WO2019076954A1

WO2019076954A1 - Intrusion detection methods and devices

Info

Publication number: WO2019076954A1
Application number: PCT/EP2018/078346
Authority: WO
Inventors: Teet HÄRM; Henri ABEL; Tanel LIIV; Mattis MARJAK; Ville ARULAANE; Romi AGAR; Tauri Tuubel
Original assignee: Defendec Oü
Priority date: 2017-10-20
Filing date: 2018-10-17
Publication date: 2019-04-25

Abstract

An autonomous wireless intrusion detection device comprises motion sensor for movement detection. Alarm events of potential movement within a monitored area are detected based on a sensor signal from the motion sensor and sent to an intrusion detection network entity. The network entity analyses each received (81) new alarm event to classify (82) the new alarm event as a true event or a false event. The network entity further dynamically controls (83, 84, 85, 86, 87, 88) the intrusion detection device to change a detection sensitivity of the intrusion detection device based on the false-true classification of the received alarm events.

Description

INTRUSION DETECTION METHODS AND DEVICES

FIELD OF THE INVENTION

The invention relates to situational awareness systems, such as an intrusion detection systems (IDS) or perimeter intrusion detection systems (PIDS).

BACKGROUND OF THE INVENTION

Wireless sensor networks (WSNs) have many applications, for example in security and surveillance systems, environmental and industrial monitoring, military and biomedical applications. Wireless sensor networks are often used as perimeter intrusion detection systems (PIDS) for monitoring of a territory or infrastructure and the monitoring of its perimeter and detection of any unauthorised access to it. Wireless sensor networks are a low cost technology that provide an intelligence solution to effective continuous monitoring of large, busy and complex landscapes.

A primary consideration in the implementation of the WSNs is the associated power consumption requirements and the limited on-board battery energy. It should be carefully taken into consideration in any algorithm or approach related to sensor network operations. The wireless sensor networks may be used fully autonomously, but typically sensor networks support human decisions by providing data and alarms that have been preliminarily analysed, interpreted and prioritized.

Conventional human intrusion sensing devices and systems may use various known sensor technologies to detect when a secure boundary has been breached. The sensor technologies include passive infrared (PIR) detectors, microwave detectors, seismic detectors, ultrasonic and other human motion detectors and systems. Having detected an intrusion a motion detector generates an alarm signal which may trigger a digital camera in the sensing device. The digital camera may capture still images or record a video as soon as the intrusion occurs. These images or video along with the location of the intrusion may be sent wirelessly to control centre station.

Sensor triggered digital cameras set up in nature take photos within a very visually volatile environment. Trees sway in the wind, bushes and branches oscillate, lighting changes due to clouds and the sun. Henceforth all these will be collectively called "natural changes". All other changes, e.g. people, animals, cars, will be called "actors". Digital cameras take photos when the sensor is triggered for any reason. Triggers by natural phenomenon are called false-alarms. The reason for some of these false alarms is that, to the detection system, the event 'looks' like a real attack so that the source of the non-human motion is falsely detected and reported as a human intruder. In a surveillance type of system it is imperative that the operator of the system is not overloaded by false-alarm when the environment starts triggering the sensor. If there are large numbers of false alarms then extra work will be created in assessing the alarms and responding accordingly. This can rapidly lead to loss of operator confidence in the intrusion detection system and consequently, a true alarm may be missed or ignored. The processing of the false alarms and sending digital images of false alarms to the operator of the system also consumes the battery energy of the sensor. The created photos contain a lot of information, but are easily readable only by humans. It is a very hard non-deterministic problem for machines to understand images correctly with high accuracy. This is especially difficult task for digital camera still images or low frame-rate video which might have a trigger time difference from seconds to hours, so almost every part of the image is somewhat changed and following gradual changes might be very complicated. There is a need to effectively differentiate between alarms and false-alarms in order to reduce and mitigate various disadvantages caused by false alarms.

BRIEF DESCRIPTION OF THE INVENTION

An aspect of the present invention is to reduce amount of false-alarms and mitigate disadvantages caused by false alarms. The aspect of the invention can be achieved by intrusion detection methods, an intrusion detection device and an intrusion detection network entity disclosed in the independent claims. The preferred embodiments of the invention are disclosed in the dependent claims. An aspect of the invention is an intruder detection method in an autonomous wireless detector device having at least one motion sensor, comprising detecting alarm events of potential movement within a monitored area based on at least one sensor signal from the at least one motion sensor,

sending alarm events to an intrusion detection network entity, dynamically adjusting a sensitivity of the detection according to sensitivity control information received from the intrusion detection network entity.

In an embodiment the detecting comprises

measuring of one or more statistical parameters of the at least one sensor signal,

comparing the one or more measured statistical parameters to current or historical parameter values, and

deciding that the at least one sensor signal represents a movement if the comparison meets a predetermined criterion,

and wherein the dynamically adjusting comprises dynamically adjusting the predetermined criterion according to the sensitivity control information received from the intrusion detection network entity.

In an embodiment the at least one sensor signal comprises at least one analog sensor signal from the at least one motion sensor, and wherein the detecting comprises amplifying the at least one analog sensor signal, and wherein the dynamically adjusting comprises dynamically adjusting the amplification according to the sensitivity control information received from the intrusion detection network entity.

In an embodiment, the method comprises triggering at least one digital camera in the detector device to create at least one set of consecutive digital images of the monitored area in response to detecting alarm events based on the at least one sensor signal, and sending an alarm event regarding the at least one set of digital images to the intrusion detection network entity.

In an embodiment the sending comprises sending the alarm event regarding the at least one set of digital images to intrusion detection network entity only if a predetermined criterion is met, and wherein the dynamically adjusting comprises dynamically adjusting the predetermined criterion according to the sensitivity control information received from the intrusion detection network entity.

In an embodiment the at least one motion sensor comprises at least one passive infrared sensor.

An another aspect of the invention is an intrusion detection method in an intrusion detection network entity, comprising

receiving from an autonomous intrusion detection device new events, said detector device operating according to a method as claimed in any one of claims 1 to 6,

analyse each received new alarm event to classify the new alarm event as a true event or a false event,

dynamically controlling the intrusion detection device to change a detection sensitivity of the intrusion detection device based on the false-true classification of the received alarm events.

In an embodiment, the method comprises

dynamically controlling the intrusion detection device to decrease a detection sensitivity of the intrusion detection device based on a count of false alarms.

In an embodiment, the method comprises

increasing the count of false events when a received alarm event is a false event,

resetting the count of false events when a received alarm event is classified as a true event,

controlling the intrusion detection device to reduce the detection sensitivity, if the count of received false alarm events exceeds a predetermined threshold,

resetting the count of received false alarm events after the reduction of the detection sensitivity.

In an embodiment, the method comprises

controlling the intrusion detection device to increase the detection sensitivity, if a predetermined time has passed from the last received event.

In an embodiment, the method comprises controlling the intrusion detection device to increase the detection sensitivity, if a predetermined time has passed from the last received event and from the last increase of the detection sensitivity.

In an embodiment the dynamically controlling comprises dynamically controlling an amplification of at least one analog motion sensor signal in the intrusion detection device.

In an embodiment the dynamically controlling comprises dynamically controlling a criterion for sending an alarm event regarding at least one set of digital images created in a digital camera of the intrusion detection device.

A further aspect of the invention is an autonomous intrusion detection device, comprising at least one motion sensor for movement detection, a wireless communications interface unit, data processing unit, an autonomous power source and at least one digital camera, the autonomous intruder detector device being configured to implement embodiments of the intrusion detection method in the intrusion detection device.

A further aspect of the invention is an intrusion detection network entity, comprising a data processing unit and an associated user interface, the entity being configured to implement embodiments of the intrusion detection method as claimed in the intruder detection network entity.

BRIEF DESCRIPTION OF THE DRAWINGS

In the following the invention will be described in greater detail by means of exemplary embodiments with reference to the accompanying drawings, in which

Figure 1 shows a simplified schematic block diagram illustrating an exemplary autonomous situational awareness system, such as an intrusion detection system (IDS);

Figure 2 shows a simplified schematic block diagram of an exemplary detector device; Figure 3 shows a simplified schematic block diagram of an exemplary wireless bridge;

Figure 4 shows a simplified flow diagram illustrating an example of processing of a sensor-triggered event in a detector device;

Figure 5 shows a simplified flow diagram illustrating an example of processing of a sensor-triggered camera event in a detector device;

Figure 6 shows a simplified schematic signalling diagram that illustrates an exemplary signalling and processing of an alarm;

Figure 7 shows a simplified schematic signalling diagram that illustrates another exemplary signalling and processing of an alarm; and

Figure 8 shows a flow diagram illustrating schematically a dynamic sensitivity control based on classification results from the analysis of received alarm events according to exemplary embodiments.

DESCRIPTION OF EXEMPLARY EMBODIMENTS

A simplified schematic block diagram of an exemplary autonomous situational awareness system, such as an intrusion detection system (IDS) according to an embodiment is illustrated in Fig. 1. The system may comprise plurality of wireless sensor nodes or stations 1, 2, 3, 4, 5 and 6 (any number of sensor stations may be employed), which are also called wireless detector devices herein, optionally one or more bridges 8 and 9, and a back-end server or central network entity 7.

A plurality of wireless detector devices 1-6 may be placed in close proximity and around the monitored asset, object, area or perimeter 10 (in various places or following a certain installation pattern). Detector devices may be placed in selected locations manually or from vehicles, including deployment from aerial and water vehicles. The detector devices 1-6 may be configured to form a network of detector devices, and to exchange configuration information about the network and measurement information on the monitored environment acquired by detector devices. According to an embodiment, the detector devices 1-6 may be configured (programmed) to organize themselves into a wireless network of detector devices, such as an ad hoc network, that employs decentralized control, meaning that there may not be any requirement for a central control centre. An "ad hoc network" is a collection of wireless detector devices that can dynamically be set up anywhere and anytime without using any pre-existing network infrastructure. A structure of an ad hoc network is not fixed but can change dynamically, i.e. detector devices (nodes) 1-6 can be added to or removed from the ad hoc network while the ad hoc network is operational, without causing irreversible failures. Thus, an ad hoc network is able to reconfigure the flow of network traffic according to the current situation. A network of detector devices may use multi-hop networking wherein two or more wireless hops can be used to convey information from a detector device to an access network, and vice versa. In other words, a detector device may have a first wireless hop to a neighbouring detector device that may have a second wireless hop to a wireless bridge or to an access network.

A wireless detector device may be an autonomous sensing device comprising at least one sensor for movement detection, and a wireless (preferably radio) communications interface unit, data processing capability, an autonomous power source and at least one digital camera. A simplified schematic diagram of an exemplary wireless detector device is illustrated in Fig. 2. A detector device 1 may be provided with a wireless communication interface 22, e.g. radio part with a transmitter, a receiver, and an antenna, a data processing unit 23, and an autonomous power supply 21, such as a battery. According to another exemplary embodiment, the autonomous power supply 21 may also be equipped with an energy harvesting device that enables collecting energy from the environment, for example a solar panel. For a movement detection the detector device 1 may comprise one or more sensors 24 for registering or measuring physical parameters related to movement (such as sound, light, seismic, vibration, magnetic field, infrared) and/or detecting changes in the environment (such as humidity, temperature, etc.). In an embodiment, the detector device may be equipped with at least one passive infrared sensor (PIR) for the movement detection. In an embodiment, the detector device may be equipped with at least one digital camera unit 23 for visual surveillance of the monitored asset, object, area or perimeter 10. The at least one digital camera unit 23 may include at least one day-time and/or at least one night-vision digital camera, for example a digital camera having an infrared capability to operate at night. In embodiments, a detector device 1 may be equipped with a high resolution digital camera for daytime surveillance and an infrared digital camera for night time security. The data processing unit 25 may comprise a microcontroller unit MCU which may include a processor part and a memory part as well as peripheral entities. The detector device 1 may also be equipped with a positioning hardware (for example a GPS receiver) providing location information (such as geographical coordinates). The wireless (preferably radio) communications interface unit 22 may be configured for a two-way wireless communication between wireless detector devices 1-6, between a wireless detector device 1-6 and a wireless bridge 8-9, and/or between a wireless detector device 1-6 and a wireless network access point 13. The wireless communications interface unit 22 may be equipped with a radio part with a transceiver (a transmitter and a receiver) and an antenna. In exemplary embodiments, a radio interface between detector devices 1-6 and a bridge 8- 9 may be configured for a short range radio communication, while a radio interface between the bridge 8-9 and a wireless access network 13 may be configured for a long range radio communication.

Wireless interfaces employed may be based on any radio interfaces, such as a radio technology and protocols used in wireless local area networks (WLANs) or wireless personal area networks, such as IEEE 802.11 (WiFi), IEEE 802.15.1 (Bluetooth), IEEE 802.15.4 (ZigBee) technology, or in mobile communication systems, such as GSM and related "2G" and "2.5G" standards, including GPRS and EDGE; UMTS and related "3G" standards, including HSPA; LTE and related "4G" standards, including LTE Advanced and LTE Advanced Pro; Next generation and related "5G" standards; IS-95 (CDMA), commonly known as CDMA2000; TETRA, etc. In exemplary embodiments, a short range radio interface may be based on IEEE 802.15.4 (ZigBee) technology and a long range radio interface may be based on 3G or CDMA mobile communication technology. A wireless bridge 8 or 9 may be an autonomous wireless communication device equipped to communicate with the wireless detector devices 1-6 and a wireless access network, more specifically with a network access point 13 in the access network. A primary function of a wireless bridge 8-9 may be to forward alarm data and messages between wireless detector devices 1-6 and a wireless access network, and the back-end server or network entity 7. In embodiments, at least one bridge may communicate wirelessly directly with the back-end server or network entity 7, i.e. not via a wireless access network. There may be any number of wireless bridges. Multi-hop networking enables greater flexibility of installation patterns of wireless detector devices per a single wireless bridge. In the example illustrated in Figure 1, the wireless bridge 9 is configured to have separate wireless one-hop connections to detector devices 1, 2 and 3, and a wireless one-hop connection to the network access point 13. The bridge 8 is configured to have separate wireless one-hop connections to the detectors 4 and 6, and a wireless multi-hop connection to the detector 5 via the detector 6, and a wireless one-hop connection to the network access point 13. A simplified schematic block diagram of an exemplary wireless bridge is illustrated in Fig. 3. A wireless bridge may be provided with a wireless communication interface 32, e.g. radio part with a transmitter, a receiver, and an antenna, a data processing unit 33, such as a microcontroller unit MCU (which may include a processor part and a memory part as well as peripheral entities), a further wireless communication interface 34, and an autonomous power supply 31, such as a battery. A first wireless (preferably radio) communications interface unit 32 may be a short range wireless transceiver unit configured for a two-way wireless communication between wireless detector devices and the wireless bridge. A second wireless (preferably radio) communications interface unit 34 may be a long range wireless transceiver unit configured for a two-way long-range wireless communication between the wireless bridge and a wireless network access point.

A back-end server or central network entity 7 may collect and store information from the wireless bridges 8-9 and the wireless detectors 1-6, and optionally from other sources, such as seismic sensors. The back-end server may be implemented by a server software stored and executed in suitable server computer hardware. A back-end server or central network entity 7 may be provided with a user interface (UI) 15, for example a graphical user interface, for alarm management and data analytics. For example, visual alarm information may be displayed either as an alarm flow or on geographical map. The user interface (UI) 15 may be a local UI at the location of the back-end server or network entity, or a remote UI communicatively connected to the back-end server or network entity. For example, the back-end server or network entity 7 may be implemented in a workstation or laptop computer, and the UI 15 comprises a monitor or display of the workstation or laptop. As another example, the back-end server or network entity 7 may be provided with an UI 15 in form of a web UI server which can be accessed by a web browser. The back-end server or network entity may also be equipped with a database, memory hardware or any type of digital data storage. The back-end server or network entity may further comprise various components for processing alarm events, analysing alarm events, detecting actors, classifying alarm events, filtering alarm events, and/or removing false alarms. In exemplary embodiments such components may include one or more of an Actor Detector component, a Prefilter component, and a Detector Sensitivity Configurator component whose functionality will be described in more detail below.

Returning now to a detector device 1, the processing unit MCU 25 may be configured (programmed) to monitor the outside physical world by acquiring samples from the sensor(s) 24. The sensor 24 may trigger an event when an appropriate object is in its monitoring area. False triggers happen due to natural phenomena and low processing power. An exemplary flow diagram of processing of a sensor-triggered event in a detector device 1 illustrated schematically in Figure 4. In exemplary embodiments, a passive infrared sensor (PIR) may be used for human detection. Humans emit some amount of infrared radiation which is absorbed by the PIR sensor 24 to identify the human intrusion. The PIR sensor may be equipped with optics so that multiple detection zones may be arranged for each PIR sensor 24. The detector device 1 may also be equipped with an analog part that interfaces with the PIR sensor(s) and amplifies the PIR sensor signal according to environmental conditions. The analog part may comprise a separate analog path with configurable or adaptive signal amplification for each PIR sensor 24 (step 41 in Figure 4). The PIR sensor signal may be sampled by the MCU 25 in regular intervals (step 42). Information about date and/or time may be added to every piece of information. The MCU may be configured (programmed) to provide a digital front-end module, i.e. signal analysis and movement detection software. All the different PIR signals may be fed into the front-end module that may determine whether the PIR signal represents a movement or not. The determination may include measurement of one or more statistical parameters of the PIR signal (step 43) and comparing the measured parameter to current or historical parameter values (step 44), and deciding (step 45) that the PIR signal represents a movement if the comparison meets a predetermined criterion. If the PIR signal does not represent a movement (result "NO" from step 45), the front-end module may proceed to continue sampling in step 42. If the PIR signal represents a movement (result "YES" from step 45), the front end module may optionally further try to determine one or more of a speed of the movement (step 46), a direction of the movement (step 47) and a distance of the object from the detector device 1 (step 48) before raising an alarm, called a device event herein, and/or triggering an event in the digital camera 23 (step 49).

In an embodiment, a single PIR sensor may consists of two infrared sensitive elements. The signal value of each of the sensitive elements is proportional to the amount infrared light that falls on the respective element. The PIR sensor 24 may output an analog sensor signal obtained by merging the signal values of the two infrared sensitive elements. The two infrared sensitive elements may be adapted so that when both elements receive equal amount of IR radiation, then the PIR sensor signal has a predefined equilibrium value x. If the two sensitive elements do not receive equal amounts of infrared radiation, then the PIR sensor signal has a value that is either larger or smaller than x. Whether the value of the sensor signal is larger or smaller than x depends on which one of the infrared sensitive elements receives more infrared radiation. The infrared sensitive element receiving more infrared radiation may output a value of the PIR sensor signal higher than x, and the infrared sensitive element receiving less infrared radiation may output a value of the PIR sensor signal lower than x. So when an object moves in front of the PIR sensor 24, at first one of the infrared sensitive elements receives more IR radiation than the other one, and later the other one receives more infrared radiation. Thus, the value of the PIR sensor signal may first deviate to one side of the equilibrium value x and then to the other side of the equilibrium value x. Similar deviations from the equilibrium value x may occur when the PIR sensor 24 moves in relation to the environment or branches of a tree move in front of the sensor.

In an embodiment, a moving average and a moving standard deviation, or similar moving descriptors, may be calculated for the samples of the PIR sensor signal (the weights for the moving descriptors are calibrated for each environment and may change at run-time). From these moving descriptors, upper and lower bounds may be calculated for the PIR samples, that changes in time along with the signal. These bounds can be thought as the noise floor of the samples - they define therebetween the expected range of values that environmental factors can generate. PIR sample values above and under the bound values can usually be indicative of movement in front of the device.

In an embodiment, also a sample of raw sensor data or readings for a configurable time window prior to the trigger time maybe stored locally in a memory of the detector device 1. In an embodiment, the raw sensor data or readings may be stored into a buffer memory of a preconfigured size. In an embodiment the raw sensor data or readings may be stored in a ring buffer of a preconfigured size. In an embodiment, stored raw data contents may also be associated with rolling-statistics for the raw samples included, such as rolling averages and/or floors over time. The stored raw data contents, and optionally the associated data, may be sent to the server along with an event notification or alarm.

Figure 5 shows a simplified flow diagram illustrating an example of processing of a triggered camera event in a detector device 1. In embodiments, an event in the digital camera (s) 23 may be triggered by a movement detection or alarm made based on the sensor signal(s) (step 51 in Figure 5). The triggering sensor(s) 24 may be any suitable type of sensor or combination of different types of sensors, such as a PIR sensor, a seismic sensor, a magnetic sensor etc. In an embodiment, the digital camera 23 may be triggered based on an alarm or triggering signal provided according to sensor detection embodiments described above with reference to Figure 3. The triggered digital camera 23 may take or create one photographic image or two or more consecutive photographic images of the monitored asset, object, area or perimeter 10 (step 52). A single image option is possible but in that case every analysis module will compare it to previous trigger event images, which will cause more false-alarms due to the fact that the differences between the compared images are much greater to the possibly much larger time difference between creation times of the images. In embodiments, the digital camera 23 may create a configurable or predetermined number of images of the area in front of the digital camera in succession over a configurable or predetermined amount of time. All images the digital camera creates may have both a thumbnail image and a full resolution image available. Information about date and/or time and/or geographical position may be added to all images. A full resolution image refers to a full-size image or video frame with a normal or original resolution. A thumbnail image is a reduced-size or reduced resolution version of a full-size image or video frame. The collected set of created images may be stored in a local memory in the detector device 1.

According to an aspect of the invention, a wireless detector device 1 may send an alarm notification to the back-end network entity or server 7 after every triggered camera event, without attempting to detect false alarms. In an embodiment, the alarm notification may be sent with one or more thumbnail images of the triggered event, and optionally raw sensor data samples stored in a buffer memory, to the back-end network entity or server 7 for further processing and false alarm filtering. The back-end network entity or server 7 may request further thumbnail images or full images, if it has determined that the triggered event is a true alarm based on the already sent thumbnail image(s). Sending thumbnail images first may reduce the amount of data transferred and thereby may conserve the battery 21 of the detector device 1. According to another aspect of the invention, a wireless detector device 1 may be configured to first perform a false alarm test for a triggered camera event, and to send an alarm notification to the back-end network entity or server 7 if the triggered camera event passes the false alarm test. In embodiments, a wireless detector device 1 may be configured to subject the triggered camera events to a strict and robust test to detect the easiest cases of false alarms. This may primarily mean that only cases where almost nothing moved or changed in the images will be classified as false alarms. Such a strict and robust test will require less processing power but will in any case reduce the number of false alarms sent to the back-end network entity or server 7, which both may conserve the battery 21 of the detector device 1. An alarm notification sent to the back-end network entity or server 7 may include information created during the false alarm test, and/or one or more thumbnail images, and optionally raw sensor data samples stored in a buffer memory.

As described above, the MCU may be configured (programmed) to provide a digital front-end module, i.e. signal analysis and movement detection software. In embodiments, the front end module may create structural similarity indexes over a set of thumbnail images or full-size images subdivided into a number of subblocks of a preset size. In embodiments, the front-end module may create a subsampled change-sensitive hash from the image by means of a suitable hashing function or algorithm (step 53). A subsampled hash may describe the image only robustly. A suitable hash function may be a function that will create a similar (or even identical) hash for similar images from various features of the image content. In an exemplary embodiment a perceptual hashing function may be used. Other examples of suitable hash functions include an average hash, a difference hash, and a wavelength hash. The created hash may be represented as a 2-dimensional matrix where every matrix cell may represent and robustly describe a corresponding sub block or sub-image in the original image. More specifically, each cell in the hash matrix may represent a measured value of at least one descriptive property of the respective subblock in the original image. Examples of such descriptive properties include luminance, color, and texture. The created hashes of the collected set of created images maybe stored locally in a memory of the detector device 1.

The front-end may then subject the created hashes to a strict and robust test to detect the easiest cases of false alarms. In an embodiment, the robust test to detect false alarms may comprise taking (computing) Hamming or Euclidean Distances (or similar) over hashes for all subset pairs of images in the current collected set of images (step 54). This may comprise computing Hamming or Euclidean Distance of every point or cell in the current hash to all provided previous hashes in the collected set of images, aggregating Hamming or Euclidean Distances of the same point or cell in the current hash into a two-dimensional distance matrix for the current image, and aggregating Hamming or Euclidean Distance matrix into an aggregated distance matrix in a way that enables to find high-variation hotspots in the distance matrix (step 55).

The test may further comprise checking if any of the aggregated distance matrixes contains a relatively large continuous area of change (step 56). If a sufficient variance is determined in any of the aggregated distance maps of the subset pairs of images (result "YES" from step 56), the MCU 25 may send an alarm notification with the hashes, and optionally raw sensor data samples stored in a buffer memory, to the server 7 for further processing, and the processing of the triggered camera event at the detector device ends (steps 57 and 59). If the distance maps are relatively stable and do not contain any difference hotspots (result "NO" from step 56), then the alarm may be dismissed or dropped (step 58) and the processing of the triggered camera event at the detector device ends (step 59) without no further action.

Figure 6 shows a simplified schematic signalling diagram that illustrates an exemplary signalling and processing of an alarm. Let us first assume that a movement is detected in a wireless detector device 1 and an alarm notification 61 is sent. There may a false alarm test before sending the alarm notification, for example as explained regarding step 58 in Figure 5. The alarm notification 61 may be relayed to the back-end network entity or server 7 by the wireless bridge 8. The back-end server 7 may receive the alarm notification including information about the event, such as the image hashes and optionally raw sensor data samples. Upon receiving the alarm notification the back-end server may notify a user about the new event through a user interface (UI) 15 (step 62).

The back-end network entity or server 7 may perform a prefiltering of the current event by performing a false alarm analysis for event information, such as hashes and/or thumbnail images and optionally the raw sensor data samples, received in the current event and in at least one previous event to determine a resolution. The prefiltering analysis is generally illustrated as a Prefilter 65 in Figure 6. The prefiltering 65 at the back-end server 7 may classify the current event as a false alarm or a true alarm based on the analysis. The robust and early prefiltering 65 enables to save on energy, radio bandwidth and processing power of the wireless detector device 1, because the detector device will not send full images or images at all for some false-alarm cases. The further more detailed analysis for the pre-filtered event is generally illustrated as an Actor Detector 66 in Figure 6. If the current event is classified as a true alarm in the prefiltering 65, the back-end server 7 may request one or more images in thumbnail and/or full resolution formats for more detailed analysis. In the example illustrated in Figure 6, the back-end server 7 may first send a request to send thumbnails 63A to the wireless detector device 1, and the wireless detector device 1 may reply by sending one or more thumbnails 63B to the back-end server 7. Then, if required, back-end server 7 may send a request to send full images 64A to the wireless detector device 1, and the wireless detector device 1 may reply by sending one or more full images 64B to the back-end server 7. A resolution reached by the actor detector 66 may be notified 67 to an end user through the user interface (UI) 15. For example, the end user may be notified that the alarm related to the new event 62 is dismissed (false alarm), still pending (further analysis needed) or a true alarm. The notification 67 may include at least one image relating to the alarm, and optionally more detailed information of the detected event, such as a location, size, speed, movement direction and/or class of an object or objects in the image. In embodiments, a resolution result may further be used to configure wireless detector devices for better detection in following triggers, as illustrated generally by a Sensitivity Configurator 68 in Figure 6.

In an embodiment, the back-end network entity or server may have stored all the previous raw samples of previous events and may have coupled the previous events with resolutions. In an embodiment, upon receiving a new raw sample set the analysis may look for similarities in the new samples to the previous samples of past confirmed and unconfirmed events, and use a found similarities to assist in classifying the new event as a false alarm or a true alarm. In an embodiment, a trained machine learning model may be used to detect patterns in raw sensor samples and give accurate results.

According to another aspect of the invention, a prefiltering 65 of the events may be based on the set of thumbnails to detect and reject events with images where there is no (meaningful) change, i.e. false alarms. In that case, the back-end network entity or server 7 may not receive hashes with the alarm notification 61 but may receive 63B or request 63A one or more thumbnails for prefiltering 65. Figure 7 shows a simplified schematic signalling diagram that illustrates exemplary signalling and processing of an alarm according the other aspect of the invention. Upon classifying an event as a false alarm, the further prosecution of the event may be stopped. Upon classifying an event as a true alarm, the more detailed analysis of the event may continue as in the further analysis or Actor Detector 66 in Figure 6, except that requesting thumbnails can be omitted. The already received set of thumbnails may be subjected to further analysis, and a set of full images may be requested from the detector device 1 for further analysis.

Movement detection and a sensor signal, such as a PIR sensor signal, is greatly affected by environmental conditions and a static solution will not be able to detect movements close to the noise levels of the environment. In harsh conditions with high noise levels, it becomes hard to detect weaker signals. Therefore, it is desired to increase movement detection confidence, e.g. confidence of signal or its absence, in complicated circumstances. The movement detection should prefer- ably be more dynamic and able to adapt to changing conditions. The outcome is that the end user receives less false alarms and the detector battery is reserved due to less operating processing power utilization.

According to an aspect of the invention, a back-end server or network entity 7 may be provided with a dynamic sensitivity control, such as illustrated generally by a Sensitivity Configurator 68 in Figures 6 and 7, which may utilize re- suits from the event analysis and classification, such as from prefilter 65or actor detector 66 illustrated in Figures 6 and 7, to dynamically control the sensitivity of wireless detector devices 1 to 6 for better detection. For example, the back-end server or network entity may change sensitivity configuration of a wireless detector device to be less sensitive, if the number of false alarms appears to be too high. As a further example, the back-end server or network entity may change sensitivity configuration of a wireless detector device to be more sensitive, if too few or no alarms at all are received from the wireless detector device.

In an embodiment, a detection sensitivity of the intrusion detector device may be configured less sensitive, if the number x of false alarms in a predeter- mined period of time y exceeds a preset threshold, for example by sending a Change detection parameters message as illustrated by message 69A in Figures 6 and 7. In another embodiment, a detection sensitivity of the intrusion detector device may be configured less sensitive, if percentage of false alarms of total number of alarms exceeds a preset threshold. In a further embodiment, a detection sensitivity of the intrusion detector device may be configured more sensitive, if no new events are received in a predetermined period z, as illustrated by a message 69B in Figures 6 and 7. The intrusion detector device 1 may reconfigure the detection sensitivity according to sensitivity parameters received from the intrusion detection network entity or server 7. Examples of possible sensitivity parameters may include an am- plification of an analog sensor signal, a predetermined (configurable) criterion for detecting motion in a motion sensor and a criterion for detecting high-variation hotspots in an aggregated distance matrix, etc.

Figure 8 shows a flow diagram illustrating schematically an exemplary dynamic sensitivity control based on classification results from the analysis of re- ceived alarm events. In an embodiment, all alarm events received from a wireless detector device 1 may added to an alarm event list before the alarm events are analysed and classified (step 81). Thus, the number of alarm events in the alarm list may represent a total number or count of received alarm events. In an embodiment, total alarm count is increased after each received alarm event. Each received alarm event may reset a timer that may measure a time passed since last alarm event. A received alarm may be ignored, if a trigger time of the alarm event is older than last time the detection sensitivity of the detector device was set to a less sensitive configuration. When a classified alarm event is received from the alarm event analysis and classification process (such as the prefilter 65 and the actor detector 66), the sensitivity control may check whether the classified alarm event in question is already listed in the alarm event list. If the classified event already exists in the alarm event list and its classification is a false alarm, the classification false is added to the alarm event in the event list. Thus, the number of alarm events with a false alarm classification in the alarm list may represent a total number or count of re- ceived false alarm events. In an embodiment, a false alarm count may be increased after each false alarm event. If classification for a received classified event is a true alarm then all existing events may be cleared from the alarm event list of the detector device 1. As a consequence, also the total count of the received alarm events and the count of received false alarms may be cleared (step 82). This may be made to indicate that alarm events are received for a valid reason, and to avoid setting the detector device to a less sensitive configuration.

The dynamic sensitivity control 68 may check the alarm event list with a suitable frequency, e.g. when any new alarm event is received, or periodically, or after every defined timeout, etc. In the example illustrated in Figure 8, the alarm list may be checked at least when new alarm event is received. All detector devices may be checked to see whether any of set thresholds have been exceeded. At first the sensitivity control may check if the false alarm count has exceed an adaptive false alarm threshold or if the total alarm count has exceeded the adaptive total alarm count threshold (step 83). If any of the defined thresholds is exceeded (result "YES" from step 83), the corresponding detector device may be controlled to reduce the detection sensitivity, i.e. new lower sensitivity settings may be sent to the corresponding detector device (step 84). Then the alarm event list of the corresponding detector device may cleared (step 85), and the control process may proceed to next detector device. If none of the defined thresholds is exceeded (result "NO" from step 83), the sensitivity control may check if instead the correspond- ing detector device has been silent for longer than allowed, e.g. if no events received during a predetermined time and the same amount of time has passed since the last sensitivity increase for the corresponding detector device (step 86). If the predetermined time has passed since the last received event and the predetermined time has also passed since the last sensitivity increase (result "YES" from step 86), the corresponding detector device may be controlled to increase the detection sensitivity, i.e. new higher sensitivity settings may be sent to the corresponding detector device (step 87). Then the alarm event list of the corresponding detector device may cleared (step 88), and the control process may proceed to next detector device. If the predetermined time has not passed since last event and since the last sensi- tivity increase (result "NO" from step 86), the control process may proceed to next detector device.

Various technical means can be used for implementing functionality of a corresponding apparatus, such as detector device or a network entity or a server, described with embodiments and it may comprise separate means for each separate function, or means may be configured to perform two or more functions. Present apparatuses comprise processors and memory that can be utilized in an embodiment. For example, functionality of an apparatus according to an embodiment may be implemented as a software application, or a module, or a unit configured as arithmetic operation, or as a program (including an added or updated software routine), executed by an operation processor. Programs, also called program products, including software routines, applets and macros, can be stored in any apparatus-readable data storage medium and they include program instructions to perform particular tasks. All modifications and configurations required for implementing functionality of an embodiment may be performed as routines, which may be implemented as added or updated software routines, application circuits (ASIC) and/or programmable circuits. Further, software routines may be downloaded into an apparatus. The apparatus, such as a detector device or a back-end server or corresponding components and/or other corresponding devices or apparatuses described with an embodiment may be configured as a computer or a microprocessor, such as single-chip computer element, including at least a memory for providing storage area used for arithmetic operation and an operation processor for executing the arithmetic operation. An example of the operation processor includes a central processing unit. The memory may be removable memory detachably connected to the apparatus.

For example, an apparatus according to an embodiment may be implemented in hardware (one or more apparatuses), firmware (one or more apparatuses), software (one or more modules), or combinations thereof. For a firmware or software, implementation can be through modules (e.g., procedures, functions, and so on) that perform the functions described herein. The software codes may be stored in any suitable, processor/computer-readable data storage medium(s) or memory unit(s) or article(s) of manufacture and executed by one or more processors/computers. The data storage medium or the memory unit may be implemented within the processor/computer or external to the processor/computer, in which case it can be communicatively coupled to the processor/computer via various means as is known in the art.

It will be obvious to a person skilled in the art that, the invention and its disclosed embodiments are not limited to the example embodiments disclosed above but the inventive concept can be implemented in various ways and modified and varied within the spirit and scope of the appended claims.

Claims

1. An intrusion detection method in an autonomous wireless detector device having at least one motion sensor, comprising

detecting alarm events of potential movement within a monitored area based on at least one sensor signal from the at least one motion sensor,

2. The method as claimed in claim 1, wherein the detecting comprises measuring of one or more statistical parameters of the at least one sensor signal,

3. The method as claimed in claim 1 or 2, wherein the at least one sen- sor signal comprises at least one analog sensor signal from the at least one motion sensor, and wherein the detecting comprises amplifying the at least one analog sensor signal, and wherein the dynamically adjusting comprises dynamically adjusting the amplification according to the sensitivity control information received from the intrusion detection network entity.

4. The method as claimed in any one of claims 1 to 3, comprising triggering at least one digital camera in the detector device to create at least one set of consecutive digital images of the monitored area in response to detecting alarm events based on the at least one sensor signal, and sending an alarm event regarding the at least one set of digital images to the intrusion detection network entity.

5. The method as claimed in claim 4, wherein the sending comprises sending the alarm event regarding the at least one set of digital images to intrusion detection network entity only if a predetermined criterion is met, and wherein the dynamically adjusting comprises dynamically adjusting the predetermined criterion according to the sensitivity control information received from the intrusion detection network entity.

6. The method as claimed in any one of claims 1 to 5, wherein the at least one motion sensor comprises at least one passive infrared sensor.

7. An intrusion detection method in an intrusion detection network entity, comprising

8. The method as claimed in claim 7, comprising

9. The method as claimed in claim 7 or 8, comprising

resetting the count of false events when a received alarm event is classified is a true event,

10. The method as claimed in any one of claims 7 to 9, comprising controlling the intrusion detection device to increase the detection sensitivity, if a predetermined time has passed from the last received event.

11. The method as claimed in any one of claims 7 to 10, comprising controlling the intrusion detection device to increase the detection sen- sitivity, if a predetermined time has passed from the last received event and from the last increase of the detection sensitivity.

12. The method as claimed in any one of claim 7 to 11, wherein the dynamically controlling comprises dynamically controlling an amplification of at least one analog motion sensor signal in the intrusion detection device.

13. The method as claimed in any one of claim 7 to 12, wherein the dynamically controlling comprises dynamically controlling a criterion for sending an alarm event regarding at least one set of digital images created in a digital camera of the intrusion detection device.

14. An autonomous intrusion detection device, comprising at least one motion sensor for movement detection, a wireless communications interface unit, data processing unit, an autonomous power source and at least one digital camera, the autonomous intruder detector device being configured to implement the method as claimed in any one of claim 1 to 6.

15. An intrusion detection network entity, comprising a data processing unit and an associated user interface, the entity being configured for implementing the method as claimed in any one of claims 7 to 13.