Selective intrusion detection systems

Abstract

A selective intrusion detection system includes a Doppler transceiver configured and adapted to receive Doppler return signals indicative of moving targets present in a surveillance space. A processor is operatively connected to the Doppler transceiver to convert Doppler return signals into spectrograms and to determine whether any given spectrogram is indicative of presence of a human or another moving target, like a domestic pet. An alarm is operatively connected to the processor, wherein the processor and alarm are configured to provide an alert in the event the processor determines any given spectrogram is indicative of a human, and to forego providing an alert in the event the processor determines any given spectrogram is indicative of another moving target only.

Claims

1. An intrusion detection system comprising: a radar transceiver configured and adapted to transmit and receive radar signals indicative of moving targets present in a surveillance space; a processor operatively connected to the radar transceiver to convert radar signals into spectrograms and to determine whether any given spectrogram is indicative of presence of a human or of another moving target in the surveillance space; an alarm operatively connected to the processor, wherein the processor and alarm are configured to provide an alert in the event the processor determines any given spectrogram is indicative of a human, and to forego providing an alert in the event the processor determines any given spectrogram is indicative only of another moving target; and a smart diagnostic system operatively connected to the processor, the smart diagnostic system configured to: store spectrograms and corresponding end user input of human/other moving target determinations to a database; and to update determination processes of the processor based on the stored spectrograms and the corresponding end user input in the database to continuously update and improve determination processes and performance of the intrusion detection system.

2. An intrusion detection system as recited in claim 1, wherein the processor is configured and adapted to determine whether any given spectrogram is indicative of a human based on a set of predetermined factors.

3. An intrusion detection system as recited in claim 2, wherein the set of predetermined factors are obtained from an experimental data set by: extracting coefficients from spectrograms of the experimental data set using at least one of a filter, a transform, a weighted average, and a Goertzel transform; and computing the set of predetermined factors from the extracted coefficients by at least one of means function, max function, standard deviation, derivative, sorting, cumulative sum, moving average, correlation, and period estimation.

4. An intrusion detection system as recited in claim 2, wherein the processor is configured to determine whether the set of predefined factors are human are selected based on a latent semantic method.

5. An intrusion detection system as recited in claim 2, wherein the set of predetermined factors are extracted from a database of signals representative of movements of humans, pets, and other targets and are obtained by learning performed by at least one of optimizations, iterations, heuristics and recursive techniques; and wherein the processor is configured to determine whether the predefined factors are indicative of a human and to trigger the alarm based on at least one of: rules, regressions, support vector machine, probabilistic latent semantic method, k-nearest neighbor, probabilities, and indicator functions that are compared against a predetermined threshold value.

6. An intrusion detection system as recited in claim 2, wherein the set of predetermined factors includes first order time features including at least one of: torso velocity tracking, upper −6 dB of the torso velocity, lower −6 dB of the torso velocity, delta between upper and lower −6 dB of the torso velocity, power generated by torso, average power generated by leg, average power per short time Fourier transform, average power of the frequencies between upper and lower −6 dB points, average of frequency indices with power higher than 20 dB/Hz, 70%, 85% and 95% of a cumulative sum of power per short time Fourier transform, and Q-factor.

7. An intrusion detection system as recited in claim 2, wherein the set of predetermined factors includes second order time features including at least one of: average torso/body power, torso period, phasing between leg Doppler signal chirp period and torso Doppler signal period, average Q-factor, standard deviation of Q-factor, ratio between peak leg velocity and average torso velocity, mean of power spectrum profile, standard deviation of power spectrum profile, upper −6 dB point of torso/body velocity period, lower −6 dB point of torso/body velocity period, phasing between torso period and upper −6 dB point of torso period, phasing between torso period and lower −6 dB point of torso period, phasing between upper −6 dB point of torso period and lower −6 dB point of torso period, ratio between average torso energy and average leg energy, standard deviation of amplitude of frequencies available in torso and body signals, standard deviation of amplitude of frequencies available in leg Doppler chirp signal, average of delta frequency between upper and lower frequency points, standard deviation of delta frequency between upper and lower frequency points.

8. An intrusion detection system as recited in claim 2, wherein the set of predetermined factors are selected through correlations and mutual information to optimize system selectivity and robustness to noise to minimize computational cost.

9. An intrusion detection system as recited in claim 1, wherein the processor is configured and adapted to determine whether any given spectrogram is indicative of a human, based on a predetermined algorithm that calculates an indicator for presence of a human or another moving target.

10. An intrusion detection system as recited in claim 9, wherein the processor and alarm are configured to provide an alert if the indicator has a value that exceeds a predetermined threshold value.

11. An intrusion detection system as recited in claim 1, wherein the processor is configured and adapted to convert radar signals into spectrograms using a set of modules including at least one of: windowing, overlapping, short-time Fourier transform, clipping, binning, noise elimination, logarithmic conversion, amplitude correction, time grouping, whitening by means of horizontal and vertical bar-removal, spectrum generator block diagram, Cepstrum analysis, wavelet analysis, vertical smoothing, and horizontal smoothing.

12. An intrusion detection system as recited in claim 1, wherein the processor includes a support vector machine, wherein the support vector machine includes: local kernel components and global kernel components that extend over a whole domain of events; and wherein parameters of a kernel are optimized for human selectivity and low false alarms using a database of representative signals of humans, pets, and other moving targets.

13. An intrusion detection system as recited in claim 12, wherein the local kernel components include Gaussians to separate islands of different classes of events.

14. An intrusion detection system as recited in claim 12, wherein the global kernel components include linear functions, multivariate polynomials, or step type functions such that the global components provide a generalization over the whole domain of events.

15. An intrusion detection system as recited in claim 12, wherein the optimization of the parameters is performed by at least one of an accelerated random search and a global optimization procedure.

16. An intrusion detection system as recited in claim 1, wherein the determination of the processor is optimized by at least one of: the decision thresholds, data processing parameters, time feature parameters, and time feature weights; wherein optimization includes at least one of: accelerated random search optimization, evolutionary optimization, gradient based optimization, simulated annealing, genetic optimization, pattern searches, optimization using response surfaces, optimization using surrogates, interval methods, and hierarchical methods; and wherein optimization is decomposed into sub-problems that are optimized sequentially.

17. An intrusion detection system as recited in claim 1, further comprising a selectivity mode adjustor for matching sensitivity for a given application and a given level of risk.

18. An intrusion detection system as recited in claim 1, further comprising a range control operatively connected to the radar transceiver to adjust the surveillance space coverage volume.

19. An intrusion detection system as recited in claim 1, further comprising communication means operatively connected to the processor to send spectrograms to an up-stream server to enable detailed selectivity processing further up-stream and to alleviate complexity and current consumption constraints down-stream.

20. An intrusion detection system as recited in claim 1, wherein the processor includes a noise elimination system including at least one of: energy measures, background filtering approaches, and measures of randomness.

21. An intrusion detection system as recited in claim 1, wherein the processor includes a trigger detection system including at least one of: energy measures and heuristics.

22. An intrusion detection system as recited in claim 1, wherein the end user input is used to make a human or other moving target determination to be used as ground truth to update or train the intrusion detection system.

23. An intrusion alarm system for detecting the presence of a moving target in the presence of interfering phenomena, comprising: a Doppler transceiver for transmitting signals into a surveillance zone; means for reception of Doppler signals returned from said surveillance zone; means for providing a spectrogram; and a processor configured to determine respective origins of Doppler targets for providing reliable intrusion security and forgoing privacy issues; and a smart diagnostic system operatively connected to the processor, the smart diagnostic system configured to: store spectrograms and corresponding end user input of human/other moving target determinations to a database; and to update determination processes of the processor based on the stored spectrograms and the corresponding end user input in the database to continuously update and improve determination processes and performance of the intrusion alarm system.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) So that those skilled in the art to which the subject disclosure appertains will readily understand how to make and use the devices of the subject disclosure without undue experimentation, preferred embodiments thereof will be described in detail herein below with reference to certain figures.

(2) FIG. 1 is a schematic diagram depicting the preferred embodiment in its application showing a surveillance space with a human and other moving targets;

(3) FIG. 2 is a schematic block diagram of an embodiment;

(4) FIG. 3 is an explanatory graphical presentation of First Order Time Features; and

(5) FIG. 4 is a hierarchical decision making graph with multiple time scales.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

(6) Reference will now be made to the drawings wherein like reference numerals identify similar structural features or aspects of the subject disclosure. For purposes of explanation and illustration, and not limitation, a schematic diagram of an exemplary embodiment of a system for selective intrusion detection in accordance with the disclosure is shown in FIG. 1 and is designated by reference character 10. Other embodiments of systems and methods for detecting intrusions in accordance with the disclosure, or aspects thereof, are provided in FIG. 2, as will be described.

(7) Referring to FIG. 1, there is shown the preferred embodiment of the present disclosure for a selective intrusion detection system 10. The intrusion detection system 10 monitors a surveillance space 5. The surveillance space 5 shows moving target—e.g. a tree 12, a heavy street traffic area including EMI, RFI, ESD and the like 13, a ceiling fan 14, a cat 15, a dog 16, and a human 20. The intrusion detection system 10 receives Doppler return signals 8 indicative of moving targets 12, 13, 14, 15, 16, 20 present in and in the vicinity of the surveillance space 5, determines whether any signals are indicative of the presence of a human 20 or of another moving target 12, 13, 14, 15, 16, and provides an alert in the event a human 20 is indicated, and foregoes providing an alert in the event that other moving targets 12, 13, 14, 15, 16 are detected. The selectivity mode switch (ref. Table 3) influences the way the system behavior blends, to provide or forego an alarm in mixed events when a human 20 as well as other moving targets 12, 13, 14, 15, 16 are detected.

(8) Referring to FIG. 2, an explanatory schematic block diagram of an embodiment of the selective intrusion detection system is depicted. A Doppler front-end 21 including a sensitivity range setting 22 is operative in the surveillance area and its Doppler return signal from the moving targets present in the surveillance area is processed. At first a buffer 23 is used in order to provide sufficient windowing samples, for example Hanning-windowing, for the spectrogram generator 24 to operate. After completion of the spectral analysis, unneeded noise-columns as well as unwanted deterministic intrinsic building signals, RFI, and the like are removed by de-noising and whitening algorithms 25. Subsequently First Order Time Features 26 are calculated according to Table 1. The outcome of these First Order Time Features 26 is stored in a 3-second buffer 27. From this 3-second buffer 27, Second Order Time Features 28 are calculated according to Table 2. Furthermore statistical values 29 determined from the First Order Time Features 26 are calculated from the content of the 3-second buffer 27. All results from Second Order Time Features 28 calculations as well as the results from the statistical calculations 29 are incident to the Support Vector Machine 30. Mode-setting 31 influences the SVM Support Vector Machine decision threshold, residing in the SVM kernel, in order to adapt to the needed security and financial risk, according to Table 3, to suit the security application at hand. Mode-setting 31 may even select different pre-calculated SVM Kernels, since these Kernels contain all parameters needed for wanted real-truth decision making. Alternatives for the SVM decision making algorithm are shown in Table 5. Furthermore the output module 32 will alarm as a conclusion of hierarchical decision making.

(9) Referring to FIG. 3, the horizontal rhythmic lines show the time-evolution of the corresponding First Order Time Features torso velocity tracking 41, upper −6 dB point of the torso velocity 42, lower −6 dB point of the torso velocity 43, and leg velocity tracking 44. These features are a result of the spectrogram of the human body dynamics and biometric characteristics during movement. For a list of First Order Time Features, reference is made to Table 1. As shown in FIG. 3, the momentary average power generated by the leg 47 is calculated by these features. First the delta 45 is calculated between the upper and lower −6 dB points of the torso velocity. Then a sum 48 is taken of the upper −6 dB point of the torso velocity 42 and the delta 45. Finally the average of the amplitudes over the range from the sum 48 up to and including the leg velocity tracking 44 is used to obtain the momentary average power generated by the leg 47.

(10) From the teaching above it should be clear that time-feature analysis is designed to carry-out the human body dynamic analysis in order to track its rhythms and quirks, finding distinguishing factors of the nature (origin) of the target at hand. In electronics theory, Q-factor is conventionally calculated by using the −3 dB points; however, the −6 dB points were used for the set of predetermined factors to provide additional robustness to noise.

(11) FIG. 4 illustrates the hierarchical decision making where human decisions are available every 50-ms 901 and are combined by hierarchical decision making rules into robust decisions at each second 902, based on the decision indicator in time 903, and the decision threshold 905. The one-second decisions 902 are further combined into 3-second decisions (not visible in FIG. 4); The nonhuman decisions 904 are the result of other moving targets such as IBS Intrinsic Building Signals, EMI, RFI, ESD or pets and the like. These nonhuman decisions are taken at a lower level in the decision hierarchy, while the 50-ms decisions 901 are taken at a higher level and the one-second decisions 902 at an even higher level when an alarm may be triggered.

(12) The confidence level of the decision is low if the decision indicator 903 is close to the decision threshold 905, in the undecided interval [0.4, 0.6]. The confidence is high if the decision indicator 903 is close to 1 for human or 0 for non-human.

(13) Selectivity Optimization

(14) A rich database with relevant Doppler signals from all events, as mentioned throughout this publication, has been logged, as well as labeled, with real truth analysis by and from experts. During the synthesis of the SVM kernels, regression methods where used to train the behavior of decision making to match this real-truth data as reported by experts.

(15) In order to boost robustness of the system behavior in adverse Doppler-input conditions, the selectivity of the embodiment has been further optimized by a plurality of methods as mentioned in Table 4. Many intruder attacks as well as quirky human and pet motions have been captured and trained in order to ascertain that the algorithms are living up to the expectations of the security installers and the “voice of their customers”, the users.

(16) Continuous Improvement of the System Behavior

(17) In order to continue improving the intrusion detection system of the present disclosure, the system has been be configured for real time learning by capturing events, adding the events to a database, and adjusting the algorithm. Several events will be stored in memory for diagnostic purposes. A ranking system for the events is based on: a) First as well as Second Order Time Features; b) hierarchical decision values; and c) human/other moving target identifier. When this buffer space is fully used, events will only be stored by overwriting a previously stored event. Since this action is destructive for the previously stored event, a smart decision will be taken. The criterion a), b) and c), already mentioned, is used to rank the priority of the events. The least useful event will be replaced with the new event. When needed the event will be read from the buffer and added to the learning database after real truth ranking by an expert. For example, events associated to missed detections or to false alarms are added to the learning database. By adding the most useful events in the learning database, the algorithm learning process yields more accurate results as time progresses, and is as a result thereby the driving continuous improvement of the selective intrusion detection system.

(18) Grid Computing

(19) To better leverage available resources, the down-stream (sensor level) processing should be kept to a minimum. Thus only low complexity indicators are used to identify a quiescent state or a possible threat. In the case where more detailed analysis is needed for a selective intrusion detection, the data will not be processed locally. Rather, the data will be communicated up-stream (control panel level or central station level) for decision making by using an efficient protocol. In such case the tasks for the sensor to be executed are: (1) early detection of a possible event, e.g. by calculation of the Doppler signal standard deviation (RMS-value); (2) Doppler signal digitization; (3) source compression to reduce redundant data; (4) forward error correction to maximize good throughput; and (5) handling the communication protocol. These remaining tasks will decimate complexity of the decision making algorithms and enable up-stream processing. Implementation can be either wired or wireless, so long as the communication method remains efficient, in terms of energy consumption per bit communicated [nano-Joule/bit] and in terms of spectral efficiency [(bits/s)/Hz]. To maintain an efficient communication method, interference with the radar, sonar and lidar operation should be avoided so as not to influence its Doppler output.

(20) TABLE-US-00001 TABLE 1 Number First Order Time Feature Formula 1 Torso velocity tracking Frequency index of maximum amplitude per single STFT 2 Upper −6 dB point of the Torso velocity With reference to Torso velocity tracking, in upward direction we log the frequency index of the half amplitude point, the −6 dB point. 3 Lower −6 dB point of the Torso velocity With reference to Torso velocity tracking, in downward direction we log the frequency index of the half amplitude point, the −6 dB point. 4 Leg velocity tracking From the maximum frequency index downward we log the first frequency index with +13 dBn. In order to avoid local maxima we validate the continuity and de-bounce as needed. 5 Delta between upper and lower −6 dB Frequency index difference between First Order points of the Torso velocity Time Feature 2 and First Order Time Feature 3 6 Power generated by the Torso The amplitude at the frequency index of First Order Time Feature 1 7 Average power generated by the Leg The average of the amplitudes over the range starting from frequency index (First Order Time Feature 2 + First Order Time Feature 5) up to the frequency index of First Order Time Feature 4 8 Average power per Short Time Fourier Average of all the amplitudes per single STFT Transform (STFT) 9 Average power of the frequencies The average of the amplitudes with frequency between upper −6 dB and lower −6 dB indices starting at First Order Time Feature 3 up to points First Order Time Feature 2 10 Average of the frequency indices with Integration of the frequency indices witch contain power over 20 dBn amplitudes of over 20 dBn divided by the amount of indices found 11 70% of the cumulative sum of the In upward direction: the first frequency index found power per STFT where the cumulative sum of all the amplitudes of a single STFT exceeds 70% of the cumulative total 12 85% of the cumulative sum of the In upward direction: the first frequency index found power per STFT where the cumulative sum of all the amplitudes of a single STFT exceeds 85% of the cumulative total 13 95% of the cumulative sum of the In upward direction: the first frequency index found power per STFT where the cumulative sum of all the amplitudes of a single STFT exceeds 90% of the cumulative total 14 Q-factor First Order Time Feature 1 divided by First Order Time Feature 5 * dBn = dB w.r.t. average Doppler background noise

(21) TABLE-US-00002 TABLE 2 Number Second Order Time Feature Formula 1 Average Torso/Body power Average of First Order Time Feature 6 2 Leg period Find the leg index frequency peaks and calculate the leg period from the time intervals 3 Torso period The frequency corresponding to the highest amplitude of the FFT from the cross-correlation of First Order Time Feature 1 and First Order Time Feature 11 4 Phasing between Leg period and Torso The phase shift between Second Order Time Feature period 2 and Second Order Time Feature 3 5 Average Q-factor Average of First Order Time Feature 14 6 Standard deviation of the Q-factor Standard deviation of First Order Time Feature 14 7 Ratio between peak Leg velocity and The leg index frequency peak divided by the average average Torso velocity of First Order Time Feature 1 8 Mean of the power spectrum profile Average of First Order Time Feature 10 divided by the cross-correlation of First Order Time Feature 1 and First Order Time Feature 11 9 Standard deviation of the power Standard deviation of First Order Time Feature 10 spectrum profile divided by the cross-correlation of First Order Time Feature 1 and First Order Time Feature 11 10 Upper −6 dB point of the Torso/Body The frequency corresponding to the maximum velocity period amplitude of the FFT from First Order Time Feature 2 11 Lower −6 dB point of the Torso/Body The frequency corresponding to the maximum velocity period amplitude of the FFT from First Order Time Feature 3 12 Phasing between Torso period and The phase shift between Second Order Time Feature upper −6 dB point of the Torso period 3 and Second Order Time Feature 10 13 Phasing between Torso period and The phase shift between Second Order Time Feature lower −6 dB point of the Torso period 3 and Second Order Time Feature 11 14 Phasing between upper −6 dB point of The phase shift between Second Order Time Feature the Torso period and lower −6 dB point 10 and Second Order Time Feature 11 of the Torso period 15 Ratio between the average Torso Average of First Order Time Feature 6 divided by the energy and the average leg energy First Order Time Feature 7 16 Standard deviation of the amplitude of Standard deviation of the FFT from the cross- the frequencies available in the correlation of First Order Time Feature 1 and First Torso/Body signal Order Time Feature 11 17 Standard deviation of the amplitude of Standard deviation of the FFT from the cross- the frequencies available in the Leg correlation of First Order Time Feature 4 and First Doppler signal Order Time Feature 12 18 up to Statistical information of First Order Examples are the mean, the standard deviation, its . . . Time Features modal value, minimum, maximum, median etc. per First Order Time Feature

(22) TABLE-US-00003 TABLE 3 Selectivity Hazards Other Decision Making Mode moving targets Security Risk Priority Residential IBS Medium risk Suppression of other Applications Pets moving targets (other than humans) General IBS Medium risk Maximum selectivity Purpose Pets Estates IBS High property risk Intruder detection Single Pet Commercial IBS High financial risk Intruder detection Outdoor Environment Medium risk Suppression of Applications Rodents environmental signals Vermin and other moving Pets targets

(23) TABLE-US-00004 TABLE 4 Optimization methods used Method nr.: Method type: 1 Bumptree 2 Genetic Algorithm 3 Accelerated Random Search 4 Hammer Algorithm 5 Pseudo Boolean 6 Pseudo Boolean Constraint Solver 7 Unconstraint Pseudo Boolean 8 Simulated Annealing 9 Tabu Search

(24) TABLE-US-00005 TABLE 5 Alternatives for the SVM decision making algorithm Method nr.: Method type: 1 K Nearest Neighbour (KNN) 2 Gaussian mixture models 3 Regression 4 Ruled-based decision 5 Markov models 6 Bayesian inference 7 Probabilistic Latent Semantic Analysis (PLSA)