Patent ID: 9449483
Filing Date: 2016-09-20
CPC Classification: G06F,G07C,G08B,Y10S

Claim Text:
1. A method comprising: an event processor detecting a plurality of events related to activities of users within a security system, wherein the plurality of events are defined by a plurality of attributes, wherein at least one of the plurality of attributes is categorical, and wherein a data distance between each of the plurality of events is a function of event attributes; an evaluation processor evaluating the detected plurality of events using a selected density based anomaly detection method responsive to a size of a neighborhood around a data point representing each of the plurality of events to establish distances between data values in a categorical portion of a data space; a comparison processor comparing a value of the established distances in the categorical portion of the data space with a selected margin threshold value; and an alarm processor setting an alarm upon detecting that the value exceeds the threshold value.