Abstract: A system for securely communicating information in a building management system (BMS) includes a plurality of HVAC devices communicably coupled via a network each HVAC device storing a copy of an HVAC data chain that includes a plurality of blocks linked sequentially. The plurality of HVAC devices includes a first HVAC device including a processing circuit configured to generate a first block comprising device data and send the block to at least a portion of the plurality of HVAC devices. The processing circuit is configured to receive a second block from one of the plurality of HVAC devices and solve the second block. The processing circuit is further configured to add the solved block to the HVAC data chain of the first HVAC device as the newest block and send the solved block to each of the plurality of HVAC devices.

Abstract: One embodiment of the present disclosure is a system for predicting performance of building equipment. The system comprises one or more sensors in communication with the building equipment, and the sensors are operable to detect characteristics from the building equipment. The system further comprises a computing device in communication with the sensors and in the same geographic location as the sensors. The computing device comprises one or more memory devices configured to store instructions that, when executed on one or more processors, cause the one or more processors to receive data from the sensors, the data based on the detected characteristics. The one or more processors also generate, based on a machine learning model and the data, a predicted performance of the building equipment when the machine learning model comprises a prior data substantially similar to the data.

Abstract: A system for securely communicating information in a building management system (BMS) includes a plurality of HVAC devices communicably coupled via a network each HVAC device storing a copy of an HVAC data chain that includes a plurality of blocks linked sequentially. The plurality of HVAC devices includes a first HVAC device including a processing circuit configured to generate a first block comprising device data and send the block to at least a portion of the plurality of HVAC devices. The processing circuit is configured to receive a second block from one of the plurality of HVAC devices and solve the second block. The processing circuit is further configured to add the solved block to the HVAC data chain of the first HVAC device as the newest block and send the solved block to each of the plurality of HVAC devices.

Abstract: A building management system includes one or more computer-readable storage media having a data structure, wherein the data structure comprises a plurality of vulnerabilities and a plurality of pairs, each of the plurality of pairs comprising one of a plurality of assets and one of the plurality of threat types, wherein each of the plurality of pairs is associated with one of the plurality of vulnerabilities and instructions. The instructions cause one or more processors to receive a threat, the threat comprising a particular threat type of the plurality of threat types, the threat indicating an incident affecting a risk value associated with a particular asset of the plurality of assets, identify a particular vulnerability of the data structure based on the particular threat type and the particular asset, and determine, based on the particular vulnerability and the threat, the risk value associated with the particular asset.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive a plurality of threat events, the received threat events associated with a plurality of threat categories, the plurality of assets associated with a plurality of locations. The instructions cause the one or more processors to generate a location-specific aggregated risk score, generate a category-specific risk metric indicating, and for each of at least two or more of the plurality of threat categories, generate a number of threat events associated with the threat categories, generate user interface data including, within a single interface, visual representations of both the location-specific aggregated risk scores for the two or more locations and the category-specific risk metrics for the two or more threat categories.

Abstract: A building management system includes one or more computer-readable storage media having a data structure, wherein the data structure comprises a plurality of vulnerabilities and a plurality of pairs, each of the plurality of pairs comprising one of a plurality of assets and one of the plurality of threat types, wherein each of the plurality of pairs is associated with one of the plurality of vulnerabilities and instructions. The instructions cause one or more processors to receive a threat, the threat comprising a particular threat type of the plurality of threat types, the threat indicating an incident affecting a risk value associated with a particular asset of the plurality of assets, identify a particular vulnerability of the data structure based on the particular threat type and the particular asset, and determine, based on the particular vulnerability and the threat, the risk value associated with the particular asset.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive a plurality of threats, the plurality of threats comprising a first threat and a second threat, the first threat and the second threat affecting a risk score of an asset and determine whether the first threat is correlated with the second threat. The instructions cause the one or more processors to determine a value of the risk score to be a first value in response to a determination that the first threat is correlated with the second threat and determine the value of the risk score to be a second value in response to a determination that the first threat is not correlated with the second threat.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive threats, the threats each indicating an incident affecting a dynamic risk score associated with an asset, wherein one or more of the threats are current threats that are active at a current point in time and one or more of the threats are historic threats that were active at one or more past times. The instructions cause the one or more processors to generate, based on the one or more current threats, the dynamic risk score at the current point in time, generate, based on the one or more historic threats, a baseline risk score, and cause a user interface to display an indication of the dynamic risk score at the current point in time and an indication of the baseline risk score.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive threats, the threats each indicating an incident affecting a dynamic risk score associated with an asset, wherein one or more of the threats are current threats that are active at a current point in time and one or more of the threats are historic threats that were active at one or more past times. The instructions cause the one or more processors to generate, based on the one or more current threats, the dynamic risk score at the current point in time, generate, based on the one or more historic threats, a baseline risk score, and cause a user interface to display an indication of the dynamic risk score at the current point in time and an indication of the baseline risk score.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive threat events indicating a potential threat, the received threat events including a first threat event associated with a first geolocation and a first threat category and a second threat event associated with a second geolocation and a second threat category. The instructions cause the one or more processors to determine, for an asset, a first geofence defining a first area around the asset for the first threat category, determine, for the asset, a second geofence defining a second area around the asset for the second threat category, the second area different than the first area, determine whether the first geolocation falls within the first geofence, determine whether the second geolocation falls within the second geofence.

Abstract: A building management system includes one or more computer-readable storage media having a data structure, wherein the data structure comprises a plurality of vulnerabilities and a plurality of pairs, each of the plurality of pairs comprising one of a plurality of assets and one of the plurality of threat types, wherein each of the plurality of pairs is associated with one of the plurality of vulnerabilities and instructions. The instructions cause one or more processors to receive a threat, the threat comprising a particular threat type of the plurality of threat types, the threat indicating an incident affecting a risk value associated with a particular asset of the plurality of assets, identify a particular vulnerability of the data structure based on the particular threat type and the particular asset, and determine, based on the particular vulnerability and the threat, the risk value associated with the particular asset.

Abstract: A building management system includes one or more computer-readable storage media having instructions that cause one or more processors to receive threat events indicating a potential threat, each threat event comprising a threat category from among a plurality of threat categories. The instructions cause the one or more processors, for each threat event, to assign, using an expiry time prediction model, an expiry time to the threat event based at least in part on the threat category of the threat event, the expiry time prediction model trained using a set of historical threat events. The instructions cause the one or more processors to classify the threat event as inactive upon expiration of an assigned expiry time.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive a plurality of threats, the plurality of threats comprising a first threat and a second threat, the first threat and the second threat affecting a risk score of an asset and determine whether the first threat is correlated with the second threat. The instructions cause the one or more processors to determine a value of the risk score to be a first value in response to a determination that the first threat is correlated with the second threat and determine the value of the risk score to be a second value in response to a determination that the first threat is not correlated with the second threat.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive a plurality of threat events, the received threat events associated with a plurality of threat categories, the plurality of assets associated with a plurality of locations. The instructions cause the one or more processors to generate a location-specific aggregated risk score, generate a category-specific risk metric indicating, and for each of at least two or more of the plurality of threat categories, generate a number of threat events associated with the threat categories, generate user interface data including, within a single interface, visual representations of both the location-specific aggregated risk scores for the two or more locations and the category-specific risk metrics for the two or more threat categories.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive threat events from one or more data sources, each threat event including a description and for each threat event determine whether the description for the threat event corresponds to one of a multiple predefined threat categories, generate a standardized threat object for the threat event using the corresponding predefined threat category, and in response to determining the description does not correspond to one of the predefined threat categories, process the description using a natural language processing engine to identify one of the predefined threat categories to be assigned to the threat event and generate a standardized threat object for the threat event using the predefined threat category identified by the natural language processing engine.

Abstract: A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive a threat, the threat comprising a particular threat type, the threat indicating an incident affecting a risk value associated with an asset. The instructions cause the one or more processors to determine, based on the threat and the asset, the risk value at a first point in time, select a decay model based on the particular threat type, and update the risk value at a plurality of points in time after the first point in time with the decay model causing the risk value to decay.

Abstract: A building management system (BMS) includes building equipment configured to provide raw data samples of one or more data points in the BMS. The BMS further includes a data collector configured to collect raw data samples from the building equipment and generate one or more raw data timeseries comprising a plurality of the raw data samples. The BMS also includes a timeseries processing engine. The timeseries processing engine is configured to identify one or more timeseries processing workflows that apply to the raw data timeseries, each of the workflows comprising a predefined sequence of timeseries processing operation. The timeseries processing engine is further configured to process the raw data timeseries using the identified timeseries processing workflows to generate one or more derived data timeseries. The BMS further includes a timeseries storage interface configured to store the raw data timeseries and the derived data timeseries in a timeseries database.

Abstract: A building management system (BMS) includes building equipment configured to provide raw data samples of data points in the BMS, a data collector configured to generate raw data timeseries including raw data samples from the building equipment, and a timeseries processing engine. The timeseries processing engine is configured to identify an initial timeseries processing workflow that applies to the raw data timeseries, identify other data timeseries required as inputs to the initial timeseries processing workflow, and generate an enriched timeseries processing workflow that includes the initial timeseries processing workflow, the raw data timeseries, and the other data timeseries. The timeseries processing engine is configured to execute the enriched timeseries processing workflow to generate a derived data timeseries. The BMS further includes a timeseries storage interface configured to store the raw data timeseries and the derived data timeseries in a timeseries database.

Abstract: A system for user interaction with a building automation system (BAS). The system includes a user device configured to accept vocal inputs and produce audio outputs, and a server in communication with the user device and a BAS controller. The server is configured to translate a vocal input to input text, and determine and store a conversation context based on the input text. The server is further configured to determine a desired output corresponding to the input text. Additionally, the server is configured to receive, from the BAS controller, BAS data corresponding to the desired output, and generate at least one audio output from the BAS data. The user device outputs the at least one audio output, and the server is configured to apply the conversation context to a subsequent vocal input.

Abstract: A building management system (BMS) includes building equipment configured to provide raw data samples of data points in the BMS, a data collector configured to generate raw data timeseries including raw data samples from the building equipment, and a timeseries processing engine. The timeseries processing engine is configured to identify an initial timeseries processing workflow that applies to the raw data timeseries, identify other data timeseries required as inputs to the initial timeseries processing workflow, and generate an enriched timeseries processing workflow that includes the initial timeseries processing workflow, the raw data timeseries, and the other data timeseries. The timeseries processing engine is configured to execute the enriched timeseries processing workflow to generate a derived data timeseries. The BMS further includes a timeseries storage interface configured to store the raw data timeseries and the derived data timeseries in a timeseries database.