Building risk analysis system with natural language processing for threat ingestion

A Building Management System (BMS) comprising one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to:

• receive a threat event indicating a potential threat to at least one of buildings, building equipment, people, or spaces within a building, the threat event having one or more threat categories among a plurality of threat categories and a threat type to indicate one or more characteristics of the potential threat;
• assign, based at least in part on the one or more threat categories using an expiry time prediction model, an expiry time to the threat event, the expiry time prediction model trained using a set of historical threat events, and wherein the historical threat events include one or more historical expiry times and include one or more similarities to at least one of the threat event, the potential threat, or the plurality of threat categories;
• determine, at a first time prior to the expiry time of the threat event, a first risk value based on the threat event;
• select, based on the threat type of the threat event, a decay model of a first model type of a plurality of different model types, the plurality of different model types linked to a plurality of different threat types, wherein the decay model decays the first risk value to a predefined risk value at the expiry time based on a decay pattern defined by the first model type;
• configure the selected decay model to execute for the threat event, the configured decay model decaying, based on the decay pattern defined by the first model type, the first risk value at the first time to the predefined risk value at the expiry time;
• and
• execute the configured decay model to decay the first risk value of the threat event.

A method for risk analysis, the method comprising:

• receiving, by one or more processing circuits, a threat event indicating a potential threat to at least one of buildings, building equipment, people, or spaces within a building, the threat event having one or more threat categories among a plurality of threat categories and a threat type to indicate one or more characteristics of the potential threat;
• assigning, by the one or more processing circuits based at least in part on the one or more threat categories using an expiry time prediction model, an expiry time to the threat event, the expiry time prediction model trained using a set of historical threat events, and wherein the historical threat events include one or more historical expiry times and include one or more similarities to at least one of the threat event, the potential threat, or the plurality of threat categories;
• determining, by the one or more processing circuits at a first time prior to the expiry time of the threat event, a first risk value based on the threat event;
• selecting, by the one or more processing circuits based on the threat type of the threat event, a decay model of a first model type of a plurality of different model types, the plurality of different model types linked to a plurality of different threat types, wherein the decay model decays the first risk value to a predefined risk value at the expiry time based on a decay pattern defined by the first model type;
• configuring, by the one or more processing circuits, the selected decay model to execute for the threat event, the configured decay model decaying, based on the decay pattern defined by the first model type, the first risk value at the first time to the predefined risk value at the expiry time;
• and
• executing, by the one or more processing circuits, the configured decay model to decay the first risk value of the threat event.

One or more non-transitory computer-readable storage medium storing instructions thereon that, when executed by one or more processors, cause the one or more processors to:

• receive a threat event indicating a potential threat to at least one of buildings, building equipment, people, or spaces within a building, the threat event having one or more threat categories among a plurality of threat categories and a threat type to indicate one or more characteristics of the potential threat;
• assign, based at least in part on the one or more threat categories using an expiry time prediction model, an expiry time to the threat event, the expiry time prediction model trained using a set of historical threat events, and wherein the historical threat events include one or more historical expiry times and include one or more similarities to at least one of the threat event, the potential threat, or the plurality of threat categories;
• determine, at a first time prior to the expiry time of the threat event, a first risk value based on the threat event;
• select, based on the threat type of the threat event, a decay model of a first model type of a plurality of different model types, the plurality of different model types linked to a plurality of different threat types, wherein the decay model decays the first risk value to a predefined risk value at the expiry time based on a decay pattern defined by the first model type;
• configure the selected decay model to execute for the threat event, the configured decay model decaying, based on the decay pattern defined by the first model type, the first risk value at the first time to the predefined risk value at the expiry time;
• and
• execute the configured decay model to decay the first risk value of the threat event.