A multi-scene plug-and-play intelligent security recognition algorithm deployment method

Abstract

This invention relates to the field of intelligent security technology, specifically to a multi-scenario plug-and-play intelligent security identification algorithm deployment method, comprising the following steps: constructing a pseudo-trigger constraint set corresponding to the target scenario; generating a scenario-immune deployment body corresponding to the security identification algorithm to be deployed; and implementing pseudo-trigger filtering on the running output to obtain effective identification results; establishing alarm output rules under the target scenario based on the effective identification results, and connecting the effective identification results that conform to the alarm output rules to the formal alarm link; when repetitive abnormal alarms occur in the formal alarm link, locally correcting the corresponding pseudo-trigger constraint set, and synchronously updating the scenario-immune deployment body. Compared with traditional methods that rely on model training or simple threshold filtering, this invention can accurately identify and target structural interferences with stable reproducibility characteristics, such as tree shadow swaying, light reflection, and periodic flickering.

Description

Technical Field

[0001] This invention relates to the field of intelligent security technology, and in particular to a multi-scenario plug-and-play intelligent security identification algorithm deployment method. Background Technology

[0002] With the development of video surveillance and artificial intelligence recognition technologies, security recognition algorithms have been widely applied in scenarios such as intrusion detection, target recognition, and behavior analysis, and are gradually evolving towards a plug-and-play deployment model. This involves directly loading pre-trained general recognition algorithms onto execution nodes in different monitoring scenarios to reduce deployment costs and improve system deployment efficiency. However, in practical applications, it has been found that the performance of the same security recognition algorithm varies significantly in different scenarios. Especially when deploying plug-and-play in new scenarios, although the algorithm itself can load and run normally, it often inherits the long-standing false alarm triggering habits of that scenario, resulting in a continuous output of a large number of false alarms after the system goes live, which seriously affects the availability and reliability of the system.

[0003] So-called false alarm triggering habits refer to a type of false triggering pattern with stable recurring characteristics that forms over a long period of time in a specific monitoring scenario due to factors such as environmental structure, changes in lighting, or object movement. For example, in monitoring points near trees, the swaying shadows created by leaves blowing in the wind may be misinterpreted by the recognition algorithm as human movement, thus repeatedly triggering intrusion alarms. Similarly, in scenarios with glass curtain walls or many reflective surfaces, light reflections at specific times may create image features resembling human shadows, which may be mistakenly identified as target objects by the algorithm. These triggers are typically characterized by stable repetition, triggering the same type of alarm, and not corresponding to real security events. Over time, this forms an inherent pattern of "conditional triggering equals false alarm" in the scenario.

[0004] In existing technologies, optimization methods typically address the aforementioned issues by increasing the detection threshold, adding post-processing filtering rules, or retraining the model. However, these methods have significant shortcomings: Firstly, simply increasing the threshold or adding general filtering rules is insufficient for fine-grained suppression of structural interference in specific scenarios, easily introducing false negatives while reducing false alarms. Secondly, re-collecting data and retraining the model is time-consuming, costly, and difficult to adapt to constantly changing interference patterns in different scenarios. Furthermore, most existing solutions lack the ability to model "inherent false triggering patterns of the scenario," failing to extract reproducible interference features from false alarms or continuously learn and dynamically correct newly emerging false triggering patterns during system operation. Summary of the Invention

[0005] This invention provides a multi-scenario plug-and-play intelligent security identification algorithm deployment method. During the plug-and-play deployment of the security identification algorithm, it effectively identifies and suppresses the inherent false alarm triggering habits in the target scenario, avoids the algorithm inheriting the structural false triggering patterns in the scenario, and realizes online adaptive correction of newly emerging false alarms. This has become a technical problem that urgently needs to be solved in the field of intelligent security deployment.

[0006] A method for deploying a multi-scenario plug-and-play intelligent security identification algorithm includes the following steps: S1. Identify the inherent false triggering factors in the target scene that can repeatedly induce false alarms, and construct the false triggering constraint set corresponding to the target scene; S2. Based on the pseudo-trigger constraint set, the security identification algorithm to be deployed is constrained and encapsulated to generate the scene immune deployment body corresponding to the security identification algorithm to be deployed; S3. Load the scene immunity deployment body into the execution node of the target scene for plug-and-play operation, and perform pseudo-trigger filtering on the running output to obtain effective identification results; S4. Based on the effective identification results, establish alarm output rules for the target scenario, and connect the effective identification results that conform to the alarm output rules to the formal alarm link; S5. When a recurring abnormal alarm occurs in the formal alarm chain, the corresponding pseudo-trigger constraint set is locally corrected, and the scenario immunity deployment body is updated synchronously.

[0007] Optionally, the target scenario includes alarm data streams and video frame sequences. The original alarm data streams and synchronized video frame sequences of the target scenario within a preset historical period are collected. The original alarm data streams are tagged and classified, events labeled as real alarms are filtered out, and a set of events labeled as false alarms is extracted.

[0008] Optionally, the set of false alarm events is spatiotemporally aligned with the corresponding video frame sequence, and the aligned video frame images are decoupled from their multi-dimensional features to identify common background environmental factors or periodic interference factors that are independent of the target to be identified, and these are marked as scene pseudo-trigger factors. The scene pseudo-trigger factors are then structured and encoded according to a preset rule template to generate the pseudo-trigger constraint set, which includes matching conditions and interception actions.

[0009] Optionally, the pseudo-trigger constraint set is parsed and converted into a machine-readable filtering logic expression; the filtering logic expression is encapsulated into an independent preprocessing filter, which is deployed at the input end of the security identification algorithm to be deployed; the preprocessing filter is coupled with the security identification algorithm to be deployed through code injection, configuration mounting or service orchestration to form an executable program unit or container image with pseudo-trigger shielding capability, which serves as the scene immunity deployment body.

[0010] Optionally, the scenario immunity deployment body distributes execution nodes to the target scenario, and the deployment agent of the execution node automatically completes environment adaptation and process startup to achieve plug-and-play operation; it obtains the original recognition results of the security recognition algorithm to be deployed on the scenario data in real time, and synchronously collects the real-time metadata of the current scenario.

[0011] Optionally, the real-time metadata is used to perform matching calculations with each constraint condition in the pseudo-trigger constraint set; If any constraint condition is matched, the corresponding original recognition result will be marked as a false trigger and intercepted and discarded. If no constraint is matched, the corresponding original recognition result will be output as a valid recognition result.

[0012] Optionally, the establishment of the alarm output rules specifically includes: Collect the valid recognition results within a preset time window, and extract the timestamp, target category, and spatial coordinate information of each valid recognition result; Statistical analysis is performed on the timestamp, target category, and spatial coordinate information to generate alarm time distribution characteristics, alarm category distribution characteristics, and alarm spatial distribution characteristics in the target scene; Based on the alarm time distribution characteristics, an alarm suppression period or alarm frequency threshold is set; based on the alarm category distribution characteristics, a confidence threshold for different target categories is set; based on the alarm spatial distribution characteristics, a spatial aggregation radius and an aggregation time window are set; and the alarm suppression period, alarm frequency threshold, confidence threshold, spatial aggregation radius, and aggregation time window are combined into an alarm output rule.

[0013] Optionally, the alarm output rules are mounted to the output module of the scenario immunity deployment body in the form of configuration files or policy scripts. The output module verifies and aggregates the valid identification results generated in real time according to the alarm output rules, encapsulates the valid identification results that pass the verification and meet the aggregation conditions into standard alarm events, and pushes them to the formal alarm link through a predefined alarm interface.

[0014] Optionally, the alarm event stream of the formal alarm link is monitored in real time, and abnormal alarms that recur within a preset time window and are confirmed as false alarms by manual or automatic verification are marked as repetitive abnormal alarms. Extract the original input data and corresponding scene metadata corresponding to the repetitive abnormal alarm, and compare and analyze them with the constraint items in the current pseudo-trigger constraint set. If no existing constraint item is matched, new scene pseudo-trigger factors are decoupled from the original input data through feature extraction.

[0015] Optionally, the new scenario pseudo-trigger factors are encoded according to a preset rule template to generate correction items, and the correction items are incrementally merged into the current pseudo-trigger constraint set to achieve local correction of the pseudo-trigger constraint set; Based on the revised pseudo-trigger constraint set, the constraint encapsulation process is re-executed to generate an incremental package of the scenario immune deployment body containing the revised logic; By implementing the hot update mechanism of the execution node, the incremental package of the scenario immunity deployment body is dynamically loaded into the running scenario immunity deployment body, completing the synchronous update without interruption.

[0016] The beneficial effects of this invention are: This invention constructs a set of pseudo-trigger constraints by reverse-analyzing historical false alarm events. This set is then transformed into executable matching condition functions and interception action functions in the form of rule templates. These are further encapsulated as preprocessing filters embedded in the input of the recognition algorithm, enabling pre-suppression of inherent interference factors in the scene. Compared to traditional methods relying on model training or simple threshold filtering, this invention can accurately identify and target structural interferences with stable reproducibility, such as tree shadow swaying, light reflection, and periodic flickering. This reduces false alarms at the source, avoids modifying the recognition model itself, and has stronger scene adaptability and engineering feasibility.

[0017] This invention, based on effective identification results, introduces a joint statistical analysis mechanism of temporal distribution features, category distribution features, and spatial distribution features to automatically generate a multi-dimensional alarm output rule system, including alarm frequency thresholds, category confidence thresholds, and spatial aggregation rules. By performing confidence verification, frequency suppression, and spatiotemporal aggregation processing on the identification results, it achieves structured integration of discrete detection results, avoiding repeated alarm flooding in a short period of time and multiple alarm outputs caused by the same interference source. Compared with the traditional detection-as-alarm method, it can improve the reliability, consistency, and business availability of alarm output.

[0018] This invention automatically identifies abnormal alarms that recur within a preset time window and are confirmed as false alarms by real-time monitoring of the alarm event stream in the formal alarm chain. When the existing set of pseudo-trigger constraints cannot match, it triggers a new process for extracting pseudo-trigger factors and generating rules, incrementally merging the new rules into the constraint set, and loading them into the running scenario immunity deployment body without interruption through a hot update mechanism. This enables online learning and continuous correction of the system's false alarm patterns. Compared to existing methods that require manual parameter tuning or offline retraining, this invention achieves selective updates and local evolution based on unmatched anomalies. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the deployment logic of an embodiment of the present invention; Figure 2 This is a schematic diagram of the deployment method according to an embodiment of the present invention. Detailed Implementation

[0021] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. For some well-known technologies, those skilled in the art may also use other alternative methods to implement the invention. Moreover, the accompanying drawings are only for more specific description of the embodiments and are not intended to specifically limit the present invention.

[0022] like Figures 1-2 As shown, a multi-scenario plug-and-play intelligent security identification algorithm deployment method includes the following steps: S1. Identify the inherent false triggering factors in the target scene that can repeatedly induce false alarms, and construct the false triggering constraint set corresponding to the target scene; S11, Collect target scene data within a preset historical period. Raw alarm data stream within and the video frame sequence synchronized with it in time Among them, the original alarm data stream This includes alarm timestamps, alarm type tags, alarm trigger locations, and video frame sequences. This includes continuously sampled video image frames and their corresponding time markers.

[0023] S12, for the raw alarm data stream Perform tag classification processing and construct alarm tag functions: ;in, Indicates the first One alarm event; Based on the alarm labeling function, events labeled as true alarms are filtered out, and a set of events labeled as false alarms is extracted: ;in, This is the alarm labeling function, where 1 represents a valid alarm and 0 represents a false alarm. A posterior event matching-based determination is used for each alarm event. The system checks if a corresponding real event record exists within the time window of the alarm's occurrence. If a matching event exists, such as manual confirmation, system record, or alarm handling record, it is determined to be a real alarm. If no matching event exists, it is determined to be a false alarm.

[0024] S13, deducing the scene factors that repeatedly induce false alarms from false alarms, and identifying stable interference patterns that are unrelated to the target and recur multiple times.

[0025] S131, after obtaining false alarms, it is necessary to find out exactly what happened in the video when the false alarm occurred. Taking the time of the false alarm as the center, a small time window is taken forward and backward, and all the video frames in the time window are extracted, so that each false alarm event corresponds to a small video segment subsequence, that is, the set of false alarm events. With the corresponding video frame sequence Perform spatiotemporal alignment and construct an alignment mapping function: This formula represents a false alarm event. Mapped to a video segment before and after it occurred; where, For the event The time of occurrence, For time-aligned windows; For each false alarm event Extract the video frame subsequence within its corresponding time window: This formula represents extracting all video frames within this time interval to form a small video clip; where, Represents a video frame; S132, a video typically contains a mixture of real targets, background environment, and interference factors. These three types of information, i.e., the features of the same frame, are decomposed into target-related components, background components, and noise / interference components. The background component is inherent to the scene, while the noise / interference component represents sources of false triggers. Therefore, for video frame subsequences... Perform multi-dimensional feature decoupling processing and construct the feature decomposition expression: This formula indicates that the information of a frame of image is divided into three parts; among which, This represents the feature representation of a video frame. Represents the target-related feature components, Represents background environmental feature components. This represents the interfering feature components; multi-dimensional feature decoupling processing includes using the YOLO object detection model to extract ROI region features. Then, background feature extraction is performed, the target region is removed, and texture (LBP), lighting, and edges are extracted from the remaining region to obtain... Finally, through interference feature extraction, inter-frame difference or frequency domain analysis is used to obtain... .

[0026] S133, perform cluster consistency analysis on the feature components corresponding to all false alarms, and identify feature components that meet the following conditions: This formula indicates that among all background or interference features, there exists a certain type of feature that repeatedly appears in different false alarm events and is highly similar to each other. This indicates that among the two categories of features, background features and interference features, there exists a certain feature. , This means that the condition holds true for all different combinations of false alarm events; And it satisfies the independence constraint: The goal is to identify whether all false alarms have anything in common. However, even if certain features appear repeatedly, they are not necessarily false triggers. They may be part of the target. This feature must have a very weak relationship with the target. Only the true false triggers of the scene are left. Therefore, the above filtering was also performed. Cluster consistency analysis involves mapping the background and interference feature components extracted from the video frame sub-sequences corresponding to all false alarm events to the same feature space, constructing a candidate feature sample set. Next, unsupervised clustering is performed based on the candidate feature sample set, preferably using density clustering (which is insensitive to cluster shape and can identify high-frequency repetition patterns) or distance-based clustering, automatically grouping samples with similar feature expressions into several feature clusters. Then, consistency evaluation is performed on each feature cluster, specifically by calculating the average similarity between any feature pairs within the cluster and the event coverage rate of the feature occurrences, to determine whether the feature cluster stably repeats in multiple false alarm events. When a feature cluster simultaneously satisfies both "intra-cluster similarity higher than a preset similarity threshold" and "the proportion of false alarm events covered exceeds a preset proportion threshold," it is determined that the feature cluster possesses cross-event consistency and stable reproducibility characteristics. Finally, the central or representative features corresponding to all feature clusters that meet the consistency criteria are extracted as candidate pseudo-triggering factors and input into the subsequent independence constraint discrimination stage for further screening.

[0027] S134, mark the feature components that meet the above conditions as the set of scene pseudo-triggering factors: ; in, Indicates candidate spurious trigger features, The feature similarity function is represented by cosine similarity. This indicates that the same feature is very similar across different false alarms. The similarity threshold is set between 0.7 and 0.9, with 0.8 being the preferred value. The correlation function is the Pearson correlation coefficient, used to determine whether there is a linear correlation. This indicates that the feature has a very weak correlation with the target feature, meaning it is not the target itself. The correlation threshold is set to a value between 0.2 and 0.4, with 0.3 being preferred. This is a set of pseudo-triggering factors for the scene.

[0028] S14, the aforementioned S11 to S13 complete the identification of false triggering factors from false alarms, set the matching condition function to transform the false triggering factors into a rule that can be judged, and set the interception action function to further transform the rule into an executable processing strategy.

[0029] Set of scene pseudo-trigger factors Structured coding is performed according to a preset rule template to generate a set of pseudo-trigger constraints. Each constraint term is represented as: ; Matching condition function Used to determine whether the input features meet the pseudo-triggering pattern and to intercept action functions. Used to perform suppression or correction operations on inputs that meet the conditions; The final set of pseudo-trigger constraints is obtained: ; This represents the number of constraint terms.

[0030] Each pseudo-trigger constraint in the rule template is encoded using a unified template: Rule Template = Matching Condition + Interception Action + Auxiliary Control. The rule template consists of the following fields: 1. Basic Identifier Fields: Rule Identifier ID, Scene Identifier, and Pseudo-Trigger Factor Type Identifier, including Reflection, Dynamic Disturbance, or Texture Misidentification, used for rule indexing and classification management.

[0031] 2. Matching condition field: Used to define when the rule is triggered, including: 2.1. Spatial Constraint Subfield: Triggering region coordinate range (ROI region) and relative positional relationship; 2.2. Appearance Feature Constraint Subfields: Feature vector template or cluster center and similarity threshold; 2.3. Temporal behavior constraint subfields: duration range, whether it has periodicity, and the magnitude of inter-frame variation; 2.4. Environmental status constraint subfields: light variation range, weather conditions, and time period; 2.5. Target Independence Constraint Subfields: Spatial overlap threshold with the target detection box, correlation threshold with target features; The above fields together form the structured expression basis of the matching condition function.

[0032] 3. Interception Action Field: Used to define how to process a match, including: 3.1. Action type field: alarm blocking, confidence decay, delayed confirmation, multi-frame review trigger, and feature suppression; 3.2. Action parameter fields: attenuation coefficient, delay frame count, continuity consistency threshold, and suppression strength parameter; 3.3. Scope field: The scope and target of the action constitute the execution description of the interception action function.

[0033] 4. Priority and Conflict Control Fields: Rule priority, whether they can be executed cumulatively, and conflict resolution strategies to prevent multiple rules from hitting at the same time and causing conflicts.

[0034] The specific content of the matching condition function is as follows: For each scene pseudo-trigger factor retained after cluster consistency analysis and independence constraint judgment, its corresponding structured description information is first extracted, and this structured description information is organized into executable judgment conditions. The structured description information includes at least the spatial occurrence area, temporal occurrence interval, motion change pattern, texture feature pattern, brightness fluctuation feature, frequency feature, and positional relationship constraint between the pseudo-trigger factor and the target detection box. When constructing the matching condition function based on the above structured description information, it can be stipulated that the corresponding pseudo-trigger factor is determined to be hit only when the candidate features extracted from the current input video frame or video frame segment simultaneously meet the following conditions: First, the spatial position of the candidate feature falls into the pre-recorded high-frequency false trigger area; Second, the similarity between the appearance feature or texture feature of the candidate feature and the corresponding pseudo-trigger factor template reaches a preset threshold or higher; Third, the temporal change pattern, flicker rhythm, periodic disturbance feature, or trajectory shape of the candidate feature is consistent with the repetition pattern in the historical samples of the pseudo-trigger factor; Fourth, the candidate feature does not meet the target association condition with the target feature to be identified, or it maintains a preset independence relationship with the target body region. The matching condition function is essentially a multi-condition joint judgment mechanism used to answer whether the characteristics of the current alarm trigger belong to a historically confirmed false triggering mode.

[0035] The specific content of the interception action function is as follows: When the matching condition function determines that the current input has hit a certain scene pseudo-trigger factor, it does not directly use the output result of the original security recognition algorithm, but instead calls the intervention action corresponding to the pseudo-trigger factor to perform targeted suppression, correction, or weight reduction processing on the current candidate alarm. Specifically, if the pseudo-trigger factor belongs to static interference types such as fixed background reflection, device edge shadow, lens stains, etc., the interception action function can perform area masking, confidence attenuation, or direct alarm blocking on the detection results in the corresponding area; if the pseudo-trigger factor belongs to dynamic interference types such as tree shadow swaying, rain and snow falling, periodic light flashing, advertising screen flickering, etc., the interception action function can perform time-series delay confirmation, continuous frame review, dynamic threshold enhancement, or multi-frame consistency secondary discrimination on the candidate results in the corresponding time window; if the pseudo-trigger factor belongs to feature-level interference types such as local texture misidentification, contour similarity misidentification, etc., the interception action function can suppress the feature response map of the corresponding candidate target, penalize its classification score, or forcibly trigger the supplementary verification process. In other words, the interception action function does not simply delete the result in one stroke, but selects the most appropriate suppression strategy according to the type of pseudo-triggering factor, so as to suppress false alarms and avoid causing false damage to real alarms as much as possible.

[0036] The process of obtaining the pseudo-trigger constraint set is as follows: First, for each identified scenario pseudo-trigger factor, a corresponding matching condition function and interception action function are established, and the two are encapsulated into a single constraint item according to a one-to-one correspondence. Each constraint item essentially represents which targeted interception or correction action should be executed when the input meets a certain pseudo-trigger pattern. Subsequently, the constraint items corresponding to all scenario pseudo-trigger factors under the same target scenario are summarized and uniformly arranged according to the pseudo-trigger factor type, priority, area of ​​effect, and applicable time conditions to form a pseudo-trigger constraint set for the target scenario. In other words, the pseudo-trigger constraint set is not a simple stack of several scattered rules, but a structured constraint set composed of multiple matching conditions and interception actions in pairs. This set can be directly called in the subsequent algorithm deployment and operation stages to target and suppress repetitive false triggering patterns in specific scenarios. In addition, each constraint item generated can be uniformly encoded into a standardized record structure that includes constraint identifier, applicable scenario identifier, matching condition field, action type field, action parameter field, and priority field. All standardized records can then be summarized and stored to obtain a set of pseudo-trigger constraints that can be directly loaded and used by the executable node.

[0037] S2. Based on the pseudo-trigger constraint set, the security identification algorithm to be deployed is constrained and encapsulated to generate the scene immune deployment body corresponding to the security identification algorithm to be deployed; S21, as described in S1, establishes a rule that executes a certain interception action if a certain condition is met. However, this rule is descriptive and cannot be directly executed. Therefore, it is necessary to transform the pseudo-triggering rule, i.e., the constraint set, into a logical program that the computer can directly execute. Each constraint item in the pseudo-triggering constraint set is a matching condition paired with an interception action. Therefore, for the pseudo-triggering constraint set... Perform item-by-item analysis, and analyze each constraint term. Converted into a machine-executable filtering logic expression, specifically represented as follows: ; This expression represents the processing method for the m-th rule on input data x: If the matching condition is met, a false trigger is detected, and the interception action is executed. ; If the condition is not met, then keep the original data. This represents the filtering logic expression corresponding to a single constraint, and is a computational logic unit that can be directly applied to the data.

[0038] The overall filtering function is obtained by representing all constraint terms in a set-like manner. ; This refers to the fusion of results from the collaborative action of multiple rules, that is, combining the processing results of all rules to form the final processing result. Specifically, for the input... Apply each in turn Record the processing result of each rule to obtain multiple candidate outputs: Priority fusion is adopted, with higher priority rules taking effect first, and subsequent rules being superimposed on them.

[0039] S22, based on the overall filtering function , Construct a preprocessing filter Its working process is represented as follows: This formula represents: input raw data New data is obtained by processing it through a preprocessing filter. ; Preprocessing filters are data filtering and correction modules deployed at the front end of the algorithm. They can be understood as input-side processing units built based on a set of pseudo-trigger constraints, used to perform matching judgments and interventions on data before it enters the recognition algorithm. When constructing preprocessing filters: 1. Input interface definition: Define the input data format as video frames or feature vectors; 2. Load the filtering logic: Load the content of S21, including all matching condition functions and all interception action functions; 3. Execute the logic framework each time data is input: Each rule is checked individually to determine whether a false trigger condition has been met. If the attack is successful, the corresponding interception action will be executed. If the match is not successful, keep the original data. 4. Output the processed data.

[0040] Pretreatment filter Encapsulate it as an independent plug-in module or microservice, and deploy it on the security recognition algorithm to be deployed. The input terminals form a pre-processing structure: ; in, The input data includes video frames or feature representations. The filtered input data, To identify the output results.

[0041] S23, Coupled Construction and Scenario-Immune Deployment Body Generation: Preprocessing filters are generated through code injection, configuration mounting, or service orchestration. With the security identification algorithm to be deployed By coupling the components and constructing a composite execution structure, this structure is encapsulated into executable program units or container images, serving as a scenario-immune deployment entity. .

[0042] The core of this part is to integrate the constructed preprocessing filter and the existing security identification algorithm into a complete system unit that can be directly run, deployed, and delivered. The previous steps yielded a preprocessing filter module capable of identifying and suppressing false triggers, but this exists independently. Similarly, the existing security identification algorithm is also an independent module. Without integration, a practically usable immune identification system cannot be formed. Therefore, the filter and identification algorithm are connected in the operational flow, ensuring that data must first be processed by the filter before entering the identification algorithm, thus providing overall resistance to false triggers. Specifically, this can be achieved through code injection to insert filtering logic at the entry point of the existing algorithm; or through configuration mounting to specify the filtering module as a preprocessing node in the system configuration layer; or through service orchestration to link the filtering service and the identification service into a processing chain within a microservice or container architecture. After this processing, the entire system's execution flow becomes: input data first enters the filter for judgment and correction, then the processed result is sent to the identification algorithm for normal identification, and finally, the result is output, thus forming an immune-first, then identification mechanism.

[0043] A combined execution structure connects two originally independent processing modules according to a fixed data flow sequence, forming a unified execution unit. The input only needs to enter the system once, but the internal processing automatically completes the filtering and recognition stages sequentially. This structure can be understood as a serial processing structure or a nested function structure, where the filter output serves as the input to the recognition algorithm—an integrated execution form. The so-called coupling construction of a combined execution structure specifically involves establishing this data flow and call relationship at the software or system level. This prevents the filter and recognition algorithm from running independently, instead creating a call-bound relationship. This can be achieved by rewriting the data entry function in the main program, inserting intermediate processing nodes in the inference pipeline, or configuring request forwarding paths in the service gateway, ensuring that input data automatically flows through the filtering module before entering the recognition module, thus achieving coupling. The coupled system is then further engineered and packaged, for example, by compiling it into a directly executable program, or by encapsulating it along with its dependencies, configuration files, and runtime scripts into an image using container technology, enabling rapid deployment and startup on different servers or edge devices.

[0044] S3. Load the scene immunity deployment body into the execution node of the target scene for plug-and-play operation, and perform pseudo-trigger filtering on the running output to obtain effective identification results; S31, Deployment and Plug-and-Play Operation: Deploying Scenario-Immune Modules Execution nodes distributed to the target scenario For devices such as camera edge devices, industrial control computers, or security servers, the deployment agent of the execution node completes the environment adaptation and process launch. The deployment agent checks whether the device environment meets the operating requirements, automatically adjusts or supplements the operating environment and starts the program, calls the main program entry point, starts the recognition service, and uses the container engine to launch the corresponding image to automatically run the service. The startup content includes the preprocessing filter module, the security recognition algorithm module, and the data input interface, and then starts running.

[0045] S32, during the execution of the node, acquires the raw recognition results of the security recognition algorithm to be deployed in real time. And simultaneously collect real-time metadata of the current scene. , forming joint data pairs: ;in, This represents the original recognition result, including the detected target, the target location bounding box, the classification result label, and the confidence score. "Original" means the result has not yet undergone false trigger filtering or correction. Indicates time Real-time metadata, including time information, environmental status, lighting parameters, and device status. This represents the input data pair used for subsequent judgment.

[0046] S33, Constraint Matching Calculation: Real-time metadata With pseudo-trigger constraint set The matching conditions for each constraint term are calculated, and a matching determination function is constructed: ; in, This indicates the overall matching result, and its value is either 0 or 1.

[0047] During computation, the real-time metadata is first parsed in a structured manner, breaking it down into multiple computable feature dimensions, including: Time dimension: current moment, day / night cycle; Environmental dimensions: light intensity, weather conditions; Device status dimensions: camera shake, exposure parameters; And dynamic behavior dimensions: whether there are periodic changes, brightness fluctuation frequency; A standardized metadata feature vector is formed; at the same time, the matching conditions of each constraint item in the pseudo-trigger constraint set have been expressed as a set of computable decision sub-conditions during construction, such as whether it is in a specified time interval, whether the illumination falls within a certain threshold range, whether there is a specific frequency of flashing mode, whether the preset environmental combination state is met, etc.

[0048] In the actual calculation process, for each constraint, the current metadata features are compared with each decision sub-condition in that constraint: for interval-type conditions, it is determined whether the metadata falls within the corresponding numerical range; for enumeration-type conditions, it is determined whether the current state belongs to the specified category; for pattern-type conditions, it is determined whether the pattern is met by performing sliding window statistics or frequency estimation on continuous metadata; only when all sub-conditions in the constraint are satisfied simultaneously is the constraint considered to be matched. After calculating each constraint, the matching results of each constraint are summarized. If any constraint is matched, the current scene state is considered to meet the pseudo-trigger condition, and the overall matching result is output as a match; otherwise, it is a miss.

[0049] S34, Based on the matching result, perform classification processing on the original recognition result: ; in, The output is Ø, which represents an empty result, indicating that the recognition result was intercepted and discarded. This is the original recognition result. At that time, output the valid recognition result. .

[0050] That is, based on the judgment result of S33: If a false trigger occurs, discard. ; If it misses, keep .

[0051] S4. Based on the effective identification results, establish alarm output rules for the target scenario, and connect the effective identification results that conform to the alarm output rules to the formal alarm link; S41, within the preset time window Collect the valid recognition results and construct a set of valid recognition results: ;in, To effectively identify the result set, For the first Valid identification results For the corresponding timestamp, The preset time window is used; for security monitoring with high real-time requirements, 40-60 seconds is used, and for stable statistical alarm distribution characteristics, 1-5 minutes is used. Structured extraction is performed on each valid recognition result: ;in, For the target category, The spatial coordinates are determined by the center point or region location of the detection box. S42, Statistical Analysis of Distribution Characteristics: Based on the set of valid identification results, construct the time distribution function, category distribution function, and spatial distribution function: Time distribution function: ;Analyze the times when alarms are likely to occur;Among them, Indicates time interval Internal alarm count, This is an indicator function; it returns 1 if the condition is met, and 0 otherwise. This is a time sub-interval.

[0052] Category distribution function: ; Identify targets that are likely to be triggered; among them, Indicates category as The number of alarms, Indicates the first Category labels for each result This indicates a category index.

[0053] Spatial distribution function: ; Identify locations where alarms are likely to occur; among them, Indicates spatial location Alarm density within the neighborhood Indicates the first Spatial coordinates of the results Indicates The spatial neighborhood centered on it.

[0054] S43, Based on the aforementioned distribution characteristics, construct a set of alarm output rule parameters: S431, Time Inhibition Rule: To control when false alarms are likely to occur, the time distribution data identifies periods with a particularly high number of alarms. Therefore, limits are set for these high-frequency periods; for example, if alarms are too frequent during a certain time period, a maximum number of alarms allowed per unit time can be limited to prevent alarm spikes in a short period. Indicates the first A time interval, This represents the alarm frequency threshold for the corresponding time interval. It is set to 1.2-1.4 times the average number of alarms during that time period, allowing for normal fluctuations but suppressing abnormal outbreaks.

[0055] S432, Category Confidence Rule: Based on the category distribution, we already know which categories are more prone to false positives. For example, "people" is reliable, while "objects" is prone to false positives. Therefore, different confidence thresholds are set for different categories. For instance, 0.5 is sufficient for people, while ≥0.8 is required for objects. For categories prone to false positives, the judgment criteria are raised. Indicates the target category. The confidence threshold for this category is set based on the false alarm rate of the corresponding category. If there are many false alarms, the threshold is increased, and if there are few false alarms, the threshold is decreased. The threshold is set to 0.4 to 0.6 for stable categories and 0.7 to 0.9 for categories prone to false alarms, making it more difficult for suspicious categories to pass.

[0056] S433, Spatial Aggregation Rule: Based on spatial distribution, we already know which areas have dense alarms, which may be due to the same interference source. Therefore, results that are spatially close and temporally close are merged. For example, multiple consecutive detections at the same location are not treated as multiple alarms, but as one. Essentially, this is to prevent a single interference source from generating multiple duplicate alarms. The spatial aggregation radius is taken as 1 to 1.5 times the average size of the target, merging the same interference source into a single event. This indicates the aggregation time window, which is 3-5 seconds.

[0057] S434 combines the above rules into a unified alarm output rule: ;in, This is a set of alarm output rules, including time limits, category filtering, and spatial merging.

[0058] S44 takes the already filtered valid identification results, checks and merges them again according to the rules, and finally turns them into alarm events that are actually output to the outside world.

[0059] Specifically, the alarm output rules The configuration file or strategy script is attached to the output module of the scene immunity deployment body to perform rule verification and aggregation processing on the real-time generated valid recognition results: S441, Confidence check: ;in, This represents the set of results that passed the confidence level check. Indicates the confidence level of the recognition result. Indicates category The corresponding threshold.

[0060] S442, Frequency Suppression Check: ;in, Indicates time interval The number of alarms within, This corresponds to the frequency threshold.

[0061] S443, Spatial Aggregation Decision: ;in, Represents the spatial coordinates of the two recognition results. The spatial aggregation radius, For the corresponding timestamp, This indicates the aggregated time window.

[0062] S444, encapsulate the valid recognition results that meet the above conditions to obtain... , indicating the first Each alarm event is ultimately pushed to the formal alarm chain through a predefined alarm interface.

[0063] S5. When a recurring abnormal alarm occurs in the formal alarm chain, the corresponding pseudo-trigger constraint set is locally corrected, and the scenario immune deployment body is updated synchronously. S51, Repetitive Abnormal Alarm Identification: The purpose is to identify recurring alarms that have been confirmed as false alarms from the already output alarms.

[0064] Real-time monitoring of the alarm event stream in the formal alarm chain to obtain the alarm event set. Within the preset time window Internally, statistical analysis is performed on alarm events to identify abnormal alarm events that meet the repetitiveness criteria and are confirmed as false alarms by manual or automatic verification, thus constructing a set of repetitive abnormal alarms: ;in, This represents a set of repetitive abnormal alarms. Indicates the first Alarm event, This indicates that the alarm event occurred within the time window. Frequency of occurrence within a time window For high-frequency scenarios, the value is taken for 15-30 seconds; for low-frequency scenarios, the value is taken for 30-60 seconds. The threshold for determining repetitiveness is set to 1.5 times the average alarm frequency. This is the alarm verification label; a value of 0 indicates a false alarm.

[0065] S52, New Pseudo-Trigger Factor Identification: Targeting Repetitive Abnormal Alarm Sets Extract its corresponding original input data and corresponding scene metadata and with the current pseudo-trigger constraint set Each constraint term is matched and compared; when no constraint term can match the abnormal alarm, the abnormal alarm is determined to belong to the unmodeled pseudo-triggering mode. Based on this, the S13 method is used to perform feature decoupling processing on the original input data to extract background features or interference features that are irrelevant to the target and repeatedly appear in multiple abnormal alarms, as new scene pseudo-triggering factors.

[0066] S53, Correction Item Generation and Constraint Set Update: The purpose is to transform newly discovered false triggering patterns into a new rule and add it to the existing rule base.

[0067] The new pseudo-trigger factors of the scene are structured and encoded according to a preset rule template to generate corresponding correction items. The correction terms are then incrementally merged into the current pseudo-trigger constraint set to obtain the updated pseudo-trigger constraint set: ;in, For the updated set of pseudo-trigger constraints, For the original pseudo-trigger constraint set, For the newly generated constraint terms, This indicates an expansion of the rule set.

[0068] S54, based on the updated pseudo-trigger constraint set The constraint parsing and encapsulation process is re-executed to generate a preprocessing filter containing the newly added constraint logic, and a corresponding scenario-immune deployment incremental package is constructed. Incremental packages only contain newly added or modified constraint logic and its associated configuration.

[0069] S55, through the hot update mechanism of the execution node, dynamically loads the incremental package of the scenario immunity deployment body into the running scenario immunity deployment body, realizing the synchronous update process in the running state, which is represented as: ;in, This indicates the updated scenario-immune deployment entity. This refers to the deployment unit that was originally running. This is an incremental merging operation. During the update process, the original identification and filtering processes continue to run without interrupting the data processing chain, thus achieving online adaptive evolution of the pseudo-trigger constraint capability. The incremental merging operation integrates the newly added or modified parts into the original system without replacing the entire system. The specific process is as follows: S551, identify changes by first identifying new rules and old rules that need to be updated from the incremental package.

[0070] S552, Classification and processing: The new rule is added directly to the rule set; To modify a rule, you must first find the original rule, and then replace or update it. Unchanged rules remain unchanged.

[0071] S553, Update Filtering Logic: Update Matching Condition Function, Update Interception Action Function and Reload Rule Execution Structure.

[0072] S554, Synchronize to the running module: Synchronize the updated rules to the preprocessing filter, output module, and decision logic.

[0073] This invention encompasses any substitutions, modifications, equivalent methods, and solutions made within the spirit and scope of this invention. To provide the public with a thorough understanding of this invention, specific details are described in detail in the following preferred embodiments; however, those skilled in the art will fully understand the invention even without these details. Furthermore, to avoid unnecessary misunderstanding of the essence of this invention, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0074] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A multi-scenario plug-and-play intelligent security identification algorithm deployment method, characterized in that, Includes the following steps: S1. Identify the inherent false triggering factors in the target scene that can repeatedly induce false alarms, and construct the false triggering constraint set corresponding to the target scene; S2. Based on the pseudo-trigger constraint set, the security identification algorithm to be deployed is constrained and encapsulated to generate the scene immune deployment body corresponding to the security identification algorithm to be deployed; S3. Load the scene immunity deployment body into the execution node of the target scene for plug-and-play operation, and perform pseudo-trigger filtering on the running output to obtain effective identification results; S4. Based on the effective identification results, establish alarm output rules for the target scenario, and connect the effective identification results that conform to the alarm output rules to the formal alarm link; S5. When a recurring abnormal alarm occurs in the formal alarm chain, the corresponding pseudo-trigger constraint set is locally corrected, and the scenario immune deployment body is updated synchronously. Monitor the alarm event stream of the formal alarm link in real time, identify abnormal alarms that occur repeatedly within a preset time window and are confirmed as false alarms by manual or automatic verification, and mark them as repetitive abnormal alarms. Extract the original input data and corresponding scene metadata corresponding to the repetitive abnormal alarm, and compare and analyze them with the constraint items in the current pseudo-trigger constraint set. If no existing constraint item is matched, new scene pseudo-trigger factors are decoupled from the original input data through feature extraction.

2. The multi-scenario plug-and-play intelligent security identification algorithm deployment method according to claim 1, characterized in that, The target scenario includes alarm data streams and video frame sequences. The original alarm data streams and synchronized video frame sequences of the target scenario within a preset historical period are collected. The original alarm data streams are tagged and classified, events labeled as real alarms are filtered out, and a set of events labeled as false alarms is extracted.

3. The multi-scenario plug-and-play intelligent security identification algorithm deployment method according to claim 2, characterized in that, The set of false alarm events is spatiotemporally aligned with the corresponding video frame sequence. Multi-dimensional feature decoupling is performed on the aligned video frame images to identify common background environmental factors or periodic interference factors that are independent of the target to be identified, and these factors are marked as scene pseudo-triggering factors. The pseudo-triggering factors of the scenario are structured and encoded according to a preset rule template to generate the pseudo-triggering constraint set, which includes matching conditions and interception actions.

4. The multi-scenario plug-and-play intelligent security identification algorithm deployment method according to claim 1, characterized in that, The pseudo-trigger constraint set is parsed and converted into a machine-readable filtering logic expression; the filtering logic expression is encapsulated into an independent preprocessing filter, which is deployed at the input end of the security identification algorithm to be deployed; the preprocessing filter is coupled with the security identification algorithm to be deployed through code injection, configuration mounting or service orchestration to form an executable program unit or container image with pseudo-trigger shielding capability, which serves as the scene immunity deployment body.

5. The multi-scenario plug-and-play intelligent security identification algorithm deployment method according to claim 4, characterized in that, The scenario-immune deployment entity distributes execution nodes to the target scenario. The deployment agent of the execution node automatically completes environment adaptation and process startup, enabling plug-and-play operation. It also obtains the original recognition results of the security recognition algorithm to be deployed on the scenario data in real time and collects real-time metadata of the current scenario simultaneously.

6. The multi-scenario plug-and-play intelligent security identification algorithm deployment method according to claim 5, characterized in that, The real-time metadata is used to perform matching calculations with the various constraints in the pseudo-trigger constraint set; If any constraint condition is matched, the corresponding original recognition result will be marked as a false trigger and intercepted and discarded. If no constraint is matched, the corresponding original recognition result will be output as a valid recognition result.

7. The multi-scenario plug-and-play intelligent security identification algorithm deployment method according to claim 1, characterized in that, The establishment of the alarm output rules specifically includes: Collect the valid recognition results within a preset time window, and extract the timestamp, target category, and spatial coordinate information of each valid recognition result; Statistical analysis is performed on the timestamp, target category, and spatial coordinate information to generate alarm time distribution characteristics, alarm category distribution characteristics, and alarm spatial distribution characteristics in the target scene; Based on the alarm time distribution characteristics, an alarm suppression period or alarm frequency threshold is set; based on the alarm category distribution characteristics, a confidence threshold for different target categories is set; based on the alarm spatial distribution characteristics, a spatial aggregation radius and an aggregation time window are set; and the alarm suppression period, alarm frequency threshold, confidence threshold, spatial aggregation radius, and aggregation time window are combined into an alarm output rule.

8. The multi-scenario plug-and-play intelligent security identification algorithm deployment method according to claim 7, characterized in that, The alarm output rules are mounted to the output module of the scenario immunity deployment body in the form of configuration files or policy scripts. The output module verifies and aggregates the valid identification results generated in real time according to the alarm output rules. The valid identification results that pass the verification and meet the aggregation conditions are encapsulated into standard alarm events and pushed to the formal alarm link through the predefined alarm interface.

9. The multi-scenario plug-and-play intelligent security identification algorithm deployment method according to claim 1, characterized in that, The new scenario pseudo-trigger factors are encoded according to a preset rule template to generate correction items, and the correction items are incrementally merged into the current pseudo-trigger constraint set to achieve local correction of the pseudo-trigger constraint set. Based on the revised pseudo-trigger constraint set, the constraint encapsulation process is re-executed to generate an incremental package of the scenario immune deployment body containing the revised logic; By implementing the hot update mechanism of the execution node, the incremental package of the scenario immunity deployment body is dynamically loaded into the running scenario immunity deployment body, completing the synchronous update without interruption.

Images