Engineering video monitoring safety management method and system

Abstract

The invention discloses an engineering video monitoring safety management method and system, and the method comprises the steps: constructing an engineering video monitoring data grading system, and configuring an operation authority baseline of each grade of data; acquiring an operation log of the engineering video monitoring system in real time and storing the operation log in the block chain; constructing a multi-dimensional behavior feature model based on the operation authority base line and the historical operation data; comparing the collected operation log with the multi-dimensional behavior feature model, identifying an abnormal operation behavior according to an abnormal early warning rule, and generating an abnormal early warning; and executing hierarchical response on the generated abnormal early warning. According to the method, videos of different risk levels are distinguished through a sensitive grading system in combination with manual presetting and AI dynamic marking; then role permission baselines are matched, operation is limited from an access source, low-permission users are prevented from making contact with high-sensitivity videos in an unauthorized mode, the risk of important data leakage can be effectively reduced, obvious violations such as unauthorized conditions can be recognized through a multi-dimensional model, and a small number of hidden operations can be early warned in advance.

Description

Technical Field

[0001] This invention relates to the field of engineering video surveillance technology, and in particular to an engineering video surveillance security management method and system. Background Technology

[0002] Integrated operation log auditing for engineering video surveillance security management is an engineering safety management model that combines video monitoring with operational behavior tracing. It can capture real-time dynamic images of key areas at the engineering site and automatically record operational behaviors related to the monitoring system, forming a traceable operation log. By combining real-time alerts from video footage with audit analysis of operation logs, it enables visualized control of safety risks at the engineering site while also ensuring the data security of the monitoring system itself.

[0003] Existing log auditing systems often rely on fixed thresholds for anomaly detection, failing to incorporate personalized standards based on user roles and historical behavior. This allows low-privilege users to gradually steal sensitive information through repeated, small-scale operations, resulting in delayed anomaly alerts. For example, a fixed threshold might trigger an alert if more than 10 downloads per day are executed. However, if a low-privilege user downloads only one piece of customer information each time, an alert might not be triggered until 10 days later, leading to untimely anomaly alerts and posing a security risk. Summary of the Invention

[0004] In order to overcome the above-mentioned shortcomings of the prior art, the purpose of this invention is to provide a method and system for security management of engineering video surveillance. By constructing a video data hierarchical system, sensitive videos are controlled at different levels, and a multi-dimensional behavioral feature model is set up to achieve more flexible and timely anomaly identification and early interception of hidden malicious operations.

[0005] The technical solution adopted by this invention to solve its technical problem is: a method for security management of engineering video surveillance, comprising the following steps:

[0006] S1. Construct a hierarchical system for engineering video surveillance data and configure the baseline for operation permissions for each level of data;

[0007] S2. Real-time acquisition of operation logs from the engineering video monitoring system and storage in the blockchain;

[0008] S3. Based on the baseline of operation permissions and historical operation data, construct a multi-dimensional behavioral feature model;

[0009] S4. Compare the collected operation logs with the multi-dimensional behavioral feature model, identify abnormal operation behaviors according to the abnormal warning rules, and generate abnormal warnings;

[0010] S5. Execute a tiered response to the generated anomaly warnings.

[0011] As a further improvement of the present invention: step S1 further includes establishing data sensitivity level standards and performing multi-level classification and labeling, specifically as follows:

[0012] Videos involving classified areas or critical operations are marked as Level 1 Sensitive.

[0013] Videos involving personnel operations or critical production processes will be marked as Level 2 Sensitive.

[0014] Videos involving public areas but requiring privacy protection will be labeled as Level 3 Sensitive.

[0015] Videos from open areas containing no sensitive information are marked as Level 4 Sensitivity.

[0016] As a further improvement of the present invention: In step S1, when classifying and labeling video surveillance data at multiple levels, a preset rule is used for basic labeling, and AI recognition is combined for dynamic labeling to generate and store the hierarchical result labeling.

[0017] Basic tags include device region mapping tags and batch rule configuration tags;

[0018] When performing dynamic tagging, if facial features of people or operation of core equipment are detected, the sensitivity level of the video is automatically increased; if no people or core equipment are detected in the frame, the sensitivity level of the video is automatically decreased.

[0019] As a further improvement of the present invention: before storing the classification result label in step S1, the classification result is embedded as a metadata field in the video file and bound to the video metadata; when the classification result label changes, the level before and after the change and the reason for the change are automatically recorded.

[0020] As a further improvement of the present invention: the construction of the multi-dimensional behavioral feature model in step S3 specifically involves:

[0021] Filter all operation logs within a set period, aggregate them by user-role-operation dimension to form a user behavior sequence;

[0022] Establish personalized baselines and cumulative effect baselines for each role to form multi-dimensional reference standards;

[0023] The personalized baseline is constructed based on the historical operation data of the corresponding user or role and is used to characterize their regular operation behavior patterns.

[0024] The cumulative effect baseline is constructed based on a threshold of the total number of operations within a preset period and is used to detect the cumulative effect of the number of operations.

[0025] As a further improvement of the present invention: in step S4, the comparison specifically includes:

[0026] Permission baseline comparison: Determine whether the real-time operation violates the operation permission baseline defined in step S1;

[0027] Personalized baseline comparison: Determine the degree of deviation between real-time operations and the personalized baseline of the corresponding user or role;

[0028] Cumulative effect baseline comparison: Determine whether the real-time operation causes the total number of operations within the period to exceed the threshold of the cumulative effect baseline.

[0029] As a further improvement of the present invention: when comparing the permission baseline, the check items include one or more of the following:

[0030] Does the operator have the necessary permissions to access the target video's sensitivity level? Is the operation type permitted? Is the operation time within the permitted time period?

[0031] If any of the above checks fails, it will be marked as an access violation.

[0032] When performing personalized baseline comparison, the inspection items include operation frequency, operation time period and operation object, and the deviation score is calculated based on the inspection items.

[0033] When comparing the cumulative effect baseline, the check items include the cumulative amount of the period, the trend growth rate, and the cumulative amount of sensitive operations. When the cumulative amount reaches the threshold, a cumulative warning is marked, and when it exceeds the threshold, an abnormal cumulative limit is marked.

[0034] As a further improvement of the present invention: step S5 includes performing a risk assessment on the identified abnormal operational behavior and generating graded early warning information, specifically:

[0035] Weights are assigned to abnormal access control, deviation from personalized baseline, and abnormal cumulative effect, respectively. The total abnormality score is calculated, and the warning level is determined based on the total abnormality score.

[0036] When the warning conditions are met, the system automatically generates a warning event and pushes it to the real-time monitoring screen simultaneously.

[0037] This invention also provides an engineering video surveillance security management system, comprising:

[0038] The storage module is used to store video data, operation permission baselines, behavioral feature model parameters, and operation logs stored on the blockchain.

[0039] The data acquisition module is used to collect operational behavior data of the video surveillance system in real time.

[0040] The multi-dimensional anomaly detection module is used to perform real-time analysis of the collected operational behavior data based on the behavioral feature model in order to identify abnormal operations.

[0041] As a further improvement of the present invention: the multi-dimensional anomaly detection module includes:

[0042] The baseline calculation unit is used to generate personalized operational baselines and cumulative effect baselines for each user or role.

[0043] The multi-dimensional comparison unit is used to compare real-time operations with the operation permission baseline, personalized operation baseline, and cumulative effect baseline respectively.

[0044] The anomaly scoring unit is used to score the risk of operations that trigger the comparison rules, determine the risk level based on the total anomaly score, and generate corresponding warnings.

[0045] Compared with the prior art, the beneficial effects of the present invention are:

[0046] This invention constructs a hierarchical system and permission baseline for engineering video surveillance data, uses blockchain technology to store operation logs immutably, and builds a multi-dimensional behavioral feature model for analyzing user behavior based on the operation permission baseline and historical operation log data. It detects real-time abnormal operation behavior, provides hierarchical early warning responses, identifies obvious violations such as unauthorized access, and can also provide early warnings for a small number of hidden operations. This solves the problems of lagging detection and high false positives in traditional fixed threshold detection, and reduces security vulnerabilities. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the process of the present invention.

[0048] Figure 2 This is a flowchart illustrating one embodiment of the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0050] In order to solve the technical problems in the prior art, the present invention will now be further described in conjunction with the accompanying drawings and embodiments:

[0051] like Figure 1 As shown, this invention discloses a method for security management of engineering video surveillance, comprising the following steps:

[0052] S1. Construct a hierarchical system for engineering video surveillance data and configure the baseline for operation permissions for each level of data;

[0053] S2. Real-time acquisition of operation logs from the engineering video monitoring system and storage in the blockchain;

[0054] S3. Based on the baseline of operation permissions and historical operation data, construct a multi-dimensional behavioral feature model;

[0055] S4. Compare the collected operation logs with the multi-dimensional behavioral feature model, identify abnormal operation behaviors according to the abnormal warning rules, and generate abnormal warnings;

[0056] S5. Execute a tiered response to the generated anomaly warnings.

[0057] This invention constructs a hierarchical system and permission baseline for engineering video surveillance data, establishes sensitivity level standards for video data, and performs multi-level classification and labeling of video data, configuring corresponding operation permission baselines for each sensitivity level; it collects all operation logs of the engineering video surveillance system in real time, and stores the operation logs immutably using blockchain technology, constructs a multi-dimensional behavioral feature model for analyzing user behavior, realizes real-time abnormal operation behavior detection, and executes hierarchical early warning responses.

[0058] Specifically, by constructing a closed-loop management system integrating "data hierarchical management, log reliability, behavioral modeling, real-time detection, and hierarchical response," the security management of engineering video surveillance can be transformed from passive, extensive, and lagging to proactive, refined, and real-time. This solves the problem that traditional methods often treat video data indiscriminately, have rudimentary permission settings, and fail to distinguish the risk differences between different areas and content in the monitored footage.

[0059] This invention, by "constructing a multi-dimensional behavioral feature model" and "performing real-time comparison," allows the system to move beyond relying solely on static rules. It learns the normal behavioral patterns (personalized baseline) of each user or role and monitors long-term accumulated operational trends (cumulative effect baseline). This enables the system not only to detect obvious violations such as "unauthorized access," but also to accurately identify seemingly normal but deviating from personal habits or slowly approaching dangerous thresholds—hidden malicious operations.

[0060] In some implementations, step S1 further includes establishing data sensitivity level standards and performing multi-level classification labeling, specifically as follows:

[0061] Videos involving classified areas or critical operations are marked as Level 1 Sensitive.

[0062] Videos involving personnel operations or critical production processes will be marked as Level 2 Sensitive.

[0063] Videos involving public areas but requiring privacy protection will be labeled as Level 3 Sensitive.

[0064] Videos from open areas containing no sensitive information are marked as Level 4 Sensitivity.

[0065] By establishing data sensitivity level standards and implementing multi-level classification and labeling, the sensitivity of video surveillance data becomes readily apparent, facilitating differentiated management by administrators based on varying sensitivity levels and further improving the accuracy of data management. Specifically, by directly linking video content with security risks, the rationality and practicality of the tiered system are ensured, enabling differentiated security control strategies. This ensures that highly sensitive videos receive the strictest protection, while less sensitive videos maintain appropriate accessibility. Thus, while guaranteeing security, resource allocation is optimized, avoiding the problems of "overprotection" or "underprotection."

[0066] In some implementations, in step S1, when classifying and labeling video surveillance data at multiple levels, a preset rule is used for basic labeling, and AI recognition is combined for dynamic labeling to generate and store the hierarchical labeling results.

[0067] Basic tags include device region mapping tags and batch rule configuration tags;

[0068] When performing dynamic tagging, if facial features of people or operation of core equipment are detected, the sensitivity level of the video is automatically increased; if no people or core equipment are detected in the frame, the sensitivity level of the video is automatically decreased.

[0069] This implementation uses preset rules for basic labeling, improving the efficiency and consistency of data classification and ensuring that basic classification standards are uniformly implemented. Combined with AI recognition for dynamic labeling, data classification can be adjusted in real time according to actual conditions, more flexibly and accurately reflecting changes in the sensitivity of video surveillance data.

[0070] In some implementations, before storing the classification result label in step S1, the classification result is embedded as a metadata field in the video file and bound to the video metadata; when the classification result label changes, the level before and after the change and the reason for the change are automatically recorded.

[0071] In this implementation, the classification results are embedded as metadata fields in the video file, achieving a tight binding between the classification results and the video data. This facilitates a clear understanding of the sensitivity level of the video throughout its storage, transmission, and use. Automatic recording of the levels before and after changes, as well as the reasons for the changes, provides detailed information for auditing and tracing data classification, helping managers understand the entire process of changes in data sensitivity levels.

[0072] In some implementations, the construction of the multi-dimensional behavioral feature model in step S3 specifically involves:

[0073] Filter all operation logs within a set period, aggregate them by user-role-operation dimension to form user behavior sequence, build personalized baselines and cumulative effect baselines for each role, and form multi-dimensional reference standards;

[0074] The personalized baseline is constructed based on the historical operation data of the corresponding user or role and is used to characterize their regular operation behavior patterns.

[0075] The cumulative effect baseline is constructed based on a threshold of the total number of operations within a preset period and is used to detect the cumulative effect of the number of operations.

[0076] In this implementation, user behavior sequences are aggregated according to the user-role-operation dimension. Operation logs are organized and analyzed from multiple dimensions, enabling the behavior feature model to more comprehensively reflect user operation behavior. Personalized baselines and cumulative effect baselines are constructed, establishing personalized operation behavior reference standards for each user or role. At the same time, the cumulative effect of operation volume is considered, which can more accurately detect abnormal behavior.

[0077] Personalized baselines can identify anomalies that deviate from users' normal behavior patterns (e.g., operations personnel suddenly accessing the finance department's video feed late at night), effectively detecting abnormal behavior by "insiders." Cumulative effect baselines can effectively identify gradual violations that occur "in small amounts and multiple times" (e.g., low-privilege users downloading a small number of sensitive videos each day, accumulating into a large data leak), solving the problem of severely delayed alerts in traditional methods in such scenarios.

[0078] In some implementations, step S4 specifically includes:

[0079] Permission baseline comparison: Determine whether the real-time operation violates the operation permission baseline defined in step S1;

[0080] Personalized baseline comparison: Determine the degree of deviation between real-time operations and the personalized baseline of the corresponding user or role;

[0081] Cumulative effect baseline comparison: Determine whether the real-time operation causes the total number of operations within the period to exceed the threshold of the cumulative effect baseline.

[0082] In this implementation, permission baseline comparison ensures that a user's actions conform to their granted permissions, effectively preventing unauthorized operations. Personalized baseline comparison, by judging the degree of deviation between real-time operations and personalized baselines, can detect abnormal user operation patterns, even if the operation does not violate the permission baseline. Cumulative effect baseline comparison can promptly detect abnormal accumulation of operation volume, avoiding security issues caused by excessive operations.

[0083] Furthermore, during the baseline comparison of permissions, the check items include one or more of the following: whether the operator role has the permission to access the target video's sensitivity level, whether the operation type is allowed, and whether the operation time is within the allowed time period; if any of the above check items fails, it is marked as a permission violation.

[0084] When performing personalized baseline comparison, the inspection items include operation frequency, operation time period and operation object, and the deviation score is calculated based on the inspection items.

[0085] When comparing the cumulative effect baseline, the check items include the cumulative amount of the period, the trend growth rate, and the cumulative amount of sensitive operations. When the cumulative amount reaches the threshold, a cumulative warning is marked, and when it exceeds the threshold, an abnormal cumulative limit is marked.

[0086] In this implementation, the baseline comparison check items clearly define the specific content of the permission check, making permission verification more comprehensive and detailed, and improving the strictness of permission management. The personalized baseline comparison check items and deviation score calculation, by comprehensively considering factors such as operation frequency, time period, and object, can more accurately assess the degree of deviation between user operations and normal behavior patterns. The cumulative effect baseline comparison check items and anomaly markers monitor periodic cumulative amounts, trend growth rates, and sensitive operation accumulation, enabling timely detection of abnormal changes in operation volume and providing strong support for security management.

[0087] In some implementations, step S5 includes performing a risk assessment on the identified abnormal operational behavior and generating tiered early warning information, specifically:

[0088] Weights are assigned to abnormal access control, deviation from personalized baseline, and abnormal cumulative effect, respectively. The total abnormality score is calculated, and the warning level is determined based on the total abnormality score.

[0089] When the warning conditions are met, the system automatically generates a warning event and pushes it to the real-time monitoring screen simultaneously.

[0090] This implementation method achieves quantitative assessment of abnormal operational behaviors by assigning weights to different types of anomalies and calculating a total anomaly score. Based on the score, warning levels are assigned, enabling managers to take appropriate measures according to the severity of the warning. Warning events are automatically generated and pushed to a real-time monitoring dashboard, ensuring that managers can obtain anomaly information promptly for rapid decision-making and improved emergency response speed.

[0091] Based on the same inventive concept, the present invention also provides an engineering video surveillance security management system, comprising:

[0092] The storage module is used to store video data, operation permission baselines, behavioral feature model parameters, and operation logs stored on the blockchain.

[0093] The data acquisition module is used to collect operational behavior data of the video surveillance system in real time.

[0094] The multi-dimensional anomaly detection module is used to perform real-time analysis of the collected operational behavior data based on the behavioral feature model in order to identify abnormal operations.

[0095] The storage module provides data storage support for the entire system, ensuring the secure storage of important information such as video data, operation permission baselines, behavioral feature model parameters, and operation logs. The acquisition module collects operational behavior data in real time, providing a timely and accurate data source for subsequent analysis and processing. The multi-dimensional anomaly detection module performs real-time analysis of the collected data based on the behavioral feature model, enabling rapid and accurate identification of abnormal operations; it is the core module for the system's security management.

[0096] In some implementations, the multi-dimensional anomaly detection module includes:

[0097] The baseline calculation unit is used to generate personalized operational baselines and cumulative effect baselines for each user or role.

[0098] The multi-dimensional comparison unit is used to compare real-time operations with the operation permission baseline, personalized operation baseline, and cumulative effect baseline respectively.

[0099] The anomaly scoring unit is used to score the risk of operations that trigger the comparison rules, determine the risk level based on the total anomaly score, and generate corresponding warnings.

[0100] Specifically, the baseline calculation unit is responsible for generating personalized operational baselines and cumulative effect baselines for each user or role, providing a reference standard for multi-dimensional comparisons. The multi-dimensional comparison unit compares real-time operations with various baselines, enabling comprehensive and accurate detection of abnormal operational behaviors. The anomaly scoring unit assigns a risk score to operations that trigger comparison rules and determines the risk level based on the total anomaly score, generating corresponding warnings so that the system can take different handling measures according to the severity of the anomaly.

[0101] Implementation Case 1:

[0102] like Figure 2 As shown in the figure, an embodiment of the present invention provides a method for security management of engineering video surveillance, comprising the following steps:

[0103] S1. Construct a hierarchical system for engineering video surveillance data, formulate data sensitivity level standards, perform multi-level classification and labeling, configure corresponding operation permission baselines for each level of data, and record operation data.

[0104] Based on the security risks and sensitive attributes of video data, establish clear classification criteria to achieve differentiated management and avoid the problems of insufficient protection of highly sensitive data or excessive management of low-sensitive data caused by indiscriminate management of all videos.

[0105] This provides a hierarchical basis for subsequent permission configuration, ensuring that highly sensitive videos are only accessible to key personnel, while less sensitive videos can be shared appropriately, balancing security and ease of use. By setting an operational permission baseline, the operator, scope of operation, and actions are clearly defined to prevent unauthorized access and unauthorized operations.

[0106] S2. Real-time collection of all operation logs from the engineering video monitoring system, and tamper-proof storage of the logs through blockchain technology;

[0107] Blockchain storage can ensure the authenticity and traceability of operation logs, and prevent logs from being tampered with or deleted.

[0108] Before writing operation logs to the blockchain, the original logs must be standardized. Each block consists of a block header and a block body. Log data is stored in the block body, while the block header records crucial information to ensure immutability. For example, the block body may contain 100 standardized log entries. Each log entry is assigned a unique hash value using the SHA-256 algorithm. These 100 hash values ​​are then used to calculate a Merkle root hash using a Merkle tree structure and stored in the block header. Subsequent verification of the Merkle root hash quickly determines whether the logs within the block have been tampered with. This blockchain technology is existing and will not be elaborated further.

[0109] S3. Construct a multi-dimensional behavioral feature model based on permission baselines and historical operation data;

[0110] By using a multi-dimensional behavioral feature model to overcome the limitations of traditional fixed threshold detection, we can achieve personalized behavioral anomaly identification for each individual, while also capturing a small number of hidden violations.

[0111] S4. Compare the collected real-time operation logs with the multi-dimensional behavioral feature model in real time to establish anomaly warning rules;

[0112] In step S4, the comparison uses static permission baseline comparison, as well as dynamic personalized baseline comparison and cumulative effect baseline comparison. The permission baseline quickly identifies obvious violations, while personalized baseline comparison and cumulative effect baseline comparison identify hidden abnormal behaviors, including deviations from individual routines and cumulative over-limit operations.

[0113] S5. Execute a tiered response to the generated anomaly warnings.

[0114] In step S1, when setting the data sensitivity level standard, videos involving confidential areas or critical operations are set to extremely sensitive, corresponding to level one; for example, server areas in the computer room, finance office, hazardous materials storage area, locations that expose core facilities, or places that may cause security accidents or leaks.

[0115] Videos involving personnel operations and critical production processes are set to high sensitivity, corresponding to level 2; for example, production line operation stations, quality inspection areas, and warehouse loading and unloading areas, including details of employee operations, production processes, and material information.

[0116] Videos involving public activity areas but requiring privacy protection are set to medium sensitivity, corresponding to level three; for example, office areas, canteens, main roads of factories, including personnel activity trajectories and non-primary area environments.

[0117] Video footage from open areas containing no sensitive information is set to low sensitivity, corresponding to level four. Examples include the factory perimeter wall, parking lot, and green belt, which contain no close-ups of people, important facilities, or business information.

[0118] The classification criteria are based on the following points: Spatial attributes: Whether it is a restricted area, such as areas requiring access control are classified as level 1-2;

[0119] Content attributes: Whether it includes personnel facial features or operational details, core equipment or processes;

[0120] Risks and consequences: Whether the leak will lead to a security incident, privacy disputes, or have no substantial impact.

[0121] In step S1, when performing multi-level hierarchical labeling of video data, basic labeling is performed using manually preset rules, dynamic labeling is achieved using AI recognition, and the hierarchical results are labeled and stored.

[0122] The basic tags include device area mapping tags and batch rule configuration tags; when performing dynamic tagging, if a close-up of a person's face or server rack operation is detected, the tag level is automatically raised by one level.

[0123] If no personnel or core equipment are detected on the screen, the alert level will be automatically downgraded.

[0124] For device-area mapping: Enter the deployment location of all monitoring devices in the system, such as "CAM-001 is deployed in the server area of ​​the computer room", and associate it with the corresponding level, such as CAM-001 being marked as level 1 by default. Batch rule configuration: Assign a unified value to devices in the same area, such as "All devices deployed at the workstations on the production line are marked as level 2 by default", and support batch import from Excel.

[0125] In step S1, by configuring role groups in the permission management system and mapping role groups to video levels, the applicable objects in the operation permission baseline are established.

[0126] For example, security administrators and core technical personnel are mapped to high-sensitivity video levels; workshop directors, quality inspectors, and maintenance engineers are mapped to high-sensitivity video levels; department managers, administrative staff, and all full-time employees are mapped to medium-sensitivity video levels; and all employees and visitors are mapped to low-sensitivity video levels.

[0127] Permitted operations, such as downloading, sharing, editing, deleting, removing watermarks when sharing externally, and batch exporting to external storage, should be implemented. Permission verification logic should be added to the API layer of the video surveillance system. For example, when calling the downloadVideo() interface, the system should first check whether the user role has the right to download videos of the corresponding level. If the user does not have permission, a 403 error should be returned, and the data export range should be limited.

[0128] For operations that allow downloading / exporting, limit the scope and amount of content to prevent large-scale leaks:

[0129] For example, the time range: Level 1 videos can be exported in a single batch of up to 1 hour of footage, while Level 2 videos can be exported in a single batch of up to 8 hours.

[0130] Quantity limit: A single character can download a maximum of 5 Level 2 video files and 20 Level 3 video files per day;

[0131] Content anonymization: When exporting Level 2-3 videos containing personnel, this feature will automatically disable and requires high-level approval.

[0132] Implementation: Embed a range verification module in the export function. If the user selects to export a Level 1 video that exceeds 1 hour, the system will automatically truncate it and prompt "Exceeded maximum export duration".

[0133] Before the grading results are marked and stored, the grading results are embedded as metadata fields in the video file and bound to the video metadata to support fast retrieval.

[0134] When a change is marked, the level before and after the change, as well as the reason for the change, are automatically recorded. For example, if AI detects an operation of a core device, the level is changed from level 2 to level 1, thus enabling traceability.

[0135] In step S3, when constructing a multi-dimensional behavioral feature model, it is necessary to integrate the permission baseline and historical operation data to ensure the integrity and accuracy of the input data; extract key information from the permission matrix to form structured data. Key information includes role, accessible video level, allowed operation type, maximum daily download volume, maximum duration of a single download, and allowed operation time period.

[0136] Filter all operation logs from the past 6 months, aggregate them by user-role-operation dimension to form user behavior sequences;

[0137] Based on integrated data, a personalized baseline and a cumulative effect baseline are constructed for each role to form a multi-dimensional reference standard. The multi-dimensional reference standard is compared with the permission baseline to calculate the anomaly score and output the risk level.

[0138] Personalized operational baseline, which is the standard of routine behavior for users or roles;

[0139] This includes operation frequency: the number of times a user operates on videos at each level per day or week, such as "emp00123 views level 2 videos an average of 3 times per day";

[0140] Operation time period: The time distribution of user operations, such as 80% of operations concentrated between 9:00 and 11:00;

[0141] Operation duration: Average duration of a single view / download;

[0142] Operation object preference: frequently accessed video level / area, such as 90% of operations are concentrated in the level 2 video of workshop A;

[0143] For historical user operation data, the average value ±3σ is taken as the normal fluctuation range according to the above dimensions. For example, an average of 3 ± 1 operations per day is normal. If the value exceeds the range, it is marked as abnormal.

[0144] The cumulative effect baseline is the total control standard for long-term operations.

[0145] Mainly includes:

[0146] Cumulative amount over a period: The total number of operations performed by a user on the same level of video within a preset period;

[0147] Trend growth rate: The month-on-month change in the amount of operations between adjacent periods;

[0148] Sensitive object accumulation: The cumulative number of operations performed on high-value videos, such as Level 1 videos and videos of specific areas.

[0149] For each real-time operation log, four types of features are extracted for model input: features include the multiple of operation frequency deviation from the personalized baseline, the degree of deviation during operation time, the operation object, and whether the operation was performed on a new device. The total anomaly score is calculated as Σ(feature value × weight), and the weights are determined through training with historical anomaly cases.

[0150] An abnormal score of 0-30 indicates normal operation.

[0151] 31-60 points: Low-risk abnormality, such as slight deviation from the individualized baseline;

[0152] 61-80 points: Medium-risk abnormality, such as cumulative score approaching the threshold;

[0153] 81-100 points: High-risk anomaly, such as cumulative threshold exceeding + operation of new equipment + non-working hours;

[0154] A pre-set veto rule will directly classify it as a high-risk anomaly:

[0155] The operation type exceeds the permission baseline, such as attempting to download without Level 1 video access permissions;

[0156] If a series of operations fail within a short period of time, such as five download rejections within 10 minutes, it may be an attempt to gain access.

[0157] The object of the operation is completely unrelated to the role, such as administrative staff frequently accessing the production line's Level 2 video;

[0158] In step S4, when verifying whether the operation conforms to the permission baseline defined in S1, the check items include:

[0159] Does the operator have the authority to access this level of video?

[0160] Is the operation type within the allowed range?

[0161] Whether the operation occurred within the permitted time period;

[0162] If any of the above checks fails, it will be marked as an access violation.

[0163] When performing personalized baseline comparison, the inspection items include operation frequency, operation time period and operation object, and the deviation score is calculated based on the inspection items.

[0164] Operation frequency: Whether a single operation exceeds the fluctuation range of the user's average daily number of operations, such as a baseline of 3 ± 1 times, and the current operation being the 5th time;

[0165] Operation time period: Does the operation time deviate from the user's usual operation time? For example, if 90% of the user's operations are during the day, and the current time is 2:00 AM;

[0166] Operation target: Whether to access videos in non-habitual areas, such as a user who usually visits workshop A, but is currently accessing workshop B;

[0167] When comparing the cumulative effect baseline, the check items include the cumulative amount of the period, the trend growth rate, and the cumulative amount of sensitive operations. When the cumulative amount reaches 80% of the threshold, a cumulative warning is marked, and when it exceeds the threshold, an abnormal cumulative limit is marked.

[0168] Cumulative downloads over a 30-day period: Whether the cumulative number of downloads is close to or exceeds the threshold;

[0169] Trend growth rate: Whether this week's trading volume exceeds the growth rate threshold compared to last week;

[0170] Accumulated Sensitive Operations: Whether the number of times Level 1 videos have been viewed exceeds the security threshold.

[0171] In step S5, the total anomaly score is calculated according to the preset weight, and the warning level is divided according to the total score. When the warning conditions are met, the system automatically generates a warning event and pushes it to the real-time monitoring screen for the security administrator to view.

[0172] Total score = Permission violation × 0.4 + Personalization deviation × 0.3 + Cumulative effect × 0.3, with adjustable weights. Permission violation is directly scored as 100 points, while other dimensions are converted to scores of 0-100.

[0173] Low-risk warning: 31-50 points;

[0174] Medium-risk warning: 51-80 points;

[0175] High-risk warning: 81-100 points. If there is a violation of permissions and operation from a different IP address, the special scenario rules will result in a veto.

[0176] The veto rule directly triggers a high-risk warning, including the following actions:

[0177] Try deleting level 1-2 video logs or operation records;

[0178] Five or more violations of access permissions within a short period of time;

[0179] Download videos of level 2 or higher in batches outside of working hours.

[0180] Based on the above-described engineering video surveillance security management method, the present invention also provides an engineering video surveillance security management system, including a storage module responsible for storing video data, operation logs and permission rule data; including video storage: storing real-time monitoring video streams and historical recording files of the engineering site, and storing them in partitions according to the hierarchical system in S1;

[0181] It also includes the storage of rules and baseline databases: storing permission baselines in S1, such as role-operation permission mapping tables, and behavioral feature model parameters in S3, including personalized baseline thresholds and cumulative effect indicators;

[0182] The log blockchain storage module adopts a blockchain architecture, which generates immutable blocks from the operation logs collected in S2, including the operator, time, and object. Each block contains the hash value of the previous block, ensuring that log tampering can be detected immediately, which will not be elaborated further.

[0183] The data acquisition module is used to collect video surveillance operation data.

[0184] This includes collecting video stream metadata, extracting video stream metadata in real time, such as shooting time, device ID, and tags of the areas involved in the scene, and associating it with operation logs, such as marking that the operator downloaded the recording of device ID=CAM-001.

[0185] Data cleaning and standardization module: Standardizes the format of the collected raw logs, such as converting timestamps from different clients to UTC standard time.

[0186] The multi-dimensional anomaly detection module, based on standardized data from the acquisition layer, performs real-time analysis through a constructed multi-dimensional behavioral feature model to identify hidden malicious operations.

[0187] The storage module, the acquisition module, and the multi-dimensional anomaly detection module are all electrically connected.

[0188] The multi-dimensional anomaly detection module includes a baseline calculation unit, which generates a personalized operation baseline for each user or role. The personalized operation baseline generation algorithm is based on statistical time-series analysis, which performs statistical analysis on the user's historical operation logs according to three dimensions: operation type, time period, and object sensitivity level.

[0189] Calculate the mean (μ), standard deviation (σ), and quantiles for each dimension to generate the baseline range: [μ-3σ, μ+3σ]; the cumulative effect baseline calculation is based on the cumulative statistics of the sliding time window to calculate the total number of user operations within four time windows: 1 hour, 24 hours, 7 days, and 30 days.

[0190] The multi-dimensional comparison unit receives standardized operation logs in real time and compares them with baselines and thresholds in the rule base. The multi-dimensional comparison unit uses the Rete algorithm to build a rule inference engine, transforming baselines and thresholds into executable comparison rules.

[0191] Fact base: Stores standardized operation logs received in real time, including user ID, operation type, time, etc.

[0192] Rule base: contains permission matching rules, such as "role C cannot access level 1 video", baseline matching rules, such as "number of operations > μ + 3σ", and time sequence rules, such as "operations > 10 times within 5 consecutive minutes"; after the logs are entered, the engine automatically matches the conditions in the rule base and triggers the corresponding rules;

[0193] The system also includes an anomaly scoring unit, which scores the risk of operations that trigger the comparison rules and determines the risk level based on the total score, generating corresponding warnings. The anomaly scoring unit uses a weighted summation algorithm to calculate the total risk score and assign weights to anomalies in different dimensions.

[0194] The baseline calculation unit, multi-dimensional comparison unit, and anomaly scoring unit are all electrically connected. At the hardware level, a heterogeneous computing architecture of CPU, GPU, and FPGA is used to balance the requirements of large-scale parallel computing and real-time response. At the algorithm level, statistical analysis, rule engine, and machine learning are combined to ensure the accuracy of the baseline and identify unknown anomaly patterns.

[0195] The main functions of this invention are:

[0196] 1. This invention uses a sensitivity classification system, combined with manual presets and AI dynamic labeling, to distinguish videos of different risk levels; and then matches it with role permission baselines to restrict operations from the source of access, preventing low-privilege users from accessing highly sensitive videos without authorization, which can effectively reduce the risk of important data leakage.

[0197] 2. This invention constructs a multi-dimensional model of personalization and cumulative effects, which can not only identify obvious violations such as unauthorized access, but also provide early warnings of small and frequent covert operations, thus solving the problems of lagging detection and frequent false judgments in traditional fixed threshold detection and reducing security vulnerabilities.

[0198] In summary, after reading this invention document, those skilled in the art can make various other corresponding modifications to the technical solutions and concepts based on this invention without creative mental effort, and all of these modifications fall within the scope of protection of this invention.

Claims

1. A method for security management of engineering video surveillance, characterized in that, Includes the following steps: S1. Construct a hierarchical system for engineering video surveillance data and configure the baseline for operation permissions for each level of data; S2. Real-time acquisition of operation logs from the engineering video monitoring system and storage in the blockchain; S3. Based on the baseline of operation permissions and historical operation data, construct a multi-dimensional behavioral feature model; S4. Compare the collected operation logs with the multi-dimensional behavioral feature model, identify abnormal operation behaviors according to the abnormal warning rules, and generate abnormal warnings; S5. Execute a tiered response to the generated anomaly warnings.

2. The engineering video surveillance security management method according to claim 1, characterized in that, Step S1 also includes establishing data sensitivity level standards and performing multi-level classification labeling, specifically as follows: Videos involving classified areas or critical operations are marked as Level 1 Sensitive. Videos involving personnel operations or critical production processes will be marked as Level 2 Sensitive. Videos involving public areas but requiring privacy protection will be labeled as Level 3 Sensitive. Videos from open areas containing no sensitive information are marked as Level 4 Sensitivity.

3. The engineering video surveillance security management method according to claim 2, characterized in that, In step S1, when classifying and labeling video surveillance data at multiple levels, a preset rule is used for basic labeling, and AI recognition is combined for dynamic labeling to generate and store the hierarchical labeling results. Basic tags include device region mapping tags and batch rule configuration tags; When performing dynamic tagging, if facial features of people or operation of core equipment are detected, the sensitivity level of the video is automatically increased. If no people or core equipment are detected in the video feed, the sensitivity level of the video will be automatically reduced.

4. The engineering video surveillance security management method according to claim 3, characterized in that, Before storing the grading results in step S1, the grading results are embedded as metadata fields in the video file and bound to the video metadata. When the classification result is marked as changed, the classification before and after the change, as well as the reason for the change, are automatically recorded.

5. The engineering video surveillance security management method according to claim 1, characterized in that, The construction of the multi-dimensional behavioral feature model in step S3 is specifically as follows: Filter all operation logs within a set period, aggregate them by user-role-operation dimension to form a user behavior sequence; Establish personalized baselines and cumulative effect baselines for each role to form multi-dimensional reference standards; The personalized baseline is constructed based on the historical operation data of the corresponding user or role and is used to characterize their regular operation behavior patterns. The cumulative effect baseline is constructed based on a threshold of the total number of operations within a preset period and is used to detect the cumulative effect of the number of operations.

6. The engineering video surveillance security management method according to claim 5, characterized in that, In step S4, the comparison includes: Permission baseline comparison: Determine whether the real-time operation violates the operation permission baseline defined in step S1; Personalized baseline comparison: Determine the degree of deviation between real-time operations and the personalized baseline of the corresponding user or role; Cumulative effect baseline comparison: Determine whether the real-time operation causes the total number of operations within the period to exceed the threshold of the cumulative effect baseline.

7. The engineering video surveillance security management method according to claim 6, characterized in that, When comparing the permission baseline, the checks include one or more of the following: Does the operator have the necessary permissions to access the target video's sensitivity level? Is the operation type permitted? Is the operation time within the permitted time period? If any of the above checks fails, it will be marked as an access violation. When performing personalized baseline comparison, the inspection items include operation frequency, operation time period and operation object, and the deviation score is calculated based on the inspection items. When comparing the cumulative effect baseline, the check items include the cumulative amount of the period, the trend growth rate, and the cumulative amount of sensitive operations. When the cumulative amount reaches the threshold, a cumulative warning is marked, and when it exceeds the threshold, an abnormal cumulative limit is marked.

8. The engineering video surveillance security management method according to claim 1, characterized in that, Step S5 includes conducting a risk assessment on the identified abnormal operational behaviors and generating tiered early warning information, specifically: Weights are assigned to abnormal access control, deviation from personalized baseline, and abnormal cumulative effect, respectively. The total abnormality score is calculated, and the warning level is determined based on the total abnormality score. When the warning conditions are met, the system automatically generates a warning event and pushes it to the real-time monitoring screen simultaneously.

9. An engineering video surveillance security management system, characterized in that, include: The storage module is used to store video data, operation permission baselines, behavioral feature model parameters, and operation logs stored on the blockchain. The data acquisition module is used to collect operational behavior data of the video surveillance system in real time. The multi-dimensional anomaly detection module is used to perform real-time analysis of the collected operational behavior data based on the behavioral feature model in order to identify abnormal operations.

10. The engineering video surveillance security management system according to claim 9, characterized in that, The multi-dimensional anomaly detection module includes: The baseline calculation unit is used to generate personalized operational baselines and cumulative effect baselines for each user or role. The multi-dimensional comparison unit is used to compare real-time operations with the operation permission baseline, personalized operation baseline, and cumulative effect baseline respectively. The anomaly scoring unit is used to score the risk of operations that trigger the comparison rules, determine the risk level based on the total anomaly score, and generate corresponding warnings.

Images