Deepseek-based intelligent monitoring box abnormal behavior recognition method

Abstract

The application discloses an intelligent monitoring box abnormal behavior recognition method based on DeepSeek, and belongs to the technical field of cross of edge intelligent device operation and maintenance of Internet of Things and industry application of large models. The method comprises the following steps: S1, collecting real-time video stream data of a monitoring area through an intelligent monitoring box; S2, pre-processing the real-time video stream data to obtain a to-be-recognized frame sequence; S3, inputting the to-be-recognized frame sequence into a lightweight DeepSeek large model deployed locally in the intelligent monitoring box, extracting visual semantic features and behavior time sequence features, and completing feature fusion; S4, performing abnormal behavior reasoning on the fused features, and outputting the confidence of the abnormal behavior category; and S5, when there is abnormal behavior, generating a local alarm by the intelligent monitoring box and performing data reporting. According to the method, the lightweight DeepSeek large model is deployed locally in the monitoring box, and real-time high-precision abnormal behavior recognition and edge-cloud collaborative continuous optimization are realized.

Description

Technical Field

[0001] This invention relates to the cross-technical fields of IoT edge intelligent device operation and maintenance and large-scale model industry applications, and in particular to a method for identifying abnormal behavior of intelligent monitoring boxes based on DeepSeek. Background Technology

[0002] With the increasing demand for refined management in security scenarios, intelligent monitoring boxes are widely used in public security, road traffic, rail transit, national border and coastal defense, and special industries such as construction sites, undertaking on-site monitoring and abnormal event early warning functions, with applications extending overseas. Existing abnormal behavior recognition solutions for intelligent monitoring boxes mainly fall into two categories: One type of solution is based on traditional computer vision. It extracts people and objects through target detection algorithms and combines trajectory tracking with manually defined rules to determine anomalies. This type of solution relies on manually designed features and fixed rules. It has weak generalization ability to changes in lighting, occluded scenes, and unconventional abnormal behaviors. It cannot understand semantic-level behavioral logic, resulting in high false negative and false positive rates, and it is difficult to meet the recognition needs of complex scenes.

[0003] Another type is the cloud-based large-scale model recognition solution, which uploads surveillance video to the cloud and uses a large model for analysis. This type of solution is highly dependent on a stable network, has high transmission latency, and cannot meet the requirements for real-time alarms; at the same time, the continuous uploading of original video poses a risk of data privacy leakage, and the bandwidth cost is high, making it difficult to deploy on a large scale.

[0004] In recent years, some edge AI monitoring solutions have been gradually implemented, but existing solutions have obvious defects: First, most models are lightweight single-frame detection models, which lack the ability to model the temporal sequence of continuous behavior and are difficult to accurately identify continuous anomalies such as climbing and destruction; Second, large models have not been deeply optimized for monitoring scenarios, resulting in high inference computing power consumption and inability to adapt to the limited edge computing power of intelligent monitoring boxes; Third, there is a lack of closed-loop iteration mechanism and false alarm filtering mechanism, so the performance of the model cannot be continuously optimized after it is launched, the false alarm rate remains high, and the operation and maintenance costs are greatly increased. Summary of the Invention

[0005] The purpose of this invention is to provide a method for identifying abnormal behavior of intelligent monitoring boxes based on DeepSeek, thereby solving the aforementioned technical problems.

[0006] To achieve the above objectives, this invention provides a method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek, comprising the following steps: S1. Obtain real-time video stream data of the monitored area through the video acquisition module integrated in the intelligent monitoring box; S2. Preprocess the real-time video stream data to obtain a sequence of frames to be recognized that are adapted to the input format of the DeepSeek large model; S3. Input the frame sequence to be identified into the lightweight DeepSeek large model deployed locally on the smart monitoring box, extract the visual semantic features and behavioral temporal features corresponding to the frame sequence to be identified, and complete the feature fusion. S4. Use the classification head of the lightweight DeepSeek large model to perform abnormal behavior inference on the fused features and output the confidence score of each preset abnormal behavior category. S5. When the confidence level of any abnormal behavior category is greater than the preset judgment threshold, it is determined that there is a corresponding abnormal behavior, and the intelligent monitoring box generates a local alarm and performs data reporting.

[0007] Preferably, the preprocessing in S2 specifically includes: The real-time video stream is sampled at equal intervals to obtain a set of candidate frames. The candidate frames are then subjected to image denoising, size normalization and pixel value standardization. Keyframes are then selected using the inter-frame difference method. The formula for calculating the inter-frame difference is: ; in, The sequence number of the frame. These are the pixel coordinates in the image. , The first Frame and the The coordinates in the frame image are The grayscale value of the pixel, For the first Frame and the Differential images between frames; Set grayscale difference threshold The difference in grayscale in the difference image is greater than Pixels are identified as moving pixels, and the proportion of moving pixels in the total number of pixels in the frame is calculated. ,when ≥ Percentage threshold When this happens, the frame is included in the keyframes, and consecutive keyframes form a sequence of frames to be identified.

[0008] The preferred lightweight DeepSeek large model is constructed through the following steps: The native DeepSeek large model undergoes structured channel pruning, with the pruning rate controlled at 30%-40%; then, INT8 symmetric weight quantization is performed, with the quantization calculation formula as follows: ; in, These are the original FP32 weight values. This is the quantization scaling factor, and , , These are the minimum and maximum values ​​after quantization, respectively; Then, by using the labeled abnormal behavior dataset of the monitoring scene, supervised fine-tuning is performed using the cross-entropy loss function to obtain a lightweight model adapted to the edge computing power of the smart monitoring box.

[0009] Preferably, in S3, visual semantic features and behavioral temporal features are extracted and feature fusion is performed as follows: Visual semantic features of keyframes in a single frame are extracted using the visual encoding branch of a lightweight DeepSeek model, with an output dimension of [missing information]. Visual feature matrix ,in The length of the frame sequence to be identified. The visual feature dimension of a single frame; Inter-frame behavioral temporal features are extracted through a temporal attention branch. The temporal attention adopts a multi-head self-attention mechanism, which consists of multiple parallel single-head attentions. The calculation formula for a single-head attention is as follows: ; in, , , These are the query matrix, key matrix, and value matrix, respectively. The feature dimension of the query matrix; the output dimension is Temporal feature matrix , For time-series feature dimensions, It is the transpose symbol; The visual feature matrix and the temporal feature matrix are concatenated and fused along the feature dimension to obtain the global behavior representation feature matrix. Then, global average pooling is used to obtain the dimension as follows: The global feature vector.

[0010] Preferably, in S4, the abnormal behavior inference uses a multi-label classification method. For each type of preset abnormal behavior, a corresponding confidence level is calculated. The confidence level calculation formula is as follows: ; in, It is the Sigmoid activation function. , The first The fully connected weight vector and bias terms corresponding to the abnormal behavior. This is the fused global feature vector; The confidence level is defined, and its value ranges from [0,1]. when ≥Preset judgment threshold When, it is determined that the first Abnormal behavior.

[0011] Preferably, the S5 generates local alarms and performs data reporting as follows: Match the corresponding risk level to the abnormal behavior category and trigger the corresponding intensity of on-site audible and visual alarms; store video clips, abnormal frame screenshots and alarm logs of preset duration before and after the abnormal behavior occurs locally; and upload the alarm information and abnormal frame screenshots to the cloud management platform or local area network management platform through the optical communication module or 5G communication module of the intelligent monitoring box.

[0012] Preferably, a cloud management platform or local area network management platform aggregates the difficult-to-identify samples and manually labeled data reported by each intelligent monitoring box to construct an incremental dataset; the LoRA low-rank adaptation method is used to incrementally fine-tune the lightweight DeepSeek large model, with the optimization objective being to maximize the reward function. The reward function calculation formula is as follows: ; in, This is the reward value for a single iteration. To verify the accuracy of the recognition set, For false alarm rate, The false negative rate, , , These are the weighting coefficients of the reward function; The updated model parameters are sent to the intelligent monitoring box to complete the local model iteration.

[0013] Preferably, the frame sampling adopts a dynamic frame rate adjustment strategy: when no moving target is detected in N consecutive candidate frames, the frame sampling interval is increased to n times the basic interval; when a moving target is detected, the basic sampling interval is restored.

[0014] Preferably, the S3 intelligent monitoring box calls the built-in NPU computing unit to perform model inference; when multiple video streams are connected, the inference tasks of each stream are sorted and computing power is allocated through a priority scoring function. The priority scoring formula is as follows: ; in, For the first The inference priority score of the video path. The preset risk level quantification value for the corresponding monitoring area. For the first The average confidence level of abnormal behavior in the video output. This represents the urgency coefficient of the event. , , These are the weight coefficients for the priority scores, and they satisfy... + + =1; NPU computing resources are allocated according to priority scores from high to low, and the score is proportional to the allocated computing power.

[0015] Preferably, after determining that abnormal behavior exists in S5 and before executing data reporting, a false alarm filtering step is also included: the identification result is matched and verified with a preset scenario rule library. If it meets the preset false alarm rules, the alarm is removed; if it does not meet the rules, the alarm is retained and subsequent reporting operations are performed. The preset false alarm rules include target size rules, legal time period rules, and environmental interference rules.

[0016] Therefore, the present invention employs the above-mentioned DeepSeek-based intelligent monitoring box abnormal behavior identification method, which has the following beneficial effects: 1. By using structured pruning and INT8 quantization, the DeepSeek large model is significantly lightweighted, greatly reducing the model size and computing power requirements while keeping the accuracy loss controllable. This allows it to be directly deployed at the edge of the smart monitoring box, enabling local real-time inference without uploading the original video. This ensures data privacy and security, eliminates network dependence, and reduces alarm response latency by more than 80%.

[0017] 2. It adopts a fusion architecture of visual semantic features and temporal attention features, which not only extracts static semantic information such as target category and scene attributes of a single frame, but also captures dynamic temporal information such as action trajectory and state changes between consecutive frames. It fully leverages the semantic understanding advantages of large models, and the accuracy of abnormal behavior recognition in complex scenes can reach more than 95%, which is significantly better than traditional edge solutions.

[0018] 3. By filtering key frames through inter-frame difference method and combining with dynamic frame rate adjustment strategy, invalid frames without moving targets are filtered out to reduce redundant inference; with computing power priority scheduling mechanism, multi-channel video inference resources are reasonably allocated, and the computing power overhead on the end side is reduced by more than 40% while ensuring recognition accuracy, which is suitable for the low power consumption and low computing power hardware conditions of intelligent monitoring box.

[0019] 4. On the one hand, the recognition results are filtered for false alarms through the scene rule base to eliminate false alarm factors such as environmental interference and small moving objects; on the other hand, an edge-cloud collaborative incremental update mechanism is established to continuously iterate the model using difficult on-site samples, which can reduce the overall false alarm rate of the system by more than 60%.

[0020] 5. Supports simultaneous identification of multiple types of abnormal behaviors, and is equipped with a complete chain of hierarchical alarms, local storage, and cloud reporting to adapt to the monitoring needs of different scenarios; the model adopts a modular design, which can be quickly expanded to add new abnormal behavior categories and flexibly adapt to diverse business scenarios.

[0021] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0022] Figure 1 This is a flowchart of the abnormal behavior identification method for intelligent monitoring boxes based on DeepSeek according to the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages disclosed in the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present invention and are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of this application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout.

[0024] It should be noted that the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, such as a process, method, system, product, or server that includes a series of steps or units, not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or device.

[0025] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0026] like Figure 1 As shown, this invention provides a method for identifying abnormal behavior of a smart monitoring box based on DeepSeek. The native DeepSeek large model refers to the original pre-trained model used as the base; the model actually deployed locally on the monitoring box after pruning, quantization, and fine-tuning is the lightweight DeepSeek large model. This embodiment is applied to a smart monitoring box equipped with an ARM main control unit + NPU computing unit. The monitoring box integrates a 2-megapixel bullet camera, 32G local storage, a wireless communication module (supporting 4G, 5G, or optical communication), and an audio-visual alarm module, and is deployed in a park perimeter monitoring scenario. The specific implementation steps are as follows: S1. The real-time video stream of the monitored area is obtained through the video acquisition module of the intelligent monitoring box. The video stream is encoded in H.264, with an original resolution of 1920×1080 and an original frame rate of 25fps. The video stream data is input into the local preprocessing module. S2. Video stream preprocessing involves sampling, image standardization, and keyframe filtering of the original real-time video stream to obtain the sequence of frames to be identified, which is suitable for the input of the adaptation model. The specific process includes: Equal-interval frame sampling: Set the basic sampling interval =200 ms, 5 frames per second are sampled from the 25fps raw video stream to obtain a candidate frame set.

[0027] Image preprocessing: Gaussian denoising is performed on candidate frames to suppress image noise; the image size is normalized to 224×224 pixels to match the input size of the DeepSeek model; pixel value normalization is performed using the following formula: ; in, These are the original pixel values. The current pixel value to be processed. =[0.485,0.456,0.406] is the average value of the RGB three channels. =[0.229,0.224,0.225] represents the standard deviation of the RGB three channels. After standardization, the pixel value distribution meets the model input requirements.

[0028] Keyframe selection: Keyframes containing moving targets are selected using the inter-frame difference method. The formula for calculating the inter-frame difference is as follows: ; in, The sequence number of the frame. These are the pixel coordinates in the image. , The first Frame and the The coordinates in the frame image are The grayscale value of the pixel, For the first Frame and the Differential images between frames; setting grayscale difference threshold =25, pixels with a gray-level difference greater than 25 in the difference image are identified as moving pixels; the proportion of moving pixels to the total number of pixels in the entire frame is calculated. Set the percentage threshold =3%, when When the percentage is ≥3%, the frame is determined to contain a valid moving target and is included in the keyframe sequence. =25、 =3% is the preferred value for standard outdoor park lighting conditions (illuminance ≥100 lux). In actual deployment, it can be calibrated and adjusted according to the scene lighting and camera gain characteristics.

[0029] Dynamic frame rate adjustment: Employs a dynamic sampling interval strategy, when continuous... N If no moving target is detected in 5 candidate frames, the sampling interval is increased to twice the base interval. = =400 ms, reducing sampling and inference overhead; when a moving target is detected in any frame, the basic sampling interval of 200ms is immediately restored. At the same time, for intermediate frames that may be missed during the extended sampling interval, the two most recent frames are immediately sampled from the buffer to participate in the current inference, avoiding missed detection of key motion start frames and ensuring the timeliness of abnormal behavior capture. Eight consecutive key frames are combined into a set of frames to be identified and input into the lightweight DeepSeek large model for inference. The core parameters of this step are summarized in Table 1.

[0030] Table 1: Preprocessing Core Parameter Settings

[0031] S3. Input the frame sequence to be identified into the lightweight DeepSeek large model deployed on the local NPU of the smart monitoring box. The model sequentially completes visual semantic feature extraction, temporal behavioral feature extraction, and feature fusion to obtain global behavioral representation features. The specific process is as follows: Lightweight DeepSeek Large Model Construction: This embodiment uses the DeepSeek-VL-1.3B large model as a base and obtains a lightweight edge model through three steps: pruning, quantization, and fine-tuning. Specifically: Structured channel pruning: An L1 regularization-based channel pruning method is used to prune the convolutional channels of the visual encoder, the attention heads of the Transformer layer, and the feedforward network channels, removing channels whose weight contribution is lower than the threshold. The overall pruning rate is 35%, and the number of model parameters is reduced from 1.3B to about 0.85B after pruning.

[0032] INT8 symmetric quantization: The pruned model weights are subjected to INT8 symmetric quantization. The quantization formula is as follows: ; in, These are the original FP32 weight values. This is the quantization scaling factor, and , , These are the minimum and maximum values ​​after quantization, respectively. In this embodiment, we take... , After quantization, the model not only shrinks in size but also improves inference speed.

[0033] Supervised fine-tuning: A dataset of abnormal behaviors in monitoring scenarios was constructed, including four types of anomalies: unauthorized intrusion, unauthorized climbing over fences, suspicious abandoned items, and damage to enclosure equipment, totaling 120,000 labeled frames. Supervised fine-tuning was performed using the cross-entropy loss function, with a learning rate set to 2×10⁻⁶. -5 With a batch size of 8 and 10 iterations, a lightweight model adapted to monitoring scenarios is obtained.

[0034] Feature extraction and fusion specifically include: Visual semantic feature extraction: The sequence of frames to be identified is input into the visual encoding branch of the model (based on the ViT-B structure). Each frame image is divided into blocks for encoding, and the visual semantic features of a single frame are output. The output dimension of the entire sequence is [missing information]. = 8×512 visual feature matrix ， Features include semantic information such as people categories, object locations, and scene attributes, among which = 512 represents the visual feature dimension of a single frame.

[0035] Temporal behavioral feature extraction: The visual feature matrix is ​​input into the temporal attention branch (3-layer Transformer encoder), and the temporal dependencies between frames are captured through a multi-head self-attention mechanism. The multi-head attention is... one The parallel single-head attention outputs are concatenated and then linearly transformed to obtain the final multi-head attention output. In this embodiment... =8, the formula for calculating single-head attention is: ; in, , , These are the query matrix, key matrix, and value matrix, respectively. The feature dimension of the query matrix. The output dimension is... Temporal feature matrix It represents dynamic behavioral information such as action trajectory and state changes, among which For time-series feature dimensions, It is the transpose symbol; Feature fusion: The visual feature matrix and the temporal feature matrix are concatenated and fused along the feature dimension to obtain the fused feature matrix. Perform global average pooling on the fused feature matrix to obtain a matrix of dimension 1. global feature vector Furthermore, since the temporal attention branch is sensitive to inter-frame positional shifts and attitude changes, abnormal behaviors that require continuous frame judgment, such as climbing over fences or falling to the ground, can be comprehensively judged by the cumulative trend of confidence in multiple frames in the sequence, thus avoiding misjudgment in a single frame.

[0036] When the intelligent monitoring box receives four surveillance videos, a computing power priority scheduling mechanism is adopted. The computing power allocation for inference is based on the risk level of the monitored area: 40% for high-risk perimeter areas, 30% for medium-risk entrances and exits, 20% for low-risk public areas, and the remaining 10% is reserved as computing power. The built-in NPU computing unit is used to execute inference. The inference time for a single 8-frame sequence is ≤300ms, meeting real-time recognition requirements. The computing power is allocated to each inference task based on a priority scoring function, the formula of which is: ; in, For the first The inference priority score of the video path. The preset risk level quantification value for the corresponding monitoring area (1 for high risk, 0.6 for medium risk, and 0.3 for low risk). For the first The average confidence level of abnormal behavior in the video output. This is the event urgency coefficient (1 if an alarm has been triggered, and 0.2 if no alarm has been triggered). , , These are the weight coefficients for the priority scores, and they satisfy... + + =1, in this embodiment =0.5, =0.3, =0.2; NPU computing power resources are allocated from high to low priority scores, with the highest priority channel allocated no less than 35% of the computing power and the lowest priority channel allocated no less than 10% of the basic computing power; when a high priority channel detects abnormal behavior, it can temporarily preempt the computing power resources of a low priority channel to ensure the timeliness of inference for abnormal events.

[0037] S4. Infer the global behavior representation feature vector using the multi-label classification head of the lightweight DeepSeek large model. Calculate the corresponding confidence score independently for each preset abnormal behavior category. The confidence score calculation formula is as follows: ; in, It is the Sigmoid activation function. , The first The fully connected weight vector and bias term corresponding to abnormal behaviors; The confidence level ranges from [0,1], with higher values ​​indicating a greater likelihood of abnormal behavior. A preset judgment threshold is set. =0.7, when the confidence level of any type of anomaly is... ≥Preset judgment threshold At that time, it was determined that the monitored area contained the first Classified abnormal behaviors; supports simultaneous determination of multiple types of anomalies, that is, when the confidence levels of multiple types exceed the threshold at the same time, the results of multiple types of anomalies are output simultaneously; this embodiment presets four types of abnormal behavior categories: illegal intrusion by personnel, unauthorized climbing over fences, suspicious left-behind items, and damage to container equipment.

[0038] S5. When the confidence level of any abnormal behavior category is greater than the preset judgment threshold, it is determined that there is a corresponding abnormal behavior. The intelligent monitoring box generates a local alarm and performs data reporting, specifically including: Initial assessment and false alarm filtering: After initially determining that abnormal behavior exists, the identification result is matched and verified against a preset scene rule base, and false alarm filtering is performed. Target size rule: If the area of ​​the bounding rectangle of the detected moving target occupies less than 2% of the screen area, it is judged as a small disturbance such as a small animal or fallen leaf, and the alarm is removed; Legitimate time period rule: During the preset legitimate working hours (8:00-18:00 on weekdays), normal personnel are not considered as unauthorized intruders; Environmental interference rule: When the global brightness variance of the image exceeds 50, it is judged as a misjudgment caused by environmental changes such as strong light or rain, and the alarm is removed. Alarms retained after rule verification will be processed for subsequent alarm and reporting procedures.

[0039] Tiered audible and visual alarms: Match the corresponding risk level to the category of abnormal behavior and trigger on-site audible and visual alarms of corresponding intensity: illegal intrusion by personnel and damage to enclosure equipment are high risks, triggering a strong audible and visual alarm with a volume of 85dB and a 2Hz strobe; unauthorized climbing over the fence is a medium risk, triggering a 60dB volume indicator light alarm; suspicious abandoned items are low risks, and only local records are generated without triggering audible and visual alarms.

[0040] Local data storage: Automatically stores at least 10 seconds of original video footage before and after the time of the anomaly (if the anomaly confidence level is still higher than the threshold at the end of 10 seconds, the storage will be extended until the confidence level falls below the threshold). At the same time, it stores screenshots of the anomaly frames, feature data and alarm logs. The local storage period is 30 days, and it is overwritten cyclically.

[0041] Cloud data reporting: Alarm type, occurrence time, abnormal frame screenshot, and device ID information are uploaded to the cloud management platform or local area network management platform via optical communication module or 5G communication module. The end-to-end reporting latency is ≤1 second, facilitating remote handling by maintenance personnel. The cloud management platform or local area network management platform aggregates difficult case samples and manually labeled data reported by each intelligent monitoring box. Each intelligent monitoring box uploads difficult case samples with confidence levels between 0.5 and 0.7, as well as false positives and false negatives verified manually, to the cloud management platform or local area network management platform. The cloud management platform or local area network management platform aggregates all samples, facilitating the construction of incremental datasets after manual labeling. The LoRA low-rank adaptation method is used for incremental fine-tuning of the lightweight DeepSeek large model, with a learning rate set to 1×10⁻⁶. -5 The process iterates for three rounds, updating only the low-rank adapter parameters of the DeepSeek large model while leaving the backbone weights unchanged. The fine-tuning process aims to maximize the reward function, calculated using the following formula: ; in, This is the reward value for a single iteration. The validation set recognition accuracy is the proportion of correctly identified samples out of the total samples. The false positive rate is the percentage of samples in a normal scenario that are incorrectly identified as abnormal by the lightweight DeepSeek model. The false negative rate is the percentage of samples where abnormal scenarios were not identified by the lightweight DeepSeek model. , , These are the weighting coefficients of the reward function, as shown in this embodiment. =0.4, =0.35, =0.25, prioritizing accuracy and suppressing false alarms; the cloud management platform or LAN management platform distributes the updated model parameters to each intelligent monitoring box via OTA or local network, completing hot updates locally; if the model parameter download or verification fails, the existing version is maintained locally and a failure log is reported, and the process is retried after the network is restored, ensuring that model updates do not affect the continuity of online monitoring services and achieving continuous iteration of model performance. When using a LAN management platform, model parameter updates can be completed through the local network, which is suitable for deployment environments with high network isolation or confidentiality requirements.

[0042] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek, characterized in that, Includes the following steps: S1. Obtain real-time video stream data of the monitored area through the video acquisition module integrated in the intelligent monitoring box; S2. Preprocess the real-time video stream data to obtain a sequence of frames to be recognized that are adapted to the input format of the DeepSeek large model; S3. Input the frame sequence to be identified into the lightweight DeepSeek large model deployed locally on the smart monitoring box, extract the visual semantic features and behavioral temporal features corresponding to the frame sequence to be identified, and complete the feature fusion. S4. Use the classification head of the lightweight DeepSeek large model to perform abnormal behavior inference on the fused features and output the confidence score of each preset abnormal behavior category. S5. When the confidence level of any abnormal behavior category is greater than the preset judgment threshold, it is determined that there is a corresponding abnormal behavior, and the intelligent monitoring box generates a local alarm and performs data reporting.

2. The method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek according to claim 1, characterized in that, Preprocessing in S2 specifically includes: The real-time video stream is sampled at equal intervals to obtain a set of candidate frames. The candidate frames are then subjected to image denoising, size normalization and pixel value standardization. Keyframes are then selected using the inter-frame difference method. The formula for calculating the inter-frame difference is: ； in, The sequence number of the frame. These are the pixel coordinates in the image. , The first Frame and the The coordinates in the frame image are The grayscale value of the pixel, For the first Frame and the Differential images between frames; Set grayscale difference threshold The difference in grayscale in the difference image is greater than Pixels are identified as moving pixels, and the proportion of moving pixels in the total number of pixels in the frame is calculated. ,when ≥ Percentage threshold When this happens, the frame is included in the keyframes, and consecutive keyframes form a sequence of frames to be identified.

3. The method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek according to claim 1, characterized in that, Lightweight DeepSeek large models are built through the following steps: The native DeepSeek large model undergoes structured channel pruning, with the pruning rate controlled at 30%-40%; then, INT8 symmetric weight quantization is performed, with the quantization calculation formula as follows: ； in, These are the original FP32 weight values. This is the quantization scaling factor, and , , These are the minimum and maximum values ​​after quantization, respectively; Then, by using the labeled abnormal behavior dataset of the monitoring scene, supervised fine-tuning is performed using the cross-entropy loss function to obtain a lightweight model adapted to the edge computing power of the smart monitoring box.

4. The method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek according to claim 1, characterized in that, S3 extracts visual semantic features and behavioral temporal features and performs feature fusion as follows: Visual semantic features of keyframes in a single frame are extracted using the visual encoding branch of a lightweight DeepSeek model, with an output dimension of [missing information]. Visual feature matrix ,in The length of the frame sequence to be identified. The visual feature dimension of a single frame; Inter-frame behavioral temporal features are extracted through a temporal attention branch. The temporal attention adopts a multi-head self-attention mechanism, which consists of multiple parallel single-head attentions. The calculation formula for a single-head attention is as follows: ； in, , , These are the query matrix, key matrix, and value matrix, respectively. The feature dimension of the query matrix; the output dimension is Temporal feature matrix , For time-series feature dimensions, It is the transpose symbol; The visual feature matrix and the temporal feature matrix are concatenated and fused along the feature dimension to obtain the global behavior representation feature matrix. Then, global average pooling is used to obtain the dimension as follows: The global feature vector.

5. The method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek according to claim 1, characterized in that: In S4, abnormal behavior reasoning uses a multi-label classification method. For each type of preset abnormal behavior, a corresponding confidence score is calculated. The confidence score calculation formula is as follows: ； in, It is the Sigmoid activation function. , The first The fully connected weight vector and bias terms corresponding to the abnormal behavior. This is the fused global feature vector; The confidence level is defined, and its value ranges from [0,1]. when ≥Preset judgment threshold When, it is determined that the first Abnormal behavior.

6. The method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek according to claim 1, characterized in that, The S5 generates local alarms and performs data reporting as follows: Match the corresponding risk level to the abnormal behavior category and trigger the corresponding intensity of on-site audible and visual alarms; store video clips, abnormal frame screenshots and alarm logs of preset duration before and after the abnormal behavior occurs locally; and upload the alarm information and abnormal frame screenshots to the cloud management platform or local area network management platform through the optical communication module or 5G communication module of the intelligent monitoring box.

7. The method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek according to claim 6, characterized in that: The cloud management platform or local area network management platform aggregates the difficult identification samples reported by each smart monitoring box and the manually labeled data to build an incremental dataset; The LoRA low-rank fitting method is used to incrementally fine-tune the lightweight DeepSeek large model. The fine-tuning process aims to maximize the reward function, which is calculated using the following formula: ； in, This is the reward value for a single iteration. To verify the accuracy of the recognition set, For false alarm rate, The false negative rate, , , These are the weighting coefficients of the reward function; The updated model parameters are sent to the intelligent monitoring box to complete the local model iteration.

8. The method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek according to claim 2, characterized in that, The frame sampling adopts a dynamic frame rate adjustment strategy: when no moving target is detected in N consecutive candidate frames, the frame sampling interval is increased to n times the basic interval; when a moving target is detected, the basic sampling interval is restored.

9. The method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek according to claim 1, characterized in that: The S3 intelligent monitoring box utilizes its built-in NPU computing unit to perform model inference. When multiple video streams are connected, a priority scoring function is used to sort and allocate computing power to each inference task. The priority scoring formula is as follows: ； in, For the first The inference priority score of the video path. The preset risk level quantification value for the corresponding monitoring area. For the first The average confidence level of abnormal behavior in the video output. This represents the urgency coefficient of the event. , , These are the weight coefficients for the priority scores, and they satisfy... + + =1; NPU computing resources are allocated according to priority scores from high to low, and the score is proportional to the allocated computing power.

10. The method for identifying abnormal behavior of an intelligent monitoring box based on DeepSeek according to claim 1, characterized in that, After determining that abnormal behavior exists in S5, before executing data reporting, a false alarm filtering step is also included: the identification result is matched and verified with the preset scene rule library. If it meets the preset false alarm rule, the alarm is removed; if it does not meet the rule, the alarm is retained and subsequent reporting operations are performed. The preset false alarm rules include target size rules, legal time period rules, and environmental interference rules.

Images