Abstract: A building security system of a building including one or more memory devices configured to store instructions causing one or more processors to receive door lock data collected from one or more sensors for one or more doors within the building indicating operation of the one or more doors, select a period for which the door lock data was collected, select a first door from the one or more doors of the building for which data is collected, and identify segments of the data indicating activity of the door. The instructions also apply a model to segments of the data indicating activity of the first door, compute a probability metric for each segment of the data, compute a combined probability score for the first door based on the computed probability metrics, and classify the first door as normally functioning or malfunctioning by comparing the combined probability score to a threshold.

Abstract: A method for predicting a path of a specific occupant of a number of occupants including receiving user access data, the user access data including a user identifier, an access time, and an access location, generating, a first model describing general sequences of access events associated with the number of occupants and a frequency of each of the general sequences, generating a second model describing specific sequences of access events associated with the specific occupant and a frequency of each of the specific sequences, and generating a path prediction model based on the first and second models, the path prediction model including a weighted score for each of the number of access control points, the weighted score associated with a probability the specific occupant accesses the access control point based on a last accessed access control point.

Abstract: A building security system of a building including one or more memory devices configured to store instructions causing one or more processors to receive door lock data collected from one or more sensors for one or more doors within the building indicating operation of the one or more doors, select a period for which the door lock data was collected, select a first door from the one or more doors of the building for which data is collected, and identify segments of the data indicating activity of the door. The instructions also apply a model to segments of the data indicating activity of the first door, compute a probability metric for each segment of the data, compute a combined probability score for the first door based on the computed probability metrics, and classify the first door as normally functioning or malfunctioning by comparing the combined probability score to a threshold.

Abstract: An alarm management system includes a plurality of data sources configured to provide data relating to an event at a building and a processing circuit. The processing circuit is configured to receive the data from the data sources, apply a Bayesian network model to the data to generate a probability score for each of a plurality of possible causes of the event, identify the most probable cause of the event as a first cause of the plurality of possible causes having a highest probability score, execute an action with respect to the identified most probable cause of the event.

Abstract: A method for detecting anomalous behavior includes receiving a plurality of historical events that occurred over a time period, identifying respective timestamps of the plurality of events, and grouping the plurality of events into respective time buckets that extend over a predetermined time interval based on the respective timestamps. The method includes identifying a subset of the time buckets that are each associated with a particular first time unit of the plurality of first time units and a particular second time unit of the second plurality of time units, counting a number of the events in each of the subset, and generating a temporal profile including an occurrence rate calculated based on the counted number of events.

Abstract: An illustrative embodiment disclosed herein is a network including a first local group of first node devices, a second local group of second node devices, and a new node device. The new node device has a processor with programmed instructions to range to each of the first node devices, collect ranging data from each of the first node devices, calculate a plurality of distances based on the ranging data, and send the plurality of distances to each of the second node devices.

Abstract: A method in an access control system includes maintaining a database of access control event data generated by a plurality of access control devices installed in a building and iterating through the access control event data in order to generate a connectivity model for the building. Generating the connectivity model includes, for each iteration, identifying a user interaction with a first door at a first time and a user interaction with a second door at a second time, determining if a difference between the first time and the second time is less than a threshold period of time, and either creating the connection between the first door and the second door or updating a weight associated with the connection. The connectivity model can be used in the access control system to correlate access control events across locations in a building or building campus.

Abstract: A method in a building access control system includes receiving a first access control event from a sensor indicating a door has been forced open or has been held open for at least a predetermined amount of time, identifying a second access control event associated with the door, determining whether to generate an alarm by evaluating the second access control event relative to the first access control event, and providing the alarm to a user of the access control system responsive to a determination that the alarm should be generated.

Abstract: An alarm management system includes a plurality of data sources configured to provide data relating to an event at a building and a processing circuit. The processing circuit is configured to receive the data from the data sources, apply a Bayesian network model to the data to generate a probability score for each of a plurality of possible causes of the event, identify the most probable cause of the event as a first cause of the plurality of possible causes having a highest probability score, execute an action with respect to the identified most probable cause of the event.

Abstract: A building security system. The building security system includes a door analysis system for the building for detecting a lock defeat device (LDD) installed at a door of the building. The door analysis system includes a processing circuit configured to receive door data for the door of the building from an access control system, the door data including a plurality of door events; determine whether the LDD has been installed at the door by analyzing the plurality of door events with one or more LDD indicators; and generate an LDD event indicating that the LDD has been installed at the door in response to a determination that the LDD has been installed at the door based on an analysis with the one or more LDD indicators.

Abstract: A building security system. The building security system includes a door analysis system for the building for detecting a lock defeat device (LDD) installed at a door of the building. The door analysis system includes a processing circuit configured to receive door data for the door of the building from an access control system, the door data including a plurality of door events; determine whether the LDD has been installed at the door by analyzing the plurality of door events with one or more LDD indicators; and generate an LDD event indicating that the LDD has been installed at the door in response to a determination that the LDD has been installed at the door based on an analysis with the one or more LDD indicators.

Abstract: A method for controlling access to at least a portion of a building includes providing a temporal model identifying relationships between a first set of access control events based on times at which the first set of access control events occurred, providing a spatial model identifying relationships between a second set of access control events based on locations associated with the second set of access control events, providing a user model identifying patterns of user behavior based on a third set of access control events, receiving a fourth set of access control events comprising time data, and location data, and user data associated with the access control events, and determining whether to generate alarms responsive to receiving the fourth set of access control events using the temporal model, the spatial model, and the user model.

Abstract: An illustrative embodiment disclosed herein is a system including client devices distributed across an environment and configured to generate distance measurements. The system further includes wireless transceivers. Each transceiver is associated with one of the client devices. Each transceiver is configured to send and receive distance measurements. The system further includes a trilateration circuit in at least one of the client devices. The trilateration circuit is configured to receive the distance measurements from the client devices, determine a first position and a first weight based on the distance measurements via a first algorithm, determine second position and a second weight based on the second distance measurements via a second algorithm, calculate a final position based on the first position, the second position, the first weight, and the second weight, and send the final position to the plurality of client devices.

Abstract: An illustrative embodiment disclosed herein is a network including a first local group of first node devices, a second local group of second node devices, and a new node device. The new node device has a processor with programmed instructions to range to each of the first node devices, collect ranging data from each of the first node devices, calculate a plurality of distances based on the ranging data, and send the plurality of distances to each of the second node devices.

Abstract: Deploying a model for anomaly detection in time series data. A period of data is received. A model of the period of data is received. It is determined that the model fits a part of the period of data and that the fitted part of the period of data includes the most recent data. A reduced model for the part of the period of data that fit the received model is built. The reduced model is deployed.

Abstract: A method for predicting a path of a specific occupant of a number of occupants including receiving user access data, the user access data including a user identifier, an access time, and an access location, generating, a first model describing general sequences of access events associated with the number of occupants and a frequency of each of the general sequences, generating a second model describing specific sequences of access events associated with the specific occupant and a frequency of each of the specific sequences, and generating a path prediction model based on the first and second models, the path prediction model including a weighted score for each of the number of access control points, the weighted score associated with a probability the specific occupant accesses the access control point based on a last accessed access control point.

Abstract: A method for controlling access to at least a portion of a building includes providing a temporal model identifying relationships between a first set of access control events based on times at which the first set of access control events occurred, providing a spatial model identifying relationships between a second set of access control events based on locations associated with the second set of access control events, providing a user model identifying patterns of user behavior based on a third set of access control events, receiving a fourth set of access control events comprising time data, and location data, and user data associated with the access control events, and determining whether to generate alarms responsive to receiving the fourth set of access control events using the temporal model, the spatial model, and the user model.

Abstract: A method in an access control system includes maintaining a database of access control event data generated by a plurality of access control devices installed in a building and iterating through the access control event data in order to generate a connectivity model for the building. Generating the connectivity model includes, for each iteration, identifying a user interaction with a first door at a first time and a user interaction with a second door at a second time, determining if a difference between the first time and the second time is less than a threshold period of time, and either creating the connection between the first door and the second door or updating a weight associated with the connection. The connectivity model can be used in the access control system to correlate access control events across locations in a building or building campus.

Abstract: A method for detecting anomalous behavior includes receiving a plurality of historical events that occurred over a time period, identifying respective timestamps of the plurality of events, and grouping the plurality of events into respective time buckets that extend over a predetermined time interval based on the respective timestamps. The method includes identifying a subset of the time buckets that are each associated with a particular first time unit of the plurality of first time units and a particular second time unit of the second plurality of time units, counting a number of the events in each of the subset, and generating a temporal profile including an occurrence rate calculated based on the counted number of events.

Abstract: A method in a building access control system includes receiving a first access control event from a sensor indicating a door has been forced open or has been held open for at least a predetermined amount of time, identifying a second access control event associated with the door, determining whether to generate an alarm by evaluating the second access control event relative to the first access control event, and providing the alarm to a user of the access control system responsive to a determination that the alarm should be generated.