CN107480647B - Method for detecting abnormal behaviors in real time based on inductive consistency abnormality detection - Google Patents

Abstract

The invention discloses an abnormal behavior real-time detection method based on inductive consistency abnormality detection. The method can fully consider the position, speed and movement direction information of the target, adopts the idea of inductive consistency abnormal detection, can realize real-time detection of abnormal behaviors of the target under the condition of greatly reducing the calculated amount, and specifically comprises the following steps of 1, defining related variables; step 2, initializing; step 3, carrying out real-time anomaly detection on each sub track in the test track; step 4, after each sub track in the current test track is detected abnormally, updating the training track data set; step 5, updating the multi-factor directional Hausdorff distance matrix; and 6, carrying out real-time anomaly detection on the next test track. The method has the advantages of simple parameter setting, high accuracy, real-time detection, easy realization of engineering and wide application prospect in the field of early warning and monitoring.

Description

Method for detecting abnormal behaviors in real time based on inductive consistency abnormality detection

Technical Field

The invention relates to an anomaly detection technology in data mining and a high-level fusion technology in information fusion, belonging to the field of pattern recognition and intelligent information processing.

Background

With the continuous perfection of the information fusion theory and the wide application of the information fusion technology, the information processing system can automatically or semi-automatically complete the detection, tracking, track association and attribute judgment of the target through the fusion process of a detection level, a position level and an attribute level, and form a continuous and stable target track. With the increasing of the types and the quantity of the targets and the increasing of the performance of the early warning monitoring system, more and more target information data are formed and stored in various early warning monitoring systems. How to let a computer automatically find the abnormal behavior of a target is a very important research content in intelligent intelligence processing. A large number of scholars at home and abroad carry out a great deal of research on the real-time abnormality detection problem of the target, and the main method comprises a learning stage and an abnormality detection stage. The learning stage includes a statistical model-based method, a neural network-based method, a clustering-based method, and the like, and the abnormality detection stage includes a statistical test-based method, a distance-based method, and the like. However, the methods generally have the problems of complex parameter setting, inaccurate statistical model, ineffective control of false alarm rate, poor online learning effect and the like. The abnormal behavior sequential detection method based on the multi-factor inconsistency measurement can fully utilize the position, speed and motion direction information of a target, and realize real-time abnormal detection of the abnormal behavior of the target in an online learning and sequential abnormal detection mode, but all historical track data need to be recalculated during each abnormal detection, so that the problem of large calculation amount exists.

Disclosure of Invention

The invention provides an abnormal behavior real-time detection method based on inductive consistency abnormal detection, which not only can fully consider the position, the speed and the motion direction information of a target, but also adopts the idea of inductive consistency abnormal detection, and can realize the real-time detection of the abnormal behavior of the target under the condition of greatly reducing the calculated amount. The method specifically comprises the following steps:

step 1, defining related variables:

1) an anomaly threshold;

2) the number of neighbors to consider k;

3) training track data set (TR)₁,…,TR_lWherein the compressed track number set is { TR }₁,…,TR_r}, checking the track data set to be { TR_r+1,…,TR_l}；

4) Multifactor oriented Hausdorff distance matrix M, each element M of matrix_i,jI 1, …, l-r, j 1, …, k denotes the track TR in the test track data set_iI-r +1, …, l to the compressed track data set { TR }₁,…,TR_rA multi-factor directional Hausdorff distance between jth and near tracks;

5) an empty priority sequence Q;

6) test track TR_l+1Continuously updated track point x₁,…,x_L。

7) Variable for exception indication

Wherein

j 1, …, L-1 corresponding to the sub-track

The category of the result of the calculation is,

corresponding track { x₁∪x₂∪…∪x_L}＝TR_l+1Calculating the obtained category;

step 2, initialization: for the current test sub-track

To compressed track data concentration

TR_gG-1, …, r, a multifactorial directional Hausdorff distance m_gG-1, …, assigning an initial value of zero to r, and calculating a multi-factor directional Hausdorff distance matrix M_i,1,…,M_i,kIs defined as

Step 3, for the test track TR_l+1＝{x₁∪x₂∪…∪x_LSub track in { x }₁∪…∪x_j1, …, L repeats the following anomaly detection process:

1) for track TR in the inspection track data set_iI-r +1, …, l as a measure of inconsistency_iUpdating is carried out;

2) definition of m according to the multi-factor directional Hausdorff distance_gUpdating the value of (1);

3) updating the elements in Q;

4) extracting current k distance values from Q

For the current test sub track { x₁∪…∪x_j} disparity measure α_l+1Updating the value of (1);

5) calculating p_l+1Taking values;

6) p is to be_l+1Judging a threshold value, and detecting and updating the abnormal condition of the current test sample;

step 4, when testing the track TR_l+1Each sub track { x }₁∪…∪x_jWhen the abnormality detection is completed for all the j-1, …, an abnormality indication variable is output, and TR is set_l+1Add to training track dataset TR₁,…,TR_lIn the method, the training track data set is updated to be { TR }₁,…,TR_l+1Where the inspection track data set is updated to { TR }_r+1,…,TR_l+1}；

Step 5, updating the multi-factor directional Hausdorff distance matrix M as follows;

step 6, the updated training track set { TR₁,…,TR_l+1The updated multi-factor directional Hausdorff distance matrix M is used as a new input variable for the test track TR_l+1And (6) carrying out abnormity detection.

The invention has the beneficial effects that: the method for detecting the abnormal behaviors based on the inductive consistency abnormity detection not only comprehensively considers the position, the speed and the course information of the target and can detect the abnormal behaviors of the target in real time, but also adopts the idea of inductive consistency abnormity detection, has the advantages of simple parameter setting, high accuracy and real-time detection, and can realize the real-time detection of the abnormal behaviors of the target in the early warning monitoring field under the condition of greatly reducing the calculated amount.

Drawings

FIG. 1 is an overall flow chart of the method for detecting abnormal behavior in real time based on inductive consistency abnormality detection according to the present invention.

Detailed Description

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

Step 1, defining related variables:

1) an anomaly threshold;

2) the number of neighbors to consider k;

3) training track data set (TR)₁,…,TR_lWherein the compressed track number set is { TR }₁,…,TR_r}, checking the track data set to be { TR_r+1,…,TR_l}；

4) Multifactor oriented Hausdorff distance matrix M, each element M of matrix_i,jI 1, …, l-r, j 1, …, k denotes the track TR in the test track data set_iI-r +1, …, l to the compressed track data set { TR }₁,…,TR_rA multi-factor directional Hausdorff distance between jth and near tracks;

5) an empty priority sequence Q;

6) test track TR_l+1Continuously updated track point x₁,…,x_L；

7) Variable for exception indication

Wherein

j 1, …, L-1 corresponding to the sub-track

The category of the result of the calculation is,

corresponding track { x₁∪x₂∪…∪x_L}＝TR_l+1Calculating the obtained category;

step 2, initialization: for current test sub-track

TR into compressed track data set_gG-1, …, r, a multifactorial directional Hausdorff distance m_gG-1, …, assigning an initial value of zero to r, and calculating a multi-factor directional Hausdorff distance matrix M_i,1,…,M_i,kIs defined as

Multi-factor orientationThe Hausdorff distance is specifically defined as follows:

1) considering the position characteristics, the speed characteristics and the heading characteristics of the two targets, the multi-factor distance between the two target points a and b is defined as:

mfdist(a,b)＝w_d·dist(a,b)+w_v·dist(v_a,v_b)+w_θ·dist(θ_a,θ_b) (1)

wherein v is_a，v_bRepresenting the velocity, θ, of points a and b_a，θ_bIndicating the course of points a and b, dist (a, b) indicating the Euclidean distance of the position features between points a and b, dist (v)_a,v_b) Euclidean distance, dist (θ) representing a velocity characteristic between points a and b_a,θ_b) Euclidean distance, w, representing course characteristics between points a and b_dWeight factor, w, representing a position feature_vWeight factor, w, representing a velocity characteristic_θRepresenting a weight factor of the heading characteristic, wherein the value of the weight factor depends on an application scene of the multi-factor distance;

2) target track TR based on multifactor distance mfdist (a, b) between two target points_ATo target track TR_BThe multifactor oriented Hausdorff distance of (a) is defined as:

TR_Aand TR_BTwo target tracks are provided;

step 3, for the test track TR_l+1＝{x₁∪x₂∪…∪x_LSub track in { x }₁∪…∪x_j1, …, L repeats the following anomaly detection process:

1) for track TR in the inspection track data set_iI-r +1, …, l as a measure of inconsistency_iUpdating:

α_i＝v_i-r(3)

2) definition of m according to the multi-factor directional Hausdorff distance_gUpdating the value of (a):

wherein m is_gG-1, …, r representing the current test sub-track

TR into compressed track data set_gG-1, …, r, a multifactorial directional Hausdorff distance;

3) updating the elements within Q: if the number of elements in Q is less than the number k of neighbors, then the current m is determined_gInserting the value into Q, if there are k distance values in Q, and the current m_gIf the distance value is less than the maximum distance value in Q, deleting the maximum distance value in Q and adding the current m_gInserting values into Q;

4) extracting current k distance values from Q

Performing summation calculation to the current test sub track { x₁∪…∪x_j} disparity measure α_l+1Updating the value of (a):

5) calculating p_l+1Taking values:

|{i＝r+1,…,l+1:α_i≥α_l+1denotes the set { i ═ r +1, …, l +1: α_i≥α_l+1The number of elements in the page;

6) p is to be_l+1And (3) judging a threshold value, and detecting and updating the abnormal condition of the current test sample:

if p is_l+1＜，

If not, then,

wherein the content of the first and second substances,

representing the current sub-track { x₁∪…∪x_jJ is 1, …, and the detection result of L is abnormal behavior,

representing the current sub-track { x₁∪…∪x_j1, …, and the detection result of L is normal behavior;

step 4, when testing the track TR_l+1Each sub track { x }₁∪…∪x_jWhen the abnormality detection is completed for all the j-1, …, an abnormality indication variable is output, and TR is set_l+1Add to training track dataset TR₁,…,TR_lIn the method, the training track data set is updated to be { TR }₁,…,TR_l+1Where the inspection track data set is updated to { TR }_r+1,…,TR_l+1}；

Step 5, updating the multi-factor directional Hausdorff distance matrix M as follows: distance vector (m) to be output₁,…,m_l) Added to M as the last row;

step 6, the updated training track set { TR₁,…,TR_l+1The updated multi-factor directional Hausdorff distance matrix M is used as a new input variable for the test track TR_l+2And (6) carrying out abnormity detection.

Claims (4)

1. A real-time detection method for abnormal behaviors based on inductive consistency abnormality detection is characterized by comprising the following steps:

step 1, defining related variables:

1) an anomaly threshold;

2) the number of neighbors to consider k;

3) training track data set (TR)₁,…,TR_nWherein the compressed track number set is { TR }₁,…,TR_r}, checking the track data set to be { TR_r+1,…,TR_n}；

4) Multifactor oriented Hausdorff distance matrix M, each element M of matrix_i,jI 1, …, n-r, j 1, …, k denotes the track TR in the test track data set_iI-r +1, …, n to the compressed track data set TR₁,…,TR_rA multi-factor directional Hausdorff distance between jth and near tracks;

5) an empty priority sequence Q;

6) test track TR_n+1Continuously updated track point x₁,…,x_L；

7) Variable for exception indication

Wherein

j 1, …, L-1 corresponding to the sub-track

The category of the result of the calculation is,

corresponding track

Calculating the obtained category;

step 2, initialization: for the current test sub-track

TR into compressed track data set_gG-1, …, r, a multifactorial directional Hausdorff distance m_gG-1, …, assigning an initial value of zero to r, and calculating a multi-factor directional Hausdorff distance matrix M_i,1,…,M_i,kIs defined as

Step 3, for the test track TR_n+1＝{x₁∪x₂∪…∪x_LSub track in { x }₁∪…∪x_j1, …, L repeats the following anomaly detection process:

1) for track TR in the inspection track data set_iI-r +1, …, n as a measure of inconsistency_iUpdating is carried out;

2) definition of m according to the multi-factor directional Hausdorff distance_gUpdating the value of (1);

3) updating the elements in Q;

4) extracting current k distance values from Q

For the current test sub track { x₁∪…∪x_j} disparity measure α_l+1Updating the value of (1);

5) calculating p_n+1Taking values;

6) p is to be_n+1Judging a threshold value, and detecting and updating the abnormal condition of the current test sample;

step 4, when testing the track TR_n+1Each sub track { x }₁∪…∪x_jWhen the abnormality detection is completed for all the j-1, …, an abnormality indication variable is output, and TR is set_n+1Add to training track dataset TR₁,…,TR_nIn the method, the training track data set is updated to be { TR }₁,…,TR_n+1Where the inspection track data set is updated to { TR }_r+1,…,TR_n+1}；

Step 5, updating the multi-factor directional Hausdorff distance matrix M as follows;

step 6, the updated training track set { TR₁,…,TR_n+1The updated multi-factor directional Hausdorff distance matrix M is used as a new input variable for the test track TR_n+2And (6) carrying out abnormity detection.

2. The method for detecting abnormal behaviors based on inductive consistency abnormality detection according to claim 1, wherein the specific definition of the multi-factor directional Hausdorff distance in step 2 is as follows:

1) considering the position characteristics, the speed characteristics and the heading characteristics of the two targets, the multi-factor distance between the two target points a and b is defined as:

mfdist(a,b)＝w_d·dist(a,b)+w_v·dist(v_a,v_b)+w_θ·dist(θ_a,θ_b)

wherein v is_a，v_bRepresenting the velocity, θ, of points a and b_a，θ_bIndicating the course of points a and b, dist (a, b) indicating the Euclidean distance of the position features between points a and b, dist (v)_a,v_b) Euclidean distance, dist (θ) representing a velocity characteristic between points a and b_a,θ_b) Euclidean distance, w, representing course characteristics between points a and b_dWeight factor, w, representing a position feature_vWeight factor, w, representing a velocity characteristic_θRepresenting a weight factor of the heading characteristic, wherein the value of the weight factor depends on an application scene of the multi-factor distance;

2) target track TR based on multifactor distance mfdist (a, b) between two target points_ATo target track TR_BThe multifactor oriented Hausdorff distance of (a) is defined as:

TR_Aand TR_BTwo target tracks.

3. The method for detecting abnormal behaviors based on inductive consistency abnormality detection according to claim 1, wherein the step 3 is specifically as follows:

for test track TR_l+1＝{x₁∪x₂∪…∪x_LSub track in { x }₁∪…∪x_j1, …, L repeats the following anomaly detection process:

1) for track TR in the inspection track data set_iI-r +1, …, n as a measure of inconsistency_iUpdating:

α_i＝v_i-r

2) definition of m according to the multi-factor directional Hausdorff distance_gUpdating the value of (a):

wherein m is_gG-1, …, r representing the current test sub-track

TR into compressed track data set_gG-1, …, r, a multifactorial directional Hausdorff distance;

3) updating the elements within Q: if the number of elements in Q is less than the number k of neighbors, then the current m is determined_gInserting the value into Q, if there are k distance values in Q, and the current m_gIf the distance value is less than the maximum distance value in Q, deleting the maximum distance value in Q and adding the current m_gInserting values into Q;

4) extracting current k distance values from Q

Performing summation calculation to the current test sub track { x₁∪…∪x_j} disparity measure α_n+1Updating the value of (a):

5) calculating p_n+1Taking values:

|{i＝r+1,…,n+1:α_i≥α_n+1denotes the set { i ═ r +1, …, n +1: α } -_i≥α_n+1The number of elements in the page;

6) p is to be_n+1And (3) judging a threshold value, and detecting and updating the abnormal condition of the current test sample:

if p is_n+1＜，

If not, then,

wherein the content of the first and second substances,

representing the current sub-track { x₁∪…∪x_jJ is 1, …, and the detection result of L is abnormal behavior,

representing the current sub-track { x₁∪…∪x_jAnd j is 1, …, and the detection result of L is normal behavior.

4. The method for detecting abnormal behavior in real time based on inductive consistency abnormality detection according to claim 1, wherein the step 5 is specifically as follows:

the multi-factor directional Hausdorff distance matrix M is updated as follows: distance vector (m) to be output₁,…,m_n) Added to M as the last line.

Images