Transforming Surveillance Sensor Data into Event Metadata, Bounding Boxes, Recognized Object Classes, Learning Density Patterns, Variation Trends, Normality, Projections, Topology; Determining Variances Out of Normal Range and Security Events; and Initiating Remediation and Actuating Physical Access Control Facilitation

A system transforms video frames into event metadata reports on object recognition and occupancy patterns and trends. Each camera distinguishes foreground content and uploads meta data and changes. Occupancy within bounding boxes, and object pre-cognition are transformed to non-image event data sets. Objects and persons of interest are tagged for optical tracking and correlation. Cloud analytics estimate probabilities of occupancy and change. Periodic capture is augmented by expectation of peaks and valleys. Imagery and event meta data across multiple cameras are combined for object recognition. The cloud reports and predicts regions of interest due metrics of occupancy. Each edge device is trained on the local topology of other devices and actuators through which objects may pass before and after entering its region of interest. Edge devices collectively initiate physical access actuator controls, predict events for other edge devices, and transmit alerts when low probability events occur.

BACKGROUND

The field of the invention is security surveillance systems using video capture devices. What is needed is a way to digest vast volumes of video streams into information that concerns security and drive video display and analysis based on content and significance.

SUMMARY

A system transforms a sequence of video frames captured by a security surveillance edge device into event metadata reports on object recognition and occupancy patterns and trends. Each camera is trained to distinguish background from foreground content and to upload meta data and imagery which denotes changes in its viewport. Further training enables sensitivity to regions of high and low probability of occupancy, determination of bounding boxes, and classes of object pre-cognition which are transformed to non-image event data sets.

Specific objects and persons of interest are tagged for optical tracking and correlation within and across viewports and surveillance devices. Based on training from the cloud, edge devices may collectively initiate physical access actuator controls, predict events for other edge devices, and transmit alerts when low probability events are recognized.

A surveillance sensor network trains a variance determination artificial intelligence machine to determine a security event and to actuate physical access denial/optimization facilitators including, display, impedimenta, audio, and illumination controls.

An untrained edge device initially captures video frames on motion and periodic timers. Local analysis uploads low or higher quality images to cloud based on heuristics.

A cloud processor analyzes content and provide regions of interest to train each edge device. Cloud processor analyzes history of images and provide reports on times and locations of high probability of interest. Object recognition of vehicles and persons define boundary boxes.

Aggregation of reports provide peaks and valleys of object occupation independent of motion. Henceforth, the trained edge device is optimized to avoid transmitting low content images and data.

Having a continuously updated range of “normal” object characteristics, when the invention detects People or vehicles traversing a Region of Interest in a non-normal direction or non-normal speed it triggers a display to present an alert, a label, trigger an actuator, or a tracking/tracing search of past and immediate next predicted camera scheduling. A security event is determined when a person abandons a vehicle or package and causes tracking of the person in adjacent camera views. A security event is determined when multiple people exit a vehicle in non-normal stopping location triggers illumination, and near by door actuators. A security event is determined when a vehicle reverses toward a door which triggers actuation of impedimenta and strobes.

DETAILED DESCRIPTION

Embodiments of the Invention

Acquisition and Transformation

A system transforms a sequence of video frames captured by a security surveillance edge device into event metadata reports on object recognition and occupancy patterns and trends.

Each camera is trained to distinguish background from foreground content and to upload meta data and imagery which denotes changes in its viewport.

Further training enables sensitivity to regions of high and low probability of occupancy, determination of bounding boxes, and classes of object pre-cognition which are transformed to non-image event data sets.

Specific objects and persons of interest are tagged for optical tracking and correlation within and across viewports and surveillance devices. E.g. public safety officers and their weapons should not be separated by some quantity of pixel blocks.

Integration and Recognition

A cloud integrator of video frame analytics trains edge devices on high and low probability of occupancy and expected rates of change.

Periodic capture and upload of imagery is augmented by expectation of peaks and valleys derived from recent trends and patterns.

Imagery and event meta data from a plurality of edge devices is combined for object recognition or classification which correlate across frames from multiple cameras.

Based on object classification and recognition, the cloud reports historical and predicts likely regions of interest due to density or scarcity of occupancy within timeframes.

Education and Actuation

Each edge device is trained on the local topology with respect to other security surveillance edge devices and actuators through which objects may pass before and after entering its region of interest.

Each may trigger or be triggered to live stream video images by or from another near its scope.

Evacuate, lockdown, or trace action requests are peer to peer messages an edge may issue or implement based on training on objects in and transit through regions of high and low probability. Based on training from the cloud, edge devices may collectively initiate physical access actuator controls, predict events for other edge devices, and transmit alerts when low probability events are recognized.

Referring now toFIG.5, a scene summary system500includes:

a plurality of Smartened Security Surveillance Edge devices511515; configured to determine and transmit Video Frame Foreground Content Event Metadata520; to

a Cloud Analytics Processing Unit530; whereby, prerecognition of events is captured by distinguishing a foreground content change from background content in each video frame and whereby communication performance is improved by only transmitting meta data on foreground content.

An Object Signature Vectors store550; and

A Regional Probability of Interest store560, are both communicatively coupled to the Cloud Analytics Processing Unit530, whereby object recognition indicia are stored and the most and least likely positions of objects in the video frames are stored when determined by the Cloud Analytics Processing Unit based on bounding box coordinates540and foreground content event meta data.

An Edge Device Directed Topology store570; and

An Abnormal Events Rules store580, are both communicatively coupled to the Cloud Analytics Processing Unit530, whereby each edge device is connected to its adjacent edge devices by directional indicia for an object normally arriving and by directional indicia for an object normally departing; and whereby said Abnormal Events Rules include trigger conditions which when true, cause action requests to be recorded and transmitted through the communication channels.

A plurality of self-actualized security surveillance edge devices (S-AED)592,594are communicatively coupled to the Abnormal Events Rules store580and to each other S-AED; and further coupled to at least one Physical Access Actuator596and at least one Physical Access Alarm598; where by upon determining a trigger condition as an Abnormal Event is TRUE, a first S-AED592transmits an action request to at least one of a second S-AED594, a physical access actuator596, and a physical access alarm598.

Referring to the Figures,FIG.6is a flowchart of methods comprising:

Transforming a sequence of video frames into event metadata610;

Distinguishing background content from foreground content612;

Uploading changes in foreground imagery614;

Training machine learning on regions of interest (high or low probability of occupancy)616;

Determining bounding boxes and classes of object pre-cognition622;

Tagging objects and persons for optical tracking624;

Training edge devices on expected occupancy and rates of change in regions of interest632;

Machine learning ranges and correlation of peaks and valleys in movement and occupancy with clock and calendar644;

Machine learning baseline activity and occupancy of statistically normal ranges656;

Training topologically adjacent edge devices on peers through which objects of interest would enter or leave their view662;

Triggering live streaming from edge devices according to movement in topologically predecessor or successor edge devices672;

Tracing and predicting a path of an object through a cone of predecessor and successor edge device views682;

Actuating physical access facilitation upon determination of a security event or determination of a low probability event692.

Referring now to another embodiment of the invention,FIG.7illustrates a security surveillance system700which includes a plurality of content triggered mesh network of surveillance sensors721-729, said sensors comprising video cameras which transmit metadata concerning foreground objects within a region of interest; coupled to a machine learning variance analysis server740, said server comprising means for determination of a normal range of content from historical aggregation of meta data and means for training said sensor on a region of interest; coupled to

a security event determination rule filter device760, said filter triggering on intrusion of an object type into an incompatible region of interest; coupled to

a physical access control facilitation actuator781-789, said actuator enabling portal operation between a first responder and location of incident or object interception.

In an embodiment, a content-triggered mesh network of surveillance sensor further includes at least one of:

an optical sensor; a chemical sensor; a vibration sensor; a combustion sensor; an audio sensor; an acceleration sensor; an infrared sensor; a temperature sensor; a three dimensional image sensor; an electro-magnetic sensor; a microphone and speaker; a pressure sensor; and a radar transceiver.

In an embodiment, a machine learning variance analysis server further includes at least one of:means for training a sensor on regions of interest;means for training a sensor to distinguish between objects in foreground and objects in background;means for aggregating metadata by location, by hour of day, by day of week, by calendar;means for learning a normal range of metadata by location, by hour of day, by day of week, by calendar;means for determining adjacency of cameras capturing the same objects within a period of time;means for determining a range of metadata for rate of change and direction of travel across a plurality of physically adjacent cameras;means for determining linger times, waiting time, length of queues; andmeans for training sensors on upload criteria based on content and change of content.

In an embodiment, a security event determination rule filter further comprises:a circuit which triggers on a current metadata which is outside a machine learned range of normal historical value by a standard deviation;a circuit which triggers when an object exiting a region of interest is unequal to the object entering said region of interest;a circuit which triggers when occupants exit a vehicle stopped in a region of interest;a circuit which triggers when a package is discarded in a region of interest;a circuit which triggers when a type of object intrudes on a region of interest which is inappropriate for the type of object; anda circuit which triggers on an amplitude of metadata which exceeds a threshold.

In an embodiment, a physical access control facilitation actuator further includes at least one of:a mobile security sensor elevator;an airborne security sensor launcher;a portal actuator;a barrier actuator;a display of a map guiding a first responder to most direct and quickest arrival to an incident or intercept location;a display of a map and location of a security event;a display of a map and video stream of most likely paths available to an object subsequent to a security event;a display of a map and video streams of path taken by an object preceding a security event; and,alarm, announcements, illumination, or environmental adjustments.

Applicant discloses that means include electronic circuits, programmable logic devices, and processors configured by instructions encoded in non-transitory media. Manual coding and machine learning to determine averages, medians, means, and normal statistics of aggregated metadata are well known to those skilled in the art without limit to current implementations.

An untrained edge device initially captures video frames on motion and periodic timers. Local analysis uploads low or higher quality images to cloud based on heuristics.

A cloud processor analyzes content and provide regions of interest to train each edge device. Cloud processor analyzes history of images and provide reports on times and locations of high probability of interest. Object recognition of vehicles and persons define boundary boxes. Aggregation of reports provide peaks and valleys of object occupation independent of motion. Henceforth, the trained edge device is optimized to avoid transmitting low content images and data.

In an embodiment, the cloud processor trains edge device with calendar and schedules of times to increase samples of capture and upload of static images of interest. In an embodiment, the cloud processor downloads boundary boxes to Edge to trigger sampling and meta data collection. Cloud processor can trace likely contiguous/overlapping views among edge device to discover a topography of the camera system as objects move through the aggregate viewspace. Additionally, cloud analysis adds labelling for contents of bounding boxes, numbers, and qualities/quantities.

Cloud analysis dynamically sets standard deviation thresholds on highly likely and highly unlikely occupancy of regions. E.g. queues, parking, roadways, hangouts, predicts trending.

In an embodiment, edge devices exchange and relay alerts to “nearby” peers to live stream or to nearby actuators to control portals, alarms, and illumination when activity or occupancy within their bounding boxes is statistically deviant. E.g. rate of travel in vehicles, stopping in travel paths, rapid disgorgement of occupants, mobbing entrances or exits in narrow timespans. Cloud processor sets triggers for volume, density, traffic flow, occupancy of bounding boxes. In an embodiment, edge devices anticipate which other device should anticipate an object moving between views.

A cloud processor receives an alert when traffic across viewports occurs in the wrong direction or above or below a normal range of velocity. (frog's eye only alerts the frog's brain for incoming or stationary targets). Cloud processor trains edge devices to work together on tracing objects when volume or velocity exceeds a standard deviation.

Another aspect of the invention is a surveillance sensor network which trains a variance determination artificial intelligence machine to determine a security event and to actuate physical access denial/optimization facilitators.

In an embodiment, a surveillance sensor network trains a variance determination artificial intelligence machine to determine a security event and to actuate physical access denial/optimization facilitators including, display, impedimenta, audio, and illumination controls.

A plurality of Surveillance Sensor Devices in a Mesh Network includes:sensors for heat/vibration/chemicals/pressure;Video capture devices configured for:Content driven triggered transmission;Object indicia capture;Object recognition;Movement, direction, density, scarcity sensors;Deblurring image transformation;Regions of interest/disinterest in bitmaps;Topology/neighborhood awareness.

A Variance Determination Machine Learning Apparatus includesMachine learning of normal ranges of action/inaction, occupancy, speed, direction, density, scarcity, repetition,Adjustment of norms by clock, day of week, holidays,Sampling of history to establish divergence from normal range,Sensor is below threshold of expected transmission rate,Summarizing scenes by numbers, density, linger time, wait time, queue length, disorder, rates of change.

Event Determination includes suddenly departing a vehicle;discarding a package;people exiting not equal to entering;When vehicle intrudes on pedestrian space;Conflict, amplitude, optical, chemical impulse, sounds, posture.

Actuating access control facilitators includesguiding a first responder to the incident or intercept location;a map and location of a security event;with likely path of an intruder post event and pre-event;displays of a cone of potential paths of an intruder pre-event and post-event;Actuating a sensor launcher.

In an embodiment, the surveillance sensor network trains a variance determination artificial intelligence machine to determine a security event and to actuate physical access denial/optimization facilitators including, display, impedimenta, audio, and illumination controls.

A plurality of Surveillance Sensor Devices in a Mesh Network includes:Non-video sensors for heat/vibration/chemicals/pressure;Video capture devices;Content driven triggered transmission;Object indicia capture;Object recognition;Movement, direction, density, scarcity sensors;Deblurring image transformation;Regions of interest/disinterest in bitmaps;Topology/neighborhood awareness.

A Variance Determination Machine Learning Apparatus includesMachine learning of normal ranges of action/inaction, occupancy, speed, direction, density, scarcity, repetition,Adjustment of norms by clock, day of week, holidays,Sampling of history to establish divergence from normal range,Sensor is below threshold of expected transmission rate,Summarizing scenes by numbers, density, linger time, wait time, queue length, disorder, rates of change,

A Security Event Determination Apparatus includesWhen N-occupants suddenly depart a vehicle;When bearer discards a package;When objects exiting not equal to objects entering;When vehicle intrudes on pedestrian space and vice versa;Conflict, amplitude, optical, chemical impulse, sounds, posture

Actuating access control facilitators includesA display guiding a first responder to a most direct and quickest arrival to the incident or intercept location;A display illustrating a map and location of a security event;A display illustrating a map and likely path of an intruder post event;A display illustrating a map and likely path of an intruder pre-event;A plurality of video displays of a cone of potential paths of an intruder pre-event;A plurality of video displays of a cone of potential paths of an intruder post-event;Actuating a security sensor launcher.

Advantageously, the base system is expandable to provide distinguishing capabilities by applying machine learning to the metadata resulting from transforming the video streams in storage or dynamically at the edge.

A machine learning method dynamically determines Regions of Interest by accumulating over time where cars or people normally queue and where they are generally absent or unusual.

Having a continuously updated range of “normal” object characteristics, when the invention detects People or vehicles traversing a Region of Interest in a non-normal direction or non-normal speed it triggers a display to present an alert, a label, trigger an actuator, or a tracking/tracing search of past and immediate next predicted camera scheduling.A person abandoning a vehicle or package causes an alert and tracking of the person in adjacent camera views.Multiple people exiting a vehicle in non-normal stopping location triggers illumination, and near by door actuators.Vehicle reversing toward a door causes impedimenta and strobes.Aggregating meta data over time enables determination ofBy comparisons of snapshot N and N−1: rate of changeLocations where people and vehicles gather/linger common waiting areasQuantification of queue dynamics, average/long/short distributionsAlert when packages/luggage is unattendedAlert when cars abandoned/stopped inappropriatelyDetermine exact drop and pickup of packagesWhich snapshot did object first appear backward search in time.

By products of such an advanced surveillance system include reports of:Comparison of accumulated metadata SetsDetermination of “Normal scenes” mostly/largely invariant over multiple SetsFor each set, which things diverge from historically “Normal Scenes”Alert when density of people exceeds standard deviate %Alert when car is exceeding immobile in a position of sceneAuto generate regions of interest for scoping/alertingAuto generate labels and commentsAuto generate “normal” parking spots from higher occupancy over many Sets.

CONCLUSION

The claimed invention may be easily distinguished from conventional surveillance systems by being content driven rather than motion driven or periodically uploaded. The invention is distinguished not only by determining security events that are at variance from learned normal ranges but displaying why they are out of the normal range. The invention is distinguished by transformation of a sequence of video frames into event metadata about objects, occupancy, direction, speed, and trends.

With reference now to the figures, and in particular, with reference toFIGS.1-4, diagrams of data processing environments are provided in which illustrative embodiments may be implemented. It should be appreciated thatFIGS.1-4are only meant as examples and are not intended to assert or imply any limitation with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environments may be made.

FIG.1depicts a pictorial representation of a network of data processing systems in which illustrative embodiments may be implemented. Network data processing system100is a network of computers, data processing systems, and other devices in which the illustrative embodiments may be implemented. Network data processing system100contains network102, which is the medium used to provide communications links between the computers, data processing systems, and other devices connected together within network data processing system100. Network102may include connections, such as, for example, wire communication links, wireless communication links, and fiber optic cables. Also, network102may be, for example, a private network, a public network, a hybrid network, a corporate network, or the like.

In the depicted example, server104and server106connect to network102, along with storage108. Server104and server106may be, for example, server computers with high-speed connections to network102. Also, it should be noted that server104and server106may represent computing nodes in a cloud environment that manages analysis services for one or more networks and their respective resources. Alternatively, server104and server106may represent clusters of servers in a data center. Further, server104and server106may provide information, such as, for example, programs, application, updates, patches, and the like, to the registered client data processing systems.

Client110, client112, and client114also connect to network102. In this example, client110is shown as desktop or personal computer with wire communication links to network102. However, it should be noted that client110is an example only and may represent other types of data processing systems, such as, for example, a video stream capture, a hub, a credential scanner, an optical scanner, a radio transceiver, a bridge, a laptop computer, handheld computer, smart phone, smart watch, smart television, or the like, with wire or wireless communication links to network102. A user of client110may utilize client110to access and utilize the resources and/or services provided by client112and client114. Resources may include, for example, data, documents, software such applications and programs, hardware such as processors, memory, and storage, and the like. Services may include any type of online service, such as, for example, identity services, physical access control services, motor control, storage management, network optimization, version control, network latency reduction, banking services, financial services, governmental services, insurance services, entertainment services, search services, reservation services, and the like. In addition, it should be noted that client110may represent a plurality of different client devices corresponding to a plurality of different users.

Clients112and114are registered clients of server104and server106. In this example, client112and client114each represents a data processing system, such as a sever computer, that provides the resources and services of network102. Further, it should be noted that client112and client114may each represent a plurality of data processing systems corresponding to one or more organizations, enterprises, institutions, agencies, and the like.

Storage108is a network storage device capable of storing any type of data in a structured format or an unstructured format. In addition, storage108may represent a plurality of network storage devices. Further, storage108may store identifiers and network addresses for a plurality of different network security servers, identifiers and network addresses for a plurality of different registered client devices, identifiers for a plurality of different users, and the like. Furthermore, storage unit108may store identities, IP and URL addresses, policies, and the like. Moreover, storage unit108may store other types of data, such as authentication or credential data that may include user names, passwords, images, and biometric data associated with network users, system administrators, and security analysts, for example.

In addition, it should be noted that network data processing system100may include any number of additional servers, clients, storage devices, and other devices not shown. Program code located in network data processing system100may be stored on a computer readable storage medium and downloaded to a computer or other data processing device for use. For example, program code may be stored on a computer readable storage medium on network security server104and downloaded to client112over network102for use on client112.

In the depicted example, network data processing system100may be implemented as a number of different types of communication networks, such as, for example, the Internet, an intranet, a local area network, a wide area network, a telecommunications network, or any combination thereof.FIG.1is intended as an example only, and not as an architectural limitation for the different illustrative embodiments.

With reference now toFIG.2, a diagram of a data processing system is depicted in accordance with an illustrative embodiment. Data processing system200is an example of a computer, such as server104inFIG.1, in which computer readable program code or instructions implementing processes of illustrative embodiments may be located. In this illustrative example, data processing system200includes communications fabric202, which provides communications between processor unit204, volatile storage206, persistent storage208, communications unit210, input/output unit212, and display214.

Processor unit204serves to execute instructions for software applications and programs that may be loaded into volatile storage206. Processor unit204may be a set of one or more hardware processor devices or may be a multi-core processor, depending on the particular implementation.

Program code244is located in a functional form on computer readable media246that is selectively removable and may be loaded onto or transferred to data processing system200for running by processor unit204. Program code244and computer readable media246form computer program product248. In one example, computer readable media246may be computer readable storage media250or computer readable signal media252. Computer readable storage media250may include, for example, an optical or magnetic disc that is inserted or placed into a drive or other device that is part of persistent storage208for transfer onto a storage device, such as a hard drive, that is part of persistent storage208. Computer readable storage media250also may take the form of a persistent storage, such as a hard drive, a thumb drive, or a flash memory that is connected to data processing system200. In some instances, computer readable storage media250may not be removable from data processing system200.

Alternatively, program code244may be transferred to data processing system200using computer readable signal media252. Computer readable signal media252may be, for example, a propagated data signal containing program code244. For example, computer readable signal media252may be an electro-magnetic signal, an optical signal, and/or any other suitable type of signal. These signals may be transmitted over communication links, such as wireless communication links, an optical fiber cable, a coaxial cable, a wire, and/or any other suitable type of communications link. In other words, the communications link and/or the connection may be physical or wireless in the illustrative examples. The computer readable media also may take the form of non-tangible media, such as communication links or wireless transmissions containing the program code.

In some illustrative embodiments, program code244may be downloaded over a network to persistent storage208from another device or data processing system through computer readable signal media252for use within data processing system200. For instance, program code stored in a computer readable storage media in a data processing system may be downloaded over a network from the data processing system to data processing system200. The data processing system providing program code244may be a server computer, a client computer, or some other device capable of storing and transmitting program code244.

As another example, a computer readable storage device in data processing system200is any hardware apparatus that may store data. Volatile storage206, persistent storage208, and computer readable storage media250are examples of physical storage devices in a tangible form.

It is understood that although this disclosure includes a detailed description on cloud computing, implementation of the teachings recited herein are not limited to a cloud computing environment. Rather, illustrative embodiments are capable of being implemented in conjunction with any other type of computing environment now known or later developed. Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources, such as, for example, networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services, which can be rapidly provisioned and released with minimal management effort or interaction with a provider of the service. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

The characteristics may include, for example, on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. On-demand self-service allows a cloud consumer to unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with the service's provider. Broad network access provides for capabilities that are available over a network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms, such as, for example, mobile phones, laptops, and personal digital assistants. Resource pooling allows the provider's computing resources to be pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to demand. There is a sense of location independence in that the consumer generally has no control or knowledge over the exact location of the provided resources, but may be able to specify location at a higher level of abstraction, such as, for example, country, state, or data center. Rapid elasticity provides for capabilities that can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time. Measured service allows cloud systems to automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service, such as, for example, storage, processing, bandwidth, and active user accounts. Resource usage can be monitored, controlled, and reported providing transparency for both the provider and consumer of the utilized service.

Service models may include, for example, Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). Software as a Service is the capability provided to the consumer to use the provider's applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface, such as a web browser (e.g., web-based e-mail). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings. Platform as a Service is the capability provided to the consumer to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations. Infrastructure as a Service is the capability provided to the consumer to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components, such as, for example, host firewalls.

Deployment models may include, for example, a private cloud, community cloud, public cloud, and hybrid cloud. A private cloud is a cloud infrastructure operated solely for an organization. The private cloud may be managed by the organization or a third party and may exist on-premises or off-premises. A community cloud is a cloud infrastructure shared by several organizations and supports a specific community that has shared concerns, such as, for example, mission, security requirements, policy, and compliance considerations. The community cloud may be managed by the organizations or a third party and may exist on-premises or off-premises. A public cloud is a cloud infrastructure made available to the general public or a large industry group and is owned by an organization selling cloud services. A hybrid cloud is a cloud infrastructure composed of two or more clouds, such as, for example, private, community, and public clouds, which remain as unique entities, but are bound together by standardized or proprietary technology that enables data and application portability, such as, for example, cloud bursting for load-balancing between clouds.

With reference now toFIG.3, a diagram illustrating a cloud computing environment is depicted in which illustrative embodiments may be implemented. In this illustrative example, cloud computing environment300includes a set of one or more cloud computing nodes310with which local computing devices used by cloud consumers, such as, for example, local computing device320A-N may communicate. Cloud computing nodes310may be, for example, server104, server106, client112, and client114inFIG.1. A local computing device of local computing devices320A-320N may be, for example, client110inFIG.1. Local computing devices may be stationary such as sensors and may be mobile such as vehicles, hand-carried, and body-worn/implanted.

Cloud computing nodes310may communicate with one another and may be grouped physically or virtually into one or more networks, such as private, community, public, or hybrid clouds as described hereinabove, or a combination thereof. This allows cloud computing environment300to offer infrastructure, platforms, and/or software as services for which a cloud consumer does not need to maintain resources on a local computing device, such as local computing devices320A-N. It is understood that the types of local computing devices320A-N are intended to be illustrative only and that cloud computing nodes310and cloud computing environment300can communicate with any type of computerized device over any type of network and/or network addressable connection using a web browser or Internet Protocol, for example.

With reference now toFIG.4, a diagram illustrating abstraction model layers is depicted in accordance with an illustrative embodiment. The set of functional abstraction layers shown in this illustrative example may be provided by a cloud computing environment, such as cloud computing environment300inFIG.3. It should be understood in advance that the components, layers, and functions shown inFIG.4are intended to be illustrative only and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided.

Abstraction layers of a cloud computing environment400include hardware and software layer402, virtualization layer404, management layer406, and workloads layer408. Hardware and software layer402includes the hardware and software components of the cloud computing environment. The hardware components may include, for example, mainframes410, RISC (Reduced Instruction Set Computer) architecture-based servers412, servers414, blade servers416, storage devices418, and networks and networking components420. In some illustrative embodiments, software components may include, for example, network application server software422and database software424.

Virtualization layer404provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers426; virtual storage428; virtual networks430, including virtual private networks; virtual applications and operating systems432; and virtual clients434.

Workloads layer408provides examples of functionality for which the cloud computing environment may be utilized. Example workloads and functions, which may be provided by workload layer408, may include mapping and navigation446, software development and lifecycle management448, virtual classroom education delivery450, data analytics processing452, transaction processing454, and security management456.

The systems and methods described herein may be embodied in other specific forms without departing from the characteristics thereof. Although the examples provided herein relate to providing interactive content for display, the systems and methods described herein can include applied to other environments in which data included in a log database used and compared to data corresponding to previous requests for content and responsive to determining a change in the data, identifying one or more content elements to which to attribute the credit for the change. The foregoing implementations are illustrative rather than limiting of the described systems and methods. Scope of the systems and methods described herein is thus indicated by the appended claims, rather than the foregoing description, and changes that come within the meaning and range of equivalency of the claims are embraced therein.