Irregular event detection in push notifications

• US 9,911,044 B2
• Filed: 01/03/2017
• Issued: 03/06/2018
• Est. Priority Date: 12/10/2012
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Ostrovsky-Berman, Yaron, Gur, Ran, Naor, Nir, Wronsky, Ran, Milman, Michael
• Primary Examiner(s): Liew, Alex
• Application Number:
  US15/397,091
• Publication Number:
  US 20170185844A1
• Time in Patent Office: 427 Days
• CPC Class Codes: G06F 40/103 Formatting, i.e. changing of presentation of documents automatic justification G06F40/189; automatic line break hyphenation G06F40/191
• CPC Class Codes: G06F 40/186 Templates
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06T 7/70 Determining position or orientation of objects or cameras camera calibration G06T7/80
• CPC Class Codes: G06V 20/41 Higher-level, semantic clustering, classification or understanding of video scenes, e.g. detection, labelling or Markovian modelling of sport events or news items segmenting video sequences G06V20/49
• CPC Class Codes: G06V 20/44 Event detection
• CPC Class Codes: G06V 20/52 Surveillance or monitoring of activities, e.g. for recognising suspicious objects recognising microscopic objects G06V20/69

Abstract

Systems and methods of detecting irregular events include the extraction of values for measure in each of a plurality of notifications. The extracted values are stored in a measures database and a distribution is calculated for the values of each of the measures. The extracted values are compared to the calculated distributions to determine if an irregular event has occurred. An irregularity alert is produced if an irregular event has occurred.

Claims

1. A method of detecting irregular events, the method comprising:

extracting values for measures in each of a plurality of notifications;

storing the extracted values in a measures database;

calculating a distribution for the values of each of the measures;

comparing extracted values to the calculated distributions;

determining if an irregular event has occurred based upon the comparison of the extracted values to the calculated distributions; and

producing an irregularity alert if an irregular event is determined.

2. The method of claim 1, wherein the irregularity alert is a pushed notification.

3. The method of claim 1, wherein the irregularity alert is visually presented in a graphical user interface.

4. The method of claim 1, further comprising:

receiving at least one user preference;

using the at least one user preference to determine if an irregular event has occurred.

5. The method of claim 4, wherein the at least one user preference is an irregularity threshold.

6. The method of claim 1, wherein the notifications are analytics reports and the measures are report measures conveying analytics data.

7. The method of claim 6, further comprising:

receiving analytics data;

automatedly generating the analytics reports from the received analytics data; and

pushing the automatedly generated analytics reports to at least one recipient.

8. The method of claim 7, wherein the analytics reports are automatedly generated by applying the received analytics data to at least one report template, and the at least one report template defines the report measures in each of the analytics reports.

9. The method of claim 8, wherein the at least one report template defines the report measures and further comprising calculating the values of the report measures from the analytics data.

10. The method of claim 7, further comprising scheduling the automated generation of the analytics reports, the calculation of the distribution for the values of the report measures, and the determination of irregular events to periodically recur.

11. A method of detecting irregular events in pushed analytics reports, the method comprising:

automatedly generating a plurality of pushed analytics reports, each analytics report comprising values for a plurality of report measures;

extracting the values for report measures from each of the plurality of pushed analytics reports;

storing the extracted values in a measures database;

calculating a distribution of values for each of the report measures;

comparing extracted values to the calculated distributions;

determining if an irregular event has occurred based upon the comparison of the extracted values to the calculated distributions; and

producing an irregularity alert if an irregular event is determined.

12. The method of claim 11, further comprising:

receiving at least one irregularity threshold; and

using the at least one irregularity threshold to determine if an irregular event has occurred.

13. The method of claim 11, further comprising calculating a plurality of distributions of values for each of the report measures for different temporal durations.

14. The method of claim 11, further comprising:

automatedly generating a current analytics report comprising current values for the plurality of report measures;

extracting the current values from the current analytics report;

comparing the current values to the calculated distributions; and

determining if an irregular event occurred from the comparison of the current values to the calculated distributions.

15. A system for detection of irregular events, the system comprising:

a measures extractor that is configured to receive a plurality of pushed report notifications and extract a plurality of values for report measures from the plurality of pushed report notifications;

a measures database operating on a computer readable medium, the measures database receives and stores the plurality of values from the measures extractor;

a distribution analyzer that calculates at least one distribution for each of the report measures from the plurality of values for each of the report measures;

an irregularity analyzer that is configured to receive values for report measures and compare the received values to the calculated at least one distribution for each of the report measures to determine if an irregular event occurs; and

an alerter that produces an irregularity alert when a determination is made that an irregular event has occurred.

16. The system of claim 15, further comprising a graphical display configured to present a graphical user interface that visually presents the irregularity alert.

17. The system of claim 15, wherein the graphical user interface further visually presents the values of the report measures.

18. The system of claim 15, further comprising a reporter module that receives analytics data and applies the analytics data to at least one report template to automatedly generate pushed report notifications that comprise the plurality of values for report measures.

19. The system of claim 18, further comprising an analytics engine that is configured to receive video data and analyze the video data on a frame by frame basis to produce analytics data, the analytics engine is further configured to provide the analytics data to the reporter module.

20. The system of claim 18, further comprising a scheduler communicatively connected to the reporter module, distribution analyzer, and the irregularity analyzer, the scheduler controls the reporter module, distribution analyzer, and the irregularity analyzer to operate at predetermined intervals.