Tamper-proof alarm method and device, electronic equipment and medium

Abstract

The present application relates to the field of smart home, in particular to a kind of anti-disassembly alarm method, device, electronic equipment and medium.First, the anti-disassembly observation information reported by target device in target defense zone is acquired, and based on dynamic bayesian network, the anti-disassembly observation information and the historical anti-disassembly state information of target defense zone are combined to determine the anti-disassembly abnormal probability that target defense zone is currently in anti-disassembly abnormal state.When anti-disassembly abnormal probability reaches preset probability threshold, decision state is constructed according to the defense zone operating state of target defense zone and anti-disassembly observation information, then target processing action is determined based on Markov decision process, and target processing action is executed to carry out anti-disassembly alarm processing to target defense zone.

Description

Technical Field

[0001] This invention relates to the field of smart homes, specifically to an anti-tamper alarm method, device, electronic device, and medium. Background Technology

[0002] With the increasing popularity of smart homes, more and more families are deploying smart devices such as door and window sensors, infrared motion sensors, smoke detectors, and smart locks, and managing these devices uniformly through a home gateway. To prevent unauthorized disassembly, movement, or damage, smart devices are typically equipped with tamper detection mechanisms. When the device casing is opened, the device is removed from its installation position, or it is subjected to abnormal disassembly, the tamper detection mechanism is triggered. The smart device reports its tamper status to the home gateway, which then controls the local alarm bell, mobile terminal, or management platform to output alarm information, thus initiating tamper alarm processing.

[0003] Existing tamper alarm processes typically employ fixed threshold judgments and single-rule strategies. However, the home environment is complex, with many scenarios that could cause the tamper detection mechanism to be briefly triggered. Fixed thresholds and single rules are insufficient to accurately distinguish between environmental interference and actual disassembly based on continuous observation information, historical triggering situations, and the current status of the protected zone, which can easily lead to false alarms and insufficient accuracy of tamper alarms. Summary of the Invention

[0004] This invention provides a tamper alarm method, device, electronic device, and medium, aiming to improve the accuracy of tamper alarms.

[0005] In a first aspect, embodiments of the present invention provide an anti-tamper alarm method, the method comprising: Acquire anti-tamper observation information reported by target devices within the target defense zone. The anti-tamper observation information is used to characterize the triggering status of the anti-tamper mechanism of the target device. Based on dynamic Bayesian networks, the probability of a target zone being in an abnormal anti-tampering state is determined by anti-tampering observation information and historical anti-tampering status information of the target zone. The historical anti-tampering status information is used to characterize the anti-tampering status of the target zone before the current time point. When the probability of anti-tampering anomalies reaches a preset probability threshold, a decision state is constructed based on the target zone's operational status and anti-tampering observation information. The operational status of the zone is used to characterize the current activation status of the target zone's monitoring and control of the equipment it manages, as well as the scope of equipment to which the monitoring and control are applicable. Based on the Markov decision process, the target processing action is determined according to the decision state; Execute target processing actions to handle tamper alarms in the target defense zone.

[0006] In one embodiment of the present invention, the historical anti-tamper status information includes the historical normal state probability and the historical anti-tamper abnormal state probability, wherein the historical normal state probability and the historical anti-tamper abnormal state probability are the probabilities of the target defense zone being in a normal state and the probabilities of being in an anti-tamper abnormal state, respectively, determined before the current time point. Based on dynamic Bayesian networks, and using anti-tamper observation information and historical anti-tamper status information of the target defense zone, the probability of the target defense zone currently being in an abnormal anti-tamper state is determined, including: Based on the historical normal state probability, the historical anti-dismantling abnormal state probability, and the preset state transition probability, determine the predicted probability of the normal state and the predicted probability of the anti-dismantling abnormal state at the current time point. Determine the first observation probability and the second observation probability corresponding to the anti-tamper observation information, wherein the first observation probability is the probability of anti-tamper observation information occurring under the condition that the target defense zone is in a normal state, and the second observation probability is the probability of anti-tamper observation information occurring under the condition that the target defense zone is in an abnormal anti-tamper state. The predicted probability of the normal state at the current time point is corrected based on the first observation probability to obtain the first corrected probability, and the predicted probability of the anti-dismantling abnormal state at the current time point is corrected based on the second observation probability to obtain the second corrected probability. The first and second corrected probabilities are normalized, and the normalized second corrected probability is taken as the anti-tampering anomaly probability.

[0007] In one embodiment of the present invention, the anti-tampering observation information includes the current anti-tampering status and the number of anti-tampering triggers within a preset statistical period. The current anti-tampering status is used to characterize whether the anti-tampering mechanism of the target device is triggered at the current time point, and the number of anti-tampering triggers is the number of times the anti-tampering mechanism switches from a non-triggered state to a triggered state within the preset statistical period. Determine the first and second observation probabilities corresponding to the anti-tamper observation information, including: Construct the current observation vector based on the current anti-tamper status and the number of anti-tamper triggers; Based on the current observation vector and the first mean vector and first covariance matrix of the first multivariate Gaussian distribution model, the first observation probability is determined. The first mean vector and the first covariance matrix are used to characterize the statistical distribution of the observation vector consisting of the anti-disassembly status and the number of anti-disassembly triggers when the target defense zone is in a normal state. Based on the current observation vector and the second mean vector and second covariance matrix of the second multivariate Gaussian distribution model, the second observation probability is determined. The second mean vector and the second covariance matrix are used to characterize the statistical distribution of the observation vector consisting of the anti-disassembly state and the number of anti-disassembly triggers when the target defense zone is in an anti-disassembly abnormal state.

[0008] In one embodiment of the present invention, the anti-tampering observation information includes the current anti-tampering status and the number of anti-tampering triggers within a preset statistical period. The current anti-tampering status is used to characterize whether the anti-tampering mechanism of the target device is triggered at the current time point, and the number of anti-tampering triggers is the number of times the anti-tampering mechanism switches from a non-triggered state to a triggered state within the preset statistical period. The decision-making state is constructed based on the operational status of the target defense zone and anti-dismantling observation information, including: Determine the zone status code corresponding to the zone operational status of the target zone; The trigger level is determined based on the preset number of times the anti-tamper triggers fall within a preset number of times within a preset statistical period; The alarm interval level is determined based on the time interval between the current time point and the previous alarm time point, where the previous alarm time point is the time point when the tamper alarm was last processed. The decision state is obtained by combining the zone status code, the current tamper protection status, the trigger count level, and the alarm interval level.

[0009] In one embodiment of the present invention, the Markov decision process includes using a reward function to determine the reward value corresponding to performing each candidate processing action in the decision state based on at least one of false alarm cost, false alarm cost, and alarm delay cost; Based on Markov decision processes, the target processing actions are determined according to the decision state, including: Obtain multiple preset decision states; For each preset decision state, the state value of the preset decision state is iteratively updated based on the reward value of performing each candidate processing action in the preset decision state and the state change probability after performing each candidate processing action, until the preset convergence condition is met. Based on the updated state value, determine the optimal processing action corresponding to the preset decision state; The optimal action for the preset decision state corresponding to the decision state is determined as the target action.

[0010] In one embodiment of the present invention, after performing the target processing action, the method further includes: Based on the operational status of the target defense zone and the equipment attributes of the target equipment, determine the equipment arming enable flag corresponding to the target equipment. The equipment arming enable flag is used to indicate whether the target equipment has entered the alert state. Send the device arming enable flag to the target device.

[0011] In one embodiment of the present invention, sending a device arming enable flag to a target device includes: Upon receiving heartbeat information from the target device, the device arming enable flag is added to the response information for the heartbeat information, and the response information is sent to the target device; or, When the operational status of the target zone changes or the equipment attributes of the target equipment change, the device actively sends an arming enable flag to the target equipment.

[0012] Secondly, embodiments of the present invention provide an anti-tamper alarm device, the device comprising: The acquisition module is used to acquire anti-tamper observation information reported by target devices within the target defense zone. The anti-tamper observation information is used to characterize the triggering status of the anti-tamper mechanism of the target device. The first determination module is used to determine the probability of an abnormal anti-tampering state of the target defense zone at present, based on the anti-tampering observation information and the historical anti-tampering state information of the target defense zone, according to the dynamic Bayesian network. The historical anti-tampering state information is used to characterize the anti-tampering state of the target defense zone before the current time point. The module is used to construct a decision state based on the target zone's operational status and anti-tamper observation information when the probability of anti-tampering anomalies reaches a preset probability threshold. The operational status of the zone is used to characterize the current activation status of the target zone's monitoring and control of the equipment it manages, as well as the range of equipment to which the monitoring and control are applicable. The second determination module is used to determine the target processing action based on the decision state, according to the Markov decision process. The execution module is used to perform target processing actions to handle tamper alarms for the target zone.

[0013] Thirdly, embodiments of the present invention provide an electronic device, the device including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When the processor executes the program stored in the memory, it implements the steps of the tamper alarm method provided in the first aspect of the present invention.

[0014] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the tamper alarm method provided in the first aspect of the present invention.

[0015] In this embodiment of the invention, the anti-tamper observation information reported by the target device is first acquired to promptly grasp the current triggering status and recent changes of the anti-tamper mechanism. Subsequently, based on a dynamic Bayesian network, the current anti-tamper observation information is fused with the historical anti-tamper status information of the target area in a time sequence, and the probability of the target area being in an abnormal anti-tamper state (anti-tamper anomaly probability) is recursively updated using state transition relationships and observation probabilities. Therefore, a single anti-tamper trigger is no longer directly equated with actual disassembly. Instead, the persistence of the abnormal state, the correlation between continuous observations, and the degree of matching between the current observation and the normal state and the abnormal anti-tamper state are comprehensively considered. This suppresses the impact of short-term triggers caused by factors such as door and window vibration, equipment loosening, temperature changes, or accidental collisions on the judgment results, improves the accuracy of anti-tamper anomaly identification and anti-tamper alarm, and reduces the probability of false alarms.

[0016] After determining that the probability of an anti-tampering anomaly reaches a preset probability threshold, a decision state is constructed based on the operational status of the target zone and anti-tampering observation information. This ensures that subsequent processing depends not only on the anomaly probability but also on whether alert control is enabled, the range of equipment to which alert control applies, and the current anti-tampering trigger characteristics for differentiated decision-making. Furthermore, based on a Markov decision process, the immediate reward, false alarm cost, missed alarm cost, alarm delay cost, and their impact on subsequent states for each candidate processing action are comprehensively evaluated. This determines the target processing action most suitable for the current anti-tampering scenario, avoiding excessive or delayed alarms caused by fixed thresholds and single rules. Finally, by executing the target processing action, tiered handling is achieved, including continued monitoring, delayed processing, alarm output, or reporting to the platform. Therefore, it can reduce false alarms caused by environmental interference while promptly identifying genuine anti-tampering anomalies that occur continuously or repeatedly, balancing the accuracy, real-time nature, and processing flexibility of anti-tampering alarms. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the tamper alarm method provided in an embodiment of the present invention; Figure 2 This is another flowchart illustrating the tamper alarm method provided in this embodiment of the invention; Figure 3 This is a schematic diagram of the anti-tamper alarm device provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention are within the scope of protection of the present invention.

[0020] The terms "first," "second," etc., used in the specification and claims of this invention are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0021] The methods, apparatus, electronic devices, and media provided by the embodiments of the present invention will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios.

[0022] Figure 1 This is a flowchart illustrating the tamper alarm method provided in an embodiment of the present invention, as shown below. Figure 1 As shown, the first aspect of the present invention provides an anti-tamper alarm method that can be used in a smart home security zone management system. The executing entity of the method can be a home gateway, a smart home controller with edge computing capabilities, or an electronic device such as a server that communicates with smart home devices, preferably a home gateway, and includes the following steps S100-S500.

[0023] Before executing the method of this embodiment, zone configuration information can be pre-established in the gateway. One zone can correspond to one physical space, or it can correspond to multiple smart home devices with the same alarm control requirements. For example, the target zone can be the master bedroom zone, the living room zone, or the entrance door zone.

[0024] Each zone's configuration information may include the zone name, zone operating status, alarm indication information, device identifier list, dynamic Bayesian network parameters, and Markov decision process parameters. The alarm indication information indicates whether the target zone is currently in an alarm state; the device identifier list records the devices managed by the target zone; the dynamic Bayesian network parameters may include state transition probabilities, observation probability model parameters, and initial state probabilities; the Markov decision process parameters may include preset decision states, candidate processing actions, state change probabilities, reward function parameters, discount factors, and convergence conditions. The document also stores zone status, alarm indications, device lists, and DBN (Dynamic Bayesian Networks) and MDP (Markov Decision Process) parameters on a zone-by-zone basis.

[0025] In some implementations, one or more sub-zones can be divided within the target zone to allow for differentiated management of devices with different surveillance and control requirements within the same physical space. The configuration information for sub-zones can include sub-zone identifiers, device sets, priorities, applicable surveillance and control methods, and the degree of spatial overlap between the sub-zone and the target zone. For example, in a living room zone, separate sub-zones can be established for the entrance door, balcony windows, and indoor activity areas. When only peripheral devices are subject to surveillance and control, devices in the entrance door and balcony window zones can be put into a surveillance state, while the human infrared sensors in the indoor activity area can remain on alert.

[0026] The target device can be a door / window sensor, a smart door lock, a human infrared sensor, a smoke sensor, a gas sensor, or other smart devices equipped with an anti-tamper mechanism. The anti-tamper mechanism can include a mechanical anti-tamper switch, a micro switch, a photoelectric detection component, an acceleration detection component, or other detection components used to detect when the device casing is opened, the device is removed from its installation position, or the device is moved abnormally.

[0027] Step S100: Obtain anti-tamper observation information reported by target equipment within the target defense zone; Among them, the anti-tampering observation information is used to characterize the triggering status of the anti-tampering mechanism of the target equipment.

[0028] In this step, the target device can periodically send heartbeat information to the gateway, carrying tamper monitoring information within the heartbeat information; alternatively, it can proactively send event reporting information to the gateway when the trigger state of the tamper mechanism changes. To balance routine status monitoring and rapid response in abnormal states, both periodic reporting and event-triggered reporting can be used simultaneously: under normal circumstances, the target device reports its status according to a preset heartbeat cycle; upon detecting that the tamper mechanism has been triggered, it immediately sends an tamper trigger event without waiting for the next heartbeat cycle.

[0029] The tamper detection information is used at least to characterize whether the tamper mechanism of the target device has been triggered. In one specific implementation, the tamper detection information may include: Current anti-tamper status; The number of times anti-tampering is triggered within a preset statistical period; The duration for which the tamper mechanism remained in a triggered state; The point in time when the tamper-proof status changes; The equipment identifier of the target device; The target zone identifier to which the target device belongs.

[0030] The current tamper protection status can be represented using binary information. For example, a value of 0 indicates that the tamper protection mechanism has not been triggered, and a value of 1 indicates that the tamper protection mechanism has been triggered. The number of tamper protection triggers can be obtained by the gateway or the target device by counting the number of times the tamper protection status changes from non-triggered to triggered within a preset statistical period. For example, the preset statistical period can be the last 10 seconds, the last 30 seconds, or the last 1 minute.

[0031] In this way, observational evidence reflecting the current tamper protection status of the target device and its recent changes is obtained, providing input for subsequent temporal probabilistic inference based on dynamic Bayesian networks. Compared with collecting only one tamper trigger signal, simultaneously collecting information such as the number of triggers and duration helps to distinguish between brief switch jitter and continuous abnormal disassembly.

[0032] For example, the target device is a door and window sensor installed on a living room window. When sunlight causes the window frame to expand and contract due to temperature changes, the tamper switch may be briefly released. The target device reports to the gateway that the current tamper status is triggered, but only one tamper trigger has occurred in the last 10 seconds, and it returns to the untriggered state after a short time. The gateway uses this report as the current tamper observation information for subsequent state inference.

[0033] Step S200: Based on the dynamic Bayesian network, determine the probability of the target defense zone being in an abnormal anti-tampering state based on the anti-tampering observation information and the historical anti-tampering status information of the target defense zone. Among them, the historical anti-tamper status information is used to characterize the anti-tamper status of the target zone before the current time point.

[0034] In this step, a dynamic Bayesian network is used to combine the state inference results of the target zone at previous time points with the newly acquired anti-tamper observation information at the current time point to make a probabilistic judgment on whether the target zone is currently in an abnormal anti-tamper state. A dynamic Bayesian network is a time-series probabilistic model that can describe the change of state over time and recursively update the state probability based on continuous observation information. This document demonstrates how a dynamic Bayesian network is used to infer the true state of a defense zone based on the observation sequence reported by the device and to quantify the uncertainty of the judgment.

[0035] In one implementation, the unobservable state of the target zone can be set as follows:

[0036] in, Indicates the target defense zone at the current time. Anti-tamper status, Indicates a normal state. This indicates an abnormal anti-tampering status.

[0037] Historical tamper status information may include the probability of a normal state determined before the current point in time. and the probability of tamper-proof abnormal state .For example:

[0038]

[0039] in, It can represent the current time point. The most recent point in time when dynamic Bayesian inference was performed.

[0040] First, the state probability at the current time point can be predicted based on the state transition probability. The state transition probability represents the likelihood that the target area will change from a certain state at a previous time point to another state at the current time point. For example, the state transition matrix... It can be represented as:

[0041] in, This represents the probability of maintaining the normal state from the normal state. This represents the probability of a change from a normal state to an anti-tamper abnormal state. This indicates the probability of recovering from an tamper-proof abnormal state to a normal state. This indicates the probability that the tamper-proof abnormal state remains in the tamper-proof abnormal state.

[0042] The probability of predicting the state at the current time point can be determined by the following formula:

[0043]

[0044] in, This indicates the predicted probability that the target defense zone is currently in a normal state, without incorporating current anti-dismantling observation information. This indicates the predicted probability that the target defense zone is currently in an abnormal anti-tampering state, without incorporating current anti-tampering observation information.

[0045] Subsequently, the predicted probability is corrected based on the likelihood of the current anti-dismantling observation information occurring under different conditions. Let the current anti-dismantling observation information be... Then it can be determined that:

[0046]

[0047] in, This indicates the first probability of obtaining the current anti-disassembly observation information when the target defense zone is actually in a normal state. This indicates the second observation probability of the current anti-tamper observation information occurring when the target defense zone is actually in an anti-tampering abnormal state.

[0048] The corrected and normalized state probabilities are:

[0049]

[0050] in, This is the probability of tampering failure.

[0051] Using the above recursive method, each tamper trigger is not processed in isolation, but is comprehensively judged based on previous state probabilities, recent trigger trends, and current observation reliability. If the tamper mechanism only experiences a single brief trigger, the probability of tamper anomaly may remain at a low level; if the tamper state remains triggered and triggers repeatedly within a short period, the probability of tamper anomaly will gradually increase with continuous observation.

[0052] In this way, the uncertainty of anti-tamper judgment is quantified by using temporal probabilistic reasoning, avoiding direct conclusion that actual disassembly has occurred due to single anti-tamper signal jitter, temperature change, loose equipment installation, or accidental collision.

[0053] For example, the probability that the target zone was in a normal state at the previous time point is 0.8, and the probability that it was in an abnormal tamper state is 0.2. Based on the state transition probability, the predicted probability of the normal state at the current time point is 0.8, and the predicted probability of the abnormal tamper state is 0.2. The current tamper observation information is "the tamper mechanism was triggered, but only once in the last 10 seconds." Its first observation probability in the normal state is 0.4, and its second observation probability in the abnormal tamper state is 0.6. After normalization, the probability of the abnormal tamper state is approximately 0.27. Based on this, the gateway can conclude that the current signal is more likely to be transient interference, rather than immediately identifying a real tampering incident.

[0054] Step S300: When the probability of anti-tampering anomaly reaches a preset probability threshold, construct a decision state based on the target defense zone's operational status and anti-tampering observation information; Among them, the zone operation status is used to characterize the current activation status of the target zone's monitoring and control of the equipment it manages, as well as the scope of equipment to which the monitoring and control applies.

[0055] In this step, a preset probability threshold is used to determine whether the current tamper anomaly warrants further action selection by a Markov decision process. The preset probability threshold can be set based on the target device type, the security level of the zone, and the user's tolerance for false alarms and missed alarms. For example, the preset probability threshold for a typical door and window sensor could be 0.80 or 0.85; for target devices with higher security requirements, a lower preset probability threshold can be set to expedite the subsequent decision-making process.

[0056] When the probability of tampering anomaly does not reach the preset probability threshold, the gateway can continue to monitor and record the current tampering observation information and wait for subsequent reports from the target device; when the probability of tampering anomaly reaches the preset probability threshold, it indicates that the current tampering signal has a high degree of anomaly credibility, and the gateway further constructs a decision state for use by the Markov decision process.

[0057] The operational status of a defense zone reflects whether the target defense zone is currently implementing surveillance and control measures on the equipment it manages, and whether these measures apply to all or only some of the equipment within the target defense zone. For example: The target defense zone did not implement warning and control measures for ordinary security equipment; The target defense zone only implements warning and control measures on the outer doors, windows, and equipment; The target defense zone implements surveillance and control over all applicable security equipment.

[0058] In this embodiment, alert control refers to the gateway determining whether to put the corresponding device into alert status based on the operational status of the target zone and the device attributes of each device within the target zone, and determining the scope of devices to which the alert status applies. When the target device enters alert status, it monitors the triggering of the tamper mechanism and reports the detected tamper observation information to the gateway for the gateway to calculate the probability of tamper anomalies and make tamper alarm decisions. When the target device does not enter alert status, alarm processing may not be performed for ordinary tamper triggers, or only the corresponding events may be recorded and reported.

[0059] Alert control can be applied to all devices within a target zone, or it can be applied only to devices that meet preset device attributes or belong to a preset device range. The gateway can convert the alert control results determined for each target device into a device arming enable flag and send it to the corresponding target device, so that the target device can enter or exit the alert state accordingly.

[0060] It's important to clarify that alert control is not the same as alarm handling. Alert control determines whether a target device is in an alert state requiring monitoring and response to abnormal events; alarm handling, on the other hand, involves identifying tamper anomalies and determining the appropriate action to take, then executing operations such as outputting alarm information, activating the alarm bell, or reporting to the management platform. In other words, alert control is the pre-emptive device management state for tamper alarms; the target device entering an alert state does not necessarily mean that an alarm has been triggered in the target zone.

[0061] The decision state can be composed of the zone's operational status, anti-tamper observation information, and information related to the current alarm history. In one implementation, the decision state can be represented as:

[0062] in, This represents the zone status code corresponding to the zone's operational status in the target zone. Indicates whether the target device has been triggered by anti-tampering measures. This indicates the level of tamper protection triggers within a preset statistical period. This indicates the alarm interval level between the current time point and the last alarm time point.

[0063] By dividing continuously changing information such as the number of tamper triggers and time intervals into discrete levels, complex home security situations can be transformed into finite states that can be handled by Markov decision processes.

[0064] In this way, by combining the anomaly confidence level output by the dynamic Bayesian network with the current alert and control status of the target zone, a decision input that comprehensively reflects the current tamper alarm conditions is formed. Thus, even if two target devices have the same tamper anomaly probability, but are operating in different zones or have different historical trigger frequencies, they can still enter different subsequent decision paths.

[0065] For example, after the target device is actually pried open, it continuously reports anti-tamper triggering. The dynamic Bayesian network determines that the probability of anti-tamper anomaly gradually increases from 0.62 to 0.94. Assuming the preset probability threshold is 0.85, the target zone is currently implementing alert control on all door and window devices, and the number of anti-tamper triggers has reached 3 in the last 10 seconds, and the last alarm was less than 10 seconds ago. Then the gateway can combine the above information into a high-risk decision state.

[0066] Step S400: Based on the Markov decision process, determine the target processing action according to the decision state.

[0067] In this step, a Markov decision process is used to formalize the tamper alarm handling as a sequential decision problem. The gateway not only determines whether an anomaly exists, but also needs to comprehensively consider the false alarm cost, false alarm cost, alarm delay cost, and subsequent impact of executing different handling actions, and select the target handling action with higher overall value from multiple candidate handling actions.

[0068] Candidate processing actions may include: Immediately activate surveillance and control of the target area; The alert control will be activated after a preset delay period. Set the target zone to alarm status and output alarm information; Do not execute alarm processing for now and continue to observe; The tampering incident is reported to the management platform, but no local alarm is triggered.

[0069] In some implementations, candidate processing actions may also include raising the alert level of the target defense zone, starting camera recording, requesting auxiliary observation information from other related devices, or notifying the property management platform.

[0070] Regarding the current decision-making state and any candidate processing action In some implementations, the action value corresponding to the candidate processing action can be determined according to the following formula:

[0071] in, Indicates the state of decision-making. Next, execute the candidate processing action. The value of the action, Indicates the execution of candidate processing actions. Instant rewards (reward value); This represents the discount factor, used to characterize the importance of future returns relative to current returns. Its value can be a number between 0 and 1, such as 0.95. Indicates the state of decision-making. Next, execute the candidate processing action. Then move to the next decision state. The probability of state change; Indicates the next decision state The state value.

[0072] The target processing action can be determined according to the following formula:

[0073] in, Represents the set of candidate processing actions. This indicates the target processing action.

[0074] Reward values ​​can be positive to represent gains or negative to represent costs. For example, correctly and promptly triggering an alarm for actual dismantling will result in a positive reward; triggering an alarm when no actual dismantling has occurred will result in a false alarm cost; failing to trigger an alarm for actual dismantling will result in a missed alarm cost; and delayed alarms will incur alarm delay costs based on the duration of the delay.

[0075] In this way, instead of using the single rule of "alarming as soon as the anti-tampering mechanism is triggered", the action is selected based on the current decision-making status and the long-term comprehensive results of different actions, thereby achieving a balance between reducing false alarms and reducing false alarms.

[0076] For example, when the target zone is under full alert, the tamper mechanism is continuously triggered, and the number of triggers is high within a short period of time, ignoring actions may result in high false negative costs, delaying actions may result in high alarm delay costs, while triggering alarm actions has the highest value. Therefore, the Markov decision process determines "setting the target zone to an alarm state and outputting alarm information" as the target processing action.

[0077] Step S500: Execute target processing action to perform tamper alarm processing on the target zone.

[0078] In this step, the gateway controls the target zone and its associated smart home devices to perform corresponding operations based on the specific type of target processing action.

[0079] When the target processing action is to trigger an alarm, one or more of the following operations can be performed: Set the alarm indication information of the target defense zone to alarm status; Push anti-tamper alarm information to the user's mobile device; Control the operation of local audible and visual alarms or sirens; Control the camera to start recording or increase the recording frame rate; Report tampering incidents to the cloud management platform; Write the target device identifier, target zone identifier, anti-tamper anomaly probability, trigger time, and number of anti-tamper triggers into the event log; Send notifications to the property management platform or other authorized terminals.

[0080] When the target processing action is to activate alert control with a delay, a countdown can be started, and the zone operation status of the target zone can be updated after the countdown ends. Different alert activation delays can be set for different zone operation statuses or different target devices. For example, a 30-second activation delay can be set when a user leaves their residence, so that the user can leave the target zone during the countdown; for continuously monitored devices, no delay can be set.

[0081] When the target processing action is to ignore it, the gateway may not output a local alarm, but it can still save the anti-tamper observation information for dynamic Bayesian inference at the next time point. In this way, although a single low-confidence trigger will not immediately disturb the user, it will affect subsequent judgments as historical information.

[0082] When the target processing action is a reporting action, the gateway can only send the tamper event to the cloud management platform, which will then record, statistically analyze, or manually review it, without controlling the local alarm.

[0083] In this way, the results obtained from probabilistic reasoning and sequential decision-making are transformed into specific smart home control operations, enabling hierarchical processing and coordinated handling of tampering incidents.

[0084] For example, if an intruder pries open a living room window, the probability of an anti-tampering anomaly increases to 0.94. The Markov decision process determines that triggering an alarm is the target action. The gateway sets the target zone to an alarm state, pushes a message to the user's mobile phone that "the living room window sensor is suspected of being tampered with," simultaneously controls the living room camera to start recording, and controls the local alarm to activate when the alarm linkage attribute of the target device is valid.

[0085] Through steps S100 to S500, the gateway first acquires the anti-tamper observation information reported by the target device, enabling it to promptly grasp the current triggering status and recent changes of the anti-tamper mechanism. Subsequently, based on a dynamic Bayesian network, the current anti-tamper observation information is fused with the historical anti-tamper status information of the target zone in a time sequence, and the probability of the target zone being in an abnormal anti-tamper state (anti-tamper anomaly probability) is recursively updated using state transition relationships and observation probabilities. Therefore, a single anti-tamper trigger is no longer directly equated with actual disassembly. Instead, the persistence of the abnormal state, the correlation between continuous observations, and the degree of matching between the current observation and the normal and abnormal anti-tamper states are comprehensively considered. This suppresses the impact of short-term triggers caused by factors such as door and window vibration, equipment loosening, temperature changes, or accidental collisions on the judgment results, improving the accuracy of anti-tamper anomaly identification and anti-tamper alarms, and reducing false alarms.

[0086] Once the probability of an anti-tampering anomaly reaches a preset probability threshold, a decision state is constructed based on the operational status of the target zone and anti-tampering observation information. This ensures that subsequent processing depends not only on the anomaly probability but also on whether alert control is enabled, the applicable equipment range for alert control, and the current anti-tampering trigger characteristics for differentiated decision-making. Furthermore, based on a Markov decision process, the immediate reward, false alarm cost, missed alarm cost, alarm delay cost, and their impact on subsequent states for each candidate processing action are comprehensively evaluated. This determines the target processing action most suitable for the current anti-tampering scenario, avoiding excessive alarms or delayed alarms caused by fixed thresholds and single rules. Finally, by executing the target processing action, tiered handling is achieved, including continued monitoring, delayed processing, alarm output, or reporting to the platform. Therefore, this embodiment can reduce false alarms caused by environmental interference while promptly identifying genuine anti-tampering anomalies that occur continuously or repeatedly, balancing the accuracy, real-time performance, and processing flexibility of anti-tampering alarms.

[0087] Once the probability of tampering anomalies reaches a preset condition, the Markov decision process is further utilized to comprehensively consider the zone's operating status, trigger count, alarm history, and the false alarms, missed alarms, and delay costs corresponding to different actions. This allows for the selection of appropriate actions for the current situation, avoiding false alarms or missed alarms caused by fixed thresholds and single rules, and improving the accuracy of tampering alarms.

[0088] Figure 2 This is another flowchart illustrating the tamper alarm method provided in this embodiment of the invention; please refer to it as well. Figures 1-2 .

[0089] In one embodiment of the present invention, the historical anti-tamper status information includes the historical normal state probability and the historical anti-tamper abnormal state probability. The historical normal state probability and the historical anti-tamper abnormal state probability are the probabilities of the target defense zone being in a normal state and the probabilities of being in an anti-tamper abnormal state, respectively, determined before the current time point.

[0090] Specifically, the historical normal state probability and the historical anti-tampering abnormal state probability can be the state probabilities obtained from the most recent dynamic Bayesian inference before the current time point, or they can be the state probabilities obtained after time decay or weighting of multiple inference results before the current time point. Preferably, the state probability obtained from the most recent inference is used so that it can be recursively inferred according to the forward algorithm of the dynamic Bayesian network.

[0091] For example, the current time point is denoted as The probabilities of historical normal states and historical anti-tampering abnormal states are expressed as follows:

[0092]

[0093] in, This represents a sequence of anti-dismantling observation information obtained up to the first time point; Indicates the probability of a historical normal state; This indicates the probability of historical anti-tampering anomalies.

[0094] When performing dynamic Bayesian network inference for the first time, before obtaining historical inference results, the initial normal state probability and initial anti-tampering abnormal state probability can be set based on the initial installation state of the target device. For example, if the target device is confirmed to be installed normally, the initial normal state probability can be set to 0.99, and the initial anti-tampering abnormal state probability can be set to 0.01. The normal state probability and anti-tampering abnormal state probability obtained in subsequent inferences can then be used as the historical normal state probability and historical anti-tampering abnormal state probability for the next inference, respectively.

[0095] Based on dynamic Bayesian networks, and using anti-tamper observation information and historical anti-tamper status information of the target defense zone, the probability of the target defense zone currently being in an abnormal anti-tamper state is determined, including: Step A1: Based on the historical normal state probability, the historical anti-tampering abnormal state probability, and the preset state transition probability, determine the predicted probability of the normal state and the predicted probability of the anti-tampering abnormal state at the current time point.

[0096] Specifically, the state transition probability is used to represent the probability that a target zone will change from a certain tamper state at a previous time point to another tamper state at the current time point, and may include:

[0097]

[0098]

[0099]

[0100] in, This indicates the probability that the target defense zone will remain in a normal state at the current time point, given that it was in a normal state at the previous time point. This indicates the probability that the target defense zone changes from a normal state to an anti-tampering abnormal state; This indicates the probability that the target defense zone will recover from an abnormal anti-tampering state to a normal state. This indicates the probability that the target defense zone will remain in an abnormal anti-tampering state at the current time point, given that it was in such a state at the previous time point.

[0101] For the same previous state, the sum of the probabilities of transitioning to each current state can be 1, that is:

[0102]

[0103] The aforementioned state transition probabilities can be obtained statistically from pre-collected normal usage samples and abnormal disassembly samples, or they can be pre-configured based on the type of target device, installation method, and actual usage environment. For example, normally installed door and window sensors typically maintain a normal state between two adjacent time points; therefore, It can be set to a larger value; when the target device has been triggered by tamper protection multiple times consecutively, the probability of it continuing to maintain the tamper protection abnormal state is usually high, therefore... It can also be set to a larger value.

[0104] The probability of predicting the normal state at the current time point can be determined by the following formula:

[0105] The probability of an abnormal tampering status at the current time point can be determined by the following formula:

[0106] in, This represents the predicted probability of the target defense zone being in a normal state at the current time point, i.e., the probability that the target defense zone is in a normal state before combining the anti-disassembly observation information at the current time point. This represents the predicted probability of an abnormal anti-tampering state at the current time point, that is, the probability that the target defense zone is in an abnormal anti-tampering state before combining the anti-tampering observation information at the current time point.

[0107] The above prediction process is equivalent to: first, based on the probability that the target defense zone was in a normal state and an abnormal anti-tampering state at the previous time point, and the possibility of each state transitioning to the current state, predicting which state the target defense zone might be in at the current time point.

[0108] Step A2: Determine the first observation probability and the second observation probability corresponding to the anti-tamper observation information, wherein the first observation probability is the probability of the above anti-tamper observation information occurring when the target defense zone is in a normal state, and the second observation probability is the probability of the above anti-tamper observation information occurring when the target defense zone is in an abnormal anti-tamper state.

[0109] Specifically, the anti-tamper monitoring information at the current time point can be represented as: ,in, This indicates the tamper monitoring information obtained at the current point in time. The tamper monitoring information may include the current tamper status of the target device, the number of tamper triggers within a preset statistical period, and other information reflecting the triggering status of the target device's tamper mechanism.

[0110] The probability of the first observation can be expressed as:

[0111] The second observation probability can be expressed as:

[0112] in This represents the first observation probability, i.e., the probability of the current anti-disassembly observation information occurring under the condition that the target defense zone is actually in a normal state. The probability of; This represents the second observation probability, which is the probability of the current anti-disarming observation information occurring given that the target defense zone is actually in an abnormal anti-disarming state. The probability of.

[0113] The first and second observation probabilities are not the final probabilities of whether the target zone is currently in a normal or abnormal anti-tamper state. Rather, they represent the degree of matching between the current anti-tamper observation information and the corresponding state. For example, if the current anti-tamper observation information is "the anti-tamper mechanism is briefly triggered once and then immediately recovers," this information may occur under normal conditions due to equipment vibration or temperature changes, therefore its first observation probability may be relatively high. If the current anti-tamper observation information is "the anti-tamper mechanism is continuously triggered and undergoes multiple state switches within a short period of time," then its second observation probability is usually relatively high.

[0114] The first and second observation probabilities can be determined by a preset observation probability model. For example, a first multivariate Gaussian distribution model corresponding to the normal state and a second multivariate Gaussian distribution model corresponding to the anti-tampering abnormal state can be established respectively. The observation vector composed of the current anti-tampering observation information is substituted into the two models respectively to obtain the first and second observation probabilities.

[0115] When the anti-tampering observation information is continuous or numerically processed, and Specifically, it can be the probability density value of the corresponding probability distribution model at the current observation information, and used as the observation likelihood in a dynamic Bayesian network.

[0116] Step A3: Correct the predicted probability of the normal state at the current time point based on the first observation probability to obtain the first corrected probability, and correct the predicted probability of the anti-tampering abnormal state at the current time point based on the second observation probability to obtain the second corrected probability.

[0117] Specifically, the first correction probability can be determined according to the following formula:

[0118] The second correction probability can be determined according to the following formula:

[0119] in, Indicates the first corrected probability; Indicates the second corrected probability; This represents the predicted probability of the normal state at the current point in time. This indicates the predicted probability of an abnormal tampering status at the current time point.

[0120] First correction probability It is used to comprehensively reflect two aspects of information: on the one hand, the probability that the target defense zone is currently in a normal state based on historical anti-tamper status information and state transition probability; on the other hand, the degree of matching between the currently obtained anti-tamper observation information and the normal state.

[0121] Accordingly, the second correction probability It is used to comprehensively reflect: the possibility that the target defense zone is in an abnormal anti-tampering state based on the evolution of its historical status, and the degree of matching between the current anti-tampering observation information and the abnormal anti-tampering state.

[0122] It should be noted that the first and second corrected probabilities are probabilities that have been corrected by the current anti-tampering observation information but have not yet been normalized. The sum of the two does not necessarily have to be equal to 1, so further normalization is required.

[0123] Step A4: Normalize the first and second corrected probabilities, and use the normalized second corrected probability as the anti-tampering anomaly probability.

[0124] Specifically, the gateway normalizes the first and second corrected probabilities.

[0125] After normalization, the following conditions can be met:

[0126] in, This represents the probability that the target defense zone is in a normal state at the current time after normalization. This represents the probability that, after normalization, the target zone is in an anti-tampering abnormal state at the current time.

[0127] The second corrected probability after normalization, i.e. , as the probability of tampering anomalies.

[0128] The probability of the normal state at the current time point and the probability of tampering It can also be saved as the historical normal state probability and historical anti-tampering abnormal state probability used when performing dynamic Bayesian network inference at the next time point, thus forming a continuously recursive state judgment process.

[0129] In this way, the current anti-tamper status of the target zone can be predicted first based on historical anti-tamper status information, and then the prediction result can be corrected based on the current anti-tamper observation information. As a result, the system will neither completely ignore the previous status changes of the target device, nor make judgments solely based on historical status. Instead, it can gradually update the anti-tamper anomaly probability as anti-tamper observation information is continuously obtained, which helps to reduce false alarms caused by a single short-term trigger and promptly improve the anti-tamper anomaly probability when anti-tamper triggers occur continuously.

[0130] For example, assume the probability of a historical normal state is:

[0131] The probability of historical anti-tampering abnormal states is:

[0132] The preset state transition probabilities are as follows:

[0133]

[0134] The predicted probability of the normal state at the current time point is:

[0135] The predicted probability of an abnormal tampering status at the current time point is:

[0136] Assuming the current anti-tamper observation information is "the anti-tamper mechanism is in a triggered state, and multiple anti-tamper triggers have occurred within the last 10 seconds," the first and second observation probabilities are determined based on the preset observation probability model as follows:

[0137]

[0138] The first corrected probability is:

[0139] The second corrected probability is:

[0140] After normalization, the probability of tampering failure is:

[0141] Therefore, although the predicted probability of an abnormal anti-dismantling state based on historical states and state transition probabilities is only 0.115, the final determined probability of an abnormal anti-dismantling state is increased to approximately 0.7005 because the matching degree between the current anti-dismantling observation information and the abnormal anti-dismantling state is significantly higher than that with the normal state. If similar abnormal anti-dismantling observation information continues to be obtained, this probability of an abnormal anti-dismantling state can be further increased in the continuous recursive process, and when it reaches the preset probability threshold, it will enter the subsequent decision state construction and target processing action determination process.

[0142] In one embodiment of the present invention, the anti-tampering observation information includes the current anti-tampering status and the number of anti-tampering triggers within a preset statistical period. The current anti-tampering status is used to characterize whether the anti-tampering mechanism of the target device is triggered at the current time point, and the number of anti-tampering triggers is the number of times the anti-tampering mechanism switches from a non-triggered state to a triggered state within the preset statistical period.

[0143] Specifically, the current tamper status indicates whether the tamper mechanism of the target device has been triggered at the current time. The current tamper status can be represented numerically; for example, 0 represents the tamper mechanism not being triggered, and 1 represents the tamper mechanism being triggered.

[0144] in, Indicates the current time point The corresponding current tamper protection status.

[0145] The number of times the tamper protection mechanism is triggered refers to the number of times it switches from a non-triggered state to a triggered state within a preset statistical period. The preset statistical period can be 10 seconds, 30 seconds, or 1 minute prior to the current time, and can also be set according to the target device type and the security level of the target zone.

[0146] It should be noted that the anti-tamper trigger count is based on the number of times the anti-tamper mechanism switches from a non-triggered state to a triggered state, not the number of times it is repeatedly sampled while the anti-tamper mechanism is continuously in a triggered state. For example, the anti-tamper states obtained sequentially within a preset statistical period are: 0, 1, 1, 1, 0, 10, 1, 1, 1, 0, 10, 1, 1, 1, 0, 1 The above state sequence shows two state changes from 0 to 1, therefore, the number of times the anti-tampering is triggered is 2.

[0147] In some implementations, a sliding time window can be used to count the number of tamper triggers. Whenever a new tamper status is obtained, historical trigger records outside the preset statistical period are removed, and the number of tamper triggers within the current sliding time window is counted, so that the number of tamper triggers can reflect the recent triggering frequency of the target device.

[0148] Determine the first and second observation probabilities corresponding to the anti-tamper observation information, including: Step B1: Construct the current observation vector based on the current tamper status and the number of tamper triggers.

[0149] Specifically, the gateway constructs the current observation vector based on the current tamper status and the number of tamper triggers. Following a preset vector element order, the current tamper status can be used as the first vector element, and the number of tamper triggers as the second vector element, thus obtaining:

[0150] in, This represents the observation vector corresponding to the current time point, i.e., the current observation vector; Indicates the current tamper protection status; This indicates the number of times the anti-tampering mechanism was triggered within the preset statistical period.

[0151] The order of vector elements in the current observation vector is consistent with the order of variables used in the first mean vector, the second mean vector, the first covariance matrix, and the second covariance matrix. That is, when the first vector element of the current observation vector is the current anti-tamper status and the second vector element is the number of anti-tamper triggers, the corresponding positions in each mean vector and covariance matrix also correspond to the current anti-tamper status and the number of anti-tamper triggers, respectively.

[0152] In some implementations, to avoid the numerical range of the tamper protection trigger count being significantly larger than the numerical range of the current tamper protection state, the tamper protection trigger count can be normalized or truncated. For example, the tamper protection trigger counts greater than or equal to a preset number can be uniformly set to a preset maximum number, or the tamper protection trigger count can be divided by the preset maximum number to obtain the normalized tamper protection trigger count. In this case, the current observation vector can be constructed based on the current tamper protection state and the normalized tamper protection trigger count.

[0153] Step B2: Determine the first observation probability based on the current observation vector and the first mean vector and first covariance matrix of the first multivariate Gaussian distribution model. The first mean vector and first covariance matrix are used to characterize the statistical distribution of the observation vector when the target defense zone is in a normal state, which is composed of the anti-tamper status and the number of anti-tamper triggers.

[0154] Specifically, the first multivariate Gaussian distribution model is used to describe the statistical distribution of the observation vector consisting of the anti-tamper status and the number of anti-tamper triggers when the target defense zone is in a normal state. The model parameters of the first multivariate Gaussian distribution model include the first mean vector and the first covariance matrix.

[0155] First mean vector It can be represented as:

[0156] in, This represents the statistical mean of the anti-tamper status when the target defense zone is in a normal state; This represents the statistical mean of the number of times the anti-tampering mechanism is triggered when the target zone is in a normal state.

[0157] The first mean vector is used to represent the observation vector that is typically obtained under normal conditions. For example, under normal conditions, the tamper mechanism is usually not triggered, and the number of tamper triggers within the preset statistical period is relatively small. Therefore, the first mean vector is usually closer to the observation characteristics of a current tamper status of 0 and a low number of tamper triggers.

[0158] First covariance matrix It can be represented as:

[0159] in, This indicates the degree of fluctuation in the tamper resistance status under normal conditions; This indicates the degree of fluctuation in the number of times the anti-tamper triggers under normal conditions; This indicates the correlation between the tamper protection status under normal conditions and the number of times the tamper protection is triggered.

[0160] When the tamper protection status and the number of tamper protection triggers are considered to be independent of each other or that the correlation between the two can be ignored, the first covariance matrix can be a diagonal matrix, that is, the off-diagonal elements are set to 0.

[0161] The gateway determines the first observation probability based on the current observation vector and the first mean vector and first covariance matrix of the first multivariate Gaussian distribution model. The first observation probability can be calculated using the multivariate Gaussian probability density function:

[0162] in, Indicates the probability of the first observation; The dimension of the observation vector is represented in this embodiment. ; Let represent the determinant of the first covariance matrix; The superscript represents the inverse of the first covariance matrix. This indicates the matrix transpose.

[0163] In the formula:

[0164] This is used to measure the statistical distance between the current observation vector and the typical observation vector under normal conditions. The closer the current observation vector is to the first mean vector, and the more its deviation is within the normal fluctuation range represented by the first covariance matrix, the greater the probability of the first observation; conversely, the less the current observation vector is to the first mean vector, the smaller the probability of the first observation.

[0165] Step B3: Determine the second observation probability based on the current observation vector and the second mean vector and second covariance matrix of the second multivariate Gaussian distribution model. The second mean vector and second covariance matrix are used to characterize the statistical distribution of the observation vector consisting of the anti-disassembly state and the number of anti-disassembly triggers when the target defense zone is in an anti-disassembly abnormal state.

[0166] Specifically, the second multivariate Gaussian distribution model is used to describe the statistical distribution of the observation vector, which consists of the anti-tampering state and the number of anti-tampering triggers, when the target defense zone is in an abnormal anti-tampering state. The model parameters of the second multivariate Gaussian distribution model include the second mean vector and the second covariance matrix.

[0167] Second mean vector It can be represented as:

[0168] in, This represents the statistical mean of the anti-tamper status when the target defense zone is in an abnormal anti-tamper state; This represents the statistical mean of the number of times the anti-tampering mechanism is triggered when the target zone is in an abnormal anti-tampering state.

[0169] Second covariance matrix It can be represented as:

[0170] in, This indicates the degree of fluctuation in the anti-tampering status relative to its mean when the target defense zone is in an abnormal anti-tampering state; This indicates the degree of fluctuation in the number of anti-tamper triggers relative to the mean when the target zone is in an abnormal anti-tamper state; This represents the covariance between the anti-tamper status and the number of anti-tamper triggers when the target zone is in an abnormal anti-tamper state.

[0171] The second mean vector and the second covariance matrix together characterize the typical values ​​and allowable fluctuation range of the observation vector when the target zone is in an abnormal anti-tampering state. For example, in an abnormal anti-tampering state, the anti-tampering mechanism is usually in a triggered state, and anti-tampering triggering may occur repeatedly in a short period of time. Therefore, the second mean vector is usually closer to the observation characteristics of the current anti-tampering state 1 and the high number of anti-tampering triggers.

[0172] The gateway determines the second observation probability based on the current observation vector and the second mean vector and second covariance matrix of the second multivariate Gaussian distribution model:

[0173] in, This represents the probability of the second observation.

[0174] The closer the current observation vector is to the second mean vector and the more it falls within the anti-tampering anomaly fluctuation range represented by the second covariance matrix, the higher the second observation probability. The dynamic Bayesian network can then use the first observation probability to correct the normal state prediction probability and the second observation probability to correct the anti-tampering anomaly state prediction probability.

[0175] It should be noted that, in this embodiment, the first observation probability and the second observation probability can be represented by the probability density values ​​of the corresponding multivariate Gaussian distribution model at the current observation vector, and used as the observation likelihood values ​​in the dynamic Bayesian network. Through subsequent normalization processing, the state probabilities of the target defense zone being in a normal state and an abnormal anti-tampering state can be obtained.

[0176] The first mean vector, the first covariance matrix, the second mean vector, and the second covariance matrix can be determined based on pre-collected and labeled anti-tamper observation samples. For example, anti-tamper observation information of the target equipment under normal use, temperature change, slight vibration, loose installation, and actual disassembly conditions can be collected, and the samples can be divided into normal state samples and anti-tamper abnormal state samples; the first mean vector and the first covariance matrix can be calculated based on the normal state samples, and the second mean vector and the second covariance matrix can be calculated based on the anti-tamper abnormal state samples.

[0177] In some implementations, corresponding multivariate Gaussian distribution models can be set for different types of target devices. For example, door and window sensors, smart door locks, and smoke sensors have different installation methods, mechanical structures, and normal fluctuation characteristics, so corresponding first mean vectors, first covariance matrices, second mean vectors, and second covariance matrices can be configured respectively, thereby improving the matching degree between the observation probability model and the actual operating characteristics of the target device. The document also uses tamper-proof status and recent trigger counts to construct two-dimensional observations, and describes the observation distribution through the mean and variance corresponding to the status.

[0178] In this way, a clear correspondence can be established between the current observation vector and the statistical distributions of the two states: the first multivariate Gaussian distribution model is used to determine the degree of matching between the current anti-tamper observation information and the normal state, and the second multivariate Gaussian distribution model is used to determine the degree of matching between the current anti-tamper observation information and the anti-tamper abnormal state. This avoids making a single judgment based solely on whether the current anti-tamper state is 1, and improves the distinction between normal interference and genuine anti-tamper anomalies by utilizing the recent number of anti-tamper triggers.

[0179] For example, the tamper mechanism of the target device is currently triggered, so the current tamper state is 1; the tamper mechanism has switched from an untriggered state to a triggered state 3 times in the last 10 seconds, so the number of tamper triggers is 3. The current observation vector is constructed as follows:

[0180] Assume the first mean vector under normal conditions is approximately:

[0181] The second mean vector under abnormal anti-tampering conditions is close to:

[0182] The statistical distance between the current observation vector and the second mean vector is significantly smaller than the statistical distance between the current observation vector and the first mean vector. Given similar fluctuation ranges represented by the corresponding covariance matrices, the second observation probability will be significantly higher than the first observation probability, thus enabling the dynamic Bayesian network to increase the probability that the target defense zone is in an anti-tampering anomaly state during subsequent inference.

[0183] In one embodiment of the present invention, the anti-tampering observation information includes the current anti-tampering status and the number of anti-tampering triggers within a preset statistical period. The current anti-tampering status is used to characterize whether the anti-tampering mechanism of the target device is triggered at the current time point, and the number of anti-tampering triggers is the number of times the anti-tampering mechanism switches from a non-triggered state to a triggered state within the preset statistical period. The decision-making state is constructed based on the operational status of the target defense zone and anti-dismantling observation information, including: Step C1: Determine the zone status code corresponding to the zone operation status of the target zone.

[0184] Specifically, the gateway can pre-establish a correspondence between the operational status of a zone and its status code, and determine the zone status code corresponding to the operational status of the target zone. The zone status code is used to convert the current alert control activation status of the target zone and the range of devices to which the alert control applies into discrete information.

[0185] For example, you can set: Code 0 indicates that no alarm control has been implemented for ordinary security equipment; Code 1 indicates that alert control is applied only to devices within a preset range; Code 2 indicates that all applicable equipment within the target defense zone is subject to surveillance and control.

[0186] The devices within the preset range can include peripheral devices such as door and window sensors and smart door locks, but do not include human infrared sensors that may be frequently triggered by users when they are indoors.

[0187] Step C2: Determine the trigger level based on the preset number of times the anti-tamper triggers fall within the preset number of times within the preset statistical period.

[0188] Specifically, the gateway determines the trigger level based on the preset interval of the number of tamper triggers within a preset statistical period. To limit the number of states in the Markov decision process, the continuously changing number of tamper triggers can be discretized.

[0189] For example, you can set:

[0190] in, Indicates the trigger count level.

[0191] Step C3: Determine the alarm interval level based on the time interval between the current time point and the previous alarm time point, where the previous alarm time point is the time point when the tamper alarm was last processed.

[0192] Specifically, the alarm interval level is determined based on the time interval between the current time point and the last alarm time point of the target zone.

[0193] For example, you can set:

[0194] in, This indicates the time interval between the current time point and the previous time point when the tamper alarm was triggered; Indicates the alarm interval level.

[0195] If the target zone has not been previously processed for tamper alarms, the alarm interval level can be set to the highest level, or a dedicated initial level can be set.

[0196] Step C4: Combine the zone status code, current tamper protection status, trigger count level, and alarm interval level to obtain the decision status.

[0197] Specifically, the gateway combines the zone status code, current tamper protection status, trigger count level, and alarm interval level in a preset order to obtain the decision status:

[0198] For example, if the zone status code has 3 possible values, the current tamper protection status has 2 possible values, the trigger count level has 4 possible values, and the alarm interval level has 4 possible values, then we can obtain:

[0199] A preset decision state.

[0200] In this way, by classifying and combining continuous information, the tamper alarm conditions in complex home environments are transformed into a finite number of discrete decision states, which helps to reduce the computational load of the Markov decision process and allows different processing strategies to correspond to different zone operating states and different alarm histories.

[0201] For example, the target zone implements alert control on all applicable devices, corresponding to zone status code 2; the current tamper protection status is 1; tamper protection has been triggered 4 times in the last 10 seconds, corresponding to trigger count level 3; the last alarm was triggered 5 seconds ago, corresponding to alarm interval level 0. The decision status is thus obtained:

[0202] This decision state can be identified as a high-risk state that requires priority handling.

[0203] In one embodiment of the present invention, the Markov decision process includes using a reward function to determine the reward value corresponding to performing each candidate processing action in the decision state based on at least one of false alarm cost, false alarm cost, and alarm delay cost.

[0204] Specifically, a set of candidate processing actions can be pre-established:

[0205] in, This indicates that alert control measures should be activated immediately. This indicates a delay in activating alert control. This indicates that an alarm has been triggered; This indicates that the current event will be ignored and observation will continue. This indicates that the message will only be reported to the management platform and will not trigger local alarms.

[0206] The gateway can use a reward function to determine the preset decision state. Next, execute the candidate processing action. Corresponding reward value The reward function can be expressed as:

[0207] in, This indicates a positive reward for properly handling tampering incidents; Indicates the cost of false alarms; Indicate whether a false alarm was caused by the execution of a candidate processing action; This indicates the cost of underreporting; Indicate whether the false negative was caused by the execution of candidate processing actions; This indicates the cost corresponding to the unit alarm delay; This indicates the alarm delay caused by the execution of candidate processing actions; This indicates the resource consumption or user interference cost associated with executing the candidate processing action itself.

[0208] Missed alarms can cause property damage or safety risks, so the cost of a missed alarm can usually be set higher than the cost of a normal false alarm. For high-safety-level devices such as smoke sensors and gas sensors, the cost of missed alarms and delays can be further increased to make the system more inclined to issue alarms faster.

[0209] Based on Markov decision processes, the target processing actions are determined according to the decision state, including: Step D1: Obtain multiple preset decision states.

[0210] Specifically, the gateway acquires multiple preset decision states. These preset decision states can be obtained from various possible combinations of zone status codes, current tamper protection status, trigger count levels, and alarm interval levels. The currently constructed decision state corresponds to one of these preset decision states.

[0211] The gateway can set an initial state value for each preset decision state. For example:

[0212] Step D2: For each preset decision state, based on the reward value of executing each candidate processing action in the preset decision state and the probability of state change after executing each candidate processing action, iteratively update the state value of the preset decision state until the preset convergence condition is met.

[0213] Specifically, for each preset decision state, the gateway iteratively updates according to the Bellman optimal equation:

[0214] in, Indicates the state of preset decision-making. Next, execute the candidate processing action. The next preset decision state may then be transitioned to; Indicates the cycle of value iteration; Represents a set of candidate processing actions; Indicates the execution of candidate processing actions. The next pre-defined decision state that can be reached after all other possible states. Perform summation; Indicates the execution of candidate processing actions. Then, the expected subsequent value is obtained by weighting and summing the state values ​​of each possible next preset decision state according to the corresponding state change probability; Indicates the first In the round of iteration, the next preset decision state The corresponding state value; Indicates after the first After rounds of iterative updates, the current preset decision state The corresponding state value; Indicates the state of preset decision-making. Next, execute the candidate processing action. The reward value obtained; Indicates the state of preset decision-making. Next, execute the candidate processing action. Then proceed to the next preset decision state. The probability of state change; This represents a discount factor used to adjust the influence of immediate rewards and subsequent value on the evaluation of the current action, and typically satisfies the following:

[0215] when When the value is small, action selection focuses more on the immediate reward; when... When the impact is large, action selection will take into account the potential long-term effects of performing the action.

[0216] The probability of state change can be obtained through statistics of historical anti-tampering event data, or it can be preset according to the device type and processing action.

[0217] The above formula (41) can be understood as follows: For each preset decision state, evaluate the immediate reward and expected subsequent value that can be obtained by performing different candidate processing actions in the state, and take the maximum comprehensive value as the state value of the preset decision state in the next iteration.

[0218] The gateway continuously iterates and updates its state value until a preset convergence condition is met. The preset convergence condition can be:

[0219] in, This indicates a preset convergence threshold, such as 0.01; This represents the change in state value of the same pre-defined decision state in two adjacent iterations. This means calculating the change in state value of all preset decision states in two adjacent iterations and selecting the largest change.

[0220] Step D3: Determine the optimal processing action corresponding to the preset decision state based on the updated state value.

[0221] Specifically, after satisfying the preset convergence conditions, the gateway determines the optimal processing action corresponding to each preset decision state based on the iteratively updated state value:

[0222] in, Indicates the preset decision state The corresponding optimal processing action.

[0223] In actual operation, the gateway can pre-compile value iterations and save the correspondence between "preset decision states and optimal processing actions". Upon obtaining the current decision state, it can directly query the optimal processing action for the corresponding preset decision state, thereby reducing online computation time. The gateway can also periodically update the reward function parameters and state change probabilities based on newly added anti-tampering event samples, achieving adaptation to the characteristics of the home environment.

[0224] Step D4: Determine the optimal processing action of the preset decision state corresponding to the decision state as the target processing action.

[0225] Specifically, the preset decision state set can be represented as:

[0226] in, Represents the set of preset decision states; Indicates the first A preset decision state; The sequence number representing the preset decision state; This indicates the total number of preset decision states.

[0227] Each preset decision state adopts the same construction method as the current decision state. For example, when the decision state consists of the zone status code, the current tamper status, the trigger count level, and the alarm interval level, the first... A preset decision state can be represented as:

[0228] in, Indicates the first Zone status coding in a preset decision state; Indicates the first The current anti-tampering status in a preset decision state; Indicates the first Trigger count levels in a preset decision state; Indicates the first Alarm interval levels in a preset decision state.

[0229] The current decision-making state, constructed based on the actual operational information of the target defense zone, can be represented as:

[0230] in, Indicates the current time point The corresponding decision state; This indicates the current status code of the target zone; Indicates the current tamper protection status of the target device; Indicates the currently determined trigger count level; This indicates the currently determined alarm interval level.

[0231] Specifically, each state component in the current decision state can be compared with the corresponding state components in each preset decision state. When the zone status code, current tamper status, trigger count level, and alarm interval level in a preset decision state are the same as the corresponding state components in the current decision state, the preset decision state is determined as the preset decision state corresponding to the current decision state.

[0232] This matching relationship can be represented as:

[0233] Right now:

[0234] in, Indicates the sequence number of the preset decision state corresponding to the current decision state; This indicates the preset decision state corresponding to the current decision state.

[0235] Since each state component is discretized according to a preset value or preset level, and the preset decision state set can include all valid combinations of each state component in advance, each current decision state can uniquely correspond to a preset decision state.

[0236] Specifically, after determining the optimal processing action for each preset decision state using the aforementioned value iteration process, the first... Each preset decision state and its optimal processing action are stored as follows:

[0237] in, Indicates the first The optimal processing action corresponding to a preset decision state.

[0238] Determine the preset decision state corresponding to the current decision state. Then, the optimal processing action corresponding to the preset decision state is read from the state-action mapping table, and the read optimal processing action is determined as the target processing action, that is:

[0239] in, Indicates the target processing action; This indicates the optimal action corresponding to the preset decision state that corresponds to the current decision state.

[0240] In other words, the state value iteration process can pre-determine the optimal processing action for each preset decision state. In the actual anti-tamper alarm process, it is only necessary to match the currently constructed decision state with the preset decision state to find the corresponding target processing action from the state action mapping table, without having to re-execute the complete state value iteration after each anti-tamper observation information is received.

[0241] In this way, by quantifying the different impacts of false alarms, missed alarms, and alarm delays through the reward function, and by using value iteration to consider the long-term impact of the current action on subsequent states, we can avoid selecting the action based solely on the current observation, thereby achieving a more reasonable balance between alarm accuracy and alarm timeliness.

[0242] For example, multiple preset decision states are established in advance based on different combinations of values ​​for zone status code, current tamper protection status, trigger count level, and alarm interval level, and candidate processing actions such as triggering an alarm, delaying processing, ignoring the current event, and only reporting to the management platform are set. For each preset decision state, a reward value is determined based on the false alarm cost, missed alarm cost, and alarm delay cost corresponding to executing each candidate processing action under that preset decision state, and the state value of the preset decision state is iteratively updated by combining the state change probability after executing each candidate processing action.

[0243] When the change in state value of each preset decision state in two consecutive iterations is less than the preset convergence threshold, the iteration stops, and the optimal processing action corresponding to each preset decision state is determined based on the updated state value. For example, for the preset decision state (2, 1, 3, 0), it is calculated that the comprehensive value corresponding to "trigger alarm" is higher than other candidate processing actions, so "trigger alarm" is determined as the optimal processing action corresponding to this preset decision state.

[0244] In the actual anti-tamper alarm process, if the decision state constructed based on the current operation status of the target zone and the anti-tamper observation information is also (2, 1, 3, 0), then it is determined that the decision state corresponds to the above preset decision state, and the optimal processing action corresponding to the preset decision state, "trigger alarm", is determined as the target processing action.

[0245] In one embodiment of the present invention, after performing the target processing action, the method further includes: Step E1: Based on the operational status of the target zone and the equipment attributes of the target equipment, determine the equipment arming enable flag corresponding to the target equipment. The equipment arming enable flag is used to indicate whether the target equipment has entered the alert state.

[0246] In this embodiment, the alert state refers to the device's operating state when the target device responds to the alert control implemented by the gateway, where it monitors preset abnormal events and handles them according to preset methods. When the target device is in the alert state, it can enable monitoring and response functions related to tamper alarms, continuously or periodically detect the triggering of the tamper mechanism, and generate tamper observation information when the tamper mechanism is detected to be triggered. This tamper observation information is then reported to the gateway for the gateway to perform tamper anomaly probability calculation and tamper alarm decision-making.

[0247] Alert status is a device-level state determined for a single target device, while the aforementioned alert control is a control process implemented by the gateway for the target zone and the devices it manages. Specifically, the gateway determines whether alert control should be enabled and the scope of devices to which the alert control applies based on the zone's operational status. Then, considering the device attributes of each device, it determines whether each device needs to enter alert status. Therefore, different devices within the same target zone can have different alert statuses.

[0248] Specifically, the equipment arming enable flag Binary information can be used to represent it:

[0249] The device arming enable flag is calculated by the gateway. The target device does not need to parse the complex zone operation status, device attributes and linkage conditions locally. It only needs to enable or disable the corresponding alarm detection function according to the received device arming enable flag.

[0250] Specifically, the device attributes of the target device may include one or more of the following: The continuous alert attribute indicates whether the target device needs to remain on alert regardless of its operating state in different defense zones. The partial alert status enable attribute is used to indicate whether the target device needs to enter the alert status when only some devices in the target defense zone are subject to alert control. The alarm linkage attribute indicates whether a local alarm should be activated when the target device triggers an alarm. The activation of full alert will be delayed. The activation of some alerts will be delayed; Current anti-tamper status; The sub-zone to which the equipment belongs; Alert priority for target equipment.

[0251] For example, the continuous alert attribute of smoke sensors, gas sensors, or emergency assistance devices can be set to enabled, so that they remain operational even when the target area does not implement alert control on ordinary security devices; some alert status enable attributes of indoor human infrared sensors can be set to disabled to prevent alarms from being triggered when users are engaged in normal indoor activities; some alert status enable attributes of door and window sensors can be set to enabled so that external doors and windows are still protected when users are indoors.

[0252] In one implementation, the device arming enable flag can be set to 1 when any of the following conditions are met: The target device's continuous alert attribute is active. The anti-tamper mechanism of the target device has been triggered, and the target zone is currently under surveillance control of some devices; The target defense zone is currently under surveillance and control of all applicable equipment; The target device's partial alert status enable attribute is active, and the target zone is currently implementing alert control on some devices.

[0253] Otherwise, set the device arming enable flag to 0.

[0254] Step E2: Send the device arming enable flag to the target device.

[0255] Specifically, after determining the device's arming enable flag, the gateway sends it to the target device. Upon receiving the device's arming enable flag, the target device can update its local alert status. For example, when the device's arming enable flag is 1, tamper detection, intrusion detection, or local alarm functions are enabled; when the device's arming enable flag is 0, the normal intrusion detection function can be disabled, but device heartbeat, fault detection, and necessary security detection functions can still be retained.

[0256] Thus, by combining complex zone operating states and device attributes into a binary flag that devices can directly recognize, the local control logic of target devices can be simplified, and different devices can be ensured to enter the appropriate alert state according to their respective security attributes. The document also uses this device-level flag to uniformly encode complex state combinations, allowing devices to determine whether to enter an alert state simply by reading the flag.

[0257] For example, the target device is a smoke sensor, and its continuous alert attribute is enabled. Even if the target zone is not currently implementing alert control for ordinary doors, windows, and infrared motion detectors, the gateway will still set the arming enable flag of the smoke sensor to 1, thereby ensuring that the smoke alarm function remains effective. As another example, if the target device is an indoor infrared motion detector, and some of its alert status enable attributes are disabled, when the target zone only implements alert control for peripheral devices, the gateway will set its arming enable flag to 0 to avoid false alarms caused by users moving indoors.

[0258] In one embodiment of the present invention, sending a device arming enable flag to a target device includes: Step F1: Upon receiving heartbeat information from the target device, add the device arming enable flag to the response information for the heartbeat information, and send the response information to the target device.

[0259] Specifically, upon receiving heartbeat information from the target device, the gateway can query the current arming enable flag of the target device and add this flag to the response information generated in response to the heartbeat information. The response information may also include device time synchronization information, device configuration version, alarm activation delay, alarm linkage attributes, and other control information that needs to be synchronized to the target device.

[0260] Upon receiving the response information, the target device reads the device arming enable flag from the response information and updates its local alert status to the status corresponding to that flag. Using a heartbeat response method eliminates the need to establish additional communication connections for normal state synchronization, thus reducing communication resource consumption.

[0261] Step F2: Alternatively, if the operational status of the target zone changes or the equipment attributes of the target device change, actively send an arming enable flag to the target device.

[0262] Specifically, when the operational status of the target zone changes, the gateway can proactively send an arming enable flag to the target device instead of waiting for the target device to send the next heartbeat information.

[0263] For example, when a user switches the target zone from not enabling normal alert control to enabling alert control for all applicable devices via a mobile terminal, the gateway immediately recalculates the device arming enable flags corresponding to each device in the target zone and sends the updated flags to the target devices that need to change their alert status.

[0264] When the device attributes of a target device change, the gateway can also proactively send the device arming enable flag. For example, if a user changes some of the target device's alert status enable attributes from invalid to enabled, the gateway immediately recalculates the target device's arming enable flag and proactively pushes it.

[0265] To improve the reliability of proactive push notifications, the gateway can request confirmation from the target device. If no confirmation is received within a preset confirmation period, retrying is performed using an exponential backoff strategy. For example, the first retry interval is 1 second, the second retry interval is 2 seconds, the third retry interval is 4 seconds, and a maximum of 3 retries are allowed. If the synchronization failure still occurs after multiple retries, the synchronization failure status can be recorded, and synchronization can be re-established via a heartbeat response the next time the target device sends a heartbeat message.

[0266] For changes in the operational status of a defense zone, proactive push notifications with confirmation and exponential backoff retries can be used. For changes in device attributes, forced synchronization can be used, which involves maintaining a pending synchronization state until confirmation is received from the target device, and continuously carrying the latest device arming enable flag in subsequent heartbeat responses. The document also sets out the distribution methods for heartbeat responses, proactive push notifications for status changes, and forced synchronization for attribute changes.

[0267] In this way, by combining periodic heartbeat synchronization with proactive push notifications of status changes, we can reduce the extra communication overhead under normal circumstances and update the alert status of target devices in a timely manner when the zone's operating status or device attributes change, thereby avoiding control delays caused by having to wait for a long heartbeat cycle.

[0268] For example, the normal heartbeat cycle of the target device is 30 seconds. When a user has just left the residence and enabled full alert control of the target zone, if relying solely on heartbeat responses, the target device may need to wait up to 30 seconds to receive a new device arming enable flag. In this embodiment, the gateway actively pushes the device arming enable flag immediately after the zone's operating status changes, enabling the target device to enter an alert state in a short time. If this active push fails due to network fluctuations, the gateway retryes according to an exponential backoff strategy and continues to carry the flag in subsequent heartbeat responses, thus balancing real-time performance and synchronization reliability.

[0269] Please see Figure 3 This is a schematic diagram of the anti-tamper alarm device provided in an embodiment of the present invention. A second aspect of the present invention provides an anti-tamper alarm device 10, which includes: The acquisition module 11 is used to acquire the anti-tamper observation information reported by the target device within the target defense zone, wherein the anti-tamper observation information is used to characterize the triggering status of the anti-tamper mechanism of the target device. The first determining module 12 is used to determine the probability of an abnormal anti-tampering state of the target defense zone at present, based on the anti-tampering observation information and the historical anti-tampering state information of the target defense zone, according to the dynamic Bayesian network. The historical anti-tampering state information is used to characterize the anti-tampering state of the target defense zone before the current time point. Module 13 is used to construct a decision state based on the operational status of the target zone and anti-tamper observation information when the probability of anti-tampering anomalies reaches a preset probability threshold. The operational status of the zone is used to characterize the current activation status of the target zone's monitoring and control of the equipment it manages, as well as the range of equipment to which the monitoring and control are applicable. The second determination module 14 is used to determine the target processing action based on the decision state according to the Markov decision process. The execution module 15 is used to perform target processing actions to perform anti-tamper alarm processing on the target defense zone.

[0270] The tamper alarm device 10 provided in the second aspect of the present invention can realize the various processes implemented in the above method embodiments and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0271] Please see Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. A third aspect of the present invention provides an electronic device 400, including a processor 410 and a memory 420. The memory 420 stores machine-executable instructions that can be executed by the processor 410. The processor 410 can execute the machine-executable instructions to implement the above-mentioned anti-tamper alarm method.

[0272] A fourth aspect of the present invention provides a machine-readable storage medium storing instructions that, when executed by a processor, cause the processor to implement the aforementioned tamper alarm method.

[0273] In one embodiment of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the tamper alarm method according to the above embodiments.

[0274] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0275] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0276] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0277] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0278] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0279] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0280] The above are merely embodiments of the present invention and are not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

[0281] Furthermore, various different embodiments of the present invention can be combined in any way, as long as they do not violate the spirit of the present invention, they should also be regarded as the content disclosed by the present invention.

Claims

1. A tamper-proof alarm method, characterized in that, The method includes: Acquire anti-tamper observation information reported by target devices within the target defense zone, wherein the anti-tamper observation information is used to characterize the triggering status of the anti-tamper mechanism of the target device; Based on a dynamic Bayesian network, the probability of the target defense zone being in an abnormal anti-tampering state is determined according to the anti-tampering observation information and the historical anti-tampering status information of the target defense zone. The historical anti-tampering status information is used to characterize the anti-tampering status of the target defense zone before the current time point. When the probability of tampering anomaly reaches a preset probability threshold, a decision state is constructed based on the operational status of the target zone and the tampering observation information. The operational status of the zone is used to characterize the current activation status of the target zone's monitoring and control of the equipment it manages, as well as the range of equipment to which the monitoring and control are applicable. Based on the Markov decision process, the target processing action is determined according to the decision state; The target processing action is executed to perform tamper alarm processing on the target defense zone.

2. The method according to claim 1, characterized in that, The historical anti-tamper status information includes the historical normal state probability and the historical anti-tamper abnormal state probability. The historical normal state probability and the historical anti-tamper abnormal state probability are the probabilities that the target defense zone is in a normal state and the probabilities that it is in an anti-tamper abnormal state, respectively, determined before the current time point. The method based on a dynamic Bayesian network, using the anti-tamper observation information and the historical anti-tamper status information of the target defense zone, determines the probability of the target defense zone currently being in an abnormal anti-tamper state, including: Based on the historical normal state probability, the historical anti-tampering abnormal state probability, and the preset state transition probability, determine the predicted probability of the normal state and the predicted probability of the anti-tampering abnormal state at the current time point. Determine a first observation probability and a second observation probability corresponding to the anti-tamper observation information, wherein the first observation probability is the probability of the anti-tamper observation information occurring under the condition that the target defense zone is in a normal state, and the second observation probability is the probability of the anti-tamper observation information occurring under the condition that the target defense zone is in an abnormal anti-tamper state; The normal state prediction probability at the current time point is corrected based on the first observation probability to obtain the first corrected probability, and the anti-tampering abnormal state prediction probability at the current time point is corrected based on the second observation probability to obtain the second corrected probability. The first and second corrected probabilities are normalized, and the normalized second corrected probability is taken as the anti-tampering anomaly probability.

3. The method according to claim 2, characterized in that, The anti-tampering observation information includes the current anti-tampering status and the number of anti-tampering triggers within a preset statistical period. The current anti-tampering status is used to characterize whether the anti-tampering mechanism of the target device is triggered at the current time point. The number of anti-tampering triggers is the number of times the anti-tampering mechanism switches from a non-triggered state to a triggered state within the preset statistical period. Determining the first observation probability and the second observation probability corresponding to the anti-tamper observation information includes: Construct the current observation vector based on the current anti-tamper status and the number of anti-tamper triggers; Based on the current observation vector and the first mean vector and first covariance matrix of the first multivariate Gaussian distribution model, the first observation probability is determined, wherein the first mean vector and the first covariance matrix are used to characterize the statistical distribution of the observation vector composed of the anti-tamper status and the number of anti-tamper triggers when the target defense zone is in a normal state. The second observation probability is determined based on the current observation vector and the second mean vector and second covariance matrix of the second multivariate Gaussian distribution model. The second mean vector and the second covariance matrix are used to characterize the statistical distribution of the observation vector consisting of the anti-tampering state and the number of anti-tampering triggers when the target defense zone is in an anti-tampering abnormal state.

4. The method according to claim 1, characterized in that, The anti-tampering observation information includes the current anti-tampering status and the number of anti-tampering triggers within a preset statistical period. The current anti-tampering status is used to characterize whether the anti-tampering mechanism of the target device is triggered at the current time point. The number of anti-tampering triggers is the number of times the anti-tampering mechanism switches from a non-triggered state to a triggered state within the preset statistical period. The step of constructing a decision state based on the operational status of the target defense zone and the anti-tamper observation information includes: Determine the zone status code corresponding to the zone operation status of the target zone; The trigger level is determined based on the preset number of times the anti-tamper triggers within the preset statistical period fall within a preset number of times interval; The alarm interval level is determined based on the time interval between the current time point and the previous alarm time point, wherein the previous alarm time point is the time point when the tamper alarm was previously processed. The decision state is obtained by combining the zone status code, the current tamper protection status, the trigger count level, and the alarm interval level.

5. The method according to claim 1, characterized in that, The Markov decision process includes using a reward function to determine the reward value corresponding to each candidate processing action performed in the decision state based on at least one of the false alarm cost, false alarm cost, and alarm delay cost. The Markov decision process-based determination of the target processing action according to the decision state includes: Obtain multiple preset decision states; For each preset decision state, the state value of the preset decision state is iteratively updated based on the reward value of performing each candidate processing action in the preset decision state and the state change probability after performing each candidate processing action, until the preset convergence condition is met. Based on the updated state value, determine the optimal processing action corresponding to the preset decision state; The optimal processing action for the preset decision state corresponding to the decision state is determined as the target processing action.

6. The method according to claim 1, characterized in that, After performing the target processing action, the method further includes: Based on the operational status of the target defense zone and the equipment attributes of the target equipment, a weapon arming enable flag corresponding to the target equipment is determined, wherein the weapon arming enable flag is used to indicate whether the target equipment has entered a state of alert. Send the device arming enable flag to the target device.

7. The method according to claim 6, characterized in that, Sending the device arming enable flag to the target device includes: Upon receiving heartbeat information from the target device, the device arming enable flag is added to the response information for the heartbeat information, and the response information is sent to the target device; or, When the operational status of the target zone changes or the device attributes of the target device change, the device arming enable flag is actively sent to the target device.

8. A tamper alarm device, characterized in that, The device includes: The acquisition module is used to acquire anti-tamper observation information reported by target devices within the target defense zone, wherein the anti-tamper observation information is used to characterize the triggering status of the anti-tamper mechanism of the target device; The first determining module is used to determine the probability of an anti-tampering anomaly in the current anti-tampering anomaly state of the target defense zone based on the anti-tampering observation information and the historical anti-tampering status information of the target defense zone, according to the dynamic Bayesian network. The historical anti-tampering status information is used to characterize the anti-tampering status of the target defense zone before the current time point. The construction module is used to construct a decision state based on the operation status of the target defense zone and the anti-tamper observation information when the probability of the anti-tampering anomaly reaches a preset probability threshold. The operation status of the defense zone is used to characterize the current activation status of the target defense zone to implement warning control on the equipment it manages and the range of equipment to which the warning control applies. The second determining module is used to determine the target processing action based on the decision state, according to the Markov decision process. The execution module is used to perform the target processing action to perform tamper alarm processing on the target defense zone.

9. An electronic device, characterized in that, The device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When a processor executes a program stored in a memory, it implements the steps of the tamper alarm method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the tamper alarm method as described in any one of claims 1-7.

Images