Access control system based upon behavioral patterns

A method and apparatus for detecting behavioral changes in a security system is provided. The method includes the steps of providing a secured area having a plurality of security zones where access to each is controlled by an access controller, detecting entrances to at least some of the plurality of security zones by an authorized person through respective access controllers of the plurality of zones over a predetermined previous time period, forming a probability model of entry into each of the plurality of security zones from the detected entrances over the previous time period, detecting access requests for the authorized user from the access controllers during a current time period, and generating a security alert upon determining that an access request of the current access requests exceeds a probability threshold value associated with the probability model.

FIELD OF THE INVENTION

The field of the invention relates to security systems and more particularly to methods of detecting physical access to a protected space.

BACKGROUND OF THE INVENTION

Security systems are generally known. Such systems are typically used in conjunction with a secured area to protect assets and/or people within the secured area.

The secured area is typically protected with a physical barrier (e.g., walls, fences, etc.) extending along a periphery of the secured area. Located along the physical barrier may be one or more access points allowing access into the secured area by authorized persons.

The access points may include some sort of physical entry point (e.g., a door) through which personnel and materials may pass both into and out of the secured area. The access points may each be equipped with a reader device (e.g., a card reader, etc.) and an access control device (e.g., an electrically activated lock) that controls opening of the door.

The secured area may also include one or more interior security areas or zones that divide the secured area into discrete zones. For example, a merchant may use an outer security zone to protect merchandise, while an inner security zone may be used to protect money received from sale of the merchandise within the outer zone. Usually the inner zones are provided with a higher security level than the outer zones.

While such systems work well, they can be defeated in any number of ways. For example, authorized people may enter during non-working hours and perform vandalism. Other authorized people may enter one or more secured areas during working hours or otherwise and improperly remove assets and/or money. Accordingly, a need exists for better methods of tracking access and detecting fraud.

DETAILED DESCRIPTION OF AN ILLUSTRATED EMBODIMENT

FIG. 1is a security system10that is used for the protection of a secured area12shown generally in accordance with an illustrated embodiment. Included within the secured area12may be one or more inner secured areas14,16. In general, the secured area12may include a first area16of a highest security rating, a second security14of a second highest security rating and a third outer security area12.

Each of the security areas12,14,16may be accessed through one or more access points18,20,22,24,26. Each of the access points18,20,22,24,26includes at least an identification reader device28for requesting entry to a respective security area12,14,16. The access points18,20,22,24,26may also each include a second identification reader device30for exiting the respective security areas12,14,16.

The security system10also includes a security panel32.FIG. 2shows details of the security panel32. The security panel32is connected to each of the reader devices28,30via a communication link34. The communication link34may be either wired or wireless.

In general, a person may request entry into each of the secured area12,14,16by presenting indicia of identification to one of the readers28. Similarly, once inside, a person may exit by presenting the indicia of identification to an exit reader30.

In each case, the indicia of identification is detected by the reader28,30and transferred to the security panel32. Within the security panel32, the transferred indicia of identification is compared with the contents of one or more reference identification files36,38to determine if the person is authorized to pass through the access point18,20,22,24,26.

The indicia of identification may be provided in the form of an access card carried by the person and presented at an access point18,20,22,24,26for purposes of requesting entry to or egress from the respective security areas12,14,16. The card may be provided with a magnetic strip that is read by the readers28,30or the card may be provided with a radio frequency identification (RFID) chip that simply requires proximity to the reader28,30in order for the reader28,30to read the indicia of identification of the person. Alternatively, the indicia of identification could the person's fingerprint or iris and the readers28,30could be fingerprint or iris scanners.

In general, the system10operates to detect and reduce insider threats to organizations that rely upon security systems. This is achieved by modeling the access pattern of a card holding person and comparing the modeled behavior against the current behavior to detect or otherwise determine a deviation.

The system10collects information about each person from use of the system10and saves the information into an event log40,42for each person. Use information about each user is used to create a behavior profile for the person. Statistical deviations from that profile can be used to detect the possibility of a lost access card being used by an unauthorized party, to the possibility of theft by a cardholder or to the possibility of some other unauthorized act such as vandalism. Once the statistical deviation has been detected, possible responses by the security panel32may include video recording the person via a video recorder35or blocking access to the secured areas12,14,16.

The event log may have information as shown in Table I in the case where the sample period (quantization level) is one hour.

TABLE ITIME8:009:0010:0011:0012:00Access Area12221
This access information for the succession of access events in Table I may be represented by the number string 12221. The string could be expanded to include prior and subsequent events. For example, if an access event in access area 1 were to be detected at 7:00, an event in area 3 were detected at 1:00, an event in area 2 at 2:00 and an event in area 1 at 3:00, then the number string could be extended to be included (e.g., 112223321). This number string (112223321) could be considered as point of a reference point in n-dimensional space (1,1,2,2,2,3,3,2,1). The n-dimension point represents a mathematical or probability model44of the access pattern behavior of the card holder over the time period. The normal behavior of the person may be established by averaging the behavior of the person for several days.

Deviations and the differences in deviations from normal behavior can then be determined by comparing a current behavior with the modeled behavior. The current behavior can be represented as another point in n-dimensional space. For example, if the user were to be present in security areas 1, 1, 2, 3, 2, 3, 3, 3, 1 during the corresponding time periods, then the user would have a current point of 1, 1, 2, 3, 2, 3, 3, 3, 1 in n-dimensional space.

The length of the string obtained after sampling can be referred to as m, such that m≦n because during analysis the whole day's data may not be available. If analysis is performed at the end of the day then m and n will be the same (m=n), if not, then the reference behavior string is cropped to its first m values. The result is two strings of length m (i.e., two points in m-dimensional space).

The two m-dimensional points are in the form of base components. The m-dimensional base components may be converted into their corresponding principle components (a principal component is a component in which the data has maximum deviation). The technique for conversion from a base component to a principal component is widely used in data mining and is call a Principle Component Analysis (PCA).

The deviation between the reference m-dimensional principle component and the current m-dimensional principle component may be determined within a probability processor46by calculating an appropriate distance (e.g., an Euclidean distance, Manhattan distance, etc.). Where Euclidean distances are used, the Euclidean distance between the two points may be determined using the equation as follows.
D(x,y)=√{square root over ({Σ([x(i)−y(i)]2)})}{square root over ({Σ([x(i)−y(i)]2)})} (i=1 tom)X-normal behaviorY-current behavior.

In this case D(x,y) defines the amount of deviation between the normal behavior and current behavior.

FIG. 3is a flow chart that depicts a set of steps100used by the system10during behavior analysis. As a first step102, the system collects use information to form a reference n-dimensional principle component.

The system10detects a current request for access104from a reader28,30. The indicia of identification is sent to the panel32where the indicia of identification of the card holder is compared106with the reference identification of the card holder. If the indicia of identification of the card holder from the reader28,30does not match the reference identification, then the request is denied108.

If the indicia of identification from the reader28,30matches the reference identification, then the behavior of the card holder is determined110. As a first step, the Euclidean distance, D(x,y) is computed112. The Euclidean distance, D(x,y) is then compared with a set of deviation threshold values a, b, c. The first threshold, a, represents very little or no deviation from the reference profile. The second threshold, b, represents sufficient deviation to merit a security alert and a third threshold value, c, represents a deviation sufficient to lockout or otherwise deny access120.

With regard to threshold values a and b, it should be noted that the system10requests a personal identification number (PIN) if the Euclidean distance, D(x,y) is greater than a and also if the Euclidean distance, D(x,y) is greater than b. In the first case, if the Euclidean distance, D(x,y) is greater than a, but less than b, then the panel32simply grants access to the card holder. On the other hand is the Euclidean distance, D(x,y) is greater than a and b, then the control panel32requests116the PIN for access and also begins recording118an image of the card holder via one or more video cameras35. On the other hand, if the Euclidean distance, D(x,y) is greater than c, then the control panel32denies access120to the card holder.

In another embodiment, the frequency of deviation may be determined over a long period of time. In this case, the operator of the system10has an established behavior of a card holder defined by a reference n-dimensional point (M) and a series of daily or hourly behaviors of a person defined by many n-dimensional points (together forming a test set). Here there is no case of m≦n as this analysis is performed with an entire day's data.

In this case, the system10finds the Euclidean distance between all of the n-dimensional points of the test set and M. First, the system10finds two points (A and B) from the test set such that D(A,M) is the maximum and D(B,M) is the minimum (i.e., B is closest to normal behavior and A is furthest from normal behavior).

A and B can be called mean points. Now, the system10finds the Euclidean distance between all of the remaining points and A and B.

Next, the system10chooses a value, k. The system10then finds the first k points closest to A and the first k points closest to B. In this case, a point X is considered close to A if d(X,A)>d(X,B).

Those k points closest to A are abnormal behaviors, the k points closest to B are normal behaviors and the rest are anomalies. The k points closest to B define the reference probability model.

This analysis is performed over a large amount of data. Only then is the data mining effective. Threshold values, a, b, c, are performed as discussed above.

In still another illustrated embodiment, the thresholds, a, b, c, are determined based upon a probability distribution function (PDF) model44of normal activity. In this case, the security alert is raised and associated security function implemented (e.g., record card holder activity or deny access to card holder) based upon the correlation of a current activity to the PDF.

In this case, {circumflex over (T)} represents the access requests or timestamps (i.e., time and ID of reader28,30) of the collected access events, density is the density function calculated for {circumflex over (T)} and μ is the average of all the density values and the actual collected access events (note that the density value is calculated even if no access event is generated at that time). The value of μ is defined by the equation as follows.

μ={∑11440⁢⁢density⁡(t)+∑t^∈T^⁢⁢density⁡(t)}.
In addition, σ is the variance for μ and μsampleis the average of all the sampled values (i.e., only the times corresponding to actual collected access event data). The value μsampleis defined by the equation as follows.

μsample={∑t^∈T^⁢⁢density⁡(t)}.
In addition, σsampleis the variance for μsample, {circumflex over (d)} is the density value at {circumflex over (t)} where {circumflex over (d)}=density({circumflex over (t)}) and

In this case, the panel32determines values for {circumflex over (d)} and for {circumflex over (d)}avg. If {circumflex over (d)}<μ−σ, then the alarm panel32may generate an alert and begin collecting video images of the card holder. Similarly, if {circumflex over (d)}<μ−2σ, then the alarm panel32may generate an alert and begin collecting video images of the card holder or may deny access to the card holder. Moreover if {circumflex over (d)}avg<μ−σ (or if {circumflex over (d)}avg<μ−2σ depending upon the preference of the operator of the system10), then the panel32may deny access to the card holder).

In general, the majority of events recorded in access logs by the panel32in memory are routine grants of access. Where a person present identifying credentials (usually a badge), the credentials are evaluated by the panel32as authorized for the protected spaces12,14,16and the access point18,20,22,24,26is unlocked. Although individually unremarkable, these events can be analyzed, as discussed above, to detect patterns of daily use and to build models to discriminate between “normal” and unusual activities or behavior. In many cases, it is possible to use routine data to provide evidence for compliance audits, determine occupancy patterns of sensitive areas and to verify presence of multiple persons for two-person security rules. Routine data can be analyzed to determine the effectiveness of the access control system10, including identifying readers that are ineffective or inoperative.

Other events may pertain either to administration and maintenance of the access system10or to exceptional events that should not occur under normal circumstances. These include: use of an invalid badge (expired, revoked or reported as lost) use of a valid badge at an unauthorized time or place, use of a badge in conjunction with a forced door, door left open, etc. Each of these events is worthy of concern by itself, but an analysis of sets of these events collected over time can indicate where security policies are not working as intended.