SYSTEMS AND METHODS FOR CORRELATING SENSORY EVENTS AND LEGACY SYSTEM EVENTS UTILIZING A CORRELATION ENGINE FOR SECURITY, SAFETY, AND BUSINESS PRODUCTIVITY

• US 20170207949A1
• Filed: 04/07/2017
• Published: 07/20/2017
• Est. Priority Date: 10/04/2007
• Status: Active Grant

• Current Assignee: SecureNet Solutions Group, LLC
• Original Assignee: SecureNet Solutions Group, LLC
• Inventors: Donovan, John J., Hussain, Daniar
• Granted Patent: US 10,020,987 B2
• Time in Patent Office: Days
• CPC Class Codes: G08B 13/19645 Multiple cameras, each having view on one of a plurality of scenes, e.g. multiple cameras for multi-room surveillance or for tracking an object by view hand-over
• CPC Class Codes: G08B 13/19656 Network used to communicate with a camera, e.g. WAN, LAN, Internet
• CPC Class Codes: G08B 13/19671 Addition of non-video data, i.e. metadata, to video stream
• CPC Class Codes: G08B 13/19693 using multiple video sources viewed on a single or compound screen
• CPC Class Codes: G08B 13/19697 Arrangements wherein non-video detectors generate an alarm themselves
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04N 5/77 between a recording apparatus and a television camera
• CPC Class Codes: H04N 7/181 for receiving images from a plurality of remote sources
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Monitoring systems and methods for use in security, safety, and business process applications utilizing a correlation engine are disclosed. Sensory data from one or more sensors are captured and analyzed to detect one or more events in the sensory data. The events are correlated by a correlation engine, optionally by weighing the events based on attributes of the sensors that were used to detect the primitive events. The events are then monitored for an occurrence of one or more correlations of interest, or one or more critical events of interest. Finally, one or more actions are triggered based on a detection of one or more correlations of interest, one or more anomalous events, or one or more critical events of interest. Events may come from sensory devices, legacy systems, third-party systems, anonymous tips, and other data sources. The present invention may be used to increase business productivity by improving security, safety, and increasing profitability of business processes.

Claims

1. A monitoring system comprising a non-transitory, physical storage medium storing computer-readable program code, the program code executable by a hardware processor, the program code when executed by the hardware processor causing the hardware processor to execute steps comprising:

receiving sensory data about a physical environment from one or more sensors;

receiving IP data of the one or more sensors, wherein the IP data comprises at least an Internet Protocol (IP) address and a network status of at least one of the sensors;

receiving legacy system data from one or more legacy systems;

processing the sensory data from the one or more sensors to detect one or more primitive sensory events;

processing the legacy system data from the one or more legacy systems to detect one or more primitive legacy events;

normalizing the primitive sensory events and the primitive legacy events into a standardized data format to generate normalized sensory events and normalized legacy events;

storing the normalized sensory events and the normalized legacy events in an event database for later retrieval as stored sensory events and stored legacy events;

retrieving one or more stored sensory events and one or more stored legacy events from the event database;

evaluating one or more historical correlations by automatically analyzing said stored sensory events and said stored legacy events, across at least one of time and space, for one or more historical correlations among the stored sensory events and the stored legacy events;

monitoring continuously and in real-time the primitive sensory events from the one or more sensors and the primitive legacy events from the one or more legacy systems based on the one or more historical correlations to identify one or more critical events;

monitoring continuously and in real-time the network status of one or more of the sensors based on the IP data to identify one or more network failure events; and

sending one or more alerts based on at least one of said critical events and said network failure events.

2. The monitoring system of claim 1, wherein the historical correlations are calculated by applying a weighting of relative importance of the sensory data based on a quality of data produced by the sensors, wherein the primitive sensory events are weighted based at least on the quality of data produced by the sensors used to capture the sensory data.

3. The monitoring system of claim 1, wherein the critical events are determined from one or more safety procedures, and wherein the one or more alerts are sent when one or more of the safety procedures are violated.

4. The monitoring system of claim 1, wherein the one or more sensors are selected from the group consisting of a temperature probe, a pressure probe, an altitude meter, a speedometer, a revolutions per minute (RPM) meter, a blood pressure meter, a heart rate meter, a chlorine meter, a radon meter, a dust particle meter, a pollution meter, a CO₂ meter, a bacteria meter, a water meter, an electrical meter, and combinations thereof.

5. The monitoring system of claim 1, wherein the one or more legacy systems are selected from the group consisting of an access control system, a personnel system, an inventory system, a financial system, a police dispatch system, a currency system, a law enforcement database, a light control system, and combinations thereof.

6. The monitoring system of claim 1, wherein the one or more legacy systems comprise at least a personnel system, and wherein the storage medium further comprises program code, which when executed causes the hardware processor to execute steps comprising:

retrieving experience levels of personnel from the personnel system;

correlating the experience levels of personnel with the primitive sensory events; and

generating one or more alerts based on the correlation between the experience levels of personnel and the primitive sensory events.

7. The monitoring system of claim 1, wherein the storage medium further comprises program code, which when executed causes the hardware processor to execute steps comprising:

performing one or more actions based on a correlation level exceeding a predetermined threshold.

8. The monitoring system of claim 1, wherein the storage medium further comprises program code, which when executed causes the hardware processor to execute steps comprising:

generating one or more new rules based on primitive events correlated and alerts generated.

9. The monitoring system of claim 1, wherein the storage medium further comprises program code, which when executed causes the hardware processor to execute steps comprising:

receiving tip data from one or more external sources;

generating tip events based on the tip data;

correlating one or more tip events with the primitive sensory events; and

generating one or more alerts based on the correlation between the tip events and the primitive sensory events.

10. The monitoring system of claim 1, wherein the primitive sensory events are weighted based at least on one or more attribute data of the one or more sensors used to capture the sensory data.

11. The monitoring system of claim 10, wherein the attribute data comprises a quality of sensory data produced by the sensors.

12. The monitoring system of claim 10, wherein the attribute data comprises an age of the sensors used to capture the sensory data.

13. The monitoring system of claim 10, wherein the attribute data comprises a time since the sensors were last maintained.

14. The monitoring system of claim 10, wherein the attribute data comprises an integrity of the sensors used to capture the sensory data.

15. The monitoring system of claim 10, wherein the attribute data comprises a reliability of the sensors used to capture the sensory data.

16. The monitoring system of claim 10, wherein the attribute data comprises a reliability of power that is powering the sensors.

17. The monitoring system of claim 10, wherein the attribute data comprises a reliability of a transmission and a bandwidth of a communication link to the sensors.

18. The monitoring system of claim 1, wherein the storage medium further comprises program code, which when executed causes the hardware processor to execute steps comprising:

providing a graphical user interface (GUI) for a human operator to receive the one or more alerts.

19. A non-transitory, physical storage medium storing computer-readable program code, the program code executable by a hardware processor, the program code when executed by the hardware processor causing the hardware processor to execute steps comprising:

receiving sensory data about a physical environment from one or more sensors;

receiving IP data of the one or more sensors, wherein the IP data comprises at least an Internet Protocol (IP) address and a network status of at least one of the sensors;

receiving legacy system data from one or more legacy systems;

processing the sensory data from the one or more sensors to detect one or more primitive sensory events;

processing the legacy system data from the one or more legacy systems to detect one or more primitive legacy events;

normalizing the primitive sensory events and the primitive legacy events into a standardized data format to generate normalized sensory events and normalized legacy events;

storing the normalized sensory events and the normalized legacy events in an event database for later retrieval as stored sensory events and stored legacy events;

retrieving one or more stored sensory events and one or more stored legacy events from the event database;

evaluating one or more historical correlations by automatically analyzing said stored sensory events and said stored legacy events, across at least one of time and space, for one or more historical correlations among the stored sensory events and the stored legacy events;

monitoring continuously and in real-time the primitive sensory events from the one or more sensors and the primitive legacy events from the one or more legacy systems based on the one or more historical correlations to identify one or more critical events;

monitoring continuously and in real-time the network status of one or more of the sensors based on the IP data to identify one or more network failure events; and

sending one or more alerts based on at least one of said critical events and said network failure events.

20. A monitoring method, comprising steps of:

receiving sensory data about a physical environment from one or more sensors;

receiving IP data of the one or more sensors, wherein the IP data comprises at least an Internet Protocol (IP) address and a network status of at least one of the sensors;

receiving legacy system data from one or more legacy systems;

processing the sensory data from the one or more sensors to detect one or more primitive sensory events;

processing the legacy system data from the one or more legacy systems to detect one or more primitive legacy events;

normalizing the primitive sensory events and the primitive legacy events into a standardized data format to generate normalized sensory events and normalized legacy events;

storing the normalized sensory events and the normalized legacy events in an event database for later retrieval as stored sensory events and stored legacy events;

retrieving one or more stored sensory events and one or more stored legacy events from the event database;

evaluating one or more historical correlations by automatically analyzing said stored sensory events and said stored legacy events, across at least one of time and space, for one or more historical correlations among the stored sensory events and the stored legacy events;

monitoring continuously and in real-time the primitive sensory events from the one or more sensors and the primitive legacy events from the one or more legacy systems based on the one or more historical correlations to identify one or more critical events;

monitoring continuously and in real-time the network status of one or more of the sensors based on the IP data to identify one or more network failure events; and

sending one or more alerts based on at least one of said critical events and said network failure events.