A security information management method and system based on big data analysis

Abstract

This invention discloses a security information management method and system based on big data analysis, comprising the following steps: Step 1: Constructing an original security image dataset of the target security scene; Step 2: Performing image preprocessing to generate a standard security image dataset; Step 3: Performing frame-level target recognition on the standard security image dataset through an improved RT-DETR network to obtain a frame-level security target information set; Step 4: Performing cross-frame correlation analysis based on the frame-level security target information set; Step 5: Statistically analyzing temporal behavioral features to generate a target behavior trajectory information set; Step 6: Performing anomaly detection and risk assessment, and outputting anomaly warning information; Step 7: Writing the frame-level security target information set, the target behavior trajectory information set, and the anomaly warning information into a security information management database. This invention improves the intelligence of security information management through an improved RT-DETR network.

Description

Technical Field

[0001] This invention relates to the field of security information management and big data analysis technology, and in particular to a security information management method and system based on big data analysis. Background Technology

[0002] With the increasing demands for urban intelligent security systems and public safety management, multi-source image data analysis technology for target behavior monitoring and risk identification in security scenarios has received widespread attention. Existing security monitoring systems mainly rely on traditional video analysis methods or image processing techniques based on single-frame target detection for abnormal behavior identification, but these methods generally suffer from the following problems in practical applications: The acquired security image frame sequences suffer from uneven brightness, low contrast, and severe noise interference under different lighting conditions, making it difficult to accurately extract the boundary and appearance features of key targets, thus affecting the accuracy and stability of target recognition. Furthermore, the inconsistent resolution, frame rate, and acquisition time of image data acquired by different devices make it difficult for existing alignment and fusion methods to achieve accurate synchronization of multiple devices and multiple frames, leading to deviations in cross-frame correlation analysis and behavior trajectory construction. For multi-target and multi-scale targets in complex scenes, traditional convolutional neural networks and classic detection methods exhibit significant performance degradation in small target recognition, scale transformation adaptability, and target occlusion, severely impacting real-time judgment and risk assessment of abnormal behavior. Existing methods lack an effective modeling mechanism between frame-level target detection results and cross-frame target trajectory correlation, making it difficult to fully utilize historical target information for uncertainty correction and behavior prediction, resulting in insufficient timeliness and accuracy of high-risk behavior warnings.

[0003] Therefore, how to provide a security information management method and system based on big data analysis is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] One objective of this invention is to propose a security information management method and system based on big data analysis. This invention fully utilizes deep convolutional feature extraction and frame-level target decoding technologies, and details how to generate frame-level target information from standard security image frames, construct target trajectory sets, and conduct behavioral risk assessments using an improved RT-DETR network. It possesses advantages such as high target recognition accuracy, accurate cross-frame behavior analysis, timely anomaly warning, and reliable multi-device data fusion.

[0005] A security information management method based on big data analysis according to an embodiment of the present invention includes the following steps: Step 1: Obtain the security image frame sequence of the target security scene and construct the original security image dataset; Step 2: Perform image preprocessing on the original security image dataset to generate a standard security image dataset; Step 3: Input the standard security image dataset into the improved RT-DETR network to perform frame-level target recognition and obtain a frame-level security target information set. The improved RT-DETR network includes a dual-branch backbone feature extraction module, an intra-scale feature interaction module, a cross-scale fusion module, a query selection module, a decoupled target decoding module, and a prediction output module. The improved RT-DETR network introduces a bright and dark field dual-branch feature structure in the dual-branch backbone feature extraction module and introduces a region prior guidance mechanism in the intra-scale feature interaction module. Step 4: Based on the frame-level security target information set, perform cross-frame correlation analysis to generate a target trajectory set; Step 5: Based on the target trajectory set, statistically analyze the temporal behavior characteristics to generate a target behavior trajectory information set; Step 6: Perform anomaly detection and risk assessment on the target behavior trajectory information set, calculate the target risk score and determine the risk level label. When the target behavior trajectory information is determined to be high risk, output an anomaly warning message. Step 7: Write the frame-level security target information set, target behavior trajectory information set, and abnormal warning information into the security information management database.

[0006] Optionally, step one specifically includes: The system acquires raw image data from each security acquisition device in the target security scenario and organizes the raw image data into a security image frame sequence according to the acquisition time order. It assigns a frame identifier to each security image frame according to the acquisition time order and associates and encapsulates each security image frame with the frame identifier to construct the raw security image dataset.

[0007] Optionally, step two specifically includes: Each security image frame is normalized in size, and each security image frame is cropped according to the set image width and image height to obtain a normalized security image; The normalized security image is denoised by using Gaussian filtering to generate a denoised security image. The brightness distribution of the denoised security image is adjusted using the gamma correction method to generate a brightness-compensated security image. The brightness-compensated security image is enhanced by using the CLAHE algorithm to increase the grayscale difference between the target area and the background area, thus generating a contrast-enhanced security image. The pixel values ​​of each pixel in the contrast-enhanced security image are mapped to the [0, 1] interval using the min-max normalization method to generate a standard security image. Each standard security image frame is associated with and encapsulated with its corresponding frame identifier to obtain a standard security image dataset.

[0008] Optionally, step three specifically includes: The dual-branch backbone feature extraction module generates shallow backbone fusion feature maps, mid-branch backbone fusion feature maps, and deep backbone fusion feature maps for each frame of standard security image through a bright and dark field dual-branch feature structure. In the scale-based feature interaction module, based on the region prior guidance mechanism, region masking and feature enhancement are performed on the deep backbone fusion feature map to obtain the region-enhanced feature map. In the cross-scale fusion module, the shallow backbone fusion feature map, the mid-layer backbone fusion feature map, and the region enhancement feature map are mapped to the set channel dimension through 1×1 convolution. Based on the mid-layer backbone fusion feature map, the shallow backbone fusion feature map is downsampled and the region enhancement feature map is upsampled to obtain the shallow backbone alignment feature map and the region enhancement alignment feature map. The shallow backbone alignment feature map, the middle backbone fusion feature map, and the region enhancement alignment feature map are added element by element to obtain the scale fusion feature map; In the query selection module, the scale-fused feature map is flattened in the spatial dimension to obtain the scale-fused feature matrix; where each row of the scale-fused feature matrix represents a candidate feature vector; By setting a category mapping matrix, the scale-fused feature matrix is ​​linearly mapped and normalized through the category prediction mapping matrix and the Softmax function to obtain the candidate category probability matrix. Based on the candidate category probability matrix, the uncertainty score is obtained by calculating the category probability distribution corresponding to each candidate feature vector using the information entropy formula; the negative of the uncertainty score is then taken to obtain the candidate query score. The candidate query scores are sorted in descending order, and the candidate feature vectors with the highest scores are selected to form the target query matrix according to the set number of query targets. In the decoupled target decoding module, a query mapping matrix, a key mapping matrix, and a value mapping matrix are defined. The scale-fused feature map is flattened into a matrix in the spatial dimension, and the key feature matrix and value feature matrix are generated by mapping them through the key mapping matrix and value mapping matrix, respectively; the target query matrix is ​​mapped to generate the query feature matrix by mapping it through the query mapping matrix. Based on the query feature matrix, key feature matrix, and value feature matrix, several layers of decoding are performed through attention operations and a feedforward network to obtain the decoded feature matrix; In the prediction output module, the decoded feature matrix is ​​linearly mapped to generate target category label, target bounding box and target confidence for each query target, and then associated and encapsulated to generate frame-level security target information; By aggregating frame-level security target information from all standard security images, a frame-level security target information set is obtained.

[0009] Optionally, the dual-branch backbone feature extraction module generates a shallow backbone fusion feature map, a middle backbone fusion feature map, and a deep backbone fusion feature map for each frame of standard security image through a bright and dark field dual-branch feature structure, specifically including: The dual-branch backbone feature extraction module includes a bright field branch, a dark field branch, and a gated fusion unit; In the bright field branch, three levels of convolutional feature extraction are performed on each frame of standard security image to generate a shallow bright field feature map, a mid-level bright field feature map, and a deep bright field feature map, respectively. In the dark field branch, three levels of gradient-constrained convolutional feature extraction are performed on each frame of standard security image to generate shallow dark field feature maps, mid-dark field feature maps, and deep dark field feature maps, respectively. In the gated fusion unit, based on each frame of standard security image, the frame-level brightness statistical vector and the local contrast statistical vector are calculated, and the frame-level brightness statistical vector and the local contrast statistical vector are feature-concatenated to obtain the statistical feature vector. The statistical feature vectors are used to generate gated weight vectors through a multilayer perceptron and a sigmoid function. The gated weight vectors are divided into shallow gated weight vectors, medium gated weight vectors and deep gated weight vectors according to the scale, and are respectively expanded to the same spatial size and channel dimension as the feature map at the corresponding scale. Based on shallow, medium, and deep gating weight vectors, the bright field shallow feature map, bright field medium feature map, and bright field deep feature map are gated and fused with the dark field shallow feature map, dark field medium feature map, and dark field deep feature map, respectively, to obtain shallow backbone fused feature map, medium backbone fused feature map, and deep backbone fused feature map.

[0010] Optionally, the intra-scale feature interaction module, based on a region prior guidance mechanism, performs region masking and feature enhancement on the deep backbone fusion feature map to obtain a region-enhanced feature map, specifically including: The shallow backbone fusion feature map and the middle backbone fusion feature map are respectively mapped to the set channel dimension through 3×3 convolution to obtain the shallow intermediate feature map and the middle intermediate feature map. Using the intermediate feature map of the middle layer as a reference, the shallow intermediate feature map is downsampled and mapped to obtain the shallow aligned feature map; The shallow aligned feature map and the middle intermediate feature map are concatenated by channels, and feature fusion, feature compression and feature normalization are performed by two layers of 1×1 convolution and the Sigmoid function to obtain the region response probability map. Set a region response threshold and perform mask filtering on the region response probability map to obtain a region prior mask map: if the response probability value of a pixel in the region response probability map is greater than or equal to the region response threshold, then set the response probability value of the current pixel to 1; otherwise, set it to 0. The deep backbone fusion feature map is flattened into a feature sequence in the spatial dimension to obtain the deep backbone fusion feature matrix; the region prior mask map is flattened into a vector to obtain the region prior mask vector. Based on the region prior mask vector, determine the mask vector index where the region prior mask value is equal to 1; filter the feature vectors of the deep backbone fusion feature matrix according to the mask vector index to obtain the feature matrix of key regions, and use the unfiltered feature vectors as the background feature matrix. Attention operations are performed on the feature matrix of the key region to obtain the enhanced feature matrix of the key region, and a 3×3 convolution is performed on the background feature matrix to obtain the background compensation feature matrix. The key region enhancement feature matrix and the background compensation feature matrix are rearranged according to their original spatial dimensions to reconstruct a region enhancement feature map.

[0011] Optionally, step four specifically includes: Based on the target bounding box, the target image region is cropped from the corresponding standard security image, and the target image region is extracted to generate the target appearance feature vector through a lightweight convolutional neural network; Set the currently established set of target trajectories, and read the end status information of each target trajectory. The end status information includes the end frame number, end target category label, end center point coordinates, and end appearance feature vector; each target trajectory corresponds to a target trajectory identifier. The frame-level security target information of each standard security image frame is compared with each target trajectory in the target trajectory set to perform cross-frame correlation analysis, and a cross-frame correlation score is obtained, specifically: If the target category label is consistent with the target category label at the end of the target trajectory, then set the category consistency label to 1; otherwise, set the category consistency label to 0. Calculate the Euclidean distance between the coordinates of the target center point and the coordinates of the end point center point to obtain the spatial proximity distance; Calculate the inner product of the target appearance feature vector and the end appearance feature vector to obtain the appearance feature similarity. Calculate the time difference between the frame identifier of the current standard security image and the frame number at the end of the trajectory to obtain the inter-frame time interval; map the inter-frame time interval to a time continuity coefficient through a negative exponential function; A cross-frame association score is constructed based on category consistency labels, spatial proximity distance, appearance feature similarity, and temporal continuity coefficient; Set an association score threshold. If the cross-frame association score is greater than or equal to the association score threshold, then associate the frame-level security target information with the corresponding target trajectory. If neither the frame-level security target information nor any target trajectory in the target trajectory set meets the association scoring threshold condition, then a new target trajectory is created using the current frame-level security target information, and the current frame-level security target information is used as the initial state of the new target trajectory and written into the target trajectory set.

[0012] Optionally, step five specifically includes: Read each target trajectory and its corresponding target category label from the target trajectory set. Each target trajectory is formed by associating multiple frame-level security target information in chronological order. Calculate the target dwell time for each target trajectory based on the start frame identifier and end frame identifier of each target trajectory; For each target trajectory, the L2 norm of the difference between the coordinates of the target center point of adjacent frame-level security target information is calculated to obtain the target displacement distance; based on the target displacement distance, the average moving speed of the current target trajectory is calculated. A set of monitoring areas is pre-defined. For each target trajectory, it is determined whether the coordinates of the target center point of each frame-level security target information are located within the monitoring area. If the target center point coordinates move from outside the monitoring area to the monitoring area, an area entry event is recorded. If the target center point coordinates move from outside the monitoring area to outside the monitoring area, an area exit event is recorded. Based on area entry and area exit events, count the number of area entry and area exit events for each target trajectory in each monitored area; The target trajectory identifier, target category label, target dwell time, average movement speed, number of times entering the area and number of times leaving the area are associated and encapsulated to generate target behavior trajectory information. The target behavior trajectory information corresponding to all target trajectories is then summarized to obtain a target behavior trajectory information set.

[0013] Optionally, step six specifically includes: Set the dwell time weight coefficient, speed weight coefficient, entry weight coefficient and exit weight coefficient, and perform minimum-maximum normalization on the target dwell time, average movement speed, number of times entering the area and number of times leaving the area, and then perform weighted fusion to obtain the target risk score; Set low-risk, medium-risk, and high-risk thresholds, and determine the risk level of the target behavior trajectory information based on the target risk score; If the target's behavioral trajectory information is determined to be high-risk, an abnormal warning event is triggered, and abnormal warning information is pushed to the security monitoring terminal. The abnormal warning information includes the target trajectory identifier, target category label, target risk score, and risk level label.

[0014] A security information management system based on big data analysis according to an embodiment of the present invention includes: The data acquisition module is used to acquire the security image frame sequence of the target security scene and construct the original security image dataset; The image preprocessing module is used to preprocess the original security image dataset to generate a standard security image dataset. The target recognition module is used to input standard security image datasets into the improved RT-DETR network, perform frame-level target recognition, and obtain frame-level security target information sets; The cross-frame correlation analysis module is used to perform cross-frame correlation analysis based on the frame-level security target information set and generate a target trajectory set; The behavior analysis module is used to statistically analyze time-series behavior characteristics based on the target trajectory set and generate a target behavior trajectory information set; The risk assessment module is used to determine anomalies and assess risks in the target behavior trajectory information set, and output anomaly warning information; The information storage module is used to write frame-level security target information sets, target behavior trajectory information sets, and abnormal early warning information into the security information management database.

[0015] The beneficial effects of this invention are: This invention introduces an improved RT-DETR network in the target recognition stage and designs a dual-branch feature structure for bright and dark fields in the backbone feature extraction structure. A gated fusion mechanism adaptively fuses bright and dark field features based on scene brightness and local contrast, thereby enhancing the target feature representation capability under complex lighting conditions. Simultaneously, a region prior guidance mechanism is introduced into the intra-scale feature interaction module. Through region response probability maps and mask filtering, key region feature enhancement and background compensation are achieved, enabling the improved RT-DETR network to more effectively focus on potential security target areas, reduce background interference, and improve detection accuracy. After target recognition, a cross-frame association score is constructed by combining target category consistency, spatial proximity, appearance feature similarity, and temporal continuity coefficients to achieve stable trajectory construction for multiple targets, avoiding trajectory drift and target loss problems caused by traditional single-feature association. Furthermore, based on the target trajectory set, statistical analysis of temporal behavioral features such as dwell time, movement speed, and area entry / exit behavior is performed. A weighted fusion calculation of the target risk score enables automatic judgment and risk level assessment of abnormal behavior, while simultaneously pushing real-time abnormal warning information to the monitoring terminal. Finally, frame-level security target information, target behavior trajectory information, and abnormal early warning information are uniformly written into the security information management database to form a traceable and analyzable security data resource system. This improves the target detection accuracy, behavior analysis capability, and risk early warning efficiency of the security system in complex monitoring environments, reduces the pressure of manual monitoring, and enhances the overall intelligence level and real-time response capability of security management. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of a security information management method and system based on big data analysis proposed in this invention; Figure 2 This invention presents a security information management method based on big data analysis and a flowchart of an improved RT-DETR network structure in the system. Figure 3 This invention presents a security information management method based on big data analysis and a flowchart of cross-frame correlation analysis in the system. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figures 1-3A security information management method based on big data analysis includes the following steps: Step 1: Obtain the security image frame sequence of the target security scene and construct the original security image dataset; Step 2: Perform image preprocessing on the original security image dataset to generate a standard security image dataset; Step 3: Input the standard security image dataset into the improved RT-DETR network to perform frame-level target recognition and obtain a frame-level security target information set. The improved RT-DETR network includes a dual-branch backbone feature extraction module, an intra-scale feature interaction module, a cross-scale fusion module, a query selection module, a decoupled target decoding module, and a prediction output module. The improved RT-DETR network introduces a bright and dark field dual-branch feature structure in the dual-branch backbone feature extraction module and introduces a region prior guidance mechanism in the intra-scale feature interaction module. Step 4: Based on the frame-level security target information set, perform cross-frame correlation analysis to generate a target trajectory set; Step 5: Based on the target trajectory set, statistically analyze the temporal behavior characteristics to generate a target behavior trajectory information set; Step 6: Perform anomaly detection and risk assessment on the target behavior trajectory information set, calculate the target risk score and determine the risk level label. When the target behavior trajectory information is determined to be high risk, output an anomaly warning message. Step 7: Write the frame-level security target information set, target behavior trajectory information set, and abnormal warning information into the security information management database.

[0019] In this embodiment, step one specifically includes: The system acquires raw image data from each security acquisition device in the target security scenario and organizes the raw image data into a security image frame sequence according to the acquisition time order. It assigns a frame identifier to each security image frame according to the acquisition time order and associates and encapsulates each security image frame with the frame identifier to construct the raw security image dataset.

[0020] In this embodiment, step two specifically includes: Each security image frame is normalized in size, and each security image frame is cropped according to the set image width and image height to obtain a normalized security image; The normalized security image is denoised by using Gaussian filtering to generate a denoised security image. The brightness distribution of a denoised security image is adjusted using gamma correction to generate a brightness-compensated security image. Specifically, the original pixel value of each pixel in the denoised security image is normalized according to the maximum pixel value to obtain a normalized brightness value; a gamma correction coefficient is set, and an exponential mapping operation is performed on the normalized brightness value to obtain a corrected brightness value; the corrected brightness value is multiplied by the maximum pixel value to obtain a brightness-compensated pixel value; and the brightness-compensated pixel values ​​of all pixels are combined to form a brightness-compensated security image. The brightness-compensated security image is enhanced by using the CLAHE algorithm to increase the grayscale difference between the target area and the background area, generating a contrast-enhanced security image. Specifically: Divide the brightness-compensated security image into several sub-image blocks; calculate the gray-level histogram of each sub-image block; Set a contrast limit threshold and crop the grayscale histogram to obtain a cropped histogram: if the number of pixels corresponding to a certain grayscale level in the grayscale histogram is greater than the contrast limit threshold, then set the number of pixels corresponding to that grayscale level to be equal to the contrast limit threshold. Calculate the cumulative distribution function of the cropping histogram, and perform a mapping transformation on the pixel gray values ​​of each sub-image block according to the cumulative distribution function to obtain the updated gray values; All updated grayscale values ​​of each sub-image block are blended at the boundary using bilinear interpolation to generate a contrast-enhanced security image. The pixel values ​​of each pixel in the contrast-enhanced security image are mapped to the [0, 1] interval using the min-max normalization method to generate a standard security image. Each standard security image frame is associated with and encapsulated with its corresponding frame identifier to obtain a standard security image dataset.

[0021] In this embodiment, step three specifically includes: The dual-branch backbone feature extraction module generates shallow backbone fusion feature maps, mid-layer backbone fusion feature maps, and deep backbone fusion feature maps for each frame of standard security images through a bright and dark field dual-branch feature structure. In the scale-based feature interaction module, based on the region prior guidance mechanism, region masking and feature enhancement are performed on the deep backbone fusion feature map to obtain the region-enhanced feature map. In the cross-scale fusion module, the shallow backbone fusion feature map, the mid-layer backbone fusion feature map, and the region enhancement feature map are mapped to the set channel dimension through 1×1 convolution. Based on the mid-layer backbone fusion feature map, the shallow backbone fusion feature map is downsampled and the region enhancement feature map is upsampled to obtain the shallow backbone alignment feature map and the region enhancement alignment feature map. The shallow backbone alignment feature map, the middle backbone fusion feature map, and the region enhancement alignment feature map are added element by element to obtain the scale fusion feature map; In the query selection module, the scale-fused feature map is flattened in the spatial dimension to obtain the scale-fused feature matrix; where each row of the scale-fused feature matrix represents a candidate feature vector; By setting a category mapping matrix, the scale-fused feature matrix is ​​linearly mapped and normalized through the category prediction mapping matrix and the Softmax function to obtain the candidate category probability matrix. In this matrix, each row of the candidate category probability matrix represents the category probability distribution of the candidate feature vector in the corresponding row; Based on the candidate category probability matrix, the uncertainty score is obtained by calculating the category probability distribution corresponding to each candidate feature vector using the information entropy formula; the negative of the uncertainty score is then taken to obtain the candidate query score. The candidate query scores are sorted in descending order, and the candidate feature vectors with the highest scores are selected to form the target query matrix according to the set number of query targets. In the decoupled target decoding module, a query mapping matrix, a key mapping matrix, and a value mapping matrix are defined. The scale-fused feature map is flattened into a matrix in the spatial dimension, and the key feature matrix and value feature matrix are generated by mapping them through the key mapping matrix and value mapping matrix, respectively; the target query matrix is ​​mapped to generate the query feature matrix by mapping it through the query mapping matrix. Based on the query feature matrix, key feature matrix, and value feature matrix, several layers of decoding are performed through attention operations and a feedforward network to obtain the decoded feature matrix; In the prediction output module, the decoded feature matrix is ​​linearly mapped to generate target category labels, target bounding boxes, and target confidence scores for each query target. These are then associated and encapsulated to generate frame-level security target information, specifically: Define the target category weight matrix, the bounding box regression weight matrix, and the confidence prediction weight matrix; The decoded feature matrix is ​​linearly mapped and normalized using the target class weight matrix and the Softmax function to generate the target class prediction matrix; The category index corresponding to the maximum value in each row vector of the target category prediction matrix is ​​selected as the target category label for each query target; The decoded feature matrix is ​​linearly mapped through the bounding box regression weight matrix to generate the target bounding box prediction matrix. The target bounding box prediction matrix represents the x-coordinate of the center point, y-coordinate of the center point, the width of the bounding box, and the height of the bounding box corresponding to each query target. The x-coordinate and y-coordinate of the center point together form the target center point coordinates. The decoded feature matrix is ​​linearly mapped through the confidence prediction weight matrix and then normalized using the Sigmoid function to obtain the target confidence for each query target. By aggregating frame-level security target information from all standard security images, a frame-level security target information set is obtained.

[0022] In this embodiment, the dual-branch backbone feature extraction module generates shallow backbone fusion feature maps, mid-layer backbone fusion feature maps, and deep backbone fusion feature maps for each frame of standard security image through a bright and dark field dual-branch feature structure, specifically including: The dual-branch backbone feature extraction module includes a bright-field branch, a dark-field branch, and a gated fusion unit; In the bright field branch, three levels of convolutional feature extraction are performed on each frame of standard security image to generate a shallow bright field feature map, a mid-level bright field feature map, and a deep bright field feature map, respectively. The structure of each level of convolutional feature extraction is as follows: a standard convolution with a kernel size of 3×3, a depthwise separable convolution with a kernel size of 3×3, and a pointwise convolution with a kernel size of 1×1. In the dark field branch, three levels of gradient-constrained convolutional feature extraction are performed on each frame of standard security image to generate shallow dark field feature maps, mid-dark field feature maps, and deep dark field feature maps, respectively. The specific process of gradient-constrained convolutional feature extraction at each level is as follows: the input feature map is processed by a standard convolution with a kernel size of 3×3 to generate an intermediate convolutional feature map; the intermediate convolutional feature map is then subjected to 3×3 convolution in both the horizontal and vertical directions to obtain a horizontal gradient response map and a vertical gradient response map, and a gradient magnitude map is calculated based on the horizontal and vertical gradient response maps; a gradient enhancement coefficient is set, and the intermediate convolutional feature map and the gradient magnitude map are weighted and fused to obtain the output feature map; In the gated fusion unit, based on each frame of standard security image, the frame-level brightness statistical vector and the local contrast statistical vector are calculated, and the frame-level brightness statistical vector and the local contrast statistical vector are feature-concatenated to obtain the statistical feature vector. The statistical feature vectors are used to generate gated weight vectors through a multilayer perceptron and a sigmoid function. The gated weight vectors are divided into shallow gated weight vectors, medium gated weight vectors and deep gated weight vectors according to the scale, and are respectively expanded to the same spatial size and channel dimension as the feature map at the corresponding scale. Based on shallow, medium, and deep gating weight vectors, the bright field shallow feature map, bright field medium feature map, and bright field deep feature map are gated and fused with the dark field shallow feature map, dark field medium feature map, and dark field deep feature map, respectively, to obtain shallow backbone fused feature map, medium backbone fused feature map, and deep backbone fused feature map.

[0023] In this embodiment, within the scale-based feature interaction module, based on a region prior guidance mechanism, region masking and feature enhancement are performed on the deep backbone fusion feature map to obtain a region-enhanced feature map. Specifically, this includes: The shallow backbone fusion feature map and the middle backbone fusion feature map are respectively mapped to the set channel dimension through 3×3 convolution to obtain the shallow intermediate feature map and the middle intermediate feature map. Using the intermediate feature map of the middle layer as a reference, the shallow intermediate feature map is downsampled and mapped to obtain the shallow aligned feature map; The shallow aligned feature map and the middle intermediate feature map are concatenated by channels, and feature fusion, feature compression and feature normalization are performed by two layers of 1×1 convolution and the Sigmoid function to obtain the region response probability map. Set a region response threshold and perform mask filtering on the region response probability map to obtain a region prior mask map: if the response probability value of a pixel in the region response probability map is greater than or equal to the region response threshold, then set the response probability value of the current pixel to 1; otherwise, set it to 0. The deep backbone fusion feature map is flattened into a feature sequence in the spatial dimension to obtain the deep backbone fusion feature matrix; the region prior mask map is flattened into a vector to obtain the region prior mask vector. Based on the region prior mask vector, determine the mask vector index where the region prior mask value is equal to 1; filter the feature vectors of the deep backbone fusion feature matrix according to the mask vector index to obtain the feature matrix of key regions, and use the unfiltered feature vectors as the background feature matrix. Attention operations are performed on the feature matrix of the key region to obtain the enhanced feature matrix of the key region, and a 3×3 convolution is performed on the background feature matrix to obtain the background compensation feature matrix. The key region enhancement feature matrix and the background compensation feature matrix are rearranged according to their original spatial dimensions to reconstruct a region enhancement feature map.

[0024] In this invention, the improved RT-DETR network inherits the basic framework of the original RT-DETR network, which includes a backbone feature extraction module, a feature fusion module, a query selection module, a Transformer decoding module, and a prediction output module. In the original RT-DETR network, the backbone network first performs multi-layer convolutional feature extraction on the input image to obtain feature maps at different scales. Then, a feature fusion structure integrates shallow, mid-layer, and deep features to form fused features with rich semantic and spatial information. In the query selection stage, a candidate feature scoring mechanism selects several high-quality query vectors as target queries from the fused features. Next, in the Transformer decoding module, an attention mechanism between queries, keys, and values ​​is used to perform multi-layer decoding of the target query, extracting target-related information from global features. Finally, in the prediction output module, linear mapping is used to generate the target category, target bounding box, and target confidence, achieving end-to-end target detection. This structure retains the end-to-end detection advantages of DETR-like networks while improving real-time detection capabilities through an efficient query selection mechanism.

[0025] Based on the original RT-DETR structure, this invention makes targeted improvements to the backbone feature extraction module and feature interaction mechanism. First, a dual-branch feature structure (bright and dark fields) is introduced in the backbone feature extraction stage. By setting bright and dark fields to extract conventional semantic features and gradient enhancement features respectively, a gated fusion unit adaptively generates gate weights based on frame-level brightness statistics and local contrast statistics, achieving dynamic fusion of the two types of features to generate shallow, mid-level, and deep backbone fused feature maps. Second, a region prior guidance mechanism is introduced in the intra-scale feature interaction module. A region response probability map is generated by fusing shallow and mid-level features, and a region prior mask is generated based on a set threshold. This mask filters regions in the deep feature map, enhancing key region features through an attention mechanism, while compensating for background regions through convolution, thus forming a region-enhanced feature map. Subsequently, in the cross-scale fusion module, the shallow, mid-level, and region-enhanced features are scale-aligned and fused element-by-element to form a more effective scale-fused feature map, which then enters the query selection, decoupled target decoding, and prediction output modules to complete the target detection task.

[0026] Through the aforementioned structural improvements, the enhanced RT-DETR network significantly improves target detection performance in complex security scenarios. Specifically, the dual-branch feature structure for bright and dark fields extracts brightness features and gradient structure information for complex lighting conditions common in surveillance scenarios, such as strong light, weak light, and shadows. Adaptive fusion is achieved through a gating mechanism, thereby enhancing the model's feature representation ability for targets in low-light or high-contrast environments. The region prior guidance mechanism pre-screens potential target regions by generating region response probability maps, enabling the network to focus on areas where targets may exist during the feature interaction phase, while reducing the interference of background noise on feature learning. The combination of these two mechanisms maintains the real-time detection advantages of RT-DETR while improving target localization accuracy and detection stability, reducing false positive and false negative rates in complex scenarios. This results in higher detection accuracy and robustness for security monitoring systems in multi-target and complex environments.

[0027] In this embodiment, step four specifically includes: Based on the target bounding box, the target image region is cropped from the corresponding standard security image, and the target image region is extracted to generate the target appearance feature vector through a lightweight convolutional neural network; the lightweight convolutional neural network includes four 3×3 convolutional layers and one fully connected layer; Set the currently established set of target trajectories, and read the end status information of each target trajectory. The end status information includes the end frame number, end target category label, end center point coordinates, and end appearance feature vector; each target trajectory corresponds to a target trajectory identifier. The frame-level security target information of each standard security image frame is compared with each target trajectory in the target trajectory set to perform cross-frame correlation analysis, and a cross-frame correlation score is obtained, specifically: If the target category label is consistent with the target category label at the end of the target trajectory, then set the category consistency label to 1; otherwise, set the category consistency label to 0. Calculate the Euclidean distance between the coordinates of the target center point and the coordinates of the end point center point to obtain the spatial proximity distance; Calculate the inner product of the target appearance feature vector and the end appearance feature vector to obtain the appearance feature similarity. Calculate the time difference between the frame identifier of the current standard security image and the frame number at the end of the trajectory to obtain the inter-frame time interval; map the inter-frame time interval to a time continuity coefficient through a negative exponential function; A cross-frame association score is constructed based on category consistency labels, spatial proximity distance, appearance feature similarity, and temporal continuity coefficient. Specifically, distance weight coefficient, appearance weight coefficient, and temporal weight coefficient are set, where the distance weight coefficient is less than 0. Based on the distance weight coefficient, appearance weight coefficient, and temporal weight coefficient, the spatial proximity distance, appearance feature similarity, and temporal continuity coefficient are weighted and fused, and the weighted fusion result is multiplied by the category consistency label to obtain the cross-frame association score. Set an association score threshold. If the cross-frame association score is greater than or equal to the association score threshold, then associate the frame-level security target information with the corresponding target trajectory. If neither the frame-level security target information nor any target trajectory in the target trajectory set meets the association scoring threshold condition, then a new target trajectory is created using the current frame-level security target information, and the current frame-level security target information is used as the initial state of the new target trajectory and written into the target trajectory set.

[0028] In this embodiment, step five specifically includes: Read each target trajectory and its corresponding target category label from the target trajectory set. Each target trajectory is formed by associating multiple frame-level security target information in chronological order. Calculate the target dwell time for each target trajectory based on the start frame identifier and end frame identifier of each target trajectory; For each target trajectory, the L2 norm of the difference between the coordinates of the target center point of adjacent frame-level security target information is calculated to obtain the target displacement distance; based on the target displacement distance, the average moving speed of the current target trajectory is calculated. A set of monitoring areas is pre-defined. For each target trajectory, it is determined whether the coordinates of the target center point of each frame-level security target information are located within the monitoring area. If the target center point coordinates move from outside the monitoring area to the monitoring area, an area entry event is recorded. If the target center point coordinates move from outside the monitoring area to outside the monitoring area, an area exit event is recorded. Based on area entry and area exit events, count the number of area entry and area exit events for each target trajectory in each monitored area; The target trajectory identifier, target category label, target dwell time, average movement speed, number of times entering the area and number of times leaving the area are associated and encapsulated to generate target behavior trajectory information. The target behavior trajectory information corresponding to all target trajectories is then summarized to obtain a target behavior trajectory information set.

[0029] In this embodiment, step six specifically includes: Set the dwell time weight coefficient, speed weight coefficient, entry weight coefficient and exit weight coefficient, and perform minimum-maximum normalization on the target dwell time, average movement speed, number of times entering the area and number of times leaving the area, and then perform weighted fusion to obtain the target risk score; Set low-risk, medium-risk, and high-risk thresholds, and determine the risk level of the target's behavioral trajectory information based on the target risk score: When the target risk score is less than the low risk threshold, the risk level label is marked as no risk; when the target risk score is less than the medium risk threshold but greater than or equal to the low risk threshold, the risk level label is marked as low risk; when the target risk score is less than the high risk threshold but greater than or equal to the medium risk threshold, the risk level label is marked as medium risk; when the target risk score is greater than or equal to the high-medium risk threshold, the risk level label is marked as high risk. If the target's behavioral trajectory information is determined to be high-risk, an abnormal warning event is triggered, and abnormal warning information is pushed to the security monitoring terminal. The abnormal warning information includes the target trajectory identifier, target category label, target risk score, and risk level label.

[0030] A security information management system based on big data analytics includes: The data acquisition module is used to acquire the security image frame sequence of the target security scene and construct the original security image dataset; The image preprocessing module is used to preprocess the original security image dataset to generate a standard security image dataset. The target recognition module is used to input standard security image datasets into the improved RT-DETR network, perform frame-level target recognition, and obtain frame-level security target information sets; The cross-frame correlation analysis module is used to perform cross-frame correlation analysis based on the frame-level security target information set and generate a target trajectory set; The behavior analysis module is used to statistically analyze time-series behavior characteristics based on the target trajectory set and generate a target behavior trajectory information set; The risk assessment module is used to determine anomalies and assess risks in the target behavior trajectory information set, and output anomaly warning information; The information storage module is used to write frame-level security target information sets, target behavior trajectory information sets, and abnormal early warning information into the security information management database.

[0031] Example 1: To verify the feasibility of this invention in practice, the method of this invention was applied to an intelligent security monitoring system for a large urban integrated transportation hub. This transportation hub includes multiple areas such as a subway station, a bus transfer hall, and an underground commercial passage, with an average daily passenger flow of approximately 180,000 people, and a peak hourly passenger flow of up to 25,000 people. The monitoring system deployed a total of 120 security cameras, including 86 indoor cameras and 34 outdoor cameras, with a resolution of 1920×1080 and a frame rate of 25fps. Due to the dense population, frequent changes in lighting, and numerous and complex movements of targets in this scenario, traditional security monitoring systems are prone to problems such as missed detections, false detections, and trajectory loss in target detection, personnel trajectory correlation, and abnormal behavior identification. This results in a low accuracy rate for abnormal behavior identification, making it difficult to meet the real-time security management needs of large public places.

[0032] In implementation, the intelligent security monitoring system first collects video data in real time using cameras distributed across various monitoring areas. This data is then organized chronologically into a sequence of security image frames, and the image data is associated and encapsulated with frame identifiers to form a raw security image dataset. Image preprocessing is then used to generate a standard security image dataset. In the target recognition stage, the standard security image dataset is input into an improved RT-DETR network for frame-level target recognition, outputting a frame-level security target information set. After target recognition, the intelligent security monitoring system crops the target region from the image based on the target bounding box and extracts the target's appearance feature vector using a lightweight convolutional neural network. The system simultaneously maintains a set of target trajectories and performs cross-frame association analysis between the target identified in the current frame and existing trajectories. During the association process, factors such as target category consistency, spatial proximity, appearance feature similarity, and temporal continuity coefficient are comprehensively considered. A cross-frame association score is constructed to determine whether a target belongs to an existing trajectory. When the association score exceeds a set threshold, the current target information is added to the corresponding trajectory; otherwise, a new target trajectory is created. This method maintains trajectory continuity in multi-target scenarios, preventing trajectory loss due to personnel crossing or occlusion.

[0033] During the behavior analysis phase, the intelligent security monitoring system statistically analyzes behavioral characteristics such as the time a person stays in the same area, their movement speed, and the number of times they enter and exit the monitored area based on the target's trajectory. For example, in a subway security checkpoint area, if a person stays in the same area for a long time or frequently enters and exits the monitored area, the system will record the corresponding behavioral characteristic data. The system then normalizes these behavioral characteristics and calculates a target risk score using set weighting coefficients, classifying the risk into low-risk, medium-risk, and high-risk levels. When the system detects high-risk behavior, it automatically pushes an anomaly warning to the monitoring terminal and simultaneously writes the target trajectory information, behavioral characteristic information, and warning information into the security information management database for subsequent analysis and management.

[0034] To evaluate the practical effectiveness of the method of this invention, data from 7 consecutive days of operation were used for testing, totaling approximately 21TB of video data and extracting approximately 450 million valid surveillance image frames. In the experiment, this invention was compared with the original RT-DETR target detection system and the YOLOv5 security detection system. The comparison metrics included target detection accuracy, target detection recall, false detection rate, trajectory association accuracy, abnormal behavior recognition accuracy, system real-time processing frame rate, and abnormal warning response time. The results of the comparative experiment are shown in Table 1.

[0035] Table 1. Performance Comparison of Different Security Identification Systems in Transportation Hub Monitoring Scenarios

[0036] As shown in Table 1, the present invention outperforms the comparative systems in multiple performance indicators. In terms of target detection performance, the target detection accuracy of the present invention reaches 95.8%, an improvement of 7.2 percentage points compared to the YOLOv5 security detection system and 4.5 percentage points compared to the original RT-DETR target detection system. The target detection recall rate reaches 94.6%, an improvement of 7.7 and 4.9 percentage points compared to the two comparative systems, respectively, indicating that the present invention can more comprehensively identify security targets in complex monitoring environments and significantly reduce missed detections. The false detection rate of the present invention is only 3.2%, a reduction of 4.6 percentage points compared to the YOLOv5 security detection system and 2.9 percentage points compared to the original RT-DETR target detection system, indicating that the improved RT-DETR network has better stability in suppressing background interference and invalid target detection.

[0037] In terms of target tracking and behavior analysis, this invention achieves a trajectory correlation accuracy of 92.7% through cross-frame correlation analysis and behavior trajectory modeling, which is 11.3 percentage points higher than the YOLOv5 security detection system and 6.5 percentage points higher than the original RT-DETR target detection system. It can maintain a more stable target trajectory even in densely populated areas or when the target is occluded. Simultaneously, the abnormal behavior identification accuracy reaches 91.4%, an improvement of 12.2 percentage points compared to the YOLOv5 security detection system and 6.9 percentage points higher than the original RT-DETR target detection system. This demonstrates that this invention, through comprehensive analysis of temporal characteristics such as target dwell time, movement speed, and area entry / exit behavior, can more accurately identify potential abnormal behaviors.

[0038] Regarding system real-time performance, this invention maintains high-precision recognition capabilities while also exhibiting excellent real-time processing performance. Its real-time processing frame rate reaches 51fps, representing an improvement of approximately 21.4% compared to the YOLOv5 security detection system and approximately 8.5% compared to the original RT-DETR target detection system, thus meeting the real-time video analysis requirements of large-scale monitoring systems. Furthermore, the anomaly warning response time of this invention is shortened to 1.8 seconds, enabling faster warning and handling of potential risky behaviors.

[0039] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A security information management method based on big data analysis, characterized in that, Includes the following steps: Step 1: Obtain the security image frame sequence of the target security scene and construct the original security image dataset; Step 2: Perform image preprocessing on the original security image dataset to generate a standard security image dataset; Step 3: Input the standard security image dataset into the improved RT-DETR network to perform frame-level target recognition and obtain a frame-level security target information set. The improved RT-DETR network includes a dual-branch backbone feature extraction module, an intra-scale feature interaction module, a cross-scale fusion module, a query selection module, a decoupled target decoding module, and a prediction output module. The improved RT-DETR network introduces a bright and dark field dual-branch feature structure in the dual-branch backbone feature extraction module and introduces a region prior guidance mechanism in the intra-scale feature interaction module. Step 4: Based on the frame-level security target information set, perform cross-frame correlation analysis to generate a target trajectory set; Step 5: Based on the target trajectory set, statistically analyze the temporal behavior characteristics to generate a target behavior trajectory information set; Step 6: Perform anomaly detection and risk assessment on the target behavior trajectory information set, calculate the target risk score and determine the risk level label. When the target behavior trajectory information is determined to be high risk, output an anomaly warning message. Step 7: Write the frame-level security target information set, target behavior trajectory information set, and abnormal warning information into the security information management database.

2. The security information management method based on big data analysis according to claim 1, characterized in that, Step one specifically includes: The system acquires raw image data from each security acquisition device in the target security scenario and organizes the raw image data into a security image frame sequence according to the acquisition time order. It assigns a frame identifier to each security image frame according to the acquisition time order and associates and encapsulates each security image frame with the frame identifier to construct the raw security image dataset.

3. The security information management method based on big data analysis according to claim 1, characterized in that, Step two specifically includes: Each security image frame is normalized in size, and each security image frame is cropped according to the set image width and image height to obtain a normalized security image; The normalized security image is denoised by using Gaussian filtering to generate a denoised security image. The brightness distribution of the denoised security image is adjusted using the gamma correction method to generate a brightness-compensated security image. The brightness-compensated security image is enhanced by using the CLAHE algorithm to increase the grayscale difference between the target area and the background area, thus generating a contrast-enhanced security image. The pixel values ​​of each pixel in the contrast-enhanced security image are mapped to the [0, 1] interval using the min-max normalization method to generate a standard security image. Each standard security image frame is associated with and encapsulated with its corresponding frame identifier to obtain a standard security image dataset.

4. The security information management method based on big data analysis according to claim 1, characterized in that, Step three specifically includes: The dual-branch backbone feature extraction module generates shallow backbone fusion feature maps, mid-branch backbone fusion feature maps, and deep backbone fusion feature maps for each frame of standard security image through a bright and dark field dual-branch feature structure. In the scale-based feature interaction module, based on the region prior guidance mechanism, region masking and feature enhancement are performed on the deep backbone fusion feature map to obtain the region-enhanced feature map. In the cross-scale fusion module, the shallow backbone fusion feature map, the mid-layer backbone fusion feature map, and the region enhancement feature map are mapped to the set channel dimension through 1×1 convolution. Based on the mid-layer backbone fusion feature map, the shallow backbone fusion feature map is downsampled and the region enhancement feature map is upsampled to obtain the shallow backbone alignment feature map and the region enhancement alignment feature map. The shallow backbone alignment feature map, the middle backbone fusion feature map, and the region enhancement alignment feature map are added element by element to obtain the scale fusion feature map; In the query selection module, the scale-fused feature map is flattened in the spatial dimension to obtain the scale-fused feature matrix; where each row of the scale-fused feature matrix represents a candidate feature vector; By setting a category mapping matrix, the scale-fused feature matrix is ​​linearly mapped and normalized through the category prediction mapping matrix and the Softmax function to obtain the candidate category probability matrix. Based on the candidate category probability matrix, the uncertainty score is obtained by calculating the category probability distribution corresponding to each candidate feature vector using the information entropy formula; the negative of the uncertainty score is then taken to obtain the candidate query score. The candidate query scores are sorted in descending order, and the candidate feature vectors with the highest scores are selected to form the target query matrix according to the set number of query targets. In the decoupled target decoding module, a query mapping matrix, a key mapping matrix, and a value mapping matrix are defined; The scale-fused feature map is flattened into a matrix in the spatial dimension, and the key feature matrix and value feature matrix are generated by mapping them through the key mapping matrix and value mapping matrix, respectively; the target query matrix is ​​mapped to generate the query feature matrix by mapping it through the query mapping matrix. Based on the query feature matrix, key feature matrix, and value feature matrix, several layers of decoding are performed through attention operations and a feedforward network to obtain the decoded feature matrix; In the prediction output module, the decoded feature matrix is ​​linearly mapped to generate target category label, target bounding box and target confidence for each query target, and then associated and encapsulated to generate frame-level security target information; By aggregating frame-level security target information from all standard security images, a frame-level security target information set is obtained.

5. A security information management method based on big data analysis according to claim 4, characterized in that, The dual-branch backbone feature extraction module generates shallow backbone fusion feature maps, mid-layer backbone fusion feature maps, and deep backbone fusion feature maps for each frame of standard security image through a bright and dark field dual-branch feature structure, specifically including: The dual-branch backbone feature extraction module includes a bright field branch, a dark field branch, and a gated fusion unit; In the bright field branch, three levels of convolutional feature extraction are performed on each frame of standard security image to generate a shallow bright field feature map, a mid-level bright field feature map, and a deep bright field feature map, respectively. In the dark field branch, three levels of gradient-constrained convolutional feature extraction are performed on each frame of standard security image to generate shallow dark field feature maps, mid-dark field feature maps, and deep dark field feature maps, respectively. In the gated fusion unit, based on each frame of standard security image, the frame-level brightness statistical vector and the local contrast statistical vector are calculated, and the frame-level brightness statistical vector and the local contrast statistical vector are feature-concatenated to obtain the statistical feature vector. The statistical feature vectors are used to generate gated weight vectors through a multilayer perceptron and a sigmoid function. The gated weight vectors are divided into shallow gated weight vectors, medium gated weight vectors and deep gated weight vectors according to the scale, and are respectively expanded to the same spatial size and channel dimension as the feature map at the corresponding scale. Based on shallow, medium, and deep gating weight vectors, the bright field shallow feature map, bright field medium feature map, and bright field deep feature map are gated and fused with the dark field shallow feature map, dark field medium feature map, and dark field deep feature map, respectively, to obtain shallow backbone fused feature map, medium backbone fused feature map, and deep backbone fused feature map.

6. The security information management method based on big data analysis according to claim 4, characterized in that, The intra-scale feature interaction module, based on a region prior guidance mechanism, performs region masking and feature enhancement on the deep backbone fusion feature map to obtain a region-enhanced feature map, specifically including: The shallow backbone fusion feature map and the middle backbone fusion feature map are respectively mapped to the set channel dimension through 3×3 convolution to obtain the shallow intermediate feature map and the middle intermediate feature map. Using the intermediate feature map of the middle layer as a reference, the shallow intermediate feature map is downsampled and mapped to obtain the shallow aligned feature map; The shallow aligned feature map and the middle intermediate feature map are concatenated by channels, and feature fusion, feature compression and feature normalization are performed by two layers of 1×1 convolution and the Sigmoid function to obtain the region response probability map. Set a region response threshold and perform mask filtering on the region response probability map to obtain a region prior mask map: if the response probability value of a pixel in the region response probability map is greater than or equal to the region response threshold, then set the response probability value of the current pixel to 1; otherwise, set it to 0. The deep backbone fusion feature map is flattened into a feature sequence in the spatial dimension to obtain the deep backbone fusion feature matrix; the region prior mask map is flattened into a vector to obtain the region prior mask vector. Based on the region prior mask vector, determine the mask vector index where the region prior mask value is equal to 1; filter the feature vectors of the deep backbone fusion feature matrix according to the mask vector index to obtain the feature matrix of key regions, and use the unfiltered feature vectors as the background feature matrix. Attention operations are performed on the feature matrix of the key region to obtain the enhanced feature matrix of the key region, and a 3×3 convolution is performed on the background feature matrix to obtain the background compensation feature matrix. The key region enhancement feature matrix and the background compensation feature matrix are rearranged according to their original spatial dimensions to reconstruct a region enhancement feature map.

7. The security information management method based on big data analysis according to claim 1, characterized in that, Step four specifically includes: Based on the target bounding box, the target image region is cropped from the corresponding standard security image, and the target image region is extracted to generate the target appearance feature vector through a lightweight convolutional neural network; Set the currently established set of target trajectories, and read the end status information of each target trajectory. The end status information includes the end frame number, end target category label, end center point coordinates, and end appearance feature vector; each target trajectory corresponds to a target trajectory identifier. The frame-level security target information of each standard security image frame is compared with each target trajectory in the target trajectory set to perform cross-frame correlation analysis, and a cross-frame correlation score is obtained, specifically: If the target category label is consistent with the target category label at the end of the target trajectory, then set the category consistency label to 1; otherwise, set the category consistency label to 0. Calculate the Euclidean distance between the coordinates of the target center point and the coordinates of the end point center point to obtain the spatial proximity distance; Calculate the inner product of the target appearance feature vector and the end appearance feature vector to obtain the appearance feature similarity. Calculate the time difference between the frame identifier of the current standard security image and the frame number at the end of the trajectory to obtain the inter-frame time interval; map the inter-frame time interval to a time continuity coefficient through a negative exponential function; A cross-frame association score is constructed based on category consistency labels, spatial proximity distance, appearance feature similarity, and temporal continuity coefficient; Set an association score threshold. If the cross-frame association score is greater than or equal to the association score threshold, then associate the frame-level security target information with the corresponding target trajectory. If neither the frame-level security target information nor any target trajectory in the target trajectory set meets the association scoring threshold condition, then a new target trajectory is created using the current frame-level security target information, and the current frame-level security target information is used as the initial state of the new target trajectory and written into the target trajectory set.

8. The security information management method based on big data analysis according to claim 1, characterized in that, Step five specifically includes: Read each target trajectory and its corresponding target category label from the target trajectory set. Each target trajectory is formed by associating multiple frame-level security target information in chronological order. Calculate the target dwell time for each target trajectory based on the start frame identifier and end frame identifier of each target trajectory; For each target trajectory, the L2 norm of the difference between the coordinates of the target center point of adjacent frame-level security target information is calculated to obtain the target displacement distance; based on the target displacement distance, the average moving speed of the current target trajectory is calculated. A set of monitoring areas is pre-defined. For each target trajectory, it is determined whether the coordinates of the target center point of each frame-level security target information are located within the monitoring area. If the target center point coordinates move from outside the monitoring area to the monitoring area, an area entry event is recorded. If the target center point coordinates move from outside the monitoring area to outside the monitoring area, an area exit event is recorded. Based on area entry and area exit events, count the number of area entry and area exit events for each target trajectory in each monitored area; The target trajectory identifier, target category label, target dwell time, average movement speed, number of times entering the area and number of times leaving the area are associated and encapsulated to generate target behavior trajectory information. The target behavior trajectory information corresponding to all target trajectories is then summarized to obtain a target behavior trajectory information set.

9. A security information management method based on big data analysis according to claim 1, characterized in that, Step six specifically includes: Set the dwell time weight coefficient, speed weight coefficient, entry weight coefficient and exit weight coefficient, and perform minimum-maximum normalization on the target dwell time, average movement speed, number of times entering the area and number of times leaving the area, and then perform weighted fusion to obtain the target risk score; Set low-risk, medium-risk, and high-risk thresholds, and determine the risk level of the target behavior trajectory information based on the target risk score; If the target's behavioral trajectory information is determined to be high-risk, an abnormal warning event is triggered, and abnormal warning information is pushed to the security monitoring terminal. The abnormal warning information includes the target trajectory identifier, target category label, target risk score, and risk level label.

10. A security information management system based on big data analysis, comprising the security information management method based on big data analysis as described in any one of claims 1 to 9, characterized in that, include: The data acquisition module is used to acquire the security image frame sequence of the target security scene and construct the original security image dataset; The image preprocessing module is used to preprocess the original security image dataset to generate a standard security image dataset. The target recognition module is used to input standard security image datasets into the improved RT-DETR network, perform frame-level target recognition, and obtain frame-level security target information sets; The cross-frame correlation analysis module is used to perform cross-frame correlation analysis based on the frame-level security target information set and generate a target trajectory set; The behavior analysis module is used to statistically analyze time-series behavior characteristics based on the target trajectory set and generate a target behavior trajectory information set; The risk assessment module is used to determine anomalies and assess risks in the target behavior trajectory information set, and output anomaly warning information; The information storage module is used to write frame-level security target information sets, target behavior trajectory information sets, and abnormal early warning information into the security information management database.

Images