System and method for detecting, recording, and warning about repeated appearances of persons in a security camera system

Abstract

This system automatically detects repeated appearances of people and vehicles through security camera systems, providing early detection of abnormal behavior such as stalking or suspicious loitering. Image analysis performs individual identification using facial, clothing, and license plate recognition from video data acquired through camera capture. Recording accumulates the appearance history of detected objects as time-series data, and the judgment method detects abnormal behavior patterns based on statistical indicators such as appearance frequency and time intervals. Alerts are sent immediately via email, push notifications, and voice alerts. Cross-sectional tracking across multiple cameras, high-precision analysis using AI technologies such as deep learning, and scalable operation through cloud computing integration are realized. Privacy protection functions ensure proper management of personal information and comply with legal requirements. This innovative security solution aims to shift from traditional post-event confirmation to preventative security systems, simultaneously improving facility safety and streamlining surveillance operations.

Description

[Technical Field]

[0001] The present invention relates to a security camera system, and in particular to a system and method for detecting repeated appearances of objects such as people or vehicles from images captured by a camera, recording and analyzing the frequency and patterns of such appearances, and issuing a warning. More specifically, the present invention relates to a technical field that combines face recognition technology, motion detection technology, license plate recognition technology, etc. to automatically detect multiple visits or stays of the same person or the same vehicle, and to early detection of behavioral patterns that may be problematic in terms of crime prevention, such as stalking or suspicious loitering. [Background technology]

[0002] In recent years, the widespread use of security camera systems has led to improvements in facility security. Conventional security camera systems have primarily been used to preserve evidence after the fact and to review recorded footage. However, there is a need for a system that can detect behavioral patterns that could pose a security risk, such as when the same individual repeatedly appears around a facility or loiter for an extended period of time, in real time and issue a warning in advance. Furthermore, manually discovering suspicious behavior patterns from the massive amount of video data obtained from multiple surveillance cameras is inefficient, and there is a growing need for automated detection systems. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP6589082B2 Summary of the Invention

[0004] The present invention aims to provide a system and method for a security camera system that automatically detects repeated appearances of the same person or vehicle, analyzes their frequency and temporal patterns, and quickly detects behavior that could pose a security problem, such as stalking or suspicious loitering, and issues an appropriate warning. [Problem to be solved by the invention]

[0005] Conventional security camera systems were capable of detecting isolated intrusions and abnormal situations, but lacked the ability to detect behavioral patterns with temporal continuity, such as the repeated appearance of the same person or vehicle. They also lacked the ability to track movement patterns across multiple monitoring locations or predict abnormal behavior through statistical analysis of visit frequency. Furthermore, there was room for improvement in visualization of detection results and integration with warning systems. Therefore, the present invention aims to provide a system and method for a security camera system that automatically detects the repeated appearance of the same person or vehicle, analyzes their frequency and temporal patterns, and quickly detects behavior that could pose a security risk, such as stalking or suspicious loitering, and issues appropriate warnings. [Means for solving the problem]

[0006] In order to solve the above problems, the security camera system of the present invention comprises an imaging means, an image analysis means, a recording means, a determination means, and a warning means. The imaging means captures images of the area to be monitored to obtain video data. The image analysis means detects objects such as people and vehicles from the video data and performs individual identification using facial recognition, clothing recognition, license plate recognition, etc. The recording means accumulates the appearance history of the detected objects as time-series data. The determination means determines abnormal behavior patterns based on statistical indicators such as appearance frequency and time intervals. The warning means issues a warning signal if an abnormality is determined. [Effects of the Invention]

[0007] This invention automatically detects repeated appearances of the same person or vehicle and uses statistical analysis to quickly identify abnormal behavior patterns, enabling it to detect stalking, suspicious loitering, and other behavior that could pose a crime prevention problem in advance and take appropriate action. Furthermore, tracking behavior patterns across multiple monitoring locations enables more comprehensive security monitoring. Furthermore, the automated detection and warning system reduces the burden on security personnel and improves monitoring efficiency. DETAILED DESCRIPTION OF THE INVENTION

[0008] In at least one embodiment, the security camera system of the present invention includes a camera unit consisting of surveillance cameras installed at multiple locations, such as building entrances, parking lots, and corridors. Each surveillance camera can be selected from visible light cameras, infrared cameras, and thermal cameras, or a combination of these, allowing the optimal camera system to be adopted depending on the shooting environment and application. The captured video data is transmitted to a central processing unit via a communication system, such as a wired network, a wireless network, or optical fiber communication. Communication protocols such as TCP / IP, HTTP, RTSP, or dedicated protocols can be used, and can be flexibly selected according to the system's required specifications. The video data compression method can also be selected from H.264, H.265, MJPEG, or a proprietary format, allowing optimization to balance bandwidth and image quality.

[0009] In at least one embodiment, the image analysis means has an object detection function for detecting objects such as people and vehicles from captured video data. For object detection, technologies such as edge detection, contour extraction, template matching, and machine learning-based detectors can be used alone or in combination. Machine learning techniques such as deep learning, support vector machines, random forests, and neural networks can be adopted, and can be selected depending on the required detection accuracy and processing speed. For person detection, a combination of techniques such as face detection, full-body detection, and walking posture detection can be used to accurately detect people photographed from various angles and distances. For vehicle detection, technologies such as shape recognition, color recognition, and license plate detection are used to extract features such as vehicle type, color, and registration number. These detection technologies are executed by processing devices such as hardware accelerators, GPUs, dedicated chips, or general-purpose processors, and the optimal implementation can be selected depending on the system's processing power and cost constraints.

[0010] In at least one embodiment, the individual identification function identifies individuals by extracting the unique features of detected objects. For individual person identification, facial recognition technology is used as the primary method, performing processes such as facial feature point extraction, facial region normalization, feature vector generation, and similarity calculation. Facial recognition algorithms can be selected from principal component analysis, linear discriminant analysis, support vector machines, and deep learning-based methods, with the appropriate method being adopted depending on the required recognition accuracy and processing speed. When facial recognition is difficult, biometric authentication technologies such as clothing color and pattern recognition, body type and height estimation, and walking pattern analysis can be used in combination as a supplementary method. For individual vehicle identification, license plate recognition is the primary method, and optical character recognition technologies such as character recognition, number recognition, and area code recognition are used. As a supplementary method when the license plate is unclear, a function is provided to learn and record visual features such as vehicle color, vehicle model, and damage patterns. These identification technologies complement each other, so that even if one method is difficult to identify, the accuracy of individual identification can be maintained using other methods.

[0011] In at least one embodiment, the recording means accumulates the appearance history of detected and identified objects in a time-series database. The database system can be a relational database, a NoSQL database, a time-series database, or an in-memory database, and the optimal system can be selected depending on the amount of data and search performance requirements. Recorded information includes the detection time, detection location, object identification information, confidence score, and related image data. Time information is time-stamped with millisecond accuracy to ensure time synchronization between multiple cameras. Location information is recorded in the form of GPS coordinates, camera identifiers, relative coordinates within the monitored area, etc., enabling integration with geographic information systems. Image data can be stored in a variety of formats, including saving the original image, extracting the detected area, and extracting and saving features, allowing for optimization that balances storage capacity and search performance. Data retention periods and compression methods can also be flexibly configured in accordance with legal requirements and operational policies.

[0012] In at least one embodiment, the determination means calculates statistical indicators from the accumulated occurrence history data and compares them with a preset threshold to determine abnormal behavior patterns. Statistical indicators calculated include occurrence frequency, stay duration, visit intervals, movement patterns, and time zone distribution. The occurrence frequency is calculated by analyzing the number of detections within a specified period, the detection density per hour, and detection trends by day of the week and time zone. The stay duration is calculated by estimating the actual stay duration based on the continuous detection time within the same area, the difference in entry and exit times, and traffic flow analysis. The threshold setting for anomaly detection can be selected from fixed values, learning-based dynamic adjustment, and settings based on statistical distribution, and is optimized according to the operational environment and security policy. The determination algorithm can use rule-based determination, machine learning-based determination, statistical anomaly detection, or a combination of these, and can be set to balance detection accuracy and false alarm rate. It also has a function to calculate an overall anomaly score by combining multiple indicators, enabling more precise anomaly detection.

[0013] In at least one embodiment, the warning means issues a warning signal in various forms when an abnormality is detected. Warning methods can be selected from email, SMS, push notification to a mobile application, screen display on a desktop application, audio alert, and visual warning light (illumination or flashing). Email transmission uses protocols such as SMTP, POP3, and IMAP, and messages can be sent in text or HTML format. Mobile notifications enable real-time warning delivery through integration with push notification services for iOS (registered trademark) and Android (registered trademark). Audio alerts provide features such as pre-recorded audio messages, dynamic message generation using voice synthesis, and audio output in multiple languages. Visual warnings control display devices such as LED warning lights, LCD displays, and projectors to indicate the warning level using color, brightness, flashing patterns, etc. The warning priority setting function allows for gradual warning delivery according to urgency and narrowing down the recipients of warnings.

[0014] In at least one embodiment, the system manages multiple surveillance cameras in an integrated manner to achieve cross-sectional tracking of objects. Inter-camera collaboration provides functions such as taking over objects in overlapping areas of coverage, matching the same object on different cameras, and estimating movement paths. Object handover achieves highly accurate tracking through correlation analysis of detection timing between adjacent cameras, comparison of feature similarities, and prediction of movement speed and direction. Movement path estimation reconstructs the movement trajectory of the object from the detection time and location information from each camera, and utilizes this information for behavioral pattern analysis. Network configurations include centralized, distributed, and hybrid architectures, optimized to meet system scale and processing load distribution requirements. Data synchronization functions enable integrated management of surveillance data from multiple locations and wide-area monitoring through integration with cloud services. Operational management functions, such as adding and removing cameras and changing settings, also support flexible system expansion and modification.

[0015] In at least one embodiment, the visualization function displays detection results and analysis data in a variety of formats to help monitors understand the situation. Display formats include real-time video display, highlighting of detected targets, statistical graphs and charts, and display of detected locations on a map. Real-time display overlays detection frames, identification information, anomaly levels, and other information on live video for intuitive monitoring. Statistical display visualizes occurrence frequency, time distribution, and regional distribution in bar graphs, line graphs, pie charts, heat maps, and other formats. Map display provides functions such as the geographic distribution of detected locations, movement trajectories, and the setting of alert areas through GIS integration. User interfaces can be provided in the form of web browsers, desktop applications, mobile applications, and other formats, depending on the usage environment. Display content customization allows users to narrow down information based on their roles and permissions, and adjust the display layout.

[0016] In at least one embodiment, the prediction function predicts future behavior based on past patterns of occurrence, supporting the establishment of a proactive alert posture. Prediction algorithms can include time series analysis, regression analysis, machine learning, deep learning, and other methods, selected based on the required prediction accuracy and computational cost. Time series analysis analyzes temporal patterns such as seasonal fluctuations, periodicity, and trends to predict future occurrence probabilities. Machine learning learns the characteristics of behavioral patterns from past data to detect similar patterns and predict anomalous patterns. Prediction results are expressed in the form of probability distributions, confidence intervals, risk scores, and other formats, and provided as decision-making support information. The prediction period and granularity are configurable, allowing for flexible settings depending on the application, from short-term to long-term predictions. To continuously improve prediction accuracy, the system also includes a function to update the learning model by comparing it with actual detection results. A prediction correction function that takes into account the influence of external factors (weather, events, social conditions, etc.) provides more practical prediction results.

[0017] In at least one embodiment, the system is equipped with a function for linking with external systems to achieve comprehensive security management. Linkage targets include security company monitoring centers, local government security systems, police department information systems, building management systems, and access control systems. Data linkage uses standard APIs, web services, database linkage, file transfer, and other methods, selecting the optimal linkage method based on the specifications of the partner system. To ensure security, the system implements functions such as data encryption, authentication and authorization, access control, and audit logs. Real-time linkage provides functions such as immediate reporting upon anomaly detection, live streaming of detected data, and instructions and confirmation via two-way communication. Periodic data synchronization using batch processing also enables efficient exchange of large volumes of data. Compatibility between different systems is ensured through functions such as protocol conversion, data format conversion, and character code conversion. High availability is achieved through functions such as linkage error detection and recovery and failover.

[0018] In at least one embodiment, the system incorporates a privacy protection function to ensure appropriate management of personal information. Privacy protection features include facial image masking, anonymization of personally identifiable information, encrypted data storage, and access permission control. Facial image masking applies mosaic, blurring, blacking, and other processes to detected facial areas to make individuals difficult to identify. The masking strength can be configured to adjust the balance between surveillance purposes and privacy protection. Anonymization pseudonyms directly identifiable information such as name and address, and retains only information necessary for statistical analysis and behavioral pattern analysis. Data storage uses strong encryption technologies such as AES encryption and RSA encryption to protect data from unauthorized access. Access control prevents unauthorized access through user authentication, role-based access control, and audit logs. Other features include data retention period management in accordance with legal requirements and automatic data deletion.

[0019] In at least one embodiment, the system integrates with various sensors to improve detection accuracy and reduce false alarms. Possible integrations include motion sensors, acoustic sensors, vibration sensors, temperature sensors, humidity sensors, smoke detectors, and gas detectors. Motion sensor integration combines detection signals from PIR sensors, microwave sensors, ultrasonic sensors, and other sensors with video analysis results to achieve more reliable person detection. Acoustic sensor integration analyzes acoustic information such as footsteps, voices, and other sounds to complement situations difficult to capture with video. Vibration sensor integration detects fence sway, door openings, and floor vibrations to support early detection of intrusions. Environmental sensor integration provides early warning of fires and chemical hazards by detecting abnormal temperature changes, smoke emissions, and hazardous gases. Sensor information fusion integrates and analyzes signals from each sensor to make comprehensive situational assessments. Time series analysis of sensor data improves the accuracy of detecting abnormal events and distinguishing between normal and abnormal conditions.

[0020] In at least one embodiment, the system is equipped with advanced analytical capabilities utilizing artificial intelligence technology. Applications of AI technology include improving image recognition accuracy, learning behavioral patterns, automating anomaly detection, and improving prediction accuracy. Deep learning technology uses techniques such as convolutional neural networks, recurrent neural networks, and transfer learning to build highly accurate recognition models from large amounts of training data. Reinforcement learning technology learns optimal monitoring strategies through interaction with the environment and enables dynamic adjustment of monitoring parameters. Natural language processing technology supports voice-based anomaly detection and monitoring in multinational environments with features such as speech recognition, text analysis, and multilingual support. In combination with edge computing technology, the system can selectively use local AI processing on the camera side and integrated AI analysis on a central server, distributing processing loads and improving responsiveness. Continuous learning and updating of AI models enables adaptation to environmental changes and new threats. Explainable AI technology visualizes the basis for AI decisions, improving system transparency and reliability.

[0021] In at least one embodiment, the system utilizes cloud computing technology to ensure scalability and availability. Cloud services are available at the IaaS, PaaS, and SaaS levels, allowing the optimal service type to be selected based on system requirements and cost constraints. Data storage uses object storage, block storage, file storage, and other storage types depending on the application, enabling efficient management of large volumes of data. Load balancing technology distributes processing across multiple server instances to ensure high throughput and availability. Auto-scaling functionality dynamically increases or decreases resources depending on processing load, optimizing the balance between cost efficiency and performance. Backup and recovery functionality minimizes the risk of data loss and ensures business continuity in the event of a disaster. Security provides protection against cloud-specific threats, geographic data distribution, and compliance support. Multi-cloud support enables risk diversification by leveraging multiple cloud providers and avoids vendor lock-in.

[0022] In at least one embodiment, a function for counting the number of repeated appearances of a person associates and records the identification information of a detected individual with the time of detection and automatically tallys the number of appearances of the same person within a specified period. This function combines multiple identification methods, such as facial recognition technology, walking pattern analysis, and clothing feature extraction, to achieve highly accurate individual identification, even when lighting conditions and angles change. The counting process can employ both real-time and batch processing, selectable depending on the system's processing power and responsiveness requirements. The aggregation period can be flexibly set to hours, days, weeks, months, etc., allowing for optimization based on monitoring objectives and security policies. A function for eliminating duplicate detections counts consecutive detections of the same person as a single appearance, providing accurate statistical data. The count data is persisted in a database and used for long-term trend analysis and statistical report generation.

[0023] In at least one embodiment, the function for alerting users to abnormal visit frequency for a specific individual learns the visit patterns of each individual and automatically detects statistically abnormal occurrences. This function learns the normal visit patterns for each individual from past visit data and calculates statistical indicators such as average visit frequency, standard deviation, and seasonal variation. To determine abnormalities, algorithms such as outlier detection, change point detection, and time series anomaly detection are used to detect sudden increases in frequency or abnormal patterns. Threshold settings can be selected from fixed value methods, learning-based methods, administrator settings, and other methods, allowing for flexible adjustments according to the operating environment. Multiple indicators can be set as alert conditions, such as absolute frequency (e.g., more than five times per day), relative frequency (e.g., more than three times the historical average), and cumulative frequency (e.g., more than 20 times per week). Detected anomalies are recorded along with a reliability score to reduce false alarms and improve accuracy. The alert information includes detailed information such as the target user's identification information, the degree of abnormality, and estimated behavioral patterns.

[0024] In at least one embodiment, the function for identifying repeat visits with the same clothing and appearance learns and records a person's appearance characteristics and detects multiple appearances with similar appearances. This function extracts visual features such as clothing color, pattern, shape, and texture using image analysis and quantifies them as feature vectors. Appearance feature extraction utilizes a combination of technologies, including hue, saturation, and brightness analysis, texture analysis, shape recognition, and fashion item detection. Similarity determination can employ methods such as distance calculation between feature vectors, machine learning classification, and deep learning feature matching. Time-series changes in appearance are taken into account, and factors such as seasonal variations, weather-related clothing changes, and the addition or removal of accessories are incorporated into the learning process. Repeat visit detection with the same appearance counts the number of similar appearances within a specified period and issues a warning if the same appearance appears abnormally frequently. The appearance database stores only anonymized feature information to ensure privacy. Detection results are recorded along with similarity scores, allowing for manual review to improve accuracy.

[0025] In at least one embodiment, a facial recognition-based personal revisit record function identifies individuals using highly accurate facial recognition technology and records and manages their revisit history in detail. This function uses a deep learning-based facial recognition algorithm to perform a series of processes, including facial feature point extraction, normalization, feature vector generation, and similarity calculation. The facial recognition process supports both real-time and batch recognition, selecting the optimal method depending on the processing load and responsiveness requirements. A facial image quality improvement function achieves highly accurate recognition even under difficult conditions such as low-resolution images, partial occlusion, and lighting changes. Individual facial features are stored in an encrypted database and protected from unauthorized access. The revisit record includes detailed information such as visit date and time, length of stay, detection location, and confidence score, creating a comprehensive behavioral history. To ensure privacy, the function implements protection features such as automatic facial image deletion, anonymization processing, and access permission control. To continuously improve recognition accuracy, the function includes functions such as corrective learning for misrecognitions and additional learning for new registered users.

[0026] In at least one embodiment, the vehicle appearance frequency tracking function by license plate uses optical character recognition technology to identify vehicles and continuously monitor their appearance patterns. This function automatically performs a series of processes: license plate detection, character region extraction, character recognition, and vehicle matching. License plate detection uses a machine learning-based object detection algorithm to detect plates at various angles, distances, and lighting conditions. Character recognition processing combines OCR technology with deep learning to accurately read characters even on dirty, damaged, or partially obscured plates. Vehicle appearance frequency is aggregated by period, such as daily, weekly, or monthly, and abnormal appearance patterns are detected through statistical analysis. Additional information, such as area code, vehicle type classification, and registration year, is also recorded to enable more detailed vehicle profiling. Vehicle tracking at multiple monitoring locations allows for estimation of travel routes and detection of patrol behavior. The vehicle database includes classification functions such as blacklists and whitelists to support automatic identification of vehicles under surveillance. To protect privacy, vehicle owners' personal information is not stored; only license plate information is anonymized and managed.

[0027] In at least one embodiment, the time-of-day appearance frequency recording function performs detailed analysis of the appearance times of detected people and vehicles to understand temporal patterns and detect anomalies. This function divides 24 hours into arbitrary time units (e.g., 30 minutes, 1 hour, 2 hours) and aggregates the number of appearances in each time period. Time data recording includes functions such as accurate recording of detection times, time zone compatibility, and automatic daylight saving time adjustment. Statistical analysis includes the average number of appearances by time period, identification of peak times, and detection of appearances during abnormal times. A dynamic baseline adjustment function is implemented to account for fluctuations in time patterns due to day of the week and season. Visualization of time-of-day data is displayed in the form of heat maps, time series graphs, radar charts, and other formats to help intuitively understand patterns. Higher alert levels can be set for appearances during special times, such as outside business hours, late nights, and early mornings. Time-of-day warning settings enable immediate alerts for abnormal appearances during specific time periods. Long-term data storage also enables analysis of long-term time patterns, such as seasonal and annual fluctuations.

[0028] In at least one embodiment, the function for aggregating the occurrence of specific targets by day of the week analyzes behavioral patterns on a weekly basis and detects anomalies specific to each day of the week. This function records the number of occurrences for each day of the week from Monday to Sunday separately and generates statistical data for each day of the week. Flexible settings are possible, such as distinguishing between weekdays and holidays, treating holidays specially, and handling holidays specific to each region. Analysis by day of the week calculates statistical indicators such as the average number of occurrences for each day of the week, standard deviation, maximum and minimum values, and uses them to set normal ranges. Anomaly detection detects sudden increases in occurrences on specific days of the week, occurrences on unusual days of the week, and abnormal patterns on consecutive days of the week. The system is equipped with an analysis function that takes into account social factors such as work patterns, school schedules, and business patterns of commercial facilities. Visualization of data by day of the week supports understanding weekly patterns by displaying them in bar graphs, radar charts, calendar formats, etc. Trend analysis over multiple weeks makes it possible to distinguish between stable patterns and fluctuating factors. Day-of-week alert settings issue appropriate levels of alerts for abnormal occurrences on specific days of the week. By accumulating long-term data, detailed analysis of day-of-the-week patterns, including seasonal and annual variations, can be performed.

[0029] In at least one embodiment, the function for listing long-stayers in a specific area divides the monitored area into multiple zones and accurately measures the time spent in each zone. This function automatically records entry and exit times, tracks movement trajectories, and calculates stay time to identify stagnants who exceed a set time threshold. Zone settings can be flexibly defined, including physical boundaries, virtual boundaries, and overlapping zones, and can be optimized according to the facility layout and monitoring objectives. The calculation of stay time uses multiple indicators, such as continuous stay time, cumulative stay time, and effective stay time, to achieve a more accurate understanding of stay status. A function is provided to exclude temporary departures that involve movement and count only actual stays. Criteria for determining long stays can be individually set by zone, time period, target attributes, etc. The visitor list displays detailed information such as the start time of stay, current stay time, expected stay time, and estimated purpose of stay. A tiered warning system supports timely intervention in the event of abnormal long stays. Statistical analysis of stay data can distinguish normal from abnormal stay patterns.

[0030] In at least one embodiment, the continuous detection feature immediately triggers an alert by detecting repeated occurrences within a short period of time and issuing a high-level warning. This feature monitors the number of detections within a specified time period (e.g., 1 hour, 30 minutes, or 15 minutes) in real time and immediately triggers an alert when a preset threshold (e.g., 3, 5, or 10 times) is exceeded. Time window settings can be selected from fixed, sliding, or adaptive window methods, allowing for optimization according to the monitoring objective. Continuous detection determination utilizes a combination of multiple identification methods to improve the accuracy of identifying the same person or vehicle. To reduce false positives, features include setting a minimum detection interval, removing duplicate detections at the same location, and filtering by reliability score. When an alert is triggered, detailed data such as detection history, time interval, detection location, and target information is automatically collected and provided as information to support situation assessment. Urgency levels can be set to enable tiered warnings based on the number of continuous detections. Multiple notification methods (e.g., email, SMS, voice, and screen display) are combined to ensure reliable warning delivery. The continuous detection pattern learning function improves the accuracy of distinguishing between normal and abnormal continuous occurrences.

[0031] In at least one embodiment, a cross-camera person appearance counting function common to all cameras integrates multiple surveillance cameras to enable comprehensive appearance monitoring throughout the entire facility. This function consolidates detection data from each camera on a central server, and integrates and manages detections of the same person across different cameras. Person matching across cameras combines multiple methods, including facial recognition, walking pattern analysis, and clothing feature matching, to achieve highly accurate person identification. The time synchronization function enables accurate recording of detection timing across multiple cameras and estimation of movement trajectories. Dynamic system configuration, which accommodates the addition and removal of cameras, supports flexible expansion and modification of the monitoring area. Network load balancing ensures stable operation even in large-scale camera networks. Cross-camera count data visualization provides comprehensive information, such as displaying people's movements on a floor map of the entire facility, detection statistics by camera, and movement history by person. Anomaly detection detects complex behavioral patterns, such as unusual movement patterns, concentration in specific areas, and evasive behavior. Integrated data management enables behavioral analysis over a wide area that cannot be captured by a single camera, providing more effective security surveillance.

[0032] In at least one embodiment, the immediate notification function when a specified number of detections is exceeded sends emergency notifications to relevant parties via various communication methods when a set detection count threshold is exceeded. This function simultaneously utilizes multiple notification channels, such as email, SMS, mobile app push notifications, voice calls, and chat apps, to ensure reliable information transmission. Notification content includes detailed information such as the target's identification information, number of detections, detection time, detection location, and image data, supporting rapid situation assessment. Notification recipients can be set at multiple levels, such as security managers, administrators, security companies, and relevant departments, and an escalation function enables tiered notification. Notification priorities can be set according to urgency, allowing for priority delivery of important alerts. The notification confirmation and response function manages the recipient's response status and automatically re-notifies unaddressed alerts. Notification history is recorded to analyze response times, evaluate notification effectiveness, and accumulate data for system improvement. Time-based notification functions, such as automatic notification during nighttime and holidays and special response outside of business hours, are included. High availability is ensured by automatically switching to a backup notification route in the event of a communication failure.

[0033] In at least one embodiment, the automatic tracking registration function for targets exceeding a threshold automatically registers people or vehicles whose detection count exceeds a set standard as targets requiring monitoring, establishing an enhanced monitoring system. This function automatically updates the tracking target list, sets tracking levels incrementally, and manages tracking periods. During tracking registration, a comprehensive profile is generated, including the target's basic information, detection history, behavioral patterns, and risk score. Tracking levels can be set to various levels, such as careful monitoring, strict monitoring, and maximum vigilance, and are automatically adjusted based on the number of detections and behavioral patterns. The automatic tracking function prioritizes detection of the appearance of registered targets and continuously accumulates detailed behavioral records. Tracking target behavior analysis performs multifaceted analysis of movement patterns, locations, visit frequency, time trends, etc. An automatic tracking cancellation function removes targets from the tracking list at the appropriate time once they have returned to normal behavioral patterns. A manual tracking registration / cancellation function is also provided, allowing flexible response at the administrator's discretion. Tracking target data is encrypted and stored to appropriately protect highly confidential monitoring information. Compliance functions such as tracking record retention period management and data deletion are implemented in accordance with legal requirements.

[0034] In at least one embodiment, an automatic notification feature for security guard mobile devices instantly delivers alert information to mobile devices to support rapid response in the field. This feature supports a variety of devices, including smartphones, tablets, and dedicated communication devices, providing notifications optimized for the security guard's work environment. The mobile application integrates functions such as alert reception, situation confirmation, response recording, and location sharing to support efficient security activities in the field. Integration with GPS displays the relationship between the guard's current location and the location of the alert and suggests the optimal response route. The push notification function ensures that alerts are received even when the app is inactive. Alert information includes information necessary for on-site decision-making, such as an image of the target, a map of the detection location, past detection history, and recommended response procedures. The voice readout function allows the content of alerts to be confirmed while on the move or while working. Offline functionality enables basic alert reception and recording even in environments with unstable communication conditions. Multilingual support supports operations in international security systems. Information sharing between security guards enables coordinated response across the entire team. Optimized battery efficiency ensures stable operation even during long periods of security work.

[0035] In at least one embodiment, the audio alert and PATLITE® linkage function provides visual and audible warnings to immediately alert and deter intruders. This function automatically plays audio messages, generates warning sounds, and controls the on / off flashing of rotating lights in response to detected abnormalities. The audio system includes pre-recorded messages, real-time voice synthesis, multilingual support, and automatic volume adjustment. Audio content can be selected to suit the situation, from general warnings to specific instructions. The PATLITE® system supports a variety of light sources, including LED, xenon, and rotating types, and controls color, brightness, and flashing patterns according to the alert level. Audio and light linkage patterns can be individually configured by urgency, time of day, location, etc. A neighborhood consideration function automatically adjusts the volume and restricts the direction of light at night or in residential areas. Sensor linkage activates an alert only when approaching people is detected, achieving both energy savings and effective deterrence. Warning history recording allows for continuous validation and optimization of effectiveness. By linking with an external security system, a more comprehensive warning and intimidation system can be created.

[0036] In at least one embodiment, the notification priority leveling function creates a tiered notification system according to the urgency of the alert, supporting an efficient response system. This function promotes appropriate responses according to the level of importance by setting multiple priority levels, such as emergency, alert, caution, and information. Automatic priority determination uses a machine learning algorithm that comprehensively evaluates multiple factors, such as the number of detections, time patterns, location, and the target's past history. Different notification methods, notification recipients, and response time requirements can be set for each priority level, enabling operations tailored to the organization's security system. The escalation function automatically elevates the priority of low-priority alerts over time if they are not addressed. Notification method optimization implements tiered delivery, such as immediate voice call for emergency alerts, SMS and email for alert alerts, and email only for caution alerts. Statistical analysis by priority level accumulates data such as alert distribution trends, response times, and effectiveness measurements, supporting continuous system improvement. Administrators can manually adjust priorities to flexibly respond to special situations and policy changes. The priority setting learning function builds an optimal priority determination model based on past response performance.

[0037] In at least one embodiment, the group alert function for multiple simultaneous threshold violations detects group threats when multiple individuals exhibit anomalous behavior at the same time and issues a special alert. This function integrates and analyzes anomaly detections of multiple individuals related in time and space to evaluate the possibility of organized behavior or coordinated suspicious activity. Group formation is determined using indicators such as simultaneous appearance, similar behavioral patterns, coordinated movement, and role division to distinguish from solo behavior. The group threat level is calculated based on group size, membership, behavioral patterns, duration, etc. Advanced analysis, such as leader-follower identification, decision-making structure estimation, and behavior prediction, is performed by analyzing the relationships between multiple individuals. Group alerts set notification content, response procedures, and escalation routes different from individual alerts, and activate a security system specialized for group response. Detection of geographically dispersed group activity enables early detection of coordinated behavior and distributed threats at multiple locations. Similarities with known organizations and methods are evaluated by comparing with a database of past group activity. Automatic detection of group disbandment allows appropriate reduction of the threat level and management of the return to normal monitoring. Liaison functions with law enforcement agencies will assist in the appropriate reporting and collaboration of suspected organized crime.

[0038] In at least one embodiment, a patrol behavior detection function that integrates detection at multiple locations integrates and analyzes data obtained from a wide-area monitoring network to detect organized reconnaissance activities and planned patrol behavior. This function analyzes detection patterns of the same target at geographically dispersed monitoring locations over time to evaluate the possibility of intentional patrol or reconnaissance. Patrol pattern recognition utilizes a combination of techniques, such as analysis of movement paths, evaluation of stay times, analysis of visit sequences, and detection of periodicity. The degree of planning and organization is quantified and expressed as a threat level based on appearance patterns across multiple facilities, multiple areas, and multiple time periods. A transportation estimation function identifies travel methods, such as walking, cycling, and driving, and uses this information to evaluate the range and planning of activities. Patrol behavior purpose estimation uses machine learning to classify the possibility of reconnaissance, reconnaissance, surveillance, intelligence gathering, etc. Abnormal patrol pattern detection distinguishes between normal patrols, such as regular business patrols, delivery work, and cleaning work. A patrol route prediction function estimates the next visit location and time, supporting the establishment of a proactive alert system. By detecting long-term patrol patterns spanning multiple days and weeks, early signs of planned crimes can be detected.

[0039] In at least one embodiment, the early detection alert function, which takes into account off-site influences, expands the monitoring range beyond the site boundaries, enabling early detection of abnormal behavior over a wide area. This function also monitors behavior on public roads, adjacent properties, and surrounding facilities, detecting premonitory behavior before intrusion into the site. Off-site monitoring, taking privacy into consideration, targets only behavior in public spaces and excludes monitoring of private property and residential areas. Premonitory behavior detection items include loitering around the site, observing boundaries, investigating intrusion routes, and checking security conditions. By linking with a geographic information system, geographic information such as site boundaries, public roads, and building layouts can be accurately identified, allowing for the establishment of an appropriate monitoring range. By combining multiple monitoring technologies (cameras, sensors, drones, etc.), wide-area monitoring without blind spots can be achieved. Time-series analysis of early detection predicts the time until an intrusion occurs, supporting the planning of preventative measures. Information sharing with neighboring facilities allows for the creation of a coordinated crime prevention system across the entire region. The system's ability to comply with legal restrictions ensures the legality of the surveillance scope and prevents violations of privacy rights. Accumulating data on early detection allows for long-term analysis of local crime trends and changes in methods, which can be used to improve crime prevention measures.

[0040] In at least one embodiment, the occurrence frequency ranking display function ranks and displays detected people and vehicles by frequency of appearance, helping determine monitoring priorities. This function automatically generates a ranking based on the number of appearances within a specified period and displays them in order from top to bottom. The ranking display also includes detailed information such as the number of appearances, most recent detection date and time, first detection date and time, detection interval, and risk score. Period settings can be selected from daily, weekly, monthly, and custom periods, allowing for flexible aggregation according to analytical purposes. The ranking filtering function enables narrowing down the display based on specific conditions (time of day, location, attributes, etc.). Multiple sorting criteria (number of appearances, most recent detection, risk score, etc.) are provided to meet the needs of monitors. The ranking change tracking function monitors the rise and fall of rankings to detect the emergence of new threats and changes in existing threats. The automatic tracking function for top-ranked individuals continuously monitors those who frequently appear. The ranking data export function supports analysis and report creation in external systems. Visual indicators (color coding, icons, warning marks, etc.) allow for an intuitive understanding of risk levels.

[0041] In at least one embodiment, a list display function with thumbnail images of frequently detected targets speeds up visual identification of frequently occurring targets and supports efficient surveillance operations. This function automatically extracts facial images and vehicle images of detected individuals and selects and displays the highest quality images as thumbnails. Automatic image quality evaluation comprehensively assesses resolution, brightness, angle, clarity, etc. to select the optimal representative image. It also has a function to integrate images obtained from multiple detections to generate clearer, more distinctive composite images. A privacy protection function applies facial masking and blurring as needed. Important information, such as the number of detections, the most recent detection date and time, and the risk level, is overlaid on the thumbnail images. A detailed display function that can be clicked on an image provides comprehensive information, such as a full-size image, detection history, and behavioral patterns. A customizable list display function allows users to adjust the display items, sort order, filter conditions, and other settings according to their needs. An automatic image update function automatically replaces images with better quality images obtained from new detections. Displaying images from multiple angles helps users understand the multifaceted characteristics of targets. By optimizing the compression of image data, high-speed rendering is achieved even when displaying a large number of thumbnails.

[0042] In at least one embodiment, the detection point visualization function using heat maps uses color intensity to represent the frequency of people and vehicles within a monitored area, helping to understand spatial patterns. This function overlays detection data on a facility floor plan or floor map, displaying color-coded data according to the frequency of occurrence. The color scale can be selected from a range of options, including gradual changes from cool to warm, transparency adjustments, and custom color palettes, optimizing the visual effect. Dynamic time-based display allows for animation of temporal patterns by time of day, day of the week, season, etc. The 3D heat map function provides a three-dimensional visualization, including vertical distribution. The system features a composite display function that overlays multiple data layers (people, vehicles, anomaly detections, etc.). Interactive functions allow users to click on specific areas to display detailed information, zoom and pan, and select ranges. Statistical overlays display numerical data such as the total number of detections, average stay time, and peak times on the map. The heat map data export function facilitates use in other GIS systems and analysis tools. By setting a threshold, areas with a density above a certain level are highlighted, indicating areas that require priority monitoring.

[0043] In at least one embodiment, the person detection trend visualization function using a time series graph graphically displays temporal changes in detection data to support trend analysis and anomaly detection. This function plots indicators such as the number of detections, detection intervals, and dwell time along a time axis, enabling visual pattern recognition. Graph formats can be selected from line graphs, bar graphs, area graphs, scatter plots, etc., and the optimal representation is adopted depending on the nature of the data. Simultaneous display of multiple series enables comparative analysis by person, area, time period, etc. Time resolution can be set to minutes, hours, days, weeks, etc., allowing for adjustment of granularity according to the analytical purpose. Automatic detection and highlighting of outliers visually emphasizes deviations from normal patterns. Statistical analysis results such as trend lines, moving averages, and seasonal decomposition are overlaid on the graph. Interactive operation allows zooming in on specific periods, checking detailed data points, and displaying statistics by selecting a range. The forecast data display function visualizes future detection trends and supports planning preventative measures. Graphs can be output as images or PDFs, allowing for use in reports and meeting materials.

[0044] In at least one embodiment, the AI-based cluster classification and display function for similar faces and people with similar behavior utilizes machine learning technology to automatically identify highly related groups of people and support the detection of organized behavior. This function calculates similarity from multidimensional data such as facial feature vectors, behavioral patterns, and spatiotemporal correlations, and forms related groups using a clustering algorithm. The optimal clustering method is selected from k-means, hierarchical clustering, DBSCAN, spectral clustering, and other methods to achieve flexible classification according to the nature of the data. Similarity calculations comprehensively evaluate facial feature similarity, behavioral pattern similarity, correlation of appearance timing, and movement path similarity, among other factors. Cluster visualization represents relationships in formats such as dendrograms, scatter plots, and network graphs to support intuitive understanding. The dynamic clustering function automatically updates, splits, and merges clusters based on new detection data. It automatically identifies central and influential individuals within a cluster to support the determination of monitoring priorities. Detecting abnormal clusters (e.g., rapid expansion in a short period of time, abnormal behavioral patterns) enables early detection of organizational threats. By analyzing the relationships between clusters, we can infer the existence of larger organizational structures and superordinate groups.

[0045] In at least one embodiment, the listing function for specific clothing and movement patterns classifies and extracts targets based on appearance and behavioral characteristics, enhancing surveillance of specific threat types. This function comprehensively analyzes visual characteristics such as clothing color, pattern, shape, and brand logos, as well as behavioral characteristics such as walking speed, direction of movement, frequency of stops, and turning around. Clothing recognition utilizes a combination of image processing technologies, including fashion item detection, color analysis, texture analysis, and shape recognition. Movement pattern analysis quantifies individual behavioral characteristics using techniques such as posture estimation, gait analysis, and behavior classification. The automatic search function for specific conditions extracts targets based on complex criteria such as "wearing a black hat and mask," "walking unnaturally slowly," and "frequent turning around." Temporal patterns are considered to detect contextual anomalies such as "wearing all black at night" or "wearing clothing other than a suit during the day on a weekday." The similar pattern learning function automatically learns risky clothing and behavior patterns from past cases, improving detection accuracy. The pattern matching confidence score display also indicates the possibility of false positives, supporting a final human decision. Custom pattern definition allows you to define and add threat patterns specific to your facility.

[0046] In at least one embodiment, a list display function with correlation analysis between visit intervals and stay times enables multifaceted evaluation of abnormalities through detailed analysis of temporal behavior patterns. This function statistically analyzes the relationship between each individual's visit interval (time elapsed since the last visit) and stay time (time spent per visit) and visualizes it using scatter plots, regression lines, correlation coefficients, etc. Normal ranges are established using statistical distributions from past data, comparisons with business patterns, and adjustments based on time of day and day of the week. Abnormal patterns are detected by identifying characteristic combinations such as "short intervals with long stays," "long intervals with short stays," and "irregular interval fluctuations." Individual behavioral profiling learns each individual's unique normal patterns and enables personalized anomaly detection. Correlation changes over time are tracked to detect changes in behavior patterns and the progression of abnormalities. A correction function that takes crowd psychology and social factors into account adjusts for the effects of external factors such as events, weather changes, and social conditions. By linking with predictive models, future visit times and stay times are estimated, supporting the optimization of security plans. Statistical significance testing of correlation analysis results is used to distinguish between coincidence and necessity. Correlation analysis across multiple time scales (days, weeks, months) is used to evaluate behavioral patterns from both short-term and long-term perspectives.

[0047] In at least one embodiment, the function for listing suspected stalking behavior automatically detects behavioral patterns characteristic of stalking behavior and helps prevent victimization. This function comprehensively analyzes behavioral elements typical of stalking behavior, such as frequent appearances, following a specific individual, lying in wait, and hidden observation. To learn behavioral patterns, a comprehensive model is constructed based on known stalking cases, expert knowledge, legal definitions, etc. A scoring system that combines multiple behavioral indicators (such as appearance frequency, length of stay, movement patterns, and gaze behavior) enables quantitative assessment of stalking likelihood. Relationship analysis between the target and potential victim detects obsessive behavior toward a specific individual. Temporal pattern analysis detects synchronization with the victim's activity schedule and predictive preemptive behavior. Spatial pattern analysis identifies lying in wait at the victim's activity locations and appearances along the victim's movement route. Detection of escalation provides early detection of escalation of behavior and increased danger. A privacy protection function ensures confidentiality of victim information and ensures that only appropriate authorized personnel can access it. The system supports rapid reporting and coordination with law enforcement agencies in the event of a serious threat, and recommends specific measures such as strengthened security, evacuation guidance, and legal action through its damage prevention proposal function.

[0048] In at least one embodiment, the automatic generation function for a daily high-frequency visitor list automatically extracts individuals with an abnormally high number of visits per day and displays them as priority targets for monitoring that day. This function accommodates daily fluctuations in the normal range by setting adaptive thresholds that take into account business hours, work patterns, seasonal factors, etc. The list generation time can be set to update the list at multiple times, such as the start of work, lunch break, and end of work. The visit count method can be selected from simple entry counts, visits with stays, and stays with significant activity, optimizing it according to the monitoring purpose. Visits with an abnormal frequency for that individual are detected by comparison with individual visit history. A whitelist function is provided to exclude legitimate high-frequency visitors such as business associates, delivery personnel, and maintenance workers. A real-time update function dynamically updates the list according to changes in visit status during the day. A function to estimate the cause of high-frequency visits classifies and displays possible business purposes, personal reasons, abnormal behavior, etc. Comparison with past data distinguishes between continuous high-frequency visitors and temporary high-frequency visitors. The automatic notification function instantly notifies relevant parties of the appearance of frequent visitors exceeding the set threshold.

[0049] In at least one embodiment, the visitor behavior deviation prediction function using an anomaly detection model utilizes machine learning technology to predict deviations from normal visitor patterns in advance, enabling preventative measures. This function learns normal baseline patterns from past visitor data and detects signs of anomalies by combining techniques such as statistical anomaly detection, time series forecasting, and pattern matching. The prediction model uses advanced algorithms such as ARIMA, LSTM, transformer, and isolation forest to capture complex temporal dependencies and nonlinear patterns. Multi-layered anomaly detection at the individual, group, and overall levels detects deviations at various scales. External factors (weather, events, social conditions, etc.) are incorporated as explanatory variables to consider normal behavioral changes due to environmental changes. Confidence intervals for predictions are displayed to quantify uncertainty and provide reference information for decision-making. Ensemble learning integrates predictions from multiple models to achieve more robust anomaly detection. Online learning functions continuously update models based on new data. Prediction results are visualized in a variety of formats, including time series graphs, probability distributions, and risk maps. The model's interpretability function clarifies the factors that underlie anomaly predictions and assists in the development of countermeasures.

[0050] In at least one embodiment, an AI-based automatic suspicious behavior scoring function comprehensively evaluates various behavioral indicators and quantifies the threat level of each target. This function uses machine learning to integrate multiple factors, such as visit frequency, length of stay, movement patterns, gaze behavior, and contact attempts, and expresses the risk level with a score from 0 to 100. Score calculation uses methods such as weighted sum, neural network, decision tree, and ensemble method to adaptively adjust the importance of each factor. Characteristics of behavioral factors are extracted using multidimensional information, such as time series patterns, spatial distribution, social context, and personal history. Dynamic score updating recalculates scores in real time based on new behavioral data, allowing for rapid response to changing situations. A score distribution normalization function appropriately maintains the overall threat level distribution and ensures the stability of relative assessments. Threshold-based automatic classification automatically categorizes targets into categories such as low risk, medium risk, high risk, and maximum alert. Detailed display of score components clearly identifies behavioral factors that cause high scores and clarifies the focus of countermeasures. By comparing with past scores, the system tracks trends in threat levels and enables early detection of escalations. Explainable AI technology makes the basis for score calculations visible, improving the transparency and reliability of the system.

[0051] In at least one embodiment, the pattern anomaly detection function based on past data matching searches for similar patterns in a database accumulated over a long period of time and performs comparative analysis with current behavior. This function evaluates the similarity between past anomaly cases and current situations using techniques such as time series pattern matching, similarity calculation, and statistical testing. Pattern comparison uses time series analysis techniques such as DTW (Dynamic Time Warping), cross-correlation, and mutual information to achieve flexible matching that takes time lags and fluctuations into account. Multidimensional pattern comparison identifies complex anomaly patterns that are difficult to detect using a single indicator. Threat types are estimated based on the category classification of past cases (e.g., intrusion, theft, stalking, vandalism, etc.). Similarity score thresholds are set to extract only past cases with significant similarities and eliminate noise. A time-based weighting function assigns higher importance to recent cases. Geographical considerations prioritize past cases in the same region or similar environments. Pattern evolution tracking detects changes in criminal methods and the emergence of new threat patterns. Visualization of detection results helps users understand abnormalities by overlaying similar patterns and highlighting differences.

[0052] In at least one embodiment, a cross-border surveillance function that links with cameras at other locations creates a wide-area surveillance network spanning multiple facilities and regions, enabling the detection of organizational threats and widespread movement. This function integrates the management of camera systems at multiple locations and automatically correlates the appearance of the same subject at different locations. Data sharing between locations uses secure communication methods such as VPNs, dedicated lines, and cloud services to ensure data confidentiality and integrity. A multiplexing system that combines facial recognition, vehicle identification, and behavioral pattern analysis is built to accurately identify the same person. An automatic time zone adjustment function maintains accurate time synchronization between locations in different time zones. Validation of travel time eliminates physically impossible short-distance travel and prevents false matches. Analysis of inter-location movement patterns supports the identification of planned organizational activities and escape routes. A wide-area alert function instantly shares detections at one location with other locations, enabling coordinated responses. A privacy protection function limits the information shared between locations to the minimum necessary, ensuring appropriate management of personal information. By setting permissions for each location, information viewing and editing permissions can be appropriately controlled to ensure security.

[0053] In at least one embodiment, the revisit prediction function based on person attribute learning learns the relationship between behavioral patterns and external characteristics such as age, gender, clothing, and body type, and predicts the likelihood of future visits. This function integrates attribute extraction through image analysis, correlation analysis with behavioral data, and predictive model construction. Attribute recognition uses computer vision technologies such as facial age estimation, gender determination, clothing classification, and body type estimation to automatically extract various personal characteristics. Correlation analysis between attributes and behavior discovers statistical relationships such as "the pattern of middle-aged men visiting on weekday evenings" and "the tendency of young women to stay in the afternoon on weekends." A time series prediction model estimates future visit timing, frequency, and duration based on individual attributes. Group-level prediction predicts the behavior of new visitors based on the behavioral trends of groups of people with similar attributes. High-precision predictions are achieved by taking into account the interactions between attributes and time factors such as seasonality, day-of-the-week effects, and time-of-day effects. Quantifying the uncertainty of the prediction provides prediction results in confidence intervals and probability distributions. The attribute change tracking function automatically updates the prediction model based on changes in clothing, age, body shape, etc. By utilizing the prediction results, it supports operational improvements such as optimizing personnel deployment and streamlining security plans.

[0054] In at least one embodiment, the predictive visitor detection function detects pre-visit behaviors prior to an actual facility visit, allowing for time to prepare. This function automatically identifies predictive behaviors such as loitering around the perimeter, scouting, driving the wrong way, and unnatural stops, and assesses the possibility of intrusion or criminal activity in advance. A comprehensive model is built to define predictive behaviors, integrating expert knowledge, analysis of past cases, and behavioral psychology theory. Spatial predictive behavior detection monitors abnormal activity around the facility, observational behavior near the boundary, and investigation of intrusion routes. Temporal predictive behavior detection identifies appearances at unusual times of day, gradual approach patterns, and repeated attempts. Behavioral predictive behavior detection detects psychological and physical changes such as unnatural behaviors, signs of tension, and concealing behaviors. By integrating and evaluating multiple predictive behaviors, even minor behaviors can be identified as signs of a serious threat when combined. By predicting the time from the predictive behavior to its execution, a timeline for implementing countermeasures can be established and effective preventive measures can be planned. A tiered warning system promotes appropriate responses according to the level of the warning sign. The learning function of the warning sign detection enables continuous improvement by adapting to new patterns and changes in techniques.

[0055] In at least one embodiment, the automatic update function for the list of suspected individuals based on appearance frequency dynamically adjusts the priority of individuals requiring vigilance based on continuous monitoring data, enabling efficient allocation of monitoring resources. This function comprehensively evaluates factors such as the rate of change in appearance frequency, cumulative risk score, and recent behavioral patterns to automatically promote or demote suspected individuals to a higher or lower level. The update algorithm uses statistical methods such as exponential smoothing, Kalman filtering, and Bayesian updating to optimize the balance between past data and the latest information. Individual learning periods are set to enable adaptive evaluation, such as short-term intensive monitoring of newly detected individuals and focusing on long-term trends for continuously monitored individuals. Dynamic adjustment of list capacity optimizes the number of suspected individuals based on the overall threat level distribution. The automatic exclusion function gradually removes individuals who have not exhibited abnormal behavior for a long period of time from the list, improving monitoring efficiency. The manual intervention function allows administrators to make emergency registrations or exclusions, compensating for the limitations of automated systems. Recording of update history supports tracking and auditing of decision-making rationales. A list change notification function automatically reports important priority changes to relevant parties. Predictive updates enable adjustments of monitored individuals to anticipate future risk changes.

[0056] In at least one embodiment, a risk scoring function linked to local crime history integrates local crime statistics and surveillance data to perform threat assessments that take geographic and temporal context into account. This function correlates and analyzes the facility's own surveillance data with external data such as police statistics, local safety information, and incident histories at nearby facilities. Geographic mapping of crime data identifies high-risk areas, crime-prone times, and trends in crime methods, and reflects these in the behavioral assessment of monitored targets. Time-series crime trend analysis enables dynamic risk assessments that take into account seasonality, day-of-the-week effects, and correlations with social events. A crime type weighting function adjusts the threat level according to the type of crime, such as theft, break-ins, and violent crime. Spatial proximity consideration adjusts the influence of crime history according to distance from the facility. Temporal proximity consideration applies higher weighting to recent incidents to appropriately reflect the current threat level. Crime technique matching increases the vigilance level when monitored targets' behavioral patterns are similar to known criminal techniques. A regional cooperation function establishes a wide-area crime prevention system in cooperation with neighboring facilities, sharing crime information. By taking into consideration legal constraints, we will maintain an appropriate balance between protecting personal information and public safety.

[0057] In at least one embodiment, a future intrusion prediction map generation function based on crime prevention history analyzes past incident data and environmental factors to visualize the spatial distribution of future intrusion risk. This function learns intrusion patterns from data such as past intrusion locations, times, methods, and damage situations, and predicts future risk distribution using machine learning. The prediction model incorporates geographical factors (location, surrounding environment, accessibility), temporal factors (season, day of the week, time of day), and social factors (people flow, events, security situation), etc., as explanatory variables. Spatial statistical methods are used to perform spatial clustering of intrusion incidents, identify hotspots, and predict diffusion patterns. Temporal prediction supports both short-term predictions (days to weeks) and long-term predictions (several months to a year), enabling use according to the timeframe of security planning. The environmental change reflection function incorporates changing factors such as building renovations, increased security, and surrounding development into the prediction model. Uncertainty visualization expresses the reliability of predictions using color intensity and contour lines, providing reference information for decision-making. The effectiveness of countermeasures can be evaluated in advance using a simulation function. Regular model updates ensure continuous improvement in prediction accuracy based on new incident data.

[0058] In at least one embodiment, the subject record evidence function creates and manages data with high evidentiary value for legal proceedings. This function manages records to meet forensic requirements, such as ensuring the integrity of detected data, ensuring the legal validity of timestamps, and maintaining a chain of custody. To prevent data tampering, hash value calculations, electronic signatures, blockchain technology, and other technologies are used to ensure the reliability of data as evidence. Detailed metadata recording comprehensively preserves technical information such as imaging conditions, processing history, analysis methods, and decision-making grounds. The automatic report generation function conforming to legal formats enables output in purpose-specific formats, such as for police submissions and court documents. Consideration for personal information protection is given by extracting only the information necessary for legal proceedings and automatically excluding irrelevant personal information. The automatic evidence preservation alert function provides advance notification of expiration of retention periods, detection of data corruption, and other events. Detailed access log recording enables tracking of all access history to evidentiary data. The multiple format output function enables provision in formats such as PDF, XML, and standardized electronic evidence formats. The expert testimony support function automatically generates explanatory materials and statistical data on technical grounds.

[0059] In at least one embodiment, the automatic blacklisting function for frequent repeat visitors automatically adds subjects exhibiting abnormal behavioral patterns to a watch list, establishing an enhanced monitoring system. This function allows for multi-level setting of registration criteria, enabling automatic classification into levels such as caution, caution, danger, and maximum caution. Registration decisions are made using composite indicators such as frequency of occurrence, time patterns, behavioral characteristics, and past history, providing a comprehensive evaluation beyond simple frequency alone. The automatic registration notification function immediately reports new blacklist registrations to administrators and provides an opportunity for manual review. The automatic deregistration decision allows for a gradual lowering of the watch level for subjects exhibiting improved behavioral patterns. Hierarchical blacklist management controls the gradual sharing of information, including internal lists, law enforcement shared lists, and industry-wide lists. Detailed recording of the reasons for registration allows for tracking of the basis for the decision and subsequent verification. Automatic validity period management enables automatic review after a certain period and expiration notification. The legal consideration function appropriately maintains the balance between human rights protection and public safety and prevents unjustified surveillance. The external database matching function automatically checks for matches with known suspect individuals.

[0060] In at least one embodiment, the same-subject tracking analysis function integrates multiple cameras to enable comprehensive behavioral monitoring throughout the facility and record detailed movement trajectories. This function automatically performs target handover in overlapping camera views, estimates the target's position in blind spots, and reconstructs the entire movement pattern. A robust matching system is built to uniquely identify targets by combining multiple techniques, including facial recognition, gait characteristics, clothing patterns, and body characteristics. Taking into account spatiotemporal constraints, the system detects physically impossible movements and time series inconsistencies and automatically corrects tracking errors. Three-dimensional movement trajectory reconstruction accurately records three-dimensional behavioral patterns, such as movement between floors, elevator use, and staircase movement. Behavior analysis extracts detailed behavioral characteristics, such as movement speed, stopping points, dwell time, and objects of interest. Abnormal movement pattern detection automatically identifies unusual movements, such as getting lost, wandering, intrusions, and escapes. A prediction function predicts the next destination and behavior from current movement patterns, supporting proactive security deployment. Privacy protection features allow access control to detailed tracking data and anonymization as needed. Statistical analysis provides operational improvement data for facility usage patterns, traffic flow optimization, security efficiency, etc.

[0061] In at least one embodiment, an information sharing function with security companies and local governments via API integration enables rapid information transmission and collaborative response between organizations, strengthening crime prevention throughout the region. This function uses standard protocols such as RESTful API, SOAP, and GraphQL to enable smooth data exchange between different systems. Security features include OAuth authentication, API key management, SSL / TLS encryption, and rate limiting to prevent unauthorized access and information leaks. Data format standardization enables information to be provided in common formats such as JSON, XML, and CSV, simplifying processing on the receiving system. Real-time notification supports immediate information sharing and collaborative response in the event of an emergency. Permission-based access control appropriately manages information disclosure levels by organization and individual. Data anonymization ensures the sharing of only necessary security information while protecting privacy. Logging maintains audit trails, enabling transparency of information access and accountability. Automatic switching in the event of a failure ensures information is transmitted via alternative routes in the event of communication failures or system downtime. The two-way communication function not only allows for the provision of information, but also for receiving instructions from security companies and issuing alerts from local governments.

[0062] In at least one embodiment, a psychological state analysis function based on facial expression and emotion recognition estimates a subject's psychological state from subtle changes in facial expressions and detects potential threats or signs of abnormal behavior. This function uses deep learning-based facial expression recognition technology to automatically classify basic emotions such as joy, anger, sadness, fear, surprise, disgust, and neutral. Microexpression analysis detects true psychological states from intentionally concealed emotions and momentary changes in facial expressions. Tracking patterns of emotional changes over time detects the progression of dangerous psychological states such as increased tension, growing hostility, and panic. Stress indicator calculation quantifies psychological stress from stiffened facial expressions, unnatural smiles, and eye movements. Abnormal psychological pattern detection identifies tension before a crime, anxiety during an escape, and changes in facial expression when lying. A learning function that takes individual differences into account sets each person's normal facial expression as a baseline to enable personalized anomaly detection. A cultural background consideration function incorporates differences in facial expressions due to ethnicity and region into the learning process. To ensure privacy, we will implement anonymization of emotional data and appropriate storage period management. By integrating it with psychological knowledge, we will improve the accuracy of behavior prediction and propose appropriate countermeasures.

[0063] In at least one embodiment, the voice recognition and conversation anomaly detection function analyzes audio within the monitored area to automatically detect threats, violent remarks, abnormal conversation patterns, etc. This function combines acoustic processing technologies such as high-performance microphone array sound collection, noise cancellation, and sound source separation. Voice recognition uses deep learning-based automatic speech recognition technology to accommodate a variety of voice patterns, including multiple languages, dialects, whispers, and rapid speech. Natural language processing of the conversation content performs sentiment analysis, intent estimation, and threat level determination. Keyword detection instantly detects the appearance of dangerous words such as "bomb," "kill," and "threat" and triggers an alert. Voice pattern analysis detects emotional changes such as shouts, screams, and abnormal excitement. Speaker identification tracks individual speech in multi-person conversations and compares it with past voice data. Environmental sound analysis also detects physical anomalies such as shattering glass, metallic sounds, and unusual mechanical sounds. The privacy protection feature ensures appropriate anonymization of conversation content and record keeping in accordance with legal requirements, while the real-time translation feature instantly understands conversations in foreign languages, making it suitable for international surveillance environments.

[0064] In at least one embodiment, the drone-linked automatic tracking function integrates unmanned aerial vehicles and ground camera systems to achieve comprehensive surveillance and dynamic target tracking in three-dimensional space. This function automatically transfers a target detected by a fixed camera to a drone, enabling continuous tracking from the air. The drone's automatic launch system enables rapid deployment when an emergency is detected and automatic flight according to a pre-defined flight plan. High-precision automatic flight combining GPS guidance and computer vision enables safe tracking flight in complex environments, such as between buildings and trees. Cooperative control of multiple drones enables simultaneous wide-area surveillance, multi-angle photography, and long-term relay tracking. Real-time video transmission enables high-quality video distribution to a ground monitoring center and automatic analysis using AI. The battery management function supports unmanned operations, including automatic charging, battery replacement, and automatic switching to a backup aircraft. The weather response function makes safe flight decisions taking into account environmental factors such as wind speed, precipitation, and visibility. The aviation regulatory compliance function enables avoidance of no-fly zones, compliance with altitude restrictions, and automatic acquisition of flight permits.

[0065] In at least one embodiment, 3D surveillance functionality using AR / VR technology utilizes augmented reality and virtual reality technologies to provide a three-dimensional, intuitive surveillance environment that goes beyond traditional 2D images. This functionality integrates video from multiple cameras to generate a 3D model, enabling free-viewpoint surveillance within a virtual space. AR display overlays target information, movement trajectories, warning displays, and other information on real-world surveillance footage to support efficient situational awareness. VR environments enable immersive surveillance, allowing monitors to move freely within the virtual space and observe targets from any angle. 3D human modeling records and analyzes detailed physical characteristics of targets, such as height, body shape, and posture, in three dimensions. Visualization of spatial relationships allows intuitive understanding of physical relationships between targets, such as distance, relative position, and crowd formation. A time-series 3D playback function recreates past events in three dimensions, enabling detailed post-event analysis. A haptic feedback function provides tactile notifications of abnormalities and a sense of physical manipulation in the virtual space. The multi-user VR function allows multiple observers to share the same virtual space, enabling collaborative monitoring. In conjunction with a 360-degree camera, it enables three-dimensional display of omnidirectional images and comprehensive monitoring without blind spots.

[0066] In at least one embodiment, the weather data integration function analyzes the correlation between weather conditions and human behavior to achieve highly accurate behavioral predictions that take weather factors into account. This function acquires detailed weather information, such as temperature, humidity, wind speed, precipitation, and sunshine, from data from the Japan Meteorological Agency, private weather services, and on-site sensors. Seasonal analysis learns the impact of seasonal changes (spring, summer, fall, and winter) on human behavior patterns and incorporates this information into the prediction model. Analysis of behavioral patterns by weather identifies differences in visit frequency, length of stay, and movement patterns under weather conditions such as sunny, rainy, snowy, and strong winds. Integration with weather forecasts enables prediction of people flow, congestion, and the probability of abnormal behavior based on future weather forecasts. The extreme weather response function automatically establishes special monitoring systems for abnormal weather such as typhoons, heavy rain, and extreme heat. Calculation of perceived temperature analyzes the relationship between human comfort indexes, which combine temperature, humidity, and wind speed, and behavioral patterns. Considering indoor and outdoor temperature differences, the relationship between the impact of air conditioning equipment and human behavior is incorporated into the predictions. By linking with weather alerts, we will be able to support evacuation actions and ensure safety when weather warnings are issued. By utilizing long-term climate data, we will be able to predict long-term changes in behavioral trends that take into account the effects of climate change.

[0067] In at least one embodiment, the social media and internet information collaborative analysis function integrates public information from social media and the internet with monitoring data to achieve more comprehensive threat assessment. This function collects public posts from social media platforms such as Twitter®, Facebook®, and Instagram® and extracts threat-related information using natural language processing. By analyzing posts with location information, it collects advance information on unusual gatherings, protests, events, etc. around the facility. By using sentiment analysis, it detects rising negative sentiment toward the facility or organization, enabling early detection of potential threats. By collecting information from news sites, bulletin boards, blogs, etc., it monitors incidents, troubles, rumors, etc. related to the facility. By using image analysis, it detects reconnaissance activities, leaks of internal information, disclosure of security holes, etc. from photos of the inside and outside of the facility posted on social media. By using trend analysis, it monitors the rapid spread of specific hashtags, keywords, and topics to detect signs of flame wars and protests. The fake news detection function distinguishes between the spread of false information and actual threats. Privacy protection features target only public information and prevent unauthorized access to private information of individuals. Consideration of legal restrictions ensures the lawfulness of information collection and maintains an appropriate balance with freedom of expression.

[0068] In at least one embodiment, the automated crowd density and congestion management function achieves safe and efficient pedestrian flow control through real-time people counting and density analysis. This function uses computer vision technology to accurately count people, visualize density distribution, and automatically determine congestion levels. Crowd behavior analysis detects collective abnormalities such as changes in crowd psychology, signs of panic, and signs of riots. Dynamic capacity management sets appropriate capacity limits for each area, preventing overcrowding and guiding pedestrian flow appropriately. In conjunction with entrance and exit control, it automatically implements measures such as entry restrictions, one-way traffic, and evacuation guidance based on the congestion situation. The prediction function predicts future congestion situations based on current pedestrian flow patterns and supports the implementation of proactive countermeasures. In conjunction with the audio system, it automatically issues announcements to alleviate congestion, provides guidance, and issues emergency evacuation instructions. In conjunction with digital signage, it displays congestion situations, guides users to alternative routes, and provides wait time information. In conjunction with external systems, it shares congestion information with transportation operators, related facilities, event organizers, and others. By accumulating statistical data, it helps analyze congestion patterns by time of day, day of the week, and season, and develops optimal staffing plans.

[0069] In at least one embodiment, the odor and chemical detection integration function integrates gas and chemical sensors with the surveillance system to detect chemical threats that cannot be detected by visual surveillance. This function detects hazardous substances such as flammable gases, toxic gases, explosives, drugs, and chemical weapons, and performs comprehensive threat assessment of human behavior through video analysis. By combining sensor data and image data, the system automatically detects chemical substances and simultaneously identifies the individual at the source. When abnormal odors or chemical substances are detected, the system automatically focuses video surveillance on the relevant area and strengthens behavioral analysis of related individuals. Air quality monitoring continuously records environmental data such as ventilation status, air cleanliness, and pollutant concentrations to prevent health damage. By assessing the level of chemical threats, it automatically issues tiered warnings and implements response procedures, ranging from minor anomalies to life-threatening threats. By linking with wind direction and speed data, the system can predict the spread of chemical substances and estimate the extent of their impact. By linking with an evacuation guidance system, the system automatically selects and guides safe evacuation routes in the event of a chemical threat. The external reporting function automatically notifies the fire department, police, chemical substance disposal specialist organizations, etc. Analysis of historical data helps identify patterns of chemical abnormalities, identify causes, and develop measures to prevent recurrence.

[0070] In at least one embodiment, the automatic lighting and environmental control interlocking function integrates the monitoring system with building facilities to achieve automatic environmental control that balances security and convenience. This function automatically turns lights on and off, adjusts brightness, and changes color temperature based on person detection, achieving both energy savings and improved visibility. Enhanced lighting upon abnormality detection automatically ensures sufficient brightness for a deterrent effect, improved visibility, and evidence preservation. Linking with the air conditioning system optimizes temperature, humidity, and ventilation based on the number of people and length of stay. Linking with security gates automatically locks doors when suspicious individuals are detected and automatically unlocks doors for authorized users. Integration with the sound system automatically plays background music, warning sounds, and announcements according to the situation. Linking with digital signage dynamically displays visitor guidance, warning messages, evacuation guidance information, and more. Linking with elevator control automatically restricts access based on security levels and operates designated elevators in emergencies. Automatic window and blind control protects privacy, saves energy, and improves crime prevention. Integration with IoT devices enables integrated environmental control and security management across the entire smart building.

[0071] In at least one embodiment, a data tamper-proofing function using blockchain technology utilizes distributed ledger technology to cryptographically guarantee the integrity and reliability of surveillance data. This function assigns hash values ​​to all data, such as surveillance footage, detection logs, and analysis results, and records them on the blockchain to enable tamper detection. A smart contract function automatically manages data access permissions, storage periods, deletion conditions, and other information, achieving highly transparent data governance. Distributed storage eliminates single points of failure and improves the availability and fault tolerance of the entire system. Integration with a timestamp service ensures the legal validity of the data creation time, increasing its evidentiary value. A multi-signature function requires approval from multiple authorized parties for important data operations, preventing internal fraud. The use of private and public blockchains optimizes the balance between confidentiality and traceability. Zero-knowledge proof technology enables the function of proving the validity of data without disclosing its contents. Automatically generating audit trails records all data access and operation history in an unalterable form. The ability to respond to legal requirements supports long-term data storage, proof of integrity, and submission of evidence in court.

[0072] In at least one embodiment, the ultra-high-speed data transfer function using 5G / 6G communications utilizes next-generation mobile communications technology to achieve real-time transmission of large volumes of video data and low-latency control. This function transmits large volumes of data, such as 4K / 8K high-resolution video, 360-degree video, and 3D video, without delay, enabling high-precision remote monitoring. By linking with edge computing, AI processing is performed near the base station, reducing network load and improving responsiveness. The network slicing function creates a virtual network dedicated to the surveillance system, ensuring stable communication unaffected by general communication traffic. Ultra-low latency communication enables time-critical functions such as real-time control, immediate warning distribution, and instantaneous situation sharing. Massive IoT support allows simultaneous connection of a large number of sensors and cameras to build a comprehensive surveillance network. The mobile monitoring function enables high-quality video transmission from mobile security guards, patrol vehicles, drones, etc. Communication security during disasters enables continued operation of the surveillance system via wireless communication even when fixed lines are down. The AI ​​optimization function automatically performs optimization such as image quality adjustment, bandwidth control, and priority setting according to communication conditions. Support for international roaming enables seamless integration with monitoring systems at overseas bases.

[0073] In at least one embodiment, the real-time processing function of edge computing achieves ultra-low latency detection, analysis, and response through distributed AI processing near the camera. This function deploys edge devices at each monitoring point and performs localized AI processing to instantly detect anomalies and perform initial response. The distributed processing architecture reduces the communication load on the central server, enabling continued localized monitoring even during network outages. Real-time image analysis enables person detection, facial recognition, and behavior analysis in milliseconds, supporting immediate response to instantaneous threats. The hierarchical processing system optimizes the division of roles between primary processing at the edge, advanced analysis in the cloud, and overall management on an integrated server. Automatic load balancing enables dynamic task allocation based on the processing capacity and load status of each edge device. The distributed deployment of machine learning models enables independent learning on each edge device while sharing knowledge across the entire system. The fog computing function enables collaborative processing among multiple edge devices and integrated analysis in the middle layer. The real-time synchronization function ensures time synchronization of distributed processed data and maintains overall consistency. Automatic management of edge devices enables remote maintenance such as fault detection, automatic recovery, and software updates.

Claims

1. A security camera system, an imaging means for capturing an image of a monitored area to acquire video data; an analysis means for detecting a person or a vehicle from the video data and identifying whether the same object appears once or multiple times; a recording means for recording the appearance history of the same object as time-series data; a determination means for calculating statistical indicators including the frequency of appearance of the same object, the duration of stay, and the interval between visits based on the appearance history, and for determining stalking behavior or suspicious wandering behavior as abnormal behavior by comparing the calculated statistical indicators with a preset threshold value; A security camera system comprising:

2. The security camera system according to claim 1, The analysis means includes a privacy protection means for anonymizing personal information by masking the detected face image of the person; A linking means for notifying a security company or a police agency of the abnormal behavior determination result. The security camera system further comprises:

3. The security camera system according to claim 1, The security camera system is characterized in that the analysis means performs facial recognition, clothing recognition, and vehicle license plate recognition from the video data, thereby improving the accuracy of identifying the same object.

4. A security camera system according to claim 1, The security camera system is characterized in that the determination means analyzes the movement speed, movement direction, and changes in the area of ​​stay as behavioral characteristics of the same object.

5. A security camera system according to claim 1, A security camera system characterized in that the analysis means and the judgment means identify the same object and judge abnormal behavior using an artificial intelligence model using deep learning.

6. A security camera system according to claim 1, The security camera system is characterized in that the determination means acquires weather data, congestion status, and crime history data for the monitored area and reflects this in determining abnormal behavior.

7. A security camera system according to claim 1, The security camera system is characterized in that the recording means records the appearance history in cloud storage.

8. A security camera system according to claim 1, The security camera system is characterized in that the photographing means includes multiple camera types including fixed cameras, rotating cameras, and drone-mounted cameras.

9. A security camera system according to claim 1, The security camera system is characterized in that the determination means further comprises warning means for issuing a warning by voice, display, or remote notification when the abnormal behavior is detected.

10. The security camera system according to claim 1, The security camera system is characterized in that the recording means encrypts and records the appearance history using quantum cryptography.

11. The security camera system according to claim 1, The security camera system is characterized in that the determination means further comprises an adjustment means for dynamically adjusting the monitoring frequency or monitoring range of the monitored area based on the abnormal behavior determination result.

12. A monitoring method using a security camera system, comprising: an imaging step of imaging the area to be monitored and acquiring video data; an analyzing step of detecting people or vehicles from the video data and identifying single or multiple occurrences of the same object; a recording step of recording the appearance history of the same object as time-series data; a determination step of calculating statistical indicators including the appearance frequency, stay time, and visit interval of the same object based on the appearance history, and comparing the calculated statistical indicators with a preset threshold value to determine stalking behavior or suspicious wandering behavior as abnormal behavior; A monitoring method using a security camera system, comprising: