KR20210040546A - Method and Apparatus for Detecting Anomaly from Security Video - Google Patents

Abstract

Disclosed are an anomaly detection apparatus for a security video and a method thereof. An embodiment of the present invention detects a predefined anomaly pattern and an undefined but suspicious anomaly pattern for a security video and creates a database in which various anomaly patterns are accumulated. By re-learning a detection model based on the generated database, the anomaly detection apparatus for a security video and the method thereof continuously increase detection performance.

Description

[Method and Apparatus for Detecting Anomaly from Security Video}

The present invention relates to an apparatus and method for detecting anomaly for security video.

The contents described below merely provide background information related to the present invention and do not constitute the prior art.

In the field of security, anomaly detection is a technology of high interest. It is very difficult for an administrator to always monitor a number of CCTV (Closed Circuit TV) images installed at the site to be monitored. Therefore, it is necessary to filter the suspicious situation and connect it to the manager's control. In addition, by adopting an anomaly detection technology, security companies can try to reduce labor costs in terms of the physical security market structure, and at the same time, it is possible to show off their technology by possessing an anomaly detection technology.

Since the anomalous situation is very diverse, such as assault, theft, fire, shooting, and collapse, it is technically very difficult to determine whether an anomaly situation occurs. Anomaly detection is generally approached in two directions.

As shown in FIG. 4, there is an action recognition method in which an anomaly situation is defined as a plurality of categories (category or class), and an anomaly situation belonging to the defined category is detected in a CCTV video. Since a plurality of specific situations are defined and based on supervised learning using a corresponding database, the behavioral recognition method shows an improvement in judgment performance in terms of perception of individual situations. However, when a complex situation that is included in the category but does not exist in the database is judged, or when a new anomaly is added, there is a problem that the behavior recognition method has a limitation on the judgment performance.

Next, as shown in FIG. 5, there is a binary classification method in which all anomaly situations are binarized into normal and abnormal conditions and classified. The binary classification method does not separately use a GT (Ground Truth) database for learning, and relies on unsupervised learning. The binary classification method is being studied in the direction of learning human behavior patterns from various videos. The binary classification method provides scores for normal and abnormal situations, and the manager can use the provided scores to determine the situation of the video.

Compared with the behavior recognition method, the binary classification method improves the classification performance for the whole anomaly. However, there is a problem in that the judgment performance for individual categories is deteriorated, and the processing power for continuously changing anomaly patterns is insufficient.

In addition to the limitations of the performance aspect as described above, for a database in which video data generated by a CCTV operating at a fixed location for 24 hours is accumulated, the conventional technology also has a problem that the information accumulated in the database cannot be used as an asset. exist.

Accordingly, there is a need for an anomaly detection method capable of improving the judgment performance for individual categories while maintaining the classification performance for the whole anomaly using the accumulated database.

Non-Patent Document 1: C. Feichtenhofer, H. Fan, J. Malik, and K. He, "SlowFast Networks for Video Recognition," arXiv:1812.03982, 2018. Non-Patent Document 2: W. Sultani1, C. Chen2, M. Shah, "Real-world Anomaly Detection in Surveillance Videos," IEEE CVPR, 2018.

The present disclosure detects a predefined anomaly pattern and an undefined but suspicious anomaly pattern for a security video, and creates a database in which various anomaly patterns are accumulated. The main object is to provide an anomaly detection apparatus and method capable of continuously improving detection performance by performing retraining on a detection model based on a generated database.

According to an embodiment of the present invention, an input video is obtained, an anomaly situation is inferred based on the input video, and the input video is converted to a normal video and an abnormal video based on the anomaly situation. (abnormal video) an anomaly distinguisher; A behavior detector for detecting an anomaly pattern corresponding to a plurality of predefined appearance categories based on the abnormal video; And a decision maker configured to determine the abnormal video as an appearance anomaly pattern or non-appearance data based on a discrimination result of the anomaly distinguisher and a detection result of the behavior detector. .

According to another embodiment of the present invention, there is provided an anomaly detection method of an anomaly detection apparatus, the method comprising: acquiring an input video; The input video is input to a pre-trained anomaly classifier to infer an anomaly situation, and based on the anomaly situation, the input video is divided into a normal video and an abnormal video. The process of doing; Inputting the abnormal video to a pre-trained behavior detector to detect an anomaly pattern corresponding to a plurality of predefined appearance categories; And determining the abnormal video as one of an appearance anomaly pattern, non-appearance data, and a normal pattern based on the identification result of the anomaly distinguisher and the detection result of the behavior detector. Provides an implemented anomaly detection method.

Another embodiment of the present invention provides a computer program stored in a computer-readable, nonvolatile or non-transitory recording medium in order to execute each step included in an anomaly detection method.

As described above, according to the present embodiment, by providing an anomaly detection apparatus and method capable of continuously improving detection performance based on a database in which an anomaly pattern for a security video is accumulated. , There is an effect that it becomes possible to advance the physical security control system of the security company.

In addition, according to the present embodiment, by providing an anomaly detection device and method based on a database in which an anomaly pattern for security video is accumulated, the effect of continuously improving the detection performance of an anomaly pattern for an object of interest for each CCTV is achieved. have.

In addition, according to the present embodiment, the server integrates and manages a database for an anomalous pattern that is difficult to accumulate data because the frequency of occurrence is low, and the server relearns the anomaly detection device using the database to continuously improve detection performance There is an effect that it becomes possible to improve.

1 is a block diagram of an anomaly detection apparatus according to an embodiment of the present invention.
2 is an exemplary diagram for a decision making process of a decision maker according to an embodiment of the present invention.
3 is a flowchart of an anomaly detection method according to an embodiment of the present invention.
4 is an exemplary diagram for a conventional behavior recognition method.
5 is an exemplary diagram for a conventional binary classification method.

Hereinafter, embodiments of the present invention will be described in detail with reference to exemplary drawings. In adding reference numerals to elements of each drawing, it should be noted that the same elements are assigned the same numerals as possible, even if they are indicated on different drawings. In addition, in describing the embodiments, when it is determined that a detailed description of a related known configuration or function may obscure the subject matter of the embodiments, a detailed description thereof will be omitted.

In addition, terms such as first, second, A, B, (a) and (b) may be used in describing the components of the present embodiments. These terms are only for distinguishing the component from other components, and the nature, order, or order of the component is not limited by the term. Throughout the specification, when a part'includes' or'includes' a certain element, it means that other elements may be further included rather than excluding other elements unless otherwise stated. . In addition, the'... Terms such as'sub' and'module' mean a unit that processes at least one function or operation, which may be implemented by hardware or software, or a combination of hardware and software.

DETAILED DESCRIPTION OF THE INVENTION The detailed description to be disclosed below together with the accompanying drawings is intended to describe exemplary embodiments of the present invention, and is not intended to represent the only embodiments in which the present invention may be practiced.

This embodiment discloses a device for detecting an anomaly for a security video. In more detail, a predefined anomaly pattern and an undefined but suspicious anomaly pattern for a security video are detected, and a database in which various anomaly patterns are accumulated is created. It provides an anomaly detection apparatus and method capable of continuously improving detection performance by performing retraining on a detection model based on a generated database.

The physical security control system has a server (not shown) on which a plurality of Closed Circuit TVs (CCTVs) and an anomaly detection device 100 according to the present embodiment are mounted, or a computing capability equivalent to that of a server. It is assumed to include a programmable system that can be used. It is assumed that the server acquires video data from a plurality of CCTVs using a wired or wireless transmission method.

Hereinafter, each group classified an anomaly pattern is expressed as a category or a class.

Hereinafter, it is assumed that video refers to a plurality of images (eg, images of about tens of units) grouped in a time series. Since the anomaly pattern is difficult to observe in one image, it is assumed that detection is attempted in a plurality of images, that is, video, grouped in a time series.

1 is a block diagram of an anomaly detection apparatus according to an embodiment of the present invention.

In an embodiment of the present invention, the anomaly detection device 100 detects an anomaly pattern from a security video input, generates a database in which the detected anomaly patterns are accumulated, and rewrites a learning model based on the generated database. Carry out learning. The anomaly detection device 100 includes all or part of an anomaly video filter 110, an anomaly video collector 120, and an incremental online learner 130.

The anomalous video filter 110 obtains the input video and infers binaryly whether the input video includes an anomaly context. The anomaly video filter 110 provides anomalous video that is inferred to include an anomaly situation. The anomaly video filter 110 may include an anomaly discriminator 111.

The anomaly video collector 120 distinguishes and stores a video for an appearance anomaly pattern, non-appearance data, and a normal pattern based on the abnormal video. The anomaly video collector 120 includes an action detector (121), a decision maker (122), an appearance database (123), an unseen database (124), and a fine decision unit. Decision unit, 125) may include all or part of.

The incremental online learner 130 performs online retraining for the anomaly classifier 111 and the behavior detector 121 based on the stored unappearance data and the video for the normal pattern. The incremental online learner 130 may include all or part of the first retraining unit 131 and the second retraining unit 132.

Here, online retraining means performing retraining on a learning model every time data for training is acquired. In contrast, offline retraining. It means accumulating and storing training data and retraining the training model at a convenient time. In terms of efficient use of storage space, online training is preferred. Unless otherwise specified, retraining is assumed to be online retraining, but is not limited thereto.

Components included in the anomaly detection apparatus 100 according to the present embodiment are not necessarily limited thereto. For example, a training unit (not shown) for training a detection model may be additionally provided on the anomaly detection apparatus 100. Here, the detection model may include an anomaly distinguisher 111 and a behavior detector 121.

1 is an exemplary configuration according to the present embodiment, and implementation including different components or different connections between components may be implemented according to an anomaly distinction method, a behavior detection method, a decision making method, and a retraining method.

Hereinafter, operations of the detailed components of the anomaly detection apparatus 100 will be described with reference to the illustration of FIG. 1.

The anomaly discriminator 111 according to the present embodiment acquires an input video, infers an anomaly situation based on the input video, and converts the input video into a normal video or an abnormal video ( abnormal video).

Here, it is assumed that the input video is obtained from a plurality of CCTVs constituting the physical security control system.

The anomaly distinguisher 111 according to the present embodiment may be implemented based on a previously learned deep learning model. Based on unsupervised learning performed without GT (Ground Truth) or weakly-supervised learning using clues about the inclusion of an anomalous situation, the training department is an anomaly discriminator (111). Can be trained in advance. The deep learning model used for the anomaly distinguisher 111 may use video as an input (eg, 3D CNN (Convolutional Neural Network)), and may be any model capable of learning. Since the deep learning model can reuse the conventional technology, detailed descriptions of the structure and operation will be omitted.

The anomaly discriminator 111 infers an abnormal score and a normal score for an anomaly situation of the input video. The anomaly discriminator 111 divides the input video into a normal video and an abnormal video by comparing the abnormal score with a preset threshold.

It is common that the anomaly distinguisher 111 reacts more sensitively to an anomaly situation than to a normal situation. That is, all input videos including an ambiguous anomaly situation are classified as abnormal videos based on a preset threshold. Accordingly, depending on the size of a preset threshold, a case in which the normal score of the abnormal video is larger than the abnormal score may occur. Later, the decision maker 122 may use this case in the decision making process.

The anomalous discriminator 111 transmits the abnormal video to the behavior detector 121 and transmits the discrimination result including the abnormal score and the normal score for the abnormal video to the decision maker 122.

The behavior detector 121 according to the present embodiment detects an anomaly pattern corresponding to a plurality of predefined appearance categories based on the abnormal video. For example, a plurality of predefined occurrence categories may be items as illustrated in FIG. 4, and the number of appearance categories may vary.

The behavior detector 121 may be implemented based on a previously learned deep learning model. Based on supervised learning using GT corresponding to a plurality of predefined occurrence categories, the training unit may train the behavior detector 121 in advance. The deep learning model used in the behavior detector 121 may use a video as an input (eg, a three-dimensional CNN (Convolutional Neural Network)), and may be any model capable of learning. Since the deep learning model can reuse the conventional technology, detailed descriptions of the structure and operation will be omitted.

In detecting the anomaly pattern based on the abnormal video, the behavior detector 121 generates confidence for each occurrence category and transmits the detection result including the generated reliability to the decision maker 122. .

The decision maker 122 according to the present embodiment generates an abnormal video based on the discrimination result provided by the anomaly discriminator 111 and the detection result provided by the behavior detector 121. Decide on one of the patterns.

The decision maker 122 determines an appearance anomaly pattern when an abnormal video belongs to a plurality of appearance categories in terms of reliability. In addition, when suspicious anomalies are included in terms of reliability and abnormal scores, it is determined as unappeared data, and when suspicious or ambiguous anomalies do not exist, it is determined as a normal pattern.

The decision maker 122 stores the video determined as the appearance anomaly pattern in the appearance database 123, and stores non-appearance data or the video determined as the normal pattern in the non-appearance database.

An example of the decision making process of the decision maker 122 will be described later with reference to FIG. 2.

The appearance database 123 includes a storage area according to a plurality of appearance categories, and stores a video determined by an appearance anomaly pattern in a storage area of a corresponding appearance category.

The non-appearance database 124 may newly create and include a storage area for each unseen category in which unappearance data is stored. The non-appearance database 124 checks whether the transmitted non-appearance data can be included in the previously generated non-appearance category. If it can be included, the delivered non-appearance data is stored in a previously created non-appearance category, and in the opposite case, a new non-appearance category is created to store the delivered non-appearance data.

The non-appearance database 124 may store videos determined in a normal pattern, including a normal category.

The non-appearance data and the video corresponding to the normal pattern stored in the non-appearance database 124 according to the present embodiment may be used for retraining the anomaly distinguisher 111 and the behavior detector 121 in the future.

In another embodiment of the present invention, a part of the video determined as the appearance anomaly pattern may be used for retraining the behavior detector 121. In the description of the decision making process of the decision maker 122, a case where the appearance anomaly pattern is used for retraining will be described.

The precision decision unit 125 double-checks the decisions made by the decision maker 122. The role of the precision decision unit 125 may be performed by a manager, but may be performed by a program that is more precise than the decision maker 123, which can replace the role of the manager. Since the precision decision unit 125 is a part to compensate for errors that may occur in the decision maker 122, it may be omitted depending on the performance of the decision maker 122.

The first retraining unit 131 according to the present embodiment may retrain the anomaly classifier 111 based on incremental learning or active learning using a video determined as a normal pattern. have.

The second retraining unit 132 according to the present embodiment may retrain the behavior detector 121 based on incremental learning or active learning using the video determined as non-appearance data.

Incremental learning is a learning method in which parameters of a learning model are updated based on retraining using the added data. In general, it is possible to increase the inference accuracy of the learning model by using incremental learning.

On the other hand, active learning is a learning method in which parameters of a learning model are updated based on retraining by adding ambiguous or infrequent data. In general, it is possible to extend the range of inference of a learning model by using active learning.

Non-appearance data and normal patterns used for retraining of the anomaly classifier 111 and the behavior detector 121 according to the present embodiment are data capable of solving both the increase in quantity and the complement of the frequency of occurrence. Accordingly, the retraining according to the present embodiment can be performed in parallel with incremental learning and active learning.

In another embodiment of the present invention, the second retraining unit 132 may retrain the behavior detector 121 based on incremental learning or active learning by using a part of the video determined as the appearance anomaly pattern. In the description of the decision making process of the decision maker 122, a case where the appearance anomaly pattern is used for retraining will be described.

In another embodiment of the present invention, the training unit may include a first retraining unit 131 and a second retraining unit 132. Therefore, each of the first retraining unit 131 and the second retraining unit 132 may train the anomaly distinguisher 111 and the behavior detector 121 in advance as described above.

Hereinafter, an example of a decision making process of the decision maker 122 according to the present embodiment will be described with reference to FIG. 2. 2 is an exemplary process according to the present embodiment, and implementation including different orders or processes may be performed according to a method of setting a reference value, an appearance category, and an operation method of a non-appearance category.

2 is an exemplary diagram for a decision making process of a decision maker according to an embodiment of the present invention.

The decision maker 122 according to the present embodiment obtains the classification result from the anomaly classifier 111 and obtains the detection result from the behavior detector 121 (S201). As described above, the classification result includes the abnormal score and the normal score for the abnormal video, and the detection result includes the reliability for each occurrence category. In addition, for post-processing of the decision making process, the decision maker 122 may temporarily store the abnormal video.

Based on the detection result, the decision maker 122 checks whether the highest reliability among the reliability for each occurrence category is greater than or equal to a preset first reference value (S202).

If the highest reliability is greater than or equal to the first reference value, the abnormal video is classified into an appearance anomaly pattern (S208), and stored in a corresponding appearance category area on the appearance database 123. For example, the first reference value is set to 0.7, and according to the reliability example 1 of FIG. 2, the reliability of the four appearance categories is greater than or equal to the first reference value. It is kept.

Conversely, if the highest reliability is less than the first reference value, the decision maker 122 checks whether some of the reliability of each occurrence category is greater than or equal to the second reference value (S203). Here, the second reference value may be a value less than or equal to the first reference value. For example, the first reference value is set to 0.1, and according to the reliability example 2 of FIG. 2, the reliability of a plurality of the values is greater than or equal to the second reference value. On the other hand, if the first reference value is set to 0.25, all reliability levels become smaller than the second reference value.

If there is a reliability greater than or equal to the second reference value, the decision maker 122 checks whether the abnormal score is greater than or equal to the normal score based on the classification result (S204).

If the abnormal score is greater than or equal to the normal score, the abnormal video is determined as an appearance anomaly pattern (S208), and is stored in a corresponding appearance category area on the appearance database 123. Here, the corresponding occurrence category can be selected based on the highest reliability.

Conversely, if the abnormal score is less than the normal score, the abnormal video is determined as non-appearance data (S207), and a new non-appearance category is created and stored in the non-appearance database 124. However, if a previously created non-appearance category exists, a new non-appearance category is not created, and a previously created non-appearance category is used.

Even if all the reliability levels are less than the second reference value, the decision maker 122 checks whether the abnormal score is greater than or equal to the normal score based on the classification result (S205).

If the abnormal score is greater than or equal to the normal score, the abnormal video is determined as non-appearance data (S207), and stored in the non-appearance database 124 in the same manner as described above.

Conversely, if the abnormal score is less than the normal score, the abnormal video is determined as a normal pattern (S206), and the abnormal video is stored in the normal category on the non-appearance database 124.

As described above, each of the non-appearance data and the normal pattern stored in the non-appearance database 124 according to the present embodiment is used for retraining of the anomaly classifier 111 and the behavior detector 121.

In another embodiment of the present invention, when a plurality of reliability levels are greater than or equal to the first reference value, a video determined as an appearance anomaly pattern (steps S202 and S208) may be used for retraining of the behavior detector 121. In addition, when the highest reliability is less than the first reference value, a video determined as an appearance anomaly pattern (steps S204 and S208) may also be used for retraining of the behavior detector 121. It is possible to improve the detection accuracy of the behavior detector 121 based on the retraining using the appearance anomaly pattern.

As described above, according to the present embodiment, the server integrates and manages a database for an anomalous pattern that is difficult to accumulate data because the occurrence frequency is low, and the server relearns the anomaly detection device using the database to detect it. There is an effect that it becomes possible to continuously improve the performance.

3 is a flowchart of an anomaly detection method according to an embodiment of the present invention.

The anomaly detection apparatus 100 according to the present embodiment acquires an input video (S301). It is assumed that the input video is obtained from a plurality of CCTVs constituting the physical security control system.

Based on the input video, the anomaly classifier 111 infers an anomaly situation and distinguishes an abnormal video (S302). Here, the anomaly distinguisher 111 may be implemented based on a previously learned deep learning model.

The anomaly discriminator 111 infers an abnormal score and a normal score for an anomaly situation of the input video. The anomaly distinguisher 111 transmits the abnormal video to the behavior detector 121 and provides a discrimination result including the abnormal score and the normal score for the abnormal video.

The behavior detector 121 detects an anomaly pattern corresponding to a plurality of predefined occurrence categories based on the abnormal video (S303). The behavior detector 121 may be implemented based on a previously learned deep learning model.

In detecting the anomaly pattern based on the abnormal video, the behavior detector 121 generates reliability for each occurrence category and provides a detection result including the generated reliability.

The anomaly detection apparatus 100 determines the abnormal video as one of an appearance anomaly pattern, non-appearance data, and a normal pattern (S304). The anomaly detection apparatus 100 classifies the abnormal video based on the identification result provided by the anomaly classifier 111 and the detection result provided by the behavior detector 121.

The anomaly detection apparatus 100 stores the video determined as the appearance anomaly pattern in the appearance database 123, and stores the non-appearance data and the video determined as the normal pattern in the non-appearance database 124 (S305).

The non-appearance data stored in the non-appearance database 124 and the video corresponding to the normal pattern may be used for retraining the anomaly classifier 111 and the behavior detector 121 later.

The anomaly detection device 100 performs double confirmation on the determination of the previous step (S304) (S306). The double check step (S306) is a step to compensate for errors that may occur in the previous step (S304), and may be omitted depending on the performance of the previous step (S304).

The anomaly detection device 100 performs retraining on the anomaly classifier 111 and the behavior detector (S307).

The anomaly detection apparatus 100 retrains the anomaly classifier 111 based on incremental learning or active learning using the video determined as a normal pattern. The anomaly detection apparatus 100 retrains the behavior detector 121 based on incremental learning or active learning using the video determined as non-appearance data.

As described above, according to the present embodiment, by providing an anomaly detection device and method capable of continuously improving detection performance based on a database in which an anomaly pattern for a security video is accumulated, a security company There is an effect that it becomes possible to advance the physical security control system.

In addition, according to the present embodiment, by providing an anomaly detection apparatus and method based on a database in which an anomaly pattern for a security video is accumulated, there is an effect of continuously improving the detection performance of an anomaly pattern for an object of interest for each CCTV. .

Each flow chart according to the present embodiment describes that each process is sequentially executed, but is not limited thereto. In other words, since it may be applicable to change and execute the processes described in the flow chart or execute one or more processes in parallel, the flow chart is not limited to a time series order.

Various implementations of the systems and techniques described herein include digital electronic circuits, integrated circuits, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), computer hardware, firmware, software, and/or their It can be realized in combination. Various such implementations may include being implemented as one or more computer programs executable on a programmable system. The programmable system includes at least one programmable processor (which may be a special purpose processor) coupled to receive data and instructions from and transmit data and instructions to and from a storage system, at least one input device, and at least one output device. Or a general purpose processor). Computer programs (which are also known as programs, software, software applications or code) contain instructions for a programmable processor and are stored on a "computer-readable medium".

Computer-readable media is any computer program product, apparatus, and/or device (e.g., CD-ROM, ROM, memory card, It represents a nonvolatile or non-transitory recording medium such as a hard disk, magneto-optical disk, and storage device).

Various implementations of the systems and techniques described herein may be implemented by a programmable computer. Here, the computer includes a programmable processor, a data storage system (including volatile memory, nonvolatile memory, or other types of storage systems or combinations thereof), and at least one communication interface. For example, the programmable computer may be one of a server, a network device, a set-top box, an embedded device, a computer expansion module, a personal computer, a laptop, a personal data assistant (PDA), a cloud computing system, or a mobile device.

The above description is merely illustrative of the technical idea of the present embodiment, and those of ordinary skill in the technical field to which the present embodiment pertains will be able to make various modifications and variations without departing from the essential characteristics of the present embodiment. Accordingly, the present embodiments are not intended to limit the technical idea of the present embodiment, but to explain the technical idea, and the scope of the technical idea of the present embodiment is not limited by these embodiments. The scope of protection of this embodiment should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present embodiment.

100: anomaly detection device 110: anomaly video filter
111: anomaly discriminator 120: anomaly video collector
121: behavior detector 122: decision maker
130: incremental online learner 131: first retraining unit
132: second retraining unit

Claims (17)

An anode that acquires an input video, infers an anomaly situation based on the input video, and distinguishes the input video into a normal video and an abnormal video based on the anomaly situation. Marley Separator;
A behavior detector for detecting an anomaly pattern corresponding to a plurality of predefined appearance categories based on the abnormal video; And
A decision maker that determines the abnormal video as an appearance anomaly pattern or non-appearance data based on the identification result of the anomaly distinguisher and the detection result of the behavior detector
Anomaly detection device comprising a. The method of claim 1,
The anomaly distinguisher is implemented based on a deep learning model, but unsupervised learning performed without GT (Ground Truth) or weakly-supervised learning using a clue as to whether the anomaly situation is included learning) based on the anomaly detection device, characterized in that the training in advance. The method of claim 1,
The anomaly distinguisher,
Inferring an abnormal score and a normal score for an anomaly situation of the input video, and comparing the abnormal score with a preset threshold to distinguish the input video as the normal video or the abnormal video, And transmitting the abnormal video to the behavior detector, and transmitting a discrimination result including the abnormal score and the normal score for the abnormal video to the decision maker. The method of claim 1,
The behavior detector is implemented based on a deep learning model, wherein the behavior detector is pre-trained based on supervised learning using GT corresponding to the plurality of appearance categories. The method of claim 3,
The behavior detector,
In detecting the anomaly pattern based on the abnormal video, anomaly detection, characterized in that, in the case of detecting the anomaly pattern, the confidence (confidence) for each of the plurality of occurrence categories and the detection result including the reliability is transmitted to the decision maker Device. The method of claim 5,
The decision maker,
If the highest reliability among the reliability of the plurality of categories is greater than or equal to a preset first reference value, a corresponding abnormal video is determined as the appearance anomaly pattern. The method of claim 5,
The decision maker,
And if the reliability of all of the plurality of categories is less than the second reference value and the abnormal score is greater than or equal to the normal score, a corresponding abnormal video is determined as the non-appearance data. The method of claim 5,
The decision maker,
When the reliability of all of the plurality of categories is less than a preset second reference value and the normal score is greater than the abnormal score, a corresponding abnormal video is determined as a normal pattern. The method of claim 5,
The decision maker,
Anomaly detection, characterized in that, when the reliability of some of the reliability of the plurality of categories is greater than or equal to a preset second reference value, a corresponding abnormal video is determined as the appearance anomaly pattern or the non-appearance data depending on the discrimination result. Device. The method of claim 8,
An appearance database storing videos determined by the appearance anomaly pattern for each of the plurality of predefined appearance categories; And
Including a plurality of unseen categories, a video determined as the non-appearance data is stored for each of the plurality of unseen categories, and a video determined as the normal pattern is stored, further including a normal category. Unappeared database
Anomaly detection device, characterized in that it further comprises. The method of claim 8,
And a first retraining unit for retraining the anomaly classifier based on incremental learning or active learning using the video determined as the normal pattern. The method of claim 1,
And a second retraining unit for retraining the behavior detector based on incremental learning or active learning using the video determined as the non-appearance data. In the anomaly detection method of the anomaly detection device,
The process of obtaining an input video;
The input video is input to a pre-trained anomaly classifier to infer an anomaly situation, and based on the anomaly situation, the input video is divided into a normal video and an abnormal video. The process of doing;
Inputting the abnormal video to a pre-trained behavior detector to detect an anomaly pattern corresponding to a plurality of predefined appearance categories; And
A process of determining the abnormal video as one of an appearance anomaly pattern, non-appearance data, and a normal pattern based on the identification result of the anomaly distinguisher and the detection result of the behavior detector
Characterized in that it comprises a, anomaly detection method implemented on a computer. The method of claim 13,
Storing the video determined as the appearance anomaly pattern for each of the plurality of predefined appearance categories in an appearance database; And
Storing a video determined as the non-appearance data for each of a plurality of unseen categories in a non-appearance database;
The process of storing the video determined as the normal pattern in the non-appearance database
It characterized in that it further comprises, an anomaly detection method implemented on a computer. The method of claim 13,
An anomaly implemented on a computer, characterized in that it further comprises a process of retraining the anomaly classifier based on incremental learning or active learning using the video determined as the normal pattern. Detection method. The method of claim 13,
And retraining the behavior detector based on incremental learning or active learning using the video determined as the non-appearance data. A computer program stored in a computer-readable, nonvolatile or non-transitory recording medium to execute each step included in the anomaly detection method according to any one of claims 13 to 16.

Images