Tailing behavior recognition method and system based on large language model

Abstract

The application relates to a tailing behavior recognition method and system based on a large language model, which obtains anonymized event data occurring in a target scene; performs service role type inference on personnel in the anonymized event data to obtain a role inference result; generates anonymized event text based on the anonymized event data and the role inference result; inputs the anonymized event text into a preset large language model, performs semantic understanding on tailing behavior, and obtains a semantic analysis result; constructs a risk feature set based on the anonymized event data, the role inference result and the semantic analysis result; inputs the risk feature set into a preset risk prediction model to obtain a tailing behavior recognition result, solves the problem of privacy leakage in existing tailing behavior recognition, and improves prediction accuracy on the basis of avoiding privacy infringement in combination with role type inference, anonymized semantic analysis and tailing recognition in a complex open management scene.

Description

Technical Field

[0001] This application relates to the field of security monitoring technology, and in particular to a tailing behavior recognition method and system based on a large language model. Background Technology

[0002] In the current urbanization process, most residential communities, office parks, and commercial complexes generally adopt open or semi-open management models to balance traffic efficiency and convenience. However, while this management approach enhances convenience, it also brings significant security risks. Due to numerous entrances and exits and extremely high personnel mobility, unauthorized personnel can easily infiltrate internal areas, leading to frequent security incidents such as theft, harassment, and even physical assault. How to effectively identify and manage potentially risky individuals while ensuring free movement of people has become a core challenge that urgently needs to be addressed in the field of smart community and park security.

[0003] Existing tracking and identification technologies typically rely on the direct collection and analysis of a person's biometric characteristics. For example, high-definition cameras capture facial images, sensors record gait characteristics or voice information, and the real-time data is compared with a pre-entered database to determine the person's identity. However, these technologies directly process and store a person's raw biometric information during the identification process. This information is unique and immutable; any leakage during transmission, storage, or comparison will cause irreversible damage to personal privacy.

[0004] There is currently no effective solution to the high risk of privacy breaches associated with tailing behavior recognition in related technologies. Summary of the Invention

[0005] This embodiment provides a tailing behavior recognition method and system based on a large language model to address the high privacy leakage risk in related technologies.

[0006] Firstly, this embodiment provides a tailing behavior recognition method based on a large language model, including:

[0007] Obtain anonymized event data that occurs within the target scenario;

[0008] Service role type inference is performed on the personnel in the anonymized event data to obtain the role inference results;

[0009] Anonymous event text is generated based on the anonymized event data and the role inference results; the anonymized event text is input into a preset large language model, and semantic understanding is performed on the tailing behavior to obtain semantic analysis results;

[0010] A risk feature set is constructed based on the anonymized event data, the role inference results, and the semantic analysis results; the risk feature set is input into a preset risk prediction model to obtain the tailing behavior identification results.

[0011] In some embodiments, service role type inference is performed on the personnel in the anonymized event data to obtain role inference results, including:

[0012] Behavioral feature vectors are extracted from the anonymized event data, and preliminary matching of the roles of visitors is performed based on the behavioral feature vectors to obtain preliminary prediction results; the roles of visitors include service roles and unknown roles; the service roles include couriers, food delivery workers, and cleaners;

[0013] Based on the temporary anonymous identifier associated with the anonymized event data, historical tracking information within a preset period is obtained, and the preliminary prediction result is corrected based on the historical tracking information to obtain the role inference result; the temporary anonymous identifier is generated from the information of the mobile device carried by the visitor.

[0014] In some embodiments, the roles of visitors are initially matched based on the behavioral feature vectors to obtain preliminary prediction results, including:

[0015] Obtain a pre-stored role template; the role template includes feature vectors of service roles.

[0016] Calculate the similarity between the behavioral feature vector and the character template;

[0017] Based on the maximum similarity, a match is made with the character template to obtain a preliminary prediction result of the character type.

[0018] In some embodiments, the preliminary prediction result is revised based on the historical tracking information to obtain a role inference result, including:

[0019] Based on the historical tracking information, the frequency of occurrence of the temporary anonymous identifier in different time periods and locations is statistically analyzed to generate an access heat map;

[0020] Spatiotemporal clustering analysis is performed on the access heat map. If the temporary anonymous identifier meets the clustering conditions corresponding to regular visitors, and the preliminary prediction result corresponding to the temporary anonymous identifier is the service role, then the confidence of the service role is increased to update the role inference result.

[0021] If the preliminary prediction result corresponding to the temporary anonymous identifier is the unknown role, calculate the total number of visits and the average stay time of the unknown role based on the access heat map; if the total number of visits and the average stay time meet the access rules of the service role, modify the unknown role to the service role to update the role inference result.

[0022] In some embodiments, anonymized event text is generated based on the anonymized event data and the role inference results; the anonymized event text is input into a preset large language model, and semantic understanding is performed on the tailing behavior to obtain semantic analysis results, including:

[0023] Obtain a first prompt template for tailgating behavior analysis, and input the anonymized event data and the role inference result into the first prompt template to obtain the first event text;

[0024] The first event text is input into a preset large language model for semantic understanding, and a preliminary prediction result is output; the preliminary prediction result includes semantic labels and risk level.

[0025] If the risk level is higher than the security condition, then an event graph is constructed based on the anonymized event data within the time neighborhood;

[0026] Obtain a second prompt template for collaborative behavior analysis, input the event graph into the second prompt template, and generate second event text;

[0027] The second event text is input into the large language model to update the risk level in order to obtain semantic analysis results.

[0028] In some embodiments, a risk feature set is constructed based on the anonymized event data, the role inference results, and the semantic analysis results, including:

[0029] Basic behavioral features, service role features, and semantic analysis features are extracted from the anonymized event data, role inference results, and semantic analysis results at the current moment, respectively.

[0030] For the anonymized event data at the current moment, obtain relevant anonymized event data within the corresponding spatiotemporal neighborhood; based on the relevant anonymized event data, extract context aggregation features;

[0031] Based on the aforementioned basic behavioral features, service role features, semantic analysis features, and context aggregation features, a risk feature set is constructed.

[0032] In some embodiments, the risk feature set is input into a preset risk prediction model to obtain tailing behavior identification results, including:

[0033] The risk feature set is input into a preset linear risk scoring function to calculate the basic risk score;

[0034] Based on a preset rule engine, the basic risk score is corrected to obtain a tailing risk score, thereby determining the tailing behavior identification result; wherein, the rule engine includes:

[0035] If the role inference result determines that it is a service role and the confidence level is above the confidence level correction threshold, then the basic risk score will be forcibly reduced.

[0036] If the semantic analysis results contain a warning label or the risk level is above the risk correction threshold, the basic risk score will be forcibly increased.

[0037] In some embodiments, the method further includes:

[0038] Based on the anonymized event data, the role inference results, the semantic analysis results, and the tailing behavior identification results, a privacy compliance warning notification is generated, and a tiered response strategy is triggered.

[0039] Secondly, this embodiment provides a tailing behavior recognition system based on a large language model, the system including: an anonymized multimodal data acquisition module and a calculation module;

[0040] The anonymized multimodal data acquisition module is deployed in the target scene to collect and generate anonymized event data;

[0041] The computing module, connected to the anonymized multimodal data acquisition module, is used to perform the steps of the method described in any one of the first aspects.

[0042] In some embodiments, the collection and generation of the anonymized event data includes:

[0043] Collect raw data from multiple modalities;

[0044] The original data is de-identified to obtain intermediate data; the de-identification process includes at least one of the following methods: identifier replacement, video textification, and sensitive information filtering.

[0045] Based on a predefined data structure, the intermediate data is transformed into structured data; the attributes in the data structure include ID, location, source, content, and metadata;

[0046] The structured data is cleaned and standardized to obtain anonymized event data for structured storage.

[0047] Thirdly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the tailing behavior recognition method based on a large language model as described in the first aspect.

[0048] Compared with related technologies, the tailing behavior recognition method and system based on a large language model provided in this embodiment obtains anonymized event data occurring in a target scenario; infers the service role type of personnel in the anonymized event data to obtain role inference results; generates anonymized event text based on the anonymized event data and the role inference results; inputs the anonymized event text into a preset large language model to perform semantic understanding on tailing behavior to obtain semantic analysis results; constructs a risk feature set based on the anonymized event data, the role inference results, and the semantic analysis results; and inputs the risk feature set into a preset risk prediction model to obtain tailing behavior recognition results. This solves the privacy leakage problem of existing tailing behavior recognition methods. For complex open management scenarios, it combines role type inference with anonymized semantic analysis and tailing recognition, improving prediction accuracy while avoiding privacy violations.

[0049] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0050] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0051] Figure 1 This is a hardware structure block diagram of the terminal for the tailing behavior recognition method based on a large language model in the embodiments of this application;

[0052] Figure 2 This is a flowchart illustrating the tailing behavior recognition method based on a large language model in the embodiments of this application;

[0053] Figure 3 This is a structural block diagram of the tailing behavior recognition system based on a large language model in the embodiments of this application;

[0054] Figure 4 This is a schematic diagram of the process for generating anonymized event data in an embodiment of this application;

[0055] Figure 5 This is a flowchart illustrating the tailing behavior recognition method based on a large language model in the second embodiment of this application.

[0056] Reference numerals: 102, processor; 104, memory; 106, transmission device; 108, input / output device; 31, anonymized multimodal data acquisition module; 32, computing module. Detailed Implementation

[0057] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0058] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order of objects.

[0059] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1 This is a hardware structure block diagram of the terminal for the tailing behavior recognition method based on a large language model in this embodiment. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0060] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the tailing behavior recognition method based on a large language model in this embodiment. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0061] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0062] This embodiment provides a tailing behavior recognition method based on a large language model. Figure 2 This is a flowchart of the tailing behavior recognition method based on a large language model in this embodiment, as shown below. Figure 2 As shown, the process includes the following steps:

[0063] Step S210: Obtain anonymized event data that occurs in the target scene.

[0064] Specifically, anonymized multimodal data acquisition modules deployed at the edge are used to collect non-identifiable behavioral data streams related to security. All data is de-identified during collection to ensure that it cannot be traced back to a specific natural person. The collected content includes, but is not limited to, the following: (1) Historical tailgating event reports: structured or semi-structured text records regularly exported by property management personnel; (2) Security patrol records: time-location-remark triplets automatically generated by the electronic patrol system; (3) Resident security complaints: free text submitted through mobile applications or mini-programs; (4) Community forum discussions: security-related posts published by residents in public sections; (5) Surveillance video to text information: video content is converted into natural language descriptions through computer vision models; (6) Access control system text logs: event logs such as card swiping time, location, and door opening method recorded by the access control controller.

[0065] The historical tailing incident report only retains the time, location, behavioral description, and physical characteristics (such as "wearing a blue coat" or "carrying a black bag"), removing personally identifiable information such as name, contact information, and room number. Information (PII); security patrol records retain patrol time, area, and abnormal record text (e.g., "one person was found lingering in the lobby for a long time"); resident safety complaints only extract keywords and emotional expressions from the complaint text (e.g., "felt followed", "stranger tailing"), without recording the complainant's identity; community forum discussions only collect semantic content about security perception in public posts (e.g., "recently someone has been following me into the building"), without capturing user IDs or private chat content; surveillance video to text information can use artificial intelligence algorithms (e.g., CV+LLM joint model) to convert video into structured behavioral description text, such as "Person_A enters through the main gate at a moderate walking speed; Person_B briefly stops at the access control and then follows closely behind," extracting the following time difference, distance, actions (looking around, obscuring face), clothing color, carried items, etc., without saving the original video or facial images; access control system logs only record event logs such as timestamps, locations, door opening methods, and whether multiple people pass through, without associating them with card numbers or user IDs. All data undergoes anonymization at the source, forming a unified format of anonymized behavioral event streams (i.e., anonymized event data), which serves as input for subsequent analysis. Let the i-th event data be E. i Its structure is as follows:

[0066] E i =(event_id i timestamp i ,location i ,source i ,content i ,metadatai ),in:

[0067] event_id i Represents the globally unique event ID of an event, in the format evt_YYYYMMDD_seq; timestamp i Indicates event time, using the ISO 8601 standard time format (including time zone); location i Indicates the standardized physical location of an event, such as "Lobby of Building A"; source i Indicates the source type; content i The content of the event is represented by an anonymized natural language description; metadata i Metadata representing an event includes contextual information such as lighting conditions, weather, and device ID.

[0068] It should be noted that all information and data involved in this application are authorized by the user or fully authorized by all parties, and are used legally.

[0069] Step S220: Infer the service role type of the personnel in the anonymized event data to obtain the role inference result.

[0070] Specifically, the goal of service role type inference is to distinguish between "suspected stalkers" and "known service personnel" (such as delivery drivers, food delivery workers, cleaners, and property management staff), rather than identifying a specific individual. Service role type inference can be based on the behavioral characteristics of the visitors. For example, delivery drivers frequently visit parcel locker areas and briefly linger at residents' doors (<30 seconds); food delivery workers tend to congregate during lunch / evening peak hours, often using stairwells or fire exits, and carrying insulated boxes; cleaners appear on weekday mornings, carrying cleaning tools, and their activities are concentrated in public areas. This step determines whether a particular behavioral event was performed by a known service role personnel (such as delivery drivers, food delivery workers, or cleaners), and the output is:

[0071] R i = (is_service_personnel) i ,role i ,confidence i );

[0072] Where: is_service_personnel i ∈[0,1] indicates whether it belongs to the service personnel category; role i ∈{courier,delivery,cleaner,unknown} represents a specific role type; confidence i∈[0,1] represents the confidence level.

[0073] Step S230: Generate anonymized event text based on the anonymized event data and the role inference result; input the anonymized event text into a preset large language model, perform semantic understanding on the tailing behavior, and obtain semantic analysis results.

[0074] Specifically, the pre-defined large language model can be a locally deployed open-source large language model. This open-source large language model is trained using a massive amount of pre-trained data; furthermore, the model parameters can be fine-tuned by combining historical anonymized aggregated data; historical anonymized aggregated data includes historical tailgating event reports, security patrol records, resident safety complaints, community forum discussions, surveillance video converted to text information, and access control system text logs, etc.

[0075] Specifically, anonymized event text includes textual information such as behavioral descriptions, location descriptions, and descriptions derived from role inferences within the anonymized event data. The large language model processes the anonymized event text through feature extraction, semantic understanding, keyword / phrase extraction, sentiment analysis, and behavioral relationship modeling to obtain structured semantic analysis results. These structured semantic analysis results include information such as type, time, location, contextual semantics, sentiment intensity, and whether the individual is a service provider.

[0076] Step S240: Construct a risk feature set based on the anonymized event data, the role inference results, and the semantic analysis results; input the risk feature set into a preset risk prediction model to obtain the tailing behavior identification results.

[0077] Specifically, risk feature sets can be constructed in various ways according to implementation requirements, including constructing risk feature sets based solely on semantic analysis results; furthermore, risk feature sets can be constructed by combining at least one of anonymized event data and role inference results; preferably, basic behavioral features, service role features, and semantic analysis features are extracted from the anonymized event data, role inference results, and semantic analysis results at the current moment, respectively, and context aggregation features are extracted based on relevant anonymized event data in the spatiotemporal neighborhood, integrating the behavioral features, service role features, semantic analysis features, and context aggregation features into a risk feature set.

[0078] The preset risk prediction model adopts a fully trained model architecture with stable prediction performance. The model architecture includes, but is not limited to, machine learning paradigms such as linear models, tree models, and deep learning models. The training data for the risk prediction model can be constructed based on historical anonymized aggregated data, as well as the role inference results and semantic analysis results obtained after sequentially performing role inference and semantic understanding based on a large language model on the historical anonymized aggregated data.

[0079] In this embodiment, anonymized event data occurring in a target scenario is acquired; service role type inference is performed on the personnel in the anonymized event data to obtain role inference results; anonymized event text is generated based on the anonymized event data and the role inference results; the anonymized event text is input into a preset large language model to perform semantic understanding on tailgating behavior to obtain semantic analysis results; a risk feature set is constructed based on the anonymized event data, the role inference results, and the semantic analysis results; the risk feature set is input into a preset risk prediction model to obtain tailgating behavior identification results. This solves the privacy leakage problem of existing tailgating behavior identification methods. For complex open management scenarios, combining role type inference with anonymized semantic analysis and tailgating identification improves prediction accuracy while avoiding privacy violations.

[0080] In some embodiments, regarding step S220 above, role type inference is performed on the personnel in the anonymized event data to obtain role inference results, specifically including:

[0081] Step S221: Extract behavioral feature vectors from the anonymized event data, and perform preliminary matching of the roles of the visitors based on the behavioral feature vectors to obtain preliminary prediction results; the roles of the visitors include service roles and unknown roles; the service roles include couriers, food delivery workers, and cleaners.

[0082] Step S222: Based on the temporary anonymous identifier associated with the anonymized event data, obtain historical tracking information within a preset period, and correct the preliminary prediction result based on the historical tracking information to obtain the role inference result; the temporary anonymous identifier is generated by the information of the mobile device carried by the visitor.

[0083] Specifically, the method for inferring service role types includes at least preliminary matching using role templates, where the role templates mainly include typical behavioral characteristics of service personnel. Features extracted from anonymized event data are matched with the role templates to output preliminary prediction results including the confidence levels of various roles. These preliminary prediction results can be directly used as the role inference results, or they can be further refined by combining methods such as anonymized identification of device signal fingerprints, access frequency, and spatiotemporal analysis of regions.

[0084] Specifically, Bluetooth / Wi-Fi probes can be used to collect signal fingerprints of mobile devices (such as MAC address hash values ​​and signal strength change curves), and the signals can be processed by one-way hashing to generate temporary anonymous identifiers (TIDs) for short-term trajectory tracking (e.g., 24 hours or 7 days). Based on short-term trajectory tracking, regular visitors (e.g., TID groups that appear in a certain building at 18:00 every day) can be identified, and these regular visitors can be classified as known service roles.

[0085] In this embodiment, without obtaining personal identification information, trajectory tracking is achieved through temporary device identifiers to correct role matching results and reduce the false judgment rate.

[0086] In some embodiments, regarding step S221 above, a preliminary match is performed on the role of the visitor based on the behavioral feature vector to obtain a preliminary prediction result, including:

[0087] Step S301: Obtain a pre-stored role template; the role template includes feature vectors of service roles.

[0088] Step S302: Calculate the similarity between the behavior feature vector and the character template.

[0089] Step S303: Based on the maximum value of the similarity, complete the matching with the character template to obtain a preliminary prediction result of the character type.

[0090] Specifically, a service role behavior template library (i.e., role templates) is built offline, whose elements are a set of typical behavioral features of role r∈R. Let R={courier,delivery,cleaner}; courier represents a courier, delivery represents a food delivery worker, and cleaner represents a cleaner. Each role r has a template T. r Defined as a multidimensional feature vector: T r =(f r 1,f r 2,…,f r k The features include: high-frequency access area f r 1. (e.g., parcel lockers, residents' doors) Distribution of dwell time f r 2 (such as mean and variance), patterns in access time f r 3 (e.g., delivery drivers concentrated between 11:30 and 13:00), carrying items mode f r 4 (such as insulated boxes, cleaning tools), walking speed range f r 5 (m / s), path regularity f r 6 (Whether it moves along a fixed route). Template Tr is generated based on historical aggregated data and is not associated with any individual.

[0091] For each anonymized event data E i Extract its behavioral feature vector f i =(f i 1, f i 2,…,f i m ), calculate f i With each character template T r Similarity:

[0092] ;

[0093] Where wj is the feature weight (which can be learned or preset), and the sum is 1.

[0094] Take the character with the highest similarity:

[0095] ;

[0096] Among them, f i With each character template T r If the similarity is greater than the similarity threshold (initially set to 0.6), it is preliminarily determined to be a service personnel.

[0097] In this embodiment, feature matching is used to quickly determine whether it is a service role.

[0098] In some embodiments, for step S222 above, the preliminary prediction result is corrected based on the historical tracking information to obtain the role inference result, including:

[0099] Step S401: Based on the historical tracking information, calculate the frequency of occurrence of the temporary anonymous identifier in each time period and location, and generate an access heat map.

[0100] Step S402: Perform spatiotemporal clustering analysis on the access heat map. If the temporary anonymous identifier meets the clustering conditions corresponding to regular visitors, and the preliminary prediction result corresponding to the temporary anonymous identifier is the service role, then increase the confidence of the service role to update the role inference result.

[0101] If the preliminary prediction result corresponding to the temporary anonymous identifier is the unknown role, the total number of visits and the average stay time of the unknown role are calculated based on the access heat map; if the total number of visits and the average stay time meet the access rules of the service role, the unknown role is modified to the service role to update the role inference result.

[0102] Specifically, define the access heatmap H for TID. TID for:

[0103] ;

[0104] Among them, 1 TID (E j This indicates that if event E... j If it belongs to this TID, it is 1; otherwise, it is 0. time (t) indicates that if event E j If it occurs within time period t, the value is 1; otherwise, it is 0. location (l) indicates that if event E j If it occurs at position l, the value is 1; otherwise, it is 0. Last7 days represents the summation range, i.e., all anonymized event data E from the past 7 days. j In one implementation, TIDs are preferably retained for 24 hours, after which they automatically expire to prevent long-term tracking. To achieve this, an anonymous behavior aggregation cache can be maintained. Before the TID's lifespan ends (24 hours), the spatiotemporal access records generated by the TID are stripped of their identifiers and written into this cache. This is then used to calculate the access heatmap H. TID When (t,l), statistics are performed based on the anonymous behavioral sequences associated with the current TID in this cache. The data in this cache is retained for 7 days for short-term behavioral pattern analysis and is automatically deleted after 7 days.

[0105] The DBSCAN clustering algorithm was used to analyze H. TID Spatiotemporal clustering is performed. If significant clusters are found, i.e., cluster adjustment is satisfied (e.g., cluster size ≥ 3 and access interval ≈ 24 hours), then the visitor is considered a regular visitor. Combined with the above... Determine if the service personnel pattern matches. If it matches, increase the corresponding confidence level.

[0106] ;

[0107] In the formula, confidence i The result of +Δc1 is reassigned to confidence. i Δc1 is the confidence enhancement coefficient, which is dynamically calculated based on the size of the clusters and the standard deviation of the time intervals. The larger the cluster size and the more regular the time intervals, the higher the Δc1 value. The preferred values ​​are [0.1, 0.3]. i This represents the confidence level, obtained based on the maximum similarity during template matching.

[0108] According to the visit popularity map H TIDThe spatiotemporal signal points of the same TID within the past 7 days are arranged in chronological order. If the time interval between adjacent signal points is less than a preset interval threshold (e.g., 300 seconds), it is determined to be the same consecutive access. The total number N of the above consecutive accesses is calculated. visit Calculate the dwell time t for a single visit. stay_k (Defined as the difference between the start and end times of the visit). Average stay duration t stay =t stay_k / N visit When N visit When t = 0, stay =0. If N = 0. visit ≥5 and t stay ≤60S, supports delivery / food delivery personnel; if N visit ≥3 and concentrated on weekday mornings, supporting the role of a cleaner. If either condition is met, then set is_service_personnel in the role inference result. i =1; otherwise, set is_service_personnel i =0.

[0109] The final updated character inference results are as follows:

[0110] ;

[0111] Among them, Sim min Minimum similarity is used for reverse scoring of unknown risk in unknown individuals; This indicates the similarity between the matched characters.

[0112] In this embodiment, cluster analysis and joint judgment of access frequency and time interval data are used to eliminate misjudgments and improve the accuracy of service role identification.

[0113] In some embodiments, regarding step S230 above, anonymized event text is generated based on the anonymized event data and the role inference result; the anonymized event text is input into a preset large language model, and semantic understanding is performed on the tailing behavior to obtain semantic analysis results, specifically including:

[0114] Step S231: Obtain a first prompt template for tailgating behavior analysis, and input the anonymized event data and the role inference result into the first prompt template to obtain the first event text.

[0115] Specifically, the input for this stage consists of two parts: anonymized event data E. i and the role inference result R i To guide the Large Language Model (LLM) for accurate analysis, a set of standardized prompt templates is preset, based on the input E.i and R i Dynamically construct the prompt text. Set the template as follows: "You are a security behavior analysis assistant. Please perform semantic analysis on the following community security events, strictly adhering to privacy protection rules: do not guess names, room numbers, or identity information. Event description: {content}; Time: {timestamp}; Location: {location}; Is it a service personnel: {is_service_personnel, role, confidence}; Environmental information: {metadata}. Please output: semantic tags (maximum 5, separated by Chinese commas), event type (normal / suspicious / ambiguous), intent suspiciousness score (0.0–1.0), context risk score (0.0–1.0), format: tag: ..., type: ..., intent: ..., risk: ...". This prompt template ensures that LLM does not attempt to identify individuals, emphasizes privacy compliance, and guarantees structured output for easy parsing.

[0116] Step S232: Input the first event text into a preset large language model for semantic understanding and output preliminary prediction results; the preliminary prediction results include semantic labels and risk levels.

[0117] Specifically, the constructed first event text P(E) i ,R i Encoded as a token sequence x in ∈N d , where d is the context length (e.g., 4096). The output distribution is obtained through forward propagation: y logits =LLM(x in Greedy decoding is used to generate natural language responses. i The output fields are matched using regular expressions to extract structured results. The matching rules for each tag are as follows:

[0118] Semantic tags: Tag: (.+?)\n;

[0119] Event type: Type: (\text{normal}|suspicious|ambiguous);

[0120] Intent score: Intent: ([0-1]\.\d{1,4});

[0121] Risk score: Risk: ([0-1]\.\d{1,4}).

[0122] If parsing fails, set a default value and log the error.

[0123] Furthermore, to prevent semantic drift of tags, a semantic tag whitelist library L can be maintained. validIncludes preset valid tags:

[0124] L valid ={Following in, loitering for a long time, carrying packages, nighttime activities, leaving quickly, repeatedly entering and exiting, covering face, gathering in large groups, equipment malfunction} If the generated tag is not in L valid If the result is correct, attempt synonym mapping; otherwise, discard. The risk level in the preliminary prediction results includes event type, intent score, and risk score.

[0125] Step S233: If the risk level is higher than the security condition, then construct an event graph based on the anonymized event data in the time neighborhood.

[0126] Specifically, for events judged as "suspicious" or high-risk, contextual expansion analysis is automatically triggered. A time neighborhood window W is defined. t =[timestamp i -10 min, timestamp i +10 min], retrieve other related events within this window {E j} j≠i Based on other related events, construct an event graph G=(V,E), where node V represents event E. k Edge E represents two events that are spatially and temporally close and semantically related.

[0127] Step S234: Obtain a second prompt template for collaborative behavior analysis, input the event graph into the second prompt template, and generate second event text.

[0128] Specifically, LLM provides a second prompt to analyze the subgraph. For example, the second prompt template is as follows: "Please analyze whether the following event groups have collaborative behavior patterns, such as tailing groups, tentative entry, etc. Only output whether there is potential linkage (yes / no), and a brief reason."

[0129] Step S235: Input the second event text into the large language model and update the risk level to obtain semantic analysis results.

[0130] Specifically, the updated semantic analysis results are represented as follows:

[0131] ;

[0132] Among them, T i For a set of semantic tags; t i ∈{normal, suspicious, ambiguous} represents the event type; Sintent∈[0,1] represents the intent suspiciousness score; Srisk∈[0,1] represents the context risk score.

[0133] In this embodiment, a large language model (LLM) is used for deep semantic understanding, extracting high-order behavioral features and contextual relationships.

[0134] In some embodiments, in step S240 above, a risk feature set is constructed based on the anonymized event data, the role inference results, and the semantic analysis results, specifically including:

[0135] Step S241: Extract basic behavioral features, service role features, and semantic analysis features from the anonymized event data, the role inference results, and the semantic analysis results at the current moment, respectively.

[0136] Specifically, basic behavioral features are derived from anonymized event data, such as x1-x5: x1: dwell time (seconds), standardized to [0,1]; x2: entry method (card swipe=0, tailgating=1, decryption=2), one-hot encoded; x3: time period (night=1, daytime=0); x4: lighting conditions (low=1, normal=0); x5: whether it is a access control point (yes=1, no=0). Service role features are derived from role inference results, such as x6-x8: x6: whether it is a service personnel (yes=1, no=0); x7: service personnel confidence ∈ 0,1; x8: whether it is a regular visitor (yes=1, no=0). Semantic analysis features are derived from semantic analysis results, such as x9-x 14 x9: Suspiciousness score of intent ∈ 0,1; x 10 Contextual risk score ∈ 0, 1; x 11 : Number of semantic tags; x 12 : Contains the "tailgating" tag (Yes = 1, No = 0); x 13 : Contains the "long-term loitering" label (Yes=1, No=0); x 14 : Contains the "cover face" tag (Yes=1, No=0).

[0137] Step S242: For the anonymized event data at the current moment, obtain relevant anonymized event data in the corresponding spatiotemporal neighborhood; based on the relevant anonymized event data, extract context aggregation features.

[0138] Specifically, taking the anonymized event data E at the current moment as an example... i The time of occurrence t i To establish a time window W, we look back 10 minutes from the endpoint. t ; with E i Location of occurrence (Loc) i Construct a spatial window W at the center s Statistics W t ∩W sThe model incorporates information such as the total number of events, the time difference since the most recent legitimate door opening, whether it immediately followed the previous legitimate door opening event, and whether the previous event involved a service personnel. All information features are Min-Max normalized to [0,1] to avoid the influence of unit dimensions, forming contextual aggregated features. By introducing these dynamic contextual features, the model can effectively identify complex tailing threats that cannot be detected by traditional single-point feature-based methods.

[0139] Step S243: Based on the basic behavioral features, service role features, semantic analysis features, and context aggregation features, construct a risk feature set.

[0140] In this embodiment, the features of the above four dimensions are integrated into a risk feature set to improve the accuracy of risk prediction and enhance the identification effect of tailing behavior.

[0141] In some embodiments, in step S240 above, the risk feature set is input into a preset risk prediction model to obtain the tailing behavior identification result, specifically including:

[0142] Step S244: Input the risk feature set into a preset linear risk scoring function to calculate the basic risk score.

[0143] Specifically, a basic risk score is defined: Score base =σ(w T x i +b), where:

[0144] σ(z)=1 / (1+e -z ), is the Sigmoid function; w represents the preset weight vector, which corresponds one-to-one with the features in the risk feature set, and can be set manually or obtained through training; b∈R is the bias term.

[0145] Step S245: Based on a preset rule engine, the basic risk score is corrected to obtain a tailing risk score, thereby determining the tailing behavior identification result. The rule engine includes: if the role inference result identifies a service-type role and the confidence level is above the confidence correction threshold, then the basic risk score is forcibly reduced; if the semantic analysis result contains a warning label or the risk level is above the risk correction threshold, then the basic risk score is forcibly increased.

[0146] Specifically, to enhance robustness, a rule-based risk correction mechanism is introduced. For example, the rules are as follows:

[0147] Rule 1, Forced Risk Reduction (Preventing Misjudgment of Delivery Personnel): If is_service_personnel=1 and confidence≥0.8, then: Score final =min(Scorebase ,0.3).

[0148] Rule 2 significantly increases risk: If the semantic label set T i If the alert label includes "No card swiped" and is immediately followed by: Score final =min(Score base +0.4, 1.0).

[0149] Rule 3: If the contextual risk score Srisk ≥ 0.8 and the total number of spatiotemporally related events Nrecent ≥ 3, then: Score final =min(Score base +0.3, 1.0).

[0150] Final trailing risk score: RiskScore i =apply_rules(Score base The judgment is made based on the final risk score:

[0151] ;

[0152] Simultaneously output RiskScore i Together with the top three highest-weighted features (for interpretability), the tailing behavior identification results are formed.

[0153] In this embodiment, the reliability of the risk score is improved by combining a linear model with a risk correction mechanism.

[0154] In some embodiments, the method further includes:

[0155] Step S250: Based on the anonymized event data, the role inference results, the semantic analysis results, and the tailing behavior identification results, generate a privacy compliance warning notification and trigger a tiered response strategy.

[0156] Specifically, based on the tailing behavior identification results, the risk level is determined, and alarms and records are generated. A tailing risk score ≥ 0.9 is considered a high-risk event, triggering a local alarm (audio-visual alert), generating a security log (retained for 7 days), but no video is uploaded; only a text summary is retained. A tailing risk score 0.65 ≤ tailing risk score < 0.9 is considered a medium-risk event, recorded in the local audit log (retained for 3 days), and can be queried by security personnel. A tailing risk score < 0.65 is considered a low-risk event, discarded or aggregated in statistics, and no individual record is retained. The threshold is configurable and supports regional differentiation settings (e.g., more sensitive areas like villa districts).

[0157] Furthermore, the system based on event E iThe difference between the generation time and the current time is used to determine the event type: if the difference is less than the preset real-time threshold (5 minutes is recommended), it is determined to be a real-time event; otherwise, it is determined to be a historical event. For real-time events, without exposing individual identities or disseminating details of personal behavior, based on the anonymized event data, the role inference results, the semantic analysis results, and the tailing behavior identification results, the following tasks are completed: (1) Generate privacy-compliant early warning notifications; (2) Trigger local security linkage mechanisms (such as sound and light prompts, access control locking); (3) Dispatch security personnel to respond as needed; (4) Record audit logs for traceability, and the log content does not contain identifiable natural person information.

[0158] Specifically, the privacy compliance alert generation mechanism includes: a pre-set template library M for generating natural language alerts. All templates avoid mentioning individual characteristics and are called as needed. For example, the template for a medium-risk event is "Abnormal entry behavior detected. Please pay attention to public area safety." The template for a high-risk event is "Suspected tailgating event detected. The system has automatically strengthened monitoring." If the event occurs during peak resident hours (e.g., 18:00–22:00), a mild tone is used: "Please note: There have been frequent abnormal passages at the entrance recently. Please pay attention to the access control status when entering and exiting." If it occurs at night or during low-traffic periods, the alert can be enhanced: "[Safety Reminder] Suspected unauthorized tailgating behavior detected. Local alert has been triggered." All templates ensure that they do not contain individual descriptions such as "a man," "a person in black," or "resident of room XX."

[0159] Specifically, the security linkage action decision-making process includes: defining a set of linkage actions A={a1,a2…}, for example, a1 is to trigger a local audio-visual alert (5 seconds), a2 is to lock the current access control channel (for 2 minutes), a3 is to send a dispatch request to the nearest security post, a4 is to start high-frame-rate recording from surrounding cameras (for 1 minute), and a5 is to record an event summary to the security log. Based on risk level and location information, the action combination is executed:

[0160] ;

[0161] When the action combination includes action a3, the scheduling process is initiated: (1) Security resource location: Use Bluetooth / Wi-Fi probes to obtain the TID (Temporary Anonymous Identifier) ​​of on-duty security personnel and calculate its relationship with the event location l i (1) Distance; (2) Nearest security selection: Select the nearest security personnel whose status is "idle"; (3) Task assignment: Send the task to their mobile terminal via an encrypted channel: "Please go to {l i Check recent security incidents. Incident type: Suspected tailgating. No resident intervention required; observe common areas only. The message does not contain video, images, or perpetrator details.

[0162] Specifically, the security logging standards include: generating an audit log for every event. i Its content is: globally unique identifier log id The system includes: location code (e.g., "A-ENT"), which does not record specific rooms; trigger tags (e.g., "entry without card swipe," "nighttime activity"); actions executed; and privacy mode, which is fixed at "enabled," indicating that the data has been anonymized. Logs are stored in a local database with the following retention periods: high-risk logs: 7 days; medium-risk logs: 3 days; low-risk logs: deleted after aggregation and statistics.

[0163] In this embodiment, the warning trigger threshold is dynamically adjusted based on different risk levels, regions, time periods, and other factors. It also matches corresponding text templates from the warning template library according to the risk level and type, achieving privacy-priority warning and security linkage. This flexible risk level classification and warning triggering method can more accurately reflect the actual risk situation, avoid underreporting and over-warning, make warning information more targeted and practical, and ensure timely and effective communication to relevant personnel through multiple channels, thereby improving the actual effectiveness of warnings.

[0164] This embodiment also provides a tailing behavior recognition system based on a large language model, see [link to relevant documentation]. Figure 3 The system includes an anonymized multimodal data acquisition module 31 and a calculation module 32.

[0165] The anonymized multimodal data acquisition module 31 is deployed in the target scene and is used to collect and generate anonymized event data; the calculation module 32 is connected to the anonymized multimodal data acquisition module 31 and is used to execute the steps of the method described in any of the above embodiments.

[0166] In this embodiment, anonymized event data occurring in a target scenario is acquired; service role type inference is performed on the personnel in the anonymized event data to obtain role inference results; anonymized event text is generated based on the anonymized event data and the role inference results; the anonymized event text is input into a preset large language model to perform semantic understanding on tailgating behavior to obtain semantic analysis results; a risk feature set is constructed based on the anonymized event data, the role inference results, and the semantic analysis results; the risk feature set is input into a preset risk prediction model to obtain tailgating behavior identification results. This solves the privacy leakage problem of existing tailgating behavior identification methods. For complex open management scenarios, combining role type inference with anonymized semantic analysis and tailgating identification improves prediction accuracy while avoiding privacy violations.

[0167] In some of these embodiments, such as Figure 4 As shown, the collection and generation of the anonymized event data includes:

[0168] Step S501: Collect raw data from the multimodal dataset.

[0169] Step S502: De-identify the original data to obtain intermediate data; the de-identification process includes at least one of the following methods: identifier replacement, video textification, and sensitive information filtering.

[0170] Step S503: Based on a predefined data structure, the intermediate data is transformed into structured data; the attributes in the data structure include ID, location, source, content, and metadata.

[0171] Step S504: Perform data cleaning and standardization on the structured data to obtain anonymized event data for structured storage.

[0172] Specifically, edge computing devices deployed within the target scenario (e.g., within a residential community) are used to collect raw data related to security behaviors in real time from multiple heterogeneous data sources. The collection process adopts an event-driven architecture, that is, the collection process is triggered immediately whenever new data is generated. The data sources collected include: (1) Historical trailing event reports: structured or semi-structured text records regularly exported by property management personnel; (2) Security patrol records: time-location-remark triplets automatically generated by the electronic patrol system; (3) Resident security complaints: free text submitted through mobile applications or mini-programs; (4) Community forum discussions: posts related to security published by residents in public sections; (5) Surveillance video to text information: video content is converted into natural language descriptions through computer vision models; (6) Access control system text logs: event logs such as card swiping time, location, and door opening method recorded by the access control controller. All data is transmitted to the local edge server through a secure communication protocol to ensure that the data is not stolen or tampered with during transmission.

[0173] To prevent the identification of specific individuals, all collected data undergoes immediate de-identification processing at the entry point. Specific operations include:

[0174] (1) Direct Identifier Replacement. All information fields that can directly identify an individual are replaced according to the preset mapping rules: the name is replaced with [REDACTED]; the room number is replaced with the unified area code, for example, "Room 302" is replaced with Unit_3F; the contact information (such as mobile phone number) is replaced with [PHONE]; the access card number or user ID is processed by a one-way hash function to generate a temporary anonymous identifier (TID).

[0175] Let the original identifier be II and the global salt be SS. Then the anonymous identifier TID is generated by the following formula:

[0176] TID=Truncate(SHA−256(I||S),16);

[0177] Here, || represents string concatenation, and Truncate means extracting the first 16 hexadecimal characters. All TIDs are only retained for 24 hours, after which they automatically expire to prevent long-term tracking.

[0178] (2) Video content processing. The original images or video streams of the surveillance videos are not saved. Instead, behavioral semantic descriptions are extracted using a pre-trained CV+LLM joint model. Continuous surveillance video frames are parsed into natural language behavioral descriptions, such as: "Person_X enters through the gate, and 2 seconds later Person_Y quickly follows and enters." This process follows the "video→text" paradigm, ensuring that no biometric data is stored.

[0179] (3) Text content desensitization. For free text input (such as complaints, forum posts), regular expression matching and predefined dictionaries are used to filter sensitive information: all strings that conform to the mobile phone number format are replaced with [PHONE]; common name patterns (such as "Mr. / Ms. X") are replaced with [PERSON]; specific room numbers are replaced with hierarchical codes (such as "Building X, Room XF").

[0180] To achieve multi-source data fusion, all collected data must be converted into a unified structured format. The following standardized data structure is defined, where the i-th event data is E. i Its structure is as follows:

[0181] E i =(event_id i timestamp i ,location i ,source i ,content i ,metadata i );

[0182] Among them, event_id i Represents the globally unique event ID of an event, in the format evt_YYYYMMDD_seq; timestamp i Indicates event time, using the ISO 8601 standard time format (including time zone); location i Indicates the standardized physical location of an event, such as "Lobby of Building A"; source i Indicates the source type; content iThe content of the event is represented by an anonymized natural language description; metadata i Metadata representing an event includes contextual information such as lighting conditions, weather, and device ID.

[0183] The collected data needs to be cleaned to remove noise and redundancy. Specific procedures include:

[0184] (1) Null value filtering: content i If the event is empty or less than 5 characters long, the event is discarded.

[0185] (2) Deduplication of duplicate events: If the source i =source j ∧location i =location j ∧∣timestamp i -timestamp j If |≤60 seconds, then the event similarity function Sim(E) i E j If Sim(E) is 1, then Sim(E) is 1; otherwise, Sim(E) is 1. i E j If Sim(E) is 0. i E j If the value is 1, then the earliest timestamp is retained and the rest are discarded.

[0186] (3) Abnormal time filtering: If timestamp i If the timeframe is outside a reasonable range (such as future time or earlier than the system deployment time), discard it.

[0187] To improve the accuracy of subsequent semantic analysis, lexical-level standardization of the text content is also necessary. Specific steps include:

[0188] (1) Synonym normalization. Define a set of synonym mappings M, for example: (follow, trail), (enter, enter). For each content... i Execute: content i (std) = Replace(content) i ,M), that is, replacing the original words with standard words.

[0189] (2) Entity normalization. Non-standard descriptions are mapped to preset categories: "deliveryman" is mapped to "courier"; "food delivery rider" is mapped to "food deliveryman"; "cleaner" is mapped to "cleaner". This mapping is done through a predefined dictionary and does not involve model reasoning.

[0190] After the above processing, the output is:

[0191] Dclean ={E1,E2,…,E n |E i ∈ Unified format, anonymized, cleaned, standardized}; This dataset serves as the output data of the anonymized multimodal data acquisition module, used for service role identification and behavioral semantic analysis.

[0192] In this embodiment, 1. All data is de-identified during collection to ensure it cannot be traced back to a specific individual, including but not limited to incident reports, surveillance videos, and resident complaints. This comprehensive data collection method more accurately reflects the security situation within the community, provides residents with an intuitive sense of security and early warnings of potential risks, making risk warnings more forward-looking.

[0193] The present embodiment will now be described and illustrated through preferred embodiments.

[0194] This preferred embodiment provides a tailing behavior recognition system based on a large language model. The system includes an anonymized multimodal data acquisition module and a calculation module.

[0195] The anonymized multimodal data acquisition module is deployed within the target scene to collect and generate anonymized event data. The method for collecting and generating the anonymized event data specifically includes: collecting raw multimodal data; performing de-identification processing on the raw data to obtain intermediate data; the de-identification processing includes at least one of identifier replacement, video texturization, and sensitive information filtering; transforming the intermediate data into structured data based on a predefined data structure; the attributes in the data structure include ID, location, source, content, and metadata; and performing data cleaning and standardization on the structured data to obtain structured, stored anonymized event data.

[0196] The computing module, connected to the anonymized multimodal data acquisition module, is used to execute a tailing behavior recognition method based on a large language model, such as... Figure 5 As shown, the specific steps include:

[0197] S1, Anonymous Multimodal Data Acquisition: Acquire anonymized event data collected by the Anonymous Multimodal Data Acquisition module.

[0198] S2, Role Classification:

[0199] Behavioral feature vectors are extracted from the anonymized event data. Pre-stored role templates are obtained; these templates include feature vectors for service roles. The similarity between the behavioral feature vectors and the role templates is calculated; based on the maximum similarity value, a match is made with the role template to obtain a preliminary prediction of the role type. The roles of the visitors include service roles and unknown roles; the service roles include delivery drivers, food delivery workers, and cleaners.

[0200] Based on the temporary anonymous identifier associated with the anonymized event data, historical tracking information within a preset period is obtained. Based on the historical tracking information, the frequency of occurrence of the temporary anonymous identifier in different time periods and locations is statistically analyzed to generate an access heatmap. Spatiotemporal clustering analysis is performed on the access heatmap. If the temporary anonymous identifier meets the clustering conditions corresponding to regular visitors, and the preliminary prediction result corresponding to the temporary anonymous identifier is the service role, the confidence level of the service role is increased to update the role inference result. If the preliminary prediction result corresponding to the temporary anonymous identifier is the unknown role, the total number of visits and average dwell time of the unknown role are calculated based on the access heatmap. If the total number of visits and the average dwell time satisfy the access rules of the service role, the unknown role is modified to correspond to the service role to update the role inference result. The temporary anonymous identifier is generated from information on the mobile device carried by the visitor.

[0201] S3, Feature Extraction and Semantic Analysis of Large Language Models:

[0202] Obtain a first prompt template for tailgating behavior analysis, input the anonymized event data and the role inference result into the first prompt template to obtain the first event text; input the first event text into a preset large language model for semantic understanding, and output a preliminary prediction result; the preliminary prediction result includes semantic labels and risk level.

[0203] If the risk level is higher than the safety condition, an event graph is constructed based on the anonymized event data in the time neighborhood; a second prompt template for collaborative behavior analysis is obtained, the event graph is input into the second prompt template, and a second event text is generated; the second event text is input into the large language model to update the risk level in order to obtain the semantic analysis result.

[0204] S4, Risk Prediction Model Construction and Application:

[0205] Basic behavioral features, service role features, and semantic analysis features are extracted from the anonymized event data, role inference results, and semantic analysis results at the current moment, respectively. For the anonymized event data at the current moment, relevant anonymized event data in the corresponding spatiotemporal neighborhood are obtained. Based on the relevant anonymized event data, context aggregation features are extracted. Based on the basic behavioral features, service role features, semantic analysis features, and context aggregation features, a risk feature set is constructed.

[0206] The risk feature set is input into a preset linear risk scoring function to calculate a basic risk score. Based on a preset rule engine, the basic risk score is corrected to obtain a tailing risk score, thereby determining the tailing behavior identification result. The rule engine includes: if the role inference result determines that it is a service role and the confidence level is above the confidence level correction threshold, then the basic risk score is forcibly reduced; if the semantic analysis result contains a warning label or the risk level is above the risk correction threshold, then the basic risk score is forcibly increased.

[0207] S5, privacy-first alerts and security linkage:

[0208] The event type is determined by the difference between the generation time of the anonymized event data and the current time: if the difference is less than a preset real-time threshold (5 minutes is recommended), it is determined to be a real-time event; otherwise, it is determined to be a historical event. For real-time events, without exposing individual identities or disseminating details of personal behavior, a privacy-compliant early warning notification is generated based on the anonymized event data, the role inference results, the semantic analysis results, and the tailing behavior identification results, and a tiered response strategy is triggered.

[0209] It should be noted that the steps shown in the above process or in the flowchart of the accompanying figures can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0210] Furthermore, in conjunction with the tailing behavior recognition method based on a large language model provided in the above embodiments, this embodiment can also provide a storage medium for implementation. The storage medium stores a computer program; when executed by a processor, the computer program implements any of the tailing behavior recognition methods based on a large language model in the above embodiments.

[0211] It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. All other embodiments derived by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0212] Obviously, the accompanying drawings are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar situations based on these drawings without any creative effort. Furthermore, it is understood that although the work done in this development process may be complex and lengthy, for those skilled in the art, certain design, manufacturing, or production modifications made based on the technical content disclosed in this application are merely conventional technical means and should not be considered as insufficient disclosure of this application.

[0213] The term "embodiment" in this application refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply that it is mutually exclusive with or independent of other embodiments. It will be clearly or implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0214] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A tailing behavior recognition method based on a large language model, characterized in that, The method includes: Obtain anonymized event data that occurs within the target scenario; Service role type inference is performed on the personnel in the anonymized event data to obtain the role inference results; Anonymous event text is generated based on the anonymized event data and the role inference results; the anonymized event text is input into a preset large language model, and semantic understanding is performed on the tailing behavior to obtain semantic analysis results; A risk feature set is constructed based on the anonymized event data, the role inference results, and the semantic analysis results; the risk feature set is input into a preset risk prediction model to obtain the tailing behavior identification results.

2. The tailing behavior recognition method based on a large language model according to claim 1, characterized in that, Service role type inference is performed on the personnel in the anonymized event data to obtain role inference results, including: Behavioral feature vectors are extracted from the anonymized event data, and preliminary matching of the roles of visitors is performed based on the behavioral feature vectors to obtain preliminary prediction results; the roles of visitors include service roles and unknown roles; the service roles include couriers, food delivery workers, and cleaners; Based on the temporary anonymous identifier associated with the anonymized event data, historical tracking information within a preset period is obtained, and the preliminary prediction result is corrected based on the historical tracking information to obtain the role inference result; the temporary anonymous identifier is generated from the information of the mobile device carried by the visitor.

3. The tailing behavior recognition method based on a large language model according to claim 2, characterized in that, Based on the behavioral feature vector, a preliminary match is made to the role of the visitor to obtain preliminary prediction results, including: Obtain a pre-stored role template; the role template includes feature vectors of service roles. Calculate the similarity between the behavioral feature vector and the character template; Based on the maximum similarity, a match is made with the character template to obtain a preliminary prediction result of the character type.

4. The tailing behavior recognition method based on a large language model according to claim 2, characterized in that, The preliminary prediction results are revised based on the historical tracking information to obtain the role inference results, including: Based on the historical tracking information, the frequency of occurrence of the temporary anonymous identifier in different time periods and locations is statistically analyzed to generate an access heat map; Spatiotemporal clustering analysis is performed on the access heat map. If the temporary anonymous identifier meets the clustering conditions corresponding to regular visitors, and the preliminary prediction result corresponding to the temporary anonymous identifier is the service role, then the confidence of the service role is increased to update the role inference result. If the preliminary prediction result corresponding to the temporary anonymous identifier is the unknown role, calculate the total number of visits and the average stay time of the unknown role based on the access heat map; if the total number of visits and the average stay time meet the access rules of the service role, modify the unknown role to the service role to update the role inference result.

5. The tailing behavior recognition method based on a large language model according to claim 1, characterized in that, Anonymous event text is generated based on the anonymized event data and the role inference results; The anonymized event text is input into a pre-defined large language model, and semantic understanding is performed on the tailing behavior to obtain semantic analysis results, including: Obtain a first prompt template for tailgating behavior analysis, and input the anonymized event data and the role inference result into the first prompt template to obtain the first event text; The first event text is input into a preset large language model for semantic understanding, and a preliminary prediction result is output; the preliminary prediction result includes semantic labels and risk level. If the risk level is higher than the security condition, then an event graph is constructed based on the anonymized event data within the time neighborhood; Obtain a second prompt template for collaborative behavior analysis, input the event graph into the second prompt template, and generate second event text; The second event text is input into the large language model to update the risk level in order to obtain semantic analysis results.

6. The tailing behavior recognition method based on a large language model according to claim 1, characterized in that, A risk feature set is constructed based on the anonymized event data, the role inference results, and the semantic analysis results, including: Basic behavioral features, service role features, and semantic analysis features are extracted from the anonymized event data, role inference results, and semantic analysis results at the current moment, respectively. For the anonymized event data at the current moment, obtain relevant anonymized event data within the corresponding spatiotemporal neighborhood; based on the relevant anonymized event data, extract context aggregation features; Based on the aforementioned basic behavioral features, service role features, semantic analysis features, and context aggregation features, a risk feature set is constructed.

7. The tailing behavior recognition method based on a large language model according to claim 1, characterized in that, The risk feature set is input into a preset risk prediction model to obtain tailing behavior identification results, including: The risk feature set is input into a preset linear risk scoring function to calculate the basic risk score; Based on a preset rule engine, the basic risk score is corrected to obtain a tailing risk score, thereby determining the tailing behavior identification result; wherein, the rule engine includes: If the role inference result determines that it is a service role and the confidence level is above the confidence level correction threshold, then the basic risk score will be forcibly reduced. If the semantic analysis results contain a warning label or the risk level is above the risk correction threshold, the basic risk score will be forcibly increased.

8. The tailing behavior recognition method based on a large language model according to claim 1, characterized in that, The method further includes: Based on the anonymized event data, the role inference results, the semantic analysis results, and the tailing behavior identification results, a privacy compliance warning notification is generated, and a tiered response strategy is triggered.

9. A tailing behavior recognition system based on a large language model, characterized in that, The system includes: an anonymized multimodal data acquisition module and a computing module; The anonymized multimodal data acquisition module is deployed in the target scene to collect and generate anonymized event data; The computing module is connected to the anonymized multimodal data acquisition module and is used to perform the steps of the method according to any one of claims 1 to 8.

10. The tailing behavior recognition system based on a large language model according to claim 9, characterized in that, The collection and generation of the anonymized event data includes: Collect raw data from multiple modalities; The original data is de-identified to obtain intermediate data; the de-identification process includes at least one of the following methods: identifier replacement, video textification, and sensitive information filtering. Based on a predefined data structure, the intermediate data is transformed into structured data; the attributes in the data structure include ID, location, source, content, and metadata; The structured data is cleaned and standardized to obtain anonymized event data for structured storage.

Images