Self-service financial service terminal and vault security facility anomaly detection system and method

Abstract

This invention belongs to the field of intelligent monitoring technology for financial security, specifically involving an anomaly detection system and method for self-service financial service terminals and vault security facilities. The system includes: (1) a sensing end; (2) an edge processing layer; and (3) a central management layer. The method includes: S1, data acquisition and synchronization; S2, multimodal feature extraction; S3, dual-channel fusion and judgment; S4, rule engine enhancement and final output; and S5, alarm generation and intelligent linkage response. This invention achieves accurate identification of abnormal states, low false alarm reporting, and intelligent linkage response through spatiotemporal alignment, multi-level feature fusion, and rule-AI collaborative decision-making, thereby significantly improving the security protection level and automated management capabilities of financial physical facilities.

Description

Technical Field

[0001] This invention belongs to the field of intelligent monitoring technology for financial security, specifically relating to an anomaly detection system and method for self-service financial service terminals and vault security facilities. Background Technology

[0002] Currently, banks and other financial institutions generally deploy video surveillance systems and independent physical sensors in self-service areas and vaults. For example, ATMs are typically equipped with cameras to record the operation process, and also have door magnetic sensors, vibration sensors, or temperature and humidity sensors to monitor the status of the equipment compartment; vaults use access control systems in conjunction with infrared and vibration sensors to achieve basic security. Some existing solutions attempt to introduce intelligent video analytics technology, such as using facial recognition to identify the operator, or using behavioral recognition algorithms to detect abnormal actions (such as prolonged lingering, obstructing cameras, etc.).

[0003] The applicant has discovered the following significant defects in the prior art: (1) Strong single-modal dependence: Video analysis is easily affected by factors such as lighting, occlusion, and camouflage, while sensors can only provide discrete state signals (such as "door open"), lacking behavioral semantics, and cannot determine whether the state constitutes a real risk; (2) High false alarm and false alarm rates: For example, the door magnetic alarm is triggered when the wind blows and the vault door is slightly opened, but no one appears, and the system still misjudges it as an intrusion; conversely, internal personnel operate the equipment in violation of regulations during authorized time periods and are missed because there are no external abnormal characteristics. (3) Lack of contextual joint judgment capability: unable to effectively identify complex anomalies that require multi-condition collaborative judgment (such as "non-business hours + door open + unauthorized face"); (4) Isolated response mechanism: alarm information is not linked with equipment control, evidence preservation, security dispatch and other links, making it difficult to form a closed-loop handling. Summary of the Invention

[0004] This invention discloses an anomaly detection system and method for self-service financial service terminals and vault security facilities. The purpose is to provide an anomaly detection method and system for self-service financial service terminals and vault security facilities based on video and multi-source sensor fusion. Through spatiotemporal alignment, multi-level feature fusion and rule-AI collaborative decision-making, it can achieve accurate identification of abnormal states, low false alarm reporting, and intelligent linkage response, thereby significantly improving the security protection level and automated management capability of financial physical facilities.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows: Anomaly detection system for self-service financial service terminals and vault security facilities, including: (1) Sensing end: Physical sensing units deployed in the target financial venue; (2) Edge processing layer: Deployed near the branch office or equipment of the target financial institution, it consists of edge computing devices with AI inference capabilities and undertakes the following functions: Receive and buffer the raw data stream from the sensing end; Perform data preprocessing, feature extraction, multimodal fusion, and preliminary anomaly detection; Independently handle alarms and local linkage when the network is down or the cloud is unavailable; Supports OTA model upgrades and remote policy configuration; (3) The central management team, including: Anomaly Management Center: Receives alarm events reported by each edge node, and performs aggregation, deduplication, and priority sorting; Evidence Management Module: Automatically packages associated evidence packages, which include video clips, sensor logs, timestamps, and confidence levels, and encrypts and stores the associated evidence packages in a secure database; Policy Configuration Center: Allows administrators to configure anomaly rules, alarm thresholds, and linkage actions by network location, device type, and time period. API Interface: Supports integration with existing bank security platforms, work order systems, and facial recognition whitelist databases.

[0006] Preferably, the sensing end includes: (1) Video acquisition unit, including: At least two high-definition cameras, one covering the operational view and the other the environmental view: Among them, the operation perspective is used to capture user behavior, face, and hand movements; Environmental perspective: Used to monitor the state of the detected physical object; The high-definition camera supports H.265 encoding, low-light imaging, and wide dynamic range, making it suitable for nighttime or strong backlight scenarios. (2) A multi-source sensor unit, including: Door magnetic sensor: Installed on the ATM security door or the main / secondary door of the vault, outputting a binary signal and duration; Temperature and humidity sensor: embedded inside the ATM equipment compartment, sampling frequency 1Hz, measuring temperature -10℃~+70℃, humidity 0~100%RH; Triaxial vibration sensor: Attached to the chassis or door frame of the ATM equipment to detect impact intensity; the threshold can be configured as needed. Infrared pyroelectric sensor: Used to assist in determining the presence of people and reduce the risk of missed detection by purely visual methods.

[0007] Preferably, the multi-source sensor unit further includes: Sound sensor: Picks up abnormal audio and extracts characteristic frequency band energy through FFT analysis; Synchronization module: All devices have a built-in hardware clock and synchronize with the edge nodes via NTP or PTP to ensure that the timestamp error is ≤ 50ms.

[0008] Methods for detecting anomalies in self-service financial service terminals and vault security facilities include the following steps: S1. Data acquisition and synchronization; S2, Multimodal Feature Extraction; S3, Dual-channel fusion and determination; S4, rule engine enhancements and final output; S5, alarm generation and intelligent linkage response.

[0009] Preferably, step S1 includes: performing time alignment and spatial alignment on the acquired video stream data and multi-source sensor data stream, wherein time alignment includes: Each video frame is appended with a UTC microsecond-level timestamp t_v; Each sensor event is appended with a timestamp t_s; Edge nodes maintain a sliding time window and bind video frames that satisfy |t_v - t_s| leq Delta t, where Delta t = 100ms, to sensor events to form event groups; Spatial alignment includes: during the system initialization phase, establishing a physical-visual mapping table through configuration files or a graphical interface.

[0010] Preferably, step S2 includes: video feature extraction and sensor information feature extraction based on a lightweight deep learning model.

[0011] Preferably, in step S2, the video feature extraction includes: 211) Object Detection: Using an improved YOLOv8s model, real-time detection of the following categories is achieved on edge devices: People, hands, faces, tools, smoke, doors opening, and cameras being obstructed; 212) Behavior recognition: Using a lightweight SlowFast network or TimeSformer, perform temporal modeling on 16 consecutive frames and output high-level semantic labels; 213) Face recognition and authorization verification: Extract facial feature vectors and compare them with the cosine similarity of the locally cached authorized personnel whitelist; The sensor information feature extraction includes: 221) The original sensor signal is converted into a structured state vector after filtering and noise reduction; 222) Calculate derived features based on sensor signals to enhance discrimination capabilities.

[0012] Preferably, step S3 includes: 311) Feature-level fusion and channel fusion: The video behavior feature vector and the sensor vector are concatenated to form a joint feature; Then input it into a 3-layer MLP or a small Transformer encoder to output the anomaly probability; 312) Decision-level fusion channel fusion: The final decision score is obtained through video decision branches and sensor decision branches.

[0013] Preferably, step S4 includes: the system has a built-in exception rule library, which covers the model output in a priority manner.

[0014] Preferably, step S5 includes: 511) Tiered alarm mechanism; 512) Automatic evidence retention: 513) Equipment linkage control.

[0015] Preferably, the method further includes fault-tolerant and robust design, specifically: Sensor failure degradation: If a certain type of sensor goes offline, the system automatically increases the weight of video analysis and marks it as "partially missing perception"; Network outage handling: Edge nodes locally cache the raw data of the last 24 hours and retransmit it after the network is restored; Privacy protection: Facial features are used only for local comparison, and the original image is anonymized at the edges before being uploaded; Model update mechanism: Supports incremental learning, using newly labeled false positive / false negative samples to fine-tune the edge model online.

[0016] The beneficial effects of the self-service financial service terminal and vault security facility anomaly detection system and method of the present invention are as follows: This invention significantly improves the accuracy and response efficiency of identifying abnormal events in self-service financial service terminals and vault security facilities by deeply integrating video semantics with the physical status of multiple sensor sources. Real-world testing shows that in typical bank branch scenarios, compared to traditional single-modal solutions, the false alarm rate is reduced by more than 62%, the detection rate of complex anomalies (such as unauthorized door opening, forced entry, and environmental overheating) is increased to 95.3%, and the alarm response latency is controlled within 2 seconds. The system supports local edge decision-making, ensuring effective protection even during network outages; simultaneously, through the collaboration of a rule engine and AI model, it balances high accuracy with business interpretability, meeting the stringent regulatory requirements of the financial industry. The core advantages include: (1) a multimodal spatiotemporal alignment mechanism to ensure that video and sensor data are analyzed in a unified context; (2) a dual-channel fusion + rule enhancement architecture that leverages the generalization capabilities of deep learning while retaining the deterministic judgment of key business logic; (3) a closed-loop linkage response to achieve the integration of "detection-alarm-handling-evidence collection"; and (4) a modular design that can be flexibly adapted to different brands of ATMs, vault access control systems and sensor types. Attached Figure Description

[0017] Figure 1 This is a diagram of the overall system architecture.

[0018] Figure 2 This is a flowchart for multi-source data processing and fusion.

[0019] Figure 3 This is a schematic diagram of the exception detection logic state machine. Detailed Implementation

[0020] The following description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0021] The following embodiments can be understood as illustrating a part of the structure or method of the present invention individually, or as combining the embodiments to explain the broader structure or method of the present invention.

[0022] Example 1: Self-service financial service terminals and vault security facility anomaly detection systems, such as Figure 1 As shown, it includes: (1) Sensing end (front-end device layer): physical sensing units deployed in the target financial venue (such as bank branch self-service area, vault passage, equipment room); (2) Edge processing layer (local intelligent analysis node): Deployed near the branch office or equipment of the target financial venue, it consists of edge computing devices with AI inference capabilities (such as NVIDIA Jetson AGX Orin, Huawei Atlas 500) and undertakes the following functions: Receive and buffer the raw data stream from the sensing end; Perform data preprocessing, feature extraction, multimodal fusion, and preliminary anomaly detection; Even when the network is down or the cloud is unavailable, alarms and local linkages (such as audible and visual alarms and device locking) can still be completed independently. Supports OTA model upgrades and remote policy configuration; (3) Central management layer (cloud / platform side), including: Anomaly Management Center: Receives alarm events reported by each edge node, and performs aggregation, deduplication, and priority sorting; Evidence Management Module: Automatically packages associated evidence packages, which include video clips, sensor logs, timestamps, and confidence levels, and encrypts and stores the associated evidence packages in a secure database; Policy Configuration Center: Allows administrators to configure anomaly rules, alarm thresholds, and linkage actions by network location, device type, and time period. API Interface: Supports integration with existing bank security platforms, work order systems, and facial recognition whitelist databases.

[0023] Example 2: Based on Embodiment 1, the sensing end includes: (1) Video acquisition unit, including: At least two high-definition cameras (≥1080P, 30fps) should be used to cover the operational and environmental views respectively. Among them, the operating perspective is the front operating area of ​​the ATM, which is used to capture user behavior, face, and hand movements; Environmental perspective: Vault door, rear or top of ATM equipment compartment, used to monitor the status of the physical object being monitored, whether tools are approaching, whether there is smoke, etc. The high-definition camera supports H.265 encoding, low-light imaging, and wide dynamic range (WDR), making it suitable for nighttime or strong backlighting scenarios.

[0024] (2) A multi-source sensor unit, including: Door magnetic sensor: Installed on the ATM security compartment door or the main / secondary door of the vault, outputting a binary signal (open / closed) and duration; Temperature and humidity sensor: embedded inside the ATM equipment compartment, sampling frequency 1Hz, measuring temperature -10℃~+70℃, humidity 0~100%RH; Triaxial vibration sensor: Attached to the chassis or door frame of the ATM equipment to detect impact intensity (unit: g), the threshold can be configured as needed; Pyroelectric infrared sensor (PIR): Used to assist in determining the presence of people and reduce the risk of missed detection by purely visual means.

[0025] Optionally, the multi-source sensor unit further includes: Sound sensor: Picks up abnormal audio (such as impact, glass breaking), and extracts characteristic frequency band energy through FFT analysis; Synchronization module: All devices have a built-in hardware clock and synchronize with edge nodes via NTP (Network Time Protocol) or PTP (Precision Time Protocol) to ensure timestamp error ≤ 50ms.

[0026] Example 3: Based on the above embodiments, the present invention also provides a method for detecting anomalies in self-service financial service terminals and vault security facilities, such as... Figure 1-3 As shown, it includes the following steps: S1. Data acquisition and synchronization; S2, Multimodal Feature Extraction; S3, Dual-channel fusion and determination; S4, rule engine enhancements and final output; S5, alarm generation and intelligent linkage response.

[0027] Example 4: Based on Embodiment 3, step S1 includes: performing time alignment and spatial alignment on the acquired video stream data and multi-source sensor data stream, wherein time alignment includes: Each video frame is appended with a UTC microsecond-level timestamp t_v; Each sensor event is appended with a timestamp t_s; Edge nodes maintain a sliding time window (default width 200ms) and bind video frames that satisfy |t_v - t_s| leq Deltat, where Deltat = 100ms, to sensor events to form an "event group". Spatial alignment includes: during the system initialization phase, establishing a physical-visual mapping table through configuration files or a graphical interface, for example: { "sensor_id": "DOOR_MAG_07", "location": "Right door of ATM-07 protective cabin", "video_channel": "CAM_03", "roi": {"x1": 420, "y1": 180, "x2": 620, "y2": 380} }

[0028] When the door sensor triggers the "open" event, the system only analyzes the visual content of the specified ROI area in CAM_03, avoiding the computational waste caused by full-screen scanning.

[0029] Example 5: Based on Example 3, step S2 includes: video feature extraction and sensor information feature extraction based on a lightweight deep learning model.

[0030] In step S2, video feature extraction includes: 211) Object Detection: Using an improved YOLOv8s model, real-time (≥25 FPS) detection of the following categories is achieved on edge devices: person, hand, face, tool (such as screwdriver, crowbar), smoke, open door, blocked camera; 212) Behavior Recognition: Based on detection, a lightweight SlowFast network or TimeSformer is used to perform temporal modeling on 16 consecutive frames, outputting high-level semantic labels, such as: "normal_withdrawal" (normal withdrawal); "prying_door" (pry open the door); "loitering" (staying for more than 3 minutes); "covering_face" (covering the face); 213) Face recognition and authorization verification: Extract the face feature vector (512 dimensions) and compare it with the local cached whitelist of authorized personnel (such as maintenance personnel and security guards) using cosine similarity, with the threshold set to 0.65.

[0031] Sensor information feature extraction includes: 221) After filtering and denoising, the original signal is converted into a structured state vector mathbf{S} in mathbb{R}^d, for example: mathbf{S} = [ text{door_open}=1, text{temp}=42.3, text{humidity}=86, text{vibration_peak}=2.8g, text{pir_active}=0, text{hour}=2, text{weekday}=4 ]; 223) Simultaneously calculate derived features such as "door opening duration", "temperature and humidity change rate", and "vibration frequency / minute" to enhance the discrimination ability.

[0032] Example 6: Based on Example 3, step S3 adopts a "dual-channel fusion + rule enhancement" architecture, which balances model generalization and business interpretability, including: 311) Feature-level fusion and channel fusion: The video behavior feature vector mathbf{V} in mathbb{R}^{128} (from the last layer of SlowFast) is concatenated with the sensor vector mathbf{S} to form the joint feature mathbf{F} = [mathbf{V}; mathbf{S}]. Input a 3-layer MLP or a small Transformer encoder and output the anomaly probability P_{text{fusion}} in[0,1].

[0033] 312) Decision-level integration channel integration: Video decision branch: Calculate the score S_v based on preset behavior rules, for example: If "prying_door" is detected, then S_v = 0.95; If "loitering" is not during business hours, then S_v = 0.8; Sensor decision branch: Calculate the risk score S_s based on the threshold and historical baseline, for example: Temperature > 40℃ and humidity > 80% → S_s = 0.85; Vibration peak > 2.5g for 3 seconds → S_s = 0.9; Final decision score: S_{text{final}} = beta cdot P_{text{fusion}} + (1 - beta) cdot left(gamma S_v + (1 - gamma) S_s right); The values ​​of beta and gamma in [0,1] can be configured by the administrator (default beta=0.6, gamma=0.5).

[0034] Example 7: Based on Example 3, such as Figure 3 As shown, step S4 includes: The system has a built-in exception rule library that overrides model outputs in a priority manner.

[0035] Typical rules are shown in the table below:

[0036] When any rule condition is met, the system directly triggers the corresponding alarm without waiting for the fusion score threshold to be determined.

[0037] Example 8: Based on Example 3, such as Figure 3 As shown, step S5 includes: Tiered alarm mechanism: Warning (yellow): Low-risk events such as abnormal environmental parameters or doors not being closed will only be logged and the operations and maintenance department will be notified. Severe (Orange): Unauthorized operation, equipment failure risk; related functions will be locked, and an app alert will be sent. Emergency (Red): Violent intrusion, fire risk, triggering audible and visual alarms, automatically dialing security numbers, and uploading evidence to the monitoring platform.

[0038] Evidence is automatically saved: The system automatically generates an "anomaly evidence package," which includes: Video clip (5 seconds before the event + 10 seconds after, H.265 encoded); Sensor raw logs (CSV format, with timestamps); Anomaly type, confidence level, trigger rule ID, device location information; Cryptographic hash value (used for tamper-proof verification).

[0039] Equipment linkage control: Implement this via Modbus TCP, RS485, or vendor SDK interfaces: ATM transaction pause / resumption; The vault door's electromagnetic lock is forced to close. Activate the local audible and visual alarm; Switch the camera to close-up mode.

[0040] Example 9: Based on the above embodiments, the method further includes fault-tolerant and robust design, as detailed below: Sensor failure degradation: If a certain type of sensor goes offline (such as a door sensor failure), the system automatically increases the weight of video analysis (adjusts beta) and marks it as "partial perception loss"; Network outage handling: Edge nodes locally cache the raw data of the last 24 hours and retransmit it after the network is restored; Privacy protection: Facial features are used only for local comparison, and the original image is desensitized at the edges (e.g., blurring unauthorized faces) before being uploaded; Model update mechanism: Supports incremental learning, using newly labeled false positive / false negative samples to fine-tune the edge model online.

[0041] It should be noted that: The technical solution of this invention has good scalability and flexibility, and there are multiple reasonable alternative implementation methods. For example, at the data fusion level, a graph neural network (GNN) can be used to model video targets and sensor nodes as a heterogeneous graph, and more fine-grained association reasoning can be achieved through message passing; in terms of feature extraction, a Vision Transformer (ViT) can be used to replace the CNN structure to improve the ability to model long-term behavior. The sensor combination can also be expanded, such as introducing a sound sensor to identify impacts or cries for help, or connecting a current / voltage monitoring module to determine whether the equipment has been illegally powered off or the power supply line has been tampered with.

[0042] In terms of deployment architecture, if edge computing power is limited, some fusion computing can be migrated to the cloud, adopting a two-tier model of "edge initial screening + cloud-based fine judgment." Conversely, in high-security locations (such as central bank vaults), it can be deployed entirely locally, disabling external network communication to meet the requirement that data does not leave the domain. Furthermore, the anomaly rule base can be upgraded from manual configuration to automatic mining based on historical alarm data (such as using the Apriori association rule algorithm) to achieve self-evolution of rules. All the above variations do not deviate from the core idea of ​​this invention—"multi-source perception-collaborative analysis-intelligent response"—and should be considered equivalent replacements within the scope of protection of this invention.

Claims

1. An anomaly detection system for self-service financial service terminals and vault security facilities, characterized by: include: (1) Sensing end: Physical sensing units deployed in the target financial venue; (2) Edge processing layer: Deployed near the branch office or equipment of the target financial institution, it consists of edge computing devices with AI inference capabilities and undertakes the following functions: Receive and buffer the raw data stream from the sensing end; Perform data preprocessing, feature extraction, multimodal fusion, and preliminary anomaly detection; Independently handle alarms and local linkage when the network is down or the cloud is unavailable; Supports OTA model upgrades and remote policy configuration; (3) The central management team, including: Anomaly Management Center: Receives alarm events reported by each edge node, and performs aggregation, deduplication, and priority sorting; Evidence Management Module: Automatically packages associated evidence packages, which include video clips, sensor logs, timestamps, and confidence levels, and encrypts and stores the associated evidence packages in a secure database; Policy Configuration Center: Allows administrators to configure anomaly rules, alarm thresholds, and linkage actions by network location, device type, and time period. API Interface: Supports integration with existing bank security platforms, work order systems, and facial recognition whitelist databases.

2. The self-service financial service terminal and vault security facility anomaly detection system as described in claim 1, characterized in that, The sensing end includes: (1) Video acquisition unit, including: At least two high-definition cameras, one covering the operational view and the other the environmental view: Among them, the operation perspective is used to capture user behavior, face, and hand movements; Environmental perspective: Used to monitor the state of the detected physical object; The high-definition camera supports H.265 encoding, low-light imaging, and wide dynamic range, making it suitable for nighttime or strong backlight scenarios. (2) A multi-source sensor unit, including: Door magnetic sensor: Installed on the ATM security door or the main / secondary door of the vault, outputting a binary signal and duration; Temperature and humidity sensor: embedded inside the ATM equipment compartment, sampling frequency 1Hz, measuring temperature -10℃~+70℃, humidity 0~100%RH; Triaxial vibration sensor: Attached to the chassis or door frame of the ATM equipment to detect impact intensity; the threshold can be configured as needed. Infrared pyroelectric sensor: Used to assist in determining the presence of people and reduce the risk of missed detection by purely visual methods.

3. The self-service financial service terminal and vault security facility anomaly detection system as described in claim 2, characterized in that, The multi-source sensor unit further includes: Sound sensor: Picks up abnormal audio and extracts characteristic frequency band energy through FFT analysis; Synchronization module: All devices have a built-in hardware clock and synchronize with the edge nodes via NTP or PTP to ensure that the timestamp error is ≤ 50ms.

4. A method for detecting anomalies in self-service financial service terminals and vault security facilities, characterized by: The detection method, implemented using the system described in any one of claims 1-3, includes the following steps: S1. Data acquisition and synchronization; S2, Multimodal Feature Extraction; S3, Dual-channel fusion and determination; S4, rule engine enhancements and final output; S5, alarm generation and intelligent linkage response.

5. The method for detecting anomalies in self-service financial service terminals and vault security facilities as described in claim 4, characterized in that, Step S1 includes: performing time alignment and spatial alignment on the acquired video stream data and multi-source sensor data stream, wherein time alignment includes: Each video frame is appended with a UTC microsecond-level timestamp t_v; Each sensor event is appended with a timestamp t_s; Edge nodes maintain a sliding time window and bind video frames that satisfy |t_v - t_s| leq Delta t, where Delta t = 100ms, with sensor events to form event groups; Spatial alignment includes: during the system initialization phase, establishing a physical-visual mapping table through configuration files or a graphical interface.

6. The method for detecting anomalies in self-service financial service terminals and vault security facilities as described in claim 4, characterized in that, Step S2 includes: video feature extraction and sensor information feature extraction based on a lightweight deep learning model; Preferably, in step S2, the video feature extraction includes: 211) Object Detection: Using an improved YOLOv8s model, real-time detection of the following categories is achieved on edge devices: People, hands, faces, tools, smoke, doors opening, and cameras being obstructed; 212) Behavior recognition: Using a lightweight SlowFast network or TimeSformer, perform temporal modeling on 16 consecutive frames and output high-level semantic labels; 213) Face recognition and authorization verification: Extract facial feature vectors and compare them with the cosine similarity of the locally cached authorized personnel whitelist; The sensor information feature extraction includes: 221) The original sensor signal is converted into a structured state vector after filtering and noise reduction; 222) Calculate derived features based on sensor signals to enhance discrimination capabilities.

7. The method for detecting anomalies in self-service financial service terminals and vault security facilities as described in claim 4, characterized in that, Step S3 includes: 311) Feature-level fusion and channel fusion: The video behavior feature vector and the sensor vector are concatenated to form a joint feature; Then input it into a 3-layer MLP or a small Transformer encoder to output the anomaly probability; 312) Decision-level fusion channel fusion: The final decision score is obtained through video decision branches and sensor decision branches.

8. The method for detecting anomalies in self-service financial service terminals and vault security facilities as described in claim 4, characterized in that, Step S4 includes: the system has a built-in exception rule library, which covers the model output in a priority manner.

9. The method for detecting anomalies in self-service financial service terminals and vault security facilities as described in claim 4, characterized in that, Step S5 includes: 511) Tiered alarm mechanism; 512) Automatic evidence retention: 513) Equipment linkage control.

10. The method for detecting anomalies in self-service financial service terminals and vault security facilities as described in claim 4, characterized in that, The method also includes fault-tolerant and robust design, specifically: Sensor failure degradation: If a certain type of sensor goes offline, the system automatically increases the weight of video analysis and marks it as "partially missing perception"; Network outage handling: Edge nodes locally cache the raw data of the last 24 hours and retransmit it after the network is restored; Privacy protection: Facial features are used only for local comparison, and the original image is anonymized at the edges before being uploaded; Model update mechanism: Supports incremental learning, using newly labeled false positive / false negative samples to fine-tune the edge model online.

Images