Campus safety risk early warning method and system based on continuous time knowledge graph

Abstract

This invention discloses a campus safety risk early warning method and system based on continuous-time knowledge graphs, belonging to the field of smart campus safety supervision. Addressing the shortcomings of campus safety early warning systems that rely on fixed rules, discrete statistics, and manual judgment, resulting in identification lags, this solution collects multi-source heterogeneous campus data, models personnel and locations as entities, and various behaviors as relationships, constructing a continuous-time campus knowledge graph with precise timestamps. It extracts time-interval-aware subgraphs, models temporal event chains through continuous-time path encoding, and aggregates them using an attention mechanism to obtain short-term risk representations of objects. A historical behavior intuition module is added to mine long-term behavioral baselines, integrating long and short-time series scores to distinguish between normal behavioral fluctuations and abnormal risks, outputting risk prediction results along with explanations of key event path tracing. This solution effectively improves the real-time performance, accuracy, and interpretability of campus anomaly identification, student safety assessment, regional risk early warning, and emergency auxiliary decision-making.

Description

Technical Field

[0001] This invention relates to the field of smart campus security monitoring technology. More specifically, this invention relates to a campus security risk early warning method and system based on continuous-time knowledge graphs. Background Technology

[0002] As the construction of smart campuses continues to advance, universities have gradually accumulated a large amount of information data, including access control card swiping, classroom attendance, dormitory access, campus consumption, library access, activity participation, security alarms, equipment operation, and on-campus incident handling. This data can reflect the operational status of students, teachers, key areas, and campus facilities from different perspectives, and is an important foundation for conducting student safety status assessments, detecting abnormal behavior, issuing early warnings for key areas, and assisting in emergency response decision-making.

[0003] However, existing campus security risk identification methods typically rely on fixed rules, discrete statistical reports, or manual experience-based judgment, which have the following limitations: First, they do not adequately utilize temporal information. Conventional methods often perform statistics based on days, weeks, or fixed time windows, easily overlooking consecutive abnormal events occurring within a short period and the sequence of events, making it difficult to accurately depict continuous behavioral chains such as "absence first, then late-night entry / exit, and then triggering an alarm." Second, they lack cross-scenario correlation capabilities. Access control, dormitory, attendance, consumption, and security data are usually scattered across different systems, making it difficult for a single system to discover multi-hop correlations between students, locations, equipment, and events, leading to delays in risk identification. Third, they lack interpretability. Some machine learning methods can output risk scores, but they cannot explain which key event paths, time intervals, and behavioral relationships jointly cause the risk, making it difficult for counselors, security personnel, or on-duty staff to review and handle the situation. Therefore, methods for campus security risk reasoning and early warning still need further improvement. Summary of the Invention

[0004] The purpose of this invention is to provide a campus safety risk early warning method and system based on continuous-time knowledge graphs, which solves the technical problems of existing campus safety early warning systems that rely on discrete statistics and manual rules, have difficulty capturing fine-grained time interval evolution, and have inexplicable early warning causes.

[0005] To achieve these objectives and other advantages of the present invention, a campus security risk early warning method based on continuous-time knowledge graphs is provided, comprising:

[0006] Acquire multi-source heterogeneous data from the campus, and perform identity mapping, time standardization, and data cleaning on the multi-source heterogeneous data to obtain standardized campus data;

[0007] Based on the standardized campus data, students, teachers, venues, courses, equipment, events, and organizations are modeled as entities, and entry and exit, absence, consumption, companionship, visits, alarms, participation, and related behaviors are modeled as relationships, thus constructing a continuous-time campus knowledge graph with precise timestamps.

[0008] For the target regulatory object and the target prediction time, based on the sequence of events, the time interval between events, the relationship type and the historical behavior pattern, the time interval perception subgraph related to the changes in campus safety risks is extracted from the continuous time campus knowledge graph;

[0009] The event paths in the time interval-aware subgraph are encoded using continuous time path encoding to model the time interval evolution, behavioral sequence, and relational activation state in the event chain, thereby obtaining an event path representation.

[0010] Based on the event path representation, key neighborhood information is fused using path importance calculation and attention neighborhood aggregation mechanism to generate a campus safety risk score for the target regulatory object.

[0011] Generate historical behavioral intuition scores based on the long-term behavioral patterns of the target regulatory objects;

[0012] The historical behavioral intuition score and the campus safety risk score are combined to form a comprehensive risk score;

[0013] Based on the comprehensive risk score, the system outputs campus safety risk prediction results, risk levels, early warning prompts, and corresponding explanations of key event paths.

[0014] Preferably, the multi-source heterogeneous data includes at least one or more of the following: access control card swipe records, dormitory entry and exit records, classroom attendance records, on-campus consumption records, library access records, campus activity participation records, video security alarm records, equipment operation records, psychological or counseling records, and on-campus incident handling records.

[0015] Preferably, the construction of a continuous-time campus knowledge graph containing precise timestamps includes:

[0016] A quadruple containing subject entity, relation type, object entity, and timestamp is constructed to represent campus event facts. The timestamp is retained based on the actual occurrence time of the event, so that the continuous time campus knowledge graph is located in continuous time space.

[0017] Preferably, the extraction of a time interval perception subgraph related to changes in campus safety risks from the continuous-time campus knowledge graph includes: taking the target monitored object as the root node, and performing time bias sampling on the multi-hop neighbor event path based on the time difference between adjacent historical events and the target predicted time, the average event interval of the target monitored object, and the correlation of relationship types.

[0018] Preferably, the continuous time path encoding includes two stages: state transformation and state evolution; wherein state transformation is used to represent the activation effect of relation type on the current event state, and state evolution is used to represent the evolution effect of continuous time interval between adjacent events on the hidden state.

[0019] Preferably, the method of integrating key neighborhood information using path importance calculation and attention neighborhood aggregation mechanism includes: calculating attention weights based on query relationships, candidate event path representations, path tail entity representations, and path position representations, and using the attention weights as the basis for interpreting key paths in risk reasoning.

[0020] Preferably, a historical behavioral intuition score is generated based on the long-term behavioral patterns of the target regulatory object, including:

[0021] An adaptive capacity historical memory unit is constructed using the target regulatory object and relationship type as an index. Based on the long-term behavioral data stored in the historical memory unit, the historical behavior intuition score is calculated by combining the historical frequency of the object entity, the event time interval, and the time decay coefficient.

[0022] Preferably, the risk level is one of low risk, risk of concern, relatively high risk, and high risk, and the risk level is obtained by matching the comprehensive risk score with different pre-set segment thresholds.

[0023] This invention also provides a campus security risk early warning system based on continuous-time knowledge graphs, comprising:

[0024] The multi-source data access module is used to acquire multi-source heterogeneous data in the campus, and to perform identity mapping, time standardization and data cleaning on the multi-source heterogeneous data to obtain standardized campus data.

[0025] The continuous-time campus knowledge graph construction module is used to model students, teachers, places, courses, equipment, events and organizations as entities based on the standardized campus data, and to model entry and exit, absence, consumption, companionship, access, alarm, participation and related behaviors as relationships, and to construct a continuous-time campus knowledge graph containing accurate timestamps.

[0026] The time interval perception subgraph extraction module is used to extract time interval perception subgraphs related to changes in campus safety risks from the continuous-time campus knowledge graph based on the event occurrence sequence, time interval between events, relationship type, and historical behavior patterns, targeting the target regulatory object and the target prediction time.

[0027] The continuous time path encoding module is used to encode the event paths in the time interval sensing subgraph in a continuous time path manner, model the time interval evolution, behavior sequence and relation activation state in the event chain, and obtain the event path representation.

[0028] The path importance and neighborhood aggregation module is used to generate a campus safety risk score for the target monitored object by fusing key neighborhood information based on the event path representation, using path importance calculation and attention neighborhood aggregation mechanism;

[0029] The Historical Behavior Intuition module is used to generate historical behavior intuition scores based on the long-term behavioral patterns of the target regulatory object.

[0030] The risk reasoning module is used to integrate the historical behavioral intuition score with the campus safety risk representation to form a comprehensive risk score.

[0031] An interpretable early warning module is used to output the campus safety risk level, early warning prompts, and corresponding explanations of key event paths based on the comprehensive risk score.

[0032] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.

[0033] The present invention has at least the following beneficial effects:

[0034] 1. Enhanced fine-grained time modeling capabilities: This application preserves the precise timestamps of campus events, avoiding the obscuring of event sequence and time interval differences by fixed time windows or discrete snapshots, and can more accurately identify risk evolution chains that occur continuously in a short period of time.

[0035] 2. Enhanced cross-scenario association reasoning capabilities: This application unifies multi-source data such as access control, dormitories, attendance, consumption, library, activities, and alarms into a continuous-time knowledge graph, which can discover multi-hop associations between students, places, equipment, and events, and improve the completeness of abnormal behavior identification.

[0036] 3. Balancing long-term patterns and recent anomalies: This application captures recent event chains through continuous time subgraph representation and learns long-term patterns through historical behavior intuition modules. This can reduce the misjudgment of normal fluctuations in work and rest as risks, and can also detect abnormal changes that deviate from personal or group habits.

[0037] 4. Explainability and Handling-Friendliness: This application outputs key event paths, time intervals, relationship types, and path weights, enabling the early warning results to be reviewed by counselors, security personnel, and management personnel, effectively improving the credibility and handling efficiency of campus safety early warnings.

[0038] Other advantages, objectives and features of the present invention will become apparent in part from the following description, and in part from those skilled in the art through study and practice of the invention. Attached Figure Description

[0039] Figure 1 This is a diagram illustrating the overall framework of the campus safety risk early warning system based on continuous-time knowledge graphs as described in this invention.

[0040] Figure 2 This is a schematic diagram of time interval sensing subgraph extraction in the campus safety risk early warning method based on continuous time knowledge graph described in this invention;

[0041] Figure 3 This is a schematic diagram of continuous-time path encoding and interpretable early warning in the campus safety risk early warning method based on continuous-time knowledge graph described in this invention. Detailed Implementation

[0042] The present invention will now be described in further detail with reference to the accompanying drawings, so that those skilled in the art can implement it based on the description.

[0043] like Figure 1 As shown, this invention provides a campus safety risk early warning method based on continuous-time knowledge graphs, including:

[0044] S1. Obtain multi-source heterogeneous data in the campus, and perform identity mapping, time standardization and data cleaning on the multi-source heterogeneous data to obtain standardized campus data;

[0045] Specifically, this step involves the collection and standardization preprocessing of heterogeneous data from multiple sources on campus. Its core is to integrate the raw business records scattered across various campus business subsystems. Through three core processing operations—unified identity mapping, time-dimension standardization, and dirty data cleaning—a standardized campus dataset with unified format, interoperable identifiers, and time-series alignment is generated.

[0046] The data sources for this step cover all business systems across the campus. Original behavior, alarm, and handling records can be retrieved from access control systems, classroom attendance systems, dormitory management systems, campus card systems, library systems, activity management systems, security alarm systems, and incident handling systems. For each original record, key fields such as personnel identification, location identification, equipment identification, behavior type, event occurrence time, event level, and handling status are parsed, invalid data is removed, and the format is standardized throughout the entire process.

[0047] Identity mapping is used to break down the barriers between independent codes in multiple systems. For example, student IDs scattered in the academic affairs system, employee IDs in the personnel system, equipment numbers in the equipment ledger, and venue codes corresponding to buildings and rooms can be uniformly mapped to a globally unique universal ID, so as to achieve identity alignment of the same person, equipment, and venue in cross-system data.

[0048] Time standardization is used to eliminate time discontinuity issues caused by different time formats of various business systems. For example, it can unify various heterogeneous time formats such as "YYYY-MM-DD HH:MM" of access control system, "MM / DD / YYYY Hour Minute Second" of all-in-one card system, and Unix segmented time of security system into a standard continuous timestamp with consistent precision, so as to ensure accurate matching of subsequent time sequence correlation and behavior trajectory inference.

[0049] The data cleaning process removes dirty data such as duplicate attendance records, records of devices with null values ​​or abnormalities, invalid alarms that are outside the campus's time and space range, and event handling statuses with logical conflicts. The final output is a standardized campus data base that can be used for subsequent map construction and risk reasoning.

[0050] S2. Based on the standardized campus data, students, teachers, venues, courses, equipment, events, and organizations are modeled as entities, and entry / exit, absence, consumption, companionship, access, alarms, participation, and related behaviors are modeled as relationships, thus constructing a continuous-time campus knowledge graph containing precise timestamps.

[0051] Specifically, in this step, students, teachers, venues, courses, equipment, events, and organizations are treated as entity sets, while entry / exit, absence, consumption, companionship, visitation, alarms, participation, affiliation, and disposition are treated as relation sets. Each campus behavior is modeled as a fact quadruple with a precise timestamp: ;

[0052] in, This represents the main entity, i.e., the party initiating the action, such as a student or a teacher; This refers to the object of an action, such as a course or dormitory. Indicates the type of relationship, such as entry / exit or absence; Represents consecutive timestamps indicating when an event occurred. Describes the set of all fact quadruples. Represents a set of entities Relation sets Timestamp set and set of facts Together they form a continuous-time campus knowledge graph.

[0053] S3. For the target regulatory object and the target prediction time, extract the time interval perception subgraph related to the changes in campus safety risks from the continuous time campus knowledge graph according to the event occurrence sequence, time interval between events, relationship type and historical behavior pattern.

[0054] Specifically, this step includes the following sub-steps:

[0055] 1) Generate campus safety risk query tasks: targeting specific regulatory bodies. Given the target prediction time τ, construct a risk query request. Only use... Based on previously occurred historical facts, the set of historical facts can be represented as follows: ;

[0056] Through this step, campus safety early warning is transformed into a risk state prediction problem based on continuous historical facts.

[0057] 2) Time-interval-aware subgraph extraction: based on the target monitored object As the root node, from In previous historical data, neighbor events were sampled using multi-hop paths. For candidate historical relationships... Calculate its sampling probability: ;

[0058] in, Represents a single candidate historical relationship The probability of being selected into a subgraph; The target prediction time is set as follows: for example, a risk assessment of abnormal student behavior is conducted uniformly at 10 PM every day, and 10 PM is the target prediction time. For candidate event timestamps, such as the timestamp corresponding to the event of a student swiping their access card in a non-teaching area at 20:10; The average interval between all historical events of the target monitored object. For example, if a student's various access and consumption events occur on average every 45 minutes over the past 30 days, then this 45-minute interval is the average interval between all such events. ; The time bias coefficient is a manually adjustable parameter used to control the strength of the model's preference for recent events. The larger the value, the more significant the increase in sampling weight is given to events that are closer to the prediction time; Refers to the target regulatory object At the target prediction time The set of all previously related neighbor temporal relationships; For set Any historical neighbor relationship is a general traversal variable used for traversal.

[0059] This time-weighted sampling mechanism naturally prioritizes events that are closer to the prediction time and highly correlated with the risk category. At the same time, it does not completely discard historical events that occurred earlier but have key explanatory value for the causes of risk. For example, if a student has a record of leaving the dormitory multiple times late at night a week ago, even if it is far from the prediction time, as long as the event belongs to the high-risk association type, it still has a certain probability of being sampled and retained in the subgraph for risk inference. The overall multi-hop sampling adopts the logic of recursively expanding outward from the root node to complete the subgraph construction. The first hop directly uses the target monitored object as the starting node and selects a certain number of first-level direct neighbor events and related entities based on the aforementioned time-aware sampling probability. The second hop uses the neighbor entities selected in the first hop as a new starting point and reuses the completely consistent time bias sampling rules to continue expanding outward to related events. The layer-by-layer sampling process is repeated until the maximum number of inference hops L set by the system is reached. Finally, a local inference subgraph containing multiple layers of time-related paths and taking into account the differences in the impact of time proximity is generated, providing structured input for subsequent path feature extraction and risk weight calculation.

[0060] S4. Perform continuous time path encoding on the event paths in the time interval perception subgraph, model the time interval evolution, behavior sequence and relation activation state in the event chain, and obtain the event path representation;

[0061] Specifically, after completing multi-hop temporal neighbor sampling and obtaining the continuous time subgraph G corresponding to the target monitored object, (s,τ) Subsequently, the system decomposes the complete subgraph and transforms it into a path set P composed of multiple ordered event paths. Each independent path within the set strictly follows the chronological order of the actual occurrence of events, connecting various elements in sequence, linking related entities, historical relationships, and the precise timestamps corresponding to each relationship. The query relationship to be analyzed is used as the final target prediction term for the entire path. This query relationship characterizes the specific risk behaviors that the model needs to identify and predict at the current prediction time τ, thus establishing the inference link of "past temporal behavior → future risk".

[0062] Taking the campus risk path example: "Zhang—(Absent)—Advanced Mathematics Class—(Late Night Entry / Exit)—West Gate of Campus—(Dormitory Not Returned)—Dormitory Building B—(Security Alarm)" Breakdown: The entire path connects two types of entities—personnel and locations—with four types of related edges in chronological order. The edges "Absent," "Late Night Entry / Exit," and "Dormitory Not Returned" represent historical relationships that have actually occurred and have corresponding timestamps. The "Security Alarm" at the end is the query relationship corresponding to this risk prediction. The final destination, "Dormitory Building B," is the entity at the end of the path. Simultaneously, throughout the entire process of building each path, the system calculates and stores the time interval Δt between two adjacent events within the path. i =ti-1 -t i For example, Zhang's absence record timestamp t i-1 With late-night access control timestamp t i The difference between the time interval values ​​will be synchronously stored in the path information, providing time-series basic data support for subsequent continuous time feature coding and risk weighting of behaviors with different time spans.

[0063] After obtaining the complete set of ordered event paths P, the encoding logic of alternating between relational state transformation and temporal state evolution is used for each event node within a single path. The hidden state of the path is updated node by node, and finally the global representation vector of the entire path is output for subsequent steps.

[0064] The first stage of encoding is the relational state transformation unit, which embeds the semantic type of the current event into the hidden state of the path history, completing the update of the risk state by the behavioral features. The corresponding calculation formula is as follows: ;

[0065] in, This represents the hidden state of the path history retained by the previous node before processing the i-th event; Let i be the relationship embedding vector corresponding to the i-th event relationship in the path; It is a nonlinear state transformation function with a learnable parameter ϕ, responsible for fusing historical states with current behavior embeddings and updating path risk hidden states.

[0066] Using a campus scenario as an example: taking the path "Zhang—(absent)—Advanced Mathematics Class—(late-night entry / exit)—West Gate of Campus" as an example, the initial hidden state of the path is the normal on-campus baseline state. When processing the "absent" event, Embedded for absence relationship, After the operation, the hidden state of the path changes from the normal attendance baseline to the absence abnormal activation state. When processing the "late-night entry and exit" event, the new late-night entry and exit relationship is embedded into the transformation function again. The risk characteristics of leaving school at night are superimposed on the absence abnormal state, so that the hidden state of the path gradually shifts to the high-risk range, realizing the state characterization of the cumulative risk of multiple behaviors.

[0067] After completing the relationship state update for a single event, the process enters the second stage, the time state evolution unit. This unit is used to characterize the continuous cumulative impact of the time interval between two adjacent events on the hidden state of path risk. The integral evolution formula is as follows: ;

[0068] in, It is the instantaneous hidden state of the path after the relationship transformation in the previous stage is completed;

[0069] Integration interval [t] i ,ti-1 ] represents the start and end timestamps of two adjacent events. The integral as a whole represents the cumulative change in risk status over time during the interval between the two events.

[0070] f θ It is a continuous-time evolution function with a learnable parameter θ.

[0071] To accurately fit the nonlinear pattern of risk change over time, the evolution function f θ The structure employs a gated loop unit architecture, implemented by simultaneously solving three sets of formulas: ; ;

[0072] in, , , These correspond to the learnable weight matrices for the update gate, reset gate, and candidate hidden states, respectively. σ is the instantaneous hidden state of the path at any time t after the relation transformation; σ is the Sigmoid activation function, and tanh is the hyperbolic tangent activation function; ⊙ represents element-wise multiplication of the vector; u is the update gate vector, which controls the retention ratio of historical risk states and newly added information over time; v is the candidate hidden state of the reset gate output, which is used to adjust the forgetting intensity of past abnormal behavior states.

[0073] The core value of this two-stage alternating coding mechanism is to distinguish the risk level differences of the same behavioral sequence at different time intervals. Taking campus operations as an example: if a student triggers a series of abnormal events within 2 hours, such as absence, leaving campus late at night, not returning to the dormitory, and security alarms, the short interval between events will accumulate a large number of abnormal increments in the time evolution integral, and the final hidden state of the path will show an extremely high risk characterization; if the above four abnormal behaviors occur sporadically over 7 days, the event intervals are extremely large, the risk state will continuously decay over time during the time evolution process, the accumulated abnormal increments of the integral are smaller, and the risk level corresponding to the final hidden state of the path is significantly lower.

[0074] After completing the alternating encoding iteration of all event nodes within the path, the hidden state vector output by the last node of the entire path is taken as the complete path representation of the event path and passed to the downstream steps for path attention weight calculation and neighborhood risk information aggregation.

[0075] S5. Based on the event path representation, key neighborhood information is fused using path importance calculation and attention neighborhood aggregation mechanism to generate a campus safety risk score for the target regulatory object.

[0076] This step, relying on the event path representation vectors output from step S4, quantitatively evaluates the contribution of each inference path to the risk prediction result of the current regulated object, selects high-contribution critical paths, and integrates the features of all paths to ultimately generate a complete and unified global risk representation of the target regulated object. Then, based on the global risk representation vector of the target regulated object... Complete the risk quantification and scoring.

[0077] Specifically, the system first retrieves the predefined query relationship embedding and performs a matching operation with the representation vector of each path to solve for the attention weight corresponding to each path. Then, using this weight as a coefficient, it performs weighted fusion and aggregation on the tail entity features and topological position features of each path. The tail entity of the path refers to the final destination entity reached by a single temporal inference link, and the position represents the topological hop depth used to encode the path in the subgraph. The system assigns exclusive learnable position embedding vectors to one-hop, two-hop, and three-hop paths to distinguish the differentiated impact of event links with different topological distances on risk assessment.

[0078] Single-head path attention and feature aggregation correspond to two sets of calculation formulas: ; ;

[0079] Where 'a' is the normalized attention weight of a single path, with a value range of 0 to 1. The higher the weight, the greater the reference value of the path for this risk prediction.

[0080] e r The predefined query relationship embedding vector in the aforementioned steps represents the target risk type to be identified (such as dormitory absence, security alarm, long-term stay off-campus risk query semantics). This represents the path representation matrix formed by concatenating all event path representation vectors of the target monitored object s at the target prediction time τ; d is the scaling factor used to eliminate the training instability caused by excessively large dot product magnitudes of high-dimensional vectors; d is the dimension of the path vector.

[0081] Softmax is a normalization function that converts all path matching scores into probabilistic weights that sum to 1.

[0082] e o For embedding the tail endpoint entity of a single path, for example, in the path "Zhang Mou—Absent—Advanced Mathematics Class—Late Night Entry / Exit—West Gate—Dormitory Not Returned—Dormitory Building B", the feature vector corresponding to the tail entity "Dormitory Building B" is e. o ;

[0083] e pFor path topology location embedding, for example, if the path "Zhang Mou—absent—Advanced Mathematics Class—late night entry and exit—West Gate—dormitory not returned—dormitory building B" is a three-hop inference link, then assign a three-hop exclusive learnable vector; This represents a vector concatenation operation used to embed the tail entity into e. o With topological location embedding e p Merged into a unified feature; This is a local risk representation of the target object for single-head attention output.

[0084] Let's continue with the campus scenario as an example: If the current query relation e r For the "dormitory absence security alarm risk", the system has two inference paths. Path 1 is a three-hop short-sequence continuous abnormal link (absence + leaving school late at night + dormitory alarm), and Path 2 is a one-hop ordinary library access record. Path 1 has a higher matching degree with the alarm risk query embedding, and will obtain a significantly larger attention weight 'a' after formula calculation. The model will prioritize the features of this abnormal path. Path 2 has a very low weight and has a negligible impact on the final risk result.

[0085] To enrich the feature representation capabilities of various risk paths and capture multi-dimensional and multi-perspective associated risk patterns, the system supports the use of a multi-head attention mechanism to optimize feature aggregation effects. The multi-head fusion calculation formula is as follows: ;

[0086] Among them, head1,...,head M There are M independent attention heads in total. Each attention head independently calculates a set of weighted path features using the single-head attention process described above. Each head is assigned independent learnable parameters and its contribution to path risk is evaluated from different semantic dimensions.

[0087] Concat() represents a vector concatenation operation, used to concatenate and fuse the local risk features output by M attention heads in a dimensional manner.

[0088] W O The output weight matrix represents a globally learnable matrix. It performs a linear dimensionality reduction transformation on the concatenated high-dimensional multi-head features, outputting a final global risk representation with regular dimensions that is suitable for downstream applications.

[0089] In addition to outputting the overall risk profile of the regulated entity for subsequent risk scoring and prediction, this step also selects several paths with high attention weights as key event paths for later visualization and interpretability of early warning results. For example, when a high-risk warning for a student is pushed out at night, the system can directly retrieve the high-weight path calculated in this step: "Zhang—absence—advanced mathematics class—late-night entry / exit—west gate of campus—dormitory not returned—dormitory building B," to intuitively display the complete temporal behavioral chain behind the warning to management personnel, ensuring that risk warnings are verifiable and their causes are traceable.

[0090] After obtaining the global risk representation vector of the target regulatory object Then, the system first represents the risk characteristics of the entire neighborhood of the object. The query relationship embedded with the type of risk to be assessed is e. r Vector concatenation and fusion are performed, and then the data is fed into a two-layer multilayer perceptron (MLP) scoring function to perform feature transformation and score output.

[0091] The two-layer MLP has a clear division of labor: the first layer receives the concatenated fusion vector, maps it to an intermediate feature space consistent with the hidden state dimension of the model, and uses the ReLU activation function to introduce non-linear fitting capability to capture the complex relationship between behavior and risk; the second layer performs dimensionality reduction mapping on the intermediate features, outputs a one-dimensional original scalar score, and then uses Sigmoid activation to constrain the value to the (0,1) interval. Finally, it obtains a standardized risk probability score through global Softmax normalization, and the corresponding calculation formula is as follows: ;

[0092] in, This represents the short-term behavior score of the object entity e corresponding to the behavior based on the time interval perception subgraph, at the prediction time τ, for the regulated object s, and under the judgment behavior relationship r. The value ranges from 0 to 1, and the closer the value is to 1, the higher the probability that the current regulated object will be subject to query risk.

[0093] However, the short-term risk score calculated solely based on the time interval perception subgraph in this step has significant limitations. On the one hand, it easily misjudges occasional fluctuations in an individual's normal behavior as risk events; on the other hand, it fails to identify gradual anomalies formed by slow shifts in long-term behavioral habits. For example, student Zhang usually returns to his dormitory before 9 PM, but on one particular day, he left school at 10 PM due to a club activity. The subgraph only captures this single instance of late return, which could easily result in an overly high risk score and a false alarm. In another scenario, a student gradually delays his return time over the past month, from 9 PM to 1 AM. A single subgraph cannot capture this long-term gradual trend, thus missing progressive risks. To compensate for the shortcomings of relying solely on recent event chains, the model subsequently introduces a historical behavior intuition module to supplement the long-term historical behavioral patterns and daily baseline habits of the monitored individual. This information, combined with the risk score from the subgraph in this step, completes the final accurate risk assessment.

[0094] S6. Generate historical behavioral intuition scores based on the long-term behavioral patterns of the target regulatory objects;

[0095] This step is used to make up for the shortcomings of the previous step, which only relied on the time interval perception subgraph for judgment, and to quantify the degree of behavioral abnormality from the perspective of the target object's long-term historical behavioral baseline.

[0096] Specifically, a dual-dimensional index of "target monitored object s + relationship type r" is adopted to persistently retain all historical information of the object under similar / approximate behavioral relationships, including related locations, personnel and other entities, event frequency, and the last occurrence time of each event, thereby constructing a dedicated historical memory unit; at the same time, a dynamic adaptive formula is set to calculate the storage capacity of the memory unit, realizing high-frequency behavior expansion and low-frequency behavior controlled storage. The capacity calculation formula is as follows: ;

[0097] in, The total storage capacity of the historical memory unit corresponding to the target monitored object s and the behavior relationship r represents the maximum number of historical behavior records that can be retained in this unit. This represents the basic memory capacity, which is the minimum number of storage entries reserved under this relationship to ensure that all behavior types have basic memory space. This represents the elastic adjustment coefficient, a manually preset hyperparameter that controls the impact of the total amount of historical events on storage expansion. This represents the total number of historical facts generated by the target monitored object s under relation r. This function represents the floor function, which rounds the expanded capacity down to the nearest integer, ensuring that the number of stored records is an integer.

[0098] Taking a campus scenario as an example: Set a basic capacity D. base =20, elasticity coefficient γ=0.3; Regarding student Zhang's "library borrowing" relationship, the total historical records F=120, substitute into the calculation of expansion capacity. The final total capacity of memory cells D memory =20+36=56 records, which can completely record the student's long-term borrowing behavior; while the same student's "late-night off-campus access" relationship history only has F=10, expanding the capacity. With a total capacity of only 23 entries, low-frequency risk behaviors do not require excessive storage resources, enabling dynamic allocation of storage resources.

[0099] The system calculates intuitive scores of historical behavior based on adaptive capacity historical memory units. The scoring formula quantifies the degree to which the current behavior deviates from the long-term behavioral baseline of the student and / or peer group and / or school area. ;

[0100] in, This represents the intuitive score of the long-term historical behavior of the object e corresponding to the behavior at the prediction time τ, for the regulatory object s, and for the judgment of the behavior relationship r, based on long-term historical behavior. The value range is (0,1). The closer the value is to 0, the more the behavior conforms to long-term habits. The closer the value is to 1, the more the behavior deviates from the norm.

[0101] n oThis indicates the frequency of the current candidate object entity's historical occurrence within the memory unit under this relation;

[0102] λ d This indicates that the model can learn a time decay coefficient, which controls the rate at which the weights of historical records decay over time.

[0103] Δt represents the target prediction time τ, which is the time interval between the last time the candidate object entity exhibited the same behavior; This represents the time decay exponent. The larger the interval Δt, the smaller the exponent result, and the weaker the constraint effect of long-term historical behavior on the current score.

[0104] Taking campus business analysis as an example: Taking student Li's "late return to dormitory due to curfew" as an example, its total memory capacity D memory =40.

[0105] Scenario 1 (Conforming to long-term habits): Li returns to his dormitory at 22:30 three times a week. The historical frequency of Li's late return location is dormitory building A. o =28, the last similar behavior occurred only Δt=1 day ago, the exponential decay term is close to 1; the product of 28 / 40 and the decay term is close to 0.7, the final score =1-0.7=0.3, the score is low, the behavior is consistent with the individual's long-term pattern and is not considered abnormal.

[0106] Scenario 2 (Severely deviating from the norm): Li has never returned to dormitory building C after 23:50 in the past. The historical frequency of this entity is n. o =0, then n o / D memory =0, final score =1, the score is close to the upper limit, the behavior is judged to be seriously deviating from the long-term baseline, which is a sudden abnormality.

[0107] Scenario 3 (Long-standing historical behavior): A year ago, Li briefly returned to dormitory building B late at night. o =5, but the interval between this record and the last record is Δt=300 days, the exponential decay term is close to 0, the overall multiplication is very small, and the score is close to 1; indicating that even if similar behavior has occurred before, but a long time has passed, the model still judges the current behavior to deviate from recent stable habits.

[0108] This score complements the subgraph risk score. Short-term links identify sudden and continuous anomalies, while historical intuition scores capture long-term habit shifts. The combination of the two can significantly reduce the probability of false alarms and missed alarms.

[0109] S7. The historical behavioral intuition score and the campus safety risk score are combined to form a comprehensive risk score;

[0110] This step involves fusing short- and long-term time-series risk scores. After obtaining the short-term continuous-time subgraph risk score and the long-term historical behavioral intuition score in the previous steps, the two-dimensional scores are weighted and fused using learnable weights to output the final comprehensive campus safety risk score that takes into account both the short-term emergency event chain and the long-term individual behavioral baseline. The complete fusion calculation formula is as follows: ;

[0111] in, The fusion weight coefficient represents the model's autonomous learning, with a value range of (0,1). It is used to balance the proportion of short-term temporal reasoning and long-term historical baseline information. The larger the value of β, the more the model focuses on the short-term risks of recent continuous event chains. 1-β is the weighting coefficient corresponding to the historical behavior intuition score. The larger the value, the more the model focuses on comparing the individual's long-term behavioral habits.

[0112] This weighted fusion mechanism enables complementary verification of short-term time-series features and long-term behavioral baselines, effectively solving the problems of false positives and false negatives caused by single-dimensional analysis. The following are two typical business scenarios:

[0113] Scenario 1: High-risk short-term events + severe long-term behavioral deviations trigger a high-risk warning due to a high overall score. Taking student Wang as an example, the predicted time τ is 23:50, the risk relationship r is the dormitory absence alarm, and the student exhibits a chain of abnormal events that day, including absenteeism, leaving school late at night, and prolonged lingering at the west gate. The short-term subgraph score... =0.91, Wang has never returned to dormitory building C before midnight, completely deviating from his long-term routine, historical behavioral intuition score. =0.94; Model learning weight β=0.55, substitute into the formula to calculate the comprehensive score. =0.55×0.91+0.45×0.94≈0.92, the overall score is close to the upper limit, the system judges it as a high risk and pushes an emergency security warning.

[0114] Scenario 2: Short-term behavior may appear abnormal, but it aligns with long-term historical patterns, suppressing false alarms and only providing a mild attention alert. Take student Chen as an example: he consistently leaves school at 11 PM every Friday to participate in off-campus club activities. In this prediction, the time τ=23:10. The short-term subgraph only captures this single instance of late return, resulting in a short-term score... =0.78, but historical behavioral intuition score =0.12; take the fusion weight β=0.55, and the comprehensive score =0.55×0.78+0.45×0.12≈0.48, the overall risk is in the low to medium range. The system recognizes that this behavior is in line with the long-term baseline, does not push high-risk alarms, and only outputs ordinary attention prompts to the counselors, which greatly reduces the number of meaningless false alarms.

[0115] The overall integration logic achieves dual verification: when short-term continuous abnormal links and long-term habit deviations occur simultaneously, the risk score is amplified; when a short-term single abnormality matches an individual's historical normality, the overall risk is reduced, providing a precise and unified final risk quantification basis for subsequent graded early warning and interpretable result display.

[0116] S8. Based on the comprehensive risk score, output the campus safety risk prediction results, risk level, early warning prompts, and corresponding explanations of key event paths.

[0117] This step is the final output of the entire time-series risk assessment process. It relies on the comprehensive campus safety risk score obtained by weighted fusion to carry out graded judgment and simultaneously outputs a complete set of traceable and human-interpretable warning details, solving the pain point of the unexplainable black box of intelligent risk assessment.

[0118] The system pre-sets segmented thresholds and calculates a comprehensive risk score based on the value range (0,1). The risk levels are divided into four categories, for example: 0≤ <0.3 is considered low risk, 0.3≤ <0.6 is considered a risk to watch, 0.6≤ A value <0.85 is considered high risk, while 0.85 ≤ A value ≤1 is considered high risk.

[0119] Each early warning record encapsulates all traceability elements, including risk type, risk cause, key event path, timestamps corresponding to each behavior, time intervals between adjacent events, path attention weight, risk prediction confidence, and standardized handling recommendations. Among them, the key explanatory path used to trace the source of risk is selected by extracting the time-series link corresponding to the maximum attention weight in all multi-hop inference paths. This link is the behavioral chain that contributes the most to the overall risk score.

[0120] The confidence level within the early warning information does not have an independent calculation formula; it is directly converted from the comprehensive risk score. (The score is then integrated.) Multiply by 100 to get the confidence level in percentage form. The value range is (0,1), corresponding to a confidence level of 0% to 100%. The higher the value, the higher the confidence level of the model in the risk warning conclusion. The confidence level formula was not listed separately in the previous steps because this indicator is a derived output field of the final fusion score and does not require additional calculation.

[0121] The following is a complete case study illustrating the implementation process of the above method. On April 15, 2025, the system performed risk prediction on student Zhang, with a target prediction time of 23:47 that day. The system retrieved historical records of Zhang and related entities from four data sources: access control, attendance, dormitory, and consumption, constructing a continuous-time campus knowledge graph containing entities such as Zhang, courses, dormitory, and school gate, and their interaction relationships. Based on this, the system generated a risk query (Zhang, abnormal nighttime behavior, ?, 23:47), with the query relationship being "abnormal nighttime behavior". The system performed 2-hop time bias sampling with Zhang as the root node, extracting subgraphs and forming a set of event paths. One critical path was "08:20 Absent from Advanced Mathematics — 14:05 Absent from University Physics — 22:38 Entering or exiting the west gate of the campus — 23:45 Not returning to the dormitory", with adjacent event time intervals of 5 hours and 45 minutes, 8 hours and 33 minutes, and 1 hour and 7 minutes, respectively. The system performed continuous-time coding on this path. Short-term, high-density absences and late-night visits caused the path's hidden state to rapidly evolve towards a high-risk direction. The path attention weight calculation results showed that this path had the highest weight (0.47), and the continuous-time subgraph risk score after MLP scoring was 0.78. The historical behavior intuition module showed that Zhang had no records of leaving school late at night or not returning in the past 30 days, with a historical intuition score of 0.91 (high deviation). Taking the fusion weight β=0.53, the comprehensive risk score after fusion was 0.84, corresponding to the "higher risk" level. The system output a warning, with the key event path being "continuous absence → leaving school late at night → not returning to the dormitory," accompanied by the precise timestamp of each behavior, the interval between adjacent behaviors, the path weight of 0.47, and the confidence level of 84%. The risk was attributed to "short-term continuous absences and late-night not returning significantly deviating from historical work and rest patterns," and the handling suggestion was "it is recommended that the counselor immediately contact to confirm safety and notify the dormitory manager to pay attention to the return to the dormitory."

[0122] Another example is the comprehensive score of middle school student Chen. =0.48, which falls within the range of 0.3≤ If the value is less than 0.6, it is considered a risk to be concerned. Only a lightweight notification will be sent to the counselor, and no on-site security action is required.

[0123] Based on the same inventive concept, the present invention also provides a campus security risk early warning system based on continuous time knowledge graph. The campus security risk early warning system can be a personal computer, a server, or other system that implements the aforementioned campus security risk early warning method.

[0124] The campus security risk early warning system based on continuous-time knowledge graph provided in this embodiment includes:

[0125] The multi-source data access module is used to acquire multi-source heterogeneous data in the campus, and to perform identity mapping, time standardization and data cleaning on the multi-source heterogeneous data to obtain standardized campus data.

[0126] The continuous-time campus knowledge graph construction module is used to model students, teachers, places, courses, equipment, events and organizations as entities based on the standardized campus data, and to model entry and exit, absence, consumption, companionship, access, alarm, participation and related behaviors as relationships, and to construct a continuous-time campus knowledge graph containing accurate timestamps.

[0127] The time interval perception subgraph extraction module is used to extract time interval perception subgraphs related to changes in campus safety risks from the continuous-time campus knowledge graph based on the event occurrence sequence, time interval between events, relationship type, and historical behavior patterns, targeting the target regulatory object and the target prediction time.

[0128] The continuous time path encoding module is used to encode the event paths in the time interval sensing subgraph in a continuous time path manner, model the time interval evolution, behavior sequence and relation activation state in the event chain, and obtain the event path representation.

[0129] The path importance and neighborhood aggregation module is used to generate a campus safety risk score for the target monitored object by fusing key neighborhood information based on the event path representation, using path importance calculation and attention neighborhood aggregation mechanism;

[0130] The Historical Behavior Intuition module is used to generate historical behavior intuition scores based on the long-term behavioral patterns of the target regulatory object.

[0131] The risk reasoning module is used to integrate the historical behavioral intuition score with the campus safety risk representation to form a comprehensive risk score.

[0132] An interpretable early warning module is used to output the campus safety risk level, early warning prompts, and corresponding explanations of key event paths based on the comprehensive risk score.

[0133] All relevant content of each step involved in the aforementioned embodiments of the campus safety risk early warning method based on continuous time knowledge graph can be referenced to the functional description of the corresponding functional module of the campus safety risk early warning system in the embodiments of this application, and will not be repeated here.

[0134] The module division in this embodiment is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of this invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0135] The present invention also provides an electronic device comprising: at least one processor and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform the aforementioned campus security risk early warning method based on continuous-time knowledge graph. This electronic device can be any terminal device including mobile phones, laptops, desktop computers, tablets, PDAs (Personal Digital Assistants), POS (Point of Sales) terminals, in-vehicle computers, etc.

[0136] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described campus security risk early warning method based on continuous-time knowledge graph.

[0137] Through the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus necessary general-purpose hardware, and of course, it can also be implemented by special hardware including application-specific integrated circuits, special CPUs, special memory, special components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for the present invention, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, portable hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0138] Although embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. They can be applied to various fields suitable for the present invention. For those skilled in the art, other modifications can be easily made. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details and illustrations shown and described herein.

Claims

1. A campus safety risk early warning method based on continuous-time knowledge graph, characterized in that, include: Acquire multi-source heterogeneous data from the campus, and perform identity mapping, time standardization, and data cleaning on the multi-source heterogeneous data to obtain standardized campus data; Based on the standardized campus data, students, teachers, venues, courses, equipment, events, and organizations are modeled as entities, and entry and exit, absence, consumption, companionship, visits, alarms, participation, and related behaviors are modeled as relationships, thus constructing a continuous-time campus knowledge graph with precise timestamps. For the target regulatory object and the target prediction time, based on the sequence of events, the time interval between events, the relationship type and the historical behavior pattern, the time interval perception subgraph related to the changes in campus safety risks is extracted from the continuous time campus knowledge graph; The event paths in the time interval-aware subgraph are encoded using continuous time path encoding to model the time interval evolution, behavioral sequence, and relational activation state in the event chain, thereby obtaining an event path representation. Based on the event path representation, key neighborhood information is fused using path importance calculation and attention neighborhood aggregation mechanism to generate a campus safety risk score for the target regulatory object. Generate historical behavioral intuition scores based on the long-term behavioral patterns of the target regulatory objects; The historical behavioral intuition score and the campus safety risk score are combined to form a comprehensive risk score; Based on the comprehensive risk score, the system outputs campus safety risk prediction results, risk levels, early warning prompts, and corresponding explanations of key event paths.

2. The campus safety risk early warning method based on continuous-time knowledge graph according to claim 1, characterized in that, The multi-source heterogeneous data includes at least one or more of the following: access control card swipe records, dormitory entry and exit records, classroom attendance records, on-campus consumption records, library access records, campus activity participation records, video security alarm records, equipment operation records, psychological or counseling records, and on-campus incident handling records.

3. The campus safety risk early warning method based on continuous-time knowledge graph according to claim 1, characterized in that, The construction of a continuous-time campus knowledge graph containing precise timestamps includes: A quadruple containing subject entity, relation type, object entity, and timestamp is constructed to represent campus event facts. The timestamp is retained based on the actual occurrence time of the event, so that the continuous time campus knowledge graph is located in continuous time space.

4. The campus safety risk early warning method based on continuous-time knowledge graph according to claim 1, characterized in that, Extracting a time interval-aware subgraph related to changes in campus safety risks from the continuous-time campus knowledge graph includes: taking the target monitored object as the root node, and performing time-biased sampling on multi-hop neighbor event paths based on the time difference between adjacent historical events and the target predicted time, the average event interval of the target monitored object, and the correlation of relationship types.

5. The campus safety risk early warning method based on continuous-time knowledge graph according to claim 1, characterized in that, The continuous-time path encoding includes two stages: state transformation and state evolution. State transformation is used to represent the activation effect of relation type on the current event state, and state evolution is used to represent the evolution effect of continuous time interval between adjacent events on the hidden state.

6. The campus safety risk early warning method based on continuous-time knowledge graph according to claim 1, characterized in that, The method of integrating key neighborhood information by utilizing path importance calculation and attention neighborhood aggregation mechanism includes: calculating attention weights based on query relationships, candidate event path representations, path tail entity representations, and path position representations, and using the attention weights as the basis for interpreting key paths in risk reasoning.

7. The campus safety risk early warning method based on continuous-time knowledge graph according to claim 1, characterized in that, Historical behavioral intuition scores are generated based on the long-term behavioral patterns of the target regulatory subjects, including: An adaptive capacity historical memory unit is constructed using the target regulatory object and relationship type as an index. Based on the long-term behavioral data stored in the historical memory unit, the historical behavior intuition score is calculated by combining the historical frequency of the object entity, the event time interval, and the time decay coefficient.

8. The campus safety risk early warning method based on continuous-time knowledge graph according to claim 1, characterized in that, The risk level is one of low risk, risk of concern, relatively high risk, and high risk, and the risk level is obtained by matching the comprehensive risk score with different pre-set segment thresholds.

9. A campus safety risk early warning system based on continuous-time knowledge graph, characterized in that, include: The multi-source data access module is used to acquire multi-source heterogeneous data in the campus, and to perform identity mapping, time standardization and data cleaning on the multi-source heterogeneous data to obtain standardized campus data. The continuous-time campus knowledge graph construction module is used to model students, teachers, places, courses, equipment, events and organizations as entities based on the standardized campus data, and to model entry and exit, absence, consumption, companionship, access, alarm, participation and related behaviors as relationships, and to construct a continuous-time campus knowledge graph containing accurate timestamps. The time interval perception subgraph extraction module is used to extract time interval perception subgraphs related to changes in campus safety risks from the continuous-time campus knowledge graph based on the event occurrence sequence, time interval between events, relationship type, and historical behavior patterns, targeting the target regulatory object and the target prediction time. The continuous time path encoding module is used to encode the event paths in the time interval sensing subgraph in a continuous time path, model the time interval evolution, behavior sequence and relation activation state in the event chain, and obtain the event path representation. The path importance and neighborhood aggregation module is used to generate a campus safety risk score for the target monitored object by fusing key neighborhood information based on the event path representation, using path importance calculation and attention neighborhood aggregation mechanism; The Historical Behavior Intuition module is used to generate historical behavior intuition scores based on the long-term behavioral patterns of the target regulatory object. The risk reasoning module is used to integrate the historical behavioral intuition score with the campus safety risk representation to form a comprehensive risk score. An interpretable early warning module is used to output the campus safety risk level, early warning prompts, and corresponding explanations of key event paths based on the comprehensive risk score.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method of any one of claims 1-8.

Images