Methods and systems for fusing multi-source heterogeneous data in hospital security

Abstract

This invention provides a method and system for fusing multi-source heterogeneous data in hospital security. The method includes: acquiring multi-source heterogeneous data from various security subsystems, processing it through spatiotemporal and semantic dimension normalization to form a standardized data stream; then combining a preset security rule base and a long short-term memory network to calculate the global situational risk level, adjusting the cumulative anomaly score threshold and determining core events; iteratively expanding along the spatiotemporal dimension with the core events as the center; determining the boundary based on the average correlation of newly included regional data points to form a spatiotemporal event window; calculating multimodal fusion weights and weighted aggregation for the data within the window by comprehensively considering semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility to obtain a fused associated dataset; using high-weight data points as real nodes, inferring potential nodes based on a security logic knowledge base, constructing probability transition edges according to weight and temporal relationship, generating an event evolution probability map, and displaying it on the terminal.

Description

Technical Field

[0001] This application belongs to the field of security, and in particular relates to a method and system for fusing multi-source heterogeneous data in hospital security. Background Technology

[0002] The security systems of modern hospitals are becoming increasingly complex and networked. Numerous security subsystems, such as video surveillance, access control, intrusion alarms, electronic patrol systems, and fire alarm linkage, are widely deployed within hospitals, generating massive amounts of security data in real time. This data comes from diverse sources and varies in format, structure, and semantics, forming a typical multi-source heterogeneous data environment. However, current hospital security management generally faces the dilemma of data silos; each subsystem operates independently, and information cannot be shared or exchanged. Security personnel are faced with complex and fragmented alarm information and raw data streams, making comprehensive judgment and rapid response impossible. This information overload not only reduces the efficiency of security work but also makes it impossible to promptly detect and predict potential security risks.

[0003] Existing technologies, through data standardization, combined with spatiotemporal correlation analysis and basic anomaly detection algorithms, can initially integrate and analyze data from different subsystems, uncovering clues to suspicious events from massive datasets. However, most of these technologies employ fixed, static anomaly scoring thresholds in their event triggering mechanisms, easily leading to missed detections in high-risk situations and false alarms in low-risk situations. The definition of event correlation scope often relies on preset fixed spatiotemporal windows, potentially resulting in incomplete correlation information or excessive irrelevant noise input. During data fusion, the credibility differences of different data sources in specific contexts are often not considered, or weighted methods are used, leading to insufficient accuracy and reliability of the fusion results. Most existing technologies remain at the level of representing and correlating already occurred events, lacking the ability to extrapolate event development trends and provide risk warnings, thus failing to provide in-depth situational awareness and predictive support for security decision-making. Summary of the Invention

[0004] To address the problem that existing technologies fail to deeply explore the intrinsic connections between multimodal data and lack the ability to predict event trends and provide risk warnings.

[0005] In the first aspect, the present invention provides the following technical solution: a method for fusing multi-source heterogeneous data in hospital security, comprising: The system acquires multi-source heterogeneous data output from the security subsystem, performs spatiotemporal and semantic dimension normalization processing on the data to obtain a standardized data stream; calculates the global situation risk level based on a preset security rule base and a long short-term memory network, and adjusts the cumulative anomaly score threshold used to trigger events according to the risk level. Core events are determined based on the cumulative anomaly scoring threshold; Centered on the core event, the system iteratively expands along the spatiotemporal dimension. In each iteration, the average correlation between the newly included data points and the core event is calculated. Expansion stops when the average correlation falls below a preset boundary threshold, thus defining a spatiotemporal event window. For the data within the event window, a multimodal fusion weight is calculated for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility evaluated based on historical data. The multimodal fusion weight is then used to weight and aggregate the data within the window to generate a fused and associated dataset. Data points in the fused and associated dataset with multimodal fusion weights higher than a preset trigger threshold are defined as real nodes. Future events that may occur based on the security logic knowledge base are used as potential nodes. Probability transition edges connecting real nodes and potential nodes are constructed according to the multimodal fusion weights and temporal relationships of the real nodes that trigger the inference, thereby generating a probability graph representing the evolution relationship of events, and the probability graph is presented on the display terminal.

[0006] Optionally, determining the core event based on the cumulative anomaly score threshold includes: The standardized data stream is analyzed using a density-based spatiotemporal clustering algorithm to identify data point clusters and noise points; Each data point is assigned a local anomaly score. Data points belonging to any data point cluster are assigned a preset first anomaly score, and noise points are assigned a preset second anomaly score, with the first anomaly score being lower than the second anomaly score. The local anomaly score of each noise point is multiplied by a spatiotemporal deviation amplification factor calculated based on its spatiotemporal distance to the nearest data point cluster to obtain the cumulative anomaly score of the noise point; the sum of the local anomaly scores of all data points within each data point cluster is calculated, and a preset spatiotemporal normal capacity benchmark value for that region is subtracted from the sum of the local anomaly scores. The difference that is greater than zero is taken as the cumulative anomaly score of the data point cluster. If the difference is less than or equal to zero, the cumulative anomaly score of the data point cluster is recorded as zero. When the cumulative anomaly score of any noise point or data point cluster is greater than or equal to the adjusted cumulative anomaly score threshold, the spatiotemporal center of the noise point or data point cluster is determined as the core event.

[0007] Optionally, the normalization processing of the data in terms of spatiotemporal and semantic dimensions includes: The spatiotemporal dimension is normalized by converting the timestamps of all data into Coordinated Universal Time and formatting them according to the ISO8601 standard. Geographical information from different sources is mapped to a unified WGS-84 coordinate system, and the product of the floor number and the preset floor height is added as the Z-axis coordinate, which is then converted into a three-dimensional rectangular coordinate system in meters. Semantic dimension paradigm is performed. Based on the predefined hospital security event ontology library, the heterogeneous event representations reported by each subsystem are uniformly mapped to standard event codes, and the identifiers of the personnel and equipment entities involved are unified into globally unique identifiers.

[0008] Optionally, the step of calculating the global situational risk level based on a preset security rule base and a long short-term memory network, and adjusting the cumulative anomaly score threshold used to trigger events according to the risk level, includes: The current alarm count and real-time personnel density data of high-risk areas are input into the security rule base to obtain the rule evaluation value. The frequency of abnormal events in the past 24 hours is input into the long short-term memory network to obtain the predicted risk value. The global situation risk level is calculated. The risk level is the weighted sum of the rule evaluation value and the predicted risk value, and is divided into three levels. Set a baseline cumulative anomaly score threshold. When the risk level is low, adjust the threshold to a times the baseline value. When the risk level is medium, the threshold remains unchanged. When the risk level is high, adjust the threshold to b times the baseline value, where a > b.

[0009] Optionally, assigning a local anomaly score to each data point, assigning a preset first anomaly score to data points belonging to any data point cluster, and assigning a preset second anomaly score to noise points, includes: The ST-DBSCAN algorithm is used to set the neighborhood spatial radius Eps1, the neighborhood temporal radius Eps2, and the minimum number of data points MinPts to form a cluster. The algorithm is executed on the standardized data stream to classify data points that meet the parameter conditions into data point clusters and those that do not meet the conditions into noise points. For a data point categorized within a data point cluster, the local anomaly score of the data point is a preset first anomaly score; for any noise point, the local anomaly score of the noise point is a preset second anomaly score.

[0010] Optionally, the iterative expansion along the spatiotemporal dimension, centered on the core event, involves calculating the average correlation between data points within the newly included region and the core event in each iteration. Expansion stops when the average correlation falls below a preset boundary threshold, thereby defining the spatiotemporal event window. This includes: Using the core event as the initial window, set the initial spatial expansion step size and the time expansion step size; In the kth iteration, the spatial range is expanded by k × spatial expansion step size, and the temporal range is expanded by k × temporal expansion step size, forming a new region to be investigated. Calculate the semantic similarity and spatiotemporal proximity between each data point in the newly included region and the core event. Obtain the correlation score of each data point by weighted summation, and then calculate the average correlation of all newly included data points. Set a boundary threshold for the average correlation degree. If the average correlation degree is greater than or equal to the threshold, the data points in the new region are included in the event window and the next iteration continues. Otherwise, stop expanding. The currently defined range is the spatiotemporal event window.

[0011] Optionally, for the data within the event window, the multimodal fusion weight is calculated for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility evaluated based on historical data, including: The text representation of any data point within the event window and the core event are converted into a 768-dimensional semantic vector using a pre-trained BERT model, and the cosine similarity Sim between the two is calculated. Calculate the spatial Euclidean distance *d* and time difference *t* between the data points and the core events, and calculate the spatiotemporal Gaussian kernel similarity *K* using a Gaussian kernel function, where the function is... ,in For spatial scale parameters, For time scale parameters; The alarm accuracy rate of the source device for the data point in the past 30 days is obtained by querying the data source credibility database and used as the credibility Cred of the source device. The multimodal fusion weight is calculated for each data point by multiplying the semantic vector cosine similarity Sim, the spatiotemporal Gaussian kernel similarity K, and the data source credibility Cred by weight coefficients and then summing them.

[0012] Optionally, defining data points in the fused associated dataset with multimodal fusion weights higher than a preset trigger threshold as real nodes, inferring possible future events based on the security logic knowledge base as potential nodes, and constructing probability transition edges connecting real nodes and potential nodes according to the multimodal fusion weights and temporal relationships of the triggered real nodes, includes: The real nodes in the fused and associated dataset with multimodal fusion weights higher than the preset trigger threshold are used as input, and the rules are matched in the security logic knowledge base. If the match is successful, potential nodes are generated. Construct probabilistic transition edges from actual nodes to potential nodes, with the probability P calculated using the following formula: ,in λ represents the prior probability of a rule in the knowledge base, W represents the multimodal fusion weight of the real-world node that triggers the rule, λ represents the time decay coefficient, and Δt represents the time difference between the current moment and the moment the real-world node occurs.

[0013] In a second aspect, the present invention provides the following technical solution: a fusion system for multi-source heterogeneous data in hospital security, comprising the following modules: The calculation module is used to acquire multi-source heterogeneous data output by the security subsystem, perform normalization processing on the data in terms of spatiotemporal and semantic dimensions to obtain a standardized data stream; calculate the global situation risk level based on the preset security rule base and long short-term memory network, and adjust the cumulative anomaly score threshold used to trigger events according to the risk level. The determination module is used to identify core events based on the cumulative anomaly score threshold. The generation module iteratively expands along the spatiotemporal dimension, centered on the core event. In each iteration, it calculates the average correlation between data points in the newly included region and the core event. When the average correlation is lower than a preset boundary threshold, the expansion stops, thereby defining a spatiotemporal event window. For the data within the event window, it calculates a multimodal fusion weight for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility evaluated based on historical data. The multimodal fusion weight is then used to weight and aggregate the data within the window to generate a fused and associated dataset. The construction module is used to define data points in the fused associated dataset with multimodal fusion weights higher than a preset trigger threshold as real nodes, infer future possible events based on the security logic knowledge base as potential nodes, and construct probability transition edges connecting real nodes and potential nodes according to the multimodal fusion weights and temporal relationships of the triggered real nodes, thereby generating a probability graph representing the evolution relationship of events, and presenting the probability graph on the display terminal.

[0014] Preferably, determining the core event based on the cumulative anomaly scoring threshold includes: The standardized data stream is analyzed using a density-based spatiotemporal clustering algorithm to identify data point clusters and noise points; Each data point is assigned a local anomaly score. Data points belonging to any data point cluster are assigned a preset first anomaly score, and noise points are assigned a preset second anomaly score, with the first anomaly score being lower than the second anomaly score. The local anomaly score of each noise point is multiplied by a spatiotemporal deviation amplification factor calculated based on its spatiotemporal distance to the nearest data point cluster to obtain the cumulative anomaly score of the noise point; the sum of the local anomaly scores of all data points within each data point cluster is calculated, and a preset spatiotemporal normal capacity benchmark value for that region is subtracted from the sum of the local anomaly scores. The difference that is greater than zero is taken as the cumulative anomaly score of the data point cluster. If the difference is less than or equal to zero, the cumulative anomaly score of the data point cluster is recorded as zero. When the cumulative anomaly score of any noise point or data point cluster is greater than or equal to the adjusted cumulative anomaly score threshold, the spatiotemporal center of the noise point or data point cluster is determined as the core event.

[0015] Preferably, the normalization processing of the data in terms of spatiotemporal and semantic dimensions includes: The spatiotemporal dimension is normalized by converting the timestamps of all data into Coordinated Universal Time and formatting them according to the ISO8601 standard. Geographical information from different sources is mapped to a unified WGS-84 coordinate system, and the product of the floor number and the preset floor height is added as the Z-axis coordinate, which is then converted into a three-dimensional rectangular coordinate system in meters. Semantic dimension paradigm is performed. Based on the predefined hospital security event ontology library, the heterogeneous event representations reported by each subsystem are uniformly mapped to standard event codes, and the identifiers of the personnel and equipment entities involved are unified into globally unique identifiers.

[0016] Preferably, the step of calculating the global situational risk level based on a preset security rule base and a long short-term memory network, and adjusting the cumulative anomaly score threshold used to trigger events according to the risk level, includes: The current alarm count and real-time personnel density data of high-risk areas are input into the security rule base to obtain the rule evaluation value. The frequency of abnormal events in the past 24 hours is input into the long short-term memory network to obtain the predicted risk value. The global situation risk level is calculated. The risk level is the weighted sum of the rule evaluation value and the predicted risk value, and is divided into three levels. Set a baseline cumulative anomaly score threshold. When the risk level is low, adjust the threshold to a times the baseline value. When the risk level is medium, the threshold remains unchanged. When the risk level is high, adjust the threshold to b times the baseline value, where a > b.

[0017] Preferably, assigning a local anomaly score to each data point, assigning a preset first anomaly score to data points belonging to any data point cluster, and assigning a preset second anomaly score to noise points, includes: The ST-DBSCAN algorithm is used to set the neighborhood spatial radius Eps1, the neighborhood temporal radius Eps2, and the minimum number of data points MinPts to form a cluster. The algorithm is executed on the standardized data stream to classify data points that meet the parameter conditions into data point clusters and those that do not meet the conditions into noise points. For a data point categorized within a data point cluster, the local anomaly score of the data point is a preset first anomaly score; for any noise point, the local anomaly score of the noise point is a preset second anomaly score.

[0018] Preferably, the step of iteratively expanding along the spatiotemporal dimension with the core event as the center, calculating the average correlation between data points in the newly included region and the core event in each iteration, and stopping the expansion when the average correlation is lower than a preset boundary threshold, thereby defining the spatiotemporal event window, includes: Using the core event as the initial window, set the initial spatial expansion step size and the time expansion step size; In the kth iteration, the spatial range is expanded by k × spatial expansion step size, and the temporal range is expanded by k × temporal expansion step size, forming a new region to be investigated. Calculate the semantic similarity and spatiotemporal proximity between each data point in the newly included region and the core event. Obtain the correlation score of each data point by weighted summation, and then calculate the average correlation of all newly included data points. Set a boundary threshold for the average correlation degree. If the average correlation degree is greater than or equal to the threshold, the data points in the new region are included in the event window and the next iteration continues. Otherwise, stop expanding. The currently defined range is the spatiotemporal event window.

[0019] Preferably, for the data within the event window, the multimodal fusion weight is calculated for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility evaluated based on historical data, including: The text representation of any data point within the event window and the core event are converted into a 768-dimensional semantic vector using a pre-trained BERT model, and the cosine similarity Sim between the two is calculated. Calculate the spatial Euclidean distance *d* and time difference *t* between the data points and the core events, and calculate the spatiotemporal Gaussian kernel similarity *K* using a Gaussian kernel function, where the function is... ,in For spatial scale parameters, For time scale parameters; The alarm accuracy rate of the source device for the data point in the past 30 days is obtained by querying the data source credibility database and used as the credibility Cred of the source device. The multimodal fusion weight is calculated for each data point by multiplying the semantic vector cosine similarity Sim, the spatiotemporal Gaussian kernel similarity K, and the data source credibility Cred by weight coefficients and then summing them.

[0020] Preferably, the step of defining data points in the fused and associated dataset whose multimodal fusion weights are higher than a preset trigger threshold as real nodes, and inferring future possible events based on the security logic knowledge base as potential nodes, and constructing probability transition edges connecting real nodes and potential nodes according to the multimodal fusion weights and temporal relationships of the triggered real nodes, includes: The real nodes in the fused and associated dataset with multimodal fusion weights higher than the preset trigger threshold are used as input, and the rules are matched in the security logic knowledge base. If the match is successful, potential nodes are generated. Construct probabilistic transition edges from actual nodes to potential nodes, with the probability P calculated using the following formula: ,in λ represents the prior probability of a rule in the knowledge base, W represents the multimodal fusion weight of the real-world node that triggers the rule, λ represents the time decay coefficient, and Δt represents the time difference between the current moment and the moment the real-world node occurs.

[0021] This invention integrates and standardizes multi-source heterogeneous data within a hospital security system. By setting event triggering conditions based on the overall situational risk level, it improves the accuracy of abnormal event detection and reduces false alarms and missed alarms. A reasonably sized spatiotemporal analysis window is constructed around core events to ensure the completeness of event-related information. Weighted fusion of semantic, spatiotemporal, and data source credibility information enhances the quality and reliability of the fused data. By constructing probabilistic graphs to extrapolate events, it shifts the focus of security event analysis from post-event analysis to pre-event warning, demonstrating the evolution path and potential risks of events and enhancing the hospital's overall proactive security and prevention capabilities. Attached Figure Description

[0022] Figure 1 A flowchart illustrating a method for fusing multi-source heterogeneous data in hospital security. Figure 2 This is a schematic diagram of the overall architecture of the security evolution map system. Detailed Implementation

[0023] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0024] If the technical solution of this application involves personal information, the product using this technical solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using this technical solution has obtained the user's separate consent before processing the sensitive personal information, and also meets the requirement of "express consent". For example, at personal information collection devices such as cameras, clear and prominent signs are set up to inform users that they have entered the scope of personal information collection and that personal information will be collected. If an individual voluntarily enters the collection scope, it is deemed that they have agreed to the collection of their personal information; or on the personal information processing device, with clear signs / information informing users of the personal information processing rules, authorization is obtained from the individual through pop-up information or by asking the individual to upload their personal information; wherein, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

[0025] On the one hand, this invention proposes a method for fusing multi-source heterogeneous data in hospital security, such as... Figure 1 As shown, it includes the following steps: S1. Obtain multi-source heterogeneous data output by the security subsystem, perform spatiotemporal and semantic dimension normalization processing on the data to obtain a standardized data stream; calculate the global situation risk level based on the preset security rule base and long short-term memory network, and adjust the cumulative anomaly score threshold used to trigger events according to the risk level.

[0026] Through RESTful API interfaces, Kafka message queues, or JDBC database connections, the system accesses real-time structured video data from the video surveillance subsystem, such as face capture records, vehicle recognition records, card swipe records from the access control subsystem, infrared beam and electronic fence alarm signals from the alarm subsystem, and inspection and tracking records from the electronic patrol subsystem. For each piece of data acquired, the timestamp is uniformly converted to the UTC standard time format using Python's datetime library, and the device ID is converted to a unified three-dimensional spatial coordinate of the floor according to a pre-established device location mapping table, completing spatiotemporal normalization. Simultaneously, a unified JSON data structure is defined to map event types from different sources, such as card swipe for door opening, unauthorized entry, and patrol arrival, to preset standardized event semantic tags, completing semantic normalization and forming a data object stream containing a unified spatiotemporal stamp, spatial coordinates, event tags, and original information. The Drools rule engine is used to load a security rule base, which includes logical rules such as classifying three consecutive access control failures within 5 minutes in a specific area as high-risk behavior. Standardized data streams are matched and evaluated in real-time to calculate rule evaluation values. Simultaneously, a trained Long Short-Term Memory (LSTM) network is used to output predicted risk values ​​based on features such as current time, area pedestrian density, and historical event frequency. The rule evaluation values ​​output by the rule engine and the predicted risk values ​​are weighted and summed to obtain a global situational risk score. A basic cumulative anomaly score threshold is set, and a tiered adjustment method with fixed coefficients is adopted. The adjustment coefficient is matched according to the risk score tier, and the basic threshold is multiplied by the adjustment coefficient to obtain the adjusted cumulative anomaly score threshold, thereby improving the system's sensitivity under high-risk situations.

[0027] In an optional embodiment, the normalization processing of the data in terms of spatiotemporal and semantic dimensions includes: The spatiotemporal dimension is normalized by converting the timestamps of all data into Coordinated Universal Time and formatting them according to the ISO8601 standard. Geographical information from different sources is mapped to a unified WGS-84 coordinate system, and the product of the floor number and the preset floor height is added as the Z-axis coordinate, which is then converted into a three-dimensional rectangular coordinate system in meters. Semantic dimension paradigm is performed. Based on the predefined hospital security event ontology library, the heterogeneous event representations reported by each subsystem are uniformly mapped to standard event codes, and the identifiers of the personnel and equipment entities involved are unified into globally unique identifiers.

[0028] In the spatiotemporal dimension paradigm operation, for timestamps, received formats such as "October 27, 2023 08:30:15 CST" or Unix timestamps "1698366615" are uniformly converted to Coordinated Universal Time (UTC) and strictly follow the ISO 8601 format, such as "2023-10-27T00:30:15Z", eliminating time zone and format differences. For spatial location, the GPS coordinates of the hospital's main building entrance, such as 116.397128°E, 39.916527°N, are set as the origin (0,0,0) of the local three-dimensional coordinate system. The locations of other devices or events, whether from the latitude and longitude of the GPS module or from the two-dimensional coordinates (x,y) and floor number F marked on the indoor positioning system or drawings, will also be converted. For example, a camera located on the 3rd floor with local 2D coordinates of (50.5, -25.2) would have a Z-axis coordinate of 7.6 meters if the preset standard floor height is 3.8 meters. The camera's coordinates in 3D space would be recorded as (50.5, -25.2, 7.6). In the spatiotemporal dimension paradigm operation, for the latitude and longitude coordinates from GPS, they are first converted into Cartesian coordinates in meters using Gauss-Krüger projection or Universal Transverse Mercator projection. Then, the plane coordinates of the main building entrance are used as the origin for offset calculation to obtain the X and Y coordinates in 3D space.

[0029] In the semantic dimension paradigm, a detailed hospital security event ontology is constructed. This library defines the hierarchical relationship of events using a tree structure. For example, the top level includes personnel anomalies, equipment malfunctions, and environmental alarms, while the next level is subdivided into events such as personnel falling, illegal intrusion, and smoke alarms. Each specific event at the bottom level is assigned a unique standard event code, such as A0102 representing a person running at excessive speed in a specific area. When raw representations are received from different subsystems, such as a person running detected by a video analytics system or a short-term high-frequency card swipe by an access control system, the semantic mapping module uses keyword matching, rule engines, or natural language processing models to uniformly map the raw representations to the standard code A0102. Simultaneously, to ensure the uniqueness of entity objects, a global identity and asset database is maintained. For example, an employee's ID card (IDEMP0755), face recognition database IDFaceID_302, and mobile phone MAC address are all associated with the same globally unique identifier (GUID), such as U-9A1B3C-D4E5F6. Similarly, a camera's device number CAM-ER-03 will also be assigned a global GUID, such as D-7G8H9J-K0L1M2.

[0030] In one possible embodiment, the step of calculating the global situational risk level based on a preset security rule base and a long short-term memory network, and adjusting the cumulative anomaly score threshold used to trigger events according to the risk level, includes: The current alarm count and real-time personnel density data of high-risk areas are input into the security rule base to obtain the rule evaluation value. The frequency of abnormal events in the past 24 hours is input into the long short-term memory network to obtain the predicted risk value. The global situation risk level is calculated. The risk level is the weighted sum of the rule evaluation value and the predicted risk value, and is divided into three levels. Set a baseline cumulative anomaly score threshold. When the risk level is low, adjust the threshold to a times the baseline value. When the risk level is medium, the threshold remains unchanged. When the risk level is high, adjust the threshold to b times the baseline value, where a > b.

[0031] Long Short-Term Memory (LSTM) networks are recurrent neural networks used for processing and predicting time-series data. The network consists of an input layer, multiple stacked LSTM layers, and an output layer. Each LSTM layer contains a series of LSTM units, each with a forget gate, input gate, and output gate, used to learn long-term dependencies in the data. The input is a 24-dimensional time-series vector. ,in This represents the total number of anomalous events that occurred in the past hour t. The output is a scalar value between 0 and 100. This represents a prediction of the security risk level for the next hour.

[0032] The calculation of the overall situational risk level is performed periodically, for example, every 5 minutes. (Rule evaluation value) The acquisition of this information relies on a knowledge base containing several expert rules. For example, the rule base might contain the rule: if the current number of active alarms is >5 and the emergency room personnel density is >0.5 people / square meter, then... =80; If a magnetic door alarm occurs in the medicine warehouse, then =95. Assuming there are 6 active alarms in the current system, the emergency room personnel density is 0.6 people / square meter, and there are no alarms in the pharmacy inventory, then the first rule is triggered. The value is 80; if multiple rules are triggered, the highest value is used. Predicted risk value. Generated by a pre-trained LSTM model. This model takes a time-series vector (e.g., [3, 1, 0, ..., 5]) containing the number of anomalous events per hour over the past 24 hours as input and outputs a risk prediction value for the next hour, ranging from 0 to 100. Assume the model outputs... It is 55.

[0033] According to the formula Calculate the overall situational risk level. Based on the example values ​​above, S=70. The classification criteria are: S less than 30 is low risk, S greater than or equal to 30 and less than or equal to 70 is medium risk, and S greater than 70 is high risk; an S value of 70 belongs to the medium risk level. The cumulative anomaly score threshold used to trigger the event is set to a baseline value of 150 points. The values ​​of a and b are selected based on experience, preferably 1.2 and 0.7. If at another time, multiple fire alarms occur at the hospital at night, leading to... Up to 90%, while historical models predict [something] due to the detection of frequent anomalous nighttime events. If the value is 85, then S = 88. At this point, S is greater than 70, which is considered a high-risk level. The cumulative anomaly score threshold will be automatically lowered to 105 points, making the system more sensitive to potential events.

[0034] S2, Determine the core events based on the cumulative anomaly scoring threshold: The standardized data stream is analyzed using a density-based spatiotemporal clustering algorithm to identify data point clusters and noise points; Each data point is assigned a local anomaly score. Data points belonging to any data point cluster are assigned a preset first anomaly score, and noise points are assigned a preset second anomaly score, with the first anomaly score being lower than the second anomaly score. The local anomaly score of each noise point is multiplied by a spatiotemporal deviation amplification factor calculated based on its spatiotemporal distance to the nearest data point cluster to obtain the cumulative anomaly score of the noise point; the sum of the local anomaly scores of all data points within each data point cluster is calculated, and a preset spatiotemporal normal capacity benchmark value for that region is subtracted from the sum of the local anomaly scores. The difference that is greater than zero is taken as the cumulative anomaly score of the data point cluster. If the difference is less than or equal to zero, the cumulative anomaly score of the data point cluster is recorded as zero. When the cumulative anomaly score of any noise point or data point cluster is greater than or equal to the adjusted cumulative anomaly score threshold, the spatiotemporal center of the noise point or data point cluster is determined as the core event.

[0035] The ST-DBSCAN algorithm is used, with a spatial neighborhood radius Eps1 of 5 meters, a temporal neighborhood radius Eps2 of 60 seconds, and a minimum number of neighborhood points MinPts for the core object of 3. Cluster analysis is performed on standardized data streams within a specific time window. This algorithm can be implemented in Python or by calling an open-source spatiotemporal clustering library. After clustering, each data point is traversed, and the cluster label is checked. If the label is -1, it is determined to be a noise point, and a preset second anomaly score value of 150 is assigned to the local anomaly score variable of the noise point. If the label is not -1, it is determined to belong to a certain data point cluster, and a preset first anomaly score value of 20 is assigned to the local anomaly score variable of the data point. The process iterates through all data points again. If a data point is a noise point, the spatiotemporal distance between the data point and the nearest cluster of data points is calculated. A spatiotemporal deviation amplification coefficient is obtained through a preset mapping function. In one embodiment, the preset mapping function is preferably M = 1 + α × ln(1 + D), where M is the spatiotemporal deviation amplification coefficient, D is the spatiotemporal Euclidean distance between the noise point and the centroid of the nearest cluster of data points, and α is a preset adjustment coefficient, preferably 0.5. Those skilled in the art should know that the mapping function is not limited to the one mentioned above, as long as the coefficient is higher the spatiotemporal distance. The coefficient is multiplied by the local anomaly score of 150 to obtain the cumulative anomaly score of the noise point. For all non-noise points, they are grouped according to their respective cluster labels. The local anomaly scores of all data points within each group are summed, and the preset spatiotemporal normal capacity benchmark value for the region where the data point cluster is located in the current time period is read. In one embodiment, the spatiotemporal normal capacity benchmark value is determined as follows: Based on historical data, the sum of local anomaly scores of all data point clusters generated in the region under normal conditions without alarms during the same week and time period (e.g., 10:00-11:00 AM on weekdays) within a set period (e.g., the past 30 days) is extracted. The algorithmic mean and standard deviation of the historical score sum are further calculated, and the sum of the mean and three times the standard deviation is used as the spatiotemporal normal capacity benchmark value. The benchmark value is subtracted from the sum of the local anomaly scores. If the difference is greater than zero, this difference is used as the cumulative anomaly score of the data point cluster; if the difference is less than or equal to zero, the cumulative anomaly score of the data point cluster is recorded as 0. The cumulative anomaly score of each noise point and each data point cluster is compared with the cumulative anomaly score threshold calculated in the previous step. If it is greater than or equal to the threshold, the spatiotemporal coordinates of the noise point, or the arithmetic mean of the spatiotemporal coordinates of all data points in the data point cluster, i.e., the centroid, is recorded as the spatiotemporal center of the core event.

[0036] In an alternative embodiment, assigning a local anomaly score to each data point, assigning a preset first anomaly score to data points belonging to any data point cluster, and assigning a preset second anomaly score to noise points, includes: The ST-DBSCAN algorithm is used to set the neighborhood spatial radius Eps1, the neighborhood temporal radius Eps2, and the minimum number of data points MinPts to form a cluster. The algorithm is executed on the standardized data stream to classify data points that meet the parameter conditions into data point clusters and those that do not meet the conditions into noise points. For a data point categorized within a data point cluster, the local anomaly score of the data point is a preset first anomaly score; for any noise point, the local anomaly score of the noise point is a preset second anomaly score.

[0037] The ST-DBSCAN algorithm processes the standardized data stream produced by the preceding steps, where each data point contains spatiotemporal information (x, y, z, t). For any unvisited data point P, its spatiotemporal neighborhood is calculated. This neighborhood is defined as a four-dimensional spatiotemporal region centered on P with a radius of Eps1 = 15 meters, extending forward and backward by Eps2 = 120 seconds along the time axis. The total number of data points falling within this spatiotemporal region, including P itself, is counted. If this number is greater than or equal to MinPts = 3, then point P is marked as a core point, forming the initial core of a data point cluster together with all points in its neighborhood. The neighborhood of each point within the cluster is iteratively checked, merging all points with reachable density (i.e., core points with a neighborhood exceeding MinPts) and non-core points within their neighborhoods into the current cluster, until the cluster can no longer expand.

[0038] After traversing all data points, points that fail to belong to any data point cluster—that is, points that are neither core points nor neighbors of any core points—are identified as noise points. For example, a normal access control card swipe event occurs at coordinates (5.1, 8.2, 0) at 10:01:30; a video surveillance pedestrian flow event occurs at (6.5, 9.0, 0) at 10:02:05; and an electronic patrol checkpoint event occurs at (4.0, 7.5, 0) at 10:03:00. These three data points are spatially less than 15 meters apart and their time intervals are all within 120 seconds, satisfying the condition MinPts=3. Therefore, they are clustered into one data point cluster, and each data point is assigned a first anomaly score of 20 points. Meanwhile, an isolated window breakage sensor alarm occurs on the top floor of the inpatient department. Since there are no other security data points within 15 meters and within 120 seconds, it will be identified as a noise point and assigned a higher second anomaly score of 150 points. Furthermore, since the isolated alarm point is far from the normal population cluster below, the calculated spatiotemporal deviation amplification factor is 1.5, and its final cumulative anomaly score is amplified to 225 points, thereby exceeding the event trigger threshold and ensuring that this high-risk isolated anomaly is defined as a core event.

[0039] S3. Centered on the core event, iteratively expand along the spatiotemporal dimension. In each iteration, calculate the average correlation between the data points in the newly included region and the core event. Stop expanding when the average correlation is lower than a preset boundary threshold, thereby defining the spatiotemporal event window. For the data within the event window, calculate a multimodal fusion weight for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility evaluated based on historical data. Use the multimodal fusion weight to perform weighted aggregation on the data within the window to generate a fused and associated dataset.

[0040] Initialize a spatiotemporal window starting from the spatiotemporal center of the core event, setting preset spatial and temporal expansion step sizes. Enter an iterative loop; in each iteration, the spatiotemporal boundary of the window expands outward by the step size, retrieving all data points within the newly expanded spherical region. For newly included data points, calculate the correlation score, and obtain the arithmetic mean of the correlation scores of all newly included points. Compare this average correlation score with a preset boundary threshold; if it is lower than the threshold, the loop terminates, and the current window becomes the spatiotemporal event window. For each data point within the window, use a pre-trained BERT model, calling the `encode` method to convert the data point and the semantic label text of the core event into a 768-dimensional vector. Call the `cosine_similarity` function from the sklearn library to calculate the cosine similarity between the two vectors. Simultaneously, calculate the spatial Euclidean distance and temporal difference between the data point and the center point of the core event, substituting them into the spatiotemporal Gaussian kernel function to obtain the spatiotemporal proximity. Then, from an updated database table, based on the source device ID of the data point, query the reliability of the source device. This reliability is updated daily based on the accuracy of the device's historical alarms. This is achieved through a linear weighting formula, for example... Calculate the multimodal fusion weights for each data point; organize all data points in the window and the calculated multimodal fusion weights into a list or data frame structure to obtain the fused associated dataset.

[0041] In one possible embodiment, the iterative expansion along the spatiotemporal dimension, centered on the core event, involves calculating the average correlation between data points within the newly included region and the core event in each iteration. Expansion stops when the average correlation falls below a preset boundary threshold, thereby defining a spatiotemporal event window. This includes: Using the core event as the initial window, set the initial spatial expansion step size and the time expansion step size; In the kth iteration, the spatial range is expanded by k × spatial expansion step size, and the temporal range is expanded by k × temporal expansion step size, forming a new region to be investigated. Calculate the semantic similarity and spatiotemporal proximity between each data point in the newly included region and the core event. Obtain the correlation score of each data point by weighted summation, and then calculate the average correlation of all newly included data points. Set a boundary threshold for the average correlation degree. If the average correlation degree is greater than or equal to the threshold, the data points in the new region are included in the event window and the next iteration continues. Otherwise, stop expanding. The currently defined range is the spatiotemporal event window.

[0042] The process begins with a core event where the accumulated anomaly score exceeds a threshold, such as a high-scoring noise point or the spatiotemporal center of a cluster of data points. In the k=1th iteration, a new investigation region is defined, which is a spatiotemporal shell: spatially, it is a sphere with a radius extending from 0 meters to 10 meters (k×10) surrounding the center point of the core event; temporally, it is a time interval of k×60 seconds before and after the occurrence of the core event. All data points falling within this shell are retrieved. For each new data point... Calculate the data points and core events The relevance is calculated using a weighted average of two components: semantic similarity (Sim) and spatiotemporal proximity (Prox). Sim is obtained by calculating the path distance between the event codes of the two entities in a predefined event ontology, while Prox is calculated using normalized spatiotemporal distance, for example... , where d and t are and The spatiotemporal distance =10 meters, =60 seconds. Assume the correlation calculation formula is: Correlation = 0.7 × Sim + 0.3 × Prox.

[0043] After calculating the correlation scores of all new data points within the shell, the average score is calculated. Assume that in the first iteration, three new data points were found with correlation scores of 0.8, 0.6, and 0.7, respectively, and an average correlation score of 0.7. Since 0.7 is greater than or equal to the boundary threshold of 0.5, this expansion is successful, and the above three data points are formally included in the event window, and the k=2th iteration begins. In the second iteration, the area of ​​investigation is expanded to a shell with a spatial radius of 10 to 20 meters and a time frame of 60 to 120 seconds before and after the event. Assume that four new data points were found within this area, with calculated correlation scores of 0.4, 0.3, 0.5, and 0.2, respectively, and an average correlation score of 0.35. Since 0.35 is less than the boundary threshold of 0.5, the iteration process stops. The spatiotemporal event window is defined as: centered on the core event, with a spatial radius of 10 meters and a time frame of 60 seconds before and after the event, encompassing the core event and the three data points included in the first iteration.

[0044] In one possible embodiment, for the data within the event window, the multimodal fusion weight is calculated for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility assessed based on historical data, including: The text representation of any data point within the event window and the core event are converted into a 768-dimensional semantic vector using a pre-trained BERT model, and the cosine similarity Sim between the two is calculated. Calculate the spatial Euclidean distance *d* and time difference *t* between the data points and the core events, and calculate the spatiotemporal Gaussian kernel similarity *K* using a Gaussian kernel function, where the function is... ,in For spatial scale parameters, For time scale parameters; The alarm accuracy rate of the source device for the data point in the past 30 days is obtained by querying the data source credibility database and used as the credibility Cred of the source device. The multimodal fusion weight is calculated for each data point by multiplying the semantic vector cosine similarity Sim, the spatiotemporal Gaussian kernel similarity K, and the data source credibility Cred by weight coefficients and then summing them.

[0045] The pre-trained BERT model is a Transformer-based bidirectional encoder representation model, a deep learning network for natural language processing. This network consists of multiple stacked Transformer encoder layers. Each Transformer encoder layer contains a multi-head self-attention mechanism module and a feedforward neural network module. By pre-training on massive amounts of text corpora, the model can learn rich linguistic knowledge. The input is a raw text representation, such as a statement representing an event. The output is a fixed-dimensional real-valued vector, typically 768-dimensional. It is the semantic representation of the input text.

[0046] For each data point P within the spatiotemporal event window, the following calculations are performed to evaluate the association strength between the data point and the core event C. At the semantic level, the original text representations of P and C are extracted, such as P being a person running rapidly detected in a video surveillance video, and C being an access control system reporting illegal intrusion. These two text segments are then input into a pre-trained Chinese BERT model, such as bert-base-chinese, to obtain the 768-dimensional output vectors of their respective [CLS] tokens. The semantic similarity Sim is obtained by calculating the cosine similarity between the two vectors. For example, the calculated result Sim = 0.82.

[0047] At the spatiotemporal level, calculate the absolute difference t between the three-dimensional Euclidean distance d and the timestamps t between P and C. Assume d = 12 meters and t = 45 seconds. Substitute the spatiotemporal Gaussian kernel function, where... =50 meters, =300 seconds. Calculated, K≈0.961. This value is close to 1, indicating that P and C are very close in time and space. Query the data source credibility database. Assuming data point P comes from camera CAM-LOBBY-02, the database records show that this device generated 50 alarms in the past 30 days, of which 48 were manually verified as genuine alarms. Then the credibility of this device, Cred=0.96. The data from the above three dimensions are weighted and fused using the following formula: The multimodal fusion weight W = 0.8903 was calculated. This weight value quantitatively represents the comprehensive correlation between data point P and the core event.

[0048] S4, define data points in the fused associated dataset whose multimodal fusion weights are higher than a preset trigger threshold as real nodes, and infer future possible events based on the security logic knowledge base as potential nodes. Construct probability transition edges connecting real nodes and potential nodes according to the multimodal fusion weights and temporal relationships of the triggered real nodes, thereby generating a probability graph representing the evolution relationship of events, and present the probability graph on the display terminal.

[0049] The algorithm iterates through each data point in the fused and associated dataset, comparing the multimodal fusion weight of each data point with a preset trigger threshold. If the weight exceeds the threshold, a real node object is created, containing all information about the data point. A security logic knowledge base built with the Neo4j graph database is used, which pre-stores rules such as causal relationships between forced entry events and subsequent asset theft events. For each newly generated real node, a Cypher query is executed to match all rules in the knowledge base with such events as preconditions, and the resulting events pointed to by the rules are instantiated as potential nodes. For each pair of potential nodes B generated by real node A, a directed edge is constructed from A to B, and the weight of this edge represents the transition probability. The probability is calculated using a function whose inputs include the multimodal fusion weights of the real node A, the confidence level of the corresponding rule in the knowledge base, and the time difference between the time A occurs and the current time. For example, the probability is equal to the weight of node A multiplied by the rule confidence level and then multiplied by an exponential decay function value with respect to the time difference. All generated real nodes, potential nodes, and the probability transition edges between them are integrated into a directed graph data structure using Python's NetworkX library, which is the probability graph. The graph data is then rendered on the display terminal of the security monitoring platform by calling a front-end visualization library such as D3.js or ECharts. Real nodes are represented by solid circles, potential nodes are represented by dashed circles, and the thickness or color intensity of the edges represent the level of transition probability.

[0050] In one possible embodiment, the step of defining data points in the fused and associated dataset whose multimodal fusion weights are higher than a preset trigger threshold as real nodes, and inferring future possible events based on the security logic knowledge base as potential nodes, and constructing probability transition edges connecting real nodes and potential nodes according to the multimodal fusion weights and temporal relationships of the triggered and inferred real nodes, includes: The real nodes in the fused and associated dataset with multimodal fusion weights higher than the preset trigger threshold are used as input, and the rules are matched in the security logic knowledge base. If the match is successful, potential nodes are generated. Construct probabilistic transition edges from actual nodes to potential nodes, with the probability P calculated using the following formula: ,in λ represents the prior probability of a rule in the knowledge base, W represents the multimodal fusion weight of the real-world node that triggers the rule, λ represents the time decay coefficient, and Δt represents the time difference between the current moment and the moment the real-world node occurs.

[0051] A trigger threshold is set, preferably 0.85. The data point with a fusion weight of W=0.8903 calculated in the previous step is identified as a real-world node because its weight is higher than 0.85. This real-world node contains multi-dimensional information such as event type, time, and location. The information of this real-world node is used as query conditions for matching in the security logic knowledge base. The knowledge base consists of a series of IF-THEN rules, for example: if the event type = illegal intrusion, the location = outpatient hall, and the occurrence time is between 23:00 and 05:00 the next day, then the potential event is determined to be asset theft risk, with a prior probability. =0.9.

[0052] Assuming the current real-world node successfully matches this rule, a potential node representing the risk of asset theft is created. A directed edge is constructed from the real-world node to this potential node, and the weight of the edge is the probability transition value P. This probability calculation combines the prior credibility of the rule, the reliability of the triggering event itself, and its timeliness. Assuming that 180 seconds have passed since the event occurred at the real-world node,... =180, the fusion weight W of the real node that triggers this rule is 0.8903, and the prior probability of the rule is... The time decay coefficient is 0.9. The probability is 0.005. The transition probability P is calculated as follows: P≈0.3257. A transition edge with a probability of 32.57% is created, representing the possibility of an illegal intrusion event evolving into an asset theft risk. The structure, including actual nodes, potential nodes, and probability transition edges, together constitutes the event evolution probability graph, which is visualized for security management personnel. The overall architecture of this invention is as follows: Figure 2 As shown.

[0053] On the other hand, the present invention also provides a fusion system for multi-source heterogeneous data in hospital security, comprising the following modules: The calculation module is used to acquire multi-source heterogeneous data output by the security subsystem, perform normalization processing on the data in terms of spatiotemporal and semantic dimensions to obtain a standardized data stream; calculate the global situation risk level based on the preset security rule base and long short-term memory network, and adjust the cumulative anomaly score threshold used to trigger events according to the risk level. The determination module is used to identify core events based on the cumulative anomaly score threshold. The generation module iteratively expands along the spatiotemporal dimension, centered on the core event. In each iteration, it calculates the average correlation between data points in the newly included region and the core event. When the average correlation is lower than a preset boundary threshold, the expansion stops, thereby defining a spatiotemporal event window. For the data within the event window, it calculates a multimodal fusion weight for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility evaluated based on historical data. The multimodal fusion weight is then used to weight and aggregate the data within the window to generate a fused and associated dataset. The construction module is used to define data points in the fused associated dataset with multimodal fusion weights higher than a preset trigger threshold as real nodes, infer future possible events based on the security logic knowledge base as potential nodes, and construct probability transition edges connecting real nodes and potential nodes according to the multimodal fusion weights and temporal relationships of the triggered real nodes, thereby generating a probability graph representing the evolution relationship of events, and presenting the probability graph on the display terminal.

[0054] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0055] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for fusing multi-source heterogeneous data in hospital security, characterized in that, Includes the following steps: Acquire multi-source heterogeneous data output from the security subsystem, and perform normalization processing on the data in terms of spatiotemporal and semantic dimensions to obtain a standardized data stream; The global situation risk level is calculated based on a preset security rule base and a long short-term memory network, and the cumulative anomaly score threshold used to trigger events is adjusted according to the risk level. Core events are determined based on the cumulative anomaly scoring threshold; Centered on the core event, the process iteratively expands along the spatiotemporal dimension. In each iteration, the average correlation between the newly included data points and the core event is calculated. When the average correlation is lower than a preset boundary threshold, the expansion stops, thereby defining a spatiotemporal event window. For the data within the event window, the multimodal fusion weight is calculated for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility evaluated based on historical data. The data within the window is weighted and aggregated using the multimodal fusion weights to generate a fused and associated dataset; Data points in the fused and associated dataset with multimodal fusion weights higher than a preset trigger threshold are defined as real nodes. Future events that may occur based on the security logic knowledge base are used as potential nodes. Probability transition edges connecting real nodes and potential nodes are constructed according to the multimodal fusion weights and temporal relationships of the real nodes that trigger the inference, thereby generating a probability graph representing the evolution relationship of events, and the probability graph is presented on the display terminal.

2. The method according to claim 1, characterized in that, The process of determining core events based on a cumulative anomaly score threshold includes: The standardized data stream is analyzed using a density-based spatiotemporal clustering algorithm to identify data point clusters and noise points; Each data point is assigned a local anomaly score. Data points belonging to any data point cluster are assigned a preset first anomaly score, and noise points are assigned a preset second anomaly score, with the first anomaly score being lower than the second anomaly score. The local anomaly score of each noise point is multiplied by a spatiotemporal deviation amplification factor calculated based on its spatiotemporal distance to the nearest data point cluster to obtain the cumulative anomaly score of the noise point; the sum of the local anomaly scores of all data points within each data point cluster is calculated, and a preset spatiotemporal normal capacity benchmark value for that region is subtracted from the sum of the local anomaly scores. The difference that is greater than zero is taken as the cumulative anomaly score of the data point cluster. If the difference is less than or equal to zero, the cumulative anomaly score of the data point cluster is recorded as zero. When the cumulative anomaly score of any noise point or data point cluster is greater than or equal to the adjusted cumulative anomaly score threshold, the spatiotemporal center of the noise point or data point cluster is determined as the core event.

3. The method according to claim 1, characterized in that, The process of normalizing the data in terms of spatiotemporal and semantic dimensions includes: The spatiotemporal dimension is normalized by converting the timestamps of all data into Coordinated Universal Time and formatting them according to the ISO8601 standard. Geographical information from different sources is mapped to a unified WGS-84 coordinate system, and the product of the floor number and the preset floor height is added as the Z-axis coordinate, which is then converted into a three-dimensional rectangular coordinate system in meters. Semantic dimension paradigm is performed. Based on the predefined hospital security event ontology library, the heterogeneous event representations reported by each subsystem are uniformly mapped to standard event codes, and the identifiers of the personnel and equipment entities involved are unified into globally unique identifiers.

4. The method according to claim 1, characterized in that, The calculation of the global situational risk level based on a preset security rule base and a long short-term memory network, and the adjustment of the cumulative anomaly score threshold used to trigger events according to the risk level, includes: The current alarm count and real-time personnel density data of high-risk areas are input into the security rule base to obtain the rule evaluation value. The frequency of abnormal events in the past 24 hours is input into the long short-term memory network to obtain the predicted risk value. The global situation risk level is calculated. The risk level is the weighted sum of the rule evaluation value and the predicted risk value, and is divided into three levels. Set a baseline cumulative anomaly score threshold. When the risk level is low, adjust the threshold to a times the baseline value. When the risk level is medium, the threshold remains unchanged. When the risk level is high, adjust the threshold to b times the baseline value, where a > b.

5. The method according to claim 2, characterized in that, Assigning a local anomaly score to each data point, assigning a preset first anomaly score to data points belonging to any data point cluster, and assigning a preset second anomaly score to noise points, includes: The ST-DBSCAN algorithm is used to set the neighborhood spatial radius Eps1, the neighborhood temporal radius Eps2, and the minimum number of data points MinPts to form a cluster. The algorithm is executed on the standardized data stream to classify data points that meet the parameter conditions into data point clusters and those that do not meet the conditions into noise points. For a data point categorized within a data point cluster, the local anomaly score of the data point is a preset first anomaly score; for any noise point, the local anomaly score of the noise point is a preset second anomaly score.

6. The method according to claim 1, characterized in that, The process involves iteratively expanding along the spatiotemporal dimension, centered on the core event. In each iteration, the average correlation between data points within the newly included region and the core event is calculated. Expansion stops when the average correlation falls below a preset boundary threshold, thereby defining a spatiotemporal event window. This includes: Using the core event as the initial window, set the initial spatial expansion step size and the time expansion step size; In the kth iteration, the spatial range is expanded by k × spatial expansion step size, and the temporal range is expanded by k × temporal expansion step size, forming a new region to be investigated. Calculate the semantic similarity and spatiotemporal proximity between each data point in the newly included region and the core event. Obtain the correlation score of each data point by weighted summation, and then calculate the average correlation of all newly included data points. Set a boundary threshold for the average correlation degree. If the average correlation degree is greater than or equal to the threshold, the data points in the new region are included in the event window and the next iteration continues. Otherwise, stop expanding. The currently defined range is the spatiotemporal event window.

7. The method according to claim 1, characterized in that, For the data within the event window, the multimodal fusion weight is calculated for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility assessed based on historical data, including: The text representation of any data point within the event window and the core event are converted into a 768-dimensional semantic vector using a pre-trained BERT model, and the cosine similarity Sim between the two is calculated. Calculate the spatial Euclidean distance *d* and time difference *t* between the data points and the core events, and calculate the spatiotemporal Gaussian kernel similarity *K* using a Gaussian kernel function, where the function is... ,in For spatial scale parameters, For time scale parameters; The alarm accuracy rate of the source device for the data point in the past 30 days is obtained by querying the data source credibility database and used as the credibility Cred of the source device. The multimodal fusion weight is calculated for each data point by multiplying the semantic vector cosine similarity Sim, the spatiotemporal Gaussian kernel similarity K, and the data source credibility Cred by weight coefficients and then summing them.

8. The method according to claim 1, characterized in that, The process involves defining data points in the fused and associated dataset whose multimodal fusion weights exceed a preset trigger threshold as real nodes, and inferring potential future events based on the security logic knowledge base as potential nodes. A probability transition edge connecting real nodes and potential nodes is constructed based on the multimodal fusion weights and temporal relationships of the triggered real nodes, including: The real nodes in the fused and associated dataset with multimodal fusion weights higher than the preset trigger threshold are used as input, and the rules are matched in the security logic knowledge base. If the match is successful, potential nodes are generated. Construct probabilistic transition edges from actual nodes to potential nodes, with the probability P calculated using the following formula: ,in λ represents the prior probability of a rule in the knowledge base, W represents the multimodal fusion weight of the real-world node that triggers the rule, λ represents the time decay coefficient, and Δt represents the time difference between the current moment and the moment the real-world node occurs.

9. A system for fusing multi-source heterogeneous data in hospital security, characterized in that, Includes the following modules: The calculation module is used to acquire multi-source heterogeneous data output by the security subsystem, and to perform normalization processing on the data in terms of spatiotemporal and semantic dimensions to obtain a standardized data stream. The global situation risk level is calculated based on a preset security rule base and a long short-term memory network, and the cumulative anomaly score threshold used to trigger events is adjusted according to the risk level. The determination module is used to identify core events based on the cumulative anomaly score threshold. The generation module iteratively expands along the spatiotemporal dimension, centered on the core event. In each iteration, it calculates the average correlation between data points in the newly included region and the core event. When the average correlation is lower than a preset boundary threshold, the expansion stops, thereby defining a spatiotemporal event window. For the data within the event window, it calculates a multimodal fusion weight for each data point by combining the semantic vector cosine similarity, spatiotemporal Gaussian kernel similarity, and data source credibility evaluated based on historical data. The multimodal fusion weight is then used to weight and aggregate the data within the window to generate a fused and associated dataset. The construction module is used to define data points in the fused associated dataset with multimodal fusion weights higher than a preset trigger threshold as real nodes, infer future possible events based on the security logic knowledge base as potential nodes, and construct probability transition edges connecting real nodes and potential nodes according to the multimodal fusion weights and temporal relationships of the triggered real nodes, thereby generating a probability graph representing the evolution relationship of events, and presenting the probability graph on the display terminal.

10. The system according to claim 9, characterized in that, The process of determining core events based on a cumulative anomaly score threshold includes: The standardized data stream is analyzed using a density-based spatiotemporal clustering algorithm to identify data point clusters and noise points; Each data point is assigned a local anomaly score. Data points belonging to any data point cluster are assigned a preset first anomaly score, and noise points are assigned a preset second anomaly score, with the first anomaly score being lower than the second anomaly score. The local anomaly score of each noise point is multiplied by a spatiotemporal deviation amplification factor calculated based on its spatiotemporal distance to the nearest data point cluster to obtain the cumulative anomaly score of the noise point; the sum of the local anomaly scores of all data points within each data point cluster is calculated, and a preset spatiotemporal normal capacity benchmark value for that region is subtracted from the sum of the local anomaly scores. The difference that is greater than zero is taken as the cumulative anomaly score of the data point cluster. If the difference is less than or equal to zero, the cumulative anomaly score of the data point cluster is recorded as zero. When the cumulative anomaly score of any noise point or data point cluster is greater than or equal to the adjusted cumulative anomaly score threshold, the spatiotemporal center of the noise point or data point cluster is determined as the core event.

Images