ACCESS CONTROL SYSTEM BASED UPON BEHAVIORAL PATTERNS

• US 20110181414A1
• Filed: 01/28/2010
• Published: 07/28/2011
• Est. Priority Date: 01/28/2010
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Subramanian, Sriram, G, Ashwin, Guralnik, Valerie, Ponnambalam, Santhanakrishnan, Balakrishnan, Sivakumar, Heimerdinger, Walt
• Granted Patent: US 8,680,995 B2
• Time in Patent Office: Days
• US Class Current: 340/541
• CPC Class Codes: G07C 9/30 not involving the use of a pass

Abstract

A method and apparatus for detecting behavioral changes in a security system is provided. The method includes the steps of providing a secured area having a plurality of security zones where access to each is controlled by an access controller, detecting entrances to at least some of the plurality of security zones by an authorized person through respective access controllers of the plurality of zones over a predetermined previous time period, forming a probability model of entry into each of the plurality of security zones from the detected entrances over the previous time period, detecting access requests for the authorized user from the access controllers during a current time period, and generating a security alert upon determining that an access request of the current access requests exceeds a probability threshold value associated with the probability model.

Claims

1. A method comprising:

providing a secured area having a plurality of security zones where access to each is controlled by an access controller;

detecting entrances to at least some of the plurality of security zones by an authorized person through respective access controllers of the plurality of zones over a predetermined previous time period;

forming a probability model of entry into each of the plurality of security zones from the detected entrances over the previous time period;

detecting access requests for the authorized user from the access controllers during a current time period; and

generating a security alert upon determining that an access request of the current access requests exceeds a probability threshold value associated with the probability model.

2. The method as in claim 1 further comprising granting access to the secured area by the person upon determining that the probability threshold value is greater than an alerting threshold value and less than a lockout value.

3. The method as in claim 2 further comprising recording a sequence of video images of the person within the secured area.

4. The method as in claim 1 further comprising denying access by the person to the secured area upon determining that the probability threshold value is greater than a lockout value.

5. The method as in claim 1 wherein the probability model further comprises a probability density function.

6. The method as in claim 5 further comprising granting access to the secured area by the person upon determining that a density value of the probability density function at the time of the request for access is less than an average of the detected entrances for a security zone of the plurality of security zones for a corresponding time period minus a variance of the average.

7. The method as in claim 5 further comprising denying access to the secured area by the person upon determining that a density value of the probability density function at the time of the request for access is less than an average of the detected entrances for a security zone of the plurality of security zones for a corresponding time period minus two times a variance of the average.

8. The method as in claim 1 wherein the probability model further comprises a reference set of principal components and the currently detected access requests comprises a current set of principle components using Principal Component analysis.

9. The method as in claim 8 wherein the step of generating the security alert further comprising determining a Euclidean distance between each point of the reference and current principle components.

10. The method as in claim 9 further comprising comparing the Euclidean distance with the probability threshold value.

12. The apparatus as in claim 1 further comprising an access grant allowing the person to enter the secured area upon determining that the probability threshold value is greater than an alerting threshold value and less than a lockout value.

11. An apparatus comprising:

a secured area having a plurality of security zones where access to each is controlled by an access controller;

an event log that contains detected entrances to at least some of the plurality of security zones by an authorized person through respective access controllers of the plurality of zones over a predetermined previous time period;

a probability model of entry into each of the plurality of security zones formed from the detected entrances over the previous time period;

access requests for the authorized user received from the access controllers during a current time period; and

a security alert that is generated upon determining that an access request of the current access requests exceeds a probability threshold value associated with the probability model.

13. The apparatus as in claim 11 further comprising an access denial sent to an access controller of the secured area for the authorized person upon determining that the probability threshold value is greater than a lockout value.

14. The apparatus as in claim 11 wherein the probability model further comprises a probability density function.

15. The apparatus as in claim 14 further comprising an access grant to the secured area by the person sent to an access controller of the access controllers upon determining that a density value of the probability density function at the time of the request for access is less than an average of the detected entrances for a security zone of the plurality of security zones for a corresponding time period minus a variance of the average.

16. The method as in claim 14 further comprising an access denial to the secured area by the person sent to an access controller of the access controllers upon determining that a density value of the probability density function at the time of the request for access is less than an average of the detected entrances for a security zone of the plurality of security zones for a corresponding time period minus two times a variance of the average.

17. The method as in claim 11 wherein the probability model further comprises a reference set of principal components and the currently detected access requests comprises a current set of principle components using Principal Component analysis.

18. The method as in claim 17 wherein the generated the security alert further comprises a probability processor that determines a Euclidean distance between each point of the reference and current principle components.

19. The method as in claim 18 further comprising comparing the Euclidean distance with the probability threshold value.

20. An apparatus comprising:

a secured area having a plurality of security zones where access to each is controlled by an access controller;

means for detecting entrances to at least some of the plurality of security zones by an authorized person through respective access controllers of the plurality of zones over a predetermined previous time period;

means for forming a probability model of entry into each of the plurality of security zones from the detected entrances over the previous time period;

means for detecting access requests for the authorized user from the access controllers during a current time period; and

means for generating a security alert upon determining that an access request of the current access requests exceeds a probability threshold value associated with the probability model.