Acquiring statistical access models

Patent metadata

Field	Value
Publication number	US-9208156-B2
Application number	US-201113312579-A
Country	US
Kind code	B2
Filing date	Dec 6, 2011
Priority date	Dec 6, 2011
Publication date	Dec 8, 2015
Grant date	Dec 8, 2015

Abstract

One or more embodiments include collecting data associated with a first access profile, collecting data associated with a second access profile, determining whether the data associated with the first access profile has a particular number of characteristics in common with the data associated with the second access profile, assigning a statistical access model associated with the second access profile to the first access profile based on the particular number of characteristics that the data associated with first access profile has in common with the data associated with the second access profile, and detecting an anomalous access event based on the statistical access model.

First claim

What is claimed is:

1. A method for acquiring statistical access models, comprising:
collecting data associated with a first access profile for a first group of users that includes a designated user, wherein the first group of users is distinct from a second group of users;
collecting data associated with a second access profile for the second group of users;
comparing the data associated with the first access profile to the data associated with the second access profile, wherein the data includes a job title associated with the first access profile and a job title associated with the second access profile respectively;
determining whether the data associated with the first access profile has a particular number of characteristics in common with the data associated with the second access profile;
determining a first statistical access model based on the first access profile and a second statistical access model based on the second access profile;
merging the first statistical access model and the second statistical access model into a merged statistical access model in response to a determination that the data associated with the first access profile has the particular number of characteristics in common with the data associated with the second access profile;
assigning the merged statistical access model to the first access profile for the designated user; and
detecting an anomalous access event of the designated user based on the merged statistical access model.

2. The method of claim 1 , wherein the merging the first statistical access model and the second statistical access model includes merging the first statistical access model to represent a first portion of a time period represented by the merged statistical access model and merging the second statistical access model to represent a second portion of a time period represented by the merged statistical access model.

3. The method of claim 1 , wherein the collecting data associated with the first access profile includes collecting data associated with a first access profile of a first individual.

4. The method of claim 3 , wherein the collecting data associated with the second access profile includes collecting data associated with a second access profile of a group of individuals.

5. The method of claim 4 , wherein the method further includes assigning a statistical access model associated with the group of individuals to the first individual when the data associated with the first access profile of the first individual has a particular number of characteristics in common with the data associated with the second access profile of the group of individuals.

6. The method of claim 3 , wherein the collecting data associated with the second access profile includes collecting data associated with a second access profile of a second individual.

7. The method of claim 6 , wherein the method includes assigning a statistical access model associated with the second individual to the first individual when the data associated with the first access profile of the first individual has a particular number of characteristics in common with the data associated with the second access profile of the second individual.

8. The method of claim 6 , wherein the method includes creating the merged statistical access model by merging the first access profile of the first individual with the second access profile of the second individual when the data associated with the first access profile of the first individual has a particular number of characteristics in common with the data associated with the second access profile of the second individual.

9. The method of claim 1 , wherein the collecting data associated with the first access profile includes collecting data associated with a first access profile of an access control device.

10. The method of claim 1 , wherein the collecting data associated with the second access profile includes collecting data associated with a second profile of a group of access control devices.

11. The method of claim 1 , wherein the collecting data associated with the first access profile and the second access profile includes collecting at least one of:
a time of an access event;
a duration of the access event;
a day of the access event;
an identification of an individual associated with the access event;
a time of a first access event associated with a location; and
a frequency of access events associated with the location.

12. A computer-readable non-transitory medium storing instructions for acquiring statistical access models, executable by a computer to cause the computer to:
collect data associated with a first access profile of a first individual;
collect data associated with a second access profile of a second individual, wherein the first individual is distinct from the second individual;
compare the data associated with the first access profile of the first individual to the data associated with the second access profile of the second individual, wherein the data includes a job title associated with the first access profile of the first individual to and a job title associated with the second access profile of the second individual respectively;
determine that the data associated with the first access profile of the first individual has a particular number of characteristics in common with the data associated with the second access profile of the second individual;
merge the first access profile of the first individual with the second access profile of the second individual to create a merged access profile based on the particular number of characteristics that the data associated with the first access profile of the first individual has in common with the data associated with the second access profile of the second individual; and
create a merged statistical access model from the merged access profile and assign the merged statistical access model to the first individual and the second individual.

13. The computer-readable non-transitory medium of claim 12 , wherein the instructions include instructions executable by the computer to detect an anomalous access event based on the merged statistical access model and provide an alert that an anomalous access event has occurred.

14. A method for acquiring statistical access models, comprising:
collecting data associated with a first access profile of a first access control device for a designated user;
collecting data associated with a second access profile, wherein the second access profile is distinct from the first access profile;
comparing the data associated with the first access profile of the first access control device to the data associated with the second access profile, wherein the data includes a job title associated with the first access profile toe and a job title associated with the second access profile respectively;
determining whether the data associated with the first access profile of the first access control device has a particular number of characteristics in common with the data associated with the second access profile;
determining a first statistical access model based on the first access profile and a second statistical access model based on the second access profile;
merging the first statistical access model and the second statistical access model into a merged statistical access model in response to a determination that the data associated with the first access profile of the first access control device has the particular number of characteristics in common with the data associated with the second access profile;
assigning the merged statistical access model to the fi

Assignees

• Libal Vit
• Guralnik Valerie
• Honeywell Int Inc

Inventors

• Libal Vit
• Guralnik Valerie

Classifications

• G06F21/316 Primary

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• G06F17/30165

  Physics · mapped topic

• G06F17/30029 Primary

  Physics · mapped topic

• G06F17/30

  Physics · mapped topic

• G06F16/00

  Information retrieval; Database structures therefor; File system structures therefor · CPC title