48 results about "Normal behaviour" patented technology

The invention relates to the technical field of pet behavior data processing, and discloses a time-space sequence data processing method and system for pet abnormal behavior recognition, and the method comprises the steps: 1, obtaining multi-modal data, carrying out the time alignment, building a multi-scale scene semantic graph, and generating a grid occupancy frequency and a region transfer matrix; 2, constructing a normal behavior template library, and generating window-level spatio-temporal features; 3, establishing group normal behavior distribution by using a generative density model, calculating a residual error in combination with a time sequence prediction model, and obtaining individual model parameters; 4, performing statistics on historical rhythm distribution and calculating differences of the day to obtain rhythm deviations; 5, fusing multi-component anomalies to obtain a comprehensive anomaly score; step 6, introducing an Internet of Things event to generate a gating coefficient and adjusting an abnormal score; and 7, comparing the abnormal score after gating with a threshold value, and outputting an abnormal alarm. According to the invention, accurate identification and stable alarm of the abnormal behavior of the pet are realized.

The invention belongs to the technical field of artificial intelligence, and discloses an operation behavior characteristic-driven rehabilitation training effect dynamic evaluation method, which comprises the following steps of: extracting compensatory behavior characteristics and recessive behavior mode characteristics by acquiring multi-dimensional operation behavior data and physiological sensor data of a patient on a simulated driving device; and constructing a behavior pattern migration feature set. And calculating a behavior pattern migration index based on the compensatory behavior characteristics in the characteristic set, and accurately identifying the progressive transformation process of the patient from the compensatory behavior to the normal behavior. Further constructing a rehabilitation capability dynamic evaluation model, generating a real-time rehabilitation capability score, dynamically adjusting the complexity of a simulated driving scene, collecting adaptive behavior data, constructing a behavior mode migration trend curve and a rehabilitation effect prediction model, and realizing closed-loop optimization of a personalized training scheme. According to the method, subjectivity and static limitation of traditional rehabilitation evaluation are broken through, and the accuracy and effectiveness of neural rehabilitation are remarkably improved.

The invention provides a personal health abnormal behavior monitoring system fused with unsupervised learning, and relates to the technical field of data processing, and the system is used for carrying out the clustering processing of historical behavior data, dividing the historical behavior data into a plurality of behavior tags, extracting the feature vector of each behavior tag, building an individual behavior physical model according to the feature vector, and carrying out the analysis of the individual behavior physical model. Inputting the target feature data into the individual behavior physical model, calculating the deviation degree of the recent behavior of the user, monitoring and recording the deviation degree to obtain an observation label group, judging whether the observation label group meets the absorption condition of the individual behavior physical model or not, if not, judging that the behavior label is an abnormal behavior, and if not, judging that the behavior label is an abnormal behavior. And according to the deviation degree and the duration of the abnormal behavior, calculating a behavior inhibition factor, and according to the behavior inhibition factor, dynamically adjusting the individual behavior physical model to limit the abnormal behavior from being identified as a normal behavior. According to the invention, the system can be prevented from mistakenly considering periodic abnormal behaviors as normal behaviors.

The invention provides a personnel abnormal behavior detection and alarm system based on a real-time video, and relates to the technical field of behavior detection, and the system comprises a data collection module which is used for capturing a video image of a target monitoring area in real time, and carrying out the video processing, and obtaining first video data; the model training module is used for acquiring historical video data of a target monitoring area and identifying and extracting key features of target personnel so as to perform behavior modeling to obtain a first normal behavior model and a first abnormal behavior model; the behavior detection module is used for comparing current video frame data in the first video data with a first normal behavior model, and if an abnormal behavior exists, determining a first behavior detection result based on the current video frame data; and the alarm processing module is used for comprehensively determining alarm information of the target monitoring area according to the first behavior detection result and the monitoring area information, and carrying out abnormal behavior alarm. The behavior model can be adjusted in real time, and the monitoring flexibility and the behavior detection accuracy are improved.

The invention discloses a monitoring analysis method and system based on big data, and relates to the technical field of monitoring data analysis, and the method comprises the following steps: S1, collecting multi-source behavior perception data in real time, carrying out the data preprocessing, and constructing a fusion data flow structure; s2, constructing a time sequence video analysis model, outputting an atomic behavior tag sequence, extracting key micro-feature indexes, and performing judgment and evaluation on individual behavior offset; s3, on the basis of the atomic behavior tag sequence, constructing a behavior sequence diagram, performing behavior chain matching and evolution evaluation, and taking exception supervision measures; s4, comprehensive risks are evaluated through the multi-source behavior perception data, and graded early warning is carried out; s5, manual auditing and event label feedback are carried out, abnormal behaviors are judged, and whether the behaviors deviate from a normal mode or not is analyzed; the problem that in dense areas such as shopping mall corridors and escalators, some theft preparation behaviors do not have the violent characteristic, are submerged by normal behaviors and cannot be captured is solved.

This application provides a method and system for detecting and protecting software supply chain risks. Among them, third-party components are obtained from the software supply chain, and their multi-level dynamic behaviors are analyzed; the Bayesian network algorithm is used to predict risk behavior patterns and construct a behavior pattern library; the behaviors during the runtime of third-party components are monitored, and the behavior data stream is recorded; the time series anomaly detection algorithm of deep learning is applied to identify abnormal behaviors that deviate from the normal behavior pattern; the graph neural network is used to evaluate the risk level of abnormal behaviors, and combined with the relevance and propagation path between behaviors, an abnormal behavior list is generated; according to the list, through the adaptive policy selection algorithm, the response policies in the security control measure library are dynamically adjusted to formulate security control measures for third-party components. This application improves the ability to identify and predict potential risk behaviors.

A computer implemented method for detecting anomalous behaviour within a system is provided. The method generates an autoencoder for detecting anomalous behaviour within the system. The method also generates a classifier for predicting a classification of behaviour within the system. An input to the classifier comprises an output from one or more internal layers of the autoencoder. The method jointly trains the autoencoder and the classifier using a set of training data comprising a plurality of sample inputs that represent normal behaviour within the system and a plurality of sample inputs that represent anomalous behaviour within the system. The training is based on an output from a joint loss function that is configured to combine any reconstruction loss from the autoencoder with any prediction error from the classifier. The joint loss function is further configured to negate any reconstruction loss of the autoencoder in response to the sample input representing anomalous behaviour within the system. The trained autoencoder is used to classify a behaviour of the system as being normal or anomalous.

A method of behavior monitoring includes determining, by one or more trained behavior models associated with a monitored asset, output data indicative of operation of the monitored asset. The method also includes determining a risk score based on the output data and determining feature importance data based on the output data. The method further includes determining whether to generate an alert based on the risk score and the feature importance data.

Systems and methods are provided for learning normal behavior for user roles of an application running within a cluster of container orchestration platform and based thereon proactively taking action responsive to suspicious events. According to one embodiment, an event data stream is created by an API server of the cluster. The data for each event includes information regarding a request made to an API exposed by the API server with which the event is associated and a user of the application by which the event was initiated. The data is augmented with a role associated with the user and an anomaly threshold for the role. Normal behavior is learned by an ML algorithm of respective user roles by processing the augmented data. When an anomaly score associated with a particular event is output by the ML algorithm that exceeds the anomaly threshold, a predefined or configurable action may be triggered.

The invention discloses a user behavior analysis method and system.The method comprises the steps that on the basis of normal behavior data of a user, frequent item sets and rare item sets of normal behaviors are mined from mass unlabeled behavior data, and an accurate basis is provided for data classification; a rare item set is used as a standard to divide majority class and minority class data sets, and minority class data is anchored based on rare features, so that the processing accuracy is improved; performing N times of conversion on the majority class data set based on the rare item set, classifying the converted data into a minority class data set, dynamically balancing the two classes of data, and improving the sensitivity of the model to a minority class normal behavior mode; and constructing a user behavior graph and a graph neural network learning model based on the balanced training data, carrying out structured representation on a user complex behavior pattern, inputting graph neural network learning to obtain a graph structure, nodes and edge features of a normal behavior pattern, inputting actual user behavior data into the trained model, and outputting an accurate user behavior analysis result.

This application relates to a behavior detection method, apparatus, computer device, computer-readable storage medium, and computer program product. The method includes: acquiring client behavior, a key feature detection set, and a full feature detection set; the key feature detection set is obtained by extracting and summarizing from the full feature detection set; detecting client behavior based on the key feature detection set; if the client behavior does not contain any key features from the key feature detection set, the client behavior is determined to be normal behavior; if the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior based on each full feature detection set; if the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior. This method can improve the efficiency of client behavior detection.

The application relates to the technical field of industrial control safety, in particular to a PLC runtime abnormal behavior identification method and system based on a behavior model, which comprises the following steps: S1, in the PLC program running process, a behavior monitoring module performs real-time monitoring and preliminarily judges abnormal behavior; S2, normal behavior and abnormal behavior are filtered out respectively according to the monitoring results of the behavior monitoring module, and behavior rule extraction is performed on the behavior monitoring module; and S3, behavior modeling is performed based on the extracted behavior rules, normal behavior model generation or update of behavior rule information files is performed on the detected normal behavior, and abnormal behavior model learning of abnormal characteristics, rapid abnormal identification and measure processing are performed on the detected abnormal behavior. The application uses a data model to describe the normal behavior model of the control behavior and the process behavior through the dependent relationship of the normal input and output data of the control and controlled process, so that the intrusion behavior can be accurately identified, and active defense can be performed.

The application discloses a railway ticket intelligent safety monitoring and early warning system and belongs to the technical field of safety monitoring. Through the combination of MSET and SPRT, complex and changeable normal behavior patterns in a ticket network can be effectively captured, and abnormal behaviors can be quickly identified through accurate statistical inference. Compared with a traditional fixed threshold detection method, the accuracy of abnormal detection is greatly improved, and the false negative rate and the false positive rate are reduced, thereby providing strong support for timely discovery and treatment of safety hazards. In combination with a multilayer and multimodal safety monitoring and early warning mechanism, the system can comprehensively, timely and accurately monitor safety threats in a ticket operation environment, timely discovers and early warns potential risks, and makes real-time defense according to the early warning, so that the safety accident rate is effectively reduced.

The invention discloses an abnormal user analysis system based on big data, and relates to the technical field of big data, and the technical scheme is characterized in that the system comprises a division module which is used for obtaining behavior characteristic data of game platform users, and performing category division on the game platform users according to the abnormal degree of the behavior characteristic data to obtain a user category division result set; collecting behavior data of a second type of users in the user type division result set according to different monitoring dimensions to obtain a first behavior data set, a second behavior data set and a third behavior data set; extracting abnormal deviation degrees between the user behaviors of the second type of users in different monitoring dimensions and the normal behaviors to obtain a first risk data set, a second risk data set and a third risk data set respectively; the method has the effect that fairness and normal order of the game are guaranteed by effectively identifying and processing the abnormal users.

A method for automatically scoring primate actions based on a behavioral interaction network includes the following steps: Step 1, acquiring primate video images, scoring and labeling them; the primate video images include normal behavior, post-medication behavior, and sham surgery behavior; Step 2, extracting monkey features from the primate video images using a neural network; training the neural network three times using the monkey features: the first training input is monkey features for normal behavior, the second training input is monkey features for sham surgery behavior, and the third training input is monkey features for post-medication behavior; finally, outputting the primate action score through a GAP layer and a fully connected layer.

Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.

The invention relates to the technical field of intelligent nursing, solves the problem that abnormal behaviors of old people cannot be accurately predicted and identified in the prior art, and provides an old people behavior monitoring method and device based on rule mining, equipment and a medium. The method comprises the following steps: according to historical video stream data, acquiring behavior characteristic data of a target old person in different time periods; mining the action feature data in different time periods according to a time sequence matching algorithm, and obtaining a behavior pattern of the target old person and corresponding behavior rule data; establishing a normal behavior pattern library according to the behavior pattern and the corresponding behavior rule data; according to real-time video stream data and the normal behavior pattern library, judging whether the target old person has an abnormal behavior or not; and when the abnormal behavior exists, giving an alarm according to the abnormal behavior. The method can improve the comprehensive behavior analysis capability, thereby improving the accuracy and stability of abnormal behavior recognition.

This invention discloses an abnormal user analysis system based on big data, belonging to the field of big data technology. Its key technical solution includes a segmentation module: acquiring behavioral characteristic data of game platform users; classifying game platform users according to the degree of abnormality in the behavioral characteristic data to obtain a user category segmentation result set; collecting behavioral data from the second category of users in the user category segmentation result set according to different monitoring dimensions to obtain a first behavior dataset, a second behavior dataset, and a third behavior dataset; extracting the abnormal deviation between the user behavior and normal behavior of the second category of users under different monitoring dimensions to obtain a first risk dataset, a second risk dataset, and a third risk dataset, respectively; the effect is that by effectively identifying and handling abnormal users, the fairness and normal order of the game are ensured.

An object of a system according to an embodiment is to analyze behavior history data, detect an abnormal behavior, and notify the abnormal behavior.SOLUTION: A system includes a collection unit, an analysis unit, and a notification unit. The collection unit collects action history data. The analysis unit analyzes the data collected by the collection unit and compares the data with a normal behavior pattern to detect an abnormal behavior. The notification unit notifies the abnormal behavior detected by the analysis unit.SELECTED DRAWING: Figure 1

The system comprises a prediction module (1) equipped with artificial intelligence to predict neurological disorders in an individual patient and identify a level of neurological disorders; a central processing unit (2) to detect triggering events and circumstances due to which the neurological disorders trigger in an individual patient upon receiving real-time behavior information data generated by a playing ball (3) of an individual patient and distinguish between a normal behavior and a neurological disorders behavior; an alert module (4) to alert the individual patient upon determining neurological disorders behavior; and an entertainment platform (5) to entertain and engage the individual patient with a specific set of activities assigned according to detected triggering events and circumstances upon determining the neurological disorders behavior, wherein a specific set of activities includes listening to music, playing games, and talking to an AI chatbot.

The invention relates to the technical field of accurate checking of grid-connected monitoring data, in particular to an API access behavior intelligent identification method, system and device and a medium. Performing statistical learning and mode induction on the cleaned API historical behavior data according to the service function and the use purpose of the API, and constructing a normal behavior model with a dynamic updating capability; performing similarity calculation on the real-time API calling data and the normal behavior model, and evaluating whether the real-time API calling data deviates from the expected behavior model or not; on the basis of similarity calculation based on statistical rules, a recurrent neural network is introduced to model a sequence behavior, so that the recognition capability of a time sequence abnormal mode is enhanced. Automatic and intelligent API access behavior recognition is achieved, the dynamic adaptive capacity of a recognition system is improved, service changes and new access modes can be quickly responded, meanwhile, the accuracy of abnormal access behavior recognition is greatly improved, and the false alarm rate and the missing report rate are effectively reduced.

Introduced here is a network-accessible platform (or simply “platform”) that is designed to monitor digital activities that are performed across different services to ascertain, in real time, threats to the security of an enterprise. In order to surface insights into the threats posed to an enterprise, the platform can apply machine learning models to data that is representative of digital activities performed on different services with respective accounts. Each model may be trained to understand what constitutes normal behavior for a corresponding employee with respect to a single service or multiple services. Not only can these models be autonomously trained for the employees of the enterprise, but they can also be autonomously applied to detect, characterize, and catalog those digital activities that are indicative of a threat.

The invention belongs to the technical field of intelligent Internet of Things, and particularly discloses an indoor behavior analysis and safety monitoring method and system based on multi-source perception, which can realize accurate identification and monitoring of specific daily behaviors of a user through multi-source data fusion and habit portrait matching, effectively distinguish normal behaviors from abnormal conditions, and greatly reduce the monitoring false alarm rate; the subentry early warning rule and the weighted statistical rule are combined, so that the monitoring early warning has a clear basis, and the credibility and the disposal efficiency of the early warning are improved; only non-sensitive water, electricity, gas and heat data are analyzed, privacy information such as human faces, videos and biological characteristics is not involved, and in combination with hierarchical authority management, user privacy is protected to the maximum extent while safety is guaranteed; the user does not need to wear any equipment, the existing indoor layout does not need to be changed, and all-weather non-inductive safety monitoring on the user can be realized; and the monitoring pressure of a monitoring party can be effectively reduced while the direct and indirect monitoring cost is reduced.

The invention discloses a keyboard and mouse behavior modeling user identification method and system based on deep learning and a computer readable storage medium. Wherein the user behavior comprises a keyboard behavior and a mouse behavior, and the identification method comprises the following steps: collecting keyboard behavior data and mouse behavior data of a user, storing the collected keyboard behavior data and mouse behavior data in a security domain, and extracting the keyboard behavior data and mouse behavior data of the user from the security domain; classifying the keyboard behavior data and the mouse behavior data based on a deep learning model, and dividing behavior actions in the keyboard behavior data and the mouse behavior data into normal behaviors and abnormal behaviors; and intercepting the abnormal behavior. According to the technical scheme, the behavior data processing of the user can be effectively completed under the condition that the security is improved.

The invention discloses a computer security system based on artificial intelligence, and the system comprises a security monitoring platform which is responsible for receiving data from all modules, carrying out the centralized processing, and providing a user interface for a manager to monitor and operate; the behavior mode analysis module is responsible for identifying normal and abnormal behavior modes through deep analysis of user behavior data and providing an important basis for safety monitoring; the intelligent rule engine is responsible for automatically generating and optimizing a security rule according to the security policy and the real-time threat information; the calling management module is used for adding an AI-assisted security analysis function while ensuring information calling; according to the invention, the behavior pattern analysis module uses the LSTM to learn and model the historical behaviors of the user, identifies the characteristics of the normal behaviors and the abnormal behaviors, and judges whether the current access behavior is abnormal or not according to the characteristics in real-time monitoring, thereby reducing the false alarm rate and the missing report rate.

The invention discloses an abnormal behavior recognition method and system, relates to the field of network security protection, and solves the problem of low recognition accuracy of abnormal behaviors in a network. According to the embodiment of the invention, through multi-dimensional feature modeling, the feature tensor for comprehensively describing network behaviors is constructed, the problem of one-sidedness of traditional single-dimensional features is solved, and the essential difference between normal and abnormal behaviors can be depicted more finely; normal behaviors are modeled through multi-dimensional Gaussian distribution, the probability density of the normal behaviors is accurately described, and false alarms caused by normal fluctuation can be reduced; and the decision boundary is adjusted in real time through Bayesian inference, so that the change of the network state can be adapted, and the problem that the accuracy of a traditional fixed threshold is reduced due to environment change is avoided. According to the whole method, a closed loop from accurate sensing and reliable modeling to intelligent decision making is formed, and high-accuracy and low-false-alarm detection of abnormal behaviors in a high-dynamic network environment is achieved.

The present application relates to the field of computer vision, and particularly relates to a kind of unsupervised classroom head posture concentration analysis method, device and equipment. Including: the video data of student video segment in the monitoring video data in classroom scene is collected;Extract the posture parameter reflecting the change of student head posture, and construct the corresponding head posture time series data based on continuous time segment;Head posture time series data is analyzed and processed, and multi-dimensional feature data for representing student head posture behavior mode is constructed;Multi-dimensional feature data is processed by unsupervised anomaly detection, and the abnormal analysis result for representing the degree of deviation of student current head posture behavior from normal behavior mode is determined;The corresponding student concentration analysis result is generated and output.The present application realizes the stable analysis of student concentration in classroom monitoring scene without manual annotation data and without relying on high-resolution facial expression information, and is suitable for low-resolution, frequently occluded real classroom environment.

The present application discloses a behavior portrait construction method, device, electronic device and storage medium, wherein the method includes: receiving a behavior portrait model reported by each terminal of at least two terminals in a first cluster; the behavior portrait model represents a model for identifying behavior anomalies obtained by local learning of the terminal; based on each received behavior portrait model, extracting a feature baseline corresponding to each process; the feature baseline is used to determine whether the behavior data of the corresponding process is normal behavior data; performing correlation analysis on the feature baselines extracted from each behavior portrait model, and correcting and adjusting the feature baseline corresponding to each process, thereby obtaining a corrected behavior portrait model.

The present application relates to the technical field of fall detection, and relates to an old person fall detection and alarm system based on a multi-modal sensor.The present application collects the height of the center of gravity from the ground in real time, combines the allowable height deviation of the detection object, analyzes whether the center of gravity is moving downward, calculates the azimuth of the center of gravity displacement based on the displacement vector of the center of gravity in the reference rectangular coordinate system, constructs a real-time center of gravity feature parameter set, obtains the azimuth of the hands and the distance from the hands to the center of gravity within a set time period, combines the center of gravity feature parameter set and the historical normal behavior data set of the detection object, determines whether the current state is reasonable, if not, analyzes the overall offset consistency based on the azimuth of the center of gravity offset and the azimuth of the hands, combines the time sequence of the height of the center of gravity from the ground and the height of the hands from the ground to determine whether a fall has occurred, reduces the false alarm and missed alarm probability, improves the recognition accuracy of the detection system, and guarantees the personal safety of the old people.

The invention relates to the technical field of artificial intelligence, in particular to an asset password changing method, system and device based on bastion host operation and maintenance behavior analysis and a medium. The method comprises the following steps: firstly, acquiring bastion host operation and maintenance data from an audit database, periodically acquiring server operation and maintenance data according to a bastion host, and establishing a comprehensive data set; then, a machine learning method is called to extract behavior characteristics from the fortress machine operation and maintenance data and the server operation and maintenance data, and normal behaviors and abnormal behaviors are obtained through recognition; and finally, calculating a risk coefficient according to the abnormal behavior and the normal behavior, and triggering a corresponding password changing operation. Based on the historical data and the change of the current environment, the potential attack opportunity or security threat is predicted, the optimal opportunity of password changing is determined, a fixed password changing strategy is optimized, and the automation level and security of the password changing process are improved.