22 results about "Normal behaviour" patented technology

A method of behavior monitoring includes determining, by one or more trained behavior models associated with a monitored asset, output data indicative of operation of the monitored asset. The method also includes determining a risk score based on the output data and determining feature importance data based on the output data. The method further includes determining whether to generate an alert based on the risk score and the feature importance data.

The invention discloses a user behavior analysis method and system.The method comprises the steps that on the basis of normal behavior data of a user, frequent item sets and rare item sets of normal behaviors are mined from mass unlabeled behavior data, and an accurate basis is provided for data classification; a rare item set is used as a standard to divide majority class and minority class data sets, and minority class data is anchored based on rare features, so that the processing accuracy is improved; performing N times of conversion on the majority class data set based on the rare item set, classifying the converted data into a minority class data set, dynamically balancing the two classes of data, and improving the sensitivity of the model to a minority class normal behavior mode; and constructing a user behavior graph and a graph neural network learning model based on the balanced training data, carrying out structured representation on a user complex behavior pattern, inputting graph neural network learning to obtain a graph structure, nodes and edge features of a normal behavior pattern, inputting actual user behavior data into the trained model, and outputting an accurate user behavior analysis result.

This application relates to a behavior detection method, apparatus, computer device, computer-readable storage medium, and computer program product. The method includes: acquiring client behavior, a key feature detection set, and a full feature detection set; the key feature detection set is obtained by extracting and summarizing from the full feature detection set; detecting client behavior based on the key feature detection set; if the client behavior does not contain any key features from the key feature detection set, the client behavior is determined to be normal behavior; if the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior based on each full feature detection set; if the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior. This method can improve the efficiency of client behavior detection.

The application relates to the technical field of industrial control safety, in particular to a PLC runtime abnormal behavior identification method and system based on a behavior model, which comprises the following steps: S1, in the PLC program running process, a behavior monitoring module performs real-time monitoring and preliminarily judges abnormal behavior; S2, normal behavior and abnormal behavior are filtered out respectively according to the monitoring results of the behavior monitoring module, and behavior rule extraction is performed on the behavior monitoring module; and S3, behavior modeling is performed based on the extracted behavior rules, normal behavior model generation or update of behavior rule information files is performed on the detected normal behavior, and abnormal behavior model learning of abnormal characteristics, rapid abnormal identification and measure processing are performed on the detected abnormal behavior. The application uses a data model to describe the normal behavior model of the control behavior and the process behavior through the dependent relationship of the normal input and output data of the control and controlled process, so that the intrusion behavior can be accurately identified, and active defense can be performed.

The application discloses a railway ticket intelligent safety monitoring and early warning system and belongs to the technical field of safety monitoring. Through the combination of MSET and SPRT, complex and changeable normal behavior patterns in a ticket network can be effectively captured, and abnormal behaviors can be quickly identified through accurate statistical inference. Compared with a traditional fixed threshold detection method, the accuracy of abnormal detection is greatly improved, and the false negative rate and the false positive rate are reduced, thereby providing strong support for timely discovery and treatment of safety hazards. In combination with a multilayer and multimodal safety monitoring and early warning mechanism, the system can comprehensively, timely and accurately monitor safety threats in a ticket operation environment, timely discovers and early warns potential risks, and makes real-time defense according to the early warning, so that the safety accident rate is effectively reduced.

A method for automatically scoring primate actions based on a behavioral interaction network includes the following steps: Step 1, acquiring primate video images, scoring and labeling them; the primate video images include normal behavior, post-medication behavior, and sham surgery behavior; Step 2, extracting monkey features from the primate video images using a neural network; training the neural network three times using the monkey features: the first training input is monkey features for normal behavior, the second training input is monkey features for sham surgery behavior, and the third training input is monkey features for post-medication behavior; finally, outputting the primate action score through a GAP layer and a fully connected layer.

Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.

The invention relates to the technical field of intelligent nursing, solves the problem that abnormal behaviors of old people cannot be accurately predicted and identified in the prior art, and provides an old people behavior monitoring method and device based on rule mining, equipment and a medium. The method comprises the following steps: according to historical video stream data, acquiring behavior characteristic data of a target old person in different time periods; mining the action feature data in different time periods according to a time sequence matching algorithm, and obtaining a behavior pattern of the target old person and corresponding behavior rule data; establishing a normal behavior pattern library according to the behavior pattern and the corresponding behavior rule data; according to real-time video stream data and the normal behavior pattern library, judging whether the target old person has an abnormal behavior or not; and when the abnormal behavior exists, giving an alarm according to the abnormal behavior. The method can improve the comprehensive behavior analysis capability, thereby improving the accuracy and stability of abnormal behavior recognition.

An object of a system according to an embodiment is to analyze behavior history data, detect an abnormal behavior, and notify the abnormal behavior.SOLUTION: A system includes a collection unit, an analysis unit, and a notification unit. The collection unit collects action history data. The analysis unit analyzes the data collected by the collection unit and compares the data with a normal behavior pattern to detect an abnormal behavior. The notification unit notifies the abnormal behavior detected by the analysis unit.SELECTED DRAWING: Figure 1

Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.

The invention belongs to the technical field of intelligent Internet of Things, and particularly discloses an indoor behavior analysis and safety monitoring method and system based on multi-source perception, which can realize accurate identification and monitoring of specific daily behaviors of a user through multi-source data fusion and habit portrait matching, effectively distinguish normal behaviors from abnormal conditions, and greatly reduce the monitoring false alarm rate; the subentry early warning rule and the weighted statistical rule are combined, so that the monitoring early warning has a clear basis, and the credibility and the disposal efficiency of the early warning are improved; only non-sensitive water, electricity, gas and heat data are analyzed, privacy information such as human faces, videos and biological characteristics is not involved, and in combination with hierarchical authority management, user privacy is protected to the maximum extent while safety is guaranteed; the user does not need to wear any equipment, the existing indoor layout does not need to be changed, and all-weather non-inductive safety monitoring on the user can be realized; and the monitoring pressure of a monitoring party can be effectively reduced while the direct and indirect monitoring cost is reduced.

The invention discloses an abnormal behavior recognition method and system, relates to the field of network security protection, and solves the problem of low recognition accuracy of abnormal behaviors in a network. According to the embodiment of the invention, through multi-dimensional feature modeling, the feature tensor for comprehensively describing network behaviors is constructed, the problem of one-sidedness of traditional single-dimensional features is solved, and the essential difference between normal and abnormal behaviors can be depicted more finely; normal behaviors are modeled through multi-dimensional Gaussian distribution, the probability density of the normal behaviors is accurately described, and false alarms caused by normal fluctuation can be reduced; and the decision boundary is adjusted in real time through Bayesian inference, so that the change of the network state can be adapted, and the problem that the accuracy of a traditional fixed threshold is reduced due to environment change is avoided. According to the whole method, a closed loop from accurate sensing and reliable modeling to intelligent decision making is formed, and high-accuracy and low-false-alarm detection of abnormal behaviors in a high-dynamic network environment is achieved.

The present application relates to the field of computer vision, and particularly relates to a kind of unsupervised classroom head posture concentration analysis method, device and equipment. Including: the video data of student video segment in the monitoring video data in classroom scene is collected;Extract the posture parameter reflecting the change of student head posture, and construct the corresponding head posture time series data based on continuous time segment;Head posture time series data is analyzed and processed, and multi-dimensional feature data for representing student head posture behavior mode is constructed;Multi-dimensional feature data is processed by unsupervised anomaly detection, and the abnormal analysis result for representing the degree of deviation of student current head posture behavior from normal behavior mode is determined;The corresponding student concentration analysis result is generated and output.The present application realizes the stable analysis of student concentration in classroom monitoring scene without manual annotation data and without relying on high-resolution facial expression information, and is suitable for low-resolution, frequently occluded real classroom environment.

The present application relates to the technical field of fall detection, and relates to an old person fall detection and alarm system based on a multi-modal sensor.The present application collects the height of the center of gravity from the ground in real time, combines the allowable height deviation of the detection object, analyzes whether the center of gravity is moving downward, calculates the azimuth of the center of gravity displacement based on the displacement vector of the center of gravity in the reference rectangular coordinate system, constructs a real-time center of gravity feature parameter set, obtains the azimuth of the hands and the distance from the hands to the center of gravity within a set time period, combines the center of gravity feature parameter set and the historical normal behavior data set of the detection object, determines whether the current state is reasonable, if not, analyzes the overall offset consistency based on the azimuth of the center of gravity offset and the azimuth of the hands, combines the time sequence of the height of the center of gravity from the ground and the height of the hands from the ground to determine whether a fall has occurred, reduces the false alarm and missed alarm probability, improves the recognition accuracy of the detection system, and guarantees the personal safety of the old people.

The application discloses a user behavior analysis method and system, which is based on normal behavior data of users, mines frequent item sets and rare item sets of normal behaviors from massive unlabeled behavior data, and provides accurate basis for data classification; divides majority class and minority class data group sets according to the rare item sets, anchors the minority class data relying on the rare features, and improves processing accuracy; converts the majority class data group N times based on the rare item sets, classifies the converted data into the minority class data group set, dynamically balances the two types of data, and improves the sensitivity of the model to the minority class normal behavior mode; constructs a user behavior graph and a graph neural network learning model based on the balanced training data, structurally represents complex behavior modes of users, inputs the graph neural network learning to obtain the graph structure, node and edge features of the normal behavior mode, inputs actual user behavior data into the trained model, and outputs accurate user behavior analysis results.

The present application relates to the technical field of pet behavior data processing, and discloses a spatio-temporal sequence data processing method and system for pet abnormal behavior recognition, comprising the following steps: step 1, acquiring multi-modal data and time alignment, establishing a multi-scale scene semantic graph, and generating a grid occupation frequency and a region transfer matrix; step 2, constructing a normal behavior template library and generating window-level spatio-temporal features; step 3, using a generative density model to establish a group normal behavior distribution, combining a time series prediction model to calculate a residual error, and obtaining individual model parameters; step 4, statistically analyzing historical rhythm distribution and calculating daily differences to obtain rhythm deviation degrees; step 5, fusing multi-component abnormalities to obtain a comprehensive abnormality score; step 6, introducing a thing networking event to generate a gating coefficient and adjust the abnormality score; and step 7, comparing the gated abnormality score with a threshold value and outputting an abnormality alarm. The present application realizes accurate recognition and stable alarm of pet abnormal behavior.

The invention relates to an air conditioner and a control method thereof, a storage medium and a program product. The method comprises the steps that behavior feature information and individual feature parameters of a target animal are obtained; the behavior characteristic information comprises the distance between the target animal and the air conditioner, the movement rate of the target animal and the effective action frequency of the target animal; the individual characteristic parameters comprise animal weight and animal type; determining a preset comparison rule corresponding to the target animal according to the individual feature parameters based on a preset animal feature threshold library; the animal characteristic threshold value library comprises the behavior state of the target animal and the threshold value range of the corresponding behavior characteristic information; the behavior state comprises a normal behavior state and an abnormal behavior state; the abnormal behavior state comprises a temperature discomfort state; and based on a preset comparison rule, according to the behavior feature information, identifying a current abnormal behavior state of the target animal. According to the method, the air conditioner can recognize the temperature discomfort state of the target animal more accurately.

The invention discloses a behavior anomaly detection method based on a normalized stream. The behavior anomaly detection method comprises the following steps: acquiring skeleton data representing a human body posture sequence; calculating a group of prototype mixing coefficients according to the skeleton data through a gating network; synchronously applying the same group of prototype mixing coefficients to cooperative work of two technical components, namely, in a first component, constructing a dynamically weighted multi-modal scoring kernel, and evaluating potential representation by the scoring kernel by mixing a plurality of behavior prototype centers so as to directly describe a plurality of normal behavior modes; the second component is used for performing selective conditional modulation on an internal layer of a normalized stream transformation network, so that the network can adaptively adjust internal feature mapping according to an input behavior type; calculating a comprehensive abnormal score based on the output of the multi-modal scoring kernel and the volume variation of the normalized flow transformation; judging whether the current behavior is abnormal according to the abnormal score; according to the invention, the accuracy of anomaly detection is improved.

Methods and apparatus automatically identify which Internet-of-Things (IoT) devices within a set are behaving in a manner non-compliant with a target behavior. Each IoT device is assigned to a grid point in a notional m-dimensional space. A respective assessment module is arranged to monitor behavior of a group of IoT devices assigned to grid points aligned with one another at a respective position along the respective dimension, and to produce an output indicative of non-compliant behavior if the monitoring indicates that behavior in the group of IoT devices deviates from a behavioral model of the IoT devices of said group. An identification module identifies at least one non-compliant IoT device in the set of IoT devices by combining outputs from the assessment modules assigned to the different dimensions of the space. The assessment modules may use trained machine-learning algorithms embodying a model of normal behavior of the group of devices.

The invention discloses a security authentication method and device and electronic equipment, relates to the technical field of computers, and is used for improving the security of security certification. The method comprises the following steps: firstly, acquiring behavior data of N dimensions generated when a user performs security certification; then, performing emotion prediction on the user by adopting a pre-trained emotion recognition model based on the behavior data to obtain a current corresponding emotion category of the user; and finally, obtaining a risk score corresponding to the user based on the emotion category and a behavior-emotion baseline corresponding to the user under the emotion category, and executing a preset security authentication strategy based on the risk score. Through the method, the emotion category of the user and the corresponding normal behavior-emotion baseline can be predicted in real time, and then the behavior data acquired in real time is compared with the normal behavior data, so that whether the user performs security verification in an abnormal state or not is determined, the user is prevented from being forced to log in a corresponding application scene, and the user experience is improved. And data leakage and the like occur.

The invention discloses a network threat sensing method, device and equipment based on user habits. The method comprises the following steps: collecting behavior data of a user on a network; establishing a behavior reference model of the user by utilizing the behavior data of the user on the network, and describing normal behavior modes and habits of the user based on the behavior reference model; the network behavior of the user is monitored in real time and compared with the behavior reference model, so that whether an abnormal behavior exists or not is detected; identifying and analyzing abnormal behaviors based on a machine learning algorithm or a statistical method, determining whether security threats exist, and sending an alarm and a notification to an administrator; if security threats are found, security measures are taken; and improving and optimizing the behavior benchmark model based on the network activity data information collection of the user so as to improve the network security. According to the invention, potential security threats can be found and dealt with timely, so that the network security is improved, and the network security risk is reduced.

The application relates to an EL-YOLO-based abnormality monitoring method for an old people gathering place, which comprises the following steps: S1, collecting monitoring video data streams in the old people gathering place, constructing image data sets containing normal behaviors and abnormal behaviors, and labeling targets in the images; S2, constructing an abnormal behavior detection network based on an EL-YOLO model; S3, training the EL-YOLO model by using the labeled data set; S4, deploying the trained EL-YOLO model to an edge computing device, accessing real-time video streams of cameras in the place, frame by frame or frame skipping detecting video frames, and identifying human targets and postures of the old people in the pictures; and S5, judging whether abnormal behaviors exist according to the detection results, which has the advantages of providing all-weather and intelligent safety protection for the old people gathering places such as communities and nursing homes, and significantly reducing health risks of the old people caused by unexpected accidents.