The field relates to surveillance systems and more particularly to the detection of incidents recorded by the surveillance system.
Surveillance systems are generally known. Such systems are typically based upon the use of one or more closed circuit television (CCTV) cameras.
In some cases, the CCTV cameras are connected to one or more displays monitored by security guards. The guards monitor the displays on a continuous basis to detect events within a secured area. Alternatively or in addition, images from each CCTV camera may be recorded for later review in the event of an incident.
In newer systems, the CCTV cameras may be equipped with motion detection. In this case, an audible alarm may be activated to alert the guard in response to the detection of motion. This may be especially useful where the secured area is very large and the guard is required to monitor a large number of cameras.
In addition to the detection of motion, many security systems are also provided with door and window switches that also operate to alert a guard to intruders. This may be useful in areas that contain one or more authorized employees who work within the secured area.
While CCTV surveillance systems work well, it is often difficult to identify video of events which do not directly trigger alarms. Accordingly, a need exists for better methods of identifying events.
While embodiments can take many different forms, specific embodiments thereof are shown in the drawings and will be described herein in detail with the understanding that the present disclosure is to be considered as an exemplification of the principles hereof, as well as the best mode of practicing same. No limitation to the specific embodiment illustrated is intended.
In general, CCTV systems may be integrated with access control systems and intrusion detection systems. In prior system, it has been difficult to correlate events among the logical entities of such systems. Some of the entities among which such correlation is important include cameras, access doors, POS operators, POS data, alarm/events, CCTV operators, etc.
The secured area may also include one or more access doors 24 and associated locking device. A card reader 26 may be located proximate the access door. Authorized persons may slide an access card through the card reader. In response, the card reader activates the locking device and opens the door thereby allowing access by authorized persons into and out of the secured area.
A number of cameras 16, 20 may also be located within and around the secured area. The cameras may be part of a surveillance system that presents images of a field of each camera on a user interface 32 of a security guard.
The user interface may include a display 34 that shows images from the cameras. A keyboard 36 allows the guard to enter commands for camera selection or other control of the security system.
At least some of the cameras may be Internet cameras that save images from the cameras into a cloud memory device such as a cloud server 28 through the Internet 30. Some of the cameras may also contain circuitry that detects motion within a field of view of the camera.
A wireless device 42 of an authorized user may be provided that includes provisions to access and control the security system. The wireless device may also download and display images saved into the cloud device.
The secured area may also include one or more point of sale (POS) devices 38. The POS devices may each contain a separate user interface that receives details of a transaction from an operator of the POS device.
The sensors, cameras and POS devices may be monitored via a local control panel 44. Upon detecting an intruder or other threat, the control panel may send an alarm message to a central monitoring station 46. The central monitoring station may respond by summoning the appropriate help (e.g., police, fire department, etc.).
Each of the devices discussed above includes circuitry that provides the functionality discussed herein. The circuitry of each device may include one or more processor apparatus (processors) 48, 50, each operating under control of one or more computer programs 52, 54 loaded from a non-transitory computer readable medium (memory 56). As used herein, reference to a step performed by a computer program is also reference to the processor that executed that step.
Within the security system, an alarm processor may monitor the sensors, the cameras and card readers. The alarm processor may also monitor the POS devices for tampering. Activation of door sensor or motion detection or tampering may be detected and the alarm processor may compose and send an alarm message to the central monitoring station.
Similarly, an access processor may monitor the card reader. The access processor may compare an identifier of a card swiped through the card reader with a list of authorized users within memory who are to be admitted into the secured area. Upon detecting a match, the access processor may activate the locking device opening the door.
The access processor may also retrieve an image of the authorized user and display that image on the display of the user interface for the benefit of a guard. In addition, the access processor may also retrieve an image from a camera monitoring the door and present the image on the user interface. This allows a guard to compare the authorized user of the card with an image of the person entering through the door.
A transaction processor may also monitor the POS devices. In this regard, the transaction processor may record each transaction and save the details into a transaction file within a memory device associated with each POS device. The transaction processor may also display details of the transaction on the user interface of a guard station or other authorized person along with video from a camera whose field of view includes the POS device.
Under the illustrated embodiment, the sensors, cameras, POS devices and card readers may each have a cloud interface 58 that saves events detected within the secured area into a respective file of the cloud server along with details of the event. The saved information may include an identifier of a device or person monitored by the security system, an identifier of the monitoring function that triggered the saving of the event into the cloud file and a time of the event. In the case of a card reader, the event would include an identifier of the card reader, an identifier of a triggering event (i.e., the detection of a card), an identifier of the monitoring function of monitoring access into the secured area through a particular door, a time that the card was read and an identifier of the card read. The details of the event may also include a video image of the authorized user of the card read and whether access by the person carrying the card was granted or denied.
In the case of a camera, the event would include an identifier of the camera, an identifier of the monitoring function of monitoring access in a particular portion of the secured area, one or more video frames from the camera and an indicator of what caused the video to be recorded (e.g., the detection of motion, activation of a nearby door sensor, etc.). In the case of a camera near a POS terminal, the monitoring function may be monitoring the POS terminal and the triggering event may be detection of a transaction from the POS terminal.
In the case of a POS terminal, the trigger for saving events into the cloud file may be the transaction itself. The event details are the details of the transaction. Details may include the monitoring function of monitoring transactions through a particular POS device, a subject matter of the transaction (e.g., a sale, voided transaction, canceled transaction, returned goods, etc.).
In the case of a sensor, the event may be the opening of a door along a periphery of the secured area. Information saved to a cloud file may include the monitoring function of monitoring access through a particular door, an identifier of the sensor and a time. Alternatively, an image may also be saved. The image saved may be from a camera that covers the door.
Under one illustrated embodiment, the system includes a search function device 60 executing on one or more processors of a portable user device that correlates images to a timeline based upon user input.
In this example, the user of the portable device may enter a set of search parameters through the user interface of the portable device. The search parameters entered by the user may include a start and end time of the time line. The search parameters may also include a system entity and at least one respective identifier for each of the two types of events (monitoring functions) to be displayed in conjunction with the timeline. The system entity may be defined by an identifier of the monitored device or person. A correlation processor of the search function dynamically correlates events of the two types to the time line.
The search function may include a monitoring options file 62, 64 associated with each system entity. Included within each monitoring options file of an entity may be list of monitoring functions available for use with that system entity. For example, a sensor for an external door may have a monitoring options file that identifies an associated card reader and a camera with a field of view the covers that door. Where the card reader is selected, the display may show images of authorized users that present an entry card to the card reader.
Similarly, where the entity is an operator of a POS terminal, the operator may have a monitoring options file that includes each of a number POS terminal that the operator could use. Similarly, the monitoring options file may identify a system file of transactions handled by the operator or an identifier of an exceptions file associated with that operator.
Returning now to the example,
The display of card holders and images from interior cameras offers a great advantage in ensuring the proper usage of access cards. By juxtapositioning the image of an authorized card holder along with the image from a camera detecting movement inside a door opened by the access card as shown in
While the process of
As shown, the search function downloads events associated with each of the identified type of events of the search and plots those events on the time line. The user can also place a cursor over a time line control (shown below the time line) to move the time line backwards and forwards in time.
In general, the search pattern of
Alternatively, the search pattern of
Similarly, the search pattern of
Similarly, the authorized user may enter information regarding POS events and actions. For example, the user may enter information regarding authorizations of each operator. For example, some operators may be allowed to accept returns while other operators are not authorized. An operator who accepts a return even though not authorized may cause an exception processor (or the correlation processor) to generate an exception. Similarly, the authorized user may bookmark certain operators or types of events that will be displayed upon selecting the operator activity option for detected activity. Bookmarking may be accomplished by saving one or more keywords (or symbols) in an event type field of the cloud file and the system entity identifier of the device or person. The keywords and identifiers provide a cross-reference between the person or device and the bookmarked event.
Similarly, an investigator may investigate a security event (e.g., a break-in) associated with a particular location and enter comments into a file that describes the event. The authorized user may bookmark the comments by linking the comments to a particular sensor or camera. The authorized user may also link certain sensor, cameras, POSs and card readers together via bookmarking based upon his/her knowledge of the alarm system.
The authorized user may also enter information regarding device, operator or subsystem status. For example, during non-store hours, the user may program a time processor to bookmark any operator activity for display on a time line.
Similarly, the authorized user may bookmark (or cause the appropriate processor to bookmark) scheduled tasks for reporting or non-reporting on the time line. The bookmarking may be performed based on whether they were performed or not performed according to the type of task involved.
The system may also include programs that automatically send e-mail alerts to the user. In this case, the logic of the programs may be based upon the concurrence or predefined time relationship of two or more events.
Similarly, the system may also include programming that records events automatically. This again is based upon two or more events that occur concurrently or within some predefined time period.
In addition, the authorized user may specify control operations that are performed by the system. As above, the control operations may be based upon the concurrence of relationship of two or more events. Communications among integrated systems may be based upon the same concept.
The search system provides the authorized user with a novel simplified human-factors based interface with a time line that can be operated in two swipes (single hand/click operation based upon the two information factors), the results of which are, in turn, presented on the top and bottom of the time line. This allows correlation of different entities like access card, associated video, etc. The correlation of events may occur and be presented dynamically.
In the integrated system of
Use of the search function allows correlation between two unrelated events/entities that may disclose hidden patterns or anomalies. In one use case, POS transactions may be compared with operator activity. When POS transactions are correlated with operator activity, the comparison may expose a pattern for a particular operator that is clearly improper. While the comparison of transaction exceptions (based upon voided sales) with operator activity are believed to be of great importance, the correlation of operator activity with any POS transaction may only be slightly less important.
In another case, comparing card holder use history with relevant alarms (based upon motion detection) is also important. This plotting of images based upon card use may help to see if card holder activity is improper by comparing such use against video from other cameras. This comparison may give direct insight in the case of stolen access cards by correlating card holder use images against motion detection images. Also, two unrelated card holders can be presented on the timeline to understand their pattern of activity in case of an incident.
In other cases, the correlation of images may be used in conjunction with back door activity or with activity at some other little-used entrance. In the case of a retail store, the back door activity of any one door can be compared with some other door to give insight about suspicious activity for specific periods when back door activity shows significant deviation from normal activity.
In general, conventional systems require more time to understand event details during normal operation and during investigations. Current alarm and incident management applications are unable to correlate specific data from multiple sources with time line information. Current systems only give static reports. Current systems only present predefined relationships among entities. They can't dynamically correlate any two different or same type entities. Current views are tabular and do not give insight or highlight patterns or anomalies.
The search system is simple and the interactive user interface provides correlation information of any two selected system entities. It saves a great deal of time during investigations and forensic analysis.
The search system minimizes human errors/misses by providing a dynamic correlation time line view of selected entities during particular time periods. The solution is an improvement considering the human factor needs of operators/investigators. The search feature avoids the conventional way of reviewing history, events, alarms and video clips in isolation as is normally done in integrated security systems.
In addition, the search system is not limited only to playback or retrieval modes. Instead, it can be used during live operation as well, for example, to add events and updates to the time line in real time. Selected time line details, correlation results can be exported or stored as clips or filtered and saved as results for later retrieval. Users can simply move the time line left or right, as needed, to see the full spectrum of correlation and can zoom into or out of image detail by pinching or by using a multi-touch process on the center of the time line.
In general, the system incorporates a cloud server saving a plurality of security events that occurred within a secured area where each saved security event includes an identifier on a device or person monitored by the security system, an identifier of the monitoring function that triggered the saving of the event in the cloud and a time of the event, a user input receiving an identifier of the monitored device or person and at least two different functions monitored by the security system and a processor downloading information of some of the plurality of saved events identified by the received identifiers from the cloud server and presenting the downloaded information of each event at corresponding locations along a timeline with a first area along the timeline reserved for information of events associated with a first of the at least two different functions and a second area reserved for information of events associated with a second of the at least two different functions.
From the foregoing, it will be observed that numerous variations and modifications may be effected without departing from the spirit and scope hereof. It is to be understood that no limitation with respect to the specific apparatus illustrated herein is intended or should be inferred. It is, of course, intended to cover by the appended claims all such modifications as fall within the scope of the claims.