System and method of anomaly detection

An apparatus comprising:

• an event processor that detects a plurality of events within a security system;
• an evaluation processor that evaluates the events using one of a first expression defined by ΣrεQconf(f(r)−mrg(r)), a second expression defined by ∫rεR|f(r)−mrg(r)|dr and a third expression defined by ∫rεRconf(f(r)−mrg(r))dr, where r is a size of a neighborhood around a data point, f(r) is a Local Correlation Integral (LOCI) of r, mrg(r) is a margin of r, R is a predetermined set of intervals of neighborhood sizes, Q is a predetermined discrete set of neighborhood sizes and conf(d) is a non-linear confidence function being 0 for near distance to the data point and quickly approaching 1 for larger distances;
• a comparison processor that compares a value of the evaluated expression with a threshold value;
• and
• an alarm processor that sets an alarm upon detecting that the value exceeds the threshold value.

An apparatus comprising:

• a security system that protects a secured area having a plurality of zones;
• a processor that detects a plurality of events within the security system including at least entry into at some of the plurality of zones;
• a processor that evaluates the events using one of a first expression defined by ΣrεQconf(f(r)−mrg(r)), a second expression defined b ∫rεR|f(r)−mrg(r)|dr and a third expression defined by ∫rεRconf(f(r)−mrg(r))dr, where r is a size of a neighborhood around a data point, f(r) is a Local Correlation Integral (LOCI) of r, mrg(r) is a margin of r, R is a predetermined set of intervals of neighborhood sizes, Q is a predetermined discrete set of neighborhood sizes and conf(d) is a non-linear confidence function being 0 for near distance to the data point and quickly approaching 1 for larger distances;
• a processor that compares a value of the evaluated expression with a threshold value;
• and
• a processor that sets an alarm upon detecting that the value exceeds the threshold value.