A property safety management method and device based on data analysis and a medium

Abstract

The application discloses a kind of property safety management method, equipment and medium based on data analysis, it is related to industrial data analysis technical field, including, object positioning is associated with the expansion table in the hanging record of object positioning key and is strung into cross-source continuous event chain, and trigger section, continuation section and change section are extracted, and are assembled into cross-source hazard candidate chain set;Cross-source hazard candidate chain set is input into double-channel risk arbitration model, and candidate chain relationship loading, enhancement suppression mark processing and double-channel arbitration are carried out, and output leading risk entry and backup risk entry, generate double-channel arbitration table;Double-channel arbitration table is arranged, and backup risk entry is hung to corresponding leading risk entry, write in check trigger content and return field, generate property safety management record.The application realizes hazard grading arbitration, distinguishes risk level, and enhances risk output checkability.

Description

Technical Field

[0001] This invention relates to the field of industrial data analysis technology, and in particular to a property security management method, equipment and medium based on data analysis. Background Technology

[0002] With the advancement of urbanization and the deep integration of information technologies such as the Internet of Things, big data, and artificial intelligence, the property management industry is transforming towards digitalization and intelligentization. In the field of industrial data analysis, technologies for the collection, integration, temporal alignment, and correlation mining of multi-source heterogeneous data are becoming increasingly mature, and event chain models and network correlation analysis methods are widely used in security risk identification scenarios. Smart property management platforms, by integrating intelligent access control and intelligent security systems, achieve refined and efficient service functions. Security event correlation analysis technology, by constructing event correlation networks and employing statistical models and machine learning algorithms to integrate and analyze discrete event data, can identify potential security threat patterns, providing technical support for property security management.

[0003] However, existing property security management technologies still have limitations in data processing and risk identification: First, existing technologies lack a unified processing mechanism for time alignment and location merging of multi-source security events, resulting in insufficient ability to link cross-source data and difficulty in constructing a complete cross-source continuous event chain, which restricts the accuracy and timeliness of hazard identification; Second, existing risk arbitration models mostly adopt a single-channel assessment method and lack a dual-channel arbitration mechanism to enhance and suppress the candidate chain relationship, making it impossible to effectively distinguish between dominant risk items and backup risk items, resulting in weak hierarchical and verifiable risk output. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a data analysis-based property security management method to address the difficulties in constructing cross-source continuous event chains and the weak hierarchical structure of risk classification output.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a property safety management method based on data analysis, comprising: collecting safety incident records within a property management area, extracting safety incident association fields, and performing unified time alignment and location merging to generate an object location in-situ entry table; based on the object location in-situ entry table, combined with the safety incident association fields, constructing object location keys, and attaching records with event association relationships to generate an object location association expansion table; connecting the attached records and object location keys in the object location association expansion table into a cross-source continuous event chain, and extracting trigger segments, continuation segments, and change segments to assemble a cross-source hazard candidate chain set; inputting the cross-source hazard candidate chain set into a dual-channel risk arbitration model, performing candidate chain relationship loading, enhanced suppression marking processing, and dual-channel arbitration, outputting dominant risk entries and backup risk entries to generate a dual-channel arbitration table; arranging the dual-channel arbitration table, attaching backup risk entries to the corresponding dominant risk entries, writing verification trigger content and feedback fields, and generating property safety management records.

[0007] As a preferred embodiment of the data analysis-based property security management method of the present invention, the steps for generating the object location in-situ entry table are as follows: The security event logs are organized, missing or incomplete fields are filled in, and the source is supplemented to generate security event association fields. Extract the original time description from the security event association field, and perform original time conversion, window reordering and conflict time yielding to generate a time alignment entry set; Perform hierarchical position merging and window order arrangement on the time alignment entry set, and write it into the position field to generate the object positioning in-place entry table.

[0008] As a preferred embodiment of the data analysis-based property security management method of the present invention, the steps of constructing object location keys and linking records with event association relationships are as follows: The object location entry table is grouped by window, expanded in parallel by position, extracted by the primary position and supplemented by the secondary position to obtain the time primary position, the position primary position, the object primary position and the sequence position, and integrated into the object location key; Establish an associated candidate window around the object's location key, divide the candidate item range, and filter out associated candidate records that satisfy the conditions of continuation of the same object, adjacent transfer, state inheritance, and disposal continuation.

[0009] As a preferred embodiment of the data analysis-based property security management method of the present invention, the steps for generating the object location association expansion table are as follows: The event-related candidate records are subjected to multi-caliber linkage verification based on continuous execution time, adjacent location, and sequential handling, and linkage tags are written to generate a linkage verification item set; The order and type of association between the linked entries are filled in according to the linked tags, and the linked records are summarized according to the object location key to generate an object location association expansion table.

[0010] As a preferred embodiment of the data analysis-based property security management method of the present invention, the concatenation is a chain of continuous events across sources, and the steps are as follows: According to the object location key and the order of association, the attached records in the object location association expansion table are centrally merged and sequentially linked to generate a set of consecutive event links. Perform source switching verification and breakpoint continuation on the continuous event chain entry set, and connect adjacent attached records that meet the continuation conditions into a cross-source continuous event chain.

[0011] As a preferred embodiment of the data analysis-based property safety management method of the present invention, the assembly into a cross-source hazard candidate chain set includes the following steps: Perform chain segment role splitting on cross-source continuous event chains to obtain triggering segments, continuation segments, and change segments; The trigger segment, continuation segment, and change segment are encapsulated in sequence, and the candidate chain category and internal order are filled in to generate a cross-source hidden danger candidate chain set.

[0012] As a preferred embodiment of the data analysis-based property security management method of the present invention, the steps for generating the dual-channel arbitration table are as follows: The dual-channel risk arbitration model includes a relation loading layer, an enhanced tag loading layer, an inhibited tag loading layer, and a dual-channel arbitration layer; In the relation loading layer, the main chain bit, parallel bit and pending bit are written for the cross-source hidden danger candidate chain set under the same object locator key to generate the candidate chain relation loading set; In the enhancement tag loading layer, the candidate chain relationship loading set is written in layers to obtain persistent enhancement bits, recurrent enhancement bits, regional enhancement bits and hysteresis enhancement bits, and integrate them into enhancement tags; In the suppression tag loading layer, the loading set of the relationship between the enhancement tag and the candidate chain is reverse-push-written to generate the suppression tag, and then integrated with the enhancement tag into a dual-tag candidate chain. In the dual-channel arbitration layer, the strengthening and suppressing markers in the dual-mark candidate chain are compared segment by segment, and the primary and backup order is determined. The dominant risk entry and the backup risk entry are output and integrated into the dual-channel arbitration table.

[0013] As a preferred embodiment of the data analysis-based property security management method of the present invention, the steps for generating property security management records are as follows: The dominant risk items in the dual-channel arbitration table are centrally merged and sequentially expanded, and the main ranking, parallel ranking, and subsequent ranking are added to form a set of dominant risk arrangement items; Based on the arrangement position of the dominant risk arrangement items, perform corresponding retrieval and targeted attachment on the backup risk items in the dual-channel arbitration table and fill in the attachment order to generate a risk attachment table; Based on the risk linkage table, the primary risk item and its corresponding backup risk item are loaded with the initial inspection content, supplementary inspection content, follow-up inspection content and source verification content, and an inspection trigger table is generated. The verification trigger table is encapsulated, and the return fields are filled in. At the same time, the rows are merged and expanded to generate property security management records.

[0014] In a second aspect, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein when the computer program is executed by the processor, it implements any step of the data analysis-based property security management method described in the first aspect of the present invention.

[0015] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the data analysis-based property security management method described in the first aspect of the present invention.

[0016] The beneficial effects of this invention are as follows: by generating an in-situ entry table for object positioning through time alignment and position merging, the standardized integration of multi-source data is realized, which solves the problem of broken correlations in industrial data analysis and improves data integrity; by outputting dominant and backup risk entries through a dual-channel risk arbitration model, the hierarchical arbitration of hidden dangers is realized, the risk levels are distinguished, and the verifiability of risk output is enhanced. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a data analysis-based property security management method.

[0019] Figure 2 A schematic diagram illustrating the sources of security incident records for a property management area.

[0020] Figure 3 This is a comparison chart showing the effect of connecting continuous event chains across sources under associated breakpoint conditions.

[0021] Figure 4 A comprehensive comparison chart of the core indicators of different schemes. Detailed Implementation

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0025] Reference Figures 1-4 This is one embodiment of the present invention, which provides a property security management method based on data analysis, including the following steps: S1: Collect security incident records within the property management area, extract security incident related fields, and perform unified time alignment and location merging to generate an object location in-situ entry table; S1.1: Security incident records include access control trigger records, inspection reporting records, equipment status change records, and manual incident reporting records; Furthermore, according to the source range of events within the property management area (e.g., the area where security events occur, such as the entrance hall of residential buildings, the perimeter of the park wall, and the area corresponding to the scope of the property service center), access control trigger records, inspection reporting records, equipment status change records, and manual incident reporting records are collected in categories. The correspondence between the location of the event, the time of the event, the object identification, and the content of the event is checked one by one. When there are duplicate registrations under the same source of the event, records with complete content and clear time descriptions are retained. If there are omissions but the event can be identified based on the context fields of the same record, the identifiable part is retained and the source attribution remains unchanged. Access control trigger records retain the trigger location and trigger status, inspection reporting records retain the inspection location and abnormality description, equipment status change records retain the equipment location and status change content, and manual incident reporting records retain the reporting location and reported matter. All types of records are merged into the same event collection scope according to a unified registration standard to form a security event record.

[0026] Figure 2This diagram illustrates the basic structure of a security incident recording scenario. Access control trigger records, equipment status change records, inspection report records, and manual incident reporting records collectively constitute the multi-source incident sources within the property management area. The relatively balanced proportion of each type of record in the diagram indicates that the simulation scenario does not rely on a single source but rather exhibits the actual characteristics of multiple sources entering in parallel, complementing each other, and cross-mapping. This diagram visually demonstrates the source basis of security incident records, providing a prerequisite for subsequent field organization, missing data backfilling, source data supplementation, unified time alignment, and location attribution. It also illustrates that the formation of the object location in-situ entry table is based on the joint participation of multi-source data, thus better reflecting the scenario rationality and experimental basis of multi-source data standardization and integration.

[0027] S1.2: Perform field organization, missing data filling, and source data addition for security event records, and generate security event association fields; Furthermore, the fields for event occurrence time, location, object identification, event content, and event source identification in security event records are organized. Records with different descriptions but consistent meanings are grouped into fields with the same name according to a unified filling standard. For missing positions, the time description, location description, and event description in the same record are checked. If the missing information can be filled in, the corresponding content is written. If the missing information cannot be filled in directly, the missing status is retained and a pending judgment position is registered. For records that do not clearly indicate the source attribution but whose source category can be identified based on the record carrier, registration entry, or event content, the source identification of access control trigger record, inspection report record, equipment status change record, or manual incident report record is added (for example, abnormal photo records within the same inspection period are added as inspection report record source), generating security event association fields.

[0028] S1.3: Extract the original time description from the security event association field, and perform original time conversion, window reordering and conflict time yielding to generate a time alignment entry set; Furthermore, the original time descriptions in the security event association fields are extracted one by one, and the text time, number time, reporting time, and status record time are uniformly converted into a standard time representation that can be compared. For the original time descriptions that only specify the time period or relative time, the original time is converted by combining the location of the event, the object identifier, and adjacent records from the same source, and the corresponding time point or time interval is determined (for example, "evening patrol" is converted to Example 19:00-21:00). The conversion results are placed into a preset time window and rearranged according to the time sequence. If there are multiple records in the same time window, they are rearranged according to the event precursors, the order of status changes, and the order of handling and registration. For records with overlapping or contradictory times for the same object identifier, the time position with clear evidence and complete record is retained, and conflicting records are moved to the corresponding continuation position according to the conflict time yield, generating a time alignment entry set.

[0029] It should be noted that the preset time window adopts a fixed duration setting. First, the registration time interval of security incident records is counted. Then, a uniform time granularity is selected in combination with the inspection cycle and the handling continuity time. When the registration frequency is no more than 15 minutes, the preset time window is set to 15 minutes; when the registration frequency is greater than 15 minutes but no more than 30 minutes, the preset time window is set to 30 minutes; when the registration frequency is greater than 30 minutes, the preset time window is set to 60 minutes.

[0030] S1.4: Perform hierarchical position merging and window order arrangement on the time alignment entry set, and write it into the position field to generate the object positioning in-place entry table.

[0031] Furthermore, the event location, object identifier, standard time representation, and event source identifier in the time alignment entry set are hierarchically merged and linked. Location descriptions such as lobby, parking space, and passageway are uniformly mapped to the corresponding location level according to the established hierarchical standards of the property management area, and the location content corresponding to the same event is linked to the same location link. Records belonging to the same location level within the same preset time window are arranged in the same window order according to the order of event occurrence, state change direction, and disposal registration order, and written to the position field in sequence (e.g., position 1, position 2, and position 3 in the example). The object identifier is missing but can be filled into the current location record by the correspondence between the location description and the event content, generating an object location in-situ entry table.

[0032] It should be noted that the established hierarchical standard for property management areas is a unified hierarchical classification standard used for location descriptions within the property management area, which is used to merge location descriptions in different records into a consistent location hierarchy.

[0033] S2: Based on the object location in-situ entry table, combined with the security event association field, construct the object location key, and attach the records with event association relationships to generate the object location association expanded table; S2.1: Perform window grouping, position expansion, primary extraction and supplementary writing on the object location in-situ entry table to obtain the time primary, position primary, object primary and sequence primary, and integrate them into the object location key; Furthermore, the records in the object location entry table are grouped according to a preset time window. Records falling within the same preset time window are grouped together, and parallel location records within the same group are expanded according to the location of the event. The clarity of the location hierarchy and the strength of the event's direction are checked for the parallel location records. The location content that can directly represent the event's location is selected as the primary location, and the remaining related location content is added as secondary location content. Combining the object identifier, event content, and position field, the time primary, location primary, object primary, and sequence primary are extracted for each record. The completeness of the object identifier and its correspondence with the group are checked. For object identifiers that are incomplete but can be identified by corresponding records in the same group, the complete object content is added (e.g., the same room number or the same equipment number). The time primary, location primary, object primary, and sequence primary are integrated into the object location key.

[0034] S2.2: Establish an associated candidate window around the object positioning key, divide the candidate item range, and filter out associated candidate records that satisfy the conditions of continuation of the same object, adjacent transfer, state inheritance and disposal continuation; Furthermore, a preset association span is expanded around each object location key according to the time primary position, and the corresponding association candidate window is determined by combining the location primary position, object primary position, and sequence position. Records that fall within the association candidate window and have a relationship with the object location key in terms of location proximity, time adjacency, or event connection are included in the candidate verification scope. Each record in the candidate verification scope is compared with the object identification continuity, the migration direction between adjacent position levels, the correspondence of state changes in the event content, and whether the handling actions are continuous. Records that can reflect the continuous appearance of the same object, the transfer from one position to an adjacent position, the previous state can inherit the next state, or the previous handling can correspond to the next handling are written into the candidate retention mark. Records that do not meet the association conditions are removed from the current candidate scope, and the association candidate records that meet the conditions of object continuity, adjacent position transfer, state inheritance, and handling continuity are screened out.

[0035] It should be noted that the preset association span is fixed according to the event type: access control trigger records and inspection reporting records take one preset time window before and after and the adjacent 1-level location level range, while equipment status change records and manual incident reporting records take two preset time windows before and after and the adjacent 2-level location level range.

[0036] Continuation of the same object: For example, if the same resident's ID appears in both the lobby access control trigger record and the corresponding floor inspection report record, it can be screened as a candidate record that satisfies the continuity of the same object; Adjacent position transfer: For example, if the same object moves from the main position in the elevator lobby on the first floor to the main position in the corridor on the adjacent second floor, it can be screened as a candidate record that satisfies the adjacent position transfer; Status continuity: For example, if the previous record states that the device is offline and the next record states that the device is back to normal, and there is a sequential relationship between the two, it can be screened as a candidate record that satisfies the status continuity; Handling continuity: For example, if the previous record states that there is a dispatch action after a manual report and the next record states the corresponding completion feedback, it can be screened as a candidate record that satisfies the handling continuity.

[0037] Association conditions are the verification criteria for determining whether two or more records can be identified as having a sequential relationship. For example, if the same resident triggers a record in the lobby access control system and then has an inspection report record on the corresponding floor, it can be determined that the association conditions of continuation of the same object and transfer of adjacent locations are met.

[0038] Event association relationships include continuation of the same object, adjacent position transfer, state succession, and handling continuation. Continuation of the same object means that the event records corresponding to the same object location key continue to appear in adjacent positions. Adjacent position transfer means that the position corresponding to the event record smoothly transitions from the adjacent position to the merged position. State succession means that the event states of the previous and subsequent event records have a continuous connection relationship. Handling continuation means that the handling action corresponding to the previous event record can form a coherent relationship with the handling process corresponding to the subsequent event record.

[0039] S2.3: Perform multi-caliber attachment verification on the candidate records associated with events based on continuous execution time, adjacent location, and successive handling, and write the attachment mark to generate a set of attachment verification entries; Furthermore, a multi-caliber linkage verification is performed on the time principal, location principal, object principal, event content, and handling content of the candidate records associated with the event. Each record is compared to check whether adjacent time principals are within a continuous connection range; records with time intervals exceeding the preset linkage span are judged as discontinuous in time. The location principal and its subordinate content are combined to check whether two records are at the same location level, adjacent location levels, or can form a corresponding relationship of movement points; records that meet the location transition logic are judged as location adjacent. The description of state changes in the event content and the response actions in the handling content are combined to check whether the previous record can provide a basis for handling the next record; records that can form an event progression relationship are judged as handling continuation. Records that simultaneously meet the conditions of time continuity, location adjacency, and handling continuation are marked with a linkage tag; records that only meet some conditions are marked with an unlinked tag, generating a linkage verification entry set.

[0040] It should be noted that location transition logic refers to the ability of the primary and secondary location contents of two records to form a sequential connection that conforms to the actual movement or event propagation path within the property management area.

[0041] The linked verification item set refers to the set of items that, after verifying the continuity of completion time, adjacency of location, and continuity of handling of event-related candidate records, are marked with linked or unmarked entries and retain the corresponding verification relationship.

[0042] S2.4: Based on the attachment mark, fill in the order of association and the type of association relationship before and after the attachment verification item set, and summarize the attachment records according to the object positioning key to generate the object positioning association expansion table.

[0043] Furthermore, based on the attachment markers in the attachment verification item set, record pairs with attachment markers are screened out (for example, the attachment verification item set is compared pairwise by object positioning key and time primary position; if there are attachment markers between two records, they are directly extracted as record pairs with attachment markers). The corresponding records are arranged according to the time primary position and sequence position around the same object positioning key. The preceding and following positions of each record in the attachment link are determined, and the order of precedence and suffix is ​​filled in (e.g., the first record in the preceding sequence and the second record in the following sequence). Combining the same object continuation, adjacent position transfer, state inheritance, and disposal continuation relationships reflected in the attachment verification item set, the association relationship type corresponding to each group of attachment records is determined and a unified relationship name is written. The completed attachment records are merged and expanded according to the object positioning key. Each attachment record under the same object positioning key is arranged side-by-side according to the association order, retaining the corresponding relationship position and association link direction, generating an object positioning association expansion table.

[0044] S3: Connect the attached records and object location keys in the object location association expansion table into a cross-source continuous event chain, and extract the trigger segment, continuation segment and change segment, and assemble them into a cross-source hidden danger candidate chain set; S3.1: Merge and sequentially connect the attached records in the object location association expansion table according to the object location key and the order of association to generate a set of consecutive event concatenation entries; Furthermore, all attached records are centrally merged according to the object location key in the object location association expansion table. Records with the same object location key and whose preceding and following associations can be connected end to end are grouped into the same concatenation range and arranged one by one according to the preceding and following associations. The complete correspondence between the preceding and following records of each attached record is checked. For attached records with parallel relationships, the concatenation order is determined by combining the time primary position, the sequence position, and the association relationship type. Records that lack intermediate connecting positions but have clear preceding and following directions are reserved for continuation positions. For attached records that can be continuously connected, they are written into the sequential concatenation positions in sequence (e.g., the first continuation position, the second continuation position, and the third continuation position in the example). The attached records in the same concatenation range are arranged end to end according to the sequence to generate a set of continuous event concatenation entries.

[0045] S3.2: Perform source switching verification and breakpoint continuation on the continuous event chain entry set, and connect adjacent attached records that meet the continuation conditions into a cross-source continuous event chain; Furthermore, according to the sequential connection position in the set of consecutive event connection entries, the changes in the event source identifier of each adjacent connection record are checked one by one to determine whether there is a continuous source switching relationship between access control trigger records, inspection reporting records, equipment status change records, and manual incident reporting records (if the object's primary position is consistent, the location's primary position is consistent or adjacent, the event content is connectable, and the handling content has a continuous correspondence, it is determined that the source switching relationship is established. For example, if the same object's primary position first shows abnormal entry information in the access control trigger record, and then the on-site verification information in the inspection reporting record appears in the adjacent location's primary position, it is considered that the source switching relationship is established. Furthermore, if the time principal position is continuous and the event content can correspond sequentially, it can be determined that there is a continuous source switching relationship between the access control trigger record and the inspection report record; for records from different sources but with continuous time principal positions, connectable location principal positions, consistent or identifiable object principal positions, and event content and handling content that can form a sequential connection, retain the candidate for connection; for records with missing records in the middle but clear directions at both ends, perform breakpoint continuation according to the sequential order, order position and relationship type, fill in the gap connection position, and connect adjacent records that meet the connection conditions in order to form a continuous event chain across sources.

[0046] It should be noted that the acceptance criteria refer to the criteria for determining whether adjacent records can form a continuous correspondence in terms of time subject, location subject, object subject, and event content or handling content. For example, if the same resident has abnormal entry information in the access control trigger record and then has on-site verification information in the inspection report record of the adjacent floor, the acceptance criteria can be considered to be met.

[0047] Figure 3 This diagram illustrates how different solutions maintain the continuity of cross-source continuous event chains under conditions of continuously increasing associated breakpoint rates (set as the proportion of the number of unconnected associated breakpoints to the total number of associated locations in the experiment). The gray curve represents control solution A, the blue curve represents control solution B, and the green curve represents the present invention solution. As the associated breakpoint rate gradually increases from 2% to 26%, all three curves show a downward trend. However, the present invention solution consistently maintains the highest continuity level (statistically calculated as the proportion of the number of connected continuous event chains before and after completion to the total number of candidate continuous event chains), and its decline is the slowest. This indicates that even when there are gaps, omissions, or intermediate breaks in access control trigger records, inspection reporting records, equipment status change records, and manual incident reporting records, the present invention solution can still maintain a high link connectivity through source switching verification and breakpoint repair. This figure can intuitively illustrate that the present invention solution does not merely repair associated breaks superficially, but can maintain stronger continuity and integrity at the cross-source continuity level.

[0048] In contrast, Plan A only performs basic summarization and general merging of security incident records, without performing unified time alignment, location merging, source switching verification, breakpoint continuation, and dual-channel risk arbitration processing.

[0049] Compared to Option B, which performs unified time alignment and partial correlation linking processing based on security event records, it does not construct a complete cross-source continuous event chain, nor does it output dominant risk entries and backup risk entries.

[0050] S3.3: Perform chain segment role splitting on cross-source continuous event chains to obtain triggering segments, continuation segments, and change segments; Furthermore, the records are linked one by one according to the sequential connection relationship in the cross-source continuous event chain. The starting position, continuous position and turning point of each record in the event chain are checked. The record that forms the first abnormal trigger, the first action start or the first state start in the event chain is marked as the trigger segment. The records that keep the subject position consistent, the subject position of the position is continuously connected, the event content continues to unfold and there is no obvious turning point are classified into the continuation segment. The records that have changed the state of the event content, moved the location, switched the action or the source changed and became more serious are marked as the change segment (for example, from abnormal access control entry to floor patrol and verification). The marked records are re-merged according to the sequence in the event chain to obtain the trigger segment, continuation segment and change segment.

[0051] S3.4: Encapsulate the trigger segment, continuation segment, and change segment in sequence, and fill in the candidate chain category and internal order to generate a cross-source hidden danger candidate chain set.

[0052] Furthermore, the trigger segment, continuation segment, and change segment are arranged sequentially according to their order of connection in the same cross-source continuous event chain. The trigger segment is placed at the beginning of the chain, and the continuation segments that are continuously connected to the trigger segment are arranged in the order of event progression. The corresponding change segment is then written into the position where the turning point occurs. For each segment, the subject position, position subject position, time subject position, and event progression relationship are checked to see if they are consistent. For cases with parallel changes, they are distinguished by their order position and written into the internal order. Combining the abnormal trigger content corresponding to the trigger segment, the continuous performance corresponding to the continuation segment, and the turning point corresponding to the change segment, the candidate chain category is supplemented. The encapsulated segments are merged according to the chain order to generate a cross-source hidden danger candidate chain set.

[0053] It should be noted that the candidate chain category is a classification marker used to identify the nature of the hidden dangers corresponding to the encapsulation of the trigger segment, continuation segment, and change segment. It is used to distinguish the specific risk types represented by cross-source hidden danger candidate chains and the direction of subsequent verification.

[0054] S4: Input the cross-source hazard candidate chain set into the dual-channel risk arbitration model, perform candidate chain relationship loading, enhanced suppression labeling, and dual-channel arbitration, output the dominant risk item and the backup risk item, and generate a dual-channel arbitration table; S4.1: The dual-channel risk arbitration model includes a relation loading layer, an enhanced label loading layer, an inhibited label loading layer, and a dual-channel arbitration layer; Furthermore, the arbitration process corresponding to the cross-source hazard candidate chain set is divided into a continuously connected four-layer processing structure. The processing part used to register the positional relationship, parallel relationship and pending relationship of the candidate chain is set as the relationship loading layer. The processing part used to write the continuous enhancement bit, recurring enhancement bit, regional enhancement bit and hysteresis enhancement bit is set as the enhancement mark loading layer. The processing part used to perform reverse pressure and write the suppression mark according to the candidate chain relationship and enhancement result is set as the suppression mark loading layer. The processing part used to compare the enhancement mark and suppression mark segment by segment and output the dominant risk item and the backup risk item is set as the dual-channel arbitration layer. The output content of the previous layer is sequentially sent to the next layer, forming a dual-channel risk arbitration model including the relationship loading layer, the enhancement mark loading layer, the suppression mark loading layer and the dual-channel arbitration layer.

[0055] It should be noted that the training process of the dual-channel risk arbitration model can use historical property safety management records as training samples. The object location association expansion table, the cross-source hidden danger candidate chain set and the corresponding verification conclusion are aligned and organized to form a training set with the dominant risk item and the backup risk item labeled. The candidate chain relationship position, the enhancement mark performance and the suppression mark performance are used as input to perform batch iterative training on the dual-channel risk arbitration model. The output deviation of the relationship loading layer, the enhancement mark loading layer, the suppression mark loading layer and the dual-channel arbitration layer are continuously corrected until the judgment results of the dominant risk item and the backup risk item correspond stably with the labeling results.

[0056] S4.2: In the relation loading layer, for the cross-source hidden danger candidate chain set under the same object locator key, the main chain bit, parallel bit and pending bit are written to generate the candidate chain relation loading set; Furthermore, in the relationship loading layer, the cross-source hazard candidate chain set under the same object positioning key is unfolded in parallel according to candidate chain category, internal order, time principal, and position principal. The trigger sequence, continuity strength, and change direction between each cross-source hazard candidate chain are checked. For cross-source hazard candidate chains that can continuously represent the main risk advancement path, the main chain position is added; for cross-source hazard candidate chains that are close in time, overlap in position, or have parallel risk manifestations but are not enough to directly override the main chain position, parallel positions are added; for cross-source hazard candidate chains that have cross-coverage, competition between successive and subsequent chains, or whose inter-chain pointing cannot directly determine the primary and secondary relationship, pending positions are added, generating a candidate chain relationship loading set.

[0057] S4.3: In the enhancement tag loading layer, the candidate chain relationship loading set is written in layers to obtain persistent enhancement bits, recurrent enhancement bits, regional enhancement bits and hysteresis enhancement bits, and integrate them into enhancement tags; Furthermore, the enhancement tag loading layer unfolds the cross-source hazard candidate chains one by one according to the candidate chain relationship loading set, and identifies different enhancement forms by combining the time principal position, position principal position, candidate chain category and internal order: when the same cross-source hazard candidate chain continues to advance along the continuous time principal position and the change segment continues to accumulate, a continuous enhancement bit is written; when the candidate chain appears at intervals but returns to the same candidate chain category multiple times, a recurrence enhancement bit is written; when multiple cross-source hazard candidate chains form a cluster pointing under adjacent position principal positions, the same regional level or shared appendix content, a regional enhancement bit is written; when the trigger segment that appears earlier only shows the risk advancement in the subsequent position after several sequences, a lagging enhancement bit is written; all enhancement bits are uniformly merged and integrated into enhancement tags.

[0058] S4.4: In the suppression tag loading layer, reverse bit-push writing is performed on the loading set of the relationship between the enhancement tag and the candidate chain to generate the suppression tag, and it is integrated with the enhancement tag into a dual tag candidate chain; Furthermore, in the suppression marker loading layer, the continuous enhancement bits, recurrent enhancement bits, regional enhancement bits, and hysteresis enhancement bits in the enhancement markers are checked one by one against the main chain bits, parallel bits, pending bits, candidate chain categories, internal order, time principal bits, and location principal bits in the candidate chain relationship loading set. It is determined whether there are any suppression situations where the enhancement direction is consistent but the primary and secondary relationships are reversed, the position coverage is too dense, the time advancement is stagnant, or the parallel competition is too strong among the cross-source hazard candidate chains under the same object positioning key. For cross-source hazard candidate chains that do not have the conditions for priority push-up, reverse suppression writing is performed in the order of priority of main chain bits, diversion of parallel bits, and back suppression of pending bits. The suppression level and suppression landing point are supplemented, the suppression marker is written into the corresponding cross-source hazard candidate chain, and integrated with the enhancement marker into a dual-marker candidate chain.

[0059] It should be noted that the priority push condition refers to the criteria for a certain cross-source potential risk candidate chain to have priority in entering the dominant judgment position in the primary and secondary comparison. For example, when the continuous enhancement position is more concentrated, the main chain position is more clear and the time progress is more continuous, it can be determined that the priority push condition is met.

[0060] S4.5: In the dual-channel arbitration layer, the strengthening and suppressing markers in the dual-mark candidate chain are compared segment by segment, and the primary and backup order is determined. The dominant risk entry and the backup risk entry are output and integrated into the dual-channel arbitration table.

[0061] Furthermore, in the dual-channel arbitration layer, the dual-marked candidate chains are expanded segment by segment according to the candidate chain category, internal order, temporal principal position, and positional principal position, based on the same object positioning key. The continuous enhancement position, recurrent enhancement position, regional enhancement position, and hysteretic enhancement position in each segment are compared with the suppression level, suppression landing point, and suppression position sequence to calculate the dual-channel arbitration potential difference value. Based on this, the primary and secondary relationship between the enhancement push strength and the suppression suppression strength is determined. For the corresponding segment whose dual-channel arbitration potential difference value meets the principal position determination condition and whose enhancement push is continuous, the principal chain position is stable, and the suppression suppression position is weak, a dominant risk entry is written. For the corresponding segment whose dual-channel arbitration potential difference value does not meet the principal position determination condition but has enhancement support and is not included in the principal position due to parallel competition, pending back pressure, or local suppression, a backup risk entry is written. The dominant risk entry and backup risk entry are merged and arranged according to the object positioning key, temporal principal position, and corresponding segment position to form a dual-channel arbitration table.

[0062] It should be noted that the dual-channel arbitration table is used to aggregate the primary risk entries and backup risk entries of each corresponding segment under the same object positioning key, clarify the primary and backup relationship, time and location attribution and arrangement order of each risk segment, and provide a unified basis for subsequent primary risk arrangement, backup risk attachment and verification trigger content loading.

[0063] The formula for calculating the dual-channel arbitration potential difference is: ; in, Indicates the first The two-channel arbitration potential difference value of the candidate chain segment. Indicates the first The number of consecutive strengthening bits for each candidate chain segment. Indicates the first The number of recurrence enhancement sites established for each candidate chain segment Indicates the first Region enhancement bit coverage of each candidate chain segment Indicates the first The span of the hysteresis enhancement bit of each candidate chain segment. Indicates the first The chain position dominance of each candidate chain segment Indicates the first Suppression levels of candidate chain segments, Indicates the first The suppression landing point offset of each candidate chain segment Indicates the first The order of the bit presses of each candidate chain segment.

[0064] It should also be noted that when calculating the dual-channel arbitration potential difference value, firstly, according to the object positioning key, candidate chain category, internal order, time principal and position principal, the continuous enhancement position establishment amount, recurrence enhancement position establishment amount, regional enhancement position coverage, lag enhancement position establishment span and chain position advantage amount in the corresponding segment are read segment by segment. The above enhancement side quantities are then processed by basic translation to form the product of enhancement driving base quantities. At the same time, the suppression level, suppression landing point offset and suppression position priority value corresponding to the segment are read. The above suppression side quantities are then processed by basic translation to form the product of suppression suppression base quantities. Then, the ratio of the two sides' action strength is constructed by the product of enhancement driving base quantities and the product of suppression suppression base quantities, and the logarithmic transformation is performed on the ratio to obtain the dual-channel arbitration potential difference value. Subsequently, based on the magnitude of the dual-channel arbitration potential difference value, combined with the main chain position stability, parallel competition, pending back pressure and local suppression, it is determined whether the current corresponding segment is written into the dominant risk entry or the backup risk entry.

[0065] Among them, the number of times the continuous enhancement bit is established is the number of times the same cross-source hidden danger candidate chain is continuously advanced in the main position of the continuous time; the number of times the recurrence enhancement bit is established is the number of times the same candidate chain category reappears after an interval; the coverage of the regional enhancement bit is the coverage range formed by the clustering under the adjacent main positions, the same regional level, or the shared appended content; the span of the establishment of the lag enhancement bit is the number of main or sequential time spans between the first appearance of the trigger segment and the subsequent risk advancement; the chain position advantage quantity is the conversion quantity of the order and stability of the main chain position, parallel position, and pending position; and the suppression landing point offset quantity is the offset distance of the suppression landing point relative to the original candidate chain segment position after the reverse pressure bit is written.

[0066] Figure 4 This method comprehensively demonstrates the differences among three schemes under normal parameter conditions in four core indicators: object location key integrity rate, attachment mark hit rate, dominant risk item hit rate, and feedback closure rate. Gray bars represent control scheme A, blue bars represent control scheme B, and green bars represent the present invention's scheme. The object location key integrity rate and attachment mark hit rate correspond to the front-end multi-source integration and association attachment capabilities; the dominant risk item hit rate corresponds to the dual-channel risk arbitration model's ability to distinguish between dominant and backup risk items; and the feedback closure rate corresponds to the link closure capability after the verification trigger table is encapsulated and the feedback field is supplemented. The present invention's scheme outperforms both control schemes in all four indicators, fully supporting the improvement of data integrity through time alignment and location merging, and enhancing the verifiability of risk output through the dual-channel risk arbitration model.

[0067] S5: Arrange the dual-channel arbitration table, attach the backup risk items to the corresponding primary risk items, write the verification trigger content and feedback fields, and generate property safety management records.

[0068] S5.1: The dominant risk items in the dual-channel arbitration table are centrally merged and sequentially expanded, and the main ranking, parallel ranking, and subsequent ranking are added to form a set of dominant risk arrangement items; Furthermore, the dominant risk entries in the dual-channel arbitration table are centrally merged according to object positioning key, time subject, position subject, and candidate chain category. Dominant risk entries under the same object positioning key are expanded one by one according to time subject, and the progress order, concurrent performance, and continuous connection relationship between each dominant risk entry are verified. Dominant risk entries with priority verification and the most direct risk progress under the same time subject are written into the main ranking position. Dominant risk entries with similar time, overlapping positions, or parallel risk performance are written into parallel positions. Dominant risk entries that are located after the current main ranking position and inherit the previous progress chain are written into subsequent positions, forming a dominant risk arrangement entry set.

[0069] S5.2: Based on the arrangement position of the dominant risk arrangement items set, perform corresponding retrieval and targeted attachment for the backup risk items in the dual-channel arbitration table and fill in the attachment order to generate a risk attachment table; Furthermore, based on the primary, parallel, and subsequent positions in the set of dominant risk placement items, the backup risk items in the dual-channel arbitration table are searched according to the object positioning key, time primary position, position primary position, and candidate chain category. Backup risk items that are close in time, correspond in position, or have a risk-pointing supplementary relationship with each placement position are screened out. The retrieved backup risk items are then targeted and attached according to the rules of priority correspondence with primary position, parallel correspondence with parallel position, and deferred correspondence with subsequent position (a backup risk item is only allowed to be attached to one dominant risk item, with priority given to the item corresponding to the primary position; when there are multiple primary positions, the dominant risk item with the closest time primary position and the closest position primary position is attached; if the primary position cannot be attached, it is then transferred to parallel attachment with parallel position or deferred attachment with subsequent position). The association link between each backup risk item and the corresponding dominant risk item is checked to see if it is clear and if the supplementary direction is consistent. The attachment order is written for the backup risk items that have been attached, and a risk attachment table is generated.

[0070] S5.3: Based on the risk linkage table, load the initial inspection content, supplementary inspection content, follow-up inspection content and source verification content for the primary risk item and the corresponding backup risk item, and generate the verification trigger table; Furthermore, based on the primary risk item, backup risk item, attachment order, object positioning key, time primary, and location primary in the risk linkage table, the verification configuration is carried out item by item. The abnormal trigger position, risk advancement position, and priority verification direction corresponding to the primary risk item are written into the initial verification content. The parallel risk manifestation, supplementary risk indication, and related verification landing point corresponding to the backup risk item are written into the supplementary verification content. The inherited inspection items that continue to extend from the primary risk item and the backup risk item along the time primary are written into the follow-up verification content. Combining the source correspondence of access control trigger records, inspection reporting records, equipment status change records, and manual reporting records, the source review content is added to the items in the link where there is source switching, record intersection, or handling jump position, and a verification trigger table is generated.

[0071] It should be noted that the initial investigation content, supplementary investigation content, continued investigation content, and source verification content are generated based on the object positioning key, time primary key, location primary key, candidate chain category, dominant risk item source, and backup risk item source, respectively.

[0072] S5.4: Encapsulate the verification trigger table, add the return fields, and merge and expand by row to generate property security management records.

[0073] Furthermore, the primary risk items, backup risk items, initial inspection content, supplementary inspection content, follow-up inspection content, and source verification content in the inspection trigger table are encapsulated and compiled according to the object location key, time primary position, location primary position, and attachment order. Inspection items corresponding to the same inspection link are grouped into the same record row, and a feedback field is added to each record. The feedback field is used to register the inspection execution status, inspection completion time, handling feedback location, and source verification confirmation status (e.g., inspected, pending supplementary inspection, and returned). Records with the same object location key and consistent inspection direction are merged and expanded by row, with the initial inspection content placed first, the supplementary inspection content and follow-up inspection content arranged in the corresponding row positions according to the attachment order, and the source verification content attached to the corresponding inspection position, generating a property safety management record.

[0074] This embodiment also provides a computer device applicable to the data analysis-based property security management method, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the data analysis-based property security management method proposed in the above embodiment.

[0075] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0076] This embodiment also provides a storage medium storing a computer program, which, when executed by a processor, implements the data analysis-based property security management method proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0077] In summary, this invention achieves standardized integration of multi-source data by generating an in-situ object location entry table through time alignment and location merging, thereby resolving correlation breaks and improving data integrity in industrial data analysis. Furthermore, by outputting dominant and backup risk entries through a dual-channel risk arbitration model, it achieves hierarchical arbitration of potential hazards, distinguishes risk levels, and enhances the verifiability of risk output.

[0078] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A property security management method based on data analysis, characterized in that, include: Collect security incident records within the property management area, extract security incident related fields, and perform unified time alignment and location merging to generate an object location in-situ entry table; Based on the object location in-situ entry table, combined with the security event association field, an object location key is constructed, and records with event association relationships are linked to generate an object location association expanded table; The attached records and object location keys in the object location association expansion table are linked together to form a cross-source continuous event chain, and the trigger segment, continuation segment and change segment are extracted and assembled into a cross-source hidden danger candidate chain set. Input the cross-source hazard candidate chain set into the dual-channel risk arbitration model, perform candidate chain relationship loading, enhanced suppression labeling, and dual-channel arbitration, output the dominant risk item and the backup risk item, and generate a dual-channel arbitration table; Arrange the dual-channel arbitration table, attach the backup risk items to the corresponding primary risk items, write the verification trigger content and feedback fields, and generate property safety management records.

2. The property security management method based on data analysis as described in claim 1, characterized in that, The steps for generating the in-situ entry table for object positioning are as follows: The security event logs are organized, missing or incomplete fields are filled in, and the source is supplemented to generate security event association fields. Extract the original time description from the security event association field, and perform original time conversion, window reordering and conflict time yielding to generate a time alignment entry set; Perform hierarchical position merging and window order arrangement on the time alignment entry set, and write it into the position field to generate the object positioning in-place entry table.

3. The property security management method based on data analysis as described in claim 2, characterized in that, The steps for constructing object locator keys and attaching records with event association relationships are as follows: The object location entry table is grouped in the same window, expanded in parallel positions, the main position is extracted and the auxiliary position is filled in, the time main position, the position main position, the object main position and the sequence position are obtained, and integrated into the object location key; Establish an associated candidate window around the object's location key, divide the candidate item range, and filter out associated candidate records that satisfy the conditions of continuation of the same object, adjacent transfer, state inheritance, and disposal continuation.

4. The property security management method based on data analysis as described in claim 3, characterized in that, The steps for generating the object location association expansion table are as follows: The event-related candidate records are subjected to multi-caliber linkage verification based on continuous execution time, adjacent location, and sequential handling, and linkage tags are written to generate a linkage verification item set; The order and type of association between the linked entries are filled in according to the linked tags, and the linked records are summarized according to the object location key to generate an object location association expansion table.

5. The property security management method based on data analysis as described in claim 4, characterized in that, The chaining is a cross-source continuous event chain, and the steps are as follows: According to the object location key and the order of association, the attached records in the object location association expansion table are centrally merged and sequentially linked to generate a set of consecutive event links. Perform source switching verification and breakpoint continuation on the continuous event chain entry set, and connect adjacent attached records that meet the continuation conditions into a cross-source continuous event chain.

6. The property security management method based on data analysis as described in claim 1, characterized in that, The assembly into a cross-source hazard candidate chain set is performed as follows: Perform chain segment role splitting on cross-source continuous event chains to obtain triggering segments, continuation segments, and change segments; The trigger segment, continuation segment, and change segment are encapsulated in sequence, and the candidate chain category and internal order are filled in to generate a cross-source hidden danger candidate chain set.

7. The property security management method based on data analysis as described in claim 1 or 6, characterized in that, The steps for generating the dual-channel arbitration table are as follows: The dual-channel risk arbitration model includes a relation loading layer, an enhanced tag loading layer, an inhibited tag loading layer, and a dual-channel arbitration layer; In the relation loading layer, the main chain bit, parallel bit and pending bit are written for the cross-source hidden danger candidate chain set under the same object locator key to generate the candidate chain relation loading set; In the enhancement tag loading layer, the candidate chain relationship loading set is written hierarchically to obtain persistent enhancement bits, recurrent enhancement bits, regional enhancement bits, and hysteresis enhancement bits, and then integrated into enhancement tags; In the suppression tag loading layer, the loading set of the relationship between the enhancement tag and the candidate chain is reverse-push-written to generate the suppression tag, and then integrated with the enhancement tag into a dual-tag candidate chain. In the dual-channel arbitration layer, the strengthening and suppressing markers in the dual-mark candidate chain are compared segment by segment, and the primary and backup order is determined. The dominant risk entry and the backup risk entry are output and integrated into the dual-channel arbitration table.

8. The property security management method based on data analysis as described in claim 7, characterized in that, The steps for generating property security management records are as follows: The dominant risk items in the dual-channel arbitration table are centrally merged and sequentially expanded, and the main ranking, parallel ranking, and subsequent ranking are added to form a set of dominant risk arrangement items; Based on the arrangement position of the dominant risk arrangement items, perform corresponding retrieval and targeted attachment on the backup risk items in the dual-channel arbitration table and fill in the attachment order to generate a risk attachment table; Based on the risk linkage table, the primary risk item and its corresponding backup risk item are loaded with the initial inspection content, supplementary inspection content, follow-up inspection content and source verification content, and an inspection trigger table is generated. The verification trigger table is encapsulated, and the return fields are filled in. At the same time, the rows are merged and expanded to generate property security management records.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the data analysis-based property security management method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the data analysis-based property security management method according to any one of claims 1 to 8.

Images