Anomaly detection based on airflow alerters

A computer program product for intrusion detection, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

• receive a plurality of real-time airflow patterns acquired by a plurality of airflow alerters, wherein each real-time airflow pattern is generated by a heating, ventilation, and air conditioning (HVAC) system in a particular facility, and each real-time airflow pattern corresponds to a different airflow alerter;
• compare each real-time airflow pattern with a predetermined airflow pattern, wherein each real-time airflow pattern corresponds to a different predetermined airflow pattern;
• when there is any real-time airflow pattern different from the corresponding predetermined airflow pattern,
• identify a plurality of groups of airflow alerters among the plurality of airflow alerters, wherein a real-time airflow pattern of each airflow alerter in the plurality of groups is different from the corresponding predetermined airflow pattern;
• and
• identify a route of an intrusion based on the plurality of groups of airflow alerters.

A system for intrusion detection, comprising:

• a processor configured to:
• receive a plurality of real-time airflow patterns acquired by a plurality of airflow alerters, wherein each real-time airflow pattern is generated by a heating, ventilation, and air conditioning (HVAC) system in a particular facility, and each real-time airflow pattern corresponds to a different airflow alerter;
• compare each real-time airflow pattern with a predetermined airflow pattern, wherein each real-time airflow pattern corresponds to a different predetermined airflow pattern;
• when there is any real-time airflow pattern different from the corresponding predetermined airflow pattern,
• identify a plurality of groups of airflow alerters among the plurality of airflow alerters, wherein a real-time airflow pattern of each airflow alerter in the plurality of groups is different from the corresponding predetermined airflow pattern;
• and
• identify a route of an intrusion based on the plurality of groups of airflow alerters.