Edge AI-based property park security abnormal event identification and early warning method

Abstract

The present application relates to the technical field of security monitoring, and in particular to a property park security abnormal event identification and early warning method based on edge AI. The method comprises: acquiring park multi-source security data and the running state of each edge node, constructing an edge node meta set and a security task meta set; determining the final processing node based on spatial adaptation, modal matching, regional coverage and node self-checking switching, and establishing a task processing sequence chain; calculating a comprehensive abnormal risk value in time through edge AI reasoning and space evidence phase-locked gate control, identifying real abnormalities, pending review abnormalities and attention events, generating a structured early warning according to the risk level and linking to disposal equipment, and realizing low-latency, high-reliable park security abnormal event identification and adaptive early warning.

Description

Technical Field

[0001] This invention relates to the field of security monitoring technology, specifically to a method for identifying and issuing early warnings of security anomalies in property parks based on edge AI. Background Technology

[0002] With the increasing number of security devices such as cameras, access control systems, gate barriers, perimeter radars, smoke detectors, and fire alarm control panels in property parks, security anomalies are becoming more multi-sourced, real-time, and complex. Based on the content of this solution, the existing technology mainly presents the following two prominent technical problems: Existing methods for handling security anomalies in residential parks often struggle to dynamically allocate security tasks based on the location of the task, the computing power of edge nodes, communication status, node health, and model capabilities. Furthermore, they lack switching mechanisms between primary processing nodes, verification nodes, and fault takeover nodes, as well as task order optimization mechanisms based on urgency, data freshness, and dependencies. This results in high task processing latency, significant node congestion, and insufficient continuous processing capacity when nodes malfunction, failing to meet the low latency and high reliability requirements of residential park security operations. In addition, existing security early warning solutions rely heavily on the results of single cameras, single sensors, or single recognition models for alarm determination, lacking multi-source evidence cross-verification mechanisms based on temporal, spatial, and semantic consistency. They also lack layered identification and processing procedures for genuine anomalies, anomalies awaiting verification, and events of concern, easily leading to false alarms, missed alarms, and insufficient warning reliability, thus affecting the accuracy and effectiveness of residential park security management.

[0003] Therefore, there is an urgent need for a method for identifying and issuing early warnings of security anomalies in property parks based on edge AI to solve the above problems. Summary of the Invention

[0004] The purpose of this invention is to provide a method for identifying and warning of abnormal security events in property parks based on edge AI, so as to improve the stability and reliability of the park security system under node fluctuations or failures, and improve the accuracy of abnormal event identification and the credibility of warning results.

[0005] The objective of this invention can be achieved through the following technical solutions: A method for identifying and issuing early warnings of security anomalies in property parks based on edge AI, the method includes: Step 1: Obtain the real-time operating status of multiple edge nodes within the property park and the security data generated by multi-source security devices; construct an edge node metaset based on the real-time operating status of multiple edge nodes; construct a security task metaset based on the security data. Step 2: Construct an edge node priority potential field based on the edge node element set and the security task element set, and determine the main processing node, verification node and fault takeover node corresponding to each security task element according to the edge node priority potential field. Step 3: Perform node self-checks and verifications on the main processing node, review node, and fault takeover node of the security task element, complete the self-check switching between nodes, and determine the final processing node corresponding to each security task element. Step 4: Construct a task processing sequence chain within the final processing node, and process security task elements sequentially according to the order of the task processing sequence chain. Step 5: Identify and issue warnings for abnormal events in security task elements.

[0006] Furthermore, constructing the priority potential field for edge nodes specifically includes the following process: Determine the spatial adaptability, modal matching degree, and regional coverage between each security task element and each edge node element; The fitting degree characterization value is determined based on spatial fit, modal matching degree, and regional coverage. The edge node elements are sorted according to their fit degree representation value.

[0007] Furthermore, determining the modal matching degree specifically includes the following process: Entity referencing is extracted from the task types in the security task element, and the extracted task type entities are converted into task type vectors; entity referencing is extracted from the AI ​​model set in the edge node element, and the extracted model entities are converted into model set vectors; modality matching degree is determined based on the correspondence between the task type vector and the model set vector.

[0008] Furthermore, the self-check and verification of the main processing node, the review node, and the fault takeover node specifically includes the following processes: Obtain the operating load value of the candidate edge nodes within a preset time period, and determine the operating fluctuation value based on the changes in operating load; Obtain the node state performance values ​​of the candidate edge nodes in different sub-time periods, and determine the node state feature values ​​based on the changes in the node state performance values. The operational characterization values ​​of the candidate edge nodes are determined based on the operational fluctuation values ​​and node status characteristic values. When the performance characteristics of the main processing node meet the preset requirements, the main processing node will be used as the final processing node; when the main processing node does not meet the preset requirements, the process will switch to the review node or the fault takeover node as the final processing node in sequence.

[0009] Furthermore, constructing the task processing sequence chain within a node specifically includes the following process: The urgency of a task is determined based on its deadline. Data freshness is determined based on the task generation time of security task elements; Determine the dependency completion rate based on the completion status of the prerequisite dependent tasks of the security task element; The task processing order representation value is determined based on the task urgency, data freshness, and dependency completion. The security task elements in the final processing node are then sorted according to the task processing order representation value to obtain the task processing order chain within the node.

[0010] Furthermore, the spatiotemporal evidence phase-locked gating mechanism includes: A spatial retrieval range is constructed centered on the location where the security task element occurs, and a temporal retrieval range is constructed centered on the generation time of the security task element. Multi-source evidence units related to the security task element are extracted from the spatial retrieval range and the temporal retrieval range to form a spatiotemporal evidence set. The evidence units in the spatiotemporal evidence set are checked for temporal consistency, spatial consistency, and semantic consistency to obtain spatiotemporal consistency phase-locked results. Based on the spatiotemporal consistency phase-locked loop results, the initial risk value of the security task element, the main identification confidence level, and the historical area risk, the comprehensive anomaly risk is determined, and the security task element is identified as a real anomaly event, an anomaly event to be reviewed, or an event of concern.

[0011] Furthermore, when a security task element is identified as a real abnormal event, an abnormal event object is generated. The abnormal event object includes at least one of the following: abnormal event type, abnormal occurrence area, abnormal occurrence time, associated target object, abnormal risk value, evidence source list, main processing node, review node, fault takeover node, evidence fragment index, and suggested handling strategy. The warning level is determined based on the abnormal risk value, and the warning level includes alert level, attention level, alarm level and emergency level. When the warning level reaches the alarm level or emergency level, the warning information is pushed to the security duty terminal, mobile patrol terminal or the edge server of the park center, and at least one of the access control, barrier gate, broadcast, fire control panel, elevator controller or sound and light alarm equipment is activated to take action.

[0012] Furthermore, the edge node elements in the edge node element set include at least one of the following: node spatial location, remaining computing power, length of the pending task queue, currently available bandwidth, communication latency, node health, set of supported AI models, and set of coverage areas.

[0013] Furthermore, the edge nodes include at least one of the following: camera edge box, access control edge controller, barrier gate edge controller, perimeter radar edge node, smoke detector edge node, fire alarm control panel edge node, elevator edge node, parking lot edge node, regional aggregation edge server, and campus center edge server.

[0014] Compared to existing solutions, the beneficial effects achieved by this invention are: This invention constructs a priority potential field for edge nodes to determine the main processing node, verification node, and fault takeover node for security tasks. By combining node self-check switching and task processing sequence chain within the node, it realizes the localized, adaptive, and continuous processing of security tasks, thereby effectively reducing processing latency and improving the stability and reliability of the park security system under node fluctuation or failure conditions.

[0015] This invention introduces a spatiotemporal evidence phase-locked gating mechanism to verify the temporal consistency, spatial consistency, and semantic consistency of multi-source evidence, and combines this with a comprehensive assessment of anomaly risks. This effectively suppresses false alarms caused by mis-triggered events from a single device or misjudgment by a single model, thereby improving the accuracy of anomaly event identification and the reliability of early warning results.

[0016] This invention can provide graded early warnings based on comprehensive abnormal risks, including alert, concern, alarm, and emergency levels, and can coordinate the handling of high-level events. It also prioritizes uploading structured early warning messages and key evidence indexes, uploads raw data only for high-level early warnings, and writes back the results of manual review for subsequent adaptive adjustments, thereby improving handling efficiency, reducing the transmission pressure between edge nodes and the central server, and enhancing the system's continuous optimization capabilities. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 This is a flowchart of the first method for identifying and issuing early warning of security anomalies in property parks based on edge AI according to an embodiment of the present invention; Figure 2 This is a flowchart of the second method for identifying and issuing early warning of security anomalies in property parks based on edge AI, according to an embodiment of the present invention. Figure 3 This is a flowchart of the third method for identifying and warning of security anomalies in property parks based on edge AI, according to an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more exemplary embodiments. Numerous specific details are provided in the following description to give a full understanding of exemplary embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, steps, etc., can be employed. In other instances, well-known structures, methods, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0021] This invention provides a method for identifying and issuing early warnings of security anomalies in property parks based on edge AI. Figure 1 This is a flowchart illustrating a method for identifying and issuing early warnings of security anomalies in property parks based on edge AI, according to an embodiment of the present invention. Figure 1 As shown, the method includes the following procedures: Step 1: Obtain the real-time operating status of multiple edge nodes within the property park and the security data generated by multi-source security devices; construct an edge node metaset based on the real-time operating status of multiple edge nodes; construct a security task metaset based on the security data. Obtain the real-time operating status of multiple edge nodes within the property park and construct an edge node metaset.

[0022] Edge nodes in a property park include, but are not limited to: camera edge boxes, access control edge controllers, barrier gate edge controllers, perimeter radar edge nodes, smoke detector edge nodes, fire alarm control panel edge nodes, elevator edge nodes, parking lot edge nodes, regional aggregation edge servers, and park center edge servers.

[0023] The edge node metaset is represented as: ,in, This represents the j-th edge node element at time t. The value is m is the total number of edge node elements. It can be represented as: ,in, This represents the spatial location of the j-th edge node; This represents the remaining computing power of the j-th edge node at time t; This represents the length of the task queue for the j-th edge node at time t, i.e., how many security tasks are currently waiting to be processed for this node. This represents the current available bandwidth of the j-th edge node at time t; This represents the communication delay of the j-th edge node at time t. The communication delay can be the network delay from the task source node to this node, or the transmission delay from this node to the regional aggregation node or the central edge server. This represents the node health of the j-th edge node at time t; This represents the set of AI models supported by the j-th edge node. Different edge nodes can deploy different AI models, such as: people detection model; vehicle detection model; smoke and fire recognition model; fall recognition model; climbing recognition model; crowd gathering recognition model; face recognition model; license plate recognition model; and tailgating recognition model. This represents the set of coverage areas for the j-th edge node. The coverage area can be the spatial range that the node can directly perceive, monitor, or process. For example, for a camera edge node... This could be the camera's field of view; for access control nodes, This could be an access control area, or a fire safety checkpoint. It can be a fire compartment covered by smoke detectors or a fire alarm control panel.

[0024] Calculate the availability of computing power at edge nodes: Let the remaining computing power of the j-th edge node at time t be... Maximum computing power is ,in, This represents the upper limit of computing power that an edge node can provide under normal operating conditions; the current queue length of tasks to be processed is... Then the computing power availability of edge node j is : ;in, It is a very small positive number used to avoid the denominator being zero. The greater the availability of this computing power, the more suitable the edge node is to undertake new security tasks.

[0025] Calculate the communication availability of edge nodes: the current available bandwidth of the j-th edge node at time t. Maximum bandwidth is This refers to the maximum amount of data that the node can transmit per unit of time, with a communication latency of [missing value]. The communication availability of edge node j is : ;in, The delay attenuation factor is determined based on the event type. When the event type is tailgating, perimeter climbing, or intrusion into equipment rooms, The timeframe is 144ms, and the event type is fire smoke, person falls, or door is forcibly opened. The time interval is 392ms, and the event type is vehicle driving in the wrong direction or fire lane being blocked. The timeframe is 587ms, and the event type is parking violation, routine inspection, or personnel loitering. Take 1400ms.

[0026] Calculating edge node health: Node health characterizes the reliability of an edge node in performing security tasks at any given moment. Node health is determined based on the edge node's stable operation indicators, data packet loss rate, temperature anomalies, and model inference error rate. Stable operation indicators are positive, representing the proportion of nodes that remain online, communicate normally, and infer normally within a preset statistical period. Data packet loss rate, temperature anomalies, and model inference error rate are negative indicators. Temperature anomalies indicate the degree of abnormality of the edge node's current temperature relative to its safe operating temperature. The optimal value is normalized to between 0 and 1; a higher value indicates a more abnormal temperature. The method for obtaining the value is as follows: ;in, The current temperature of the edge node. The safe operating temperature is defined as follows: the model inference error rate is the proportion of edge nodes that encounter anomalies or errors when executing AI model inference; the negative index is obtained by summing the data packet loss rate, temperature anomaly value, and model inference error rate corresponding to the negative index; the node health is obtained by subtracting the negative index value from the proportion corresponding to the stable operation index.

[0027] Acquire data generated by multiple security devices within the property park, and generate a set of security task elements based on the data.

[0028] Multi-source security equipment includes cameras, access control equipment, barrier gate equipment, perimeter radar, infrared sensors, smoke detectors, fire alarm control panels, elevator controllers, parking systems, and patrol terminals.

[0029] The security task element set is represented as: , Let i represent the i-th security task element at time t. The value is , This represents the number of security tasks generated within the current time window. It can be represented as: ,in, This indicates the task element The corresponding original security incidents include: perimeter intrusion incidents; tailgating incidents; fire and smoke incidents; vehicle driving in the wrong direction incidents; crowd gathering incidents; elevator entrapment incidents; and unauthorized entry into equipment rooms. Indicates the first Each security task element has an initial risk value corresponding to its generation. This initial risk value is user-defined and is a normalized risk value, ranging from 0 to 1. The initial risk value is determined based on at least one of the following factors: event type, location, time period, historical anomaly records, and the reliability of the triggering device. The initial risk value for an event involving ordinary personnel passing by can be set to 0.05 to 0.15; for a failed card swipe event at a regular access control system, it can be set to 0.20 to 0.35; for an event involving suspicious loitering at night, it can be set to 0.55 to 0.75; for an event involving tailgating, it can be set to 0.65 to 0.85; for an event involving perimeter climbing, it can be set to 0.85 to 0.98; and for an event where smoke detectors and video pyrotechnics are triggered simultaneously, it can be set to 0.85 to 1.00. These values ​​can be adjusted based on historical security data, regional importance, and manual verification results for different property parks. This indicates the task deadline, which is the latest time that the security task element should be completed. This indicates the processing type of security task elements, such as video initial screening task; target detection task; behavior recognition task; access control verification task; perimeter radar verification task; smoke and fire recognition task; vehicle trajectory analysis task; cross-modal fusion task; and early warning generation task. This indicates the amount of data that the i-th security task element needs to process, such as the size of a video clip; the number of image frames; the length of sensor data; the number of access control records; and the number of trajectory points. Indicates the task generation time; This represents the set of prerequisite dependent tasks, which is the set of tasks that must be completed before processing the original security event corresponding to the i-th task element. For example, for the "tailgating alarm generation task", its prerequisite dependent tasks may include: access control card swipe record reading task; door camera person detection task; and comparison of authorized number of people with actual number of people entering task. This represents the set of tasks required for verification, i.e., the set of tasks that need to be verified to confirm whether the security event is truly abnormal. For example, for a "perimeter intrusion event," the verification tasks might include: perimeter radar verification; cross-verification of adjacent cameras; comparison of access control authorization status; and verification of patrol personnel location. For a "fire and smoke event," the verification tasks might include: smoke detector data verification; image smoke recognition; temperature change trend assessment; and confirmation of fire alarm control panel status.

[0030] Step 2: Construct an edge node priority potential field based on the edge node element set and the security task element set, and determine the main processing node, verification node and fault takeover node corresponding to each security task element according to the edge node priority potential field. Figure 2This is a flowchart of the second method for identifying and issuing early warning of security anomalies in property parks based on edge AI, as described in this embodiment of the invention. Figure 2 As shown, constructing the edge node priority potential field based on the edge node metaset and the security task metaset specifically includes the following steps: For each security task element, calculate its compatibility representation value with each edge node element to form the edge node priority potential field: Step S201: Determine the spatial adaptability, modal matching degree, and regional coverage between each security task element and each edge node element; To calculate the Euclidean distance between each security task element and the edge node element, and to eliminate coordinate dimensions and unify the range of fit values, we first perform maximum-min normalization on all distances to obtain the normalized distance between security task element i and edge node element j. ,based on Calculate the spatial fit between each security task element and the edge node element: ; Calculate the modal matching degree between each security task element and the edge node element: Using the BiLSTM model to analyze task types in security task metadata Entity references are extracted, and the entity references are transformed into task type vector matrices based on the bag-of-words model; a BiLSTM model is used to process the model set in the edge node meta-matrix. Entity references are extracted and transformed into model set vector matrices based on the bag-of-words model, where the task type vector matrix and the model set vector matrix have the same dimension. Calculate the modality matching degree vector between the task type vector matrix and the model set vector matrix. : in, The number of vectors in the task type vector matrix. The adjacency matrix represents the task type vector matrix and the model set vector matrix. , This represents the node number in the adjacency matrix. Representing the adjacency matrix The sum of the number of all sides in the middle, express The degree, express The degree, Represents a node Existing communities Represents a node Existing communities For conditional constraint coefficients; if Task types and If the model in the model has at least one corresponding model, then If it is 1, then... =0; where, Task types and The corresponding model in the example can be illustrated by the following example: when When the task type includes fireworks recognition tasks, The model in the model includes a fireworks recognition model, which means... Task types and There is a corresponding model in it.

[0031] Modality matching vector The modulus value is denoted as the modal matching degree between each security task element and the edge node element.

[0032] Calculate the area coverage between each security task element and the edge node element: if the task location is within the coverage area of ​​the edge node, the area coverage is 1; if the task location is not within the coverage area of ​​the edge node, the area coverage is 0. Step S202: Determine the fit degree characterization value based on spatial fit, modal matching degree, and regional coverage; After normalization, the spatial fit, modality matching, and regional coverage are summed, and the sum is recorded as the fit degree characterization value. Step S203: Sort the edge node elements according to the adaptation degree characterization value.

[0033] The edge node elements are sorted from largest to smallest according to their compatibility representation values ​​with each security task element and each edge node element, generating a sorting sequence. The sequence of edge node elements corresponding to this sorting sequence can be recorded as the edge node priority potential field. The edge node element corresponding to the first position in the sorting sequence is recorded as the main processing node of the security task element, the edge node element corresponding to the second position is recorded as the verification node of the security task element, and the edge node element corresponding to the third position is recorded as the fault takeover node of the security task element.

[0034] Step 3: Perform node self-checks and verifications on the main processing node, review node, and fault takeover node of the security task element, complete the self-check switching between nodes, and determine the final processing node corresponding to each security task element. The self-check and verification of the main processing node, review node, and fault takeover node of this security task element includes: The main processing node, review node, and fault takeover node of the security task element are designated as candidate edge nodes. Based on the operation monitoring data of the candidate edge nodes, the operation load value of the candidate edge nodes within a preset time period before the security task element establishes a link with the candidate edge nodes is obtained. The preset time period includes several detection moments, and each detection moment corresponds to a operation load value. The operation load value represents the product of the edge node's CPU utilization, memory utilization, disk I / O utilization, network throughput utilization, and request queue backlog after data normalization. A rectangular coordinate system is established with the operating load value at each detection time as the Y-axis and the execution time at each detection time as the X-axis. The operating load characterization curve of the candidate edge node is generated by plotting points. The operating peak value and operating valley value in the operating load characterization curve of the candidate edge node are counted. The operating peak value is the maximum value of the operating load value, and the operating valley value is the minimum value of the operating load value. The peak-valley difference between the operating peak value and the operating valley value is calculated. Draw perpendicular lines from the two endpoints of the edge node's operating load characterization curve to the X-axis to obtain two perpendicular line segments. The edge node's operating load characterization curve, the two perpendicular line segments, and the X-axis form a graph. Calculate the area of ​​this graph, and multiply the area of ​​this graph by the peak-valley difference after unifying the dimensions. The resulting product is recorded as the operating fluctuation value. The runtime from the start of the access request of the edge node to the current detection time is collected and marked as the time threshold. The time threshold is divided into i sub-time periods, where i is a natural number greater than zero. The node status performance value of the edge node in each sub-time period is obtained. The node status performance value represents the product of the response anomaly multiplier value, the resource jitter impact value, and the average node temperature after data normalization. Among them, the response anomaly ratio value represents the ratio between the area enclosed by the line segment of the response delay value characteristic curve above the preset response delay value characteristic curve and the area enclosed by the response delay value characteristic curve and the X-axis; the resource jitter impact value represents the product of the acute angle formed by the first intersection of the resource utilization rate characteristic curve and the preset resource utilization rate characteristic curve and the length of the line segment of the resource utilization rate characteristic curve above the preset resource utilization rate characteristic curve after data normalization; in this way, a set B of node state performance values ​​is constructed, and then the maximum subset and minimum subset in set B are obtained, and the difference between the maximum subset and minimum subset in set B is marked as the node state characteristic value; After normalizing the operational fluctuation value and the node state characteristic value respectively, the sum of the node state characteristic value and the operational fluctuation value is calculated, and the sum is recorded as the operational characterization value of the candidate edge node.

[0035] The self-check switching between nodes is completed based on the running performance value. The final processing node corresponding to each security task element is determined by: loading the running performance value threshold, judging whether the running performance value corresponding to the main processing node of the security task element exceeds the running performance value threshold; if not, the main processing node is recorded as the final processing node corresponding to the security task element; if so, switch to the review node, and judge whether the running performance value corresponding to the review node exceeds the running performance value threshold; if not, the review node is recorded as the final processing node corresponding to the security task element; if it exceeds, switch to the fault takeover node, and the fault takeover node is recorded as the final processing node corresponding to the security task element.

[0036] Step 4: Construct a task processing sequence chain within the final processing node, and process security task elements sequentially according to the order of the task processing sequence chain. Figure 3 This is a flowchart of the second method for identifying and issuing early warning of security anomalies in property parks based on edge AI, as described in this embodiment of the invention. Figure 3 As shown, constructing the intra-node task processing sequence chain within the final processing node specifically includes the following processes: Step S301: Determine the task urgency based on the task deadline of the security task element; Computational tasks Urgency: Assume the task deadline is The current time is The urgency of the task : It is worth noting that the task deadline is... It must be greater than the current time. ; Step S302: Determine data freshness based on the task generation time of the security task element; Computational tasks Data freshness: Let the task generation time be... Then the data freshness for: ;in, This is the time decay coefficient; it is determined according to the task type and can be defined by the user. For example, it is 1 second for fire smoke detection, 2 seconds for personnel fall detection, 3 seconds for tailgating detection, and 30 seconds for fire lane obstruction detection. Step S303: Determine the dependency completion rate based on the completion status of the prerequisite dependent tasks of the security task element; Computational tasks Dependency completion Task dependency completion degree is used to characterize the completion status of the prerequisite dependent tasks of the current security task element. For the first... For each security task element, firstly, its set of prerequisite dependent tasks is obtained, and the number of tasks in this set that are in a completed state is counted. Then, the number of completed prerequisite dependent tasks is compared with the total number of prerequisite dependent tasks to obtain the task dependency completion degree. The higher the task dependency completion degree, the more likely the current security task element is to be executed. When a task has no prerequisite dependent tasks, its task dependency completion degree can be set to a preset maximum value, which is usually between 0 and 1.

[0037] Step S304: Determine the task processing order representation value based on task urgency, data freshness, and dependency completion, and sort the security task elements in the final processing node according to the task processing order representation value to obtain the task processing order chain within the node.

[0038] urgency of the task Data freshness and dependency completion The sum of the values ​​is recorded as the task processing order representation value. The security task elements in the final processing node are sorted from largest to smallest according to the task processing order representation value to obtain the task processing order chain in the node. The security task elements are processed in sequence according to the order of the task processing order chain.

[0039] Step 5: Identify and issue warnings for abnormal events in security task elements; The final processing node sequentially reads security task elements according to the task processing order chain within the node, and performs edge AI inference processing on the original security data corresponding to the security task elements to obtain the main recognition result of the security task elements. The main recognition result includes event type, event location, event time, target object, target trajectory, model recognition confidence, and evidence fragment index. Among them, the evidence fragment index is used to point to at least one of the following: video frame, image, access control record, radar detection point, smoke detector trigger value, fire alarm control panel status, barrier gate record, elevator status, or patrol terminal record that triggered the recognition result.

[0040] To avoid false alarms caused by mistriggered events from a single security device or misjudgment by a single AI model, this step introduces a spatiotemporal evidence phase-locked loop (PLL) gating mechanism as a key technical feature for anomaly event identification and early warning. Specifically, in obtaining the first... After identifying the main identification result of each security task element, a spatial retrieval range is constructed with the occurrence location of the security task element as the center and a preset spatial radius; a temporal retrieval range is constructed with the generation time of the security task element as the center and a preset time window; multi-source evidence units related to the security task element are extracted from the spatial retrieval range and the temporal retrieval range to form a spatiotemporal evidence set.

[0041] The multi-source evidence unit includes AI-recognized evidence output by the main processing node, verified evidence output by the verification node, task processing results that have a prior dependency on security task elements, task processing results that have a verification dependency on security task elements, and auxiliary evidence generated by security equipment in adjacent areas. Each evidence unit includes at least the source of the evidence, the time of its generation, the location of its occurrence, its semantic features, and its credibility. The semantic features of the evidence are used to characterize the meaning of the event corresponding to the evidence unit, such as "unauthorized personnel entered," "access control card swipe failed," "the same target remained continuously," "radar detected a target crossing the boundary," "smoke concentration increased," and "video identified a smoke and fire area," etc.

[0042] Pairwise matching is performed on the evidence units in the spatiotemporal evidence set to construct a set of evidence matching pairs, and the spatiotemporal consistency phase-locked value of the security task element is calculated. : ; in, Indicates the time of the i-th security task element. The spatiotemporal consistency phase-locked value; This represents the set of evidence matching pairs consisting of spatiotemporal evidence sets; Represents the set of evidence matching pairs The number of evidence matching pairs included. It is a very small positive number, used to avoid the denominator being zero; and These represent the credibility of the evidence in the a-th and b-th evidence units, respectively. and These represent the time when the evidence for the a-th and b-th evidence units was generated, respectively. This represents the time-locked loop coefficient corresponding to the event type of the security task element; and These represent the locations where the evidence occurred in the a-th and b-th evidence units, respectively. Indicates the spatial distance between the locations where two pieces of evidence occurred; This represents the spatial phase-locked coefficient corresponding to the event type of this security task element; and These represent the semantic features of the evidence unit a and the evidence unit b, respectively. This represents the semantic similarity between the semantic features of two pieces of evidence. A larger spatiotemporal consistency phase-locked value indicates a higher degree of support for the same abnormal event across multiple security devices or edge AI models in terms of time, space, and semantics. Preferably, to ensure the accuracy of the spatiotemporal consistency phase-locked value, the spatial phase-locking coefficient and the temporal phase-locking coefficient are set to 3 meters and 3 seconds, respectively.

[0043] Based on the spatiotemporal consistency phase-locked loop value, the initial risk value of the security task element, the main identification confidence level, historical area risk, and evidence conflict penalty value, the comprehensive anomaly risk value is calculated: ; in, Indicates the first Each security task element at any time The overall abnormal risk value; This represents the normalization mapping function, used to map the calculation result to a range between 0 and 1; Indicates the first The initial risk value of each security task element; This represents the primary identification confidence level output by the final processing node; Indicates the spatiotemporal consistency phase-locked value; This indicates historical area risk, which is determined based on the frequency of similar abnormal events, the proportion of manual confirmation, and the handling results in the area where the security task element is located within a preset historical period.

[0044] When the spatiotemporal consistency phase-locked value reaches the phase-locked threshold for the corresponding event type, and the comprehensive anomaly risk value reaches the anomaly judgment threshold, the security task element is identified as a real anomaly event, and an anomaly event object is generated. The anomaly event object includes the anomaly event type, anomaly occurrence area, anomaly occurrence time, associated target object, anomaly risk value, evidence source list, main processing node, review node, fault takeover node, evidence fragment index, and suggested handling strategy.

[0045] When the overall anomaly risk value is high but the spatiotemporal consistency phase-locked loop (PLL) value has not reached the PLL threshold, a formal alarm is not generated directly. Instead, the security task element is marked as an anomaly event awaiting review, and a supplementary review task is generated based on the review dependency task set of this security task element. The supplementary review task is re-added to the security task element set, and the processing nodes and processing order are re-determined according to steps two through four. In this way, situations such as false identification by a single camera, momentary false triggering of a smoke detector, short-term malfunction of access control equipment, and isolated radar reflection points are allowed to enter the review process without directly triggering a high-level alarm.

[0046] When the spatiotemporal consistency phase-locked value is high but the overall anomaly risk value has not reached the anomaly judgment threshold, the security task element is marked as an event of concern and stored in the park's security event cache. If new evidence that is temporally, spatially, or semantically continuously associated with the event of concern appears in subsequent time windows, the overall anomaly risk value is recalculated, and a determination is made based on the updated overall anomaly risk value to determine whether to escalate it to an anomaly event.

[0047] For security task elements identified as genuine abnormal events, the warning level is determined based on the comprehensive abnormal risk value. Warning levels include: alert level, attention level, alarm level, and emergency level. The alert level prompts management personnel to check the backend; the attention level pushes the warning to the park's security duty terminal and preserves fragmented evidence; the alarm level simultaneously pushes the warning to the security duty terminal, mobile patrol terminal, and the park's central edge server; the emergency level, while pushing the warning information, simultaneously triggers at least one of the following emergency response devices: access control, gate barriers, broadcasting, fire alarm control panel, elevator controller, or audible and visual alarm equipment.

[0048] When generating early warning information, the final processing node converts the abnormal event object into a structured early warning message. The structured early warning message includes the event name, event level, location, time of occurrence, risk value, evidence summary, handling recommendations, and evidence access index. To reduce the transmission pressure between edge nodes and the central server, the final processing node prioritizes uploading the structured early warning message and the index of key evidence fragments; only when the early warning level reaches the alarm or emergency level will the corresponding video clips, image frames, or raw data from multi-source sensors be uploaded.

[0049] After the early warning is completed, the identification status, comprehensive abnormal risk value, early warning level, handling result and manual review result of the security task element are written into the security event record database. The manual review result is used as the basis for updating the historical regional risk and evidence conflict penalty value of subsequent security task elements of the same type, so that the subsequent abnormal event identification process can be adaptively adjusted according to the actual operation of the park.

[0050] In summary, this invention acquires multi-source security data and the operational status of each edge node in the park, constructs an edge node metaset and a security task metaset; determines the final processing node based on spatial adaptation, modal matching, regional coverage, and node self-check switching, and establishes a task processing sequence chain; calculates a comprehensive anomaly risk value through edge AI inference and spatiotemporal evidence phase-locked gating, identifies real anomalies, anomalies pending review, and events of concern, generates structured early warnings according to risk levels, and links response equipment, achieving low-latency, high-reliability park security anomaly identification and adaptive early warning.

[0051] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0052] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0053] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0054] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0055] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0056] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for identifying and issuing early warnings of security anomalies in property parks based on edge AI, characterized in that, The methods include: Step 1: Obtain the real-time operating status of multiple edge nodes within the property park and the security data generated by multi-source security devices; construct an edge node metaset based on the real-time operating status of multiple edge nodes; construct a security task metaset based on the security data. Step 2: Construct an edge node priority potential field based on the edge node element set and the security task element set, and determine the main processing node, verification node and fault takeover node corresponding to each security task element according to the edge node priority potential field. Step 3: Perform node self-checks and verifications on the main processing node, review node, and fault takeover node of the security task element, complete the self-check switching between nodes, and determine the final processing node corresponding to each security task element. Step 4: Construct a task processing sequence chain within the final processing node, and process security task elements sequentially according to the order of the task processing sequence chain. Step 5: Identify and issue warnings for abnormal events in security task elements.

2. The method for identifying and issuing early warning of security anomalies in property parks based on edge AI according to claim 1, characterized in that, Constructing the priority potential field for edge nodes specifically includes the following process: Determine the spatial adaptability, modal matching degree, and regional coverage between each security task element and each edge node element; The fitting degree characterization value is determined based on spatial fit, modal matching degree, and regional coverage. The edge node elements are sorted according to their fit degree representation value.

3. The method for identifying and issuing early warning of security anomalies in property parks based on edge AI according to claim 2, characterized in that, Determine the specific modal matching degree The process includes the following: Entity referencing is extracted from the task types in the security task element, and the extracted task type entities are converted into task type vectors. Entity referencing is extracted from the AI ​​model set in the edge node element, and the extracted model entities are converted into model set vectors; the modality matching degree is determined based on the correspondence between the task type vector and the model set vector.

4. The method for identifying and issuing early warning of security anomalies in property parks based on edge AI according to claim 1, characterized in that, Specific self-checks and verifications are performed on the main processing node, the verification node, and the fault takeover node. Includes the following processes: Obtain the operating load value of the candidate edge nodes within a preset time period, and determine the operating fluctuation value based on the changes in operating load; Obtain the node state performance values ​​of the candidate edge nodes in different sub-time periods, and determine the node state feature values ​​based on the changes in the node state performance values. The operational characterization values ​​of the candidate edge nodes are determined based on the operational fluctuation values ​​and node status characteristic values. When the running performance value of the main processing node meets the preset requirements, the main processing node will be used as the final processing node. When the primary processing node does not meet the preset requirements, it will switch to the verification node or the fault takeover node as the final processing node in sequence.

5. The method for identifying and issuing early warning of security anomalies in property parks based on edge AI according to claim 1, characterized in that, Constructing the task processing sequence chain within a node Includes the following processes: The urgency of a task is determined based on its deadline. Data freshness is determined based on the task generation time of security task elements; Determine the dependency completion rate based on the completion status of the prerequisite dependent tasks of the security task element; The task processing order representation value is determined based on the task urgency, data freshness, and dependency completion. The security task elements in the final processing node are then sorted according to the task processing order representation value to obtain the task processing order chain within the node.

6. The method for identifying and issuing early warning of security anomalies in property parks based on edge AI according to claim 1, characterized in that, Spatiotemporal evidence phase-locked gating mechanisms include: A spatial retrieval range is constructed centered on the location where the security task element occurs, and a temporal retrieval range is constructed centered on the generation time of the security task element. Multi-source evidence units related to the security task element are extracted from the spatial retrieval range and the temporal retrieval range to form a spatiotemporal evidence set. The evidence units in the spatiotemporal evidence set are checked for temporal consistency, spatial consistency, and semantic consistency to obtain spatiotemporal consistency phase-locked results. Based on the spatiotemporal consistency phase-locked loop results, the initial risk value of the security task element, the main identification confidence level, and the historical area risk, the comprehensive anomaly risk is determined, and the security task element is identified as a real anomaly event, an anomaly event to be reviewed, or an event of concern.

7. The method for identifying and issuing early warning of security anomalies in property parks based on edge AI according to claim 6, characterized in that, When a security task element is identified as a real abnormal event, an abnormal event object is generated. The abnormal event object includes at least one of the following: abnormal event type, abnormal occurrence area, abnormal occurrence time, associated target object, abnormal risk value, evidence source list, main processing node, review node, fault takeover node, evidence fragment index, and suggested handling strategy. The warning level is determined based on the abnormal risk value, and the warning level includes alert level, attention level, alarm level and emergency level. When the warning level reaches the alarm level or emergency level, the warning information is pushed to the security duty terminal, mobile patrol terminal or the edge server of the park center, and at least one of the access control, barrier gate, broadcast, fire control panel, elevator controller or sound and light alarm equipment is activated to take action.

8. The method for identifying and issuing early warning of security anomalies in property parks based on edge AI according to claim 1, characterized in that, The edge node elements in the edge node element set include at least one of the following: node spatial location, remaining computing power, length of the pending task queue, currently available bandwidth, communication latency, node health, set of supported AI models, and set of coverage areas.

9. The method for identifying and issuing early warning of security anomalies in property parks based on edge AI according to claim 1, characterized in that, Edge nodes include at least one of the following: camera edge boxes, access control edge controllers, barrier gate edge controllers, perimeter radar edge nodes, smoke detector edge nodes, fire alarm control panel edge nodes, elevator edge nodes, parking lot edge nodes, regional aggregation edge servers, and campus center edge servers.

Images