System and method of anomaly detection

Patent metadata

Field	Value
Publication number	US-8941484-B2
Application number	US-201313800443-A
Country	US
Kind code	B2
Filing date	Mar 13, 2013
Priority date	Mar 13, 2013
Publication date	Jan 27, 2015
Grant date	Jan 27, 2015

Abstract

A method and apparatus wherein the method includes detecting a plurality of events within a security system, evaluating the events using one of a first expression defined by Σ rεQ conf(f(r)−mrg(r)), a second expression defined by ∫ rεR |f(r)−mrg(r)|dr and a third expression defined by ∫ rεR conf(f(r)−mrg(r))dr, where r is a size of a neighborhood around a data point, f(r) is a Local Correlation Integral (LOCI) of r, mrg(r) is a margin of r, R is a predetermined set of intervals of neighborhood sizes, Q is a predetermined discrete set of neighborhood sizes and conf(d) is a non-linear confidence function being 0 for near distance to the data point and quickly approaching 1 for larger distances, comparing a value of the evaluated expression with a threshold value and setting an alarm upon detecting that the value exceeds the threshold value.

First claim

The invention claimed is:

1. A method comprising:
detecting a plurality of events within a security system;
evaluating the events using one of a first expression defined by Σ rεQ conf(f(r)−mrg(r)), a second expression defined by ∫ rεR |f(r)−mrg(r)|dr and a third expression defined by ∫ rεR conf(f(r)−mrg(r))dr, where r is a size of a neighborhood around a data point, f(r) is a Local Correlation Integral (LOCI) of r, mrg(r) is a margin of r, R is a predetermined set of intervals of neighborhood sizes, Q is a predetermined discrete set of neighborhood sizes and conf(d) is a non-linear confidence function being 0 for near distance to the data point and quickly approaching 1 for larger distances;
comparing a value of the evaluated expression with a threshold value; and
setting an alarm upon detecting that the value exceeds the threshold value.

2. The method as in claim 1 wherein the detected events further comprise physical entry by a plurality of person through a plurality of portals, each portal having an electric lock that controls physical entry by the plurality of persons into a secured area of the security system.

3. The method as in claim 2 further comprising a time of entry through one of the plurality of portals.

4. The method as in claim 1 further comprising a time of entry of an authorized user into the secured area.

5. The method as in claim 1 wherein the detected events further comprise activation of a plurality of security sensors within a secured area of the security system.

6. The method as in claim 5 wherein the detected events further comprise a time between activation of each of the plurality of sensors of the security system.

7. The method as in claim 5 wherein the detected events further comprise detection of motion within the secured area.

8. An apparatus comprising:
an event processor that detects a plurality of events within a security system;
an evaluation processor that evaluates the events using one of a first expression defined by Σ rεQ conf(f(r)−mrg(r)), a second expression defined by ∫ rεR |f(r)−mrg(r)|dr and a third expression defined by ∫ rεR conf(f(r)−mrg(r))dr, where r is a size of a neighborhood around a data point, f(r) is a Local Correlation Integral (LOCI) of r, mrg(r) is a margin of r, R is a predetermined set of intervals of neighborhood sizes, Q is a predetermined discrete set of neighborhood sizes and conf(d) is a non-linear confidence function being 0 for near distance to the data point and quickly approaching 1 for larger distances;
a comparison processor that compares a value of the evaluated expression with a threshold value; and
an alarm processor that sets an alarm upon detecting that the value exceeds the threshold value.

9. The apparatus as in claim 8 wherein the detected events further comprise physical entry by a plurality of person through a plurality of portals, each portal having an electric lock that controls physical entry by the plurality of persons into a secured area of the security system.

10. The apparatus as in claim 9 wherein the detected events further comprise a time of entry through one of the plurality of portals.

11. The apparatus as in claim 8 further comprising a time of entry of an authorized user into the secured area.

12. The apparatus as in claim 8 wherein the detected events further comprise activation of a plurality of security sensors within a secured area of the security system.

13. The apparatus as in claim 12 wherein the detected events further comprise a time between activation of each of the plurality of sensors of the security system.

14. The apparatus as in claim 12 wherein the detected events further comprise detection of motion within the secured area.

15. An apparatus comprising:
a security system that protects a secured area having a plurality of zones;
a processor that detects a plurality of events within the security system including at least entry into at some of the plurality of zones;
a processor that evaluates the events using one of a first expression defined by Σ rεQ conf(f(r)−mrg(r)), a second expression defined b ∫ rεR |f(r)−mrg(r)|dr and a third expression defined by ∫ rεR conf(f(r)−mrg(r))dr, where r is a size of a neighborhood around a data point, f(r) is a Local Correlation Integral (LOCI) of r, mrg(r) is a margin of r, R is a predetermined set of intervals of neighborhood sizes, Q is a predetermined discrete set of neighborhood sizes and conf(d) is a non-linear confidence function being 0 for near distance to the data point and quickly approaching 1 for larger distances;
a processor that compares a value of the evaluated expression with a threshold value; and
a processor that sets an alarm upon detecting that the value exceeds the threshold value.

16. The apparatus as in claim 15 wherein the detected events further comprise physical entry by a plurality of person through a plurality of portals, each portal having an electric lock that controls physical entry by the plurality of persons into a secured area of the security system.

17. The apparatus as in claim 16 wherein the detected events further comprise a time of entry through one of the plurality of portals.

18. The apparatus as in claim 15 further comprising a processor that compares values from at least two of the expressions with a respective threshold value and sets an alarm upon detecting that they both exceed the respective threshold.

19. The apparatus as in claim 15 further comprising a processor that compares values from all three of the expressions with a respective threshold value and sets an alarm upon detecting that they all exceed the respective threshold.

Assignees

• Honeywell Int Inc

Inventors

• Vacha Pavel
• Libal Vit
• Guralnik Valerie

Classifications

• G08B31/00

  Predictive alarm systems characterised by extrapolation or other computation using updated historic data · CPC title

• G08B25/008 Primary

  Alarm setting and unsetting, i.e. arming or disarming of the security system · CPC title

• G08B29/188 Primary

  Data fusion; cooperative systems, e.g. voting among different detectors · CPC title