A multi-layer airport security framework using YOLO-based X-ray detection, video anomaly analysis, IoT sensor monitoring and blockchain logging

Abstract

Security screening systems require reliable and real-time detection of threats in complex X-ray imagery and surrounding environments. Manual inspection of baggage images is often a overhead due to operator fatigue, cluttered objects and overlapping items. Recent advances in deep learning and intelligent sensing technologies provide opportunities for automated threat detection in such environments. In this work, we propose a multi-layer airport security framework integrating three complementary detection modules: YOLO-based X-ray prohibited-item detection, video anomaly detection for behavioural monitoring, and IoT-based environmental anomaly sensing. In addition to this, a blockchain-secured logging mechanism is incorporated to ensure tamper-proof storage of security events. The X-ray detection module employs YOLOv11-s trained on the CLCXray dataset to identify prohibited items in baggage. Behavioural anomalies in surveillance footage are detected using a 3D-CNN autoencoder, while environmental anomalies from IoT sensors are identified using an LSTM autoencoder. Outputs from these modules are integrated using a unified multimodal risk scoring mechanism. Experimental results demonstrate that YOLOv11-s achieves mAP of 78.91% and YOLOv8-s achieves mAP of 78.49% with strong detection reliability across varying confidence thresholds, both the models have comparable performance and either of it could be chosen. The IoT anomaly detection produces reconstruction errors in the range of 0.019–0.03, with anomalies identified when the error exceeds a threshold of 0.041 and for video anomaly its 0.0040–0.00685. The proposed multimodal fusion module achieves ROC-AUC score of 0.864, which demonstrated an improved detection reliability compared to individual modalities. Also, the framework achieves an average detection latency of 0.014 ms per event, while the blockchain logging module records security events with an average latency of 0.179 ms and supports up to 5723.47 transactions per second. These results demonstrate that the proposed framework provides an effective, scalable, and secure solution for automated airport security monitoring systems.

Introduction

Airports are critical infrastructures.Its an area where huge passengers and high baggage throughput creates security challenges. Traditional screening systems rely heavily on human operators like analysing X-ray baggage scans and monitoring surveillance feeds, which can lead to operator fatigue, oversight, and delayed threat detection. Recent advances in artificial intelligence and computer vision have enabled automated inspection systems which are capable of identifying suspicious objects and abnormal behaviour in real time^1–3.Deep learning-based object detection techniques have demonstrated strong performance in detecting prohibited items within X-ray security imagery. Datasets such as SIXray and CLCXray provide large-scale annotated benchmarks for evaluating threat detection models under complex occlusion and clutter conditions^4,5. Modern object detectors such as Faster R-CNN, SSD, and YOLO variants is widely adopted for automated baggage screening due to their ability to detect multiple objects together with high accuracy^6,7. Among these, YOLO-based detectors are better in terms of detection accuracy and inference speed, enabling real-time deployment in security screening systems⁸.In addition to object detection, surveillance video analysis plays an important role in identifying behavioural anomalies such as suspicious movement patterns, abandoned baggage, or loitering in restricted area^9,10. Public datasets such as Avenue dataset provide frame-level anomaly annotations that enable evaluation of video anomaly detection models in crowded environments¹¹and environmental sensor data from IoT networks can recognize unusual fluctuations in physical conditions such as temperature, humidity, which are of serious concern^12,13.However, existing airport security solutions often operate these modalities independently. Object detection, surveillance monitoring, and IoT sensor analytics are processed in separate systems,which limits their ability to capture complex multi-modal threat patterns^3,14. Furthermore, security event records must be stored securely to prevent tampering or unauthorized modifications. Blockchain-based logging frameworks provide immutable event storage and traceability for security monitoring systems^15–17,37.

Motivated by these challenges, this work proposes a unified multi-layer anomaly detection framework for airport security that integrates X-ray baggage inspection, surveillance video anomaly detection, and IoT sensor monitoring with a secure blockchain-based logging architecture. The proposed framework employs a YOLOv11-based detector for prohibited item detection, combined with video anomaly scoring and IoT anomaly monitoring. Unlike conventional fusion approaches, the system performs multi-modal decision analysis where fusion-based anomaly detection is supplemented by independent prohibited item detection logic to ensure critical threats are not underestimated.The proposed system is evaluated using the CLCXray dataset for prohibited item detection and the Avenue dataset for video anomaly detection^5,11. Experimental results demonstrate that the YOLOv11-s model achieves stronger detection performance while maintaining real-time inference capability. Also, the integrated framework achieves an ROC-AUC score of 0.73 for multimodal anomaly detection while maintaining low latency and efficient blockchain-based event logging (Table 1).

Table 1.

Comparison of existing airport security monitoring approaches (Grouped by functional modules).

Sl	Reference / Method	Objective	Methodology used	How work relates / Improves
X-ray Prohibited Item Detection
1	SIXray Dataset4	Detect prohibited items in X-ray images	CNN / YOLO variants	YOLOv11 improves detection stability.
2	CLCXray Detection Model5	Overlapped item detection	Label-aware CNN	Enhanced augmentation improves detection.
3	YOLO Object Detection6,18	Real-time detection	CNN-based detection	Extended to multimodal monitoring.
4	Attention-based X-ray Detection19	Handle occlusion	Attention CNN	Improved feature extraction in YOLOv11.
5	Powder Detection in X-ray Images20	Detect powders	Attention CNN	Similar threat patterns captured.
6	Deep Learning for Baggage Screening7	Improve screening	Image enhancement	Integrated with YOLO detection.
7	YOLO-based Real-time Detection Study1	Automated inspection	Deep CNN	Faster multi-class detection.
Video Anomaly Detection and Behavioural Analysis
8	Video Anomaly Detection Survey2	Detect abnormal behaviour	Spatio-temporal DL	Identifies suspicious activities.
9	Crowd Behaviour Anomaly Detection10	Detect crowd anomalies	CNN + RNN	Behaviour monitoring improved.
10	Edge AI Surveillance Systems14	Local anomaly detection	Edge AI + vision	Enables real-time monitoring.
IoT-based Monitoring and Anomaly Detection
11	IoT Anomaly Detection Survey13	Sensor anomaly detection	IoT modelling	Detects environmental anomalies.
12	Privacy-preserving IoT Frameworks21	Secure communication	Encryption + FL	Secure IoT integration.
13	IDeep Learning for IoT Data Analysis22	Threat detection	IoT + DL	Integrated anomaly scoring.
14	IWGAN-based Network Anomaly Detection23	Detect Wi-Fi anomalies	GAN	Multi-source anomaly detection.
15	IoT Healthcare Monitoring Systems24	IoT frameworks	Sensor architectures	Applied to anomaly detection.
Blockchain-based Secure Logging
16	Blockchain-based Secure Logging Systems15	Preserve log integrity	Hash chaining	Tamper-proof storage.
17	Blockchain-based Detection Framework16	Secure detection systems	Blockchain pipelines	Integrated with detection modules.
18	Blockchain-enabled Medical Data Framework25	Secure data sharing	Blockchain + DL	Used for secure logging.
19	Blockchain-based IoT Security Framework26	Secure IoT monitoring	RL + blockchain	Secure anomaly detection.
20	Multimodal Airport Security Monitoring	Detect prohibited items and behavioural anomalies	YOLOv11 + video anomaly detection + IoT monitoring + blockchain logging	Unified framework integrating X-ray, video, IoT, and blockchain modules

The contributions of this work are summarized as follows:

• A unified multi-modal anomaly detection framework which integrated X-ray inspection, surveillance monitoring, and IoT anomaly analysis.

• A YOLOv11-based prohibited item detection model that is optimized for real-time airport baggage screening.

• A decision-level fusion mechanism that combines behavioural anomaly detection with independent threat identification.

• A blockchain-based secure logging mechanism for immutable storage of security events.

Related work

Recent studies have explored automated airport security systems using deep learning and multi-modal sensing^1,3. Convolutional neural networks have been widely applied to detect prohibited items in X-ray baggage scans, with datasets such as SIXray and CLCXray by enabling large-scale evaluation of detection models under occlusion conditions^4,5,8. Many object detection architectures including Faster R-CNN, SSD, and YOLO-based models have been investigated for security screening^6,7,18,36. Also, video anomaly detection techniques using convolutional autoencoders, LSTM networks, and transformer-based architectures have demonstrated good results for surveillance monitoring^2,9,10.IoT-based monitoring systems have been proposed to detect abnormal sensor activity inside smart surveillance infrastructures^12,13. More recently, blockchain-based logging frameworks have been explored that ensures secure and tamper-resistant event storage in distributed detection systems^15–17. However, most existing approaches focus on single-modality detection and do not fully integrate visual, behavioural, and sensor-based anomaly detection within a unified architecture^3,14.

Research gap

Eventhough significant progress has been made in individual areas such as X-ray prohibited item detection, video anomaly detection and IoT-based monitoring^2,8,12, most of the existing approaches focuses on a single modality. Real-world airport security environments require integrated monitoring frameworks that combines multiple data sources to improve detection reliability and situational awareness^3,14. Many existing systems lack secure mechanisms for storing anomaly events and maintaining tamper-proof audit trails^15,16. The proposed framework addresses all of these limitations by integrating X-ray prohibited item detection, video behavioural anomaly detection and IoT-based environmental monitoring within a unified multimodal architecture. In addition, a blockchain-based logging is added to ensure secure and immutable storage of anomaly events, thereby providing a comprehensive and reliable solution for intelligent airport security monitoring^15,17.

Results

The proposed multi-layer airport security framework was evaluated across X-ray prohibited-item detection, video anomaly detection, IoT anomaly monitoring, multimodal fusion, and blockchain-based logging^2,8,12,16.For prohibited item detection, YOLOv8-s achieved mAPof 0.89719 and mAP of 0.78487, with a precision of 0.92067 and recall of 0.86179. YOLOv11-s demonstrated a slightly improved performance with mAP of 0.89888 and mAP of 0.78917, with a precision of 0.90449 and recall of 0.86067. Although the performance gain is marginal, the consistent improvement in mAP indicates enhanced localization stability and generalization capability, supporting the effectiveness of architectural refinements in YOLOv11-s for just 50 epochs as compared to YOLOv8-s which runs for a total of 180 epochs^19,27.Either of the models can be used for detecting prohibited items since there is a marginal performance gain,for running equal number of epochs.For IoT anomaly detection, sensor data consisting of temperature, humidity, and vibration signals were synthetically generated using a Python-based simulation framework to evaluate environmental conditions in airport infrastructure.Synthetic IoT data lets you make both normal and abnormal patterns in a controlled way. This makes it possible to test how well anomaly detection works in a planned way in different situations.Synthetic anomaly generation is a widely adopted approach in IoT anomaly detection when real-world datasets are not available^28,29. The LSTM autoencoder achieved a normal reconstruction error in the range of 0.019–0.03 for normal data, with anomalies identified when the error exceeds a threshold of 0.041, with ROC–AUC score of 1.0, demonstrating clear statistical separation between normal and anomalous sensor behaviour.Similarly, the Conv3D video autoencoder effectively captured spatio-temporal deviations,by producing reconstruction errors of 0.00413 for normal behaviour and 0.00425–0.00685 for anomalous events. The ROC–AUC metric,that provides a threshold-independent statistical evaluation of classification performance, confirms the model’s ability to distinguish normal and abnormal patterns for varying thresholds^2,9.The simulated IoT dataset closely aligns with real-world sensor behaviour, as confirmed through comparison with the Intel Lab dataset³⁰, where temperature (S: 22.10, R: 22.26) and humidity (S: 39.75, R: 39.41) show very similar mean values, with slightly lower but comparable variance (temperature: S: 8.55, R: 12.29; humidity: S: 30.90, R: 40.47). In addition, a consistent negative correlation between parameters is observed (S: -0.43, R: -0.60), while low Kolmogorov–Smirnov statistics (S: 0.05–0.06) show minimal distributional deviation.The multimodal fusion mechanism combined anomaly scores to produce a unified risk score, achieving an ROC–AUC value of approximately 0.864. This demonstrates an improved detection robustness compared to individual modalities by including complementary behavioural and environmental signals³.Detection events generated by all subsystems were securely recorded using the blockchain-based logging framework. The system achieved an average logging latency of 0.000179 seconds, a throughput of 5723.47 transactions per second, and an average storage overhead of 110.89 bytes per event, demonstrating efficient and scalable secure event recording^15,16.

To position the proposed YOLOv11-based detection model within the context of existing object detection architectures, its performance is compared with several widely used detectors including NAS-FOS,PAA,MHT-X, YOLOv8, and YOLOv10 (Fig. 1). The results show that YOLOv11 provides marginally better detection performance compared to earlier YOLO variants while maintaining comparable computational efficiency, highlighting its effectiveness in real-time prohibited item detection of complex X-ray imagery (Tables 2, 3, 4, 5, 6).

Fig. 1.

Sample detection results of the trained YOLO model on CLCXray dataset.

Table 2.

Performance comparison on the CLCXray dataset.

Method
NAS-FOS31	72.3	57.3
PAA31	71.6	58.3
MHT-X31	80.87	65.26
FCOS+DOAM31	68.5	54.3
ATTS+LAcls31	71.8	59.3
YOLOv8-n31	82.6	71.9
YOLOv10-n31	82.9	72.3
YOLOv10-s31	83.8	73.9
YOLOv11-n31(baseline)	82.0	71.9
YOLOv8-s	89.71	78.49
YOLOv11-s	89.88	78.92

Table 3.

Performance of CLCXray dataset models.

Sl No	Model name	Type	Layers	Parameters	GFLOPs	mAP50	mAP50–95	Precision	Recall
1	YOLOv11-s	X-ray Detection	100	9,417,444	21.3	0.89888	0.78917	0.90449	0.86067
2	YOLOv8-s	X-ray Detection	72	11,130,228	28.5	0.89719	0.78487	0.92067	0.86179

Table 4.

Performance of autoencoder models (IoT and Video).

Sl No	Model name	Type	Normal rec. error	Anomaly rec. error
1	IoT LSTM-AE	IoT Anomaly Detection	0.019–0.03	0.041
2	Video Conv3D-AE	Video Anomaly Detection	0.00413	0.00425–0.00685

Table 5.

Multimodal fusion performance metrics.

Sl No	Model name	Type	Video score	IoT score	Risk score
1	Multimodal Fusion	Video + IoT + X-ray Fusion	0.4114	0.5119	0.4277

Table 6.

Blockchain logging performance metrics.

Sl No	Metric	Value	Description
1	Average Event Logging Latency	0.000179 seconds	Time required to append a security event to the blockchain ledger
2	Throughput	5723.47 transactions/sec	Number of security events processed per second
3	Ledger File Size	110890 bytes	Total storage size of the blockchain ledger file
4	Storage Overhead per Event	110.89 bytes	Average storage cost for each logged event

Visualisation

The visualisation outputs demonstrate the effectiveness of the proposed multi-layer security system across X-ray, video and IoT modalities. For X-ray analysis, YOLOv11-s consistently identifies prohibited items such as knives, blades, scissors, bottles, cans and daggers with high-confidence bounding boxes, even in heavily cluttered bags with overlapping objects^5,8. The predicted regions align closely with object boundaries, by indicating strong spatial localisation performance. YOLOv8-s produces similar detections, but with slightly less bounding-box stability in densely occluded scenes, strengthening the advantage of YOLOv11-s on complex baggage imagery⁶.Video anomalies further confirm the system’s ability to detect unappropriate human behaviour. The Conv3D autoencoder maintains a low reconstruction error for normal activities such as walking or standing, while shows visibly higher reconstruction error for abnormal events including running, falling and restricted-zone entry^2,9.IoT anomaly visualisations show clear deviations in sensor patterns, where temperature, vibration or humidity spikes are easily distinguishable from baseline readings^12,13. Together, these qualitative results supports the quantitative metrics and demonstrates that the proposed framework can accurately detect suspicious items, behaviours and environmental conditions in realistic screening environments (Figs. 2, 3, 4, 5).

Fig. 2.

Loss convergence for the proposed YOLO model on CLCXray dataset.

Fig. 3.

mAP performance trends of the proposed YOLO model during training on CLCXray dataset.

Fig. 4.

ROC curves for X-ray and video anomaly detection models.

Fig. 5.

ROC curves for IoT anomaly detection and multimodal fusion models.

Discussion

The results demonstrate that the proposed multi-layer framework effectively integrates various security modalities to improve detection reliability. The YOLOv11-s model shows a slight but consistent improvement over YOLOv8-s, that indicates an enhanced feature representation and localization stability.The IoT anomaly detection model achieved an ROC–AUC of 1.0, showing a clear separation between normal and anomalous sensor readings. This is primarily due to the controlled generation of synthetic anomalies, which introduces distinct deviations from normal behaviour. However, real-world IoT data may present more complex and overlapping patterns.The video anomaly detection module captures spatio-temporal deviations, which demonstrates its capability to detect abnormal behavioural patterns without requirement of any labelled anomaly data. A key contribution of this work is the multimodal fusion mechanism, which combines video and IoT anomaly scores to produce an unified risk assessment. The fusion model achieves an ROC–AUC of 0.73, which shows an improved robustness compared to individual modalities by making use of complementary information.Compared to any existing single-modality approaches such as X-ray detection or video-based anomaly detection^2,8, the proposed framework provides a more stronger and coordinated security solution through integrated decision-level analysis.The blockchain-based logging mechanism further enhances system reliability by ensuring tamper-resistant storage of detection events while maintaining low latency.Despite these advantages, the framework is limited by the use of synthetic IoT data. Future work must focus on real-world deployment, adaptive fusion strategies, and extending detection capabilities to additional threat categories such as drugs,inorganic powders.

Methodology

The proposed airport security monitoring framework integrates multiple anomaly detection modules that analyses multiple security data sources. The system combines prohibited item detection from X-ray baggage images, behavioural anomaly detection from surveillance video streams, and anomaly monitoring from IoT sensor data^2,8,12. Each module independently processes its corresponding data modality and generates anomaly scores representing the likelihood of abnormal events. These anomaly scores are integrated using a weighted fusion mechanism that estimates an overall risk score. The resulting events are recorded using a blockchain-based secure logging framework that ensures tamper-resistant storage of security monitoring data^15,16.

System framework

The proposed architecture consists of four major modules:

1. prohibited item detection using X-ray imagery,

2. behavioural anomaly detection from surveillance videos,

3. IoT sensor anomaly detection, and

4. blockchain-based event logging.

Figure 6 illustrates the interaction between these components. The prohibited item detection module analyses X-ray baggage images using a YOLOv11-based object detection model trained on CLCXray dataset⁵.The model identifies threat objects such as knives,gun,blade,cans, and other hazardous items inside baggage scans and produces detection confidence scores representing the likelihood of prohibited objects. The video anomaly detection module analyses surveillance video sequences obtained from the Avenue dataset¹¹. Video frames are extracted from surveillance streams and analysed to compute anomaly scores that represent deviations from normal behavioural patterns.The IoT monitoring module analyses sensor readingsthat represents environmental conditions within airport infrastructure. IoT-based monitoring systems are increasingly used for infrastructure security and anomaly detection due to their ability to continuously monitor environmental conditions^12,13,24. Since publicly available airport IoT datasets are limited because of security restrictions, synthetic sensor data are generated using Python-based simulation techniques^28,29. These simulated datasets represent sensor measurements such as temperature readings,humidity and vibration. Each detection module generates anomaly events containing information such as anomaly type, anomaly score, timestamp, and detection source. These events are subsequently integrated and analysed by the decision module to determine the final system risk state.

Fig. 6.

Proposed Multimodal Anomaly Detection Framework integrating video, IoT sensor data, and prohibited item screening with weighted fusion and blockchain logging.

Datasets

The proposed airport security monitoring framework utilizes three datasets corresponding to different security monitoring modalities: X-ray baggage imagery, surveillance video streams, and IoT sensor data. Each dataset represents a different layer of the airport security monitoring pipeline. The prohibited item detection module uses the CLCXray dataset⁵, which contains annotated X-ray baggage images collected for airport security screening research. For the CLCXray dataset, the original annotations were provided in COCO-style JSON format. To enable training using the YOLO detection framework, the annotations were converted into YOLO label format. In this format, each object instance is represented by a class identifier and normalized bounding box coordinates corresponding to the object center location, width, and height relative to the image dimensions. After annotation conversion, the dataset was organized into a YOLO training directory structure containing separate folders for images and label files. All images were then resized to pixels to match the input resolution required by the YOLO model. The dataset includes bounding box annotations for prohibited objects belonging to twelve different classes, including items such as knives, guns, scissors, daggers, and other hazardous tools^4,5. Behavioural anomaly detection is performed using the Avenue dataset¹¹. This dataset contains surveillance video sequences with frame-level annotations indicating whether observed behaviour corresponds to normal activity or abnormal events. Therefore, the dataset consists of two classes: normal and abnormal behaviour. Since publicly available airport IoT datasets are limited due to privacy and security restrictions, a synthetic IoT sensor dataset was generated using Python-based simulation techniques^28,29. Synthetic IoT data enables the generation of both normal and abnormal patterns in a controlled manner, making it possible to evaluate anomaly detection performance under diverse conditions.The simulated IoT dataset closely aligns with real-world sensor behaviour, as confirmed through comparison with the Intel Lab dataset³⁰, where temperature (S: 22.10, R: 22.26) and humidity (S: 39.75, R: 39.41) show very similar mean values, with slightly lower but comparable variance (temperature: S: 8.55, R: 12.29; humidity: S: 30.90, R: 40.47). In addition, a consistent negative correlation between parameters is observed (S: -0.43, R: -0.60), while low Kolmogorov–Smirnov statistics (S: 0.05–0.06) show minimal distributional deviation (Tables 7, 8, 9, 10).

Table 7.

Basic information of the datasets used in this work.

Sl No	Dataset name	Total samples	Training split	Validation split	Testing split	Number of classes	Sample resolution
1	CLCXray (X-ray Dataset)	9,565 images	7,652	956	957	12 classes (blade,dagger,knife, scissors,swiss army knife,cans,carton drinks,plastic bottle,vaccum pump,spray cans)	Images resized to 640640
2	Avenue Dataset (Video)	30,000 frames (16 videos)	15,324	3,816	10,860	2 classes (Normal / Abnormal)	Frames resized to 224224
3	IoT Dataset (This Work)	2,880 samples	2,304	288	288	2 classes (Normal / Abnormal derived from anomaly detection)	3-sensor vector: [temperature, humidity, vibration]

Table 8.

Features of the CLCXray dataset used for prohibited item detection.

Sl No	Feature name	Description
1	Image_ID	Unique identifier assigned to each X-ray baggage image.
2	Image	X-ray scan representing the internal contents of baggage items.
3	Bounding_Box	Coordinates specifying the spatial location of an object within the X-ray image.
4	Object_Class	Annotated prohibited item category such as knife, firearm, wrench, or other hazardous objects.

Table 9.

Feature description of the synthetic IoT sensor dataset.

Sl No	Feature	Description
1	Timestamp	Time at which the environmental sensor reading was recorded.
2	Temperature	Simulated environmental temperature measurement representing airport infrastructure conditions.
3	Humidity	Relative humidity measurement indicating environmental moisture levels.
4	Vibration	Sensor reading representing structural or equipment vibration patterns.

Table 10.

Feature description of the Avenue video anomaly dataset.

Sl No	Feature	Description
1	Video Frames	Individual frames extracted from surveillance video sequences.
2	Pixel Intensities	RGB pixel values representing visual information within each frame.
3	Temporal Sequence	Ordered sequence of frames used to capture motion behaviour in surveillance scenes.

Pre-processing

For the X-ray baggage dataset, all images were resized to pixels to match the input requirements of the YOLO-based object detection model⁶after converting to YOLO-labels. This resizing step ensures there are consistent spatial dimensions across all training and inference samples while preserving all the relevant visual information that is required for object detection. For the surveillance video dataset, video sequences from the Avenue dataset were processed using OpenCV to extract individual frames from the recorded videos¹¹. Each extracted frame was resized to pixels at the rate of 5 fps to reduce computational complexity while preserving spatial features that are required for anomaly detection^2,9. The synthetic IoT dataset contains environmental sensor readings consisting of timestamp, temperature, humidity, and vibration measurements. As the dataset contains only three sensor attributes,the sensor readings were directly used as input for anomaly detection without applying additional preprocessing operations such as feature normalization or dimensionality reduction¹².

Models

The proposed airport security monitoring system employs multiple machine learning models to analyse multiple data modalities including X-ray baggage images, surveillance video streams, and IoT sensor readings^2,8,12. Each model is designed to process a specific data source and generate anomaly indicators which are later used by the multimodal monitoring framework.

Prohibited item detection model

YOLOv11-S employs a multi-stage architecture having a CSP-based backbone, a BiFPN neck, and a decoupled detection head³². The backbone extracts hierarchical features using convolutional and CSP blocks with efficient gradient flow. The BiFPN aggregates multi-scale features that enhances detection of small and overlapping X-ray objects⁸. The anchor-free decoupled head predicts object classes and bounding boxes directly, by enabling efficient and accurate real-time detection⁷.

The prohibited item detection module employs a YOLOv11-based object detection model. YOLO (You Only Look Once) is a single-stage object detection framework which is capable of simultaneously performing object localization and classification within a single forward pass through a convolutional neural network¹⁸. Due to its high detection speed and accuracy (Fig. 7), YOLO-based detectors are widely used for real-time security inspection applications^6,8. The model was trained using the CLCXray dataset⁵, which contains annotated X-ray baggage images⁴. Since the original annotations were provided in COCO format, they were converted into YOLO label format prior to training. Training was performed using the Ultralytics YOLO training framework with an input image resolution of ³³. The YOLOv8-s model was fine-tuned using transfer learning from pretrained weights and trained for a total of 160 epochs, consisting of an initial training phase of 80 epochs followed by an additional fine-tuning stage of 80 epochs whereas YOLOv11-s was trained for 50 epochs⁶. During training, the model learns the spatial features that allows it to detect prohibited objects such as knives, blades, scissors, and other hazardous items that are present in baggage scans⁸. The trained YOLO detection model predicts bounding box coordinates, object class labels, and confidence scores for each detected object.

Fig. 7.

YOLOv11 network architecture illustrating backbone, neck, and head components used for object detection³².

Video anomaly detection model

The video anomaly detector is implemented using a 3D-CNN autoencoder that captures spatio-temporal patterns in surveillance data^2,9,38. The encoder compresses video volumes by using a stacked 3D convolutions to learn motion and appearance features. The decoder reconstructs the input sequence, and deviations between input and reconstruction indicate abnormal behaviour. Reconstruction error is used as the anomaly score, enabling efficient real-time detection of unusual activities². Behavioural anomaly detection in surveillance footage is performed using video data obtained from the Avenue dataset¹¹. Video anomaly detection models analyse temporal patterns in surveillance frames to identify deviations from normal behavioural patterns that occur within monitored environments^2,9. In the proposed framework, surveillance videos are first processed using OpenCV to extract individual frames from the recorded video sequences. Each frame is resized to pixels to reduce computational complexity while preserving important spatial features required for anomaly detection². The video anomaly detection module processes the extracted frames and computes anomaly scores that represent deviations from normal motion behaviour⁹. Higher anomaly scores correspond to abnormal events such as irregular motion trajectories,loitering in and around restricted zones or any unusual activities occurring within the surveillance scene (Figs. 8, 9).

Fig. 8.

Architecture of the 3D CNN autoencoder used for anomaly detection and classification³⁴.

Fig. 9.

LSTM autoencoder architecture showing encoder, bottleneck, and decoder generating reconstructed sequences³⁵.

IoT sensor anomaly detection model

The IoT anomaly detection module employs an LSTM autoencoder to model temporal dependencies in sensor data^12,13. The encoder compresses sequential sensor readings into a latent representation by capturing normal operating behaviour. The decoder reconstructs this sequence, and deviations between input and reconstruction indicate anomalies. Reconstruction error is used as the anomaly score, enabling effective detection of abnormal temporal patterns in IoT sensor streams^12,35.

Environmental monitoring within airport infrastructure is performed using IoT sensor readings representing temperature, humidity, and vibration measurements^12,13,24. IoT-based anomaly detection systems analyse the sensor signals to identify abnormal environmental behaviour or equipment malfunction¹³. Since airport IoT datasets are limited due to privacy and security constraints, a synthetic IoT dataset was generated in this work to simulate environmental monitoring conditions^28,29. The dataset contains timestamped sensor readings that represents temperature, humidity, and vibration measurements collected over time. The IoT anomaly detection module analyses these sensor signals to identify deviations from normal operational behaviour¹². Variations in sensor readings beyond the expected patterns indicate potential abnormal environmental conditions within the monitored infrastructure.

Fusion weight computation

To integrate anomaly indicators obtained from multiple monitoring modules, the proposed framework employs a weighted multimodal fusion mechanism³. This fusion process combines anomaly scores generated from the video anomaly detection module, IoT sensor monitoring module, and X-ray object detection module to produce a unified behavioural risk score.

Before performing fusion, the anomaly scores produced by each modality are normalized to ensure comparability across different score distributions. Min–max normalization is applied as follows:

1

where denotes the original anomaly score of the i-th sample in modality m, and represents the corresponding normalized score. Here, and denote the minimum and maximum anomaly scores observed within modality m.

Following normalization, an aggregate anomaly score for each modality is computed as the mean of its normalized values:

2

where represents the total number of samples in modality m, and corresponds to video, IoT, and X-ray modalities, respectively.

The fusion weights are then computed dynamically by normalizing the aggregated modality scores:

3

such that the weights satisfy the normalization constraint:

4

Finally, the overall fused anomaly score R is computed as a weighted combination of the modality-specific anomaly scores:

5

where , , and denote the normalized anomaly scores obtained from the video, IoT, and X-ray modules, respectively.The fusion weights are not manually assigned but are dynamically computed in a prior stage based on the statistical characteristics of each modality. These weights are subsequently used during real-time fusion and decision-making, ensuring consistency across system components.This dynamic weighting strategy enables the system to adaptively assign higher importance to modalities exhibiting stronger anomaly signals, thereby improving robustness and reliability compared to conventional fixed-weight fusion approaches.

Multi-modal risk assessment

After computing the fused anomaly score R, the system categorizes the security risk into three levels based on statistically derived thresholds: normal, warning, and critical. Let denote the standard deviation of the fused anomaly scores. The warning and critical thresholds are defined as

6

7

The fusion status is determined as

8

In parallel, the X-ray detection module evaluates whether a prohibited object is present. Let denote the X-ray detection confidence score and represent the X-ray detection threshold defined as

9

where and denote the mean and standard deviation of the X-ray detection scores respectively. If , the system flags the presence of a prohibited item.It is important to note that the X-ray modality contributes both to the fused anomaly score and is independently used for explicit prohibited item detection. This dual-role design enables both integrated anomaly assessment and direct object-level threat identification.The final system alert combines the behavioural fusion status with the prohibited item detection result, enabling detection of both behavioural anomalies and object-based security threats.

Algorithm 1.

Multimodal threat detection using adaptive fusion-based risk scoring.

Experimental setup and evaluation metrics

All experiments were conducted on a GPU-enabled system using Python and the Ultralytics framework for YOLO training³³. The CLCXray dataset was used as provided by the original authors, which includes predefined training, validation, and testing splits^4,5.

Two YOLO model variants were evaluated for prohibited item detection. YOLOv8-s was trained using a two-stage strategy. In the first stage, the model was trained for 80 epochs using pretrained COCO weights (Fig. 10). In the second stage, the best checkpoint from the first stage was used for further training over an additional 80 epochs to refine feature representations. YOLOv11-s was trained for 50 epochs using an input resolution of pixels and a batch size of 16. Standard YOLO data augmentation techniques were applied to improve performance of the model⁸.

Fig. 10.

Critical threat scenario illustrating multimodal fusion-based risk scoring for a passenger carrying a prohibited item in a restricted zone. The system integrates video anomaly detection, IoT sensor monitoring, and X-ray detection to compute a unified risk score and trigger alerts.

For behavioural monitoring, the video anomaly detection module processes surveillance frames that are extracted from the Avenue dataset at 5 frames per second (FPS). The IoT anomaly detection module analyses environmental sensor readings consisting of temperature, humidity, and vibration measurements. The video analysis model uses a Conv3D autoencoder, while the IoT subsystem uses an LSTM autoencoder to model normal patterns.

For multimodal evaluation, anomaly scores generated from the video and IoT subsystems were normalized and fused using the weighted strategy defined in Eq. (1)–(3). The final fused score is used to detect anomalies

To assess detection performance, several standard evaluation metrics were employed. Intersection over Union (IoU) measures the overlap between predicted and ground-truth bounding boxes:

10

Overall detection performance is quantified using mean Average Precision (mAP):

11

where represents the average precision for class c, and N is the total number of classes^5,33. Precision and Recall are defined as:

12

The F1-score is computed as:

13

For anomaly detection models, Receiver Operating Characteristic (ROC) analysis is used to evaluate the classification capability. The Area Under the Curve (ROC-AUC) quantifies the model’s ability to distinguish between normal and abnormal samples.

For YOLO detection outputs, the confidence score is defined as:

14

Finally, detection events generated by all the subsystems are recorded using a blockchain-based logging framework, ensuring secure and tamper-resistant storage of monitoring data^15,16.

Computational complexity

The computational complexity of the proposed monitoring framework is given by its individual components. The prohibited item detection module, based on the YOLO architecture, is the most computationally intensive part, with complexity approximately for an input image of size , where K denotes kernel size and C denotes the number of filters^6,18. The video anomaly detection module processes the frames sequentially, with a complexity proportional to the number of processed frames, i.e., O(F) per time step². The IoT anomaly detection module operates on low-dimensional sensor data, resulting in a linear complexity O(n) for n observations¹². The multimodal fusion stage involves a weighted linear combination of the anomaly scores,that yeilds a constant time complexity O(1)³. The blockchain logging component performs SHA-256 hashing with complexity O(m), where m is the size of the event record¹⁵. Overall, the framework is suitable for real-time deployment, as computational cost is dominated by the YOLO-based detection module, while the remaining components introduces a minimal overhead.

Conclusion

This work proposes a unified multi-layer airport security monitoring framework that integrates YOLOv11-s based X-ray prohibited-item detection, IoT-based environmental anomaly monitoring, video behavioural analysis, and blockchain-secured event logging within a single architecture . The proposed system demonstrates a strong performance across all the modalities, with YOLOv11-s achieving high detection accuracy on the CLCXray dataset , while the IoT LSTM-autoencoder and Conv3D-autoencoder effectively distinguishes abnormal patterns through reconstruction-error separation. A key contribution of this work is the multimodal fusion mechanism that combines behavioural and environmental anomaly indicators to generate a unified risk score,that improves detection robustness compared to individual subsystems . By integrating complementary security signals and secure blockchain-based event recording, this framework provides a more reliable and tamper-resistant monitoring solution than traditional single-modality approaches. Future work may extend the framework to additional threat categories such as concealed inorganic powders and hazardous materials, further enhancing automated airport security screening systems.

Author contributions

S.T and R.R: Conceptualization, supervision, methodology, validation, data curation. review & editing. C.LR, CV.M, C.RJ, and S.P Gowda: Software development, system implementation, experimentation, data analysis, and writing - original draft preparation. All authors reviewed and approved the final manuscript.

Funding

Open access funding provided by B.M.S. College of Engineering.

Data availability

The CLCXray dataset and the Avenue video dataset used in this study are publicly available from their respective sources . The simulated IoT dataset generated for this work is not publicly archived but is available from the author, Chaitanya LR (chaitanyalr.is23@bmsce.ac.in), upon reasonable request.

Code availability

The implementation of the proposed framework is publicly available at: https://github.com/Chaitanya-Ravi28/Airport-anomaly-detection.git.

Declarations

Competing Interests

The authors declare no competing interests.