A building security event detection method and system based on open source honkong and a medium

Abstract

The embodiment of the application discloses a building security event detection method and system based on open source Hongmeng, and a medium, belongs to the field of intelligent building and Internet of Things security technology, solves the problem of centralized single point failure risk and high deployment cost in the prior art. Including, based on the open source Hongmeng distributed soft bus, the security devices in the building are connected to the same distributed collaborative network;When any security device data triggers an alarm condition, a suspected event record is generated, and a verification task is issued to the atomized service of other security devices in the space area where the suspected event is located;Receive the multi-modal perception data returned by each verification task, and perform multi-dimensional progressive consistency verification on the multi-modal perception data;The verification result is synthesized according to the preset fusion strategy to obtain a confidence score;After the confidence score meets the condition, the suspected event is determined to be a real security event, and at least one response action is automatically arranged and started through open source Hongmeng distributed task scheduling.

Description

Technical Field

[0001] This application relates to the fields of smart building and Internet of Things security technology, and in particular to a building security event detection method, system and medium based on the open source HarmonyOS. Background Technology

[0002] As the construction of smart cities deepens, the demand for intelligent building security continues to upgrade. Modern building security systems typically deploy multiple sensing subsystems, such as access control systems, video surveillance systems, and fire detection systems, generating massive amounts of real-time sensing data daily.

[0003] Existing building security incident detection methods typically employ a single-sensor threshold triggering mechanism. This involves setting independent alarm thresholds for various security devices such as access control systems, cameras, vibration sensors, and infrared detectors. When the data collected by any sensor exceeds its preset threshold, the system determines it as a security incident and triggers an alarm response. However, this single-modal threshold judgment method can trigger alarms under any non-security disturbance to a single sensor, such as pet activity, leaves rustling in the wind, temperature fluctuations, or accidental device triggering. The high false alarm rate not only overwhelms security personnel by dealing with a large number of invalid alarms, but more seriously, genuine security incidents may be buried in the sea of ​​false alarms, exacerbating the risk of missed detections.

[0004] Based on this, existing technologies include "Intelligent Collaborative Control System for Building Security Based on 5G and Multimodal Data Sensing" (publication number CN121664954A), which aggregates multimodal data through a 5G network, preprocesses it at the edge, and then sends it to a central fusion analysis module for event determination and collaborative response. However, while this solution reduces single-modal false alarms to some extent, it still relies on a centralized fusion architecture, and each edge node needs to use external communication networks such as 5G to transmit data back to the central platform, which poses the risk of centralized single-point failure and high deployment costs. Summary of the Invention

[0005] This application provides a building security event detection method, system, and medium based on the open-source HarmonyOS, which addresses the following technical issues: Existing technologies rely on a centralized converged architecture, and each edge node needs to use external communication networks such as 5G to transmit data back to the central platform, which poses the risk of centralized single point of failure and high deployment costs.

[0006] The embodiments of this application adopt the following technical solutions: This application provides a building security event detection method based on the open-source HarmonyOS, executed by edge nodes deployed in various areas of a building. The method includes: connecting building security devices to the same distributed collaborative network based on the open-source HarmonyOS distributed soft bus; when any security device triggers an alarm condition, generating a suspected event record and, through the open-source HarmonyOS distributed task scheduling, issuing verification tasks to the atomic services of other security devices in the spatial area where the suspected event is located; receiving multimodal perception data returned from each verification task and performing multi-dimensional progressive consistency verification on the multimodal perception data; synthesizing a confidence score based on the consistency verification results according to a pre-set fusion strategy; and, after the confidence score meets the pre-set security scoring conditions, determining the suspected event as a real security event, and automatically orchestrating and initiating at least one response action through the open-source HarmonyOS distributed task scheduling.

[0007] In one implementation of this application, verification tasks are issued to the atomic services of other security devices within the spatial area where the suspected event is located through open-source HarmonyOS distributed task scheduling. Specifically, this includes: determining the target verification area with the spatial location of the suspected event as the center and a preset distance as the radius; issuing verification tasks in parallel to each atomic service of different sensing modes within the target verification area through open-source HarmonyOS distributed task scheduling, so that each atomic service can perform verification data collection and feature extraction locally, and write the extraction results into the shared data space through open-source HarmonyOS distributed data management; wherein, each verification task is set with a maximum verification duration.

[0008] In one implementation of this application, multi-dimensional progressive consistency verification is performed on the multimodal sensing data, specifically including: constructing an effective time window centered on the timestamp of the suspected event, performing time window consistency verification on each multimodal sensing data, and marking data whose timestamps fall within the effective time window as time-valid data; constructing an effective spatial region centered on the spatial location of the suspected event, performing spatial location consistency verification on each time-valid data, and marking data whose collection location falls within the effective spatial region as spatiotemporal valid data; performing event logic chain similarity matching between the spatiotemporal valid data and the security event knowledge graph, and outputting an event logic chain consistency score based on the matching results.

[0009] In one implementation of this application, the consistency verification results are synthesized into a confidence score according to a pre-set fusion strategy. Specifically, this includes: determining the effective data time coverage rate based on the ratio between the number of valid time data and the total number of verification tasks issued; determining the effective data spatial pass rate based on the ratio between the number of valid spatiotemporal data and the number of valid time data; and weighting and fusing the effective data time coverage rate, the effective data spatial pass rate, and the event logic chain consistency score based on pre-set weight coefficients to obtain the confidence score.

[0010] In one implementation of this application, after weighted fusion of effective data time coverage, effective data spatial pass rate, and event logic chain consistency score based on preset weight coefficients, the method further includes: obtaining feedback labels corresponding to building security event detection results, and classifying and labeling the feedback labels based on the spatial regions where each building security event occurs; determining the event density coefficients corresponding to each spatial region based on the labeling results; iteratively searching for candidate weight combinations within a preset neighborhood using a Bayesian optimization method, starting from the current weight combination; weighting the candidate sampling points according to the event density coefficients corresponding to each spatial region in each iteration to determine the target sampling point; determining the weighted accuracy of security events in each spatial region using the weight combination corresponding to the target sampling point; updating the Bayesian optimization model using the weighted accuracy as the observation value of the Bayesian optimization objective function, and repeating the iteration until a preset number of iterations is reached; determining the candidate weight combination with the highest weighted accuracy in each iteration as the weight combination to be updated, and updating the current weight as the weight combination to be updated.

[0011] In one implementation of this application, after synthesizing a confidence score from the consistency verification results according to a pre-set fusion strategy, the method further includes: comparing the verification results with the actual handling results; if a new security event evidence combination pattern exists, converting it into a triple and adding it to the security event knowledge graph to achieve population updates; wherein the security event knowledge graph is stored in a shared data object of distributed data management; and determining the confidence decay value of each triple in the security event knowledge graph, and when the confidence decays to less than a preset threshold, performing a review update on the triple; when the security event knowledge graph undergoes population updates and / or review updates, the changed content is automatically synchronized to all edge nodes through the publish-subscribe mechanism of distributed data management, so that each edge node updates its locally cached subset of triples according to the synchronized changed content.

[0012] In one implementation of this application, at least one response action is automatically orchestrated and initiated through the open-source HarmonyOS distributed task scheduling, specifically including: obtaining event feature information corresponding to a real security event; wherein, the event feature information includes at least the event type, event location, and event risk level; querying a pre-set response strategy mapping table based on the event feature information to determine the set of response actions to be executed; and distributing each response action in the set of response actions in parallel to the corresponding atomic service for execution through the open-source HarmonyOS distributed task scheduling.

[0013] In one implementation of this application, after connecting building security devices to the same distributed collaborative network based on the open-source HarmonyOS distributed soft bus, the method further includes: when any edge node is detected to be offline, or when the failure rate of security devices within the jurisdiction of any online edge node is higher than a preset failure threshold, determining that edge node as a fault node; obtaining the security event sequence that occurred in the target spatial region corresponding to the fault node within a preset time period before the failure; determining the associated event chain that occurs sequentially along the spatial direction based on the spatial location and time interval of each event in the security event sequence; determining the target spatial region involved in the associated event chain in the next time period based on the propagation direction and propagation speed of the associated event chain; determining the edge node corresponding to the target spatial region as the takeover node, and migrating the tasks currently undertaken by the fault node to the takeover node for execution.

[0014] This application provides a building security event detection system based on open-source HarmonyOS, comprising: a distributed device access module for connecting building security devices to the same distributed collaborative network based on the open-source HarmonyOS distributed soft bus; a suspected event triggering module for generating a suspected event record when any security device data triggers an alarm condition; a multimodal parallel verification module for issuing verification tasks to the atomic services of other security devices in the spatial area where the suspected event is located through open-source HarmonyOS distributed task scheduling; a spatiotemporal consistency judgment engine for receiving multimodal perception data returned by each verification task, performing multi-dimensional progressive consistency verification on the multimodal perception data, synthesizing a confidence score according to a preset fusion strategy, and determining the suspected event as a real security event after the confidence score meets the preset security scoring conditions; and an intelligent response orchestration module for automatically orchestrating and initiating at least one response action through open-source HarmonyOS distributed task scheduling.

[0015] This application provides a non-volatile computer storage medium storing computer-executable instructions. These instructions are configured to: connect building security devices to the same distributed collaborative network based on the open-source HarmonyOS distributed soft bus; when any security device's data triggers an alarm condition, generate a suspected event record and, through the open-source HarmonyOS distributed task scheduling, issue verification tasks to the atomic services of other security devices within the spatial area where the suspected event is located; receive multimodal perception data returned by each verification task and perform multi-dimensional progressive consistency verification on the multimodal perception data; synthesize a confidence score based on the consistency verification results according to a preset fusion strategy; after the confidence score meets the preset security scoring conditions, determine that the suspected event is a real security event, and automatically orchestrate and initiate at least one response action through the open-source HarmonyOS distributed task scheduling.

[0016] The above-mentioned technical solutions adopted in this application embodiment can achieve the following beneficial effects: This application embodiment connects building security devices to the same distributed collaborative network through the open-source HarmonyOS distributed soft bus, breaking down information silos between devices in traditional security systems, eliminating the need for additional middleware or gateway conversion devices, and reducing system integration complexity. This application embodiment adopts a distributed decentralized architecture, with judgment and response decisions completed locally at edge nodes, improving the system's high availability and fault tolerance. Secondly, by issuing verification tasks to the atomic services of other security devices within the spatial area where the event occurs, event-driven spatial correlation parallel verification is achieved, avoiding network congestion and wasted computing power caused by full data upload in traditional solutions. By replacing traditional single threshold judgment with spatiotemporal consistency multi-dimensional verification, the problem of high false alarm rate in the building security field is solved, reducing the ineffective workload of security personnel and improving the effective utilization rate of security resources. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 An application diagram of a building security event detection scenario based on open-source HarmonyOS is provided for an embodiment of this application; Figure 2 This application provides a method for detecting building security events based on the open-source HarmonyOS. Figure 3 This is a schematic diagram of the structure of a building security event detection system based on the open-source HarmonyOS, provided as an embodiment of this application. Detailed Implementation

[0018] This application provides a building security event detection method, system, and medium based on the open-source HarmonyOS.

[0019] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0020] Figure 1An application diagram of a building security event detection scenario based on open-source HarmonyOS is provided for embodiments of this application, such as... Figure 1 As shown, the monitored building is divided into multiple spatial areas, including Area A, Area B, and Area C. Each area is equipped with different types of security sensing devices, such as cameras, smoke sensors, and infrared detectors. Each security device connects to the edge node of its assigned area via the open-source HarmonyOS distributed soft bus. The edge node, acting as a regional-level computing and processing unit, is responsible for the access management, data preprocessing, and local decision-making of the security devices within its jurisdiction.

[0021] Each edge node is interconnected with the central application management layer through the open-source HarmonyOS distributed soft bus. Edge nodes can also work together through peer-to-peer communication. When an edge node fails, its tasks can be migrated to other edge nodes to ensure that security detection capabilities are not interrupted.

[0022] This architecture leverages the transparent interconnection of devices and distributed task scheduling capabilities of the open-source HarmonyOS distributed soft bus to achieve unified access of security sensing devices, edge processing of multimodal data, and collaborative fault tolerance between regions, effectively solving the single point of failure risk and response delay problems of traditional centralized security systems.

[0023] Figure 2 This application provides a building security event detection method based on the open-source HarmonyOS, such as... Figure 2 As shown, the building security event detection method based on the open-source HarmonyOS includes the following steps: S101, based on the open-source HarmonyOS distributed soft bus, connects building security devices to the same distributed collaborative network.

[0024] In one implementation of this application, the open-source HarmonyOS distributed soft bus is used to uniformly connect heterogeneous security sensing devices such as building access controllers, network cameras, vibration sensors, infrared intrusion detectors, and smoke detectors to a distributed collaborative sensing network. Each device registers its sensing capability description with the network in the form of atomic services, achieving transparent device interconnection across brands and protocols.

[0025] Specifically, when the access control controller connects to the open-source HarmonyOS distributed sensing network, it runs firmware that supports the HarmonyOS device access specification and publishes each access control event, such as personnel ID, access time, access result, and camera screenshot features, to the distributed soft bus event bus in real time and registers it as an atomic service of type "AccessControl".

[0026] When an IP network camera connects to the open-source HarmonyOS distributed sensing network, it runs a camera proxy atomic service on the edge gateway side, obtains video streams through the ONVIF protocol, executes a lightweight target detection algorithm locally, writes the detection results into the distributed data management system, and registers it as an atomic service of type "VideoAnalysis".

[0027] When vibration sensors and infrared intrusion detectors are connected to the open-source HarmonyOS distributed sensing network, they are connected to the edge gateway through HarmonyOS lightweight devices and registered with the system as atomic services of type "PhysicalSensor" and "InfraredDetector".

[0028] When smoke and gas sensors are connected to the open-source HarmonyOS distributed sensing network, they are connected to the building control gateway via the ZigBee protocol. The control gateway runs the corresponding atomic service to perform protocol conversion and then connects to the distributed soft bus, registering as an atomic service of type "EnvironmentSensor".

[0029] S102. When any security device data triggers an alarm condition, a suspected event record is generated, and a verification task is sent to the atomic service of other security devices in the spatial area where the suspected event is located through the open-source HarmonyOS distributed task scheduling.

[0030] In one implementation of this application, when any security device data triggers an alarm condition, a suspected event record is generated. A target verification area is defined centered on the spatial location of the suspected event, and verification tasks are distributed in parallel to atomic services of different sensing modalities within this area through distributed task scheduling. After each atomic service completes data collection and feature extraction locally, it writes the results into a shared data space for distributed data management.

[0031] Specifically, this embodiment of the application runs an atomized alarm reception service on edge nodes to monitor the data streams of each connected sensor device in real time. When the data from any single sensor exceeds a preset sensitivity threshold, a suspected security event record is generated. This record includes information such as the triggering sensor ID, alarm type, timestamp of occurrence, and spatial location. This suspected event does not trigger an external response action; instead, it distributes verification tasks to relevant nodes through the open-source HarmonyOS distributed task scheduling.

[0032] Furthermore, the alarm receiving atomization service subscribes to event data published by various sensor atomization services in real time, and performs judgments based on preset hierarchical sensitivity thresholds. In this embodiment, the hierarchical sensitivity thresholds include at least a basic threshold, a nighttime enhanced threshold, and a high-alert state threshold. When sensor data triggers a threshold, a suspected event record is generated, and a verification task is distributed through distributed task scheduling. Based on the building's three-dimensional spatial model, a target verification area related to the suspected event location is automatically determined, and data acquisition and feature extraction instructions are issued to all heterogeneous sensor atomization services within the target verification area through open-source HarmonyOS distributed task scheduling.

[0033] It should be noted that, by default, the target verification area is defined as all adjacent areas within a radius of 15 meters centered on the suspected location. In practical applications, the range of the target verification area can be adjusted, and this application does not impose any restrictions on this.

[0034] Upon receiving the instruction, each verification atomic service independently completes data processing locally and writes the feature extraction results into the corresponding verification result data set through distributed data management. In this application embodiment, each verification task has a maximum verification duration. A verification timeout mechanism ensures that verification tasks that do not return results within 500ms are marked as missing. This maximum verification duration can also be adjusted according to actual applications; this application embodiment does not impose any restrictions on it.

[0035] S103. Receive the multimodal perception data returned by each verification task, and perform multi-dimensional progressive consistency verification on the multimodal perception data.

[0036] In one implementation of this application, the atomic service of the judgment engine on the edge collaboration node reads multimodal feature data from the distributed data management after receiving the verification task completion notification, and performs multi-dimensional spatiotemporal consistency verification.

[0037] Specifically, the spatiotemporal consistency verification in this application embodiment includes time window consistency verification, spatial location consistency verification, and security event logic chain verification. Based on the combined results of these three dimensions of verification, an event authenticity confidence score is output. If the confidence score exceeds a set threshold, it is determined to be a real security threat event; otherwise, it is determined to be a false alarm and recorded.

[0038] Furthermore, the time window consistency check in this embodiment includes: taking the suspected event trigger timestamp T0 as the center, determining whether the timestamps of each modality verification data fall within a preset valid time window [T0-Δt, T0+Δt], where Δt is the preset half-width of the time window, which can be determined comprehensively based on the network transmission delay and device response time between sensors in the building. In this embodiment, the default value is 2 seconds. Data exceeding the window is not included in the evaluation, and the number of valid time data included in the evaluation is denoted as N_valid.

[0039] Spatial consistency verification includes: based on the building's three-dimensional spatial coordinate system, verifying whether the source spatial region of each valid modal data is within a preset spatial consistency range from the suspected event triggering location. Data that does not meet the requirement is excluded, and the number of valid spatiotemporal data that meets the requirement is denoted as N_spatial. In this embodiment, the spatial consistency range is defined with the suspected event triggering location as the center and a preset radius R. In this embodiment, the default value is 15 meters, but this value can be adjusted according to the sensor deployment density and spatial area size within the building.

[0040] The security event logic chain verification includes: loading a security event knowledge graph, which predefines multimodal behavioral feature combination patterns corresponding to various security threat events. The judgment engine performs similarity matching between the currently valid multimodal feature vectors and each threat pattern in the security event knowledge graph, outputting an event logic chain consistency score (Score_logic) and the corresponding threat type. Further, in this embodiment, the similarity matching can be calculated using cosine similarity or Euclidean distance. Each threat pattern in the security event knowledge graph is stored as a low-dimensional dense vector, which is pre-calculated using TransE or TransH knowledge graph embedding algorithms.

[0041] The time window consistency check, spatial location consistency check, and security event logic chain verification are executed sequentially. Only data that passes the previous step can proceed to the next step, forming a progressive screening process.

[0042] S104. Combine the consistency verification results with a confidence score according to the preset fusion strategy.

[0043] In one implementation of this application, the event authenticity confidence score is output by combining the above three-dimensional verification results. If the confidence score exceeds the set threshold, it is determined to be a real security threat event; otherwise, it is determined to be a false alarm and recorded.

[0044] Specifically, the total number of verification tasks issued during the handling of this suspected incident is recorded as the first number; the number of valid data points that pass the time window consistency check is recorded as the second number; the ratio between the second number and the first number is calculated, and this ratio is used as the valid data time coverage rate. This ratio reflects the proportion of verification tasks that successfully return valid data within the preset time window out of all issued verification tasks. The higher the ratio, the better the response consistency of each sensor in the time dimension.

[0045] The number of valid temporal data points that pass the time window consistency check is recorded as the third quantity. The number of valid spatiotemporal data points that pass both the time window consistency check and the spatial location consistency check is recorded as the fourth quantity. The ratio between the fourth quantity and the third quantity is calculated, and this ratio is taken as the valid data spatial pass rate. This ratio reflects what proportion of the valid temporal data simultaneously meets the spatial location consistency requirements; a higher ratio indicates better positioning consistency of each sensor in the spatial dimension.

[0046] Obtain the event logic chain consistency score output after similarity matching through the security event knowledge graph. This score reflects the degree of matching between the current multimodal perception data combination and the known security threat event patterns. The higher the score, the more consistent the current event is with the behavioral logic characteristics of real security threats.

[0047] Obtain the pre-configured time coverage weight coefficient, spatial passability weight coefficient, and logical chain score weight coefficient; the sum of these three weight coefficients is 1. Multiply the effective data time coverage by the time coverage weight coefficient to obtain the first time-weighted value; multiply the effective data spatial passability by the spatial passability weight coefficient to obtain the second spatial-weighted value; multiply the event logical chain consistency score by the logical chain score weight coefficient to obtain the third logical-weighted value; add the first time-weighted value, the second spatial-weighted value, and the third logical-weighted value to obtain the final confidence score. This confidence score measures the probability that the current suspected event is a real security event; the higher the score, the greater the likelihood that the event is a real threat.

[0048] Furthermore, by combining the results of the three-dimensional verification, the final confidence score is synthesized according to the following formula: Confidence=α×(N_valid / N_total)+β×(N_spatial / N_valid)+γ×Score_logic; Wherein, coefficient α is the time window consistency weight, β is the spatial location consistency weight, γ is the event logic chain matching weight, N_valid is the number of valid time data, N_spatial is the number of valid spatiotemporal data, N_total is the total number of verification tasks issued, and Score_logic is the event logic chain consistency score.

[0049] In one implementation of this application, the time window consistency weight, spatial location consistency weight, and event logic chain matching weight in this embodiment are obtained through offline optimal weight search before deployment.

[0050] Specifically, before system deployment, historical security data of the target building is collected, including labeled real threat events and false alarm events. A training set and a validation set are constructed, whereby the training set is used for model training during the weight search process, and the validation set is used to evaluate the performance of each candidate weight combination. To ensure the statistical significance of the search results, the total sample size of the historical security data is no less than 500 cases.

[0051] A grid search combined with K-fold cross-validation is employed. Under the constraints of parameter space α∈[0,1], β∈[0,1], γ∈[0,1] and α+β+γ=1, the search seeks the weight combination that maximizes the F1-score on the validation set. For example, in K-fold cross-validation, K is set to 5, meaning the training set is evenly divided into 5 subsets. Each time, 4 subsets are used for training, and the remaining subset is used for validation. This process is repeated 5 times, and the average F1-score is used as the performance evaluation metric for this weight combination. The search result is the system's embedded default weight. This offline search process only needs to be executed once during implementation, and the search result is written to the system configuration area, eliminating the need for repeated execution after deployment.

[0052] In one implementation of this application, during actual operation, the system continuously collects manual feedback labels of the judgment results and periodically performs online weight fine-tuning. The fine-tuning employs a Bayesian optimization method, starting with the current weight combination and searching within the neighborhood Δ∈[-0.05, +0.05] for a new weight combination that maximizes the recent judgment accuracy. If the verification accuracy of the new weight combination improves by more than a set threshold, the system's current weights are updated; otherwise, the original weights remain unchanged. This online optimization mechanism ensures that the system can adapt to the security environment characteristics of different buildings.

[0053] Specifically, this embodiment obtains feedback tags corresponding to the security event detection results of each spatial region, and determines the event density coefficient based on the event occurrence frequency of each spatial region. Starting from the current weight combination, a candidate weight combination is iteratively searched within a preset neighborhood using a Bayesian optimization method. In each iteration, the candidate sampling points are weighted according to the event density coefficient of each spatial region, and the weighted accuracy of each spatial region is used as the observation value of the Bayesian optimization objective function to update the optimization model. After the iteration is completed, the candidate weight combination with the highest weighted accuracy is updated as the current weight.

[0054] Furthermore, manual feedback tags corresponding to the detection results of each security incident are continuously collected. Each feedback tag indicates whether the detection result is a real threat or a false alarm. Feedback tags are categorized based on the spatial region where each security incident occurred, grouping tags belonging to the same spatial region together. The total number of feedback tags in each spatial region is counted, reflecting the frequency of security incidents in that region within the statistical period. Based on the event frequency of each spatial region, the event density coefficient is calculated; spatial regions with higher event frequencies have larger event density coefficients. Using the currently used weight combination as the starting point for Bayesian optimization, a search boundary is set within a preset neighborhood range, preparing to iteratively search for a better weight combination. In each iteration, the Bayesian optimization model generates several candidate sampling points based on the current Gaussian process surrogate model. Based on the event density coefficient of each spatial region, the candidate sampling points are weighted; spatial regions with higher event density coefficients receive higher weights during the weighting process, thus favoring weight optimization in areas with high event frequency. From the weighted candidate sampling points, the target sampling point is selected. The weight combination corresponding to the target sampling point is used as the current evaluation weight, and the detection accuracy of security events in each spatial region is calculated. The detection accuracy of each spatial region is weighted and summed according to the corresponding event density coefficient to obtain the weighted accuracy under that weight combination. The target sampling point and its corresponding weighted accuracy are used as a new set of observation data and added to the historical observation dataset of the Bayesian optimization model to update the Gaussian process surrogate model, making the model's fit to the objective function more accurate. It is determined whether the current iteration count has reached the preset maximum iteration count. If not, the next iteration continues; if it has, the iteration process stops. From all the evaluated candidate weight combinations in previous iterations, the one with the highest weighted accuracy is selected as the weight combination to be updated. The currently used weight combination is updated to the weight combination to be updated, completing this round of online adaptive fine-tuning.

[0055] In one implementation of this application, the construction of the security event knowledge graph adopts a dual-mode design combining in-memory graph and persistent storage. Specifically, the memory structure uses a hybrid storage of adjacency list and adjacency matrix. The entity set E = {e1, e2, ..., e...} n}, each entity e i Contains attribute tuples<ID, Type, Attributes, Timestamp,Confidence> (Entity unique identifier, entity type, entity attribute set, timestamp, confidence level); relation set R = {r1, r2, ..., r...} m}, each relation r jContains attribute tuples<Subject_ID, Predicate, Object_ID,Weight, Evidence_Source> (Subject entity identifier, relation predicate, object entity identifier, relation weight, evidence source); To support efficient spatiotemporal queries, a spatial index R-tree and a temporal index B+-tree are established. Persistent structure: An attribute graph model is used to store data in a graph database. Nodes correspond to entities, edges correspond to relations, and the attributes of nodes and edges contain complete metadata. An inverted index is also maintained to support fast inverse queries for given sensor combinations to possible event types. Multimodal feature template library: Each event type node in the graph is equipped with a multimodal feature template. The template contains typical sensor data patterns for that event type, used for pattern matching in the analysis engine.

[0056] In one implementation of this application, the security event knowledge graph is constructed using a dual-driven approach of top-down and bottom-up. This includes: **Ontology Definition Phase:** Based on expert knowledge in the security field, the ontology structure of the graph is defined, including entity types (EventType, SensorType, SpatialRegion, TemporalPattern, ThreatLevel), relationship types (triggers, co-occurs-with, located-in, precedes, indicators), and attribute sets (confidence, frequency of occurrence, spatiotemporal constraints). **Initial Construction Phase:** Historical security event data, security industry standard documents, and equipment manufacturer technical manuals are collected as structured data sources. A top-down approach maps expert-defined event patterns to entities and relationships in the graph. Simultaneously, a bottom-up approach uses frequent pattern mining to discover implicit multimodal association rules from historical event data, automatically supplementing the graph. Vectorization embedding stage: The TransE / TransH knowledge graph embedding algorithm is adopted to map entities and relations in the graph into low-dimensional dense vectors, so that the relation translation operation in the vector space can accurately reflect the semantic relations in the graph, providing a computable similarity measure for subsequent security event matching.

[0057] In one implementation of this application, the embodiment further includes a method for updating a security knowledge graph. Through a mechanism combining online incremental updates and periodic global optimization, the knowledge graph is ensured to continuously adapt to new forms of security threats. Specifically, this includes: Online incremental update: After the judgment engine outputs the event judgment result, the judgment result is compared with the actual handling result. If a new evidence combination pattern is found, the new event pattern is extracted from the newly added historical event data through the FP-Growth frequent pattern mining algorithm and automatically converted into triples and added to the knowledge graph.

[0058] Confidence decay mechanism: the weight w of each relation edge in the security knowledge graph ij (t) decays exponentially over time, with the decay formula being w. ij (t) = w ij (0) × e^(-λt), where λ is the decay coefficient (default λ=0.01 / day) and t is the number of days since the last verification. When the weight decays to below the threshold, the triple is automatically marked as awaiting manual review, ensuring that the knowledge graph can automatically eliminate outdated threat patterns.

[0059] Periodic global optimization: In this embodiment, the knowledge graph is stored in a shared data object of distributed data management, and each edge node locally caches a subset of triples related to its jurisdiction. When the knowledge graph is updated for population and / or review, the changes are automatically synchronized to all edge nodes through the publish-subscribe mechanism of distributed data management.

[0060] S105. After the confidence score meets the preset security scoring conditions, the suspected event is determined to be a real security event. At least one response action is automatically orchestrated and initiated through the open-source HarmonyOS distributed task scheduling.

[0061] In one implementation of this application, event feature information corresponding to a real security event is obtained; wherein, the event feature information includes at least the event type, event location, and event risk level. Based on the event feature information, a pre-set response strategy mapping table is queried to determine the set of response actions to be executed. Through the open-source HarmonyOS distributed task scheduling, each response action in the response action set is distributed in parallel to the corresponding atomic service for execution.

[0062] Specifically, in this embodiment, based on the output of the analysis engine, various atomic response services are automatically orchestrated and executed in parallel through distributed task scheduling to achieve a second-level response closed loop. The response orchestration engine maintains an event type-response action mapping table, which is stored in the form of atomic services and supports dynamic updates. For different types of real security events, the mapping table specifies the combination of atomic services that need to be called in parallel, including any combination of access control atomic services, camera tracking atomic services, alarm push atomic services, and audible and visual alarm atomic services. When adding a new security event type or a new response action, it is only necessary to register the corresponding atomic service to the distributed network and update the mapping table, without modifying the core system code.

[0063] In one implementation of this application, the embodiment of this application is based on the node status awareness capability of the open source HarmonyOS distributed soft bus to monitor the health status of each node in the network in real time, and automatically trigger task migration and degradation scheduling strategies when a node fails.

[0064] Specifically, the online status of each edge node is monitored in real time through the heartbeat mechanism of the open-source HarmonyOS distributed soft bus. Simultaneously, the number of online security devices connected to the managed area of ​​each online edge node is periodically counted, and the ratio of the number of online devices to the total number of devices in the managed area is calculated to obtain the device availability rate of that edge node. When the heartbeat signal of an edge node is detected to be interrupted, the edge node is determined to be offline and identified as a faulty node. Alternatively, when the device availability rate of an online edge node falls below a preset fault threshold, the edge node is determined to be online but has lost basic security detection capabilities, and is also identified as a faulty node.

[0065] The target spatial area under the jurisdiction of the faulty node is determined. All security event records for that target spatial area within a preset time period prior to the fault occurrence are retrieved from the distributed data management system. These records are then arranged into a security event sequence according to the chronological order of their occurrence. The security event sequence is traversed, analyzing the spatial relationships and time intervals between adjacent events. If the spatial positions of adjacent events advance sequentially in a certain direction, and the time interval between adjacent events is less than a preset time interval threshold, then these events are determined to belong to the same associated event chain. The starting event position, ending event position, total number of events, and total duration of this associated event chain are recorded.

[0066] Based on the spatial vector between the starting and ending event positions in the associated event chain, the propagation direction of the chain is determined. The propagation speed is calculated based on the spatial distance between the starting and ending events and the total duration. Using the propagation direction and speed, combined with the position of the ending event and a preset prediction duration, the possible spatial location of the chain in the next time period is calculated. A predicted affected area is defined centered on this location with a preset radius, and this predicted affected area is designated as the target spatial area. The jurisdictional area division information of each edge node within the building is queried to find the edge node whose jurisdiction covers the target spatial area, and this edge node is designated as the takeover node.

[0067] The system retrieves all tasks currently assigned to the faulty node that are awaiting migration, including ongoing verification tasks, pending analysis tasks, and pending response orchestration tasks. Using the open-source HarmonyOS distributed task scheduling mechanism, all these tasks are migrated to the takeover node for execution. After the migration is complete, the takeover node continues to execute these tasks, ensuring uninterrupted security detection capabilities in the area under the faulty node's jurisdiction.

[0068] Figure 3 This is a schematic diagram of the structure of a building security event detection system based on the open-source HarmonyOS, provided as an embodiment of this application. Figure 3 As shown, the building security event detection system based on the open-source HarmonyOS includes: a sensing and perception layer, an edge collaboration layer, and an application management layer.

[0069] The sensing layer includes a distributed device access module, which connects building security devices to the same distributed collaborative network based on the open-source HarmonyOS distributed soft bus. Specifically, this includes access controllers, IP network cameras, vibration sensors, and smoke / gas sensors. Each device connects to the edge collaborative network via the open-source HarmonyOS distributed soft bus, registering its data capabilities with the system in the form of atomic services, without requiring additional middleware adaptation.

[0070] The edge collaboration layer is deployed on the edge gateway nodes of each floor. These edge nodes interconnect through the open-source HarmonyOS distributed soft bus, forming a decentralized distributed collaboration network. The analysis engine and response orchestration module run as atomic services, supporting dynamic migration between nodes. This includes: The suspected event triggering module runs as an atomic service on the edge node and is used to generate a suspected event record when any security device data triggers an alarm condition. The multimodal parallel verification module is deployed in the form of an atomic service set on the edge gateway of each floor. Driven by distributed task scheduling, it executes in parallel and sends verification tasks to the atomic services of other security devices in the spatial area where the suspected event is located. The spatiotemporal consistency assessment engine is deployed at the floor or building collaborative decision-making node. It is used to receive multimodal perception data returned by each verification task, perform multi-dimensional progressive consistency verification on the multimodal perception data, synthesize the consistency verification results into a confidence score according to the preset fusion strategy, and determine the suspected event as a real security event after the confidence score meets the preset security scoring conditions. The intelligent response orchestration module is used to automatically orchestrate and initiate at least one response action through the open-source HarmonyOS distributed task scheduling.

[0071] Distributed fault tolerance management module: Based on the node status awareness capability of the open source HarmonyOS distributed soft bus, it monitors the health status of each node in the network in real time and automatically triggers task migration and degradation scheduling strategies when a node fails.

[0072] The application management layer includes global security policy configuration, device management, and statistical analysis and display. It runs in the building management center or cloud and reads real-time alarms and analysis results through open-source HarmonyOS distributed data management. It is also responsible for global security policy configuration, device management, and statistical analysis and display.

[0073] This application provides a non-volatile computer storage medium storing computer-executable instructions. These instructions are configured to: connect building security devices to the same distributed collaborative network based on the open-source HarmonyOS distributed soft bus; when any security device's data triggers an alarm condition, generate a suspected event record and, through the open-source HarmonyOS distributed task scheduling, issue verification tasks to the atomic services of other security devices within the spatial area where the suspected event is located; receive multimodal perception data returned by each verification task and perform multi-dimensional progressive consistency verification on the multimodal perception data; synthesize a confidence score based on the consistency verification results according to a preset fusion strategy; after the confidence score meets the preset security scoring conditions, determine that the suspected event is a real security event, and automatically orchestrate and initiate at least one response action through the open-source HarmonyOS distributed task scheduling.

[0074] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for devices and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0075] The above descriptions are merely embodiments of this application and are not intended to limit the scope of this application. For those skilled in the art, various modifications and variations can be made to the embodiments of this application. These modifications or substitutions do not cause the essence of the corresponding technical solutions to depart from the spirit and scope of the technical solutions in the embodiments of this application.

Claims

1. A building security event detection method based on the open-source HarmonyOS, characterized in that, The method is executed by edge nodes deployed in various areas of the building, and the method includes: Based on the open-source HarmonyOS distributed soft bus, security devices in buildings are connected to the same distributed collaborative network; When any security device data triggers an alarm condition, a suspected event record is generated, and a verification task is sent to the atomic service of other security devices in the spatial area where the suspected event is located through the open-source HarmonyOS distributed task scheduling. Receive the multimodal perception data returned by each of the verification tasks, and perform multi-dimensional progressive consistency verification on the multimodal perception data; The consistency verification results are combined into a confidence score according to a pre-defined fusion strategy. Once the confidence score meets the preset security scoring conditions, the suspected event is determined to be a real security event. At least one response action is automatically orchestrated and initiated through the open-source HarmonyOS distributed task scheduling.

2. The building security event detection method based on open-source HarmonyOS according to claim 1, characterized in that, The process of distributing verification tasks to the atomic services of other security devices within the spatial area where the suspected incident occurred, through the open-source HarmonyOS distributed task scheduling, specifically includes: The target verification area is determined with the spatial location of the suspected event as the center and a preset distance as the radius. The verification tasks are distributed in parallel to each atomic service of different sensing modalities within the target verification area through the open-source HarmonyOS distributed task scheduling, so that each atomic service can perform verification data collection and feature extraction locally, and write the extraction results into the shared data space through the open-source HarmonyOS distributed data management; wherein, each verification task is set with a maximum verification duration.

3. The building security event detection method based on open-source HarmonyOS according to claim 1, characterized in that, The multi-dimensional progressive consistency verification of the multimodal sensing data specifically includes: An effective time window is constructed centered on the timestamp of the suspected event. The consistency of the time window is verified for each of the multimodal sensing data. Data whose timestamps fall within the effective time window are marked as valid time data. An effective spatial region is constructed centered on the spatial location of the suspected event. Spatial location consistency is verified for each of the effective temporal data. Data whose collection location falls within the effective spatial region is marked as spatiotemporally valid data. The spatiotemporal valid data is matched with the security event knowledge graph for event logic chain similarity, and an event logic chain consistency score is output based on the matching results.

4. The building security event detection method based on open-source HarmonyOS according to claim 3, characterized in that, The process of synthesizing a confidence score from the consistency verification results according to a pre-defined fusion strategy specifically includes: The effective data time coverage rate is determined based on the ratio between the number of valid time data and the total number of verification tasks issued. Based on the ratio between the number of valid spatiotemporal data and the number of valid temporal data, the valid data spatial throughput rate is determined. Based on preset weighting coefficients, the effective data time coverage rate, the effective data spatial pass rate, and the event logic chain consistency score are weighted and fused to obtain the confidence score.

5. The building security event detection method based on open-source HarmonyOS according to claim 4, characterized in that, The method further includes, after weighting and fusing the effective data time coverage, the effective data spatial pass rate, and the event logic chain consistency score based on preset weight coefficients, the method further includes: Obtain feedback tags corresponding to the building security incident detection results, and classify and label the feedback tags based on the spatial area where each building security incident occurred; Based on the annotation results, the event density coefficients corresponding to each of the spatial regions are determined; Starting with the current weight combination, candidate weight combinations are iteratively searched within a preset neighborhood using a Bayesian optimization method. In each iteration, the candidate sampling points are weighted according to the event density coefficients corresponding to each spatial region to determine the target sampling point; The weighted accuracy of security events in each spatial region is determined by combining the weights corresponding to the target sampling points. The weighted accuracy is used as the observed value of the Bayesian optimization objective function to update the Bayesian optimization model. This process is repeated until the preset number of iterations is reached. The candidate weight combination with the highest weighted accuracy in each iteration is determined as the weight combination to be updated, and the current weight is updated to the weight combination to be updated.

6. The building security event detection method based on open-source HarmonyOS according to claim 3, characterized in that, After synthesizing a confidence score from the consistency verification results according to a pre-defined fusion strategy, the method further includes: The verification results are compared with the actual handling results. If a new security incident evidence combination pattern exists, it is converted into a triple and added to the security incident knowledge graph to achieve filling and updating. The security incident knowledge graph is stored in a shared data object of distributed data management. In addition, the confidence decay value of each triple in the security event knowledge graph is determined, and when the confidence decays to less than a preset threshold, the triple is reviewed and updated. When the security event knowledge graph undergoes the population update and / or the review update, the changes are automatically synchronized to all edge nodes through the publish-subscribe mechanism of the distributed data management, so that each edge node updates its locally cached subset of triples according to the synchronized changes.

7. The building security event detection method based on open-source HarmonyOS according to claim 1, characterized in that, The automatic orchestration and initiation of at least one response action through the open-source HarmonyOS distributed task scheduling specifically includes: Obtain event feature information corresponding to the real security event; wherein, the event feature information includes at least the event type, event location, and event risk level; Based on the event characteristic information, query the preset response strategy mapping table to determine the set of response actions to be executed; The open-source HarmonyOS distributed task scheduling mechanism distributes each response action in the response action set to the corresponding atomic service for execution in parallel.

8. The building security event detection method based on open-source HarmonyOS according to claim 1, characterized in that, After connecting building security devices to the same distributed collaborative network based on the open-source HarmonyOS distributed soft bus, the method further includes: When any edge node is detected to be offline, or when the failure rate of security equipment within the jurisdiction of any online edge node is higher than a preset failure threshold, the edge node is determined to be a faulty node. Obtain the sequence of security events that occurred within a preset time period before the fault in the target spatial region corresponding to the fault node. Based on the spatial location and time interval of each event in the security event sequence, a chain of related events occurring sequentially along the spatial direction is determined; Based on the propagation direction and speed of the associated event chain, the target spatial region involved by the associated event chain in the next time period is determined; The edge nodes corresponding to the target space region are identified as takeover nodes, and the tasks currently being migrated by the faulty node are migrated to the takeover nodes for execution.

9. A building security event detection system based on the open-source HarmonyOS, characterized in that, The system includes: The distributed device access module is used to connect building security devices to the same distributed collaborative network based on the open-source HarmonyOS distributed soft bus. The suspected event triggering module is used to generate a suspected event record when any security device's data triggers an alarm condition; The multimodal parallel verification module, through the open-source HarmonyOS distributed task scheduling, sends verification tasks to the atomic services of other security devices in the spatial area where the suspected incident is located; The spatiotemporal consistency assessment engine is used to receive multimodal perception data returned by each verification task, perform multi-dimensional progressive consistency verification on the multimodal perception data, synthesize a confidence score based on the consistency verification results according to a preset fusion strategy, and determine the suspected event as a real security event after the confidence score meets the preset security scoring conditions. The intelligent response orchestration module is used to automatically orchestrate and initiate at least one response action through the open-source HarmonyOS distributed task scheduling.

10. A non-volatile computer storage medium storing computer-executable instructions, characterized in that, The computer-executable instructions are capable of performing the method described in any one of claims 1-8.

Images