Abstract:
A system for processing monitoring device data that includes a central processing server in communication with at least one monitoring device operable to receive the monitoring device data. The system further includes a processing rules data store having processing rules corresponding to the one or more identifiable targets and risk factor data that is linked to the occurrence of the event. The central processing server is configured to obtain a processing rule corresponding to the at least one target from the processing rules data store, perform a predictive analysis in which one or more risk factors in the monitoring device data are used to calculate a probability that the event will occur in generating a threat assessment, and generate a notification of the potential threat if the probability that the event will occur is higher than a predetermined threshold.

Description:
CROSS-REFERENCES TO RELATED APPLICATIONS 
     This application is a continuation of application Ser. No. 10/351,979, filed Jan. 24, 2003, which claims the benefit of Provisional Application No. 60/352,094, filed Jan. 25, 2002, the entire disclosures of which are hereby incorporated by reference. 
    
    
     BACKGROUND 
     Generally described, monitoring systems are used to obtain information from a variety of elements. In a representative use, a security monitoring system may provide real-time data reflecting the current status of a monitored environment, such as a physical location within a given premises. For example, a security guard may use a computer terminal to obtain video data from a number of cameras in order to assess the status of a premises. Accordingly, many conventional security monitoring systems can assist users in evaluating whether a security breach, or other monitoring issue, has occurred (e.g., whether there is an unauthorized presence within the premises). Further, some security monitoring systems, upon the detection of a condition, are operable to initiate a number of reactive measures. For example, the monitoring system may alert an appropriate authority, or notify one or more authorized users. 
     Although the traditional security monitoring system obtains information regarding the status of various aspects of a monitored environment, such as the status of physical devices or the presence or location of individuals, the outputs from most traditional security monitoring network data are fundamentally reactive in nature. With reference to the previous example, if a security monitoring system obtains motion detection data from a monitored premises, the data output for the traditional security monitoring network is typically limited to a determination of whether motion occurred and whether the detected motion is authorized. Both of these outputs are reactive in nature. Similarly, if a security monitoring network obtains live video data, the data output for the traditional monitoring network will be a transmission of the incoming video data to a display terminal, or more reactive, the archival of the video data. Clearly, the traditional security monitoring network cannot predict when motion will be detected or what the contents of the video motion may be. Thus, most, if not all, monitoring networks, are designed for, and therefore limited to, reactive data processing. 
     Although it may not be possible to predict events, particularly those linked to human behavior, with total accuracy, there are a variety of situations in which one or more factors may be utilized to establish a likelihood of an event occurring. In some limited situations, a single inputted factor, or condition, may have a sufficiently strong association with a target event such that the presence of the factor will likely determine whether the target event will occur. More commonly, however, the presence of a number of inputted factors, which if considered in isolation would have a limited association with a target event, may cumulatively indicate the likelihood of the target event occurring. 
     As applied to security monitoring networks and security processing services, the processing of data for the purpose of to the identifying an individual, such as facial recognition, fingerprint, retinal scan, and the like, may be useful for assessing security threats when the data used to identify an individual is linked to data linking that individual to a potential threat, based upon past behavior or other known risk factors In many instances, the risk factors may be unrelated to a specific individual, such as a state of alert at a premises. There are a number of situations in which the processing of multiple data inputs to produce a predictive threat assessment, that is, to process multiple data inputs to assess the likelihood of a target event, is clearly beneficial. 
     With reference to a security monitoring system implementation, there is an undeniable benefit from generating a threat assessment based on processing a wide variety of factors. For example, considered in isolation, the purchasing of a one-way airline ticket may not pose a sufficient threat to require additional investigation on behalf of law enforcement authorities. However, if the one-way ticket purchase is considered in conjunction with information, such as the purchase of the ticket with cash or the absence of checked baggage, the cumulative information could generate a threat assessment requiring at least some additional follow up, such as an automated notification to a perform an search at a security checkpoint. With another potential embodiment, a storeowner may wish to generate a reward assessment based upon predicted consumer&#39;s actions. In these situations, and many others, the data inputs can be interpreted to facilitate future actions. In each of these examples, however, because the assessment is not reactive, conventional monitoring systems are not well suited to provide such services. 
     SUMMARY 
     This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This summary is not intended to identify key features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. 
     In accordance with an aspect, a system for processing monitoring device data is provided. The system includes a central processing server in communication with the at least one monitoring device operable to receive the monitoring device data. The system further includes a processing rules data store having processing rules corresponding to the one or more identifiable targets and risk factor data that is linked to the occurrence of the event. In one embodiment, the central processing server is configured to obtain a processing rule corresponding to the at least one target from the processing rules data store, perform a predictive analysis in which one or more risk factors in the monitoring device data are used to calculate a probability that the event will occur in generating a threat assessment, and generate a notification to authorized personnel of the potential threat if the probability that the event will occur is higher than a predetermined threshold. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The foregoing aspects and many of the attendant advantages of the disclosure subject matter will become more readily appreciated as the same become better understood by reference to the following detailed description, when taken in conjunction with the accompanying drawings, wherein: 
         FIG. 1  is a block diagram of a representative portion of the Internet; 
         FIG. 2  is a block diagram of an action assessment system formed in accordance with the disclosed subject matter; 
         FIG. 3  is a block diagram illustrative of an action assessment system including a central processing server and one or more external data sources formed in accordance with the disclosed subject matter; 
         FIG. 4  is a block diagram illustrative of an action assessment system including a central server and two external data sources formed in accordance with an alternative embodiment of the disclosed subject matter; 
         FIG. 5  is a block diagram of an illustrative architecture for a premises server formed in accordance with the disclosed subject matter; 
         FIG. 6  is a block diagram of an illustrative architecture of a central processing server formed in accordance with the disclosed subject matter; and 
         FIGS. 7A and 7B  are flow diagrams illustrative of an action assessment processing routine implemented by a premises or central processing server in accordance with the disclosed subject matter. 
     
    
    
     DETAILED DESCRIPTION 
     As described above, aspects of the disclosed subject matter are embodied in a World Wide Web (“WWW”) or (“Web”) site accessible via the Internet. As is well known to those skilled in the art, the term “Internet” refers to the collection of networks and routers that use the Transmission Control Protocol/Internet Protocol (“TCP/IP”) to communicate with one another. A representative section of the Internet  20  is shown in  FIG. 1 , where a plurality of local area networks (“LANs”)  24  and a wide area network (“WAN”)  26  are interconnected by routers  22 . The routers  22  are special purpose computers used to interface one LAN or WAN to another. Communication links within the LANs may be wireless, twisted wire pair, coaxial cable, or optical fiber, while communication links between networks may utilize 56 Kbps analog telephone lines, 1 Mbps digital T-1 lines, 45 Mbps T-3 lines or other communications links known to those skilled in the art. 
     Furthermore, computers  28  and other related electronic devices can be remotely connected to either the LANs  24  or the WAN  26  via a digital communications device, modem and temporary telephone, or a wireless link. It will be appreciated that the Internet  20  comprises a vast number of such interconnected networks, computers, and routers and that only a small, representative section of the Internet  20  is shown in  FIG. 1 . 
     The Internet has recently seen explosive growth by virtue of its ability to link computers located throughout the world. As the Internet has grown, so has the WWW. As is appreciated by those skilled in the art, the WWW is a vast collection of interconnected or “hypertext” documents written in HyperText Markup Language (“HTML”), or other markup languages, that are electronically stored at or dynamically generated by “WWW sites” or “Web sites” throughout the Internet. Additionally, client-side software programs that communicate over the Web using the TCP/IP protocol are part of the WWW, such as JAVA® applets, instant messaging, e-mail, browser plug-ins, Macromedia Flash, chat and others. Other interactive hypertext environments may include proprietary environments such as those provided in America Online or other online service providers, as well as the “wireless Web” provided by various wireless networking providers, especially those in the cellular phone industry. It will be appreciated that the disclosed subject matter could apply in any such interactive communication environments, however, for purposes of discussion, the Web is used as an exemplary interactive hypertext environment with regard to the disclosed subject matter. 
     A Web site is a server/computer connected to the Internet that has massive storage capabilities for storing hypertext documents and that runs administrative software for handling requests for those stored hypertext documents as well as dynamically generating hypertext documents. Embedded within a hypertext document are a number of hyperlinks, i.e., highlighted portions of text which link the document to another hypertext document possibly stored at a Web site elsewhere on the Internet. Each hyperlink is assigned a Uniform Resource Locator (“URL”) that provides the name of the linked document on a server connected to the Internet. Thus, whenever a hypertext document is retrieved from any Web server, the document is considered retrieved from the World Wide Web. Known to those skilled in the art, a Web server may also include facilities for storing and transmitting application programs, such as application programs written in the JAVA® programming language from Sun Microsystems, for execution on a remote computer. Likewise, a Web server may also include facilities for executing scripts and other application programs on the Web server itself. 
     A remote access user may retrieve hypertext documents from the World Wide Web via a Web browser program. A Web browser, such as Netscape&#39;s NAVIGATOR® or Microsoft&#39;s Internet Explorer, is a software application program for providing a user interface to the WWW. Upon request from the remote access user via the Web browser, the Web browser requests the desired hypertext document from the appropriate Web server using the URL for the document and the HyperText Transport Protocol (“HTTP”). HTTP is a higher-level protocol than TCP/IP and is designed specifically for the requirements of the WWW. HTTP runs on top of TCP/IP to transfer hypertext documents and user-supplied form data between server and client computers. The WWW browser may also retrieve programs from the Web server, such as JAVA applets, for execution on the client computer. Finally, the WWW browser may include optional software components, called plug-ins, that run specialized functionality within the browser. 
     Referring now to  FIG. 2 , an actual embodiment of an action assessment system  200  formed in accordance with the disclosed subject matter will be described. The action assessment system  200  facilitates the processing of multiple data inputs obtained from a number of monitoring devices located within one or more physical premises. The action assessment system processes the monitoring device data according to one or more processing rules, which can be system controlled or premises-specific. Based on an evaluation of the inputs and a corresponding rule, the action assessment system  200  generates an action assessment. Accordingly, the system  200  can implement a system response, including the request and processing of additional information. In an illustrative embodiment of the disclosed subject matter, the action assessment system  200  may be utilized to generate security threat assessments. However, one skilled in the relevant art will appreciate that the disclosed subject matter is not limited to a security threat assessment system and that the disclosed embodiments are illustrative in nature. 
     With reference to  FIG. 2 , the action assessment system  200  includes a premises server  204  assigned to a premises  202  or group of premises  202 . In an illustrative embodiment of the disclosed subject matter, the premises server  204  is located physically proximate to the premises  202 . Alternately, the premises server  204  may be remote, or physically separated from the premises  202 . Moreover, although a single premises server  204  is illustrated in  FIG. 2 , any number of computing devices may be utilized to implement the disclosed subject matter. 
     In accordance with an illustrative embodiment of the disclosed subject matter, the premises server  204  is in communication with a number of data sources for facilitating communication with various monitoring and output devices, for evaluating premises specific rules and/or for storing the inputted data for evaluation. More specifically, the premises server  204  is in communication with a user profiles database  206  operable to store and recall monitoring device data associated with one or more unique identifiers. The premises server  204  is also in communication with a premises rules database  208 . The premises rules database  208  is operable to recall one or more premises specific rules for evaluating the monitoring data. As will be explained in further detail below, premises rules database  208  can include programmatic and declarative rules for utilization by processing systems, including but not limited to individual automata, neural networks, support vector machines and any additional learning systems. The premises server  204  is further in communication with a device profiles database  210  that includes information operable to control and interpret communications from the various monitoring and output devices connected to the premises server  204 . One skilled in the relevant art will appreciate that various control methods may be utilized within the disclosed subject matter to control the monitoring and output devices and obtain corresponding information. Further, one skilled in the relevant art will appreciate that the user profiles database  206 , the premises rules database  208  and the device profiles database  210  may be physically remote from the premises server  204  and may be implemented as part of a distributed database network. 
     As also illustrated in  FIG. 2 , the premises server  204  can communicate with one or more monitoring devices  212  via a network connection. A more detailed description of a network for communicating with monitoring devices, including the use of one or more device servers, is found in U.S. Provisional Application No. 60/281,254, entitled SYSTEM AND METHOD FOR MANAGING A DEVICE NETWORK and filed on Apr. 3, 2001, the disclosure of which is hereby incorporated by reference. In an illustrative embodiment, the monitoring devices  212  can include smoke, fire and carbon monoxide detectors. The monitoring devices  212  can also include door and window access detectors, glass break detectors, motion detectors, audio detectors, metal detectors, explosive detectors and/or infrared detectors. Still further, the monitoring devices  212  can include computer network monitors, voice identification devices, video cameras, still cameras, microphones and/or fingerprint, facial, retinal, or other biometric identification devices. Still further, the monitoring devices  212  may include pressure-sensitive mats or planar surfaces. Still further, the monitoring devices  212  can include conventional panic buttons, global positioning satellite (“GPS”) locators, other geographic locators, medical indicators, and vehicle information systems. The monitoring devices  212  can also be integrated with other existing information systems, such as inventory control systems, accounting systems, reservation systems, point-of-sale (“POS”) terminals/systems, and the like. It will be apparent to one skilled in the relevant art that additional or alternative monitoring devices  212  corresponding to a specific monitoring function may be practiced with the disclosed subject matter. 
     The premises server  204  also communicates with one or more output devices  214 . In an illustrative embodiment, the output devices  214  can include audio speakers, display or other audio/visual displays, or audio diaphragms for the projection of audio within targeted areas of a premises. The output devices  214  may also include electrical or electro-mechanical devices that allow the system to perform actions. The output devices  214  can include computer system interfaces, telephone interfaces, wireless interfaces, door and window locking mechanisms, aerosol sprayers, and the like. As will be readily understood by one skilled in the art, the type of output device is associated primarily with the type of action the action assessment system  200  generates. Accordingly, additional or alternative output devices  214  are considered to be within the scope of the disclosed subject matter. In accordance with the disclosed subject matter, the monitoring devices  212  and the output devices  214  can be linked together in a computer network environment in which multiple premises servers  202  work in parallel, sharing data and processes. Moreover, additional premises servers  202 , monitoring devices  212 , and output devices  214  may be joined modularly to provide extensibility to the system  200 . 
     Turning now to  FIG. 3 , an expanded embodiment of the disclosed subject matter will be explained. In accordance with this embodiment, an action assessment system  300  includes a number of premises  202  and premises servers  204  that operate as described with respect to  FIG. 2 . Each of these premises  202  communicates to a central processing facility  302  that includes at least one central processing server  304 . In an illustrative embodiment of the disclosed subject matter, the individual premises  202  can communicate via global communication network such as the Internet  20 , or alternatively via private communication networks and/or communication lines. Similar to the premises server  204 , the central processing server  304  is in communication with a number of data sources to facilitate processing incoming monitoring device data from the premises  202  and communicating with various monitoring devices within each individual premises  202 . More specifically, the central server  304  includes a user profiles database  306 , a premises rules database  308 , and a device profiles database  310 . In an illustrative embodiment of the disclosed subject matter, the central processing server  304  data sources have similar functions to the user profile database  206 , premises rules database  208 , and device profile database  210  ( FIG. 2 ) and operable to add a second data processing layer to the action assessment system  300 . More specifically, the user profiles database  306  is operable to store and recall user profile data for processing the various inputs from the monitoring device data. The premises rules database  308  is operable to provide rules for processing premises monitoring device-specific data. In an illustrative embodiment of the disclosed subject matter, the premises rules database may maintain individually customized rules for each premises  202  on the system  300  or a set of rules applicable to each premises. Finally, the device profiles database  310  is operable to interpret and/or control the various monitoring devices from each premises  202 . Similar to the premises databases, the central server databases may be physically proximate to the central server  304 , may be remote or physically separate from the central server  304  and implemented as part of a distributed database system. 
     The action assessment system  300  can also include one or more external data sources  312 , operable to supply additional information to the central processing server  304 . In an illustrative embodiment of the disclosed subject matter, the external data sources  312  can include law enforcement databases, governmental databases, international databases, internal company databases, third-party commercial databases, and the like. 
     In accordance with this embodiment of the disclosed subject matter, the premises server  204  can obtain and process monitoring device data. As part of the processing, the premises server  204  can transmit the monitoring device data and any processing results to the central processing server  204 . The central server can obtain the data from the individual premises  202 , process it according to its premises rules to generate an action assessment. Additionally, the central processing server  304  may also obtain additional information, such as from the external data sources  312 , as part of the data processing step, or as a result of a preliminary data processing. For example, the central server  304  could obtain an action assessment and monitoring device data from an individual premises server  204 , and then request additional information from an external data source  312 , such as an FBI record database. In conjunction with its processing rules and the additional data, the central processing server  304  may generate one or more action assessments and implement any number of actions. Accordingly, an action assessment system  300  can implement multiple layers for processing. 
     Although a single central processing server  304  is illustrated in  FIG. 3 , one skilled in the relevant art will appreciate that any number of central processing servers  304  may be implemented to process data from premises servers  204 . Moreover, multiple central processing servers  304  may be utilized within an action assessment system  300  to generate any number of processing layers. For example, a second central processing server  304  may be utilized to process data from the first central processing server  304 . 
     With reference now to  FIG. 4 , an alternative embodiment for an action assessment system  400  will be described. In accordance with this embodiment, the action assessment system  400  includes a number of premises  402  that include a premises server  404 , monitoring devices  406 , and output devices  408 . However, the premises server  404  does not include additional data sources, such as a user profile database, a premises rule database or device profile database, to process the monitoring device data. Instead, all of the monitoring device and output device data is transferred to a central server  304  which evaluates monitoring device data according to the user profile database  306 , a premises rule database  308 , and a device profiles database  310 , described above. The central server  304  can obtain additional external data from an external data source  312 . However, one skilled in the art will appreciate that the central server  304  can then transfer the data to an additional layer (not shown) to implement additional processing layers. 
     In accordance with this embodiment of the disclosed subject matter, the individual premises  402  no longer have the ability to process the monitoring device data and transfer it to an external source. Additionally, in another embodiment of the disclosed subject matter, the premises server  402  may also be omitted such that the monitoring devices  406  transmit data directly to the central server  304 . Still further, the action assessment system  400  may be further modified to include a combination of premises  202  ( FIG. 2 ) having a premises server  204  and premises  402  communicate unprocessed monitoring device data to a central processing server  304 . All such embodiments are considered to be within the scope of the disclosed subject matter. 
       FIG. 5  is a block diagram depicting an illustrative architecture for a premises server  204  ( FIG. 2 ). Those of ordinary skill in the art will appreciate that the premises server  204  includes many more components then those shown in  FIG. 5 . However, it is not necessary that all of these generally conventional components be shown in order to disclose an illustrative embodiment for practicing the disclosed subject matter. As shown in  FIG. 5 , the premises server  204  includes a network interface  502  for connecting directly to a LAN or a WAN, or for connecting remotely to a LAN or WAN. Those of ordinary skill in the art will appreciate that the network includes the necessary circuitry for such a connection, and is also constructed for use with the TCP/IP protocol, the particular network configuration of the LAN or WAN it is connecting to, and a particular type of coupling medium. The premises server  204  may also be equipped with a modem for connecting to the Internet through a point-to-point protocol (“PPP”) connection or a serial-line Internet protocol (“SLIP”) connection as known to those skilled in the art. 
     The premises server  204  also includes a processing unit  504 , an optional display  506 , an input/output (I/O) interface  508  and a mass memory  510 , all connected via a communication bus, or other communication device. The I/O interface  508  includes hardware and software components that facilitate interaction with a variety of the monitoring devices via a variety of communication protocols including TCP/IP, X10, digital I/O, RS-232, RS-485 and the like. Additionally, the I/O interface  44  facilitates communication via a variety of communication mediums including telephone landlines, wireless networks (including cellular, digital and radio networks), cable networks and the like. In an actual embodiment of the disclosed subject matter, the I/O interface is implemented as a layer between the server hardware and software applications utilized to control the individual monitoring devices. It will be understood by one skilled in the relevant art that alternative interface configurations may be practiced with the disclosed subject matter. 
     The mass memory  510  generally comprises a RAM, ROM, and a permanent mass storage device, such as a hard disk drive, tape drive, optical drive, floppy disk drive, or combination thereof. The mass memory  510  stores an operating system  512  for controlling the operation of the premises server. It will appreciated that this component may comprise a general-purpose server operating system as is known to those skilled in the art, such as UNIX, LINUX™, or Microsoft WINDOWS NT®. The memory also includes a WWW browser 50, such as Netscape&#39;s NAVIGATOR® or Microsoft&#39;s Internet Explorer browsers, for accessing the WWW. 
     The mass memory  510  also stores program code and data for interfacing with various premises monitoring devices, for processing the monitoring device data and for transmitting the processed data. More specifically, the mass memory  510  stores a device interface application  514  in accordance with the disclosed subject matter for obtaining monitoring device data from a variety of devices and for manipulating the data for processing. The device interface application  514  comprises computer-executable instructions which, when executed by the premises server  204  obtains and transmits device data as will be explained below in greater detail. The mass memory  510  also stores a data processing application  512  for processing monitoring device data in accordance with rules maintained within the rules database  208 . The mass memory  510  further stores an output interface application program  518  for transmitting processed device data to one or more external system components. The operation of the data transmittal application  516  will be described in greater detail below. It will be appreciated that these components may be stored on a computer-readable medium and loaded into the memory of the premises server using a drive mechanism associated with the computer-readable medium, such as a floppy, CD-ROM, DVD-ROM drive, or network drive. 
       FIG. 6  is a block diagram depicting an illustrative architecture for a central server  304  ( FIG. 3 ). Those of ordinary skill in the art will appreciate that the central server  304  includes many more components then those shown in  FIG. 6 . However, it is not necessary that all of these generally conventional components be shown in order to disclose an illustrative embodiment for practicing the disclosed subject matter. 
     As shown in  FIG. 6 , the central server  304  includes a network interface  600  for connecting directly to a LAN or a WAN, or for connecting remotely to a LAN or WAN. Those of ordinary skill in the art will appreciate that the network interface includes the necessary circuitry for such a connection, and is also constructed for use with the TCP/IP protocol, the particular network configuration of the LAN or WAN it is connecting to, and a particular type of coupling medium. The central server  304  may also be equipped with a modem for connecting to the Internet  20 . 
     The central server  304  also includes a processing unit  602 , an optional display  604  and a mass memory  606 , all connected via a communication bus, or other communication device. The mass memory  606  generally comprises a RAM, ROM, and a permanent mass storage device, such as a hard disk drive, tape drive, optical drive, floppy disk drive, or combination thereof. The mass memory  606  stores an operating system  608  for controlling the operation of the central server. It will be appreciated that this component may comprise a general-purpose server operating system. 
     The mass memory  606  also stores program code and data for interfacing with the premises devices, for processing the device data and for interfacing with various authorized users. More specifically, the mass memory  606  stores a premises interface application  610  in accordance with the disclosed subject matter for obtaining data from a variety of monitoring devices and for communicating with the premises server. The premises interface application  610  comprises computer-executable instructions, which, when executed by the central server  304 , interface with the premises server  204  as will be explained below in greater detail. The mass memory  606  also stores a data processing application  612  for processing monitoring device data in accordance with rules maintained within the rules database  308 . The operation of the data processing application  612  will be described in greater detail below. The mass memory  606  further stores an output interface application  614  for outputting the processed monitoring device data to a variety of authorized users or additional central processing servers  304  in accordance with the disclosed subject matter. The operation of the output interface application  614  will be described in greater detail below. It will be appreciated that these components may be stored on a computer-readable medium and loaded into the memory of the central server using a drive mechanism associated with the computer-readable medium. 
     Generally described, the disclosed subject matter facilitates the collection and processing of a variety of premises information to generate one or more action assessments of potential future activity. The system of the disclosed subject matter obtains monitoring data from any one of a variety of monitoring devices  212 . In an actual embodiment of the disclosed subject matter, the monitoring device data can be categorized as asset data, resource data or event data. Asset data is obtained from a monitoring device corresponding to an identifiable object that is not capable of independent action. For example, asset data includes data obtained from a bar code or transponder identifying a particular object, such as a computer, in a particular location. Resource data is obtained from a monitoring device corresponding to an identifiable object that is capable of independent action. For example, resource data includes data from a magnetic card reader that identifies a particular person who has entered the premises. Event data is obtained from a monitoring device corresponding to an on/off state that is not correlated to an identifiable object. Event data is a default category for all of the monitoring devices. As will be readily understood by one skilled in the relevant art, alternative data categorizations are considered to be within the scope of the disclosed subject matter. 
     In an illustrative embodiment of the disclosed subject matter, the monitoring device data is obtained by the monitoring devices  212  on the premises server  204  and processed according to some form of decision logic. In an actual embodiment of the disclosed subject matter, the premises server maintains databases  208  having logic rules for asset data, resource data and event data. Moreover, because the monitoring device data is potentially applicable to more than one authorized user, multiple rules may be applied to the same monitoring device data. Alternatively, the monitoring device data may be processed according to a weighted decision logic, such as a neural network, that does not utilize fixed decision logic. Still further, as illustrated in  FIGS. 3 and 4 , some or all of the monitoring device data may be processed by the central server  304  according to different processing layer logic rules maintained in the premises rules database  308 . 
     Based on the evaluation of the decision logic, the premises server  204  can generate an action assessment corresponding to the outcome of the threat assessment (a determined likelihood of a target event occurring). In an illustrative embodiment of the disclosed subject matter, the action assessment may be in the form of a numerical indicator that has one or more actions associated with it. For example, in an airline security monitoring embodiment, a numerical action assessment can cause law enforcement authorities to implement a pre-defined set of actions. In another embodiment of the disclosed subject matter, the action assessment can be in the form of a set of customized actions initiated by the monitoring system. With reference to the airline security example, a customized action assessment can be in the form of a transfer of data to an individual, or group of individuals, that are determined to be relevant to the particular set of monitoring device data. Moreover, in yet another embodiment of the disclosed subject matter, an action assessment system  200 ,  300  or  400  may utilize a combination of pre-determined numerical identifiers and customized actions. 
     With reference now to  FIGS. 7A and 7B , a routine  700  for processing an action assessment implemented by a premises server  204  in accordance with the disclosed subject matter will be described. Although routine  700  is described in relation to a premises server  204 , the routine  700  may be implemented by the central server  304 , or other similarly configured computing device. With reference to  FIG. 7A , at block  702 , monitoring device data is obtained from one or more monitoring devices. In an illustrative embodiment of the disclosed subject matter, raw monitoring device data may be directly transmitted to the device interface application  514  of the premises server  204 . Alternatively, some or all of the monitoring device data may be pre-processed prior to being obtained by the device interface application  514 . Additionally, the monitoring device data can also include additional information that facilitates the origin of the monitoring device data (e.g., a device identifier) and any other information describing a parameter associated with the collection of the data (e.g., a time stamp). 
     At block  704 , the data processing application  716  associates one or more identifiers corresponding to the monitoring device data. In an illustrative embodiment of the disclosed subject matter, the unique identifiers can include any identifiable data that can be used to associate the monitoring device data with an individual or other identifiable device or resource. For example, a unique identifier can include an individual name, a social security number, a traveler identifier, and the like. Additionally, the unique identifier can include a credit account number, such as a bank account number or credit card number, a license number, serial number, and the like. One skilled in the relevant art will appreciate that some monitoring device data can generate multiple unique identifiers. For example, a record indicating the purchase of product/service can generate unique identifiers corresponding to the individual making the purchase, the medium utilized to complete the purchase, and the item purchased. 
     At decision block  706 , a test is conducted to determine whether a record exists in the user profile database  306  for each unique identifier. If no record exits, at block  708 , the data processing application  516  generates one or more database records corresponding the unique identifier. Once the database record has been created, or if a record already exists, at block  710 , the data processing application  516  populates the record with the corresponding monitoring device data. In an illustrative embodiment of the disclosed subject matter, the data processing application  516  may include some type of selective processing rules that allow it populate the record with only a portion of the monitoring device data. For example, if the unique identifier relates to a purchase, the data processing application  516  may save only pricing information and the medium of purchase. Additionally, the data processing application  516  may be configured to discard some types of monitoring device data prior to populating a record. For example, the data processing application can establish threshold values for some of the data, such a price bottom for purchases, to mitigate the collection of less relevant data. 
     At block  712 , the data processing application  516  obtains rules corresponding to the modified records and at block  714 , generates an action assessment based upon the evaluation of the rule. In one embodiment of the disclosed subject matter, the data processing application may utilize programmatic rules-based logic to process the monitoring device data. In accordance with this embodiment, the data processing application  516  associates a value for the monitoring device data and generates an action assessment based on the programmatic rule. If more than one piece of information resides in a particular data record, the programmatic rule can include an action assessment based on the evaluation of the combination of data. However, the data processing application  516  may include some type of default status in the event some values of monitoring device data are not accounted for, or if some combination of data is not included. 
     In an illustrative embodiment of the disclosed subject matter, each premises  202  may maintain an independent premises rules database  208  that is not dependent on any other premises. Additionally, each individual premises  202  may be configured to allow the various premises  202  on the system to share data by synchronizing the database records on a periodic basis. Alternatively, the premises rules database  208  may also be configured to be mirrored to other selected databases on a more immediate basis. Similarly, one or more premises  202  may be configured to allow for the sharing of the premises rules data by the implementation of a distributed database network. 
     In an alternative embodiment of the disclosed subject matter, the rules-based logic may also be implemented in a declarative manner to provide more opportunities for system administrators, or other authorized personnel, to customize an action assessment for a particular evaluation of inputs and/or to modify the number of combination of inputs supported by the data processing application  516 . In an illustrative embodiment of the disclosed subject matter, each premises rules database  208  may be populated with a pre-defined set of processing rules. Accordingly, to modify the rules according to preferences set by each premises, the rules could be generated, and therefore modified, according to a declarative user interface. The declarative user interface allows for the modification of the processing rules as the monitoring device data is processed. 
     In yet another embodiment of the disclosed subject matter, the data processing application  516  may utilize a neural network, support vector machine, or other learning system, to establish an action assessment based upon values for a given set of inputs. One skilled in the relevant art will appreciate that a learning system includes a randomly selected weighting scale for a given number of inputs. By utilizing a number of training data sets in which an output is known for a given set of inputs, the learning system could be trained to adjust the weight values for the various inputs to generate an appropriate output, or set of outputs. In accordance with this embodiment, the data processing application would utilize the learning system to generate an output based on values for any number of data inputs and combination of the inputs. Moreover, the premises rules database  208  could include different weighing schema that would allow for modification of the learning system outputs for different factual scenarios. Likewise, in one embodiment, each premises would have the capability to modify the weights for each input, to customize the processing of the data. 
     In an alternative embodiment to block  714 , the monitoring device data may not be automatically processed as it is received. Instead, the data processing application  516  may delay the processing of data for a given time period to allow the collection of multiple information pieces and reduce redundant data processing. Additionally, the data processing application  516  may pre-process the monitoring device data prior to applying a processing rule. For example, the data processing application may utilize finite automata to search for specific types of data to process. The data processing application  516  may program a finite automata to search for a particular individual or to search for specific credit card numbers. Alternatively, the data processing application  516  may filter monitoring device data according to its source to prioritize processing from different sources. Accordingly, routine  700  can be modified to incorporate the different embodiments. 
     Turning now to  FIG. 7B , at block  716 , the data processing application can return the action assessment. In an illustrative embodiment of the disclosed subject matter, the output interface application  518  can generate log files of the action assessment and/or transmit the results of the processing to any number of authorized recipients. At decision block  718 , a test is conducted to determine whether additional action items are required. If additional action items are required, at block  720 , the data processing application  516  obtains the action items from the premises rules database  208 . At block  722 , the action items are initiated. In an illustrative embodiment of the disclosed subject matter, the data processing application may obtain control information from the device profiles database  210  and utilize the output interface application  518  to generate the corresponding protocols to the output devices  214 . Additionally, or alternatively, the output interface application  518  may transmit a request to another layer of processing, such as central processing server  304  ( FIG. 3 ) to request that additional data processing take place. Upon the execution of the action items, or if no action items exist, the routine  700  terminates at block  724 . 
     The systems and routines of the disclosed subject matter may be incorporated in a number of monitoring environments. In one aspect, the disclosed subject matter may be configured as an airport security assessment system to monitor airline security risks. In this embodiment, monitoring device data may be obtained from reservation systems, travel agencies, check-in system, airport gates, and the like to assess passenger safety security assessments. For example, the assessment system would capable of processing a method of payment, destination, number of bags checked and the FBI criminal database in generating a security assessment. Additionally, the assessment system would also be operable to obtain monitoring device data, such as video data or cockpit access data, from individual airplanes prior to and during a flight as part of the assessment routine. 
     In another aspect, the disclosed subject matter may be configured in a commercial sales environment to monitor various aspects of consumer sales. In one embodiment, an action assessment system may be configured to prevent future shoplifting offenses or fraud at a POS terminal. In this embodiment, monitoring device data may be obtained from the POS terminals, various inventory items, digital cameras, facial recognition systems, and the like. In another embodiment, an action assessment system may be configured to reward consumer spending. In this embodiment, monitoring device data may be obtained from the POS terminals, third-party credit companies and biometric data. 
     In yet another aspect, the disclosed subject matter may be configured in a military threat assessment environment. In accordance with this aspect, monitoring device data is obtained from a number of sources including physical monitoring devices and intelligence monitoring devices. For example, physical monitoring device data can include digital image cameras, radar images, sonar images, satellite images, and the like, that indicates the likelihood of a monitored activity. The intelligence monitoring device data can include threat assessments, warnings, press announcements, etc. that provide an indication of the likelihood of an activity being a threatening activity. In accordance with the disclosed subject matter, the central processing server  302  is configured to provide an assessment of a threat to a premises, or other identifiable target, and initiate an action corresponding to the threat. The initiation of an action can include a notification to military officials of the threat category and a notification to authorized users to initiate an action. The notification to authorized users can also include a selection of one or more authorized users best suited to respond to the type of threat that has been assessed. The initiation of an action can also include the initiation additional monitoring actions such as increased video monitoring, the activation of special monitoring devices, and/or the sounding of alarms, etc. 
     While various embodiments of the disclosed subject matter have been illustrated and described, it will be appreciated that various changes can be made therein without departing from the scope of the claims.