System and methods for proactive threat detection in a security system
Proactive threat detection in a security system includes monitoring user input received for operating the security system over time and establishing a baseline user input for operating the security system that produces a baseline operation of the security system that can monitor for and identify each of a plurality of baseline security events. An anomaly in the user input relative to the baseline user input is detected and a determination is made as to whether the anomaly means the security system is not able to identify one or more of the baseline security events. When the anomaly in the user input causes the security system to not be able to identify one or more of the baseline security events, a proactive threat detection alert is provided that prompts an operator to take action to resolve the anomaly.
1 . A method comprising:
providing proactive threat detection in a security system of a facility, wherein the security system includes a controller operatively coupled to a plurality of sensors and to a user interface, wherein each of the plurality of sensors are for detecting a corresponding sensed event of the facility, wherein the controller is configured to identify security events of the facility based at least in part on the sensed events detected by the plurality of sensors, and wherein the controller is configured to receive user input for operating the security system including arming and disarming the security system, the method further comprising:
monitoring over time the user input received from the user interface for operating the security system;
establishing a baseline user input for operating the security system based on the user input received from the user interface, wherein the baseline user input produces a baseline operation of the security system that can monitor and identify each of a plurality of baseline security events of the facility;
raising an alarm based on identification of one or more of the plurality of baseline security events of the facility;
detecting an anomaly in the user input received at the controller relative to the baseline user input,
wherein the anomaly in the user input causes the security system to not be able to identify one or more of the plurality of baseline security events of the facility; and
providing a proactive threat detection alert based on the detection of the anomaly in the user input received at the controller.
2 . The method of claim 1 , wherein the anomaly in the user input comprises a manual bypass of one or more of the plurality of sensors that are not bypassed under the baseline operation of the security system.
3 . The method of claim 2 , wherein the plurality of sensors of the security system comprises one or more sensors that are classified as essential sensors and one or more sensors that are classified as non-essential sensors, and wherein the anomaly in the user input comprises a manual bypass of one or more of the essential sensors.
4 . The method of claim 2 , wherein the plurality of sensors of the security system comprises one or more sensors that are classified as essential sensors and one or more sensors that are classified as non-essential sensors, and wherein the anomaly in the user input comprises a manual bypass of one or more of the essential sensors followed by arming the security system.
5 . The method of claim 1 , wherein the controller comprises an automatic arm and disarm configuration that defines when the security system is automatically armed and when the security system is automatically disarmed, wherein the anomaly in the user input comprises changing the automatic arm and disarm configuration of the controller.
6 . The method of claim 1 , wherein the anomaly in the user input comprises disarming the security system at a time that is in consistent with the baseline user input.
7 . The method of claim 1 , wherein the anomaly in the user input comprises disarming the security system at a time that is anomalous relative to the baseline user input, followed by physical access detected by one or more of the plurality of sensors in one or more higher security areas of the facility.
8 . The method of claim 1 , wherein the plurality of sensors comprise one or more of an access control device, a door open sensor, a window open sensor, a motion sensor and a video camera.
9 . The method of claim 8 , wherein the controller comprises a sensor association configuration that configures an association between two or more of the plurality of sensors, and wherein the anomaly in the user input comprises modifying the sensor association configuration.
10 . The method of claim 1 , wherein the proactive threat detection alert is provided across a network to a central monitoring station to alert an operator of the central monitoring station.
11 . The method of claim 1 , wherein establishing the baseline user input for operating the security system comprises:
storing over time the user input received for operating the security system;
using machine learning to learn a ML model that identifies the baseline user input; and
using the ML model to detect the anomaly in the user input relative to the baseline user input.
12 . A security system for a facility, comprising:
a plurality of sensors each for detecting a corresponding sensed event of the facility;
a user interface;
a controller operatively coupled to a plurality of sensors and the user interface, wherein the controller is configured to identify security events of the facility based at least in part on the sensed events detected by the plurality of sensors, and wherein the controller is configured to receive user input via the user interface for operating the security system including arming and disarming the security system, the controller configured to:
store a baseline user input for operating the security system, wherein the baseline user input produces a baseline operation of the security system that can monitor and identify each of a plurality of baseline security events of the facility;
raise an alarm when the controller identifies one or more of the plurality of baseline security events of the facility;
detect an anomaly in the user input received at the controller and relative to the baseline user input;
determine whether the anomaly in the user input causes the controller to not be able to identify one or more of the plurality of baseline security events of the facility; and
when the anomaly in the user input causes the controller to not be able to identify one or more of the plurality of baseline security events, send a proactive threat detection alert to a remote device.
13 . The security system of claim 12 , wherein when the anomaly in the user input does not cause the controller to not be able to identify one or more of the plurality of baseline security events, not providing the proactive threat detection alert to the remote device.
14 . The security system of claim 12 , wherein the anomaly in the user input comprises a manual bypass of one or more of the plurality of sensors that are not bypassed under the baseline operation of the security system.
15 . The security system of claim 12 , wherein the controller includes an automatic arm and disarm configuration that defines when the security system is automatically armed and when the security system is automatically disarmed, wherein the anomaly in the user input comprises changing the automatic arm and disarm configuration of the controller.
16 . A method comprising:
providing proactive threat detection in a security system of a facility, wherein the security system includes a controller operatively coupled to a plurality of sensors, wherein each of the plurality of sensors are for detecting a corresponding sensed event of the facility, wherein the controller is configured with a baseline configuration that configures the controller to identify each of a plurality of baseline security events of the facility based at least in part on the sensed events detected by the plurality of sensors, and wherein the controller is configured to receive user input for operating the security system including arming and disarming the security system, the method further comprising:
receiving a user input at the controller;
determining that the user input changes the baseline configuration of the controller such that the controller is no longer able to identify one or more of the plurality of baseline security events; and
providing a proactive threat detection alert based on the determination that the changes to the baseline configuration are such that the controller is no longer able to identify the one or more of the plurality of baseline security events.
17 . The method of claim 16 , wherein the user input changes the baseline configuration of the controller such that the controller is no longer able to identify one or more of the plurality of baseline security events when the user input configures one or more of the plurality of sensors to be bypassed that are not bypassed under the baseline configuration.
18 . The method of claim 16 , wherein the user input changes the baseline configuration of the controller such that the controller is no longer able to identify one or more of the plurality of baseline security events when the user input configures one or more of the plurality of sensors to be bypassed that are not bypassed under the baseline configuration, followed by arming the security system.
19 . The method of claim 16 , wherein the plurality of sensors of the security system comprises one or more sensors that are classified as essential sensors and one or more sensors that are classified as non-essential sensors, and wherein the user input changes the baseline configuration of the controller such that the controller is no longer able to identify one or more of the plurality of baseline security events when the user input configures one or more of the essential sensors to be bypassed.