Updating method and device of anomaly detection model, electronic equipment and medium

Abstract

The invention discloses an updating method and device of an anomaly detection model, electronic equipment and a medium, and belongs to the technical field of model processing. The method comprises the following steps: acquiring various multi-modal data acquired by an edge monitoring node in an activity range of a target person; abnormal behavior detection is carried out by adopting an abnormal detection model stored in the edge monitoring node and various multi-modal data, abnormal identification information of the target person is obtained, and the abnormal detection model is a model issued by a federal learning server; determining a parameter update amount of the anomaly detection model based on the anomaly identification information; uploading the parameter update quantity to a federated learning server, and performing global optimization on the federated learning server according to the parameter update quantity uploaded by the plurality of edge monitoring nodes to obtain an updated anomaly detection model; and receiving the updated anomaly detection model issued by the federal learning server, and replacing the locally stored anomaly detection model with the updated anomaly detection model, thereby reducing the data uploading amount and avoiding privacy leakage.

Description

Technical Field

[0001] This application belongs to the field of model processing technology, specifically relating to an anomaly detection model update method, an anomaly detection model update device, an electronic device, and a readable storage medium. Background Technology

[0002] Currently, elderly behavior monitoring systems based on centralized cloud computing collect video data through cameras deployed indoors, transmit the complete data to a federated learning server for behavior analysis and anomaly identification, and trigger alarms when anomalies such as falls or prolonged stillness are detected. However, the above solutions require uploading large volumes of video data to the cloud, and there is a 2-5 second delay during the transmission process. In case of emergencies such as falls, alarms cannot be triggered quickly, which may delay rescue opportunities. Moreover, since videos of the elderly’s daily activities need to be uploaded to the cloud in their entirety, privacy is easily exposed due to cloud data leaks or interception during transmission, resulting in low user acceptance. Furthermore, currently, elderly abnormality monitoring devices based on local stand-alone computing can analyze collected behavioral data using simple algorithms built into the device, without the need for data upload. However, local algorithms are difficult to update and iterate, and their recognition accuracy is low: the built-in algorithms rely on factory presets and cannot optimize the model based on data from multiple scenarios, resulting in an accuracy rate of less than 70% for abnormal behaviors in complex environments (such as partial falls or slow fainting); that is, the algorithms of different devices are independent, making it impossible to aggregate multi-user data to improve the model's generalization ability, resulting in poor adaptability. Summary of the Invention The purpose of this application is to provide an anomaly detection model update method, an anomaly detection model update device, an electronic device, and a readable storage medium, which can solve the problems of large data upload volume, privacy exposure, weak model generalization ability, and poor adaptability in the current elderly monitoring process.

[0003] To solve the above-mentioned technical problems, this application is implemented as follows: In a first aspect, embodiments of this application provide a method for updating an anomaly detection model, applied to an edge monitoring node, the method comprising: Acquire various multimodal data collected by edge monitoring nodes within the activity range of target personnel; The abnormal behavior detection is performed using the anomaly detection model stored in the edge monitoring node and the various multimodal data to obtain the anomaly identification information of the target person. The anomaly detection model is a model issued by the federated learning server. The parameter update amount of the anomaly detection model is determined based on the anomaly identification information; The parameter update amount is uploaded to the federated learning server, and the updated anomaly detection model is obtained by global optimization of the parameter update amount uploaded by multiple edge monitoring nodes on the federated learning server. The system receives the updated anomaly detection model from the federated learning server and replaces the locally stored anomaly detection model with the updated model.

[0004] Optionally, the step of using the anomaly detection model stored in the edge monitoring node and the multiple multimodal data to perform abnormal behavior detection and obtain the anomaly identification information of the target person includes: Feature data is extracted from the various multimodal data respectively, and the multiple feature data are fused to generate a fused feature; The fused features are input into the anomaly detection model stored in the edge monitoring node, and the anomaly identification information of the target person is output.

[0005] Optionally, determining the parameter update amount of the anomaly detection model based on the anomaly identification information includes: The loss value of the anomaly detection model is calculated based on the anomaly identification information; The parameter update amount of the anomaly detection model is determined based on the loss value.

[0006] Optionally, it also includes: The feature data is encrypted using a preset encryption algorithm and then uploaded to the federated learning server, whereby the model is trained and updated based on the feature data.

[0007] Optionally, it also includes: The risk level is determined based on the anomaly identification results; An alarm is triggered according to the stated risk level.

[0008] Optionally, the step of extracting feature data based on the various multimodal data includes: When the multimodal data is video data, sample is taken from the video data to obtain the target video keyframe; Input the video keyframes into the trained human pose estimation model and output the key skeleton point coordinate data. Based on the key skeleton point coordinate data, determine the displacement vector and angle change rate of skeleton points in adjacent frames; The displacement vector and the rate of change of angle are used as feature data of the video data.

[0009] Optionally, the step of extracting feature data based on the various multimodal data includes: When the multimodal data is radar data, Fourier transform is used to convert the radar data into a frequency domain signal; Feature data is extracted from the frequency domain signal.

[0010] Secondly, embodiments of this application provide a method for updating an anomaly detection model, the method comprising: The parameter update amount uploaded by multiple edge monitoring nodes is obtained. The parameter update amount is the multi-modal data collected by the edge monitoring nodes within the activity range of the target person. Based on the multi-modal data and the anomaly detection model stored locally by the edge monitoring nodes, the anomaly identification information of the target person is obtained. Based on the anomaly identification information, the parameter update amount of the anomaly detection model is determined. The anomaly detection model stored locally is the model distributed by the anomaly detection model stored on the federated learning server. The anomaly detection model stored on the federated learning server is globally optimized based on the update amounts of the multiple parameters to obtain the updated anomaly detection model. The updated anomaly detection model is distributed to multiple edge monitoring nodes to update the anomaly detection model stored locally on the edge monitoring nodes.

[0011] Optionally, the step of globally optimizing the anomaly detection model stored on the federated learning server based on the update amounts of the multiple parameters to obtain an updated anomaly detection model includes: Obtain the number of samples of parameter updates uploaded by each edge monitoring node; The weight data corresponding to each edge monitoring node is determined based on the number of samples. The anomaly detection model stored on the federated learning server is globally optimized based on the weight data and the parameter update amount to obtain the updated anomaly detection model.

[0012] Optionally, after obtaining the updated anomaly detection model, the following steps are also included: The anomaly detection model is subjected to security verification. After the security verification is passed, the updated anomaly detection model is distributed to multiple edge monitoring nodes.

[0013] Thirdly, embodiments of this application provide an update apparatus for an anomaly detection model, the apparatus comprising: The multimodal data acquisition module is used to acquire various multimodal data collected by the edge monitoring node within the activity range of the target personnel; The anomaly identification information determination module is used to perform abnormal behavior detection using the anomaly detection model stored in the edge monitoring node and the multiple multimodal data to obtain the anomaly identification information of the target person. The anomaly detection model is a model issued by the federated learning server. The parameter update quantity generation module is used to determine the parameter update quantity of the anomaly detection model based on the anomaly identification information. The parameter update upload module is used to upload the parameter update to the federated learning server, so as to perform global optimization on the parameter update uploaded by multiple edge monitoring nodes on the federated learning server to obtain the updated anomaly detection model. The anomaly detection model update module is used to receive the updated anomaly detection model issued by the federated learning server and replace the locally stored anomaly detection model with the updated anomaly detection model.

[0014] Fourthly, embodiments of this application provide an anomaly detection model update apparatus, the apparatus comprising: The parameter update quantity acquisition module is used to acquire the parameter update quantity uploaded by multiple edge monitoring nodes. The parameter update quantity is the multi-modal data collected by the edge monitoring nodes within the activity range of the target personnel. Based on the multi-modal data and the anomaly detection model stored locally by the edge monitoring nodes, the anomaly identification information of the target personnel is obtained. Based on the anomaly identification information, the parameter update quantity of the anomaly detection model is determined. The anomaly detection model stored locally is the model distributed by the anomaly detection model stored on the federated learning server. An anomaly detection model optimization module is used to globally optimize the anomaly detection model stored on the federated learning server based on the update amounts of the multiple parameters, so as to obtain an updated anomaly detection model. The anomaly detection model distribution module is used to distribute the updated anomaly detection model to multiple edge monitoring nodes to update the anomaly detection model stored locally on the edge monitoring nodes.

[0015] Fifthly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0016] In a sixth aspect, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0017] In a seventh aspect, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the method as described in the first aspect.

[0018] In this embodiment, the edge monitoring node can upload parameter updates to the federated learning server, reducing the amount of data uploaded while avoiding leakage of user data privacy. Moreover, in this embodiment, the federated learning server can combine the parameter updates uploaded by multiple edge monitoring nodes to achieve global optimization, thereby improving the model's generalization ability and enhancing its adaptability. Attached Figure Description

[0019] Figure 1a This is a flowchart illustrating an update method for an anomaly detection model in an embodiment of this application. Figure 1b This is a schematic diagram of a system architecture according to an embodiment of this application; Figure 1c This is a flowchart illustrating the training process of a federated learning model in one embodiment of this application. Figure 1d This is a schematic diagram of an anomaly identification and alarm workflow in an embodiment of this application; Figure 2 This is a flowchart illustrating another method for updating an anomaly detection model in an embodiment of this application. Figure 3 This is a schematic flowchart of an anomaly detection model update device according to an embodiment of this application; Figure 4 This is a schematic flowchart of an update device for another anomaly detection model in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0022] The optimization of the anomaly detection model provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0023] Reference Figure 1a The diagram illustrates a flowchart of an anomaly detection model update method according to an embodiment of this application. This anomaly detection model update method can be applied to edge monitoring nodes, and the specific steps of the anomaly detection model update method include the following: Step S101: Acquire various multimodal data collected by the edge monitoring node within the activity range of the target personnel; In practical applications, to monitor the behavior of target personnel, an architecture of edge monitoring nodes and federated learning servers can be set up. Multiple edge monitoring nodes can be connected to the federated learning server. Each edge monitoring node can be equipped with a multimodal data acquisition device to collect various multimodal data within the activity range of the target personnel. The target personnel can be people who need special attention, such as the elderly.

[0024] In this embodiment, the edge monitoring node can be equipped with a high-definition camera and a millimeter-wave radar. High-definition cameras can be deployed in key indoor monitoring areas to collect real-time video data of elderly people's activities, with a resolution of 1080P and a frame rate of 25fps. Millimeter-wave radar can work in conjunction with cameras, with a detection range of 0.5-10m, to collect micro-motion signals of the human body, compensating for the shortcomings of visual monitoring in complex lighting environments.

[0025] Step S102: Abnormal behavior detection is performed using the anomaly detection model stored in the edge monitoring node and the various multimodal data to obtain the anomaly identification information of the target person. The anomaly detection model is a model issued by the federated learning server. In practical applications, edge monitoring nodes locally store anomaly detection models, which are models distributed from the federated learning server. These anomaly detection models can identify anomalies in target personnel based on multimodal data, outputting anomaly probabilities and anomaly types.

[0026] Specifically, the process of generating and distributing models in the cloud is as follows: The cloud platform needs to build a training library containing over 100,000 samples based on publicly available behavioral datasets (such as the UR Fall Detection Dataset and Le2i Fall Detection Dataset). These samples cover 20 categories of behavioral data, including falls, walking, and sitting, from elderly individuals of different ages (60-90 years old) and body types (BMI 18-28) under different lighting conditions (50-1000 lux) and furniture layouts. YOLOv5s is used as the basic detection model. Knowledge distillation technology is used to transfer knowledge from the teacher model (20 million parameters) to the student model, compressing the number of parameters to less than 5 million and increasing the inference speed to over 30fps, meeting the real-time processing requirements of the edge. The compressed initial model is then optimized using TensorRT before being distributed to each edge monitoring node.

[0027] In one embodiment of this application, the step of using the anomaly detection model stored in the edge monitoring node and the multiple multimodal data to perform abnormal behavior detection and obtain the anomaly identification information of the target person includes: extracting feature data based on the multiple multimodal data respectively, and fusing the multiple feature data to generate a fused feature; inputting the fused feature into the anomaly detection model stored in the edge monitoring node, and outputting the anomaly identification information of the target person.

[0028] In practical applications, feature extraction can be performed on the acquired multimodal data to extract the corresponding feature data. Specifically, feature extraction can be performed according to the feature extraction method corresponding to the type of multimodal data. That is, different types of data have different features, and therefore the extraction methods used to extract these feature data are also different. By first setting the association between the type and the feature extraction method, after collecting multimodal data, the feature extraction method can be determined according to the type, and then the feature extraction can be performed.

[0029] After feature extraction, various features can be normalized, and then the normalized feature data can be fused to construct fused features. In one example, an attention mechanism can be used for weighted fusion.

[0030] For example, edge monitoring nodes can use an attention mechanism to weightedly fuse skeletal feature data and radar feature data, giving higher weight to visual features (0.7) for emergency behaviors such as falls and higher weight to radar features (0.6) for static state judgments. Then, weighted fusion can be performed based on the weighted data, and the fused feature vector can be input into the optimization model to output the abnormal probability value and behavior type.

[0031] By inputting the fused features into the anomaly detection model, the anomaly identification results of the target person, namely the anomaly probability and the category of abnormal behavior, can be output.

[0032] In one embodiment of this application, the feature data can be encrypted according to a preset encryption algorithm and then uploaded to the federated learning server, so that the federated learning server can perform model training and updates based on the feature data.

[0033] In practical applications, edge monitoring nodes can upload feature data to the federated learning server, thereby avoiding privacy leaks caused by directly uploading raw data to the cloud, and reducing data transmission volume and improving transmission efficiency.

[0034] Specifically, the edge monitoring node can first transmit the feature data to the encryption gateway, where it is encrypted using a preset algorithm before being uploaded to the federated learning server. The encryption algorithm can be the RSA encryption algorithm.

[0035] In one embodiment of this application, the step of extracting feature data based on the various multimodal data includes: when the multimodal data is video data, sampling is performed on the video data to obtain target video keyframes; the video keyframes are input into a trained human pose estimation model to output key skeleton point coordinate data; the displacement vectors and angle change rates of skeleton points in adjacent frames are determined based on the key skeleton point coordinate data; and the displacement vectors and angle change rates are used as feature data of the video data.

[0036] For example, when processing the acquired video data, an inter-frame sampling strategy can be adopted, that is, one key frame is extracted every two frames. Then, after preprocessing such as image grayscale conversion and Gaussian blur denoising using the OpenCV open-source library, the coordinates of 18 key skeletal points (such as the tip of the nose, shoulder joint, hip joint, ankle joint, etc.) can be extracted using the MediaPipe human pose estimation model, and the displacement vector and angle change rate of the skeletal points in adjacent frames can be calculated.

[0037] The specific data processing procedure is as follows: Data input: Receive keyframes after frame-by-frame sampling (after grayscale conversion and Gaussian blur denoising).

[0038] Skeletal point extraction: The MediaPipe human pose estimation model is called to locate and output the two-dimensional pixel coordinates of 18 key skeletal points (nose tip, shoulder joint, etc.).

[0039] Feature calculation: Obtain the coordinates of the same bone point in two adjacent frames, calculate the horizontal / vertical displacement components to obtain the displacement vector; calculate the rate of change of the angle of the line connecting bone points in adjacent frames using the vector angle formula to quantify the amplitude and trend of limb movement.

[0040] In one embodiment of this application, the step of extracting feature data based on the various multimodal data includes: when the multimodal data is radar data, using Fourier transform to convert the radar data into a frequency domain signal; and extracting feature data from the frequency domain signal.

[0041] For the collected radar data, the time domain signal can be converted into the frequency domain signal through Fast Fourier Transform (FFT), and then characteristic parameters such as micro-motion frequency (0.1-5Hz) and range change rate can be extracted.

[0042] In one embodiment of this application, different levels of alarms can be set in the edge monitoring node. Specifically, the risk level can be determined based on the anomaly identification result; and an alarm can be triggered according to the risk level.

[0043] The edge monitoring node can preset two abnormal levels: Level 1 risk (emergency) such as falls and fainting, and Level 2 risk (early warning) such as prolonged stillness. Level 1 risk triggers an immediate local audible and visual alarm plus a remote family notification, while Level 2 risk first caches behavioral data for 10 seconds for secondary verification. At the same time, the edge node only caches characteristic data of abnormal periods, and normal data is destroyed in real time.

[0044] In this application embodiment, two levels of risk assessment criteria can be preset: Level 1 risk is an emergency situation with an abnormal probability ≥90%, including falls (sudden drop in vertical displacement of key skeletal points ≥50cm and lasting for more than 1 second), fainting (radar micro-motion frequency <0.1Hz and no limb displacement), and falling out of bed (sudden drop in vertical displacement of key skeletal points within the bed area ≥30cm); Level 2 risk is a warning situation with an abnormal probability of 60%-89%, including 15 minutes of stillness (limb displacement <5cm within the same area and micro-motion frequency stable at 0.2-0.5Hz), abnormal gait (stride length difference ≥20cm and step frequency <40 steps / minute), and frequent nighttime urination (getting up ≥3 times between 1:00 AM and 5:00 AM).

[0045] During the tiered response phase, Level 1 risks can trigger a "triple alarm" mechanism: the edge terminal immediately activates an 80dB buzzer (frequency 2000Hz) and a red LED flashing light (flashing frequency 2Hz) for local audible and visual alarms. Simultaneously, within 10 seconds, alarm information is pushed via the 5G network to the family's APP (including the anomaly type, occurrence time, and real-time screenshot) and the elderly care institution management platform (simultaneously displaying the electronic map coordinates of the terminal's installation location). The feature data (skeletal vector, radar frequency domain map) of the 10 seconds before and after the anomaly period is encrypted and uploaded to the cloud for backup. The backup data is retained for 30 days for subsequent traceability. Level 2 risks activate a "cached verification-delayed response" mechanism. The edge node first caches the collected data for the next 10 seconds to local storage. If the model inference still determines that it is abnormal after 10 seconds, an SMS warning is triggered (sent to the family's reserved mobile phone number). If the anomaly is resolved, the cached data is automatically destroyed. According to actual tests, this mechanism can reduce the false alarm rate from 15% to below 5%.

[0046] In this embodiment, risk grading can achieve a balance between alarm accuracy and timeliness, while selective data caching optimizes edge storage resource usage. This reduces the false alarm rate to below 5%, decreases edge node storage usage by 60%, avoids interference from invalid alarms, and saves hardware costs.

[0047] Step S103: Determine the parameter update amount of the anomaly detection model based on the anomaly identification information; After obtaining anomaly identification information by using an anomaly detection model, the anomaly detection model can be adjusted based on the feedback of the anomaly identification information to obtain the parameter update amount. The parameter update amount is the data that the edge monitoring node obtains based on the current multimodal data and the anomaly detection model, which can further optimize the anomaly detection model. The parameter update amount refers to the parameter values ​​that need to be updated in the anomaly detection model.

[0048] In one embodiment of this application, determining the parameter update amount of the anomaly detection model based on the anomaly identification information includes: calculating the loss value of the anomaly detection model based on the anomaly identification information; The parameter update amount of the anomaly detection model is determined based on the loss value.

[0049] In practical applications, a loss function can be set for the anomaly detection model. Based on the anomaly identification information, the loss value of the anomaly detection model can be calculated, and then the local model parameters can be updated based on the loss value to obtain the parameter update amount. The goal of the update is to make the predicted values ​​of the anomaly detection model infinitely close to the actual values.

[0050] Step S104: Upload the parameter update amount to the federated learning server, and perform global optimization on the parameter update amount uploaded by multiple edge monitoring nodes on the federated learning server to obtain the updated anomaly detection model. After obtaining the parameter update, the parameter update can be uploaded to the federated learning server. The federated learning server can receive parameter update from multiple edge monitoring nodes, and then perform global optimization based on all received parameter update to obtain an updated anomaly detection model. The purpose of the global optimization process is to integrate the parameter update from all edge monitoring nodes to obtain an anomaly detection model that is more suitable for each current edge monitoring node and improve the accuracy of the anomaly detection model.

[0051] In practical applications, during the parameter update upload process, the data can first be sent to the encryption gateway for encryption processing according to a preset algorithm, and then the encrypted parameter update data can be sent to the federated learning server.

[0052] For example, the system sets 2:00-4:00 AM daily as a low-load training window. During this period, edge nodes stop real-time alarm pushes and only retain data collection functionality. Edge nodes calculate model loss values ​​based on 1000+ locally collected sample data points for the day, update local model parameters using the stochastic gradient descent (SGD) algorithm, and then upload the updated parameters to the federated learning server via an RSA2048-bit encryption gateway. The server uses the FedAvg weighted aggregation algorithm to assign weights to each edge node based on its sample data volume (10%-30% weight per node, with higher weights for larger sample volumes), aggregating data to generate a globally optimized model.

[0053] Step S105: Receive the updated anomaly detection model issued by the federated learning server, and replace the locally stored anomaly detection model with the updated anomaly detection model.

[0054] The federated learning server enables global model optimization and allows the optimized anomaly detection model to be distributed to various edge monitoring nodes for application.

[0055] In this embodiment, raw privacy data (video) is restricted to edge processing, with only non-privacy feature data transmitted for federated training. Simultaneously, edge-local inference replaces centralized cloud inference, achieving "data not leaving the domain, model superior across domains." Compared to existing technologies, this embodiment reduces data transmission volume by over 90%, anomaly detection latency is controlled within 500ms, and the risk of privacy data leakage is reduced to near zero. It fundamentally resolves the conflict between real-time performance and privacy protection.

[0056] Reference Figure 1bThis diagram illustrates a system architecture according to an embodiment of this application. The overall system architecture includes three core layers: a perception layer (edge ​​monitoring nodes), a collaboration layer (federated learning server), and an application layer (user terminal), along with the functional modules contained in each layer. Specifically, the perception layer may include high-definition cameras, millimeter-wave radar, and edge computing modules; the application layer may include a family member mobile app and a management platform for elderly care institutions; and the collaboration layer may include an encryption gateway and a federated learning server.

[0057] High-definition cameras: Deployed in key indoor monitoring areas, responsible for real-time collection of video data of elderly people's activities, with a resolution of 1080P and a frame rate of 25fps.

[0058] Millimeter-wave radar: Works in conjunction with cameras, with a detection range of 0.5-10m, and is responsible for collecting micro-motion signals of the human body, making up for the shortcomings of visual monitoring in complex lighting environments.

[0059] Edge computing module: Equipped with an ARM Cortex-A72 processor, it has a built-in lightweight behavior recognition model and is responsible for local data preprocessing, feature extraction and anomaly inference.

[0060] Encryption gateway: Deployed in the collaboration layer, it uses the RSA encryption algorithm to encrypt and decrypt transmitted data, ensuring the security of parameter transmission.

[0061] Federated Learning Server: Equipped with an Intel Xeon E5 processor, it aggregates parameters from multiple edge nodes using the FedAvg algorithm to generate a globally optimized model.

[0062] Family members' mobile app: Receives abnormal alarm information, supports viewing alarm details and device status, and enables remote monitoring.

[0063] Elderly Care Institution Management Platform: Designed for institutional users, it supports multi-node monitoring data aggregation, alarm statistics, and batch device management.

[0064] Communication network: It adopts Wi-Fi / 5G technology to connect the perception layer, collaboration layer and application layer to achieve efficient transmission of data and instructions.

[0065] Based on the above system architecture, the following data processing can be achieved: the cameras and millimeter-wave radars of the edge monitoring nodes synchronously collect multimodal data and transmit it to the edge computing module for feature extraction; the extracted feature data is encrypted by the encryption gateway and then uploaded to the federated learning server; the server aggregates the parameters of multiple nodes to generate an optimized model and distributes it to each edge node to update the local model; the edge module infers abnormal behavior through the optimized model and pushes alarm information to the family APP and management platform through the communication network, forming a closed-loop architecture of "collection-processing-optimization-alarm".

[0066] Among them, the edge module, by optimizing the steps of model inference of abnormal behavior, is the core execution link of the "collection-processing-optimization-alarm" closed loop. It is specifically divided into four steps, each closely linked and taking into account both accuracy and practicality: The first step is multimodal data synchronous preprocessing. The camera and millimeter-wave radar synchronously collect data at a sampling frequency of 25Hz, with the time difference controlled within 10 milliseconds to avoid misalignment—for example, when an elderly person gets up in their bedroom, both simultaneously record the movement and vital signs. The camera first samples the image frame by frame (keeping one frame out of every two), and after grayscale denoising and wide-angle distortion correction, retains a clear image of human movement. The radar filters environmental electromagnetic interference and extracts core vital sign data such as the frequency of human micro-movements and the rate of change of distance. Both types of data are transmitted in real-time to the temporary buffer of the edge computing module (only storing data within 30 seconds to avoid privacy hoarding).

[0067] The second step is feature fusion and standardization. The edge computing module calls a lightweight feature extraction algorithm to locate 18 key skeletal points from the preprocessed camera data, calculate the displacement vectors of adjacent frames and the rate of change of the angle of the skeletal connection, and generate 64-dimensional motion features; it also extracts 64-dimensional vital signs such as respiratory rate and limb movement speed from the radar data. Then, the two types of features are uniformly scaled to the [0,1] interval through Min-Max normalization, and then weighted and fused through an attention mechanism—emergency behaviors (such as falls) are mainly weighted with motion features at 0.7, and static anomalies are mainly weighted with vital signs at 0.6, finally generating a 128-dimensional fused feature vector.

[0068] The third step is model inference and risk assessment. The feature vector input is federated into a local model (with fewer than 5 million parameters and an inference speed of more than 30fps). The model calculates the behavior matching degree through a deep learning network and outputs anomaly probability value and behavior type label (such as "fall", "fainting", "prolonged stillness").

[0069] The fourth step involves comparing the data to preset thresholds: If the anomaly probability is ≥90% and the feature matching degree conforms to the emergency behavior template (e.g., a sudden drop in vertical hip displacement ≥50cm with no recovery within 1 second), it is classified as a Level 1 risk; if the probability is 60%-89% and matches the non-emergency template (e.g., limb movement ≤5cm within 15 minutes but breathing is normal), it is classified as a Level 2 risk; if the probability is <60%, it is classified as normal, and cached data is cleared in real time. The fourth step is alarm triggering and data logging. Level 1 risk immediately triggers a linked alarm: the terminal activates an 80-decibel audio-visual alert, and within 10 seconds, pushes "time-location-anomaly type-on-site feature screenshot" to the family APP and management platform via encrypted MQTT protocol, simultaneously uploading feature data (encrypted with SM4) for 10 seconds before and after the anomaly to the cloud for 30 days; Level 2 risk first initiates a 10-second secondary verification, and if anomalies are continuously detected, an SMS warning is sent; otherwise, the data is automatically cleared. The entire reasoning process is completed at the edge, only uploading feature data and alarm information to ensure privacy and real-time response.

[0070] Reference Figure 1c This document illustrates a flowchart of a federated learning model training process according to an embodiment of this application. Specifically, it may include five core steps: initial model deployment, edge local inference, encrypted parameter upload, server aggregation optimization, and model distribution and update.

[0071] Cloud server: Stores basic behavior recognition datasets (such as UR Fall Detection Dataset), is responsible for pre-training the initial model, and compresses the lightweight model through knowledge distillation.

[0072] Edge Node 1 / 2: Represents multiple edge monitoring terminals deployed in a distributed manner. Each node has local data processing and model inference capabilities and is a local execution unit for federated learning.

[0073] Encryption Gateway: As a secure hub for parameter transmission, it encrypts the model updates uploaded by edge nodes and decrypts the optimized models sent by the server.

[0074] Federated Learning Server: The core processing unit, which uses a weighted aggregation algorithm (FedAvg) to fuse parameters according to the data volume weights (10%-30%) of each edge node, and also has model security verification functions.

[0075] The cloud server distributes the lightweight initial model to each edge node; the edge nodes perform model inference based on locally collected data, calculate the inference loss, and generate parameter update quantities; the parameter update quantities are encrypted by the encryption gateway and then uploaded to the federated learning server; the server aggregates and optimizes the parameters of multiple nodes and completes security verification to generate a globally optimized model; the optimized model is decrypted by the encryption gateway and then distributed to each edge node, overwriting the original model, and completing an iteration every 24 hours to achieve seamless model upgrades.

[0076] The federated learning model training and iteration process adopts a three-stage approach of "pre-training - local fine-tuning - global aggregation" to ensure that the model continuously improves recognition accuracy while protecting privacy. In the initial model deployment phase, the cloud needs to build a training library containing more than 100,000 samples based on public behavioral datasets (such as UR Fall Detection Dataset and Le2i Fall Detection Dataset). The samples cover 20 categories of behavioral data, such as falls, walking, and sitting, for elderly people of different ages (60-90 years old) and body types (BMI 18-28) under different lighting (50-1000 lux) and furniture layout scenarios. YOLOv5s is used as the basic detection model. Knowledge distillation technology is used to transfer knowledge from the teacher model (20 million parameters) to the student model, compressing the number of parameters to less than 5 million and improving the inference speed to more than 30fps, which meets the real-time processing requirements of the edge. The compressed initial model is optimized by TensorRT and then distributed to each edge node in PB format (about 2MB in size) via HTTPS protocol. The model version number (such as V1.0.0) and checksum (MD5 value) are attached to the distribution. The edge node verifies the integrity after receiving the data. If the verification fails, the interrupted transmission is resumed.

[0077] The specific data processing flow during the model iteration phase is as follows: The first step is localized inference and parameter updates at edge nodes. Edge nodes collect 2 hours of labeled sample data daily (approximately 180,000 frames of image features and radar signal features, divided into training and validation sets in an 8:2 ratio). The initial model is fine-tuned based on the local training set using a stochastic gradient descent (SGD) optimizer with a learning rate of 0.001 and a batch size of 32. After 100 iterations, the validation set inference loss is calculated (using the cross-entropy loss function, with a target loss value below 0.05). Based on the loss value, parameter updates are generated through backpropagation. Only the weight increments and bias adjustments of the model's convolutional and fully connected layers are retained, while the original weight data is discarded. The update data is compressed into a 512KB binary file, labeled with the node ID (e.g., EDGE-001), collection timestamp, and loss value.

[0078] The second step is parameter encryption upload. The encrypted gateway uses the SM2 asymmetric encryption algorithm to encrypt the parameter updates, generating encrypted data packets (with an appended gateway signature and timestamp). These packets are then uploaded to the federated learning server via the 5G NB-IoT network in fragmented transmission mode. If the packet loss rate exceeds 5% during transmission, automatic retransmission is initiated.

[0079] The third step is cloud aggregation and verification. The server receives data from all nodes at 2:00 AM daily. First, it verifies the gateway signature and data integrity using national cryptographic algorithms, eliminating tampered or corrupted data packets (verification pass rate must be ≥95%). A federated averaging algorithm is used to aggregate the effective parameter updates, assigning aggregation weights based on each node's inference accuracy (60% weight) and data quality (40% weight). For example, a node with 96% accuracy has a weight of 0.012, and a node with 92% accuracy has a weight of 0.008. This aggregation generates a global parameter update matrix. Then, differential privacy technology is used to add noise (noise intensity ε=0.1) to prevent reverse inference of local node data features. After security enhancement, this is integrated into a globally optimized model (PB format, approximately 2.1MB in size), generating a new version number (e.g., V1.0.1) and a verification code. The fourth step is encrypted model distribution and upgrade. The optimized model, after being symmetrically encrypted with SM4, is broadcast to each edge node. Upon receiving the model, each node decrypts it, verifies the version number, and, if correct, overwrites the existing model. The entire upgrade process is completed silently in the background (taking ≤30 seconds) without affecting real-time monitoring. This iterative process is completed every 24 hours, achieving seamless model upgrades.

[0080] The edge node localization inference stage can be understood as transforming the "observation results" of cameras and radar into "key information" that can determine anomalies.

[0081] For example, when Mr. Zhang, who lives alone, takes a walk in his living room, the system works like this: the camera doesn't continuously capture images at full capacity, but instead saves one key frame out of every two captured frames, conserving power without delaying analysis. First, the color image is converted to black and white (grayscale), then small noise points (such as patterns caused by changes in lighting) are removed. Next, like "drawing a skeleton," the system locates 18 key body parts of Mr. Zhang, accurately pinpointing locations like the tip of his nose, shoulders, hips, and ankles. Then, the system compares the positional changes of these "skeleton points" between two frames, such as whether the hips suddenly shifted downwards or the angle of the ankles became abnormal. Simultaneously, the radar can capture the slight rise and fall of Mr. Zhang's chest breathing and the speed of his body movement, converting these real-time signals into more easily analyzed frequency data, such as whether the breathing frequency is normal between 0.1-5Hz and whether the distance between his body and the terminal suddenly changes. Then, the motion characteristics "seen" by the camera and the vital signs "detected" by the radar are adjusted into a unified standard format and merged into a "data packet" containing 128 key pieces of information. Finally, it is handed over to a lightweight model in the terminal so that the model can determine whether there are any abnormal new behaviors.

[0082] Reference Figure 1dThis diagram illustrates a workflow for anomaly identification and alarming according to an embodiment of this application. The entire process of anomaly identification and hierarchical alarming includes five key steps: data acquisition, feature fusion, model inference, risk assessment, and alarm response. The process involves the following modules and units: Multimodal data acquisition unit: integrates the acquisition functions of camera and radar, and simultaneously acquires video data (25Hz) and micro-motion signal data (25Hz) to provide raw input for feature extraction.

[0083] Feature extraction and fusion module: Deployed in the edge computing unit, it extracts human skeleton key point features from video key frames and micro-motion frequency and distance change rate features from radar signals, and then fuses the two types of features.

[0084] Edge Model Inference Module: Loads a lightweight model optimized by federated learning, inputs fused features and outputs anomaly identification results with an accuracy rate of over 95%.

[0085] Risk level assessment module: It has two preset risk levels. Level 1 risk corresponds to emergency abnormalities such as falls and fainting, while Level 2 risk corresponds to warning abnormalities such as prolonged stillness.

[0086] Alarm execution unit: includes local audible and visual alarm device (80dB buzzer and red flashing light combination) and remote notification module, which triggers differentiated responses according to risk level.

[0087] Data caching and destruction module: performs 10-second cache verification on secondary risk data. If the verification passes, an alarm is triggered; otherwise, the data is automatically destroyed to optimize storage resources.

[0088] The data processing based on the above modules is as follows: After the multimodal data acquisition unit acquires the raw data, it is transmitted to the feature extraction and fusion module to generate multi-dimensional features; the feature data is input into the edge model inference module to obtain the recognition result, and the risk level determination module classifies the risk type; if it is a level one risk, a local audible and visual alarm and a remote notification are immediately triggered, and the abnormal feature data is uploaded to the cloud for backup; if it is a level two risk, data cache verification is initiated, and if an anomaly is still detected after 10 seconds, a remote notification is triggered, otherwise the cached data is destroyed, thus achieving a balance between alarm accuracy and timeliness.

[0089] Scenario examples based on the above embodiments of this application are illustrated below: Taking the scenario of fall monitoring for elderly people living alone as an example, a monitoring terminal was deployed in the living room of a 75-year-old elderly person living alone. The system has completed 10 federated iterations, and the model recognition accuracy rate has reached 96%. One day, an elderly person tripped on the carpet while walking in the living room, triggering the monitoring process: the perception layer camera captured a sudden drop in vertical displacement of the hip joint from 120cm to 60cm, the radar detected a sudden drop in limb movement speed from 0.8m / s to 0, and a drop in micro-motion frequency from 0.3Hz to 0; after the edge computing module fused the two types of features, the model output a 98% probability of an abnormal fall, classifying it as a level one risk; the terminal immediately activated an audible and visual alarm, and simultaneously pushed an alarm message "14:30 abnormal fall in living room" to the elderly person's daughter's APP, along with a screenshot of the scene. The community elderly care service station's management platform also received the alarm, showing the terminal's location as "Living room, Building 3, 502, XX Community"; after receiving the information, the elderly person's daughter immediately called home but could not get through, and contacted community volunteers to check on the elderly person. Upon arrival, the volunteers confirmed the elderly person's situation through the terminal's voice intercom function, and marked "rescued" on the APP, and the system automatically stopped the alarm; at 3:00 AM that day, the edge node encrypted and uploaded the feature data of this fall event and the updated model parameters to the federated server, which aggregated 100 After the parameters of each node are calculated, an optimized model is generated and sent to the terminal the next morning. This improves the model's speed in recognizing falls in specific scenarios such as "carpet tripping" by 20%, forming a complete closed loop of "monitoring-alarm-rescue-optimization".

[0090] In this embodiment, the edge monitoring node can upload parameter updates to the federated learning server, reducing the amount of data uploaded while avoiding leakage of user data privacy. Moreover, in this embodiment, the federated learning server can combine the parameter updates uploaded by multiple edge monitoring nodes to achieve global optimization, thereby improving the model's generalization ability and enhancing its adaptability.

[0091] Reference Figure 2 The diagram illustrates a flowchart of another anomaly detection model update method according to an embodiment of this application. This anomaly detection model update method can be applied to a federated learning server, and the specific steps of the anomaly detection model update method include the following: Step S201: Obtain the parameter update amount uploaded by multiple edge monitoring nodes. The parameter update amount is the multi-modal data collected by the edge monitoring nodes within the activity range of the target personnel. Based on the multi-modal data and the anomaly detection model stored locally by the edge monitoring nodes, obtain the anomaly identification information of the target personnel. Based on the anomaly identification information, determine the parameter update amount of the anomaly detection model. The anomaly detection model stored locally is the model distributed by the anomaly detection model stored on the federated learning server. Step S202: Based on the update amounts of the multiple parameters, perform global optimization on the anomaly detection model stored in the federated learning server to obtain the updated anomaly detection model; Step S203: The updated anomaly detection model is distributed to multiple edge monitoring nodes to update the anomaly detection model stored locally on the edge monitoring nodes.

[0092] In one embodiment of this application, the step of globally optimizing the anomaly detection model stored on the federated learning server based on the update amounts of the plurality of parameters to obtain an updated anomaly detection model includes: Obtain the number of sample parameters updated uploaded by each edge monitoring node; determine the weight data corresponding to each edge monitoring node based on the number of samples; and perform global optimization on the anomaly detection model stored on the federated learning server according to the weight data and the parameter update amount to obtain the updated anomaly detection model.

[0093] In practical applications, the weighted aggregation algorithm (FedAvg) can be used to optimize the model globally in a federated learning server. First, the number of samples for parameter updates uploaded by each edge monitoring node can be determined, and then the total number of samples can be determined. Thus, the weight data of each edge monitoring node = the number of samples of that edge monitoring node / the total number of samples.

[0094] Then, the corresponding parameter update amounts are weighted according to the obtained weight data to obtain the globally optimized parameter update amounts, and the updated anomaly detection model is determined according to these parameter update amounts.

[0095] In one embodiment of this application, after obtaining the updated anomaly detection model, the anomaly detection model can be subjected to security verification; after the security verification is passed, the updated anomaly detection model is distributed to multiple edge monitoring nodes.

[0096] The security verification can include detecting whether there are abnormal offsets in the parameters or whether there is malicious injection code. After the verification is passed, it can be sent to each edge node via HTTPS protocol. After the node receives the data, it automatically overwrites the old model, achieving a seamless iteration every 24 hours. According to actual tests, the accuracy of the model in recognizing falling behavior in complex scenarios can be improved from the initial 75% to over 95% after iteration.

[0097] In this embodiment, the edge monitoring node can upload parameter updates to the federated learning server, reducing the amount of data uploaded while avoiding leakage of user data privacy. Moreover, in this embodiment, the federated learning server can combine the parameter updates uploaded by multiple edge monitoring nodes to achieve global optimization, thereby improving the model's generalization ability and enhancing its adaptability.

[0098] It should be noted that the anomaly detection model update method provided in this application embodiment can be executed by an anomaly detection model optimization device, or a control module in the anomaly detection model optimization device for executing the method of loading the anomaly detection model optimization. This application embodiment uses the anomaly detection model optimization device executing the method of loading the anomaly detection model optimization as an example to illustrate the anomaly detection model optimization method provided in this application embodiment.

[0099] Reference Figure 3 The diagram shows a structural schematic of an anomaly detection model update device according to an embodiment of this application, which may specifically include the following modules: The multimodal data acquisition module 301 is used to acquire various multimodal data collected by the edge monitoring node within the activity range of the target personnel; The anomaly identification information determination module 302 is used to perform abnormal behavior detection using the anomaly detection model stored in the edge monitoring node and the multiple multimodal data to obtain the anomaly identification information of the target person. The anomaly detection model is a model issued by the federated learning server. The parameter update generation module 303 is used to determine the parameter update amount of the anomaly detection model based on the anomaly identification information. The parameter update upload module 304 is used to upload the parameter update to the federated learning server, so as to perform global optimization on the parameter update uploaded by multiple edge monitoring nodes on the federated learning server to obtain the updated anomaly detection model. The anomaly detection model update module 305 is used to receive the updated anomaly detection model issued by the federated learning server and replace the locally stored anomaly detection model with the updated anomaly detection model.

[0100] In one embodiment of this application, the anomaly identification information determination module 302 may include: The fusion feature generation submodule is used to extract feature data based on the multiple multimodal data respectively, and fuse the multiple feature data to generate fusion features; The anomaly identification information output submodule is used to input the fused features into the anomaly detection model stored in the edge monitoring node and output the anomaly identification information of the target person.

[0101] In one embodiment of this application, the parameter update generation module 303 may include: The loss value determination submodule is used to calculate the loss value of the anomaly detection model based on the anomaly identification information; The parameter update amount determination submodule is used to determine the parameter update amount of the anomaly detection model based on the loss value.

[0102] In one embodiment of this application, the anomaly identification information determination module 302 may include: The feature data transmission submodule is used to encrypt the feature data according to a preset encryption algorithm and then upload it to the federated learning server, so that the federated learning server can perform model training and updates based on the feature data.

[0103] In one embodiment of this application, the apparatus may further include: A risk level determination module is used to determine the risk level based on the anomaly identification results; The alarm triggering module is used to trigger alarms according to the risk level.

[0104] In one embodiment of this application, the fusion feature generation submodule may include: A video keyframe determination unit is used to sample from the video data to obtain target video keyframes when the multimodal data is video data; The coordinate data determination unit is used to input the video keyframes into the trained human pose estimation model and output the coordinate data of key bone points. The data determination unit is used to determine the displacement vector and angle change rate of bone points in adjacent frames based on the key bone point coordinate data. The feature data determination unit is used to use the displacement vector and the angle change rate as feature data of the video data.

[0105] In one embodiment of this application, the fusion feature generation submodule may include: The Fourier transform unit is used to convert the multimodal data into a frequency domain signal by using Fourier transform when the multimodal data is radar data. The feature data extraction unit is used to extract feature data from the frequency domain signal.

[0106] In this embodiment, the edge monitoring node can upload parameter updates to the federated learning server, reducing the amount of data uploaded while avoiding leakage of user data privacy. Moreover, in this embodiment, the federated learning server can combine the parameter updates uploaded by multiple edge monitoring nodes to achieve global optimization, thereby improving the model's generalization ability and enhancing its adaptability.

[0107] Reference Figure 4 The diagram shows a structural schematic of an anomaly detection model update device according to an embodiment of this application, which may specifically include the following modules: The parameter update quantity acquisition module 401 is used to acquire the parameter update quantity uploaded by multiple edge monitoring nodes. The parameter update quantity is the multi-modal data collected by the edge monitoring nodes within the activity range of the target personnel. Based on the multi-modal data and the anomaly detection model stored locally by the edge monitoring nodes, the anomaly identification information of the target personnel is obtained. Based on the anomaly identification information, the parameter update quantity of the anomaly detection model is determined. The anomaly detection model stored locally is the model distributed by the anomaly detection model stored on the federated learning server. An anomaly detection model optimization module 402 is used to globally optimize the anomaly detection model stored on the federated learning server based on the update amounts of the multiple parameters, so as to obtain an updated anomaly detection model. The anomaly detection model distribution module 403 is used to distribute the updated anomaly detection model to multiple edge monitoring nodes to update the anomaly detection model stored locally on the edge monitoring nodes.

[0108] In one embodiment of this application, the anomaly detection model optimization module 402 may include: The sample data acquisition submodule is used to obtain the number of samples of parameter update data uploaded by each edge monitoring node; The weight data determination submodule is used to determine the weight data corresponding to each edge monitoring node based on the number of samples. The anomaly detection model submodule is used to globally optimize the anomaly detection model stored on the federated learning server according to the weight data and the parameter update amount, so as to obtain the updated anomaly detection model.

[0109] In one embodiment of this application, the apparatus further includes: A security verification module is used to perform security verification on the anomaly detection model. The execution module is used to distribute the updated anomaly detection model to multiple edge monitoring nodes after the security verification is passed.

[0110] In this embodiment, the edge monitoring node can upload parameter updates to the federated learning server, reducing the amount of data uploaded while avoiding leakage of user data privacy. Moreover, in this embodiment, the federated learning server can combine the parameter updates uploaded by multiple edge monitoring nodes to achieve global optimization, thereby improving the model's generalization ability and enhancing its adaptability.

[0111] In this embodiment, the edge monitoring node can upload parameter updates to the federated learning server, reducing the amount of data uploaded while avoiding leakage of user data privacy. Moreover, in this embodiment, the federated learning server can combine the parameter updates uploaded by multiple edge monitoring nodes to achieve global optimization, thereby improving the model's generalization ability and enhancing its adaptability.

[0112] The optimization device for the anomaly detection model in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This application embodiment does not impose specific limitations.

[0113] The optimization device for the anomaly detection model in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0114] The optimization device for the anomaly detection model provided in this application embodiment can achieve Figures 1a to 2 The various processes implemented by the optimization device of the anomaly detection model in the method embodiment will not be described again here to avoid repetition.

[0115] Optionally, this application embodiment also provides an electronic device, including a processor 1010, a memory 1009, and a program or instructions stored in the memory 1009 and executable on the processor 1010. When the program or instructions are executed by the processor 1010, they implement the various processes of the above-described anomaly detection model update method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0116] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0117] Figure 5 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of this application. The electronic device 1000 includes, but is not limited to, the following components: radio frequency unit 1001, network module 1002, audio output unit 1003, input unit 1004, sensor 1005, display unit 1006, user input unit 1007, interface unit 1008, memory 1009, and processor 1010.

[0118] The memory 1009 includes applications and an operating system; the user input unit 1007 may include a touch panel 10071 and other input devices 10072; the input unit 1004 may include an image processor 10041 and a microphone 10042; and the display unit 1006 may include a display panel 10061.

[0119] Those skilled in the art will understand that the electronic device 1000 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 1010 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 5 The electronic device structure shown does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here. This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described anomaly detection model update method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0120] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0121] This application also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described anomaly detection model update method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0122] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0123] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0124] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0125] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for updating an anomaly detection model, characterized in that, Applied to edge monitoring nodes, the method includes: Acquire various multimodal data collected by edge monitoring nodes within the activity range of target personnel; The abnormal behavior detection is performed using the anomaly detection model stored in the edge monitoring node and the various multimodal data to obtain the anomaly identification information of the target person. The anomaly detection model is a model issued by the federated learning server. The parameter update amount of the anomaly detection model is determined based on the anomaly identification information; The parameter update amount is uploaded to the federated learning server, and the updated anomaly detection model is obtained by global optimization of the parameter update amount uploaded by multiple edge monitoring nodes on the federated learning server. The system receives the updated anomaly detection model from the federated learning server and replaces the locally stored anomaly detection model with the updated model.

2. The method according to claim 1, characterized in that, The abnormal behavior detection is performed using the anomaly detection model stored in the edge monitoring node and the various multimodal data to obtain the abnormal identification information of the target person, including: Feature data is extracted from the various multimodal data respectively, and the multiple feature data are fused to generate a fused feature; The fused features are input into the anomaly detection model stored in the edge monitoring node, and the anomaly identification information of the target person is output.

3. The method according to claim 1, characterized in that, Determining the parameter update amount of the anomaly detection model based on the anomaly identification information includes: The loss value of the anomaly detection model is calculated based on the anomaly identification information; The parameter update amount of the anomaly detection model is determined based on the loss value.

4. The method according to claim 2, characterized in that, Also includes: The feature data is encrypted using a preset encryption algorithm and then uploaded to the federated learning server, whereby the model is trained and updated based on the feature data.

5. The method according to claim 1, characterized in that, Also includes: The risk level is determined based on the anomaly identification results; An alarm is triggered according to the stated risk level.

6. The method according to claim 2, characterized in that, The extraction of feature data based on the various multimodal data includes: When the multimodal data is video data, sampling is performed from the video data to obtain the target video keyframes; Input the video keyframes into the trained human pose estimation model and output the coordinate data of key bone points. Based on the key skeleton point coordinate data, determine the displacement vector and angle change rate of skeleton points in adjacent frames; The displacement vector and the rate of change of angle are used as feature data of the video data.

7. The method according to claim 2, characterized in that, The extraction of feature data based on the various multimodal data includes: When the multimodal data is radar data, Fourier transform is used to convert the radar data into a frequency domain signal; Feature data is extracted from the frequency domain signal.

8. A method for updating an anomaly detection model, characterized in that, Applied to a federated learning server, the method includes: The parameter update amount uploaded by multiple edge monitoring nodes is obtained. The parameter update amount is the multi-modal data collected by the edge monitoring nodes within the activity range of the target person. Based on the multi-modal data and the anomaly detection model stored locally by the edge monitoring nodes, the anomaly identification information of the target person is obtained. Based on the anomaly identification information, the parameter update amount of the anomaly detection model is determined. The anomaly detection model stored locally is the model distributed by the anomaly detection model stored on the federated learning server. The anomaly detection model stored on the federated learning server is globally optimized based on the update amounts of the multiple parameters to obtain the updated anomaly detection model. The updated anomaly detection model is distributed to multiple edge monitoring nodes to update the anomaly detection model stored locally on the edge monitoring nodes.

9. The method according to claim 8, characterized in that, The step of globally optimizing the anomaly detection model stored on the federated learning server based on the update amounts of the multiple parameters to obtain the updated anomaly detection model includes: Obtain the number of samples of parameter updates uploaded by each edge monitoring node; The weight data corresponding to each edge monitoring node is determined based on the number of samples. The anomaly detection model stored on the federated learning server is globally optimized based on the weight data and the parameter update amount to obtain the updated anomaly detection model.

10. The method according to claim 9, characterized in that, After obtaining the updated anomaly detection model, the following is also included: The anomaly detection model is subjected to security verification. After the security verification is passed, the updated anomaly detection model is distributed to multiple edge monitoring nodes.

11. An update device for an anomaly detection model, characterized in that, The device, applied to edge monitoring nodes, includes: The multimodal data acquisition module is used to acquire various multimodal data collected by the edge monitoring node within the activity range of the target personnel; The anomaly identification information determination module is used to perform abnormal behavior detection using the anomaly detection model stored in the edge monitoring node and the multiple multimodal data to obtain the anomaly identification information of the target person. The anomaly detection model is a model issued by the federated learning server. The parameter update quantity generation module is used to determine the parameter update quantity of the anomaly detection model based on the anomaly identification information. The parameter update upload module is used to upload the parameter update to the federated learning server, so as to perform global optimization on the parameter update uploaded by multiple edge monitoring nodes on the federated learning server to obtain the updated anomaly detection model. The anomaly detection model update module is used to receive the updated anomaly detection model issued by the federated learning server and replace the locally stored anomaly detection model with the updated anomaly detection model.

12. An update device for an anomaly detection model, characterized in that, The apparatus, used in a federated learning server, includes: The parameter update quantity acquisition module is used to acquire the parameter update quantity uploaded by multiple edge monitoring nodes. The parameter update quantity is the multi-modal data collected by the edge monitoring nodes within the activity range of the target personnel. Based on the multi-modal data and the anomaly detection model stored locally by the edge monitoring nodes, the anomaly identification information of the target personnel is obtained. Based on the anomaly identification information, the parameter update quantity of the anomaly detection model is determined. The anomaly detection model stored locally is the model distributed by the anomaly detection model stored on the federated learning server. An anomaly detection model optimization module is used to globally optimize the anomaly detection model stored on the federated learning server based on the update amounts of the multiple parameters, so as to obtain an updated anomaly detection model. The anomaly detection model distribution module is used to distribute the updated anomaly detection model to multiple edge monitoring nodes to update the anomaly detection model stored locally on the edge monitoring nodes.

13. An electronic device, characterized in that, The method includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method for updating the anomaly detection model as described in any one of claims 1-10.

14. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the anomaly detection model update method as described in any one of claims 1-10.

Images