Patent Application
20090228980
The invention relates generally to security systems, and more particularly to access control systems.
Typically, access control systems record events as individuals use their access control device or code to gain entry to locations within a facility. In addition to normal access events, alarms are also recorded in cases such as doors held open too long or forced open. Generally, alarms are further investigated by security officers to verify the facility remains secure. Security system alarms are typical responses to physical scenarios based on the type of devices in use. Security systems offering advanced features that analyze multiple pieces of information to determine significant events are desirable.
Furthermore, security access control software provides recording capabilities on access events and alarms. In a non-limiting example, reports that indicate individuals who presented their badge at a particular checkpoint are easily retrieved. However, data is displayed as textual information. Alarms are generally shown on display monitors with textual information about the device issuing the alarm and the type of alarm. Since most security officers are very familiar with the facility and the local terminology describing locations, providing data in formats to improve understanding may also be a significant improvement in security products.
It is therefore desirable for an improved security system.
In accordance with an embodiment of the invention, a system for detecting an anomalous access event is provided. The system includes a tracking module configured to provide multiple graphical illustrations corresponding to a number of paths traversed by an individual at various times. The system also includes a similarity metric module configured to compare the plurality of graphical representations and detect an anomalous access event.
In accordance with another embodiment of the invention, a security system is provided. The security system includes multiple access control devices configured to record one or more access events. The system also includes a processor comprising a database module configured to generate a database of the access events. The processor also includes a tracking module configured to provide multiple graphical representations of a number of paths traversed by an individual at various times based upon the database. The processor also includes a similarity metric module configured to compare the multiple graphical representations and detect an anomalous access event.
In accordance with another embodiment of the invention, a method of assembling a security system is provided. The method includes providing multiple access control devices configured to record one or more access events. The method also includes providing a processor comprising a database module configured to generate a database of the access events. The method also includes providing a processor comprising a tracking module configured to provide a plurality of graphical representations of a number of paths traversed by an individual at various times based upon the database. The method further includes providing a similarity metric module configured to compare multiple graphical representations and detect an anomalous access event.
These and other advantages and features will be more readily understood from the following detailed description of preferred embodiments of the invention that is provided in connection with the accompanying drawings.
As discussed in detail below, embodiments of the invention include a system and a method for detection of anomalous events. A graphical visualization of an activity or an event of an individual within a secured facility is generated to monitor the activity and aid security personnel with security operations in the facility. Further, an analytical metric over the graphical visualization is disclosed that compares the individual's event with prior events of the individual, which may be considered as his/her normal activity. The analytical metric may also be used to compare the individual's event with that of other individuals within the facility.
To enhance security features, a similarity metric module 18 is also employed. The similarity metric module 18 compares the multiple graphical representations to generate a similarity function having a similarity score and enables detection of an anomalous access event. The similarity score ranges between 0 and 1, wherein 0 is generated for a least possible similarity in the graphical representation and 1 is generated for a most similar graphical representation. In one embodiment, the similarity metric module 18 generates a similarity function directly proportional to a number of nodes and edges that are common between the graphical representations. In another embodiment, the nodes and the edges have the same weighting to represent the frequency of the nodes and the edges being traversed. In yet another embodiment, the similarity metric module 18 adjusts a relative contribution of the nodes and the edges.
A goal in evaluating path similarity is to identify changes in a path of the individual that detects an anomalous behavior. In one embodiment, anomalies are detected utilizing a three-phased approach. First, an individual's path on a particular day is compared to his/her history. A threshold of the similarity metric is used to decide if the test path is similar to the historical data. If the similarity is above the threshold, then no anomaly exists. If dissimilarity is detected, then a second step is taken including selecting historical paths from other individuals that are similar to the individual's historical paths. Finally, a check is performed to verify if the paths traversed by other individuals also showed a deviation from their historical paths at a similar time to the test individual (for example on the particular day).
Several parameters such as, but not limited to, frequency of a path being taken, and a time of the day access events occur, may be used to tune the similarity metric module 18. Access events that occur at roughly a same time of the day are considered more similar than a same event occurring at different times of the day. In a particular embodiment, the similarity metric module 18 compares multiple graphical representations of a particular individual traversed on different days. In another embodiment, the similarity metric module 18 compares multiple graphical representations of different individuals traversed at a common time. In yet another embodiment, the similarity metric module 18 compares a graphical representation of an individual on a day of a week with one or more graphical representations of the individual on a different day of the week. In another embodiment, the similarity metric module compares a graphical representation of an individual on a weekend day with one or more graphical representations of the individual on a different weekend day.
In one embodiment, the similarity metric module adds a penalty to the similarity score that is proportional to a difference between time of an access event of an individual at a location and an average time of the access event of the individual at the location derived from a database of the graphical representations. In another embodiment, the similarity metric module adds a penalty to the similarity score that is proportional to a difference between time of an access event of an individual at a location and at least one of a minimum or a maximum of a time of the access event of the individual at the location derived from a database of the graphical representations. In yet another embodiment, the similarity metric module is configured to integrate a standard deviation of a time of an access event of the individual at a location based upon the graphical representations. A display monitor 20 is used to display the graphical representations.
In one embodiment, selected nodes may be weighted more heavily in the similarity metric than others. This weighting may be dependent on additional information stored in the security system database. For instance, specific entrances and exits to a building may not be significant to determining anomalies. In an alternate embodiment, groups of nodes may be treated as a “super” node. For instance, two entrances side-by-side may be used interchangeably. The security system will capture which entrance is used when an individual utilizes the specific access control device, but for anomaly detection they can be considered equivalent. In such a case, the similarity metric can add the frequencies from the two nodes. The edges would also be redefined to connect events to and from this new super node instead of the individual nodes. For instance in
It should be clear to one skilled in the art, that the similarity metric module evaluates an underlying data structure defining the nodes and edges (events and sequences of events) (as in graph theory) and not the illustration of that graphical representation as shown in
The various embodiments of a system and method for detecting anomalous events described above thus provide a convenient and efficient means to prevent security incidents from occurring. Monitoring of real time, predictive behavior of individuals within a site increases safety and efficiency of the sites, and reduces a number of tedious and expensive event investigations. The person-path model and the similarity metric module described above facilitate efficient exploratory search over alarm situations, while efficiently distinguishing between true and false alarms.
It is to be understood that not necessarily all such objects or advantages described above may be achieved in accordance with any particular embodiment. Thus, for example, those skilled in the art will recognize that the systems and techniques described herein may be embodied or carried out in a manner that achieves or optimizes one advantage or group of advantages as taught herein without necessarily achieving other objects or advantages as may be taught or suggested herein.
Furthermore, the skilled artisan will recognize the interchangeability of various features from different embodiments. For example, the use of a biometric reader with respect to one embodiment can be adapted for use with a similarity metric module configured to compare a graphical representation of an individual on a weekend day with one or more graphical representations of the individual on a different weekend day. Similarly, the various features described, as well as other known equivalents for each feature, can be mixed and matched by one of ordinary skill in this art to construct additional systems and techniques in accordance with principles of this disclosure.
While the invention has been described in detail in connection with only a limited number of embodiments, it should be readily understood that the invention is not limited to such disclosed embodiments. Rather, the invention can be modified to incorporate any number of variations, alterations, substitutions or equivalent arrangements not heretofore described, but which are commensurate with the spirit and scope of the invention. Additionally, while various embodiments of the invention have been described, it is to be understood that aspects of the invention may include only some of the described embodiments. Accordingly, the invention is not to be seen as limited by the foregoing description, but is only limited by the scope of the appended claims.
