Abstract: Systems and methods for increasing an efficiency of an operator of a security system are discussed generally herein. A system can include a memory including ontology data saved thereon, the ontology data can define interrelationships between a scanner associated with access to a room of an area under surveillance, a camera with a field of view at least partially overlapping a footprint of the room, an identifier configured to be scanned by the scanner and associated with a person, and a security policy including one or more predefined conditions, which when satisfied, indicate when a security threat exists, the security policy includes a response an operator can perform if the conditions are satisfied, and the system can include a query module configured to receive a query and search the ontology data and temporal and spatial data associated with the area under surveillance in response to receiving the query.

Abstract: Methods, devices, and computer-readable media for determining a deployment of an access control system are described herein. One method includes extracting a plurality of two-dimensional spaces from a building information model of a facility, determining a plurality of connections between the plurality of spaces, defining a zone of the facility, wherein the zone includes a subset of the plurality of spaces and a subset of the plurality of connections between the spaces, and associating an access reader with a particular connection of the subset of the plurality of connections located on a boundary of the zone.

Abstract: Devices, methods, systems, and computer-readable media for open architecture security are described herein. One or more embodiments include a method for open architecture security, comprising: identifying a source of a received computing component, assigning a value to the received computing component based on the source, and designating the received computing component into a security level based on the assigned value.

Abstract: A method and apparatus are provided where the method includes detecting a plurality of events related to the activities of users within a security system, wherein the events are defined by a plurality of attributes, wherein at least one attribute is categorical, and wherein a data distance between events is a function of event attributes, evaluating the detected events using a density based anomaly detection method f(r), where r is a size of a neighborhood around a data point, comparing a value of the evaluated expression with a margin threshold value (msg(r)), and setting an alarm upon detecting that the value exceeds the threshold value.

Abstract: Devices, methods, and systems for monitoring access to a location are described herein. One or more method embodiments include determining data associated with an access event associated with a location, determining whether the access event is an anomalous access event using the data associated with the access event and a statistical model of data associated with a number of non-anomalous access events associated with the location, and assessing, if the access event is determined to be an anomalous access event, the anomalous access event. In various embodiments, assessing the anomalous access event includes at least one of determining an anomaly type associated with the anomalous access event, determining an anomaly classification confidence associated with the anomalous access event, determining an anomaly severity associated with the anomalous access event, and determining a reliability associated with the statistical model.

Abstract: Devices, methods, systems, and computer-readable media for open architecture security are described herein. One or more embodiments include a method for open architecture security, comprising: identifying a source of a received computing component, assigning a value to the received computing component based on the source, and designating the received computing component into a security level based on the assigned value.

Abstract: Devices, methods, and systems for monitoring access to a location are described herein. One or more method embodiments include determining data associated with an access event associated with a location, determining whether the access event is an anomalous access event using the data associated with the access event and a statistical model of data associated with a number of non-anomalous access events associated with the location, and assessing, if the access event is determined to be an anomalous access event, the anomalous access event. In various embodiments, assessing the anomalous access event includes at least one of determining an anomaly type associated with the anomalous access event, determining an anomaly classification confidence associated with the anomalous access event, determining an anomaly severity associated with the anomalous access event, and determining a reliability associated with the statistical model.

Abstract: One or more embodiments include collecting data associated with a first access profile, collecting data associated with a second access profile, determining whether the data associated with the first access profile has a particular number of characteristics in common with the data associated with the second access profile, assigning a statistical access model associated with the second access profile to the first access profile based on the particular number of characteristics that the data associated with first access profile has in common with the data associated with the second access profile, and detecting an anomalous access event based on the statistical access model.

Abstract: Methods, systems, and computer-readable media for tailgating detection are described herein. One method includes collecting, via a computing device, access log data associated with a profile; processing, by a processor coupled to the computing device, the access log data to obtain a statistical access model; detecting, by the processor, a tailgating sequence based on the statistical access model; and providing, by the processor, a notification that the tailgating sequence has occurred.

Abstract: A method and apparatus where the method includes detecting a plurality of events related to the activities of users within a security system wherein the events are defined by a plurality of attributes, wherein at least one attribute is categorical and wherein a data distance between events is a function of event attributes, evaluating the detected events using a a density based anomaly detection method f(r), where r is a size of a neighborhood around a data point, comparing a value of the evaluated expression with a margin threshold value (msg(r)) and setting an alarm upon detecting that the value exceeds the threshold value.

Abstract: Methods, systems and Devices for operating a surveillance system are described herein. One method includes determining a plurality of parameters of a video camera installed at a particular location in a facility based on a projection of an image captured by the video camera onto a virtual image captured by a virtual video camera placed at a virtual location in a building information model of the facility corresponding to the particular location, determining a two-dimensional geometry of the facility based on the building information model, wherein the geometry includes a plurality of spaces, determining a coverage of the video camera based on a portion of the plurality of parameters and the geometry, determining which spaces of the plurality of spaces are included in the coverage, and associating each space included in the coverage with a respective portion of the image.

Abstract: Methods, devices, and computer-readable media for determining a deployment of an access control system are described herein. One method includes extracting a plurality of two-dimensional spaces from a building information model of a facility, determining a plurality of connections between the plurality of spaces, defining a zone of the facility, wherein the zone includes a subset of the plurality of spaces and a subset of the plurality of connections between the spaces, and associating an access reader with a particular connection of the subset of the plurality of connections located on a boundary of the zone.

Abstract: A method and apparatus where the method includes detecting a plurality of events related to the activities of users within a security system wherein the events are defined by a plurality of attributes, wherein at least one attribute is categorical and wherein a data distance between events is a function of event attributes, evaluating the detected events using a density based anomaly detection method f(r), where r is a size of a neighborhood around a data point, comparing a value of the evaluated expression with a margin threshold value (msg(r)) and setting an alarm upon detecting that the value exceeds the threshold value.

Abstract: Systems and methods for increasing an efficiency of an operator of a security system are discussed generally herein. A system can include a memory including ontology data saved thereon, the ontology data can define interrelationships between a scanner associated with access to a room of an area under surveillance, a camera with a field of view at least partially overlapping a footprint of the room, an identifier configured to be scanned by the scanner and associated with a person, and a security policy including one or more predefined conditions, which when satisfied, indicate when a security threat exists, the security policy includes a response an operator can perform if the conditions are satisfied, and the system can include a query module configured to receive a query and search the ontology data and temporal and spatial data associated with the area under surveillance in response to receiving the query.

Abstract: A plurality of access models comprise patterns of accesses to resources protected by an Access Control System (ACS). The access models are used to classify the accesses to the resources as either normal or anomalous. The system stores attributes for the individuals for whom the access models are available, receives attributes of an individual not associated with an access model, and compares the attributes of the individual not associated with an access model to the attributes of the individuals for whom access models are available. The system further selects an access model for the individual not associated with an access model based on the comparison, and uses the selected access model for the individual not associated with an access model to classify access to the one or more resources protected by the ACS by the individual not associated with an access model as either normal or anomalous.

Abstract: A method and apparatus wherein the method includes detecting a plurality of events within a security system, evaluating the events using one of a first expression defined by ?r?Qconf(f(r)?mrg(r)), a second expression defined by ?r?R|f(r)?mrg(r)|dr and a third expression defined by ?r?Rconf(f(r)?mrg(r))dr, where r is a size of a neighborhood around a data point, f(r) is a Local Correlation Integral (LOCI) of r, mrg(r) is a margin of r, R is a predetermined set of intervals of neighborhood sizes, Q is a predetermined discrete set of neighborhood sizes and conf(d) is a non-linear confidence function being 0 for near distance to the data point and quickly approaching 1 for larger distances, comparing a value of the evaluated expression with a threshold value and setting an alarm upon detecting that the value exceeds the threshold value.

Abstract: A method and apparatus wherein the method includes detecting a plurality of events within a security system, evaluating the events using one of a first expression defined by ?r?Qconƒ(ƒ(r)?mrg(r)), a second expression defined by ?r?R|ƒ(r)?mrg(r)|dr and a third expression defined by ?r?Rconƒ(ƒ(r)?mrg(r))dr, where r is a size of a neighborhood around a data point, f(r) is a Local Correlation Integral (LOCI) of r, mrg(r) is a margin of r, R is a predetermined set of intervals of neighborhood sizes, Q is a predetermined discrete set of neighborhood sizes and conf(d) is a non-linear confidence function being 0 for near distance to the data point and quickly approaching 1 for larger distances, comparing a value of the evaluated expression with a threshold value and setting an alarm upon detecting that the value exceeds the threshold value.

Abstract: A method and apparatus where the method includes detecting a plurality of events related to the activities of users within a security system wherein the events are defined by a plurality of attributes, wherein at least one attribute is categorical and wherein a data distance between events is a function of event attributes, evaluating the detected events using a density based anomaly detection method f(r), where r is a size of a neighborhood around a data point, comparing a value of the evaluated expression with a margin threshold value (msg(r)) and setting an alarm upon detecting that the value exceeds the threshold value.

Abstract: A system and method include obtaining data related to accessing cyber assets and accessing physical assets from a combined cyber access and physical access control system that protects cyber and physical assets of an organization from both authorized and unauthorized access with malicious intent. The system and method compare the data to known patterns of expected behavior, and identify patterns of suspicious behavior as a function of comparing the data to the patterns of expected behavior. The comparison is utilized to identify potentially malicious insider behavior toward the cyber and physical assets.

Abstract: A method and apparatus for detecting behavioral changes in a security system is provided. The method includes the steps of providing a secured area having a plurality of security zones where access to each is controlled by an access controller, detecting entrances to at least some of the plurality of security zones by an authorized person through respective access controllers of the plurality of zones over a predetermined previous time period, forming a probability model of entry into each of the plurality of security zones from the detected entrances over the previous time period, detecting access requests for the authorized user from the access controllers during a current time period, and generating a security alert upon determining that an access request of the current access requests exceeds a probability threshold value associated with the probability model.