Alarm event processing method and device, electronic equipment and program product

Abstract

The invention discloses an alarm event processing method and device, electronic equipment and a program product, and relates to the field of computers.The method comprises the steps that an alarm frame corresponding to an alarm event is obtained, frame feature extraction is conducted on the alarm frame, and multi-modal feature data corresponding to the alarm frame are obtained, the alarm frame is used for indicating that the alarm event meets preset alarm conditions; performing false alarm evaluation on the multi-modal feature data to obtain a false alarm probability of the alarm frame, the false alarm probability being used for indicating a probability that the alarm event is a false alarm unexpected alarm event; when the false alarm probability is greater than a preset false alarm threshold value, generating a false alarm record associated with a preset alarm condition based on the alarm frame and the false alarm probability; based on the at least one false alarm record associated with the preset alarm condition, performing confidence assessment on the preset alarm condition to obtain the confidence of the alarm condition; and when the confidence coefficient is smaller than a preset confidence threshold value, a preset alarm condition is corrected.

Description

Technical Field

[0001] This invention relates to the field of computers, and more specifically, to a method and apparatus for handling alarm events, electronic equipment, and program products. Background Technology

[0002] In existing alarm systems, statically configured alarm rules are easily affected by environmental changes, equipment performance fluctuations, and the evolution of business scenarios, resulting in a persistently high false alarm rate. In particular, when an alarm rule is triggered, traditional systems often lack effective means to immediately assess and confirm whether the alarm is a false alarm, and whether the false alarm was caused by improper rule settings. Therefore, related technologies suffer from low accuracy in alarm event processing. Summary of the Invention

[0003] This invention provides a method, apparatus, electronic device, and program product for processing alarm events, in order to at least solve the technical problem of low accuracy in processing alarm events in related technologies.

[0004] To achieve the above objectives, according to one aspect of this application, a method for processing alarm events is provided, comprising: acquiring an alarm frame corresponding to an alarm event, and extracting frame features from the alarm frame to obtain multimodal feature data corresponding to the alarm frame, wherein the alarm frame is used to indicate that the alarm event meets preset alarm conditions; performing false alarm assessment on the multimodal feature data to obtain a false alarm probability of the alarm frame, wherein the false alarm probability is used to indicate the probability that the alarm event is a false alarm of an unexpected alarm event; if the false alarm probability is greater than a preset false alarm threshold, generating a false alarm record associated with the preset alarm conditions based on the alarm frame and the false alarm probability; performing a confidence assessment on the preset alarm conditions based on at least one false alarm record associated with the preset alarm conditions to obtain a confidence level of the alarm conditions; and correcting the preset alarm conditions if the confidence level is less than a preset confidence threshold.

[0005] According to another aspect of the present invention, an alarm event processing apparatus is also provided, comprising: an acquisition unit, configured to acquire an alarm frame corresponding to an alarm event and extract frame features from the alarm frame to obtain multimodal feature data corresponding to the alarm frame, wherein the alarm frame is used to indicate that the alarm event meets preset alarm conditions; a first evaluation unit, configured to perform false alarm evaluation on the multimodal feature data to obtain a false alarm probability of the alarm frame, wherein the false alarm probability is used to indicate the probability that the alarm event is a false alarm of an unexpected alarm event; a generation unit, configured to generate a false alarm record associated with the preset alarm conditions based on the alarm frame and the false alarm probability when the false alarm probability is greater than a preset false alarm threshold; a second evaluation unit, configured to perform a confidence evaluation on the preset alarm conditions based on at least one false alarm record associated with the preset alarm conditions to obtain a confidence level of the alarm conditions; and a correction unit, configured to correct the preset alarm conditions when the confidence level is less than a preset confidence threshold.

[0006] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the alarm event processing method of any of the above.

[0007] According to another aspect of the present invention, a computer program product is also provided, including a computer program, wherein when the computer program is executed by a processor, it implements the steps of the alarm event processing method of any of the above-mentioned methods.

[0008] The embodiments provided in this application generate multimodal feature data by extracting frame features from alarm frames and combining them with text descriptions of alarm events, video images, audio clips, and environmental and business-side information. These features are then subjected to in-depth analysis to instantly output the false alarm probability of the alarm event. This ensures the system can quickly respond to and identify unexpected alarm events, avoiding invalid or outdated alarms and significantly improving alarm accuracy. Based on collected false alarm records, the effectiveness of preset alarm conditions is quantitatively evaluated, i.e., the confidence level of the alarm conditions is calculated. The confidence level evaluation mechanism can statistically analyze the frequency and trend of false alarms under specific alarm conditions and determine whether alarm conditions need to be corrected by setting a confidence threshold. This method transforms the evaluation of alarm rules from static to dynamic, enabling timely reflection of the actual performance of alarm conditions in the current environment and business scenario, thereby avoiding continuous false alarms caused by rules remaining unchanged or having poor adaptability. When the confidence level of a preset alarm condition is found to be lower than the preset confidence threshold, a correction strategy is generated and automatically executed, completing rule optimization without manual intervention, thus improving the efficiency and accuracy of alarm rule correction. In this way, not only can the false alarm probability of alarm events be quickly and accurately identified and assessed, but alarm rules can also be intelligently corrected based on the false alarm assessment results. This fundamentally solves the problem that static alarm rules in existing alarm systems are prone to generating high false alarm rates, and achieves the technical effect of improving the accuracy of alarm event processing. It also solves the technical problem of low accuracy in alarm event processing in related technologies. Attached Figure Description

[0009] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0010] Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method for handling alarm events is shown.

[0011] Figure 2 This is a flowchart of an optional alarm event processing method according to an embodiment of the present invention.

[0012] Figure 3 This is a flowchart of an optional dynamic alarm rule optimization method based on large model workflow orchestration according to an embodiment of the present invention.

[0013] Figure 4 This is a flowchart of another optional dynamic alarm rule optimization method based on large model workflow orchestration according to an embodiment of the present invention.

[0014] Figure 5 This is a schematic diagram of an optional alarm event processing device according to an embodiment of the present invention.

[0015] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0016] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0017] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0018] It should be noted that the alarm event handling method and apparatus in this disclosure can be used in the computer field, or in any field other than the computer field. This disclosure does not limit the application field of the alarm event handling method and apparatus.

[0019] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected in this public disclosure are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0020] It should be noted that in this disclosure, customer information is collected and analyzed, and users are provided with corresponding operation entry points to choose whether to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0021] The present invention will now be described in detail with reference to various embodiments.

[0022] Example 1

[0023] According to an embodiment of the present invention, an embodiment of a method for processing alarm events is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0024] The alarm event handling method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method for handling alarm events is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 (Illustrated as 102a, 102b, ..., 102n) Processor 102 (processor 102 may include, but is not limited to, a microprocessor MCU (Microcontroller Unit) or a programmable gate array (FPGA), etc.), memory 104 for storing data, and transmission device 106 for communication functions. In addition, it may include: a display, input / output interface (I / O interface), Universal Serial Bus (USB) port (which may be included as one of the ports of the BUS bus), network interface, power supply, and / or camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0025] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0026] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the alarm event handling method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the alarm event handling method described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0027] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0028] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0029] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for handling alarm events is shown. Figure 2 This is a flowchart of an optional alarm event processing method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0030] S202, obtain the alarm frame corresponding to the alarm event, and extract the frame features of the alarm frame to obtain the multimodal feature data corresponding to the alarm frame. The alarm frame is used to indicate that the alarm event meets the preset alarm conditions.

[0031] S204, Perform false alarm evaluation on multimodal feature data to obtain the false alarm probability of alarm frame, wherein the false alarm probability is used to indicate the probability that the alarm event is a false alarm or an unexpected alarm event;

[0032] S206, When the false alarm probability is greater than the preset false alarm threshold, generate a false alarm record associated with the preset alarm conditions based on the alarm frame and the false alarm probability;

[0033] S208, Based on at least one false alarm record associated with the preset alarm conditions, perform a confidence assessment on the preset alarm conditions to obtain the confidence level of the alarm conditions;

[0034] S210, if the confidence level is less than the preset confidence threshold, the preset alarm conditions are corrected.

[0035] Optionally, in this embodiment, an alarm frame refers to an image or video frame containing evidence of abnormal activity captured by the system when an alarm event occurs.

[0036] Optionally, in this embodiment, the multimodal feature data includes the time, location, environmental information, video frame features, audio features, sensor signals, etc. of the alarm event, which are used to comprehensively analyze all aspects of the alarm event.

[0037] Optionally, in this embodiment, the false alarm probability is based on the analysis results of the alarm frame by the AI ​​model, which assesses the possibility that the alarm event is a false alarm. The higher the probability value, the more likely the event is to be a false alarm.

[0038] Optionally, in this embodiment, the preset alarm conditions are conditions for triggering an alarm that are pre-set by the system or experts, including thresholds, detection conditions, arming strategies, etc.

[0039] Optionally, in this embodiment, the confidence level is a quantitative assessment of the effectiveness and accuracy of the preset alarm conditions in the current scenario, used to determine whether the rules need to be adjusted. The preset confidence threshold is a set standard for judging whether an alarm condition is effective; alarm conditions below this threshold are considered to need correction.

[0040] Optionally, in this embodiment, after receiving an alarm signal, the corresponding alarm frame is acquired, and then multimodal feature data is extracted from these alarm frames, including but not limited to video frame analysis, audio signal processing, sensor data reading, etc., in order to comprehensively capture the contextual information of the alarm event.

[0041] Using a pre-trained multimodal AI model, the extracted feature data is deeply analyzed to assess the likelihood of an alarm frame being a false alarm, and a false alarm probability value is output. If the false alarm probability exceeds a preset false alarm threshold, the system marks the alarm event as a false alarm and generates a false alarm record containing the alarm frame and the false alarm probability.

[0042] Based on accumulated false alarm records, statistical analysis is performed on false alarm events associated with specific alarm conditions to calculate the confidence level of the alarm condition and evaluate its actual effect in the current environment. When the confidence level of an alarm condition falls below a preset confidence threshold, the system automatically enters a rule correction process, generating optimization suggestions for thresholds, detection conditions, sensor weights, or masking strategies to improve the accuracy and adaptability of alarm rules.

[0043] Optionally, in this embodiment, by acquiring alarm frames of alarm events and extracting multimodal feature data from the alarm frames, a comprehensive basis is provided for subsequent false alarm assessment. Subsequently, an AI model is used to analyze these feature data to derive the false alarm probability, transforming high-probability false alarm events into information that the system can process, namely, false alarm records. Based on the false alarm records, the confidence level of preset alarm conditions is further evaluated to quantify their effectiveness and reliability in actual operation. When the confidence level of a certain alarm condition is found to be lower than the preset standard, the rule correction process can be automatically initiated to generate and execute optimization suggestions. Dynamic adjustment of alarm conditions can be achieved without manual intervention, significantly shortening the rule tuning cycle, reducing the false alarm rate, and improving the intelligence level of the alarm system.

[0044] The embodiments provided in this application generate multimodal feature data by extracting frame features from alarm frames and combining them with text descriptions of alarm events, video images, audio clips, and environmental and business-side information. These features are then subjected to in-depth analysis to instantly output the false alarm probability of the alarm event. This ensures the system can quickly respond to and identify unexpected alarm events, avoiding invalid or outdated alarms and significantly improving alarm accuracy. Based on collected false alarm records, the effectiveness of preset alarm conditions is quantitatively evaluated, i.e., the confidence level of the alarm conditions is calculated. The confidence level evaluation mechanism can statistically analyze the frequency and trend of false alarms under specific alarm conditions and determine whether alarm conditions need to be corrected by setting a confidence threshold. This method transforms the evaluation of alarm rules from static to dynamic, enabling timely reflection of the actual performance of alarm conditions in the current environment and business scenario, thereby avoiding continuous false alarms caused by rules remaining unchanged or having poor adaptability. When the confidence level of a preset alarm condition is found to be lower than the preset confidence threshold, a correction strategy is generated and automatically executed, completing rule optimization without manual intervention, thus improving the efficiency and accuracy of alarm rule correction. In this way, not only can the false alarm probability of alarm events be quickly and accurately identified and assessed, but alarm rules can also be intelligently corrected based on the false alarm assessment results. This fundamentally solves the problem that static alarm rules in existing alarm systems are prone to generating high false alarm rates, and achieves the technical effect of improving the accuracy of alarm event processing.

[0045] As an optional approach, based on at least one false alarm record associated with a preset alarm condition, a confidence assessment is performed on the preset alarm condition to obtain the confidence level of the alarm condition, including:

[0046] Based on the set of false alarm records associated with the preset alarm conditions in multiple time intervals, and all alarm events associated with the preset alarm conditions in multiple time intervals, determine the false alarm rate of the preset alarm conditions in each time interval.

[0047] The confidence level is obtained by weighting the false alarm rates of each time interval according to the time weight corresponding to each time interval.

[0048] Optionally, in this embodiment, the false alarm record set refers to the set of events that are triggered according to preset alarm conditions within a certain period of time but are judged as false alarms by the system. Each false alarm record contains specific information about triggering the alarm, the false alarm judgment logic, and a related timestamp.

[0049] Optionally, in this embodiment, all alarm events include the set of all alarm events triggered by preset alarm conditions, including false alarm events and non-false alarm events.

[0050] Optionally, in this embodiment, the false alarm rate refers to the proportion of the number of false alarm records to the total number of alarm events within a specific time interval, and is used to quantify the false alarm frequency of a specific rule.

[0051] Optionally, in this embodiment, the time weight indicator assigns higher weight to recent data and gradually reduces the weight of older data, so that the system pays more attention to the impact of recent false alarm events on the confidence level of alarm conditions.

[0052] Optionally, in this embodiment, the confidence level is an indicator that evaluates the effectiveness and reliability of the preset alarm conditions in the current environment by comprehensively considering the false alarm rate and its corresponding time weight.

[0053] Optionally, in this embodiment, the total number of alarm events triggered by the preset alarm condition in different time intervals is first counted, and then the events that are judged as false alarms are filtered out from these events. The proportion of false alarm events in each time interval to the total number of alarm events is calculated, that is, the false alarm rate of the alarm condition in each time interval is obtained.

[0054] To more accurately reflect the current effectiveness of alarm rules, the system introduces a time-weighted mechanism. Time weights are set according to a decreasing time principle, meaning that time intervals closer to the current time have higher weights, and vice versa. This can be achieved through an exponential decay function or other decreasing functions, ensuring that recent data has a greater impact on confidence assessment than older data.

[0055] Based on the false alarm rate and corresponding time weight for each time interval, a weighted summation method is used to calculate the confidence level of the preset alarm condition. Specifically, the false alarm rate of each time interval is multiplied by its time weight, and then the weighted false alarm rates of all time intervals are summed. The result is the confidence level of the alarm condition.

[0056] Through the embodiments provided in this application, by comprehensively considering the frequency and time factors of false alarms, the confidence assessment mechanism can effectively locate failed alarm conditions and promptly trigger the rule correction process, avoiding the problem of continuous false alarms caused by outdated rule configurations. This not only improves the intelligence of alarm event handling but also ensures the adaptability and stability of the alarm system.

[0057] As an optional approach, after determining the false alarm rate for each time interval within multiple time intervals under the preset alarm conditions, the method further includes:

[0058] Obtain the percentage of false alarm records in the set of false alarm records associated with each time interval whose false alarm probability differs from the preset false alarm threshold by more than the preset difference.

[0059] The confidence level is obtained by weighting and summing the false alarm rates for each time interval according to the proportion corresponding to each time interval; or,

[0060] The confidence level is obtained by weighting and summing the false alarm rates for each time interval according to the time weight and proportion of each time interval.

[0061] Optionally, in this embodiment, the preset difference value is a set threshold value used to measure the degree of difference between the false alarm probability and the preset false alarm threshold. Setting this difference value can reflect the system's sensitivity to false alarm events, helping to more accurately identify which false alarm events have a more significant impact on rule confidence.

[0062] Optionally, in this embodiment, the percentage indicates the percentage of false alarm records in a specific time interval whose false alarm probability differs from a preset false alarm threshold by more than a preset difference, relative to all false alarm records in that time interval. This is used to measure the proportion of high-probability false alarm events in the overall false alarm events and their contribution to the rule confidence assessment.

[0063] Optionally, in this embodiment, after determining the false alarm rate of the preset alarm conditions in multiple time intervals, the present invention further filters out false alarm records whose false alarm probability differs from the preset false alarm threshold by a value greater than the preset difference, and calculates the proportion of these high-probability false alarm records in the set of false alarm records in each time interval, i.e., the percentage.

[0064] Based on the proportion of high-probability false alarm records identified above, there are two methods to calculate the confidence level:

[0065] The first method uses only the percentage as the weight to perform a weighted sum of the false alarm rates for each time interval. For example, the false alarm rate for each time interval is first multiplied by its corresponding percentage, and then summed to obtain the confidence level.

[0066] The second method combines time weights and the aforementioned proportions to perform a double-weighted summation of the false alarm rates for each time interval. For example, the false alarm rate for each time interval is first multiplied by its corresponding proportion, then multiplied by its corresponding time weight, and then summed to obtain the confidence level.

[0067] Whether using percentage as the weight or combining time weight and percentage for dual weighting, the goal is to more accurately assess the true effectiveness of preset alarm conditions in the current business environment. This method, by emphasizing the impact of high-confidence false alarm events on confidence assessment, ensures that the system's evaluation of alarm rules focuses more on those rules that most need correction, thereby improving the targeting and efficiency of rule optimization.

[0068] By using the embodiments provided in this application, the system can identify which false alarm events have the most significant impact on the confidence level of preset alarm conditions by filtering out false alarm records whose false alarm probabilities differ significantly from a preset threshold and calculating the proportion of these records in each time interval. Then, according to the selected method (using only proportion or combining time weight and proportion), the false alarm rates in each time interval are weighted and summed to obtain the final confidence level of the preset alarm conditions. This approach considers not only the number of false alarm events but also the importance of the events and the impact of time factors on the confidence level, making the evaluation results more objective and accurate, and able to reflect the actual performance of alarm rules in specific scenarios in a timely manner.

[0069] As an optional solution, the preset alarm conditions can be modified, including:

[0070] Multiple correction simulations are performed on the preset alarm conditions. One correction simulation is used to indicate that a correction simulation operation is performed on the preset alarm conditions. The multiple correction simulation operations corresponding to multiple correction simulations include each correction operation in multiple preset correction operations and an ordered combination operation of at least two correction operations in multiple preset correction operations.

[0071] Given the simulation score of each correction simulation in multiple correction simulations, the target correction simulation operation corresponding to the target correction simulation with the highest simulation score is determined as the target correction operation to be executed under the preset alarm condition. The simulation score is used to indicate the degree of increase in the confidence of the preset alarm condition after each correction simulation.

[0072] Perform target correction operations on preset alarm conditions.

[0073] Optionally, in this embodiment, correction simulation refers to simulating the execution of a preset correction strategy before the actual correction operation is performed, in order to predict and evaluate the expected effect of the alarm conditions after correction. One correction simulation corresponds to the simulation execution of one correction strategy, while multiple correction simulations cover the simulation process of multiple strategies or combinations of strategies.

[0074] Optionally, in this embodiment, the preset correction operation is a variety of strategy options for correcting alarm conditions, pre-set based on historical data analysis and expert advice. These operations may include adjusting thresholds, adding or deleting detection conditions, reallocating sensor weights, or formulating masking strategies for specific time periods.

[0075] Optionally, in this embodiment, ordered combination operation refers to combining two or more preset correction operations in a specific order to form a more complex correction strategy. For example, adjusting the threshold first, and then adjusting the sensor weights, in order to achieve a better confidence improvement effect.

[0076] Optionally, in this embodiment, the simulated score is a quantitative evaluation of the overall effect of the correction operation after the simulation correction operation, based on multiple indicators such as the predicted decrease in false positive rate, changes in rule coverage, and business compliance. The higher the score, the greater the potential for the correction operation to improve confidence.

[0077] Optionally, in this embodiment, the preset alarm conditions are subjected to multiple correction simulations, with each simulation executing a preset correction operation or an ordered combination of operations. This includes individually correcting the threshold, adjusting sensor weights, adding or removing detection conditions, and simulations combining these operations in different orders to comprehensively evaluate the potential effects of various correction strategies.

[0078] For each corrective simulation, the system calculates a simulation score based on the simulation results to quantify the contribution of the corrective action to improving the confidence level of the alarm conditions. This calculation considers factors such as the corrected false alarm rate, rule coverage, and business compliance. The system compares the simulation scores of all corrective simulations to determine the target corrective simulation action with the highest simulation score.

[0079] The correction operation with the highest simulation score is identified as the target correction operation, which is the strategy most likely to improve the confidence level of the alarm condition in a real-world scenario. The system then executes this target correction operation to actually correct the preset alarm condition.

[0080] The current affairs category provided in this application, by introducing the concepts of correction simulation and simulation score, achieves intelligent optimization of preset alarm conditions. The system first executes multiple correction simulations, covering all preset correction operations and their ordered combinations, to comprehensively evaluate possible correction strategies. Next, the system quantitatively evaluates the overall effect of each correction operation based on the simulation results, comparing the merits of different strategies through simulation scores. This calculation process comprehensively considers multiple dimensions such as the corrected false alarm rate, rule coverage, and business compliance, ensuring the comprehensiveness and objectivity of the evaluation. Finally, the system selects the target correction simulation operation with the highest simulation score for actual execution. This method not only improves the efficiency of rule correction but also ensures the effectiveness and relevance of the correction strategy, avoiding problems such as insufficient rule coverage or over-adjustment caused by blind correction.

[0081] As an optional approach, before performing multiple correction simulations on the preset alarm conditions, the method also includes:

[0082] Obtain a first correction operation and a second correction operation associated with a preset alarm condition, wherein the first correction operation is used to instruct the alarm parameter of the preset alarm condition to be increased by a first magnitude value, and the second correction operation is used to instruct the alarm parameter to be decreased by a second magnitude value.

[0083] Obtain the third and fourth correction operations associated with the preset alarm conditions. The third correction operation is used to indicate the addition of a first alarm sub-condition to the preset alarm conditions, and the fourth correction operation is used to indicate the deletion of a second alarm sub-condition to the preset alarm conditions.

[0084] Obtain the fifth correction operation associated with the preset alarm conditions, wherein the fifth correction operation is used to indicate the adjustment of the effective time of the preset alarm conditions;

[0085] The multiple correction operations include a first correction operation, a second correction operation, a third correction operation, a fourth correction operation, and a fifth correction operation.

[0086] Optionally, in this embodiment, the first correction operation refers to an adjustment strategy that increases the alarm parameter in the preset alarm conditions by a certain margin, aiming to reduce false alarms caused by environmental fluctuations or equipment noise by increasing the sensitivity threshold. The second correction operation is the opposite of the first correction operation, which is a strategy that decreases the alarm parameter by a certain margin, aiming to avoid oversensitivity, reduce false alarms caused by unnecessary or overly detailed alarm conditions, and ensure that important events are not missed.

[0087] Optionally, in this embodiment, the third correction operation involves adding one or more first alarm sub-conditions to the preset alarm conditions. By adding alarm judgment logic, such as adding specific time intervals, weather conditions, or specific behavioral patterns, the rules become more refined, reducing false alarms caused by ambiguous rules. The fourth correction operation instructs the deletion of one or more second alarm sub-conditions from the preset alarm conditions to eliminate alarm judgment criteria that are no longer applicable or incompatible with the current environment, thereby reducing the false alarm rate and improving the relevance and effectiveness of the rules.

[0088] Optionally, in this embodiment, the fifth correction operation instruction adjusts the effective time of the preset alarm conditions, including but not limited to setting the blocking or activation of alarm rules within a specific time period, in order to adapt to changes in business cycles and environment, and avoid triggering unnecessary alarms during non-sensitive time periods or specific events.

[0089] Optionally, in this embodiment, five types of correction operations related to preset alarm conditions are acquired, including parameter adjustment (increase / decrease), addition or deletion of alarm sub-conditions, and adjustment of alarm rule effective time. These operation types cover various common needs for alarm condition adjustment, such as sensitivity adjustment, logic refinement, rule simplification, and time adaptation.

[0090] For each correction operation type, the system further defines specific correction strategies, including the magnitude of parameter adjustment, the type of alarm sub-condition to be added or deleted, and the adjustment method for the effective time. For example, the first and second correction operations define the magnitude of increasing and decreasing alarm parameters, respectively, while the third and fourth correction operations specify the specific logic for adding and deleting alarm sub-conditions.

[0091] Finally, the system integrates the first, second, third, fourth, and fifth correction operations obtained above to form a set containing all possible correction strategies, providing a comprehensive strategy framework for subsequent correction simulation and evaluation.

[0092] The embodiments provided in this application define five correction operation types to address the diversity of preset alarm conditions, aiming to cover various aspects of rule adjustment, including threshold sensitivity adjustment, alarm logic refinement and simplification, and rule time adaptability optimization. By refining the specific correction strategies for each operation, such as the magnitude of parameter adjustment, the logic of alarm sub-conditions, and the setting of effective time, the system constructs a comprehensive correction strategy library for subsequent correction simulation. This preprocessing step provides rich strategy choices for correction simulation, ensuring that the potential of different correction strategies to improve the confidence of alarm conditions can be fully evaluated during the correction simulation process.

[0093] As an optional approach, frame feature extraction is performed on the alarm frame to obtain the multimodal feature data corresponding to the alarm frame, including:

[0094] The alarm frame is parsed to obtain the timestamp data, sensor identification data, geographic location data, and alarm type data corresponding to the alarm frame;

[0095] The video stream data and sensor time-series data corresponding to the alarm event are acquired, and the video stream data and sensor time-series data are parsed to obtain the video stream features and sensor time-series features corresponding to the alarm event.

[0096] Timestamp data, sensor identification data, geographic location data, alarm type data, video stream features, and sensor time-series features are identified as multimodal feature data.

[0097] Optionally, in this embodiment, timestamp data refers to the specific time point when the alarm frame is captured or generated, used to locate the time of the event and provide timing information of the alarm event. Sensor identification data is used to uniquely identify the sensor that triggered the alarm, including the sensor's ID, type, and location, which helps the system track and analyze the abnormal state and performance of specific sensors. Geographic location data refers to the specific geographic coordinates of the alarm event, used to locate the location of the event, facilitating regional management and analysis by the system, such as combining map information to determine the rationality of the alarm event. Alarm type data describes the type of alarm event, such as intrusion, fire, vehicle violation, etc., used by the system to quickly identify and classify different alarm events, providing targeted response strategies.

[0098] Optionally, in this embodiment, the video stream features are key features extracted from the video stream related to the alarm event, including but not limited to target detection, behavior recognition, optical flow analysis, and image content description, used to comprehensively determine the authenticity of the alarm event. The sensor time-series features are time-series features extracted from continuously acquired data from the sensor, such as the trend of signal strength changes, identification of abnormal patterns, and continuity of sensor status, used to assess the environmental background of the alarm event and the operating status of the sensor.

[0099] Optionally, in this embodiment, the alarm frame is parsed to extract its timestamp data, sensor identification data, geographical location data, and alarm type data. This step aims to obtain basic information about the alarm event and provide necessary data for subsequent feature extraction and event localization.

[0100] Subsequently, the system acquires video stream data and sensor time-series data related to the alarm event, performs target detection, behavior recognition, and optical flow analysis on the video stream, and extracts time-series features from the sensor data to comprehensively reflect the visual and physical background information of the alarm event.

[0101] The extracted timestamp data, sensor identification data, geographic location data, alarm type data, video stream features, and sensor temporal features are integrated to form a multimodal feature dataset. This feature data, which integrates temporal, spatial, visual, and physical information, provides a comprehensive analytical foundation for subsequent false alarm assessment and rule optimization.

[0102] The embodiments provided in this application, through a detailed description of the multimodal feature data extraction process, aim to ensure that the system can comprehensively and accurately understand the contextual information of alarm events. First, by parsing alarm frames, the system obtains the time point of the event, the sensor information that triggered the alarm, the location of the event, and the type of alarm. This provides crucial information for the initial location and classification of the event. Next, the system deeply analyzes the video stream and sensor data related to the event, extracting target behavior features from the video stream and temporal change information from the sensor data. This feature data reflects the visual details and environmental background of the event, helping the system to perform deeper event judgment and threshold optimization. Finally, all extracted basic information and feature data are integrated to form a multimodal feature dataset. In this way, the system not only grasps the basic situation of the alarm event but also comprehensively evaluates various aspects of the event.

[0103] As an optional approach, false alarm assessment is performed on multimodal feature data to obtain the false alarm probability of the alarm frame, including:

[0104] Multimodal feature data is input into a multimodal prediction model to obtain the false alarm probability of the alarm frame output by a multimodal evaluation model. The multimodal evaluation model is a pre-trained neural network model used to evaluate false alarms of the input multimodal feature data.

[0105] After assessing the confidence level of the preset alarm conditions based on at least one false alarm record associated with preset alarm conditions, the method further includes:

[0106] The parameters of the multimodal evaluation model are updated based on the set of false alarm records associated with the preset alarm conditions in multiple time intervals, and all alarm events associated with the preset alarm conditions in multiple time intervals.

[0107] Optionally, in this embodiment, the multimodal prediction model is a trained neural network model that can process multiple types of data from different sensors and evaluate the probability of whether an alarm frame is a false alarm by analyzing multimodal feature data.

[0108] Optionally, in this embodiment, the multimodal feature data includes a comprehensive data set of timestamp data, sensor identification data, geographic location data, alarm type data, video stream features, and sensor timing features, which is used to comprehensively reflect the contextual information of the alarm event.

[0109] Optionally, in this embodiment, the parameter update instruction adjusts the network weights or structural parameters in the multimodal prediction model based on the deviation between the model's prediction performance and the actual false alarm situation, so as to improve the accuracy and adaptability of the model in assessing false alarms of alarm events.

[0110] Optionally, in this embodiment, the extracted multimodal feature data is used as input and fed into a pre-trained multimodal prediction model. After deep learning analysis, the model outputs a false alarm probability representing the likelihood that the alarm frame is a false alarm. This process utilizes the model's cross-modal fusion capability, improving the accuracy of false alarm detection through comprehensive analysis of video, sensor data, and basic information of the alarm frame.

[0111] After completing the confidence assessment of the preset alarm conditions, the system updates the parameters of the multimodal prediction model based on the set of false alarm records and all alarm events over multiple time intervals in the past. This update process typically includes retraining the model to learn the latest false alarm patterns, adjusting model weights, or optimizing the model structure to ensure that the model can better adapt to the current business environment and the distribution of false alarm data, thereby improving its accuracy and reliability in future false alarm detection.

[0112] Through the embodiments provided in this application, by inputting multimodal feature data into a pre-trained multimodal prediction model, the system can assess the false alarm probability of alarm frames based on deep learning technology. This assessment process fully utilizes the model's cross-modal learning capabilities, effectively integrating visual, physical, and contextual information, and significantly improving the accuracy of false alarm discrimination. Secondly, after completing the confidence assessment of alarm conditions, the multimodal prediction model's parameters are proactively updated. This mechanism, based on a large amount of false alarm records and alarm event data, enables the model to continuously learn and adapt to new false alarm features and business scenarios, ensuring that the model maintains a high judgment accuracy over the long term. Through this dynamic learning and adjustment process, the multimodal prediction model becomes a key component for dynamically optimizing alarm rules in the entire system, continuously improving the system's intelligent response capabilities and dynamic rule adjustment capabilities, and significantly enhancing the overall system performance and user experience.

[0113] As an alternative approach, the aforementioned alarm event handling methods can be applied to dynamic alarm rule optimization scenarios based on AI-driven large-scale model workflow orchestration. In this scenario, traditional security platforms typically employ static rules written only once, such as "thresholds + deployment tables." With changes in environmental temperature and humidity, business load cycles, or temporary construction, thresholds fixed based on expert experience quickly become invalid, leading to a surge in false alarms and missed alarms. Each correction often requires coordination meetings among equipment vendors, system integrators, and operations personnel, scheduling on-site configuration changes and retesting, averaging several weeks. During this period, numerous noisy alarms consume the on-duty personnel's time, masking the true potential risks. Therefore, the industry urgently needs a mechanism that can automatically diagnose rule defects upon the occurrence of false alarms, instantly generate executable optimization suggestions, and issue them in a closed loop, transforming "waiting for manual rule modification" into "rules self-evolving with the scenario," thereby significantly shortening the handling chain, reducing false alarm rates, and improving system availability and user experience.

[0114] This embodiment addresses the technical problems of high false alarm rates, long rule optimization cycles, and high manual intervention costs in the aforementioned security alarm systems caused by static rules that cannot dynamically evolve with changes in the environment, business, or threat situation. By introducing a large AI model, a closed-loop process is achieved from rule triggering and false alarm judgment to optimization suggestion generation, thereby reducing the false alarm rate, improving alarm accuracy, and enhancing the system's intelligence level.

[0115] A flowchart of a dynamic alarm rule optimization method based on large model workflow orchestration is shown below. Figure 3 The diagram illustrates the process from alarm triggering to new rule taking effect. The specific steps are as follows:

[0116] Rule-triggered alarm: An existing alarm rule is triggered, generating an alarm signal.

[0117] Large-scale model for identifying false alarms: Analyze alarm signals using a large-scale model to determine whether they are false alarms.

[0118] Generate optimization suggestions: Based on the false positive results, the large model generates optimization suggestions for the original rules.

[0119] Confirmation and Issuance: After relevant personnel or the system review and confirm the optimization suggestions, the execution command is issued.

[0120] New rules take effect: The optimized new alarm rules have been officially put into use, completing one rule iteration.

[0121] Another flowchart of a dynamic alarm rule optimization method based on large-model workflow orchestration is shown below. Figure 4 The diagram illustrates the complete closed-loop process from monitoring alarm events to iterative rule optimization. The specific steps are as follows:

[0122] Monitoring alarm events: The system monitors and captures various alarm-related events in real time.

[0123] Alarm event standardization: The captured alarm events are standardized in terms of format and content to facilitate subsequent analysis.

[0124] False alarm identification: Determine whether the alarm is a false alarm using a large model; if not, output the alarm directly; if so, proceed to the subsequent optimization process.

[0125] Rule validity quantification: The validity of the original rule that triggered this false alarm is evaluated and quantitatively analyzed.

[0126] Optimization suggestions: Based on the quantification results, corresponding rule optimization suggestions are generated from the large model.

[0127] Manual confirmation: Submit the optimization suggestions to relevant personnel for review and confirmation.

[0128] Suggestion adoption determination: If rejected: Return to the "Optimization Suggestions" stage, modify the suggestion, and then re-enter the manual confirmation process. If accepted: Execute the automatic rule distribution.

[0129] Automatic rule deployment: The optimized rules are officially deployed and take effect, and the results of this iteration are written into the experience base to provide data support for subsequent rule optimization.

[0130] Optionally, in this embodiment, the workflow starts immediately after the camera triggers an alarm. First, the event triggering node collects spatiotemporal, video, and sensor data and encapsulates them into a standard message; then, the false alarm discrimination node calls the multimodal model to provide confidence scores and automatically distributes the data according to dynamic thresholds; if a false alarm is confirmed, the rule failure quantification node synchronously calculates the rule failure score, and if it exceeds the threshold, it enters the optimization suggestion node to select the optimal strategy; after the solution is reviewed by natural language interaction, it is converted into native device instructions by the rule issuing node, issued to the front end, and the rule library is updated. At the same time, the feedback node writes the effect into the experience pool for the model to continuously learn itself. This completes the closed loop of "triggering - discrimination - quantification - optimization - review - issuance", realizing minute-level iteration of alarm rules as the scene changes and a continuous decrease in the false alarm rate.

[0131] By subscribing to alarm event messages through persistent long connections, after capturing the original alarm frame triggered by the specified manufacturer's protocol, the multimodal event normalization chain is immediately invoked: first, the packet header is parsed to obtain the timestamp, device ID, geographic coordinates and trigger type, then the video stream segments and sensor time series data of the corresponding time period are pulled and uniformly encoded and formatted, and then the field mapping, type validation and missing value filling are completed according to the predefined JSONSchema, finally generating a standardized JSON object containing complete spatiotemporal information, video frames and metadata, and writing the JSON to the event field of the Context for direct consumption by downstream nodes.

[0132] The orchestrator calls a hot-pluggable multimodal fusion sub-model to jointly encode the video frame sequence, sensor timing, and rule metadata in the Context. Visual-physical-semantic consistency features are extracted through a cross-modal attention mechanism, and a normalized false alarm confidence score (fp_score) is output. Subsequently, the large model dynamically generates two control edges with fp_score ≥ 0.85 as the decision boundary: if the condition is true, the process proceeds to node 3 for rule failure quantification; otherwise, a "normal reporting" task is instantiated, and the current workflow instance is immediately terminated.

[0133] After a standardized alarm event enters this step, the system concatenates its text description, trigger frame image, audio clip, and environmental business information into a multimodal input according to a preset template. The text fields include the key frame and video clip that triggered the alarm, the camera's built-in metadata (such as exposure, gain, frame rate, lens orientation / PTZ position information), the raw signals from the front-end sensor (if applicable), the device's operation and calibration information (such as time synchronization status, lens damage and focus status, firmware version), the arming strategy, threshold and whitelist configuration, spatiotemporal metadata (time, weather, construction or temporary change markers, flight / flight information, etc.), and historical similar alarm records and manual handling tags (confirmed, false alarm, or missed alarm). All data is stored in a unified format for correlation analysis and retrospective auditing.

[0134] The system performs target detection, tracking, pose / behavior recognition, optical flow, and inter-frame difference analysis on video streams to extract motion trajectories and event segments. It also extracts time-frequency features, waveform anomalies, and energy spectra from audio, thermal imaging, or radar signals. Simultaneously, it calculates rule-related numerical features, such as trigger threshold distance, overlap between trigger points and whitelists, trigger duration, and trigger frequency. The system then concatenates these sensor features with the scene context, summarizing all features as input for subsequent decision-making and rule evaluation.

[0135] The input set is encoded and fed into a multimodal large model that has been fine-tuned. The model uses the Transformer structure as its backbone and integrates text, image and audio features through a cross-modal attention mechanism. The model output includes false positive confidence fp_score, false positive cause category (such as environmental noise, equipment failure, whitelist behavior) and interpretable annotations (keyframes, key features) to support accurate discrimination and traceable decision-making.

[0136] The system compares the output false alarm probability value with a preset threshold: if fp_score ≥ 0.85, it is automatically marked as a false alarm and the optimization suggestion generation process of node 3 is immediately started; when fp_score < 0.85, it is determined to be a true alarm and directly enters the alarm output stage, while recording the determination result for subsequent incremental training of the model.

[0137] The judgment results are written to the audit database in the form of structured logs, including event number, false alarm probability value, judgment conclusion, model version number and timestamp, to meet the needs of post-event traceability and model performance evaluation.

[0138] Based on the feature set generated by the nodes, the workflow invokes the rule evaluation module for quantitative analysis. The false alarm rate of the rule over 30 days is calculated, and a time decay factor is introduced to highlight the importance of recent performance, ultimately yielding a rule failure metric. The workflow engine compares this metric with a preset threshold and makes routing decisions accordingly.

[0139] If the metric exceeds the threshold, the current rule is deemed to have a significant defect, and the workflow is moved to the optimization strategy generation stage; if the metric does not exceed the threshold, the workflow is moved to the periodic review branch, and immediate optimization is not performed.

[0140] For rules deemed defective, the workflow generates candidate optimization schemes at this stage. First, the system constructs a constrained strategy parameter space, which includes: the dynamic adjustment range of threshold parameters (±15%); options for adding or deleting detection conditions; a scheme for redistributing sensor weight coefficients; and a masking strategy for specific time periods.

[0141] Subsequently, the workflow executes an optimization algorithm (Monte Carlo tree search) within the policy space, using historical data as a validation set to simulate and evaluate the changes in false alarm rate under different parameter combinations, and finally selects the optimal policy that maximizes the reduction in false alarm rate under the condition of satisfying business constraints as the candidate solution.

[0142] The generated candidate strategies are transformed into actionable outputs. Natural language templates are used to convert strategy parameters into easily understandable optimization suggestion text. Simultaneously, structured configuration patch files conforming to standards such as ONVIF are generated. Once the text suggestions and configuration patches are bound together, they are pushed to a human-machine verification interface, awaiting review by operations personnel. The workflow is paused at this stage, awaiting external input.

[0143] The system displays a comparison of simulated effects before and after rule optimization to operations and maintenance personnel (such as differences in 24-hour alarm distribution). Operations and maintenance personnel can issue commands via natural language. The workflow engine parses the commands and converts them into specific configuration parameter changes. Subsequently, the workflow continues execution based on the final confirmation commands from the operations and maintenance personnel.

[0144] Accepted instruction: The workflow continues, and the authorization system issues configurations.

[0145] Rejection instruction: The current workflow instance is terminated, and the optimization suggestion and its context are marked as rejected and returned to the training dataset.

[0146] Modification instruction: Workflow rollback, re-evaluate the strategy based on the manually adjusted parameters, and form a new iterative cycle.

[0147] Upon receiving the adoption instruction, the workflow securely distributes the configuration patch to the target alarm device via the standard device management channel. After receiving the patch, the device parses and applies the new rules in runtime, taking effect without requiring a restart, thus achieving dynamic and seamless rule updates. The workflow instance records the distribution status and timestamp before normally terminating.

[0148] The embodiments provided in this application utilize a multimodal large-scale model with targeted fine-tuning to perform semantic-level false alarm identification for each alarm event and establish a "false alarm-rule" reverse mapping mechanism. This allows false alarm events to directly drive rule correction, preventing the recurrence of similar false alarms. This method can reduce the false alarm rate from 15% to below 3% after 30 days of system operation, achieving a continuous decline. Based on optimization suggestion nodes, this proposal automatically generates executable configuration patches and writes them directly to the front-end alarm devices via a hot update channel, without requiring downtime or on-site operations. Compared to the traditional manual scheduling of an average of 23 days, this solution can complete the "trigger-judgment-evaluation-optimization-effectiveness" closed loop within one day, significantly shortening the optimization cycle. The large-scale model input side adopts a loosely coupled design of "rule feature vector + business context," keeping the model structure unchanged and requiring only incremental fine-tuning for deployment. Therefore, the same process is applicable to various security scenarios such as airports, subways, logistics warehouses, and factory perimeters, exhibiting good portability. The front end provides a natural language conversion engine that can automatically parse colloquial commands such as "exclude weekends" into time masks and display the results in real time. Duty officers can complete complex rule adjustments with a single click, without needing to understand threshold formulas or write scripts, significantly reducing reliance on professional technology.

[0149] Example 2

[0150] The alarm event processing device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in the above embodiment one. The specific implementation method and beneficial effects can be referred to the foregoing method embodiment, and will not be repeated here.

[0151] Figure 5 This is a schematic diagram of an optional alarm event processing device according to an embodiment of the present invention, such as... Figure 5 As shown, the alarm event processing device may include:

[0152] The acquisition unit 502 is used to acquire the alarm frame corresponding to the alarm event and extract the frame features of the alarm frame to obtain the multimodal feature data corresponding to the alarm frame. The alarm frame is used to indicate that the alarm event meets the preset alarm conditions.

[0153] The first evaluation unit 504 is used to evaluate the false alarms of the multimodal feature data and obtain the false alarm probability of the alarm frame. The false alarm probability is used to indicate the probability that the alarm event is a false alarm or an unexpected alarm event.

[0154] The generation unit 506 is used to generate a false alarm record associated with a preset alarm condition based on the alarm frame and the false alarm probability when the false alarm probability is greater than the preset false alarm threshold.

[0155] The second evaluation unit 508 is used to evaluate the confidence of the preset alarm conditions based on at least one false alarm record associated with the preset alarm conditions, and obtain the confidence level of the alarm conditions.

[0156] The correction unit 510 is used to correct the preset alarm conditions when the confidence level is less than the preset confidence threshold.

[0157] As an optional solution, the second evaluation unit 508 includes:

[0158] The first determining module is used to determine the false alarm rate of the preset alarm conditions in each time interval based on the set of false alarm records associated with the preset alarm conditions in multiple time intervals and all alarm events associated with the preset alarm conditions in multiple time intervals.

[0159] The first calculation module is used to perform a weighted summation of the false alarm rates for each time interval according to the time weight corresponding to each time interval, so as to obtain the confidence level.

[0160] As an optional solution, the device also includes:

[0161] The first acquisition module is used to, after determining the false alarm rate of the preset alarm conditions in each time interval, acquire the proportion of false alarm records in the set of false alarm records associated with each time interval whose false alarm probability differs from the preset false alarm threshold by more than a preset difference.

[0162] The second calculation module, after determining the false alarm rate for each time interval under multiple time intervals under preset alarm conditions, performs a weighted summation of the false alarm rates for each time interval according to the proportion corresponding to each time interval, to obtain the confidence level; or,

[0163] The third calculation module is used to calculate the confidence level by weighting and summing the false alarm rates of each time interval according to the time weight and proportion of each time interval after determining the false alarm rate of each time interval under the preset alarm conditions in multiple time intervals.

[0164] As an optional solution, the correction unit 510 includes:

[0165] The simulation module is used to perform multiple correction simulations on preset alarm conditions. The single correction simulation is used to indicate that a single correction simulation operation is performed on the preset alarm conditions. The multiple correction simulation operation corresponding to the multiple correction simulation includes each correction operation in multiple preset correction operations and an ordered combination operation of at least two correction operations in multiple preset correction operations.

[0166] The second determining module is used to determine the target correction simulation operation corresponding to the target correction simulation with the highest simulation score as the target correction operation to be executed under the preset alarm condition, after obtaining the simulation score of each correction simulation in multiple correction simulations. The simulation score is used to indicate the degree of increase in the confidence of the preset alarm condition after each correction simulation.

[0167] The correction module is used to perform target correction operations on preset alarm conditions.

[0168] As an optional solution, the device also includes:

[0169] The second acquisition module is used to acquire the first correction operation and the second correction operation associated with the preset alarm conditions before performing multiple correction simulations on the preset alarm conditions. The first correction operation is used to instruct the alarm parameter of the preset alarm conditions to be increased by a first magnitude value, and the second correction operation is used to instruct the alarm parameter to be decreased by a second magnitude value.

[0170] The third acquisition module is used to acquire the third correction operation and the fourth correction operation associated with the preset alarm condition before performing multiple correction simulations on the preset alarm condition. The third correction operation is used to indicate the addition of the first alarm sub-condition to the preset alarm condition, and the fourth correction operation is used to indicate the deletion of the second alarm sub-condition to the preset alarm condition.

[0171] The fourth acquisition module is used to acquire the fifth correction operation associated with the preset alarm conditions before performing multiple correction simulations on the preset alarm conditions. The fifth correction operation is used to indicate the adjustment of the effective time of the preset alarm conditions.

[0172] The multiple correction operations include a first correction operation, a second correction operation, a third correction operation, a fourth correction operation, and a fifth correction operation.

[0173] As an optional solution, the acquisition unit 502 includes:

[0174] The parsing module is used to parse the alarm frame to obtain the timestamp data, sensor identification data, geographical location data and alarm type data corresponding to the alarm frame;

[0175] The fifth acquisition module is used to acquire video stream data and sensor time-series data corresponding to the alarm event, and to parse the video stream data and sensor time-series data to obtain the video stream features and sensor time-series features corresponding to the alarm event.

[0176] The third determination module is used to determine timestamp data, sensor identification data, geographic location data, alarm type data, video stream features, and sensor time-series features as multimodal feature data.

[0177] As an optional solution, the first evaluation unit 504 includes:

[0178] The input module is used to input multimodal feature data into the multimodal prediction model to obtain the false alarm probability of the alarm frame output by the multimodal evaluation model. The multimodal evaluation model is a pre-trained neural network model used to evaluate the false alarm of the input multimodal feature data.

[0179] The device also includes:

[0180] The update module is used to perform a confidence assessment on the preset alarm conditions based on at least one false alarm record associated with the preset alarm conditions, and after obtaining the confidence level of the alarm conditions, update the parameters of the multimodal evaluation model based on the set of false alarm records associated with the preset alarm conditions in multiple time intervals and all alarm events associated with the preset alarm conditions in multiple time intervals.

[0181] The alarm event processing device may also include a processor and a memory. The acquisition unit 502, the first evaluation unit 504, the generation unit 506, the second evaluation unit 508, the correction unit 510, etc. are all stored in the memory as program units. The processor executes the program units stored in the memory to realize the corresponding functions.

[0182] The processor described above contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and alarm event handling can be implemented by adjusting kernel parameters.

[0183] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0184] Example 3

[0185] Embodiments of this application may provide an electronic device. Figure 6 This is a structural block diagram of an electronic device for performing an alarm event processing method according to an embodiment of this application. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (Only one is shown) processor 602, memory 604, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0186] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the alarm event processing method and apparatus in this embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the aforementioned alarm event processing method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0187] The processor can invoke information and applications stored in the memory via the transmission device to perform the following steps: in response to a first backup request triggered by a first resource of a first shared client, verifying the resource type of the first resource; if the resource type of the first resource is a shared resource type, determining the target source resource corresponding to the first resource on the shared server associated with the first shared client, wherein the shared server is used to share at least one source resource with at least two clients, the at least one source resource includes the target source resource, and the at least two clients include the first shared client; and copying the target source resource from the shared server to the backup server.

[0188] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0189] Those skilled in the art will understand that all or part of the steps in the various alarm event handling methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0190] Example 4

[0191] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the alarm event handling method provided in Embodiment 1.

[0192] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the alarm event processing method of any one of the above embodiments.

[0193] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0194] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the alarm event handling method in various embodiments of this application.

[0195] This application also provides a computer program product, including a non-volatile computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the alarm event handling method in various embodiments of this application.

[0196] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0197] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0198] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0199] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0200] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0201] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0202] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for handling alarm events, characterized in that, include: Obtain the alarm frame corresponding to the alarm event, and extract frame features from the alarm frame to obtain multimodal feature data corresponding to the alarm frame. The alarm frame is used to indicate that the alarm event meets the preset alarm conditions. The multimodal feature data is evaluated for false alarms to obtain the false alarm probability of the alarm frame, wherein the false alarm probability is used to indicate the probability that the alarm event is a false alarm or an unexpected alarm event; If the false alarm probability is greater than a preset false alarm threshold, a false alarm record associated with the preset alarm condition is generated based on the alarm frame and the false alarm probability. Based on at least one false alarm record associated with the preset alarm condition, a confidence assessment is performed on the preset alarm condition to obtain the confidence level of the alarm condition; If the confidence level is less than a preset confidence threshold, the preset alarm condition is corrected.

2. The method according to claim 1, characterized in that, The confidence level of the alarm condition is obtained by performing a confidence assessment on at least one false alarm record associated with the preset alarm condition, including: Based on the set of false alarm records associated with the preset alarm conditions in multiple time intervals, and all alarm events associated with the preset alarm conditions in multiple time intervals, determine the false alarm rate of the preset alarm conditions in each of the multiple time intervals. The confidence level is obtained by weighting and summing the false alarm rates of each time interval according to the time weight corresponding to each time interval.

3. The method according to claim 2, characterized in that, After determining the false alarm rate of the preset alarm condition in each of the plurality of time intervals, the method further includes: Obtain the proportion of false alarm records in the set of false alarm records associated with each time interval whose false alarm probability differs from the preset false alarm threshold by a preset difference. The confidence level is obtained by weighting and summing the false alarm rates for each time interval according to the proportion corresponding to each time interval; or, The confidence level is obtained by weighting and summing the false alarm rates of each time interval according to the time weight and the proportion corresponding to each time interval.

4. The method according to claim 1, characterized in that, The modification of the preset alarm conditions includes: The preset alarm condition is subjected to multiple correction simulations, wherein each correction simulation is used to indicate that a correction simulation operation is performed on the preset alarm condition, and the multiple correction simulations corresponding to the multiple correction simulations include each correction operation in a plurality of preset correction operations, and an ordered combination operation of at least two correction operations in the plurality of preset correction operations. Given the simulation score of each correction simulation in the multiple correction simulations, the target correction simulation operation corresponding to the target correction simulation with the highest simulation score is determined as the target correction operation to be executed for the preset alarm condition. The simulation score is used to indicate the degree of improvement in the confidence of the preset alarm condition after each correction simulation. The target correction operation is performed on the preset alarm conditions.

5. The method according to claim 4, characterized in that, Before performing multiple correction simulations on the preset alarm conditions, the method further includes: Obtain a first correction operation and a second correction operation associated with the preset alarm condition, wherein the first correction operation is used to instruct the alarm parameter of the preset alarm condition to be increased by a first magnitude value, and the second correction operation is used to instruct the alarm parameter to be decreased by a second magnitude value. Obtain the third and fourth correction operations associated with the preset alarm conditions, wherein the third correction operation is used to indicate the addition of a first alarm sub-condition to the preset alarm conditions, and the fourth correction operation is used to indicate the deletion of a second alarm sub-condition to the preset alarm conditions. Obtain the fifth correction operation associated with the preset alarm condition, wherein the fifth correction operation is used to indicate an adjustment to the effective time of the preset alarm condition; The plurality of correction operations include the first correction operation, the second correction operation, the third correction operation, the fourth correction operation, and the fifth correction operation.

6. The method according to any one of claims 1 to 5, characterized in that, The step of extracting frame features from the alarm frame to obtain multimodal feature data corresponding to the alarm frame includes: The alarm frame is parsed to obtain the timestamp data, sensor identification data, geographic location data, and alarm type data corresponding to the alarm frame; The video stream data and sensor timing data corresponding to the alarm event are obtained, and the video stream data and sensor timing data are parsed to obtain the video stream features and sensor timing features corresponding to the alarm event. The timestamp data, sensor identification data, geographic location data, alarm type data, video stream features, and sensor timing features are determined as the multimodal feature data.

7. The method according to any one of claims 1 to 5, characterized in that, The step of evaluating the false alarms of the multimodal feature data to obtain the false alarm probability of the alarm frame includes: The multimodal feature data is input into a multimodal prediction model to obtain the false alarm probability of the alarm frame output by the multimodal evaluation model, wherein the multimodal evaluation model is a pre-trained neural network model used to evaluate the false alarm of the input multimodal feature data; After assessing the confidence level of the preset alarm condition based on at least one false alarm record associated with the preset alarm condition, the method further includes: The parameters of the multimodal evaluation model are updated based on the set of false alarm records associated with the preset alarm conditions in multiple time intervals and all alarm events associated with the preset alarm conditions in the multiple time intervals.

8. An alarm event processing device, characterized in that, include: The acquisition unit is used to acquire the alarm frame corresponding to the alarm event, and to extract the frame features of the alarm frame to obtain the multimodal feature data corresponding to the alarm frame. The alarm frame is used to indicate that the alarm event meets the preset alarm conditions. The first evaluation unit is used to evaluate the false alarms of the multimodal feature data and obtain the false alarm probability of the alarm frame. The false alarm probability is used to indicate the probability that the alarm event is an unexpected alarm event that is a false alarm. The generation unit is used to generate false alarm records associated with preset alarm conditions based on the alarm frame and the false alarm probability when the false alarm probability is greater than the preset false alarm threshold. The second evaluation unit is used to evaluate the confidence of the preset alarm conditions based on at least one false alarm record associated with the preset alarm conditions, and obtain the confidence level of the alarm conditions. The correction unit is used to correct the preset alarm conditions when the confidence level is less than the preset confidence threshold.

9. An electronic device, characterized in that, The method includes one or more processors and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method of any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 7.

Images