Active intervention method and system based on campus security situation awareness

Abstract

The invention belongs to the technical field of artificial intelligence and campus security management, and relates to an active intervention method and system based on campus security situation awareness, which constructs a continuous space-time anomaly potential field model through multi-modal data paradigm and space-time alignment, and realizes dynamic evaluation of gradient, divergence and time derivative based on field theory analysis. An optimal intervention strategy is generated in combination with model prediction control, closed-loop active prevention and control is formed, multi-source heterogeneous sensing data is mapped into spatio-temporal information quantum, a four-dimensional potential field is generated by using weighted kernel function superposition, and risk source sink and evolution trend are analyzed in combination with a motion velocity field. Finally, an intervention action sequence for minimizing potential field deviation and controlling cost is solved through an MPC framework, and full-process automation from risk identification to active disposal is achieved. According to the invention, continuous, quantitative and prospective perception and active intervention of the campus security situation can be realized, and the intelligence and response efficiency of security management are significantly improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence and campus safety management, and specifically relates to a method and system for active intervention based on campus safety situation awareness. BACKGROUND

[0002] The traditional campus safety management system, at a specific stage of its development, has formed a set of effective technical paradigms. This paradigm is mainly based on physical isolation and fixed-point monitoring. By arranging video monitoring cameras, access control systems, perimeter alarm systems and other independent sensing and execution units in key areas, and supplemented by periodic manual patrols by security personnel, a protective network covering major risk points is formed. From the design principle, the core of this system is a passive response mechanism based on discrete event triggering.

[0003] Each security subsystem is pre-set with explicit and high-threshold triggering conditions, such as the access control system responding to unauthorized card swiping, the infrared detector responding to intrusion into the protected area, and the smoke sensor responding to smoke particles reaching a certain concentration. Only when the intensity or characteristics of a specific event meet the pre-set hard rules, the system will generate a high-deterministic alarm signal, and then start the subsequent manual disposal process. In the past few decades, this mode characterized by point defense and post-response has effectively solved the prevention problem of single security events with clear boundaries and obvious characteristics such as burglary and fire, and has played an indispensable role in improving the protection capability of key targets and providing evidence support for post-tracing.

[0004] Therefore, the current technical challenge in the field is no longer simply increasing the density of monitoring probes or improving the response speed of a single alarm event, but how to fundamentally break through the constraints of the traditional discrete event-driven model. The technical problem to be solved is how to build a new data processing and analysis paradigm that can effectively integrate multi-source heterogeneous sensing data containing a large amount of "background noise", and through deep spatio-temporal correlation analysis and behavior pattern mining, realize the continuous quantitative evaluation of the evolution process from "normal" to "abnormal" of the entire campus safety ecosystem, and then move the focus of safety management from post-emergency disposal to active identification and precise intervention in the risk formation process. In other words, how to establish a closed-loop control method that can extract the overall security situation from massive, low-intensity dynamic data streams and automatically generate and execute intervention strategies based on the dynamic evolution of the situation, has become a key challenge and technical problem to be solved for those skilled in the art. SUMMARY

[0005] The technical problem to be solved by the present application is to overcome the blind area of risk evolution process caused by relying on discrete events and high threshold triggering in the existing campus safety management system, and the passive lag response mode caused thereby.

[0006] According to the first aspect of the present application, an active intervention method based on campus safety situation awareness is claimed, comprising the following steps: S1, multi-modal data normalization and space-time alignment processing, receiving and standardizing the data stream from a plurality of heterogeneous sensor networks deployed in the campus, and mapping the normalized data stream to a unified space-time reference; S2, constructing a space-time anomaly potential field and dynamically calculating, based on the normalized data stream, constructing and dynamically calculating a four-dimensional space-time anomaly potential field P(x,y,z,t) representing the entire campus safety state through a preset field theory model; S3, performing campus safety situation assessment based on field analysis, generating a multi-dimensional state vector representing the current overall campus safety situation by analyzing the topological structure and dynamic evolution characteristics of the space-time anomaly potential field; S4, generating an intervention strategy based on model predictive control, generating a set of active intervention instructions aimed at guiding the space-time anomaly potential field to a preset safe reference state under the optimal control framework according to the safety situation represented by the multi-dimensional state vector; S5, analyzing the intervention instructions and closed-loop execution, analyzing the active intervention instructions into specific control commands for the underlying security and defense execution equipment and executing them, while continuously monitoring the actual impact of the intervention measures on the space-time anomaly potential field to form a closed-loop feedback control.

[0007] Further, in the S1, the heterogeneous sensor network comprises: a video monitoring network for outputting video frame data; an access control system for outputting access log data; a perimeter intrusion detection system for outputting trigger signal data; an environment perception Internet of Things for outputting scalar sensor data; a network traffic monitoring system for outputting data packet metadata; In S1, the received raw data is normalized and converted, which is uniformly packaged into a standardized space-time information quantum STIQ data structure, the space-time information quantum is a tuple containing the following fields: Timestamp, the event occurrence time calibrated by a unified time reference; Three-dimensional coordinates Coordinate, the corresponding position of the event in the pre-constructed campus three-dimensional geographic information system model; Entity_ID, an identifier of an entity associated with the event; DataType, a type code of the original data source; AnomalyVector, a normalized feature vector extracted from the original data to represent the abnormality degree thereof; Metadata.

[0008] Further, the extraction manner of the AnomalyVector includes: when the DataType is video monitoring data, at least one of regional crowd density, average moving speed, reverse index, wandering time length or gathering index is extracted and normalized by target detection and behavior analysis as a component of the AnomalyVector; when the DataType is network traffic data, at least one of the number of connection requests per unit time, the proportion of abnormal protocols or the degree of deviation of the average size of data packets from the baseline is extracted and normalized as a component of the AnomalyVector.

[0009] Further, in the S2, the potential value P of any point (x, y, z) in space at time t is calculated by the following formula: P(x, y, z, t) = Σ_i[W(DataType_i)A(AnomalyVector_i)K_s(d_i)K_t(Δt_i)] wherein the summation is over all space-time information quanta STIQ_i within a preset time window T_w; W(DataType_i) is a basic risk weight function assigned according to the DataType_i of the space-time information quantum; A(AnomalyVector_i) is an abnormality degree function quantified according to the AnomalyVector_i of the space-time information quantum; K_s(d_i) is a spatial decay kernel function, the value of which depends on the spatial distance d_i between the calculation point and the occurrence position of the space-time information quantum; K_t(Δt_i) is a time decay kernel function, the value of which depends on the time difference Δt_i between the current time and the occurrence time of the space-time information quantum.

[0010] Further, the abnormality degree quantification function A(AnomalyVector_i) is implemented by a pre-trained variational autoencoder VAE model; the variational autoencoder model is trained using historical data collected by the campus in a determined safe state to learn a low-dimensional latent representation of normal data patterns; The value of the anomaly degree is calculated as the reconstruction error between the input anomaly feature vector AnomalyVector_i and its reconstructed vector after passing through the variational autoencoder model; The spatial decay kernel function K_s(d_i) takes the form of a Gaussian kernel: K_s(d_i)=exp(-d_i^2 / (2σ_s^2)), where σ_s is a spatial influence radius parameter; The temporal decay kernel function K_t(Δt_i) takes the form of an exponential decay function: K_t(Δt_i)=exp(-Δt_i / τ_t), where τ_t is a temporal decay constant.

[0011] Further, in the S3, the indicators calculated by analyzing the spatio-temporal anomaly potential field include: Potential field gradient ▽P, used to represent the spatial variation rate of risk intensity; Divergence of risk flux ▽·(Pv), where v is the entity motion velocity field obtained by applying optical flow estimation algorithm on video data output by the video surveillance network and performing multi-camera data fusion, used to identify the source or sink of risk; Temporal derivative of potential field P / t, used to represent the growth rate of risk intensity; The entity motion velocity field v is obtained by applying optical flow estimation algorithm on video data output by the video surveillance network and performing multi-camera data fusion to describe the motion of personnel or vehicles in the campus; The multi-dimensional state vector is composed of statistical features of the potential field gradient, the divergence of risk flux, and the temporal derivative of potential field, including maximum value, mean value, and the volume of high value area.

[0012] Further, in the S4, the optimal control framework is a model predictive control framework, which, in each control period, generates the active intervention instruction by solving an optimization problem based on the spatio-temporal anomaly potential field obtained at present as the initial state; The specific implementation of the model predictive control framework includes: Establishing a partial differential equation model describing the dynamic evolution of the spatio-temporal anomaly potential field; In each control period, within a limited future prediction time domain T_p, the partial differential equation model is used to predict the future evolution trajectory of the spatio-temporal anomaly potential field under the application of possible intervention action sequence; By solving the optimization problem, the optimal intervention action sequence U within the control time domain T_c that can minimize the predefined cost function is found, and the first action in the sequence is output as the active intervention instruction at the current time.

[0013] Furthermore, the predefined cost function J is defined by the following formula: J=∫_[t,t+T_p](||P(τ)-P_base|| 2 _Q+||u(τ)||_R)dτ Among them, the first term is ||P(τ)-P_base|| 2 _Q is the state penalty term, used to penalize the deviation between the predicted potential field P(τ) and the preset safe reference state P_base, and Q is the state weight matrix; the second term ||u(τ)||_R is the control cost term, used to penalize the cost of performing the intervention action (u(τ)), and R is the control weight matrix.

[0014] Furthermore, in S5, the active intervention command is parsed through an intervention resource-action mapping engine; The engine maintains a database storing all available intervention resources and their status, and queries the database to match the optimal physical resources to execute the instruction based on the received active intervention instruction; The intervention resources include security personnel, access control controllers, audible and visual alarms, broadcasting systems, and pan-tilt-zoom (PTZ) cameras in video surveillance systems. The closed-loop feedback control is characterized as follows: After the intervention command is executed, the heterogeneous sensor network continuously collects data to calculate the actual impact of the intervention measures on the spatiotemporal anomaly potential field in real time. The updated spatiotemporal anomaly potential field will be used as the initial state of the next control cycle and input into the model predictive control framework to achieve dynamic adjustment of subsequent intervention strategies.

[0015] According to a second aspect of the present invention, the present invention claims protection for a proactive intervention system based on campus security situational awareness, comprising: One or more processors; A memory that stores one or more programs, which, when executed by one or more processors, enable the one or more processors to implement the aforementioned proactive intervention method based on campus security situation awareness.

[0016] The application belongs to the technical field of artificial intelligence and campus safety management, and relates to an active intervention method and system based on campus safety situation awareness. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 A work flow diagram of an active intervention method based on campus safety situation awareness as claimed in the embodiments of the application; Figure 2 A second work flow diagram of an active intervention method based on campus safety situation awareness as claimed in the embodiments of the application; Figure 3 A structural diagram of an active intervention system based on campus safety situation awareness as claimed in the embodiments of the application. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the application will be clearly and completely described in the embodiments of the application in combination with the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the application.

[0019] In this document, reference to“an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. Those skilled in the art will understand that the embodiments described herein are combinable with other embodiments.

[0020] With the increasingly complex functions of the campus, the openness of personnel flow is enhanced, and the security threat form evolves to concealment, linkage and suddenness. The inherent characteristics of the above technical solutions at the principle level gradually show their inherent and deep limitations in response to new challenges. The reason is that the cornerstone of the traditional architecture is "event certainty", that is, the perception and computing resources of the whole system are highly optimized for identifying and confirming known high signal-to-noise ratio threat events. This design philosophy has advantages in pursuing alarm accuracy and avoiding false alarms, but the cost is the "process sensitivity" of the overall system state. The system is essentially indiscriminately filtering a large amount of low-amplitude seemingly unrelated environmental background data and only responding to "signal spikes" that break through the threshold. This mode leads to a fundamental "analysis gap": the evolution of security risks is often a continuous process from quantitative change to qualitative change, coupled with the fermentation of multiple weak abnormal factors. The traditional system is structurally "blind" when the risk is still in the embryonic or latent stage due to its discrete and single-point threshold-based working principle. For example, abnormal gathering of people in a certain area, long-term irregular wandering of a person around a sensitive building, and continuous unauthorized access attempts at multiple access points within a short time, these "subthreshold" information, which does not trigger any subsystem hard alarm rule, may indicate a group event or a premeditated intrusion when they are associated in time and space dimensions. The data model and processing logic of the traditional system naturally lack the ability to perform correlation analysis and significance extraction on such cross-system and cross-time weak signals. The data is preprocessed by independent subsystems at the beginning, and a large amount of context background containing potential situation information is permanently lost, resulting in data islandization and cognitive fragmentation, making it impossible for managers to form a continuous, dynamic and forward-looking cognition of the overall security situation of the campus, and the decision and action naturally fall into a passive lagging state.

[0021] According to the first embodiment of the present application, referring to Figure 1 The present application claims a kind of based on the initiative intervention method of campus security situation awareness, comprising the following steps: S1, multi-modal data normalization and space-time alignment processing, receiving and standardizing the data stream from the multiple heterogeneous sensor networks deployed in the campus, and mapping the normalized data stream to a unified space-time reference frame; S2, constructing a space-time anomaly potential field and dynamically calculating, based on the normalized data stream, constructing and dynamically calculating a four-dimensional space-time anomaly potential field P (x, y, z, t) by a predetermined field theory model, which continuously quantifies the security state of the whole campus; S3, performing a campus security situation assessment based on field theory analysis, generating a multi-dimensional state vector representing the current overall security situation of the campus by analyzing the topological structure and dynamic evolution characteristics of the spatio-temporal anomaly potential field; S4, generating an intervention strategy based on model predictive control, generating a set of active intervention instructions aimed at guiding the spatio-temporal anomaly potential field to a preset safe baseline state under the framework of optimal control according to the security situation represented by the multi-dimensional state vector; S5, analyzing and executing the intervention instructions in a closed loop, analyzing the active intervention instructions into specific control commands for the underlying security and protection execution equipment and executing them, while continuously monitoring the actual impact of the intervention measures on the spatio-temporal anomaly potential field to form a closed-loop feedback control.

[0022] Further, in the S1, the heterogeneous sensor network includes: a video monitoring network for outputting video frame data; an access control system for outputting access log data; a perimeter intrusion detection system for outputting trigger signal data; an environmental perception Internet of Things for outputting scalar sensor data; a network traffic monitoring system for outputting data packet metadata; In S1, the received raw data is converted into a standardized spatio-temporal information quantum (STIQ) data structure, which is a tuple containing the following fields: Timestamp, the event occurrence time calibrated by a unified time reference; Three-dimensional coordinates Coordinate, the corresponding position of the event in the pre-constructed campus three-dimensional geographic information system model; Entity ID, the entity identifier associated with the event; Data type DataType, the type code of the original data source; Anomaly vector AnomalyVector, a normalized feature vector extracted from the original data for representing the degree of anomaly; Metadata.

[0023] Further, the extraction method of the anomaly feature vector AnomalyVector includes: When the data type is video monitoring data, at least one of the region crowd density, average moving speed, reverse index, wandering time, or aggregation index is extracted and normalized as a component of the anomaly feature vector through target detection and behavior analysis; When the data type is network traffic data, at least one of the number of connection requests per unit time, the proportion of abnormal protocols, or the degree of deviation of the average packet size from the baseline is extracted and normalized as a component of the anomaly feature vector.

[0024] Wherein, in this step S1 through a high-precision network time protocol (NTP) server deployed in the data center, the server is synchronized with an external atomic clock source, provides a unified, millisecond-precision time reference for all data collection devices within the campus, ensures the consistency of the time stamp of all input data. Secondly, based on the pre-constructed campus three-dimensional geographic information system (3D-GIS) digital twin model, the physical installation position of each sensor is accurately mapped to the unified three-dimensional coordinate system (X, Y, Z) of the model. Subsequently, for each received raw data, perform a normalization conversion and uniformly encapsulate it as a standardized "spatio-temporal information quantum" (STIQ) data structure. The spatio-temporal information quantum is a tuple containing the following fields: STIQ={Timestamp, Coordinate, Entity_ID, DataType, AnomalyVector, Metadata}. Wherein, Timestamp is the event occurrence time stamp calibrated by NTP; Coordinate is the three-dimensional coordinate corresponding to the event occurrence in the 3D-GIS model; Entity_ID is the unique identifier of the entity associated with the event, such as personnel ID, device MAC address; DataType is the type code of the original data source; AnomalyVector is the normalized feature vector extracted from the original data, used to represent the abnormal degree thereof; Metadata is the preserved original data digest or other context information.

[0025] Further, in the S2, the potential value P of any point (x, y, z) in space at time t is calculated by the following formula: P(x,y,z,t)=Σ_i[W(DataType_i)A(AnomalyVector_i)K_s(d_i)K_t(Δt_i)] Wherein, the summation traverses all spatio-temporal information quanta STIQ_i within the preset time window T_w; W(DataType_i) is the basic risk weight function assigned according to the data type DataType_i of the spatio-temporal information quantum; A(AnomalyVector_i) is the anomaly degree function quantified according to the anomaly feature vector AnomalyVector_i of the spatio-temporal information quantum; K_s(d_i) is the spatial decay kernel function, whose value depends on the spatial distance d_i between the calculation point and the location where the spatiotemporal information quantum occurs; K_t(Δt_i) is the time decay kernel function, whose value depends on the time difference Δt_i between the current moment and the moment when the spatiotemporal information quantum occurs.

[0026] Furthermore, the anomaly quantification function A(AnomalyVector_i) is implemented through a pre-trained variational autoencoder (VAE) model; The variational autoencoder model is trained using historical data collected on campus under a defined security condition to learn a low-dimensional latent representation of normal data patterns. The anomaly level is calculated as the reconstruction error between the input anomaly feature vector AnomalyVector_i and its reconstructed vector after passing through the variational autoencoder model. The spatial decay kernel function K_s(d_i) adopts the form of Gaussian kernel function: K_s(d_i)=exp(-d_i^2 / (2σ_s^2)), where σ_s is the spatial influence radius parameter; The time decay kernel function K_t(Δt_i) adopts the form of an exponential decay function: K_t(Δt_i)=exp(-Δt_i / τ_t), where τ_t is the time decay constant.

[0027] Furthermore, in S3, the indices calculated for analyzing the spatiotemporal anomaly potential field include: The potential field gradient ▽P is used to characterize the spatial rate of change of risk intensity. The divergence of risk flux is ▽·(Pv), where v is the velocity field of physical motion obtained through sensor data, used to identify the source or sink of risk; Time derivative of potential field P / t is used to characterize the growth rate of risk intensity; The physical motion velocity field v is obtained by applying an optical flow estimation algorithm to the video data output by the video surveillance network and fusing data from multiple cameras, describing the velocity field of people or vehicles moving within the campus. The multidimensional state vector is composed of the statistical characteristics of the potential field gradient, the divergence of the risk flux, and the time derivative of the potential field. The statistical characteristics include the maximum value, the mean value, and the volume of the high-value region.

[0028] In this embodiment, this step no longer relies on traditional, rule-based threshold judgment. Instead, it uses mathematical analysis of the topological structure and dynamic evolution characteristics of the spatiotemporal anomaly potential field P to quantitatively and qualitatively assess the overall security situation of the current campus. The assessment process mainly calculates the following three core field theory indicators: Gradient of potential field: Calculate the gradient vector of potential field P in space ▽P= ( P / x, P / y, P / z). The magnitude of the gradient ||▽P|| represents the spatial variation rate of risk intensity. An area with a high gradient value indicates the boundary of a sharp transition from low risk to high risk, which is a potential risk concentration area or a risk front being formed.

[0029] Divergence of potential field: Combine the velocity field v(x,y,z,t) of personnel or objects obtained by video analysis to calculate the divergence of risk flux ▽·(Pv). The area with positive divergence value represents a "source" of risk, i.e., risk is being generated and spreading outward, such as an abnormal gathering point of the crowd. The area with negative divergence value represents a "sink" of risk, i.e., risk is being absorbed or dissipated, such as an orderly evacuation of the crowd.

[0030] Temporal derivative of potential field: Calculate the rate of change of potential field P with respect to time P / t. This value represents the growth rate of risk intensity. An area with a high positive value indicates that the risk is rapidly accumulating and deteriorating, with a high immediate danger.

[0031] According to the maximum value, average value, and volume of high-value area of the above three indicators, the overall security situation of the campus is defined as a continuous multi-dimensional state vector S={max(||▽P||),avg(||▽P||),max(▽·(Pv)),max( P / t),V_high_P}. This state vector comprehensively and dynamically describes the intensity, spatial distribution, diffusion trend, and evolution speed of security risk, replacing the traditional discrete security level classification.

[0032] Further, in the S4, the optimal control framework is a model predictive control framework, which, in each control period, generates the active intervention instruction by solving an optimization problem based on the currently obtained spatio-temporal anomaly potential field as the initial state; Referring to Figure 2 , the specific implementation of the model predictive control framework includes: establishing a partial differential equation model describing the dynamic evolution of the spatio-temporal anomaly potential field; In each control cycle, within a limited future prediction time horizon T_p, the future evolution trajectory of the spatio-temporal abnormal potential field P is predicted under the application of a possible sequence of intervention actions u using the partial differential equation model. By solving the optimization problem, the optimal sequence of intervention actions U within the control time horizon T_c that minimizes the predefined cost function J is found, and the first action in the sequence is output as the active intervention instruction at the current time.

[0033] Further, the predefined cost function J is defined by the following formula: J=∫_[t,t+T_p](||P(τ)-P_base|| 2 _Q+||u(τ)||_R)dτ Wherein, the first term ||P(τ)-P_base|| 2 _Q is the state penalty term, which is used to penalize the deviation between the predicted potential field P(τ) and the pre-set safe baseline state P_base, and Q is the state weight matrix; the second term ||u(τ)||_R is the control cost term, which is used to penalize the cost of executing the intervention action (u(τ)), and R is the control weight matrix.

[0034] Wherein, in this embodiment, the goal of this step is to automatically generate a set of optimal active intervention instructions based on the safety situation S evaluated in S3, to guide the abnormal potential field P back to a pre-defined baseline potential field P_base representing absolute safety, usually a uniform field close to zero, at the minimum cost. This process is modeled as an optimal control problem.

[0035] First, a dynamic evolution model of the potential field P is established, which is a partial differential equation (PDE) describing the change law of the potential field under no intervention and intervention: P / t=D▽ 2 P-▽·(Pv)+F_source-F_intervention Wherein, D▽ 2 P is the diffusion term, which represents the natural dispersion of risk; -▽·(Pv) is the convection term, which represents the propagation of risk with the flow of entities; F_source is the source term, which is contributed by newly generated STIQs; F_intervention is the control term, which represents the inhibitory effect of intervention measures on the potential field.

[0036] The generation of intervention strategies is realized through a model predictive control (MPC) framework. In each control cycle, the MPC controller performs the following operations: Take a snapshot of the current potential field P(t) as the initial state.

[0037] Within a finite future time domain [t, t+T_p] (prediction time domain), using the above PDE model, we can predict the future evolution trajectory of the potential field P under the application of a series of possible intervention action sequences U={u(t), u(t+1), ..., u(t+T_c-1)} (control time domain T_c<=T_p).

[0038] Solve an optimization problem to find a control sequence U that minimizes the following cost function J: J=∫_[t,t+T_p](||P(τ)-P_base|| 2 _Q+||u(τ)||_R)dτ The cost function consists of two parts: the first part is ||P(τ) - P_base|| 2 _Q is the state penalty term, representing the deviation between the predicted potential field P(τ) and the baseline safety field P_base. The weight matrix Q defines the degree of attention paid to the deviation in different regions. The second part, ||u(τ)||_R, is the control cost term, representing the cost of performing the intervention action u(τ) (such as manpower and energy consumption). The weight matrix R is used to balance the intervention effect and cost.

[0039] The first action u(t) of the optimal control sequence U obtained by solving is output as the intervention command at the current time.

[0040] The intervention action u is an abstract control vector, whose components correspond to different types of intervention methods, such as adjusting the access control level of a specific area, pushing patrol instructions to the security personnel terminal of a specific area, activating the sound and light alarm or broadcast system of a specific area, and adjusting the pan-tilt-zoom and focal length of the camera in the video surveillance system.

[0041] Furthermore, in S5, the active intervention command is parsed through an intervention resource-action mapping engine; The engine maintains a database storing all available intervention resources and their status, and queries the database to match the optimal physical resources to execute the instruction based on the received active intervention instruction; The intervention resources include security personnel, access control controllers, audible and visual alarms, broadcasting systems, and pan-tilt-zoom (PTZ) cameras in video surveillance systems. The closed-loop feedback control is characterized as follows: After the execution of the intervention instruction, the heterogeneous sensor network continues to collect data to calculate the actual effect of the intervention measure on the spatio-temporal anomaly potential field in real time; the updated spatio-temporal anomaly potential field will be used as the initial state of the next control cycle and input into the model predictive control framework to dynamically adjust the subsequent intervention strategy.

[0042] In this embodiment, the step parses the abstract intervention instruction u(t) generated by S4 into specific control commands for the underlying security execution equipment. This process is implemented through an "intervention resource-action mapping engine". The engine maintains a database storing the status of all available intervention resources, such as each access control, each camera, and each security personnel, and their executable action sets. After receiving u(t), the engine queries the database to match the optimal physical resources to execute the instruction. For example, if u(t) contains an instruction component to evacuate personnel in area A, the engine will find the broadcasting equipment in area A and send a preset evacuation voice broadcast instruction to it, and send a coordination instruction to the mobile terminal of the security personnel closest to area A.

[0043] After executing the intervention instruction, the sensor network in the campus continuously collects data and calculates the actual effect of the intervention measure on the spatio-temporal anomaly potential field P in real time through S1 to S3. The updated potential field P(t+1) will be used as the initial state of the next control cycle and input into the MPC controller. This mechanism forms a complete closed-loop feedback control, and the system can continuously and dynamically adjust its subsequent intervention strategy according to the actual effect of the intervention, until the indicators of the potential field return to the safe threshold range, thereby ensuring the effectiveness and adaptability of the intervention.

[0044] According to the second embodiment of the present application, referring to Figure 3 The present application claims a proactive intervention system based on campus security situation awareness, comprising: one or more processors; a memory having one or more programs stored thereon, when the one or more programs are executed by the one or more processors, the one or more processors implement the proactive intervention method based on campus security situation awareness.

[0045] In a specific embodiment, the technical solution of the present application is deployed and verified in a comprehensive university campus with an area of about 1.5 square kilometers, including teaching buildings, experimental buildings, student dormitories, libraries, gymnasiums, and administrative office buildings, and other functional areas. The campus is equipped with comprehensive security and Internet of Things infrastructure, providing a solid data foundation for the implementation of the method.

[0046] Step S1, multi-modal data normalization and spatio-temporal alignment, is performed. This step is the data basis for constructing a unified spatio-temporal anomaly potential field. The goal is to convert the original sensor data with diverse sources and formats into a standardized data structure that can be fused and calculated in a unified spatio-temporal framework.

[0047] Specifically, the campus-deployed data collection system includes: 2158 high-definition network cameras covering public areas, building entrances, and the periphery of key laboratories, forming a video monitoring network; 894 C3-400 access control controllers deployed at all building and dormitory access points, forming an access control system; 320 infrared and microwave dual-detection detectors deployed along the campus perimeter, forming a perimeter intrusion detection system; 186 environmental perception IoT nodes containing smoke sensors, temperature and humidity sensors, and combustible gas concentration sensors deployed in chemical warehouses, high-voltage distribution rooms, and data centers; and a network traffic monitoring system that monitors the campus network data center server cluster through the network backtracking analysis system deployed on the core switch.

[0048] To ensure the accurate alignment of all data in the time dimension, the system deploys an NTP Stratum-1 time server supporting GPS and Beidou dual-mode time service in the campus data center. This server receives satellite atomic clock signals through an antenna and provides unified Network Time Protocol (NTP) services for all networked cameras, access controllers, IoT gateways, and servers on campus, ensuring that the timestamp synchronization accuracy of all devices is better than 5 milliseconds, thereby eliminating the problem of data timing disorder caused by device clock drift.

[0049] In the spatial dimension, the system pre-constructs a high-precision 3D-GIS digital twin model of the entire campus using unmanned aerial photography and laser radar scanning technology. This model is rendered and managed based on UnrealEngine5, with a spatial coordinate system accuracy of centimeters. During system initialization, the physical installation positions of each camera, access card reader, infrared detector, and other sensor devices are accurately labeled into the unified three-dimensional coordinate system (X, Y, Z) of the 3D-GIS model through GPS positioning and manual fine-tuning. For example, a camera installed at the end of the west corridor on the third floor of Building A has a coordinate of (354.72, 812.33, 12.50).

[0050] When any of the above data sources generates a piece of raw data, the data preprocessing module will immediately capture it and convert it into a standardized "Spatio-Temporal Information Quantum (STIQ)" data structure. This data structure is a tuple, specifically defined as: STIQ = {Timestamp, Coordinate, Entity_ID, DataType, AnomalyVector, Metadata}.

[0051] For example, when a student successfully swipes the student card with ID 202101158 at 14:30:15.128 on October 26, 2023 to open the first floor door located at coordinates (450.15, 678.90, 4.20) in Building B of the laboratory building, the original log generated by the access control system will be converted into an STIQ instance: Timestamp is 1698294615128 (Unix millisecond timestamp); Coordinate is (450.15, 678.90, 4.20); Entity_ID is 202101158; DataType code is 0x01, representing "authorized access control"; AnomalyVector is a feature vector representing the degree of abnormality of the event. For a normal authorized access, the vector may be [0.0, 0.0], representing "time period abnormality" and "frequency abnormality", respectively; Metadata can store text information such as "first floor door of Building B of the laboratory building".

[0052] The extraction of AnomalyVector is the key in the normalization process. For different data types, its extraction method is also different. For video surveillance data, the system uses the YOLOv5 model deployed on the edge computing node for real-time target detection, and conducts behavior analysis on the detected crowd or individual. AnomalyVector can be a five-dimensional vector, [v_1, v_2, v_3, v_4, v_5], representing the normalized "region crowd density", "average moving speed", "reverse index", "wandering time" and "aggregation index", respectively. For network traffic data, AnomalyVector can be a three-dimensional vector, [f_1, f_2, f_3], representing the degree of deviation of "connection request number per unit time", "abnormal protocol proportion" and "average data packet size" from the baseline. These feature vectors will be input into the deep learning model to quantify the overall degree of abnormality.

[0053] Subsequently, step S2 of constructing and dynamically calculating the spatio-temporal anomalous potential field is performed, which is the core of the method of the present application. The discrete and sparse STIQ data stream generated in the previous step is converted into a four-dimensional scalar function P(x, y, z, t) that can continuously and globally describe the entire campus security state through a mathematical model inspired by physical field theory. The value of this function represents the potential risk intensity at time t at the spatial point (x, y, z). In order to perform numerical calculations, the 3D-GIS space of the entire campus is divided into a voxel grid with a size of 1 meter x 1 meter x 1 meter. The calculation of the potential field is completed by a parallel computing program deployed on a server cluster containing 8 NVIDIA A100 GPUs within each calculation period (set to 1 second in this embodiment).

[0054] At any time t, the potential value P of any voxel center point (x, y, z) is calculated by superimposing the contributions of all STIQs generated within a specific time window T_w in the past. The calculation formula is: P(x, y, z, t) = Σ_i[W(DataType_i)A(AnomalyVector_i)K_s(d_i)K_t(Δt_i)].

[0055] Each function and parameter in the formula has a clear definition and numerical value in this embodiment. The weight function W(DataType_i) is implemented through a configurable lookup table, giving different basic risk weights to different types of event sources. For example, the weight W of "perimeter intrusion detector trigger" (DataType=0x04) is set to 10.0; the weight of "unauthorized access attempt" (DataType=0x02) is 5.0; the weight of "smoke concentration exceeds the standard" (DataType=0x05) is 8.0; and the weight of "normal authorized access" (DataType=0x01) is only 0.1. This differentiated weight setting ensures that high-risk events have a more significant impact on the potential field.

[0056] The implementation of the anomaly degree quantification function A (AnomalyVector_i) relies on a pre-trained variational autoencoder (VAE) model. The model adopts a symmetric encoder-decoder structure, both of which are composed of three fully connected layers, and the latent space dimension in the middle is set to 8. The model is trained using hundreds of millions of STIQ data collected during the past six months on campus without any security incident reports, learning a compact representation of various normal behavior patterns. At runtime, when a new STIQ is generated, its AnomalyVector is fed into the VAE model, and the value of function A is the L2 norm Euclidean distance between the input vector and its reconstructed vector after encoding-decoding, i.e. A = ||AnomalyVector_i-VAE(AnomalyVector_i)||_2. This reconstruction error value is normalized to the [0, 1] interval, and the larger the error, the higher the degree of deviation of the event from the normal pattern, and the higher the anomaly quantification value A.

[0057] The spatial decay kernel function K_s(d_i) adopts a Gaussian kernel form: K_s(d_i) = exp(-d_i^2 / (2σ_s^2)). Where d_i is the Euclidean distance between the calculation point (x, y, z) and the event occurrence point Coordinate_i. The spatial influence radius σ_s is an event type related parameter, which determines the dispersion range of the risk in space. For example, for fire alarm events, σ_s can be set to 50 meters to reflect its extensive influence; while for a door access anomaly, σ_s can be only 5 meters, indicating that its influence is highly localized.

[0058] The time decay kernel function K_t(Δt_i) adopts an exponential decay form: K_t(Δt_i) = exp(-Δt_i / τ_t). Where Δt_i is the time difference between the current calculation time t and the event occurrence time Timestamp_i. The time decay constant τ_t is also related to the event type, which determines the duration of risk memory. For transient events such as illegal intrusion, τ_t can be set to 180 seconds; while for persistent risks such as chemical leakage, τ_t can be as long as 1800 seconds.

[0059] By performing the above superposition calculation on each voxel in parallel on the GPU, the system can generate a high-resolution three-dimensional potential field distribution map covering the entire campus every second, dynamically reflecting the risk distribution and intensity changes throughout the campus.

[0060] Next, step S3 is executed, which is the campus security situation assessment based on field theory analysis. This step goes beyond the traditional alarm mechanism based on a single event or simple rules, and instead analyzes the macroscopic topological structure and dynamic characteristics of the entire potential field P, thereby gaining a profound insight into the overall security status of the campus. The system mainly calculates three core field theory indicators.

[0061] The first is the potential field gradient ▽P. By applying the finite difference method to the three-dimensional potential field data, the gradient vector of each voxel is calculated. P / x, P / y, P / (z) The gradient vector points in the direction of the fastest growth of the potential field, and its magnitude ||▽P|| represents the spatial rate of change of the risk intensity. In the potential field visualization image, high gradient regions appear as dense areas of contour lines, which often indicate the front between normal and risk regions and are risk boundaries that require close attention.

[0062] The second is the divergence of the risk flux, ▽·(Pv). This calculation requires combining a velocity field v(x,y,z,t) obtained from video analysis, describing the movement of people or vehicles on campus. This velocity field is obtained by applying optical flow estimation algorithms to surveillance videos and fusing data from multiple cameras. Pv can be understood as the "risk flux," that is, the strength and direction of risk propagation as entities move. Calculating its divergence can reveal the sources and sinks of risk. Regions with positive and large divergence values ​​indicate that risk is spreading outward from that region, representing the "source" of risk, such as an abnormal gathering of people. Conversely, regions with negative divergence values ​​represent the "sink" of risk, indicating that entities are carrying risk away from that region, such as an orderly evacuation exit.

[0063] The third is the time derivative of the potential field. P / t. By comparing the potential field P(t) of the current period with the potential field P(t-1) of the previous period, the rate of change of the potential value at each voxel is calculated. This indicator directly reflects the rate of risk growth. A high positive value... P / Even if the current potential field value P in a region t is not high, it indicates that the risk in that region is rapidly accumulating and deteriorating, and it has extremely high potential danger, requiring immediate intervention.

[0064] The statistical characteristics of these field theory indices, such as max(||▽P||), avg(||▽P||), max(▽·(Pv)), max( P / t) and the volume V_high_P of high potential regions (e.g. P > 0.7), integrated into a multi-dimensional campus security state vector S. This vector S dynamically and comprehensively characterizes the intensity, spatial distribution, diffusion and convergence trend, and evolution rate of the current campus security risk, providing much richer and deeper information than the traditional "normal / alarm" binary state for subsequent decision making.

[0065] Then, step S4, intervention strategy generation based on model predictive control, is performed. The goal of this step is to automatically and proactively generate a set of optimal intervention instructions based on the evaluated security state S, with the purpose of guiding the abnormal potential field P back to a reference potential field P_base representing absolute safety, a uniform field with all voxel values close to zero, with minimal intervention cost.

[0066] To achieve this goal, the system first establishes a partial differential equation (PDE) model describing the dynamic evolution of the potential field P: P / t = D▽ 2 P - ▽ · (Pv) + F_source - F_intervention. In this equation, D▽ 2 P is the diffusion term, describing the natural spatial dispersion process of the risk without external force, with the diffusion coefficient D fitted from historical data. ▽ · (Pv) is the convection term, describing the propagation of the risk with the flow of people / vehicles. F_source is the source term contributed by newly generated STIQs. F_intervention is the control term representing the suppression effect of the intervention measures on the potential field, which is what we need to solve and impose.

[0067] The generation of the intervention strategy is realized through a model predictive control (MPC) framework. The MPC controller performs rolling optimization with a control period of 5 seconds. At the beginning of each period, the controller first acquires the potential field P(t) at the current time as the initial state of the system. Then, it performs forward simulation using the above PDE model within a limited future time domain, i.e. the prediction horizon T_p, set to 60 seconds. It explores a series of possible intervention action sequences U = {u(t), u(t+5)} within the control horizon T_c, set to 10 seconds, i.e. the next 2 control steps, and predicts the future evolution trajectories of the potential field P under these different action sequences.

[0068] The optimization goal is to find an optimal control sequence U that minimizes a comprehensive cost function J. The cost function is defined as: J = ∫_[t,t+T_p] (||P(τ) - P_base|| + ||▽P(τ)||) dτ + ∫_[t,t+T_p] (||U(τ)|| + ||▽U(τ)||) dτ. The first term of the cost function represents the deviation of the potential field P from the reference potential field P_base, and the second term represents the intervention effort, i.e. the magnitude of the intervention actions and their spatial distribution. 2_Q+||u(τ)||_R)dτ. This function contains two parts: a state penalty term ||P(τ)-P_base|| 2 _Q is used to penalize the deviation between the predicted potential field P(τ) and the safety reference field P_base. The weight matrix Q is a diagonal matrix, and its diagonal elements can be set according to the importance of different regions. For example, a higher weight is applied to the deviation of the chemical laboratory region. The control cost term ||u(τ)||_R is used to penalize the execution cost of the intervention action u(τ). The weight matrix R reflects the resource consumption of different intervention methods, such as dispatching security, activating broadcasts, and adjusting access control. By solving this constrained optimization problem, the MPC controller can find an optimal intervention strategy U that effectively reduces risk while taking into account execution costs over a period of time.

[0069] Subsequently, the MPC controller outputs only the first action u(t) in the optimal sequence as the intervention command that needs to be executed immediately at the current moment. In the next control cycle, the controller will acquire the new potential field state again and repeat the entire prediction and optimization process described above. This rolling optimization method allows the control strategy to continuously adapt to changes in the potential field.

[0070] Finally, step S5, intervention command parsing and closed-loop execution, is executed. This step is responsible for converting the abstract intervention command u(t) generated by the MPC controller into physical control commands for specific security enforcement devices on campus. u(t) is a control vector, whose components correspond to different areas and types of intervention intensities. For example, a component of u(t) u_A_broadcast=0.8 might mean "execute evacuation broadcasts at 80% intensity in area A".

[0071] This transformation process is accomplished by an "intervention resource-action mapping engine." This engine maintains a real-time updated database recording the status of all controllable resources on campus, including the real-time location of every security personnel, the current status of every access control system, the availability of every loudspeaker, and the current orientation of every PTZ camera. Upon receiving u(t), the engine queries the database based on the type, region, and intensity of the instruction, matching the optimal physical resource for execution. For example, for the instruction u_A_broadcast=0.8, the engine will locate all broadcast terminals within area A and send them a preset evacuation announcement at 80% volume. Simultaneously, if u(t) also contains a component instructing to patrol area A, the engine will calculate the nearest available security personnel and push an instruction containing a map of area A's location and patrol requirements to their mobile terminal.

[0072] After the execution of the intervention action, its effect will be immediately perceived by the sensor network within the campus. For example, the presence of security personnel will be reflected in the video surveillance footage, and the evacuation broadcast will cause the movement of the crowd. These changes will generate new STIQs, thus changing the distribution of the spatio-temporal anomaly potential field P. In the next calculation cycle, the updated potential field P(t+1) will be input as the new initial state into the MPC controller. The MPC controller will evaluate the actual effect of the previous intervention action and, on this basis, generate new, more targeted intervention instructions. This process forms a complete, data-driven closed-loop feedback control system, ensuring the continuous effectiveness of the intervention measures and high adaptability to dynamic changes.

[0073] To verify the effectiveness of the method of the present application, a simulation experiment was designed and conducted. The experiment simulated a scenario in which an unauthorized person tried to enter the A experimental building storing dangerous chemicals during the night off-peak hours.

[0074] Scenario setting: the time is 2:00 a.m. A simulated unauthorized person first lingers near the north door (coordinate C1) of the A experimental building for more than 5 minutes. Then, the person tries to use an invalid card to open the north door access control for three times.

[0075] Data collection and STIQ generation: Camera V1 deployed near the north door detects long-term lingering behavior through behavior analysis algorithms. This continuously generates a series of STIQs with DataType "abnormal lingering", and the "lingering time" component in the AnomalyVector continuously increases, causing the anomaly quantization value A to gradually climb from 0.1 to 0.6.

[0076] The north door access controller D1 records three failed card attempts. This generates three STIQs with DataType "unauthorized access attempt", with weight W of 5.0 and anomaly quantization value A close to 1.0.

[0077] Potential field construction and evolution: Due to the continuous generation of the above STIQs, the value of the spatio-temporal anomaly potential field P around the space region of the north door C1 of the A experimental building begins to accumulate rapidly. Due to the effect of the spatial decay kernel function, a Gaussian-shaped potential field protrusion with C1 as the center and a radius of about 5 meters is formed. After the third failed card swipe, the peak value P_max at C1 reaches 0.85.

[0078] Situation assessment: The gradient ||▽P|| of the potential field reaches a peak value of 1.2 in the edge region of the potential field protrusion, far exceeding normal fluctuations. At the same time, due to the rapid accumulation of risk in this region, the time derivative P / A peak of 0.5 / second also appears. These indicators are integrated into the security posture vector S, which indicates that a high-intensity, rapidly developing local risk is forming in the north entrance area of Building A.

[0079] Intervention strategy generation: After receiving the current potential field distribution, the MPC controller performs optimization calculation within its prediction horizon. The deviation penalty weight Q for the area of Building A in the cost function is set to a high value. The optimization result shows that the optimal intervention strategy u(t) should include the following combination: Upgrade the access control permissions of all other entrances of Building A to the highest security level to prevent intruders from entering from other paths.

[0080] Push a high-priority alarm and on-site navigation instructions to the terminal of security guard G03 who is on night patrol about 150 meters away from C1.

[0081] Remotely control camera V1 at C1, turn its gimbal towards the target person, and turn on the infrared fill light for continuous tracking and clear imaging.

[0082] Turn on the sound and light alarm at the entrance of C1 and issue a voice warning: "You have entered the monitoring area, please leave immediately."

[0083] Closed-loop execution and feedback: The intervention resource-action mapping engine parses u(t) into specific control instructions for the access control system, the terminal of security guard G03, camera V1, and the sound and light alarm, and issues them.

[0084] The simulated person leaves under the sound and light alarm and voice warning. Camera V1 captures his departure behavior and generates a new STIQ, whose motion state causes the potential field value to start falling. Security guard G03 arrives at the scene within 2 minutes and confirms that there is no abnormality through the terminal feedback.

[0085] In the next few control periods, the system monitors the potential field value P, gradient ||▽P||, and time derivative P / t of the C1 area, which quickly fall back to the safe baseline level. The MPC controller determines that the risk has been eliminated, and stops the intervention action. The entire process from the first detection of abnormal wandering to the complete elimination of risk takes about 8 minutes, and no manual monitor needs to intervene throughout the process.

[0086] For comparison, the same simulation scenario is conducted in an environment using a traditional security system. The traditional system is based on independent, rule-based subsystems.

[0087] Video monitoring system: only for video tracking after the event, no real-time behavior analysis capability. Security personnel need to find abnormalities by watching multiple video screens through round patrol, which is easy to be overlooked due to fatigue.

[0088] Access control system: set as "three consecutive card swiping failures to generate an alarm log". The log is only recorded in the local server, and needs to be manually queried by security personnel in the monitoring center to be found.

[0089] Scenario reproduction: The simulated personnel loitered at the north gate for 5 minutes, and the traditional video system had no reaction.

[0090] The simulated personnel failed to swipe the card for three times. The access control system generated a low-priority alarm log on the server.

[0091] The security personnel in the monitoring center found the alarm log during the routine inspection 15 minutes later.

[0092] The security personnel manually retrieved the video playback near the north gate to confirm the suspicious personnel.

[0093] The security personnel called the patrol officer G03 through the intercom to go to the scene, which was more than 20 minutes away from the event.

[0094] When the patrol officer G03 arrived at the scene, the simulated personnel had already left.

[0095] Through the detailed description and data comparison of the above examples and comparative examples, it can be clearly seen that the active intervention method based on campus security situation awareness provided by the present application, by constructing a spatio-temporal anomaly potential field model and introducing a closed-loop intervention mechanism based on model predictive control, has made breakthrough progress in the sensitivity of risk perception, the comprehensiveness of situation assessment, the timeliness and intelligence level of intervention response, compared with the prior art, greatly improving the overall security protection capability in complex environments such as campus.

[0096] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the shown or discussed mutual ones can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0097] In addition, the various functional units in the embodiments of the present application can be integrated in one processing unit, or each can exist as an independent physical unit, or two or more than two of them can be integrated in one physical unit. The above-mentioned integrated unit can be implemented in the form of hardware, or in the form of a software functional unit. The above is only an embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation using the content of the specification and drawings of the present application, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

[0098] The specific embodiments of the application are described above, but it is only as an example, and the present application is not limited to the specific embodiments described above. Any equivalent modification or replacement of the present application for those skilled in the art is also within the scope of the present application, therefore, any equivalent transformation and modification, improvement, etc. made without departing from the spirit and principle range of the present application should be covered in the scope of the present application.

Claims

1. A proactive intervention method based on campus security situational awareness, characterized in that, Includes the following steps: S1, Multimodal data paradigmization and spatiotemporal alignment processing, receives and standardizes data streams from multiple heterogeneous sensor networks deployed on campus, and maps the paradigmized data streams to a unified spatiotemporal reference; S2, Constructing a spatiotemporal anomaly potential field and dynamic calculation: Based on the normalized data stream, construct and dynamically calculate a four-dimensional spatiotemporal anomaly potential field P(x,y,z,t) that continuously quantifies the overall campus safety status through a preset field theory model. S3, based on field theory analysis, performs campus security situation assessment. By analyzing the topological structure and dynamic evolution characteristics of the spatiotemporal abnormal potential field, a multidimensional state vector representing the current overall campus security situation is generated. S4, Generate an intervention strategy based on model predictive control. Based on the safety situation represented by the multidimensional state vector, under the optimal control framework, generate a set of active intervention instructions aimed at guiding the spatiotemporal abnormal potential field to a preset safety reference state. S5, parse the intervention command and closed-loop execution, parse the active intervention command into a specific control command for the underlying security execution device and execute it, while continuously monitoring the actual impact of the intervention measures on the spatiotemporal abnormal potential field to form a closed-loop feedback control.

2. The proactive intervention method based on campus security situational awareness according to claim 1, characterized in that, In S1, the heterogeneous sensor network includes: Video surveillance networks are used to output video frame data; Access control system, used to output access log data; Perimeter intrusion detection system, used to output trigger signal data; environmental sensing IoT, used to output scalar sensor data; A network traffic monitoring system is used to output data packet metadata. In S1, the received raw data undergoes a normalization transformation, uniformly encapsulating it into a standardized spatiotemporal information quantum (STIQ) data structure. The spatiotemporal information quantum is a tuple containing the following fields: A timestamp is the time when an event occurred, calibrated to a uniform time base. The three-dimensional coordinates (Coordinate) represent the location of the event within the pre-built three-dimensional geographic information system model of the campus. The entity's unique identifier, Entity_ID, is the identifier of the entity associated with the event; DataType, which is the type encoding of the original data source; Anomaly Vector is a normalized feature vector extracted from the original data to characterize its degree of anomalousness. Metadata.

3. The proactive intervention method based on campus security situational awareness according to claim 2, characterized in that, The extraction methods for the Anomaly Vector include: When the data type is video surveillance data, through target detection and behavior analysis, at least one of the following is extracted and normalized as a component of the abnormal feature vector: regional population density, average moving speed, reverse movement index, loitering duration, or aggregation index. When the data type is network traffic data, at least one of the following is extracted and normalized as a component of the abnormal feature vector: the number of connection requests per unit time, the proportion of abnormal protocols, or the degree to which the average size of data packets deviates from the baseline.

4. The proactive intervention method based on campus security situational awareness according to claim 1, characterized in that, In S2, the potential value P of any point (x, y, z) in space at time t is calculated by the following formula: P(x,y,z,t)=Σ_i[W(DataType_i)A(AnomalyVector_i)K_s(d_i)K_t(Δt_i)] Among them, summation is performed on all spatiotemporal information quanta STIQ_i within the preset time window T_w; W(DataType_i) is the basic risk weight function assigned to the data type DataType_i based on the spatiotemporal information quantum; A(AnomalyVector_i) is an anomalousness function quantized by the anomalous feature vector AnomalyVector_i based on the spatiotemporal information quantum. K_s(d_i) is the spatial decay kernel function, whose value depends on the spatial distance d_i between the calculation point and the location where the spatiotemporal information quantum occurs; K_t(Δt_i) is the time decay kernel function, whose value depends on the time difference Δt_i between the current moment and the moment when the spatiotemporal information quantum occurs.

5. The proactive intervention method based on campus security situational awareness according to claim 4, characterized in that, The anomaly quantification function A(AnomalyVector_i) is implemented through a pre-trained variational autoencoder (VAE) model. The variational autoencoder model is trained using historical data collected on campus under a defined safe condition to learn a low-dimensional latent representation of normal data patterns. The anomaly level is calculated as the reconstruction error between the input anomaly feature vector AnomalyVector_i and its reconstructed vector after passing through the variational autoencoder model. The spatial decay kernel function K_s(d_i) adopts the form of Gaussian kernel function: K_s(d_i)=exp(-d_i^2 / (2σ_s^2)), where σ_s is the spatial influence radius parameter; The time decay kernel function K_t(Δt_i) adopts the form of an exponential decay function: K_t(Δt_i)=exp(-Δt_i / τ_t), where τ_t is the time decay constant.

6. The proactive intervention method based on campus security situational awareness according to claim 1, characterized in that, In step S3, the indices calculated for analyzing the spatiotemporal anomaly potential field include: The potential field gradient ▽P is used to characterize the spatial rate of change of risk intensity. The divergence of risk flux is ▽·(Pv), where v is the velocity field of physical motion obtained through sensor data, used to identify the source or sink of risk; Time derivative of potential field P / t is used to characterize the growth rate of risk intensity; The physical motion velocity field v is obtained by applying an optical flow estimation algorithm to the video data output by the video surveillance network and fusing data from multiple cameras, describing the velocity field of people or vehicles moving within the campus. The multidimensional state vector is composed of the statistical characteristics of the potential field gradient, the divergence of the risk flux, and the time derivative of the potential field. The statistical characteristics include the maximum value, the mean value, and the volume of the high-value region.

7. The proactive intervention method based on campus security situational awareness according to claim 1, characterized in that, In S4, the optimal control framework is a model predictive control framework, which generates the active intervention command by solving an optimization problem based on the currently acquired spatiotemporal anomaly potential field as the initial state in each control cycle. The specific implementation of the model predictive control framework includes: A partial differential equation model describing the dynamic evolution of the spatiotemporal anomalous potential field is established; Within each control cycle, within a finite future prediction time domain T_p, the partial differential equation model is used to predict the future evolution trajectory of the spatiotemporal anomalous potential field under the application of possible intervention action sequences. By solving the optimization problem, the optimal intervention sequence U in the control time domain T_c that minimizes the predefined cost function is found, and the first action in the sequence is output as the active intervention instruction at the current moment.

8. The proactive intervention method based on campus security situational awareness according to claim 7, characterized in that, The predefined cost function J is defined by the following formula: J=∫_[t,t+T_p](||P(τ)-P_base|| 2 _Q+||u(τ)||_R)dτ Among them, the first term is ||P(τ)-P_base|| 2 _Q is the state penalty term, used to penalize the deviation between the predicted potential field P(τ) and the preset safe reference state P_base, and Q is the state weight matrix; the second term ||u(τ)||_R is the control cost term, used to penalize the cost of performing the intervention action (u(τ)), and R is the control weight matrix.

9. The proactive intervention method based on campus security situational awareness according to claim 1, characterized in that, In S5, the active intervention command is parsed through an intervention resource-action mapping engine; The engine maintains a database storing all available intervention resources and their status, and queries the database to match the optimal physical resources to execute the instruction based on the received active intervention instruction; The intervention resources include security personnel, access control controllers, audible and visual alarms, broadcasting systems, and pan-tilt-zoom (PTZ) cameras in video surveillance systems. The closed-loop feedback control is characterized as follows: After the intervention command is executed, the heterogeneous sensor network continuously collects data to calculate in real time the actual impact of the intervention measures on the spatiotemporal anomalous potential field. The updated spatiotemporal anomaly potential field will be used as the initial state for the next control cycle and input into the model predictive control framework to achieve dynamic adjustment of subsequent intervention strategies.

10. A proactive intervention system based on campus security situational awareness, characterized in that, include: One or more processors; A memory having stored one or more programs, which, when executed by one or more processors, cause the one or more processors to implement a proactive intervention method based on campus security situational awareness as described in any one of claims 1 to 9.

Images