Systems and methods for correlating sensory events and legacy system events utilizing a correlation engine for security, safety, and business productivity

• US 10,587,460 B2
• Filed: 06/05/2018
• Issued: 03/10/2020
• Est. Priority Date: 10/04/2007
• Status: Active Grant

• Current Assignee: SecureNet Solutions Group, LLC
• Original Assignee: SecureNet Solutions Group, LLC
• Inventors: Donovan, John J, Hussain, Daniar
• Primary Examiner(s): La, Anh V
• Application Number:
  US16/000,436
• Publication Number:
  US 20180278464A1
• Time in Patent Office: 644 Days
• Field of Search: 340540, 340506, 34053925, 340521, 340937, 348143, 348159
• CPC Class Codes: G08B 13/19645 Multiple cameras, each having view on one of a plurality of scenes, e.g. multiple cameras for multi-room surveillance or for tracking an object by view hand-over
• CPC Class Codes: G08B 13/19656 Network used to communicate with a camera, e.g. WAN, LAN, Internet
• CPC Class Codes: G08B 13/19671 Addition of non-video data, i.e. metadata, to video stream
• CPC Class Codes: G08B 13/19693 using multiple video sources viewed on a single or compound screen
• CPC Class Codes: G08B 13/19697 Arrangements wherein non-video detectors generate an alarm themselves
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04N 5/77 between a recording apparatus and a television camera
• CPC Class Codes: H04N 7/181 for receiving images from a plurality of remote sources
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

Monitoring systems and methods for use in security, safety, and business process applications utilizing a correlation engine are disclosed. Sensory data from one or more sensors are captured and analyzed to detect one or more events in the sensory data. The events are correlated by a correlation engine, optionally by weighing the events based on attributes of the sensors that were used to detect the primitive events. The events are then monitored for an occurrence of one or more correlations of interest, or one or more critical events of interest. Finally, one or more actions are triggered based on a detection of one or more correlations of interest, one or more anomalous events, or one or more critical events of interest. Events may come from sensory devices, legacy systems, third-party systems, anonymous tips, and other data sources. The present invention may be used to increase business productivity by improving security, safety, and increasing profitability of business processes.

Claims

1. A monitoring system comprising a non-transitory, physical storage medium storing computer-readable program code, the program code executable by a hardware processor, the program code when executed by the hardware processor causes the hardware processor to implement:

a primitive event analytics module adapted to receive sensory data about a physical environment from one or more sensors and for processing the sensory data from the one or more sensors to detect one or more primitive sensory events;

a legacy event analytics module adapted to receive legacy system data from one or more legacy systems and for processing the legacy system data from the one or more legacy systems to detect one or more primitive legacy events;

a network analytics module adapted to receive Internet Protocol (IP) data of the one or more sensors, wherein the IP data comprises at least an IP address and a network status of at least one of the sensors, and wherein the network analytics module is adapted to process the IP data of the one or more sensors to detect one or more primitive network events;

a normalization engine adapted to normalize the primitive sensory events, the primitive legacy events, and the primitive network events into a standardized data format to generate normalized sensory events, normalized legacy events, and normalized network events;

an event queue adapted to queue the normalized sensory events, the normalized legacy events, and the normalized network events for storage in an event database and for later retrieval as stored sensory events, stored legacy events, and stored network events from the event database;

a correlation engine adapted to evaluate one or more historical correlations by automatically analyzing said stored sensory events, said stored legacy events, and said stored network events, across at least one of time and space, for one or more historical correlations among the stored sensory events, the stored legacy events, and the stored network events, wherein the correlation engine is adapted to monitor continuously and in real-time the normalized sensory events, the normalized legacy events, and the normalized network events to identify one or more critical events; and

an alerting engine adapted to send one or more alerts based on said one or more critical events, wherein said one or more critical events are based at least on the one or more historical correlations among said stored sensory events, said stored legacy events, and said stored network events.

2. The monitoring system of claim 1, wherein the one or more historical correlations are calculated by applying a weighting of relative importance of the stored sensory events based on a quality of the sensory data from the one or more sensors.

3. The monitoring system of claim 1, wherein the one or more historical correlations are calculated by applying a weighting of relative importance of the legacy system data based on a quality of data produced by the one or more legacy systems.

4. The monitoring system of claim 1, wherein the one or more critical events are determined from one or more safety procedures, and wherein the one or more alerts are sent when one or more of the safety procedures are violated.

5. The monitoring system of claim 1, wherein the one or more sensors are selected from the group consisting of a temperature probe, a pressure probe, an altitude meter, a speedometer, a revolutions per minute (RPM) meter, a blood pressure meter, a heart rate meter, a chlorine meter, a radon meter, a dust particle meter, a pollution meter, a CO₂ meter, a bacteria meter, a water meter, an electrical meter, and combinations thereof.

6. The monitoring system of claim 1, wherein the one or more legacy systems are selected from the group consisting of an access control system, a personnel system, an inventory system, a financial system, a police dispatch system, a currency system, a law enforcement database, a light control system, and combinations thereof.

7. The monitoring system of claim 1, wherein the one or more legacy systems comprise at least a personnel system, and wherein the storage medium further comprises program code, which when executed causes the hardware processor to execute steps comprising:

retrieving experience levels of personnel from the personnel system;

correlating the experience levels of personnel with the primitive sensory events; and

generating one or more alerts based on the correlation between the experience levels of personnel and the primitive sensory events.

8. The monitoring system of claim 1, wherein the storage medium further comprises program code, which when executed causes the hardware processor to execute steps comprising:

performing one or more actions based on a correlation level exceeding a predetermined threshold.

9. The monitoring system of claim 1, wherein the storage medium further comprises program code, which when executed causes the hardware processor to execute steps comprising:

generating one or more new rules based on primitive events correlated and alerts generated.

10. The monitoring system of claim 1, wherein the storage medium further comprises program code, which when executed causes the hardware processor to execute steps comprising:

receiving tip data from one or more external sources;

generating tip events based on the tip data;

correlating one or more tip events with the primitive sensory events; and

generating one or more alerts based on the correlation between the tip events and the primitive sensory events.

11. The monitoring system of claim 1, wherein the primitive sensory events are weighted based at least on one or more attribute data of the one or more sensors used to capture the sensory data.

12. The monitoring system of claim 11, wherein the attribute data comprises a quality of sensory data produced by the sensors.

13. The monitoring system of claim 11, wherein the attribute data comprises an age of the sensors used to capture the sensory data.

14. The monitoring system of claim 11, wherein the attribute data comprises a time since the sensors were last maintained.

15. The monitoring system of claim 11, wherein the attribute data comprises an integrity of the sensors used to capture the sensory data.

16. The monitoring system of claim 11, wherein the attribute data comprises a reliability of the sensors used to capture the sensory data.

17. The monitoring system of claim 11, wherein the attribute data comprises a reliability of power that is powering the sensors.

18. The monitoring system of claim 11, wherein the attribute data comprises a reliability of a transmission and a bandwidth of a communication link to the sensors.

19. The monitoring system of claim 1, wherein the storage medium further comprises program code, which when executed causes the hardware processor to implement:

a graphical user interface (GUI) for a human operator to receive the one or more alerts.

20. A non-transitory, physical storage medium storing computer-readable program code, the program code executable by a hardware processor, the program code when executed by the hardware processor causes the hardware processor to implement:

a primitive event analytics module adapted to receive sensory data about a physical environment from one or more sensors and for processing the sensory data from the one or more sensors to detect one or more primitive sensory events;

a legacy event analytics module adapted to receive legacy system data from one or more legacy systems and for processing the legacy system data from the one or more legacy systems to detect one or more primitive legacy events;

a network analytics module adapted to receive Internet Protocol (IP) data of the one or more sensors, wherein the IP data comprises at least an IP address and a network status of at least one of the sensors, and wherein the network analytics module is adapted to process the IP data of the one or more sensors to detect one or more primitive network events;

a normalization engine adapted to normalize the primitive sensory events, the primitive legacy events, and the primitive network events into a standardized data format to generate normalized sensory events, normalized legacy events, and normalized network events;

an event queue adapted to queue the normalized sensory events, the normalized legacy events, and the normalized network events for storage in an event database and for later retrieval as stored sensory events, stored legacy events, and stored network events from the event database;

a correlation engine adapted to evaluate one or more historical correlations by automatically analyzing said stored sensory events, said stored legacy events, and said stored network events, across at least one of time and space, for one or more historical correlations among the stored sensory events, the stored legacy events, and the stored network events, wherein the correlation engine is adapted to monitor continuously and in real-time the normalized sensory events, the normalized legacy events, and the normalized network events to identify one or more critical events; and

an alerting engine adapted to send one or more alerts based on said one or more critical events, wherein said one or more critical events are based at least on the one or more historical correlations among said stored sensory events, said stored legacy events, and said stored network events.

21. A monitoring system comprising a non-transitory, physical storage medium storing computer-readable program code, the program code executable by a hardware processor, the program code when executed by the hardware processor causes the hardware processor to implement:

a sensory event analytics module to receive sensory data about a physical environment from one or more sensors and to process the sensory data from the one or more sensors to detect one or more sensory events;

a legacy event analytics module to receive legacy system data from one or more legacy systems and to process the legacy system data from the one or more legacy systems to detect one or more legacy events;

an event database adapted to store the sensory events and the legacy events for later retrieval as stored sensory events and stored legacy events;

a system-wide analytics module to evaluate one or more historical correlations by automatically analyzing the stored sensory events and the stored legacy events across at least one of time and space, for one or more historical correlations among the stored sensory events and the stored legacy events;

an Internet Protocol (IP) network for communicating between the sensory event analytics module, the legacy event analytics module, the event database, and the system-wide analytics module; and

an alerting module to send one or more alerts based on one or more critical events, wherein the one or more critical events are based at least on the one or more historical correlations among the stored sensory events and the stored legacy events.

22. The system of claim 21, further comprising:

a network analytics module adapted to receive Internet Protocol (IP) data of the one or more sensors, wherein the IP data comprises at least an IP address and a network status of at least one of the sensors, and wherein the network analytics module is adapted to process the IP data of the one or more sensors to detect one or more network events.

23. The system of claim 22, further comprising:

a normalization module adapted to normalize the sensory events, the legacy events, and the network events into a standardized data format to generate normalized sensory events, normalized legacy events, and normalized network events.

24. The system of claim 23, further comprising:

an event queue to queue the normalized sensory events, the normalized legacy events, and the normalized network events for storage in the event database.

25. The system of claim 24, wherein the system-wide analytics module is adapted to evaluate one or more historical correlations by automatically analyzing the stored sensory events, the stored legacy events, and the stored network events, across at least one of time and space, for one or more historical correlations among the stored sensory events, the stored legacy events, and the stored network events.

26. The system of claim 25, wherein the system-wide analytics module is adapted to monitor continuously and in real-time the normalized sensory events, the normalized legacy events, and the normalized network events to identify the one or more critical events, and wherein the one or more critical events are based at least on the one or more historical correlations among the stored sensory events, the stored legacy events, and the stored network events.