments, the frequency of abnormal segments and the number of times the same type of abnormality is repeated within a preset observation period are counted. When the frequency of abnormality exceeds the average level of the cluster and the number of repetitions reaches the set repetition threshold, the abnormality is added to the list of threatening personnel and an alarm record is automatically generated.

[0127] In one implementation, the abnormal path segment list generated in step S16 (centered on the three abnormal road segment records of short-term visitor "VIS-S-218", including complete data such as abnormal road segment identification, node information, actual travel time, and deviation rate) is used. This embodiment relies on a machine learning statistical model to complete the quantitative statistics of abnormal frequency and repetition, cluster level comparison, and threat personnel identification, and finally generate traceable alarm records to provide a closed-loop handling basis for access control security monitoring. The statistical logic, parameter sources, and algorithm details are clearly defined throughout the process, which meets the requirements of the latest patent examination guidelines.

[0128] First, core judgment data was obtained, including a list of abnormal path segments, a preset observation period, the average anomaly frequency of the personnel's cluster, and a threshold for the number of anomaly repetitions. The preset observation period was set to 7 days based on the park's security management needs, ensuring that periodic abnormal behavior could be captured while avoiding misjudgments due to an excessively short period. The personnel "VIS-S-218" belong to a short-term visitor group (cluster 3). Their average anomaly frequency was calculated using a machine learning statistical model: the density-based Local Anomaly Factor (LOF) algorithm was used to analyze the 7-day frequency of abnormal segments for all 48 short-term visitors in cluster 3. After removing 10% of extreme outliers, the average was calculated to be 2 times / week. This average objectively reflects the normal anomaly fluctuation level of the short-term visitor group and is suitable for the short-term visitor access management scenario. The threshold for the number of anomaly repetitions was determined through training with historical threat event data. A logistic regression model was used to analyze the correlation between abnormal behavior and threat events over the past 3 years. When the number of repetitions of the same type of anomaly is ≥3 times, the probability of a threat event increases to over 85%, therefore, the threshold was set at 3 times. Meanwhile, by associating the complete personnel information of "VIS-S-218" (name: Zhang, visiting company: a technology company, reason for appointment: technical exchange, visit duration: 1 week, IC card authorization scope: office building floors 1-2) with the abnormal path segment's corresponding abnormal type identifier, the abnormal type is uniformly classified as "excessive road passage time", ensuring the accurate binding of personnel information, abnormal behavior, and abnormal type, and providing a complete personnel profile for access management and handling.

[0129] Based on a preset 7-day observation period, a counting statistical model from machine learning was used to count the total frequency of abnormal path segments by personnel dimension, and simultaneously count the number of repetitions of the same type of abnormality by abnormality type. This statistical model automatically associates and counts abnormal events by constructing a three-dimensional index of "personnel identifier - abnormality type - occurrence time," supporting multi-dimensional rapid aggregation queries and avoiding omissions and errors from manual statistics. Statistical results for "VIS-S-218" showed that 8 abnormal path segment records were triggered within 7 days, and all abnormalities belonged to the same type, "excessive road passage time," with no other types of abnormalities. Further analysis of the abnormality occurrence time distribution revealed that 6 of these occurred between 10:00 and 14:00 on weekdays, and 2 occurred on weekends, exhibiting a clear irregular concentration characteristic. This resulted in personnel abnormality statistical results including "personnel identifier, total abnormality frequency, number of repetitions of the same type, and abnormal time period distribution." The statistical results are stored in a structured document format for easy subsequent comparison and analysis, facilitating access management decisions.

[0130] The anomaly statistics of "VIS-S-218" were compared with the criteria for its cluster. First, the frequency of anomalies was compared: the average anomaly frequency for cluster 3 (short-term visitor group) was 2 times / week, while the total anomaly frequency of "VIS-S-218" was 8 times, four times the average, far exceeding the normal fluctuation range. Second, the number of repetitions of the same type of anomaly was checked: with a threshold of 3 times, the "excessive road passage time" anomaly of "VIS-S-218" was repeated 8 times, meeting the criterion of "repetition count ≥ threshold". During the comparison, the bias analysis algorithm in machine learning was used to quantify the degree of difference, calculating a Z-score of 3.2 for the anomaly frequency (Z-score > 2 is considered significant anomaly), and a confidence level of 99.7% for the number of repetitions of the same type of anomaly, further verifying the significance and non-randomness of the abnormal behavior.

[0131] When both comparison conditions are met, the threat actor determination logic is triggered, adding "VIS-S-218" (Zhang) to the threat actor list. This list is stored in a relational database table structure, with core fields including "Threat Actor Identifier," "Cluster Affiliation," "Total Frequency of Anomalies," "Number of Repetitions of the Same Type," "Anomaly Type," "First Anomaly Time," "Last Anomaly Time," and "Risk Level." The risk level is automatically determined based on the quantitative results of anomaly frequency and repetition counts. A random forest classification model is used to determine that when the anomaly frequency exceeds the average level by more than 3 times and the number of repetitions is ≥5 times, the risk level is determined to be "high risk." Therefore, "VIS-S-218" is marked as "high risk," providing a clear basis for adjusting access permissions in access management.

[0132] Simultaneously, alarm records containing complete information are automatically generated. The record content strictly follows the structured format of "Personnel Information - Anomaly Details - Judgment Basis": The personnel information section includes "VIS-S-218, Zhang, a certain technology company, appointment for technical exchange, IC card authorized scope office building floors 1-2"; the anomaly details section includes "8 abnormal path segments occurred within 7 days, all of which were of the 'excessive travel time' type, involving 3 different road segments (D001→D009, D009→D012, D012→D001), with an average deviation rate of 8500%, and the abnormal time periods were concentrated between 10:00-14:00 and weekends"; the judgment basis section clearly states "1. The total frequency of anomalies is 8 times, which exceeds the average level of the short-term visitor group (2 times / week) by 4 times, with a Z-score of 3.2, which is a significant anomaly; 2. The same type of anomaly was repeated 8 times, reaching 2.6 times the set threshold (3 times), with a confidence level of 99.7%."

[0133] Once an alarm record is generated, it is simultaneously pushed to security terminals and management personnel's mobile devices via the park's security management platform interface, triggering a tiered response process: high-risk alarms trigger real-time pop-up notifications with a visual trajectory map of the abnormal path (generated based on the access topology map), while simultaneously locking the IC card authorization scope of the affected person (restricting new access permissions), and automatically linking to the park's monitoring system to retrieve video recordings of the corresponding road segment during the abnormal period, providing comprehensive data support for manual verification. The threat personnel list and alarm records will be archived and stored long-term, serving as an important basis for subsequent security audits and access management permission adjustments, forming a complete security monitoring chain of "anomaly detection - threat assessment - response closed loop".

[0134] refer to Figure 2 The second embodiment of the invention provides a machine learning-based access control data anomaly detection system, characterized in that it includes:

[0135] Access sequence construction module: Collects access control card swipe records, personnel identification, card swipe time and corresponding access control node, and groups them by personnel identification and sorts them in ascending order by card swipe time to obtain the access time sequence of each person;

[0136] Topology graph construction module: Based on the access control nodes, analyze the physical connectivity between nodes, filter the nodes that can pass through each other physically, and construct a weighted undirected passage topology graph;

[0137] Path sequence generation module: Based on the passage time sequence, it sequentially connects the corresponding nodes of each time point on the passage topology map to form a personnel passage path sequence with timestamps, and records the actual elapsed time of adjacent card swipe events in the personnel passage path sequence and the shortest path length of the corresponding nodes in the passage topology map;

[0138] The benchmark model construction module extracts the core feature attributes of the personnel passage path sequence and uses a preset clustering algorithm to divide each personnel passage path sequence into clusters. Based on the mean or median of the feature attributes of each cluster, a passage benchmark model corresponding to each cluster is constructed.

[0139] Suspicious Path Marking Module: Input a single personnel passage path sequence into the passage benchmark model of the corresponding cluster, calculate the feature deviation of the path, and if the feature deviation exceeds a preset deviation threshold, mark the corresponding personnel passage path sequence as a suspicious path containing potentially abnormal subsequences;

[0140] Abnormal road segment verification module: Combining the shortest path length and preset travel speed, the module verifies each segment of the suspicious path, determines the rationality of the travel time of each segment, identifies unreasonable segments as abnormal behavior segments, and compiles them into a list of abnormal path segments.

[0141] Threat Personnel Determination Module: Based on the list of abnormal path segments, the module counts the frequency of abnormal segments and the number of times the same type of abnormality is repeated within a preset observation period. When the frequency of abnormality exceeds the average level of the cluster and the number of repetitions reaches the set repetition threshold, the module is added to the list of threat personnel and an alarm record is automatically generated.

[0142] The core feature attributes include path length, travel time, and node jump frequency.

[0143] It should be noted that the access control data anomaly detection system based on machine learning provided in this embodiment of the invention is used to execute all the process steps of the access control data anomaly detection method based on machine learning in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0144] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A method for detecting anomalies in access control data based on machine learning, characterized in that, include: Collect access control card swipe records, personnel identification, card swipe time and corresponding access control node, and group them by personnel identification and sort them in ascending order by card swipe time to obtain the passage time sequence of each person; Based on the access control nodes, the physical connectivity between nodes is analyzed, and node pairs that can pass through each other physically are selected to construct a weighted undirected passage topology graph. Based on the passage time sequence, the nodes corresponding to each time point are connected sequentially on the passage topology map to form a personnel passage path sequence with timestamps. At the same time, the actual elapsed time of adjacent card swipe events in the personnel passage path sequence and the shortest path length of the corresponding nodes in the passage topology map are recorded. The core feature attributes of the personnel passage path sequence are extracted, and a preset clustering algorithm is used to divide each personnel passage path sequence into clusters. Based on the mean or median of the feature attributes of each cluster, a passage benchmark model corresponding to each cluster is constructed. Input a single personnel passage path sequence into the passage benchmark model of the corresponding cluster, calculate the feature deviation of the path, and if the feature deviation exceeds a preset deviation threshold, mark the corresponding personnel passage path sequence as a suspicious path containing potentially abnormal subsequences. Combining the shortest path length with the preset travel speed, the suspicious path is checked segment by segment to determine the rationality of the travel time of each segment. Unreasonable segments are identified as abnormal behavior segments, and a list of abnormal path segments is compiled. Based on the list of abnormal path segments, the statistical personnel count the frequency of abnormal segments and the number of times the same type of abnormality is repeated within a preset observation period. When the frequency of abnormality exceeds the average level of the cluster and the number of repetitions reaches the set repetition threshold, it is included in the list of threatening personnel and an alarm record is automatically generated. The core feature attributes include path length, travel time, and node jump frequency.

2. The access control data anomaly detection method based on machine learning according to claim 1, characterized in that, The system collects access control card swipe records, personnel identification, card swipe time, and corresponding access control nodes, and groups them by personnel identification and sorts them in ascending order by card swipe time to obtain the passage time sequence for each person, including: The access control data acquisition mechanism is activated to capture access control card swipe records and extract the personnel identifier, card swipe time, and corresponding access control node associated with the access control card swipe records. Based on the extracted personnel identifiers, the verified access control card swipe records are classified, and the access control card swipe records and swipe times corresponding to the same personnel identifier are integrated into an independent data set; Each independent data set is sorted in ascending order according to the time of card swipe to form the passage time sequence for each person.

3. The access control data anomaly detection method based on machine learning according to claim 1, characterized in that, The step of analyzing the physical connectivity between access control nodes, filtering physically directly passable node pairs, and constructing a weighted undirected passage topology graph based on the access control nodes includes: Based on the access control nodes, combined with the physical layout of the building and the distribution of access channels, the physical connectivity between each access control node is analyzed one by one, and the pairs of nodes that can be directly accessed and the pairs of nodes that cannot be accessed are identified, thus forming the node connectivity analysis results. Based on the node connectivity analysis results, access control node pairs that are physically directly accessible are selected, and node pairs that cannot be directly accessed are removed to obtain the effective access relationships between nodes. Based on the effective access relationships between the nodes, each access control node is used as a vertex of the topology graph and the direct access relationships between nodes are used as edges. The weights of the edges are set in combination with the physical distance between the nodes to form the topology graph composition information. Based on the topology graph composition information, a weighted undirected access topology graph is constructed.

4. The access control data anomaly detection method based on machine learning according to claim 1, characterized in that, The step involves sequentially connecting the corresponding nodes at each time point on the traffic topology map according to the traffic time sequence to form a timestamped personnel traffic path sequence. Simultaneously, it records the actual elapsed time of adjacent card-swiping events in the personnel traffic path sequence and the shortest path length of the corresponding nodes on the traffic topology map, including: Obtain the passage time series and the passage topology map, extract the access control node information corresponding to each time point in the passage time series, and establish the association mapping between time points and access control nodes; Based on the aforementioned association mapping, the access control nodes corresponding to each time point are connected sequentially on the access topology map in chronological order to form a sequence of personnel access paths with timestamps. Traverse the sequence of personnel access paths, extract the timestamps corresponding to two adjacent card swipe events, and calculate the actual elapsed time of the two card swipe events; For the access control nodes corresponding to the two card swipe events, locate the corresponding node positions in the access topology map, and calculate and record the shortest path length between the two nodes.

5. The access control data anomaly detection method based on machine learning according to claim 1, characterized in that, The process involves extracting the core feature attributes of the personnel passage path sequences and using a preset clustering algorithm to divide each personnel passage path sequence into clusters. Based on the mean or median of the feature attributes of each cluster, a passage benchmark model is constructed for each cluster, including: Traverse the personnel passage path sequence, extract the core feature attributes including path length, passage time and node jump frequency one by one, and normalize the extracted core feature attributes, remove redundant feature terms and integrate them to form a feature attribute set. Based on the set of feature attributes, a preset clustering algorithm is invoked, and the clustering distance threshold and the initial range of the number of clusters are set. The established clustering algorithm automatically classifies the travel path sequences of each person, divides them into clusters based on the similarity of the feature attribute set, and determines the path sequences contained in each cluster and the distribution range of cluster features. For each cluster, feature attributes of all personnel travel path sequences within the cluster are extracted, and the mean or median of each feature attribute is calculated. The mean or median is used as the cluster feature benchmark, and combined with the common features of personnel travel path sequences within the cluster, a travel benchmark model corresponding to each cluster is constructed.

6. The access control data anomaly detection method based on machine learning according to claim 1, characterized in that, The step of inputting a single personnel passage path sequence into the passage benchmark model of the corresponding cluster, calculating the feature deviation of the path, and if the feature deviation exceeds a preset deviation threshold, marking the corresponding personnel passage path sequence as a suspicious path containing potentially abnormal subsequences includes: Obtain the sequence of individual personnel passage paths and determine the cluster to which they belong, and retrieve the passage benchmark model corresponding to the cluster; The single path sequence is input into the corresponding traffic benchmark model, and the core feature attributes of the single path sequence are extracted and compared with the cluster feature benchmark in the corresponding traffic benchmark model to calculate the feature deviation. A preset deviation threshold is retrieved, and the calculated feature deviation degree is compared with the preset deviation threshold. If the feature deviation degree exceeds the preset deviation threshold, the path sequence is marked as a suspicious path containing potentially abnormal subsequences.

7. The access control data anomaly detection method based on machine learning according to claim 1, characterized in that, The method combines the shortest path length with the preset travel speed to check each segment of the suspicious path, determine the reasonableness of the travel time for each segment, identify unreasonable segments as abnormal behavior segments, and compile a list of abnormal path segments, including: The suspicious path, the shortest path length, and the preset travel speed are obtained to determine the road segment range formed by each adjacent node in the suspicious path and the corresponding actual travel time. Based on the shortest path length and preset travel speed of each road segment, calculate the reasonable travel time range for each road segment, compare the deviation range between the actual travel time and the reasonable travel time for each segment, and output the comparison results. Based on the comparison results, the rationality of the travel time of each road segment is judged, and road segments whose actual travel time exceeds the reasonable travel time deviation range are identified as abnormal behavior segments. Summarize all identified abnormal behavior segments, record the node information, actual passage time, and deviation range corresponding to each abnormal behavior segment, and form a list of abnormal path segments.

8. The method for detecting anomalies in access control data based on machine learning according to claim 1, characterized in that, The method involves statistically analyzing the frequency of abnormal segments and the number of repetitions of the same type of abnormality within a preset observation period based on the list of abnormal path segments. When the frequency of abnormality exceeds the average level of its cluster and the number of repetitions reaches a set repetition threshold, the individual is added to the threat personnel list and an alarm record is automatically generated, including: Obtain the list of abnormal path segments, the average level of abnormal frequency and the number of abnormal repetitions of the cluster to which the personnel belong, and associate the corresponding personnel information with the type identifier of the abnormal path segments; Based on a preset observation period, the total frequency of occurrence of abnormal path segments for each person is counted according to the personnel dimension, and the number of repetitions of the same type of abnormality is counted according to the abnormality type, thus forming the personnel abnormality statistics results. Based on the personnel anomaly statistics, the frequency of anomalies for each person is compared with the average level of their respective cluster, and the matching of the number of repetitions of the same type of anomaly with the set repetition threshold is checked. When the frequency of an anomalies by a person exceeds the average level of their cluster and the number of repetitions of the same type of anomaly reaches a set threshold, the corresponding person will be added to the list of threat persons, and an alarm record containing the person's information, anomaly details, and the basis for the judgment will be automatically generated.

9. A machine learning-based access control data anomaly detection system, characterized in that, include: Access sequence construction module: Collects access control card swipe records, personnel identification, card swipe time and corresponding access control node, and groups them by personnel identification and sorts them in ascending order by card swipe time to obtain the access time sequence of each person; Topology graph construction module: Based on the access control nodes, analyze the physical connectivity between nodes, filter the nodes that can pass through each other physically, and construct a weighted undirected passage topology graph; Path sequence generation module: Based on the passage time sequence, it sequentially connects the corresponding nodes of each time point on the passage topology map to form a personnel passage path sequence with timestamps, and records the actual elapsed time of adjacent card swipe events in the personnel passage path sequence and the shortest path length of the corresponding nodes in the passage topology map; The benchmark model construction module extracts the core feature attributes of the personnel passage path sequence and uses a preset clustering algorithm to divide each personnel passage path sequence into clusters. Based on the mean or median of the feature attributes of each cluster, a passage benchmark model corresponding to each cluster is constructed. Suspicious Path Marking Module: Input a single personnel passage path sequence into the passage benchmark model of the corresponding cluster, calculate the feature deviation of the path, and if the feature deviation exceeds a preset deviation threshold, mark the corresponding personnel passage path sequence as a suspicious path containing potentially abnormal subsequences; Abnormal road segment verification module: Combining the shortest path length and the preset travel speed, the module verifies each segment of the suspicious path, judges the rationality of the travel time of each segment, identifies unreasonable segments as abnormal behavior segments, and compiles them into a list of abnormal path segments. Threat Personnel Determination Module: Based on the list of abnormal path segments, the module counts the frequency of abnormal segments and the number of times the same type of abnormality is repeated within a preset observation period. When the frequency of abnormality exceeds the average level of the cluster and the number of repetitions reaches the set repetition threshold, the module is added to the list of threat personnel and an alarm record is automatically generated. The core feature attributes include path length, travel time, and node jump frequency.

Images