Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive threats, the threats each indicating an incident affecting a dynamic risk score associated with an asset, wherein one or more of the threats are current threats that are active at a current point in time and one or more of the threats are historic threats that were active at one or more past times. The instructions cause the one or more processors to generate, based on the one or more current threats, the dynamic risk score at the current point in time, generate, based on the one or more historic threats, a baseline risk score, and cause a user interface to display an indication of the dynamic risk score at the current point in time and an indication of the baseline risk score.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive threats, the threats each indicating an incident affecting a dynamic risk score associated with an asset, wherein one or more of the threats are current threats that are active at a current point in time and one or more of the threats are historic threats that were active at one or more past times. The instructions cause the one or more processors to generate, based on the one or more current threats, the dynamic risk score at the current point in time, generate, based on the one or more historic threats, a baseline risk score, and cause a user interface to display an indication of the dynamic risk score at the current point in time and an indication of the baseline risk score.

Abstract: A building security system includes one or more memory devices configured to store instructions, that when executed on one or more processors, cause the one or more processors to receive, for each of alarm rules, one or more alarm rule parameters for each of the alarm rules from a user device, receive security system data from a security system, and for each alarm rule of the alarm rules determining, based on the one or more alarm rule parameters for the alarm rule, whether the alarm rule is triggered by the security system data and generating an alarm for the alarm rule in response to determining that the alarm rule is triggered.

Abstract: A method for detecting anomalous behavior includes receiving a plurality of historical events that occurred over a time period, identifying respective timestamps of the plurality of events, and grouping the plurality of events into respective time buckets that extend over a predetermined time interval based on the respective timestamps. The method includes identifying a subset of the time buckets that are each associated with a particular first time unit of the plurality of first time units and a particular second time unit of the second plurality of time units, counting a number of the events in each of the subset, and generating a temporal profile including an occurrence rate calculated based on the counted number of events.

Abstract: A method in an access control system includes maintaining a database of access control event data generated by a plurality of access control devices installed in a building and iterating through the access control event data in order to generate a connectivity model for the building. Generating the connectivity model includes, for each iteration, identifying a user interaction with a first door at a first time and a user interaction with a second door at a second time, determining if a difference between the first time and the second time is less than a threshold period of time, and either creating the connection between the first door and the second door or updating a weight associated with the connection. The connectivity model can be used in the access control system to correlate access control events across locations in a building or building campus.

Abstract: A method in a building access control system includes receiving a first access control event from a sensor indicating a door has been forced open or has been held open for at least a predetermined amount of time, identifying a second access control event associated with the door, determining whether to generate an alarm by evaluating the second access control event relative to the first access control event, and providing the alarm to a user of the access control system responsive to a determination that the alarm should be generated.

Abstract: A building security system includes one or more memory devices configured to store instructions, that when executed on one or more processors, cause the one or more processors to receive, for each of alarm rules, one or more alarm rule parameters for each of the alarm rules from a user device, receive security system data from a security system, and for each alarm rule of the alarm rules determining, based on the one or more alarm rule parameters for the alarm rule, whether the alarm rule is triggered by the security system data and generating an alarm for the alarm rule in response to determining that the alarm rule is triggered.

Abstract: A method for a person of interest (POI) monitoring system including generating a POI data structure, wherein the POI data structure includes an identifier of an individual to be monitored as a POI, causing the POI data structure to include an indication of one or more recipients to be notified upon detection of the individual, receive, from a security device, security data that describes an interaction of the individual with the security device, the security data including the identifier of the individual, determining whether the received identifier matches the identifier of the POI data structure, and causing one or more user devices associated with the one or more recipients to display a GUI notification in response to the received identifier matching the identifier of the POI data structure.

Abstract: A building security system. The building security system includes a door analysis system for the building for detecting a lock defeat device (LDD) installed at a door of the building. The door analysis system includes a processing circuit configured to receive door data for the door of the building from an access control system, the door data including a plurality of door events; determine whether the LDD has been installed at the door by analyzing the plurality of door events with one or more LDD indicators; and generate an LDD event indicating that the LDD has been installed at the door in response to a determination that the LDD has been installed at the door based on an analysis with the one or more LDD indicators.

Abstract: A building security system. The building security system includes a door analysis system for the building for detecting a lock defeat device (LDD) installed at a door of the building. The door analysis system includes a processing circuit configured to receive door data for the door of the building from an access control system, the door data including a plurality of door events; determine whether the LDD has been installed at the door by analyzing the plurality of door events with one or more LDD indicators; and generate an LDD event indicating that the LDD has been installed at the door in response to a determination that the LDD has been installed at the door based on an analysis with the one or more LDD indicators.

Abstract: A method for controlling access to at least a portion of a building includes providing a temporal model identifying relationships between a first set of access control events based on times at which the first set of access control events occurred, providing a spatial model identifying relationships between a second set of access control events based on locations associated with the second set of access control events, providing a user model identifying patterns of user behavior based on a third set of access control events, receiving a fourth set of access control events comprising time data, and location data, and user data associated with the access control events, and determining whether to generate alarms responsive to receiving the fourth set of access control events using the temporal model, the spatial model, and the user model.

Abstract: A method for detecting anomalous behavior includes receiving a plurality of historical events that occurred over a time period, identifying respective timestamps of the plurality of events, and grouping the plurality of events into respective time buckets that extend over a predetermined time interval based on the respective timestamps. The method includes identifying a subset of the time buckets that are each associated with a particular first time unit of the plurality of first time units and a particular second time unit of the second plurality of time units, counting a number of the events in each of the subset, and generating a temporal profile including an occurrence rate calculated based on the counted number of events.

Abstract: A method in a building access control system includes receiving a first access control event from a sensor indicating a door has been forced open or has been held open for at least a predetermined amount of time, identifying a second access control event associated with the door, determining whether to generate an alarm by evaluating the second access control event relative to the first access control event, and providing the alarm to a user of the access control system responsive to a determination that the alarm should be generated.

Abstract: A method in an access control system includes maintaining a database of access control event data generated by a plurality of access control devices installed in a building and iterating through the access control event data in order to generate a connectivity model for the building. Generating the connectivity model includes, for each iteration, identifying a user interaction with a first door at a first time and a user interaction with a second door at a second time, determining if a difference between the first time and the second time is less than a threshold period of time, and either creating the connection between the first door and the second door or updating a weight associated with the connection. The connectivity model can be used in the access control system to correlate access control events across locations in a building or building campus.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive threats, the threats each indicating an incident affecting a dynamic risk score associated with an asset, wherein one or more of the threats are current threats that are active at a current point in time and one or more of the threats are historic threats that were active at one or more past times. The instructions cause the one or more processors to generate, based on the one or more current threats, the dynamic risk score at the current point in time, generate, based on the one or more historic threats, a baseline risk score, and cause a user interface to display an indication of the dynamic risk score at the current point in time and an indication of the baseline risk score.

Abstract: A method for controlling access to at least a portion of a building includes providing a temporal model identifying relationships between a first set of access control events based on times at which the first set of access control events occurred, providing a spatial model identifying relationships between a second set of access control events based on locations associated with the second set of access control events, providing a user model identifying patterns of user behavior based on a third set of access control events, receiving a fourth set of access control events comprising time data, and location data, and user data associated with the access control events, and determining whether to generate alarms responsive to receiving the fourth set of access control events using the temporal model, the spatial model, and the user model.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive threats, the threats each indicating an incident affecting a dynamic risk score associated with an asset, wherein one or more of the threats are current threats that are active at a current point in time and one or more of the threats are historic threats that were active at one or more past times. The instructions cause the one or more processors to generate, based on the one or more current threats, the dynamic risk score at the current point in time, generate, based on the one or more historic threats, a baseline risk score, and cause a user interface to display an indication of the dynamic risk score at the current point in time and an indication of the baseline risk score.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive a threat, the threat comprising a particular threat type, the threat indicating an incident affecting a risk value associated with an asset. The instructions cause the one or more processors to determine, based on the threat and the asset, the risk value at a first point in time, select a decay model based on the particular threat type, and update the risk value at a plurality of points in time after the first point in time with the decay model causing the risk value to decay.

Abstract: A multiplexed data channel telephone system comprising a master station (221) and one or more remote stations (222) is disclosed. Each station (221, 222) is bridged, in a parallel electrical connection, onto a wire-pair (201) that extends from the stations to a telephone switching system. Each station (221, 222) includes a voiceband line interface (110, 310) for connecting to the wire-pair (201) at voiceband frequencies, and a radio frequency line interface (700, 800) for connecting to the wire-pair (201) at radio frequencies. Each station further includes multiplexer and demultiplexer equipment (500, 600) for frequency shifting a data channel between baseband and rf. Amplitude modulation and half-duplex transmission are used in the data channel. Telephone status and control information, including ringing and answer control, are exchanged between controllers (160, 360) via the data channel.