System and method of anomaly detection with categorical attributes
AssigneeHoneywell International Inc.
InventorsVit Libal, Pavel Vacha, Valerie Guralnik
Life of this patent
Estimating the term…
Abstract
A method and apparatus are provided where the method includes detecting a plurality of events related to the activities of users within a security system, wherein the events are defined by a plurality of attributes, wherein at least one attribute is categorical, and wherein a data distance between events is a function of event attributes, evaluating the detected events using a density based anomaly detection method f(r), where r is a size of a neighborhood around a data point, comparing a value of the evaluated expression with a margin threshold value (msg(r)), and setting an alarm upon detecting that the value exceeds the threshold value.
Claims20
A method comprising:
- an event processor detecting a plurality of events related to activities of users within a security system, wherein the plurality of events are defined by a plurality of attributes, wherein at least one of the plurality of attributes is categorical, and wherein a data distance between each of the plurality of events is a function of event attributes;
- an evaluation processor evaluating the detected plurality of events using a selected density based anomaly detection method responsive to a size of a neighborhood around a data point representing each of the plurality of events to establish distances between data values in a categorical portion of a data space;
- a comparison processor comparing a value of the established distances in the categorical portion of the data space with a selected margin threshold value;
- and
- an alarm processor setting an alarm upon detecting that the value exceeds the threshold value.
An apparatus comprising:
- an event processor that detects a plurality of events related to activities of users within a security system, wherein the plurality of events are defined by a plurality of attributes, wherein at least one of the plurality of attributes is categorical, and wherein a data distance between each of the plurality of events is a function of event attributes;
- an evaluation processor that evaluates the detected plurality of events using a density based anomaly detection method responsive to a size of a neighborhood around a data point representing each of the plurality of events to establish distances between data values in a categorical portion of a data space;
- a comparison processor that compares a value of the established distances in the categorical portion of the data space with a selected margin threshold value;
- and
- an alarm processor that sets an alarm upon detecting that the value exceeds the threshold value.
An apparatus comprising:
- a security system that detects security events within a secured area;
- an event processor that detects events related to activities of users within a security system, wherein the events are defined by a plurality of attributes, wherein at least one of the plurality of attributes is categorical, and wherein a data distance between each of the events is a function of event attributes;
- an evaluation processor that evaluates the detected events using a selected density based anomaly detection method to establish a distance between data values in a categorical portion of a data space;
- a comparison processor that compares a value of the established distances in the categorical portion of the data space with a margin threshold value;
- and
- an alarm processor that sets an alarm upon detecting that the value exceeds the threshold value.
Dependencies are inferred from the claim text.