Monitoring access to a location

Patent metadata

Field	Value
Publication number	US-9251633-B2
Application number	US-201113166178-A
Country	US
Kind code	B2
Filing date	Jun 22, 2011
Priority date	Jun 22, 2011
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

Devices, methods, and systems for monitoring access to a location are described herein. One or more method embodiments include determining data associated with an access event associated with a location, determining whether the access event is an anomalous access event using the data associated with the access event and a statistical model of data associated with a number of non-anomalous access events associated with the location, and assessing, if the access event is determined to be an anomalous access event, the anomalous access event. In various embodiments, assessing the anomalous access event includes at least one of determining an anomaly type associated with the anomalous access event, determining an anomaly classification confidence associated with the anomalous access event, determining an anomaly severity associated with the anomalous access event, and determining a reliability associated with the statistical model.

First claim

What is claimed:

1. A method for monitoring access to a location, comprising:
recording, by a reader of an access control system located at an entrance of a location, data associated with an access event associated with the location, wherein the access event includes accessing a first area of the location at a first time and a second area of the location at a second time, and wherein the recorded data includes a day and time of the access event;
determining, by a computing device of the access control system, whether the access event is an anomalous access event by comparing the recorded data associated with the access event to a statistical model of data associated with a number of non-anomalous access events associated with the location, wherein the access event is an anomalous access event when a difference between the first and second time is below a threshold time;
assessing, by the computing device if the access event is determined to be an anomalous access event, the anomalous access event in order to determine whether the anomalous access event represents a significant gap in or threat to security of the location and, if so, what can be done in response to the anomalous access event, wherein assessing the anomalous access event includes:
determining an anomaly classification confidence associated with the anomalous access event, wherein the anomaly classification confidence associated with the anomalous access event includes a value having one or more numbers or letters therein, the value representing a confidence level associated with the determination that the access event is an anomalous access event; and
determining an anomaly severity associated with the anomalous access event, wherein the anomaly severity associated with the anomalous access event includes a value having one or more numbers or letters therein, the value representing an amount of seriousness with which the anomalous access event should be treated;

changing, by the computing device, a pre-existing access policy for the location if the value of the anomaly classification confidence meets or exceeds a pre-defined threshold or if the value of the anomaly severity meets or exceeds a pre-defined threshold; and
preventing, by the computing device, a subsequent access event to the location from occurring based on the changed access policy for the location.

2. The method of claim 1 , wherein the location is a secured location.

3. The method of claim 1 , wherein the access event associated with the location includes an entering of the location by an individual.

4. The method of claim 1 , wherein the method includes determining the statistical model.

5. The method of claim 1 , wherein the access event is an anomalous access event if the data associated with the access event deviates from the statistical model by at least a particular amount.

6. The method of claim 1 , wherein the recorded data includes one or more of:
a duration of the access event;
an identification of an individual associated with the access event;
a time of a first access event associated with the location in a day; and
a frequency of access events associated with the location.

7. A computing device for monitoring access to a location, comprising:
a memory configured to store a statistical model of data associated with a number of normal access events associated with a location; and
a processor configured to execute executable instructions stored in the memory to:
record, by a reader of an access control system located at an entrance of the location, data associated with an access event associated with the location, wherein the access event includes accessing a first area of the location at a first time and a second area of the location at a second time, and wherein the recorded data includes a duration of the access event;
determine whether the access event is an anomalous access event by comparing the data associated with the access event to the statistical model, wherein the access event is an anomalous access event when a difference between the first and second time is below a threshold time;
assess, if the access event is determined to be an anomalous access event, the anomalous access event in order to determine whether the anomalous access event represents a significant gap in or threat to security of the location and, if so, what can be done in response to the anomalous access event, wherein assessing the anomalous access event includes:
determining an anomaly type associated with the anomalous access event;
determining an anomaly classification confidence associated with the anomalous access event, wherein the anomaly classification confidence associated with the anomalous access event includes a value having one or more numbers or letters therein, the value representing a confidence level associated with the determination that the access event is an anomalous access event;
determining an anomaly severity associated with the anomalous access event, wherein the anomaly severity associated with the anomalous access event includes a value having one or more numbers or letters therein, the value representing an amount of seriousness with which the anomalous access event should be treated; and
determining a reliability associated with the statistical model; and

change a pre-existing access policy for the location if the value of the anomaly classification confidence meets or exceeds a pre-defined threshold or if the value of the anomaly severity meets or exceeds a pre-defined threshold; and
prevent a subsequent access event to the location from occurring based on the changed access policy for the location.

8. The computing device of claim 7 , wherein the anomaly type associated with the anomalous access event is one of:
an edge anomaly, wherein an edge anomaly is an anomaly that corresponds to an anomalous access event that is at and/or near an edge of the statistical model;
a cluster anomaly, wherein a cluster anomaly is an anomaly that corresponds to an anomalous access event belonging to a pattern of anomalous access events; and
a gap anomaly, wherein a gap anomaly is an anomaly that corresponds to an anomalous access event within the statistical model that does not occur frequently.

9. The computing device of claim 7 , wherein the anomaly severity associated with the anomalous access event is based on at least one of:
a level of security associated with the location;
a level of security associated with an individual accessing the location;
a level of security associated with a group of individuals accessing the location;
a level of security associated with a time of the access event; and
an amount of difference between the data associated with the access event and the statistical model.

10. The computing device of claim 7 , wherein the reliability associated with the statistical model is based on an amount of data used to build the statistical model.

11. The computing device of claim 7 , wherein the computing device includes a user interface configured to provide the assessment of the anomalous access event to a user of the computing device.

12. The computing device of claim 7 , wherein the processor is configured to execute executable instructions stored in the memory to:
provide a single value that represents the determined anomaly type;
provide a single value that represents the determined anomaly classification confidence;
provide a single value that represents the determined anomaly severity; and
provide a single value that represents the determined reliability.

13. A method for monitoring access to a location, comprising:
recording, by a reader of an access co

Assignees

• Libal Vit
• Guralnik Valerie
• Honeywell Int Inc

Inventors

• Libal Vit
• Guralnik Valerie

Classifications

• G08B31/00

  Predictive alarm systems characterised by extrapolation or other computation using updated historic data · CPC title

• G07C2209/08

  With time considerations, e.g. temporary activation, valid time window or time limitations · CPC title

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• G06F21/45 Primary

  Structures or tools for the administration of authentication · CPC title

• G07C9/00 Primary

  Individual registration on entry or exit · CPC title