Unusual score generators for a neuro-linguistic behavioral recognition system
Techniques are disclosed for generating anomaly scores for a neuro-linguistic model of input data obtained from one or more sources. According to one embodiment, generating anomaly scores includes receiving a stream of symbols generated from an ordered stream of normalized vectors generated from input data received from one or more sensor devices during a first time period. Upon receiving the stream of symbols, generating a set of words based on an occurrence of groups of symbols from the stream of symbols, determining a number of previous occurrences of a first word of the set of words, determining a number of previous occurrences of words of a same length as the first word, and determining a first anomaly score based on the number of previous occurrences of the first word and the number of previous occurrences of words of the same length as the first word.
1. A non-transitory, processor-readable medium storing instructions that, when executed by a processor, cause the processor to:
receive, from a lexical analyzer, a data structure including at least one statistically significant word, at least one anomaly score for the at least one statistically significant word, and at least one alert directive;
generate a syntax based on the data structure;
compare the syntax to a plurality of syntaxes stored in a proto-perceptual memory to identify an unusual syntax score;
generate output including at least one of the unusual syntax score, the syntax, or the alert directive; and
generate an alert based on the at least one alert directive and the unusual syntax score.
2. The non-transitory, processor-readable medium of claim 1 , further storing instructions to cause the processor to receive an update from the proto-perceptual memory,
the instructions to generate the syntax including instructions to generate the syntax further based on the update.
3. The non-transitory, processor-readable medium of claim 2 , wherein the update includes an update to a feature weight for at least one feature of the at least one word.
4. The non-transitory, processor-readable medium of claim 2 , wherein the update includes an update to a combined word list including a plurality of words.
5. The non-transitory, processor-readable medium of claim 2 , wherein the update includes an update to a combined word frequency list.
6. The non-transitory, processor-readable medium of claim 1 , further comprising:
iteratively updating the proto-perceptual memory; and
generating, via the processor, a plurality of further syntaxes based on the iterative updates to the proto-perceptual memory.
7. The non-transitory, processor-readable medium of claim 1 , wherein the unusual syntax score includes a syntactic measure of the syntax and a semantic measure of the syntax.
8. The non-transitory, processor-readable medium of claim 1 , wherein the output includes a connected graph including:
a plurality of nodes, each node from the plurality of nodes representing a word from the plurality of words, and
a plurality of edges, each edge from the plurality edges representing a relationship between a pair of words from the plurality of words.
9. The non-transitory, processor-readable medium of claim 1 , wherein each alert directive from the at least one alert directive includes an identifier, an alert pointer, match criteria, and an epilog.
10. A non-transitory, processor-readable medium storing instructions that, when executed by a processor, cause the processor to:
detect, during a first time period, that a behavior from a plurality of behaviors observed within a monitoring system is abnormal;
generate an alert in response to detecting the behavior from the plurality of behaviors during the first time period;
generate an alert directive based on user-defined match criteria during a second time period;
detect, during a third time period after the second time period, the behavior from the plurality of behaviors; and
not generate an alert in response to detecting the behavior from the plurality of behaviors during the third time period, based on the alert directive.
11. The non-transitory, processor-readable medium of claim 10 , wherein the alert directive includes an identifier, an alert pointer, match criteria, and an epilog.
12. The non-transitory, processor-readable medium of claim 10 , wherein the instructions to detect the behavior from the plurality of behaviors include instructions to detect that the behavior from the plurality of behaviors is abnormal is based on a learning-based object classification type.
13. The non-transitory, processor-readable medium of claim 10 , wherein the instructions to generate the alert in response to detecting the behavior from the plurality of behaviors during the first time period include instructions to generate the alert based on a learning-based object classification type.
14. The non-transitory, processor-readable medium of claim 10 , wherein the user-defined match criteria includes a tolerance range.
15. The non-transitory, processor-readable medium of claim 10 , wherein the instructions to detect the behavior from the plurality of behaviors include instructions to detect that the behavior from the plurality of behaviors is abnormal is based on neuro-linguistic data generated via perceptual associative learning.
16. A non-transitory, processor-readable medium storing instructions that, when executed by a processor, cause the processor to:
detect, during a first time period, that a behavior from a plurality of behaviors observed within a monitoring system is normal;
not generate an alert in response to detecting the behavior from the plurality of behaviors during the first time period;
generate an alert directive based on user-defined match criteria;
detect, during a second time period after the first time period, the behavior from the plurality of behaviors; and
generate an alert in response to the detection of the behavior from the plurality of behaviors during the third time period, based on the alert directive.
17. The non-transitory, processor-readable medium of claim 16 , wherein the alert directive includes an identifier, an alert pointer, match criteria, and an epilog.
18. The non-transitory, processor-readable medium of claim 16 , wherein the instructions to detect the behavior from the plurality of behaviors include instructions to detect that the behavior from the plurality of behaviors is normal is based on a learning-based classification.
19. The non-transitory, processor-readable medium of claim 16 , wherein the user-defined match criteria includes a tolerance range.
20. The non-transitory, processor-readable medium of claim 16 , wherein the user-defined match criteria includes a representation of a location depicted within a video.