Systems and methods for detecting security events in an environment

1. A method for controlling a security system monitoring an environment, comprising:

collecting sensor data from a plurality of sensors located in the environment;

determining, based on the sensor data, whether a plurality of characteristics of a security event are present in the environment, wherein a determination for each respective characteristic further includes a respective confidence score indicative of a likelihood that the respective characteristic is present;

identifying, from a plurality of pre-determined environment states, a state of the environment based on a current time and an event schedule of the environment;

generating a combined score that is a function of each respective confidence score and a plurality of weights, wherein each weight of the plurality of weights corresponds to a respective characteristic of the plurality of characteristics and has a value based on the state of the environment, and wherein assigning weight values for each state of the plurality of pre-determined environment states comprises:

analyzing historic sensor data of historic security events;

determining, for a historic security event, confidence scores for a respective plurality of characteristics; and

setting the plurality of weights such that combined scores generated from the plurality of weights and the confidence scores for the respective plurality of characteristics are all greater than a threshold score;

determining that the combined score is greater than the threshold score; and

generating an alert indicative of the security event in response to determining that the combined score is greater than the threshold score.

2. The method of claim 1 , further comprising:

identifying a remediation action associated with the security event in a data structure listing remediation actions for a plurality of security events; and

executing the remediation action.

3. The method of claim 2 , the threshold score is a first threshold score and wherein identifying the remediation action comprises:

identifying a first remediation action that corresponds to the first threshold score and a second remediation action that corresponds to a second threshold score, wherein the second threshold score is greater than the first threshold score;

selecting the first remediation action to execute in response to determining that the combined score is greater than the first threshold score and less than the second threshold score; and

selecting the second remediation action to execute in response to determining that the combined score is equal to or greater than the second threshold score.

4. The method of claim 1 , wherein a respective weight of the plurality of weights has a first value for the state of the environment and a second value for another state of the environment.

5. The method of claim 4 , further comprising:

determining that the state of the environment has changed to the another state;

adjusting the respective weight from the first value to the second value; and

updating the combined score.

6. The method of claim 1 , wherein setting the plurality of weights comprises executing a machine learning algorithm that optimizes weights based on a given state of the environment such that the combined scores of the historic security events are all greater than the threshold score.

7. The method of claim 6 , further comprising:

receiving an indication that the security event is not occurring in the environment; and

adjusting the plurality of weights for the state by re-training the machine learning algorithm using the indication that the sensor data does not correspond to the security event.

8. The method of claim 6 , wherein each respective weight has a maximum value and a minimum value to prevent overfitting.

9. An apparatus for controlling a security system monitoring an environment, comprising:

a memory; and

a processor communicatively coupled with the memory and configured to:

collect sensor data from a plurality of sensors located in the environment;

determine, based on the sensor data, whether a plurality of characteristics of a security event are present in the environment, wherein a determination for each respective characteristic further includes a respective confidence score indicative of a likelihood that the respective characteristic is present;

identify, from a plurality of pre-determined environment states, a state of the environment based on a current time and an event schedule of the environment;

generate a combined score that is a function of each respective confidence score and a plurality of weights, wherein each weight of the plurality of weights corresponds to a respective characteristic of the plurality of characteristics and has a value based on the state of the environment, and wherein assigning weight values for each state of the plurality of pre-determined environment states comprises:

analyzing historic sensor data of historic security events;

determining, for a historic security event, confidence scores for a respective plurality of characteristics; and

setting the plurality of weights such that combined scores generated from the plurality of weights and the confidence scores for the respective plurality of characteristics are all greater than a threshold score;

determine that the combined score is greater than the threshold score; and

generate an alert indicative of the security event in response to determine that the combined score is greater than the threshold score.

10. The apparatus of claim 9 , wherein the processor is further configured to:

identify a remediation action associated with the security event in a data structure listing remediation actions for a plurality of security events; and

execute the remediation action.

11. The apparatus of claim 10 , wherein the threshold score is a first threshold score, and wherein to identify the remediation action comprises to:

identify a first remediation action that corresponds to the first threshold score and a second remediation action that corresponds to a second threshold score, wherein the second threshold score is greater than the first threshold score;

select the first remediation action to execute in response to determine that the combined score is greater than the first threshold score and less than the second threshold score; and

select the second remediation action to execute in response to determine that the combined score is equal to or greater than the second threshold score.

12. The apparatus of claim 9 , wherein a respective weight of the plurality of weights has a first value for the state of the environment and a second value for another state of the environment.

13. The apparatus of claim 12 , wherein the processor is further configured to:

determine that the state of the environment has changed to the another state;

adjust the respective weight from the first value to the second value; and

update the combined score.

14. The apparatus of claim 9 , wherein to set the plurality of weights comprises to execute a machine learning algorithm that optimizes weights based on a given state of the environment such that the combined scores of the historic security events are all greater than the threshold score.

15. The apparatus of claim 14 , wherein the processor is further configured to:

receive an indication that the security event is not occurring in the environment; and

adjust the plurality of weights for the state by re-training the machine learning algorithm using the indication that the sensor data does not correspond to the security event.

16. The apparatus of claim 14 , wherein each respective weight has a maximum value and a minimum value to prevent overfitting.

17. A non-transitory computer-readable medium storing instructions for controlling a security system monitoring an environment, wherein the instructions are executable by a processor to:

collect sensor data from a plurality of sensors located in the environment;

determine, based on the sensor data, whether a plurality of characteristics of a security event are present in the environment, wherein a determination for each respective characteristic further includes a respective confidence score indicative of a likelihood that the respective characteristic is present;

identify, from a plurality of pre-determined environment states, a state of the environment based on a current time and an event schedule of the environment;

generate a combined score that is a function of each respective confidence score and a plurality of weights, wherein each weight of the plurality of weights corresponds to a respective characteristic of the plurality of characteristics and has a value based on the state of the environment, and wherein assigning weight values for each state of the plurality of pre-determined environment states comprises:

analyzing historic sensor data of historic security events;

determining, for a historic security event, confidence scores for a respective plurality of characteristics; and

setting the plurality of weights such that combined scores generated from the plurality of weights and the confidence scores for the respective plurality of characteristics are all greater than a threshold score;

determine that the combined score is greater than the threshold score; and

generate an alert indicative of the security event in response to determine that the combined score is greater than the threshold score.