Home-based physical and cyber integrated security—intrusion detection system (PCIS-IDS)
View Patent ↗Provided is an integrated physical security and cyber security intrusion and anomaly detection method for determining physical or electronic ingress/egress of a person/device and/or data/information from a home/facility/premise. The method includes processing data and information obtained from physical security system sensors, wired/wireless network traffic, and third-party sources, and creating sensor and network traffic profile, baselines and detecting anomalies and writing all related data to either a local database or a remotely managed database at a monitoring center.
1. A method for an integrated physical security and cyber security intrusion and anomaly detection system for determining physical or electronic ingress or egress of a person or device and/or data or information from a home, facility or premise, the method comprising:
detecting, via a wired or wireless network system (WWNS) coupled to a physical security alarm system (PSAS) and Internet of Things (IoT) components real-time (IoT), intrusion activity and network traffic and intrusion activity;
processing data and information obtained from physical security system sensors, wired or wireless network traffic, and third-party sources;
creating, based on the data and information, a plurality of sensor and network traffic profiles, the sensor and network traffic profiles including active devices and network protocols;
wherein the creating includes (i) discovery and logging of the active devices on a plurality of connected networks (ii) discovery and logging of all network protocols on the connected networks and (iii) categorizing the wired or wireless network traffic into types based on a plurality of Transmission Control Protocol/Internet Protocols (TCP/IP);
establishing a plurality of network activity baselines for each of the physical security system sensors, each of the IoT components and the WWNS based on the sensor and network traffic profiles;
detecting anomalies and writing all related data to either a local database or a remotely managed database at a monitoring center; and
providing activity alerts based on comparing the detected real-time IoT intrusion activity, and the network and traffic intrusion activity, to a respective one or more of the plurality of network activity baselines.
2. The method of claim 1 , wherein the data and information obtained from the physical security system sensors include real-time intrusion activity.
3. The method of claim 1 , further including monitoring, via a security sensor gateway (SSG), traffic and detecting anomalies on the WWNS by analyzing the real-time intrusion activity sensed by the physical security system sensors, and the detected network traffic and intrusion activity.
4. The method of claim 3 , wherein the plurality of sensor and network traffic activity profiles are based on the analyzed sensed real-time intrusion activity and the analyzed network traffic and intrusion activity.
5. The method of claim 3 , wherein the monitoring traffic, the detecting anomalies, the creating a plurality of sensor and network intrusion traffic activity profiles, the establishing a network activity baseline, and the providing activity alerts are performed within the SSG.
6. The method of claim 5 , wherein the SSG aggregates data from the integrated physical security and cyber security intrusion and anomaly detection system and data from a plurality of sensors and devices connected to the WWNS into one or more collection points.
7. The method of claim 6 , wherein the SSG is configured to compare the monitored traffic and the intrusion activity with each network activity baseline produces a threat anomaly detection level.
8. The method of claim 7 , wherein the SSG is configured to trigger a security alert when the threat anomaly detection level exceeds a predetermined threshold.
9. The method of claim 8 , wherein a remote monitoring station (RMS) is responsive to the triggered security alert.
10. The method of claim 9 , wherein the local database is synchronized with a master database at the RMS, enabling the RMS to perform its critical monitoring, alerting and defend functions and to provide a consolidated periodic system monitoring report to system owners on activities and incidents within a security environment.
11. The method of claim 10 , wherein the SSG is programmed to provide system defense, triage, and/or recovery functions for a plurality of PSAS sensors and a control panel as well as for a plurality of devices connected to the WWNS and the IoT components.
12. The method of claim 11 , wherein The RMS is configured to monitor, profile, and alert home, facility or premise owners of ingress, egress, incidents, anomalies, intrusions and other pertinent activities within a security system environment and the home, facility or premise.
13. The method of claim 12 , wherein the RMS interfaces and interacts with the SSG to monitor, profile, optionally defend, and alert system owners to a plurality of system events.
14. The method of claim 13 , wherein the plurality of system events include ingress, egress, anomalies, intrusions and other pertinent activities within the security system environment of the alert system owners.
15. The method of claim 1 , wherein the plurality of sensor and network traffic profiles include egress/ingress activity and a traffic type and a traffic volume.