Methods and devices for automatic transaction machines for recognizing surroundings

A method for enhancing automated transaction machine (ATM) security surveillance. The method consists of receiving a set of data from a financial device and generating a template for the financial device. The method generates an analysis by analyzing a portion of the received set of data. The method then determines a likelihood factor that the analyzed first portion is associated with a security threat, wherein if the likelihood factor is above a threshold then the method generates a second analysis by analyzing a second portion of the received first set of data and revises the likelihood factor based on the second analysis. The method generates a notice if the first likelihood factor exceeds a second threshold and then updates the template with the analysis and the likelihood factor and receives a second set of data from the monitoring device. The method updates the template with the second set of data.

TECHNICAL FIELD

The present disclosure generally relates to methods, systems, and devices for enhanced automated transaction machine (ATM) security surveillance.

BACKGROUND

ATM devices often attract danger due to the nature and access to fiat currencies. Thus, to deter this danger, ATMs generally include security and surveillance features and devices.

There is generally a need to further secure areas around ATMs. Thus ATMs are consistently upgraded with security features. It is possible to double purpose these features for further securing the surrounding environment around an ATM. While some solutions currently exist for securing the ATM itself, this is inefficient and only useful for a limited location range around the ATM.

Typically, security surveillance of unguarded sites for burglary, vandalism or other unlawful activity, or for augmenting protection of guarded sites, includes taking video camera images of site activity and transmitting the images to a remote central monitoring point. A human observer, who periodically inspects an array of video displays of multiple sites detects an actionable incident or event at the site. But, because of fatigue and other factors, the chances of the observer failing to notice an incident are substantial.

The present disclosure provides systems, methods, and devices to solve these and other security problems.

SUMMARY

In the following description, certain aspects and embodiments of the present disclosure will become evident. It should be understood that the disclosure, in its broadest sense, could be practiced without having one or more features of these aspects and embodiments. Specifically, it should also be understood that these aspects and embodiments are merely exemplary. Moreover, although disclosed embodiments are discussed in the context of a processor bracket and, it is to be understood that the disclosed embodiments are not limited to any particular industry.

Disclosed embodiments include a method for enhancing automated transaction machine (ATM) security surveillance. The method consists of receiving a first set of data from a financial device. The method further consists of generating a template for the financial device, where the template comprises the received first set of data. The method stores the template. The method further generates a first analysis by analyzing a first portion of the received first set of data. The method then determines a first likelihood factor that the analyzed first portion is associated with a security threat, wherein if the first likelihood factor is above a first threshold then the method generates a second analysis by analyzing a second portion of the received first set of data and revises the first likelihood factor based on the second analysis. The method further generates a first notice if the first likelihood factor exceeds a second threshold. The method then updates the template with the first analysis and the first likelihood factor. Then the method receives a second set of data from the monitoring device. And the method then updates the template with the second set of data.

DETAILED DESCRIPTION

An initial overview of machine learning is first provided immediately below and then specific exemplary embodiments of systems, methods, and devices for enhancing ATM security surveillance are described in further detail. The initial overview is intended to aid in understanding some of the technology relevant to the systems, methods, and devices disclosed herein, but it is not intended to limit the scope of the claimed subject matter.

In the world of machine prediction, there are two subfields—knowledge-based systems and machine-learning systems. Knowledge-based approaches rely on the creation of a heuristic or rule-base which is then systematically applied to a particular problem or dataset. Knowledge-based systems make inferences or decisions based on an explicit “if-then” rule system. Such systems rely on extracting a high degree of knowledge about a limited category to virtually render all possible solutions to a given problem. These solutions are then written as a series of instructions to be sequentially followed by a machine.

Machine learning, unlike the knowledge-based programming, provides machines with the ability to learn through data input without being explicitly programmed with rules. For example, as just discussed, conventional knowledge-based programming relies on manually writing algorithms (i.e. rules) and programming instructions to sequentially execute the algorithms. Machine learning systems, on the other hand, avoid following strict sequential programming instructions by making data-driven decisions to construct their own rules. The nature of machine learning is the iterative process of using rules, and creating new ones, to identify unknown relationships to better generalize and handle non-linear problems with incomplete input data sets. A detailed explanation of one such machine learning technique is disclosed in the article: Michalski, R. S., Stepp, R. E. “Learning from Observation: Conceptual Clustering,” Chapter 11 of Machine Learning: an Artificial Intelligence Approach, eds. R. S. Michalski, J. G. Carbonell and T. M. Mitchell, San Mateo: Morgan Kaufmann, 1983.

Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings and disclosed herein. Wherever convenient, the same reference numbers will be used throughout the drawings to refer to the same or like parts.

The disclosed embodiments relate to systems and methods for utilizing data to enhance an ATM security surveillance. While some solutions currently exist for securing the ATM itself, this is inefficient and only useful for a limited location range around the ATM. Furthermore, current solutions do not effectively utilize machine learning to properly analyze the abundance of surveillance data around ATMs to improve security and the safety of the community.

There exist substantial untapped security data sources that may be utilized to provide improved ATM and community security. Sentient, voice, and image recognition software has progressed such that simple audio/video data files can be streamed and analyzed by machine learning software to detect threats. And with the expansive range of modern sensors (such as cameras and audio recorders), and the dispersed nature of ATMs, ATMs can further provide security for the community at large. The disclosed embodiments below describe the formation and modification of financial device templates to further improve the accuracy and speed of machine-learning analysis, as well as, improve the response time of first responders in the case of determined danger. The embodiments disclosed below utilize machine learning to provide enhanced security of the ATM itself, but also the surrounding community as well.

The following description provides examples of systems, methods, and devices for enhancing ATM security surveillance. The arrangement of components shown in the figures is not intended to limit the disclosed embodiments, as the components used in the disclosed systems may vary.

FIG. 1illustrates an exemplary enhanced ATM security surveillance100system. In any given environment, input data110a-110eis ripe for monitoring by device120. Device120may exist in any type of environment, either having open doors or with closed doors, and it may generally provide a means for users to interact with their banks and bank accounts. And likewise, device120may receive input data110a-110efrom a single source or from multiple surrounding sources. Input data110a-110emay be video data, audio data, or biometric data. The enhanced ATM security surveillance100system may receive several types of inputs, for example, audio recordings110a, video recordings110b, biometric scans110c, mobile device communication110d, and even input through a user interface110e. Data110a-110ereceived by device120may be altered, using various combinations, and the system is not limited to the data illustrated inFIG. 1.

A user attempting to access their bank account may attempt to access the account through device120, for example, an ATM. In certain embodiments, device120may include a power supply, such as a battery, configured to provide electrical power to one or more components of device120, such as processor, a memory, and a communication device.

In addition to functioning as an ATM, i.e. providing user access to financial institutions and their banking accounts, device120may further communicate with processing center140. Communication between device120and processing center140may occur through various means through a network. Appropriate forms of communication include near-field communication (NFC), Wi-Fi, Bluetooth, cellular, and/or other such forms of wireless communication, as well as wired communication, discussed herein. Device120may communicate the received input data110a-110eto processing center140for further processing and analysis.

Once received, processing center140may further analyze input data110a-110ethrough the means described herein. Additionally, processing center140may further analyze data from a plurality of financial devices120. For example, processing center140may process input data110a-110ewith any of the above machine learning methods previously discussed. Alternatively, processing center140may create a template for the input data110a-110ereceived at an initial time. Processing center140may further store initial input data110a-110eand analyze it to determine whether there is a likelihood that input data110a-110eis associated with a security threat if input data110a-110eindicates, above a threshold, that there is a security threat. The security threat may be to a specific user interacting with device120, or processing center140may determine that there is a security threat to the general surroundings of device120. For example, the user may shout for help, or processing center140may determine that the user is under distress from an assailant. The security threat may be for device120itself, e.g. an individual is attempting to vandalize, break into, destroy, etc. device120; or alternatively, the security threat may be for the environment, e.g. a flash flood threatens the area, a fire is raging near by, an actual tornado sighting, etc. Processing center140may use sentiment analysis to determine if there is a security threat by analyzing particular sounds or key phrases, i.e. “help-help.” Alternatively, processing center140may analyze additional auditory triggers, such as gunshots or the volume and inflection of user's voices. This analysis may be conducted as an alternative to or in conjunction with the sentiment analysis. Processing center140may use video recognition to determine a security threat through facial recognition of a wanted criminal, an amber alert child, or even detecting significant heat (infrared) from a nearby fire.

After further analysis, processing center140may transmit instructions back to device120. In some embodiments, processing center140may instruct device120to sound an alarm and may signal that appropriate authority first responders are on their way. Additionally, processing center140may also transmit alerts to authority160. Authority160may include any security personnel or system designed to respond to threats such as the fire department, police, ambulance, security, any first responder, etc. Processing center140may transmit necessary input data110a-110erequired by authority160to respond appropriately. Processing center140may communicate with authority160via any appropriate forms of communication including near-field communication (NFC), Wi-Fi, Bluetooth, cellular, and/or other such forms of wireless communication, as well as wired communication, discussed herein. Additionally, processing center140may maintain an open communication connection with authority160and provide one or more live streams of input data110a-110e. Authority160may be associated with device120(i.e. security for a financial service provider) or it may be associated with a third party.

FIG. 2illustrates an exemplary configuration of device120, consistent with disclosed embodiments. Various types of financial devices120, such as an ATM, a bank drive-through window, a vending machine, etc. may be implemented in system100. As shown, device120may include a display122, an input/output (“I/O”) device124, one or more processors126, and a memory128having stored therein one or more program applications129, such as template130, and data131. Device120may also include a money dispenser132. Device120may also include antenna134and one or more sensors136. Display122, I/O devices124, processor(s)126, memory128, antenna134, or sensor(s)136may be connected to one or more of the other devices depicted inFIG. 1, such as to processing center140, or even to another device120. Such connections may be accomplished using a bus or other interconnecting device(s).

Processor126may be one or more known processing devices, such as a microprocessor from the Pentium™ or Atom™ families manufactured by Intel™, the Turion™ family manufactured by AMD™, the Exynos™ family manufactured by Samsung™, or the Snapdragon™ family manufactured by Qualcomm™. Processor126may constitute a single core or multiple core processors that executes parallel processes simultaneously. For example, processor126may be a single core processor configured with virtual processing technologies. In certain embodiments, processor126may use logical processors to simultaneously execute and control multiple processes. Processor126may implement virtual machine technologies, or other known technologies to provide the ability to execute, control, run, manipulate, store, etc., multiple software processes, applications, programs, etc. In another embodiment, processor126may include a multiple-core processor arrangement (e.g., dual, quad core, etc.) configured to provide parallel processing functionalities to allow device120to execute multiple processes simultaneously. One of ordinary skill in the art would understand that other types of processor arrangements could be implemented that provide for the capabilities disclosed herein.

I/O devices124may include one or more devices that allow financial device120to receive input from a user and provide feedback to the user. I/O devices124may also include one or more devices that allow device120to monitor input from the surrounding environment. I/O devices124may include, for example, one or more buttons, switches, speakers, microphones, video cameras, infrared scanners, biometric scanners, styluses, or touchscreen panels. In some embodiments, I/O devices124may be manipulated by the user to input information into device120.

Memory128may be a volatile or non-volatile, magnetic, semiconductor, tape, optical, removable, non-removable, or other type of storage device or tangible (i.e., non-transitory) computer-readable medium that stores one or more program applications129such as template130, and data131. Data131may include, for example, user personal information, account information, display settings and preferences, financial device information, or recorded data from I/O devices124. In some embodiments, account information may include items such as, for example, an alphanumeric account number, account label, account balance, account issuance date, account expiration date, account issuer identification, a government ID number, and any other necessary information associated with a user and/or an account associated with a user, depending on the needs of the user, and/or entities associated with system100.

Program application129may include operating systems (not shown) that perform known operating system functions when executed by one or more processors. By way of example, the operating systems may include any of Microsoft Windows™, Unix™, Linux™ Apple™, or Android™ operating systems, Personal Digital Assistant (PDA) type operating systems, such as Microsoft CE™, or other types of operating systems. Accordingly, disclosed embodiments may operate and function with computer systems running any type of operating system. Device120may also include communication software that, when executed by processor126, may provide communications with a network. Device120may be a device that executes applications for performing operations consistent with disclosed embodiments. For example, device120may be an ATM, a vending machine, a kiosk, or may be a device such as a PDA, a cell phone, a tablet, a computer, etc.

Program applications129may include template130, which may be a template for monitoring security threats consistent with the machine learning processes described herein. In some embodiments, application129may include instructions that cause processor126to connect with a network and processing center140.

Device120may also store, in memory128, data131relevant to the examples described herein for system100. One such example is the storage of user identifying information like a username/pas sword, user biometric data, etc. or user account information. Data131may contain any data discussed above relating to the historical data processed for security threats. Data131may be further associated with information for a particular user.

Sensors136may include one or more devices capable of sensing the environment around device120, and/or sensing data gathered by input/output124devices. In some embodiments, sensors136may include, for example, a position sensor, a physical pressure sensor, a microphone, a camera, an ambient light sensor, an infrared sensor, a temperature sensor, a gas sensor (to detect combustible or toxic gases), and/or a conductivity sensor. In addition, sensors136may include devices for detecting location via systems such as a Global Positioning System (GPS), a radio frequency triangulation system based on cellular or other such wireless communication, and/or other systems for determining the location of device120.

Antenna134may include one or more devices capable of communicating with a network. One such example includes an antenna wirelessly communicating with a network via cellular data or Wi-Fi. Although communication between device120and a network and/or processing center140, may be shown as wireless communication, such communication could also occur using wired communication via, for example, an Ethernet terminal (not shown).

The network may comprise any type of computer networking arrangement used to exchange data. For example, the network may be the Internet, a private data network, local area network (LAN), wide area network (WAN), virtual private network (VPN) using a public network, and/or other suitable connection(s) that enables system100to send and receive information between the components of system100. In some embodiments, the network may include a public switched telephone network (“PSTN”) and/or a wireless network such as a cellular network, WiFi network, or other known wireless network capable of bidirectional data transmission. In other embodiments, the network may include any local computer networking used to exchange data in a localized area, such as WiFi, Bluetooth™, Ethernet, Radio Frequency, and other suitable network connections that enable components of system100to interact with one another.

Money dispenser132may be a mechanical means for providing currency to a user as provided in a typical ATM. Further, device120may have access to a limited amount of fiat currency in order to dispense to users based on their interactions with the device120.

In certain embodiments, device120may include a power supply, such as a battery (not shown), configured to provide electrical power to device120. It is contemplated that power supply may include any power supplied from an external power grid, an electrical generator set, or any other power supply known in the art.

FIG. 3shows an exemplary configuration of processing center140consistent with disclosed embodiments. Processing center140may be associated with a financial service provider, a merchant, a vendor, a bank, or any other entity that maintains a user account. In one embodiment, processing center140may optionally include one or more processors142, one or more input/output (I/O) devices144, and one or more memories146. In some embodiments, processing center140may take the form of a server, general purpose computer, mainframe computer, or the like. In other embodiments, processing center140may take the form of a mobile computing device such as a smartphone, tablet, laptop computer, or the like. Alternatively, processing center140may be configured as a particular apparatus, device, dedicated circuit, or the like, based on the storage, execution, and/or implementation of the software instructions that perform one or more operations consistent with the disclosed embodiments. Additionally, processing center140may be a physical facility associated with the financial service provider, merchant, vendor, or any other entity that maintains a user account.

Processor(s)142may include one or more known processing devices, such as mobile device microprocessors, desktop microprocessors, server microprocessors, or the like. For instance, processor142may be one or more known processing devices, such as a microprocessor from the Pentium™ or Atom™ families manufactured by Intel™, the Turion™ family manufactured by AMD™, the Exynos™ family manufactured by Samsung™, or the Snapdragon™ family manufactured by Qualcomm™. Processor142may constitute a single core or multiple core processors that executes parallel processes simultaneously. For example, processor142may be a single core processor configured with virtual processing technologies. In certain embodiments, processor142may use logical processors to simultaneously execute and control multiple processes. Processor142may implement virtual machine technologies, or other known technologies to provide the ability to execute, control, run, manipulate, store, etc., multiple software processes, applications, programs, etc. In another embodiment, processor142may include a multiple-core processor arrangement (e.g., dual, quad core, etc.) configured to provide parallel processing functionalities to allow processing center140to execute multiple processes simultaneously. One of ordinary skill in the art would understand that other types of processor arrangements could be implemented that provide for the capabilities disclosed herein. The disclosed embodiments are not limited to a particular type of processor.

I/O devices144may be one or more devices configured to allow data to be received and/or transmitted by processing center140. I/O devices144may include one or more digital and/or analog devices that allow processing center140to communicate with other machines, devices, and systems, such as other components and devices of system100. For example, I/O devices144may include a screen for displaying messages to a user (such as a customer, a retail venue manager, a bank manager, or a financial service provider employee). I/O devices144may also include one or more digital and/or analog devices that allow a user to interact with system100, such as a touch-sensitive area, keyboard, buttons, or microphones. I/O devices144may also include other components known in the art for interacting with a user. I/O devices144may also include one or more hardware/software components for communicating with other components of system100. For example, I/O devices144may include a wired network adapter, a wireless network adapter, a cellular network adapter, or the like. Such network components enable processing center140to communicate with other devices of system100to send and receive data.

Memory146may include one or more storage devices configured to store instructions usable by processor142to perform functions related to the disclosed embodiments. For example, memory146may be configured with one or more software instructions, such as one or more program applications147that perform one or more operations when executed by processor142. The disclosed embodiments are not limited to separate programs or computers configured to perform dedicated tasks. For example, memory146may include a single program or multiple programs that perform the functions of device120or processing center140. Memory146may also store data148that is used by the one or more applications147.

In certain embodiments, memory146may store software executable by processor142to perform methods, such as the methods represented by the flowcharts depicted inFIGS. 4-5and/or the methods associated with user interface (e.g., display122) discussed above with reference toFIG. 2. In one example, memory146may store program applications147. Applications147stored in memory146, and executed by processor142, may include a financial service app that causes processor142to execute processes related to financial services provided to users including, but not limited to, processing fiat currency transactions, credit and debit card transactions, checking transactions, processing payments, checking account balances, authorizing identity of user, verifying transactions, updating the user account, and/or analyzing received input from I/O devices144and124including input data110a-110e. Memory146may store template149. In some examples, program applications147may be stored in an external storage device, such as a cloud server located on a network, and processor142may retrieve and execute the externally stored programs147.

Processing center140may be used to store input data148relevant to examples described herein for system100. One such example is the storage of input data110a-110ereceived by device120from input/output devices122and sensors136(microphones, keyboards, touch screens, cameras, web cameras, mouse, biometric sensors, location based sensors, accelerometers, etc. discussed throughout here). Data148may contain any data discussed above relating to the communication of user-based inputs, as well as, surrounding device120environment detected inputs. In addition, data148may contain historical input data110a-110efrom previous encounters, such as audio recordings, video recordings, sentiment analysis, audio frequency analysis, audio patterns, audio triggers indicating distress, visual recognition analysis, infrared images, previous threat reports, biometric data, account data, typing pattern, finger pressure rates, reading rates, and/or typing error rates. The data148associated with particular user, device120, or surrounding areas of device120may also contain template149data that continuously is updated with new analysis. Data148may also include a modeled determination, threshold, and analysis.

Processing center140may include at least one database150. Database150may consist of a volatile or non-volatile, magnetic, semiconductor, tape, optical, removable, nonremovable, or other type of storage device or tangible (i.e., non-transitory) computer readable medium. For example, database150may include at least one of a hard drive, a flash drive, a memory, a Compact Disc (CD), a Digital Video Disc (DVD), or a Blu-Ray™ disc. Alternatively, Database150may be a Microsoft SQL databases, Share Point databases, Oracle™ databases, Sybase™ databases, or other relational databases

Database150may store data, such as data148that may be used by processor142for performing methods and processes associated with disclosed examples. Data stored in database150may include any suitable data, such as information relating to a user, a device120, information relating to surrounding detected actions, and information modeled threat assessment, and/or user account. Although shown as a separate unit inFIG. 3, it is understood that database150may be part of memory146, or an external storage device located outside of system100. At least one of memory146, and/or database150may store data and instructions used to perform one or more features of the disclosed examples. At least one of memory146, and/or database150may also include any combination of one or more databases controlled by memory controller devices (e.g., server(s), etc.) or software, such as document management systems, Microsoft SQL databases, Share Point databases, Oracle™ databases, Sybase™ databases, or other relational databases. Processing center140may also be communicatively connected to one or more remote memory devices (e.g., databases (not shown)) through a network. The remote memory devices may be configured to store information and may be accessed and/or managed by system100. Systems and methods consistent with disclosed examples, however, are not limited to separate databases or even to the use of a database.

The components of processing center140may be implemented as a device in hardware, software, or a combination of both hardware and software, as will be apparent to those skilled in the art. For example, although one or more components of processing center140may be implemented as computer processing instructions, all or a portion of the functionality of processing enter140may be implemented instead in dedicated electronics hardware.

Processing center140also stores template149. Template149may include characteristics associated with device120and/or an environment surrounding device120. For example, template149may include notes on potential dangers to device120, including prior analyses of received input data110a-110e. Additionally, for example, template149may include notes on potential non-dangers and false positives. For instance, if previous received input data110a-110econsistently indicates that device120is located in the vicinity of a fire hazard (e.g., the fire department is consistently called at a neighboring building), template149may include notes regarding, for example, a frequency with which the fire department arrives in the vicinity of device120. Alternatively, for example, if device120is located in the vicinity of a hospital then template149may include this information so that the danger analysis factors in the potential for frequent ambulances traveling in the vicinity of device120. Template149may be consistently updated with new received input data110a-110eto refine its notes with additional context. Template149may provide an initial set of data to compare received input data110a-110eagainst. Template149may improve system100by providing additional data to build a pattern of analysis and recognition (e.g., commonly determined sentient and facial recognition), thereby improving system100and associate memory speed.

Through processor(s)142, processing center140runs application147by performing methods and processes associated with disclosed examples described more fully below. Application147may analyze received input data110a-110efor device120including, but not limited to, username/password; audio recordings, video recordings, sentiment analysis, audio frequency analysis, audio patterns, audio triggers indicating distress, visual recognition analysis, infrared images, previous threat reports, biometric data, account data, typing pattern, finger pressure rates, reading rates, and/or typing error rates; the device120information like type of device, device operating system, device serial number, device location, type of connection; data obtained from sensors136or location based data; historical data stored in memory128(and/or memory146); as well as any analysis conducted or modeled by application147. In some examples, application147may be stored in an external storage device, such as a cloud server located on a network and, and processor142may execute the application147remotely.

FIG. 4is a flowchart of an exemplary process400performed by system100. For example, process400may be include a method for enhancing ATM security surveillance, and, utilizing, analyzing, and modeling information collected (i.e. input data110a-110e) from device120. The process may include a step410of receiving a first set of data from device120. In step410, device120may provide an initial first set of input data110a-110eto the processing center140. As previously discussed, device120may be associated with a financial service provider, a bank, or any entity that associates user accounts with their customers. As such, device120may initially acquire the first set of input data110a-110efrom any of the discussed I/O124devices or sensors136discussed herein. In step410, a user may provide the device120with the initial input data110a-110ewhile using device120. Alternatively, in step410, the device120may receive the initial input data110a-110ethrough other means, such as, from sensors136associated with device120.

At step420, processing center140may generate a template for the respective device120. This initial template may be based on the received initial input data110a-110e. During step420, processing center140may create a base line of received input data110a-110e, at a given initial time, for future comparison. Additionally, processing center140further may associate the received input data110a-110efrom device120with its GPS coordinates.

System100may store, at step430, the received input data110a-110eand the generated template at processing center140.

At step440, the received the initial input110a-110e, may be portioned into at least two parts, a first portion and a second portion, where the first portion is analyzed by application147and machine learning techniques discussed above. The second portion may be stored in processing center140. Additionally, at step440, application147may, through sentiment analysis, determine if the received input data110a-110econtains triggers that may constitute signs of danger. For example, application147may detect audio files of voice and recognize several factors indicating distress in a user's voice. Alternatively, application147may detect the audio frequency of a gunshot or first responder sirens. Application147, at step440, may also detect triggers in the audio files indicating car or building alarms. For instance, at step440, application147may further detect certain words from audio inputs that are triggered as signs of danger, such as “help!” “help!”; “someone call 911”; etc. Another trigger for application147may consist of the context and tone of words within an audio file to determine if a user is actually in danger or merely saying a potentially danger-triggering word. Alternatively, application147may detect triggers within video files that are determined to be associated with signs of danger, such as a bright flash spark, or a raging fire. Or application147may utilize facial recognition to identify a criminally wanted assailant. Alternatively, application147may detect infrared input that indicates excessive heat or freezing temperatures. Application147may detect potentially dangerous triggers for both the user and the device120surrounding area. For instance, the device120pressure sensors may activate indicating to application147that the device120is being broken into. A person having ordinary skill in this art would understand that the inputs discussed above are exemplary and that application147may utilize various factors in determining potentially-dangerous triggers based on the various inputs and sensor data.

At step450, the system100may compare the received first set of data from device120(step410) with a pre-defined base line of security and danger alerts. Further based on the comparison, system100may determine a likelihood factor that the analyzed (step440) received input data110a-110eis above a set threshold. For instance, by sorting previous input data110a-110ethrough weighted variables (e.g., frequency of sirens, size of flame, noted sentiment distress, etc.), the danger analysis may determine that the likelihood of danger is significant and associate a high factor. The likelihood factor determination may weight different input data110a-100edifferently to prioritize likely dangerous events (e.g., audio clips of shouts for help). Based on the determined likelihood factor, the monitoring center140may determine that there is a security threat at the device120. In one embodiment, system100, at step450, may further determine that the user at device120is in danger, or alternatively, system100may further determine that the device120itself is in danger, or alternatively, system100may determine that the surrounding area by device120is dangerous. Further, at step450, the system100may determine the likelihood that there is danger near the device120within a confidence interval. For instance, after analyzing input data110a-100e, system100may determine that certain audio files express distress (e.g., a user's voice is frightful), yet the sentiment analysis may not be entirely certain that the detected fear suggests a danger event. Thus, system100may further determine, a confidence interval reflecting a certainty or probability that the analyzed input data110a-110eindicates danger to device120. System100may determine the likelihood that device120may be subject to danger based on the determined confidence interval.

At step460, system100may compare the likelihood factor determined in step450against a pre-determined threshold. If it is determined that the analyzed data (step440) and determined likelihood factor (step450) are not above the pre-determined threshold, then, at step460, processing center140may proceed to step460, modifying the template149by updating template149with the new analysis and likelihood factor determination, and then repeating step410with analyzing new received input data110a-110e. Alternatively, if it is determined that the analyzed data (step440) and determined factor (step450) are above the pre-determined threshold, then, at step460, processing center140may analyze, at step462, the second portion (step440) of received first set of input data110a-110e(step410).

Much like step440, at step462, the system100may analyze the second portion of the received first set of input data110a-110e. Step462may undergo the same analysis as step440, via application147, and search for additional danger triggers in the second portion of the received first set of input data. Then at step464system100may modify the step450determined likelihood factor with the combination of analysis from steps440and462.

At step466, like step460, system100may compare the revised likelihood factor determined in step464against a second pre-determined threshold which is higher than the first threshold. If it is determined that the revised determined likelihood factor (step464) is not above the second pre-determined threshold, then, at step466, the system100may proceed to step468and determine if there is a third portion of the received first set of input data110a-110e. Alternatively, if it is determined that the revised determined likelihood factor (step464) is above the pre-determined second threshold, then at step470, the processing center140may provide prompt notice. At step470a prompt notice includes either notifying the user and/or users surrounding device120that a danger exists or that authorities have been notified, or the prompt notice by transmitted from processing center140directly to authority160. For instance, notice to the user may include a phone call, email, text, warning sign, flashing lights, sirens, or an audio clip. Similarly, notice to authority160may include a phone call, email, text, warning sign, flashing lights, sirens, or an audio clip. Additionally, in step470, system100may be configured to transmit a signal to wake up an otherwise dormant or inactive user device or device associated with authority160. Further, system100may be configured to provide the prompt notice to the user or authority160after waking up the device associated with the user or with authority160. System100may be configured to further improve the accuracy and speed of machine-learning analysis, as well as, improve the response time of first responders in the case of determined danger by referencing template130.

First, at step468, if system100determines there is a third portion of the received first set of input data110a-110ethen system100may repeat step460and may incorporate the third set portion of data into steps460,462, and464. Otherwise, system100may proceed to step460by modifying the template.

Second, at step466, if it is determined that the revised likelihood factor is above the second pre-determined threshold, then system100may provide a prompt notice at step470. device120.

At step480, system100may modify template149generated at step420. System100may store in template149all the received data portions from step410,440,462, and468; as well as, all the analysis and threshold determinations from steps440-468. Modified template from step480may replace stored template for device120at step430. System100may then begin the process again of receiving new input data110a-110efor threat analysis.

FIG. 5is a flowchart of an exemplary process for providing notice to device120user upon determination that a threat is detected at device120. For instance, at step500, system100already determined a threat is present (see steps410-450ofFIG. 4). At step510, processing center140may instruct device120to request a user response. The response request is designed to prompt a confirmation whether the user is safe or unsafe. Additionally, device120may receive the response in any input format discussed herein (i.e. audio, visual, etc.).

At step520, application147further analyzes the response received at step510from device120. Much likeFIG. 4, at step520, application147may utilize machine learning techniques and sentiment analysis to determine whether the user verified they were safe or still in distress.

At step530, processing center140may alert the authorities160if it is unable to verify the safety of the user.

While illustrative embodiments have been described herein, the scope thereof includes any and all embodiments having equivalent elements, modifications, omissions, combinations (e.g., of aspects across various embodiments), adaptations and/or alterations as would be appreciated by those in the art based on the present disclosure. For example, the number and orientation of components shown in the exemplary systems may be modified. Thus, the foregoing description has been presented for purposes of illustration only. It is not exhaustive and is not limiting to the precise forms or embodiments disclosed. Modifications and adaptations will be apparent to those skilled in the art from consideration of the specification and practice of the disclosed embodiments.

The elements in the claims are to be interpreted broadly based on the language employed in the claims and not limited to examples described in the present specification or during the prosecution of the application, which examples are to be construed as non-exclusive. It is intended, therefore, that the specification and examples be considered as exemplary only, with a true scope and spirit being indicated by the following claims and their full scope of equivalents.