Systems and methods for facilitating remote security threat detection

• US 9,922,386 B2
• Filed: 03/17/2016
• Issued: 03/20/2018
• Est. Priority Date: 10/25/2013
• Status: Active Grant

• Current Assignee: Michael Stapleton Associates, Ltd.
• Original Assignee: Michael Stapleton Associates, Ltd.
• Inventors: Crowley, Raymond, Wynn, Michael, Atherall, Joe, Dimmick, Matthew Ryan
• Primary Examiner(s): Rashid, Harunur
• Application Number:
  US15/073,470
• Publication Number:
  US 20160196628A1
• Time in Patent Office: 733 Days
• Field of Search: 726 23
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods are disclosed for detecting security threats in a network environment. A canine detection unit may initially inspect items at a screening location. A local workstation is used to further inspect the items that are identified as raising potential security concerns. Requests for assistance are submitted to remote experts for assistance with resolving the potential security concerns. One or more servers receive the requests over a network and retrieve dialing plans associated with the origins of the requests. The one or more servers utilize the dialing plans to route the requests to expert groups assigned to dialing plans. In response to the requests being accepted by remote expert devices in one of the expert groups, the one or more servers establish connections between the local workstations and the remote expert devices that accept the requests.

Claims

1. A system for detecting security threats, the system comprising:

at least one canine detection unit comprising one or more canines and one or more handlers that inspect items at screening locations to detect potential security concerns;

a plurality of screening devices, wherein the screening devices include imaging systems comprising sensors for inspecting the items at the screening locations and wherein inputs received through the sensors are transformed into scanning data for display on workstations located at the screening locations; and

a server device that includes a processor and a non-transitory storage device that stores instructions which cause the processor to;

receive a first set of selections for creating expert groups, wherein each of the expert groups defines a set of experts equipped to manage potential security threats;

receive a second set of selections for creating dialing plans that are used to route requests received from the workstations at the screening locations to the expert groups, wherein each dialing plan specifies a sequential ordering of expert groups for handling requests originating from the screening locations;

store data that associates at least one of the dialing plans with at least one of the screening locations;

in response to receiving a request submitted by an operator located at one of the screening locations, retrieve a dialing plan associated with that screening location;

select an expert group identified in the retrieved dialing plan to receive the request based, at least in part, on the sequential ordering of expert groups specified in the retrieved dialing plan;

establish a connection between the operator and an expert in the selected expert group in response to the request being accepted by the expert;

transmit the transformed screening data to the expert for assistance in resolving the request;

receive an assistance request from the expert in the selected expert group for requesting assistance from a second remote expert in resolving the request submitted by the operator;

establish a second connection between the expert and a second remote expert in response to the second remote expert accepting the assistance request; and

transmit the transformed scanning data to the second remote expert to permit the second remote expert to provide assistance with resolving the request;

wherein communications between the expert and the second remote expert via the second connection are private and are not visible to the operator on the operator'"'"'s workstation.

2. The system of claim 1, wherein the system utilizes a three tier approach to handle the potential security threats that includes:

a first security tier that utilizes the at least one canine detection unit to inspect the items at the screening location with the one or more canines;

a second security tier that utilizes the screening devices to inspect a subset of the items that are identified by the at least one canine detection unit as the raising potential security concerns; and

a third security tier that utilizes the connection with the expert or the second connection with the second remote expert to resolve the potential security concerns.

3. The system of claim 1, wherein the one or more handlers associated with the at least one canine detection unit are equipped with a mobile device for alerting individuals of the potential security concerns that are identified by the one or more canines.

4. The system of claim 1, wherein the at least one canine detection unit includes teams of canines and handlers that are certified to detect explosives or narcotics, and the at least one canine detection unit is utilized to inspect packages that are being loaded onto or unloaded from a truck, boat or plane.

5. The system of claim 1, wherein the server device stores status information for monitoring the expert groups, and the status information for the selected expert group is changed to idle when all experts assigned to the selected expert group fail to accept a request.

6. The system of claim 5, wherein future requests received from the screening location associated with the retrieved dialing plan are not transmitted to the selected expert group while the status information indicates that the selected expert group is idle, and the server device processor is caused to select another expert group identified in the dialing plan to receive the request based, at least in part, on the sequential ordering in the retrieved dialing plan.

7. The system of claim 1, wherein each one of the dialing plans includes separate sequential orderings for different types of requests such that a first sequential ordering is used to route threat assessment requests to expert groups identified in the dialing plan and a second sequential ordering is used to route testing or calibration requests to expert groups identified in the dialing plan, and the first sequential ordering is different from the second sequential ordering.

8. The system of claim 1, wherein each one of the dialing plans identifies a plurality of expert groups and the sequential ordering is used to determine an order in which the identified expert groups will receive requests originating from a screening location associated with the dialing plan.

9. The system of claim 1, wherein the instructions further cause the processor to:

monitor status information for the expert groups that indicates whether the experts groups are idle or active; and

automatically transmit notifications to an operations center when expert groups are designated as idle.

10. The system of claim 1, wherein the server device is configured to provide admin tools that provide interfaces for receiving the first set of selections that are used to create the expert groups, receiving the second set of selections that are used to create the dialing plans, and associating the dialing plans with the screening locations.

11. A method for detecting security threats, the method comprising:

inspecting items at a screening location to detect potential security concerns with a canine detection unit comprising one or more canines and one or more handlers;

in response to the canine detection unit determining that an item raises a potential security concern, inspecting the item with a screening device located at the screen location, wherein the screening device includes an imaging system comprising sensors for inspecting the item and wherein inputs received through the sensors are transformed into scanning data for display on a workstation located at the screening location; and

creating a session with an expert over a network to resolve the potential security concern, wherein creating a session with an expert over a network includes;

receiving, at a server device, a first set of selections for creating expert groups, wherein each of the expert groups defines a set of experts equipped to manage security threats;

receiving, at the server device, a second set of selections for creating a dialing plan that is utilized to route requests received from the workstation at the screening location to the expert groups, wherein the dialing plan specifies a sequential ordering of expert groups for handling requests originating from the screening location;

storing data that associates the dialing plan with the screening location;

in response to receiving a request submitted by an operator utilizing the workstation, retrieving the dialing plan associated with the screening location;

selecting an expert group identified in the retrieved dialing plan to receive the request based, at least in part, on the sequential ordering of expert groups specified in the retrieved dialing plan;

establishing a connection between the operator and the expert in the selected expert group in response to the request being accepted by the expert;

transmitting the transformed screening data to the expert for assistance in resolving the request;

receiving an assistance request from the expert in the selected expert group for requesting assistance from a second remote expert in resolving the request submitted by the operator;

establishing a second connection between the expert and the second remote expert in response to the second remote expert accepting the assistance request; and

transmitting the transformed scanning data to the second remote expert to permit the second remote expert to provide assistance with resolving the request;

wherein communications between the expert and the second remote expert via the second connection are private and are not visible to the operator on the workstation.

12. The method of claim 11, wherein the method utilizes a three tier approach to handle the potential security concerns which includes:

implementing a first security tier that utilizes the canine detection unit to inspect the items at the screening location with the one or more canines;

implementing a second security tier that utilizes the screening device to inspect the item identified by the canine detection unit as raising the potential security concern; and

implementing a third security tier that utilizes the connection with the expert or the second connection with the second remote expert to resolve the potential security concern.

13. The method of claim 11, wherein the one or more handlers associated with the canine detection unit are equipped with a mobile device for alerting individuals of the potential security concerns that are identified by the one or more canines.

14. The method of claim 11, wherein the canine detection unit includes teams of canines and handlers that are certified to detect explosives or narcotics, and the canine detection unit is utilized to inspect packages that are being loaded onto or unloaded from a truck, boat or plane.

15. The method of claim 11, wherein the server device stores status information for monitoring the expert groups, and the status information for the selected expert group is changed to idle when all experts assigned to the selected expert group fail to accept a request.

16. The method of claim 15, wherein future requests received from the screening location associated with the retrieved dialing plan are not transmitted to the selected expert group while the status information indicates that the selected expert group is idle, and the another expert group identified in the dialing plan is selected to receive the request based, at least in part, on the sequential ordering in the retrieved dialing plan.

17. The method of claim 11, wherein each one of the dialing plans includes separate sequential orderings for different types of requests such that a first sequential ordering is used to route threat assessment requests to expert groups identified in the dialing plan and a second sequential ordering is used to route testing or calibration requests to expert groups identified in the dialing plan, and the first sequential ordering is different from the second sequential ordering.

18. The method of claim 11, wherein each one of the dialing plans identifies a plurality of expert groups and the sequential ordering is used to determine an order in which the identified expert groups will receive requests originating from the screening location associated with the dialing plan.

19. The method of claim 11, wherein the instructions further cause the processor to:

monitor status information for the expert groups that indicates whether the experts groups are idle or active; and

automatically transmit notifications to an operations center when expert groups are designated as idle.

20. A method for detecting security threats, the method comprising:

receiving an indication that a canine detection unit has detected an item that raises a potential security concern at a screening location;

inspecting the item with a screening device located at the screen location in response to the received indication, wherein the screening device includes an imaging system comprising sensors for inspecting the item and wherein inputs received through the sensors are transformed into scanning data for display on a workstation located at the screening location; and

initiating a request for a session with an expert over a network to resolve the potential security concern, wherein the session creation comprises;

receiving, at a server device, a first set of selections for creating expert groups, wherein each of the expert groups defines a set of experts equipped to manage security threats;

receiving, at the server device, a second set of selections for creating a dialing plan that is utilized to route requests received from the workstation at the screening location to the expert groups, wherein the dialing plan specifies a sequential ordering of expert groups for handling requests originating from the screening location;

storing data that associates the dialing plan with the screening location;

in response to receiving a request submitted by an operator utilizing the workstation, retrieving the dialing plan associated with the screening location;

selecting an expert group identified in the retrieved dialing plan to receive the request based, at least in part, on the sequential ordering of expert groups specified in the retrieved dialing plan;

establishing a connection between the operator and the expert in the selected expert group in response to the request being accepted by the expert;

transmitting the transformed screening data to the expert for assistance in resolving the request;

receiving an assistance request from the expert in the selected expert group for requesting assistance from a second remote expert in resolving the request submitted by the operator;

establishing a second connection between the expert and the second remote expert in response to the second remote expert accepting the assistance request; and

transmitting the transformed scanning data to the second remote expert to permit the second remote expert to provide assistance with resolving the request;

wherein communications between the expert and the second remote expert via the second connection are private and are not visible to the operator on the workstation.

21. The method of claim 20, wherein the indication is provided by a mobile device operated a handler associated with the canine detection unit.