SECURITY EVENT DETECTION AND THREAT ASSESSMENT
An indication of a detected security event is received. One or more sensors are selected based on the detected security event. The selected sensors are used to detect additional information associated with a protected airspace associated with the detected security event. A risk level assessment associated with the detected security event is determined based at least in part on the additional information detected using the selected sensors. A response is automatically invoked based on the determined risk level assessment.
1 . A method, comprising:
receiving an indication of a detected security event;
selecting one or more sensors based on the detected security event;
using the selected sensors to detect additional information associated with a protected airspace associated with the detected security event;
determining a risk level assessment associated with the detected security event based at least in part on the additional information detected using the selected sensors; and
automatically invoking a response based on the determined risk level assessment.
2 . The method of claim 1 , wherein the indication of the detected security event includes an initial location of the detected security event.
3 . The method of claim 1 , wherein the detected additional information includes a refined location of the detected security event.
4 . The method of claim 1 , wherein the indication of the detected security event is received is from at least one of the sensors included in a first layer of sensors.
5 . The method of claim 4 , wherein the one or more sensors are selected from a second layer of sensors.
6 . The method of claim 5 , wherein the one or more sensors are selected from a second layer of sensors based on a corresponding availability of the one or more sensors.
7 . The method of claim 5 , wherein the one or more sensors are selected from a second layer of sensors based on whether the one or more sensors are capable of detecting the detected security event.
8 . The method of claim 1 , wherein the one or more sensors are selected based on corresponding sensor information stored in a sensor information database.
9 . The method of claim 8 , wherein the sensor information database stores corresponding sensor information associated with a plurality of registered sensors.
10 . The method of claim 1 , wherein selecting one or more sensors based on the detected security event comprises selecting a primary sensor from a set of available sensors.
11 . The method of claim 10 , wherein selecting one or more sensors based on the detected security event comprises selecting one or more secondary sensors from a set of available sensors.
12 . The method of claim 1 , wherein determining a risk level assessment associated with the detected security event comprises:
determining corresponding feature values associated with a plurality of features based in part on the detected additional information;
applying a feature vector comprised of at least some of the determined corresponding feature values to a machine learning model; and
outputting the risk level assessment associated with the detected security event.
13 . A system, comprising:
a processor; and
a memory coupled with the processor, wherein the memory is configured to provide the is processor with instructions which when executed cause the processor to:
receive an indication of a detected security event;
select one or more sensors based on the detected security event;
use the selected sensors to detect additional information associated with a protected airspace associated with the detected security event;
determine a risk level assessment associated with the detected security event based at least in part on the additional information detected using the selected sensors; and
automatically invoke a response based on the determined risk level assessment.
14 . The system of claim 13 , wherein the indication of the detected security event includes an initial location of the detected security event.
15 . The system of claim 13 , wherein the indication of the detected security event is received from at least one of the sensors included in a first layer of sensors.
16 . The system of claim 15 , wherein the one or more sensors are selected from a second layer of sensors.
17 . The system of claim 16 , wherein the one or more sensors are selected from a second layer of sensors based on a corresponding availability of the one or more sensors.
18 . The system of claim 16 , wherein the one or more sensors are selected from a second layer of sensors based on whether the one or more sensors are capable of detecting the detected security event.
19 . The system of claim 13 , wherein the one or more sensors are selected based on corresponding sensor information stored in a sensor information database.
20 . A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving an indication of a detected security event;
selecting one or more sensors based on the detected security event;
using the selected sensors to detect additional information associated with a protected airspace associated with the detected security event;
determining a risk level assessment associated with the detected security event based at is least in part on the additional information detected using the selected sensors; and
automatically invoking a response based on the determined risk level assessment.