SE2051514A1 - Identifying abnormal behaviour - Google Patents

Abstract

It is provided a method for identifying abnormal behaviour of a user (6a, 6b). The method is performed in a behaviour determiner (l). The method comprises: obtaining (40), from an access control system (10), access data of the user (6a, 6b), the access data indicating when the user has accessed an electronic lock (i2a-i) in the access control system to gain access to a physical space secured by the electronic lock (i2a-i); and determining (44) that the access data indicates abnormal behaviour.

Description

IDENTIFYING ABNORMAL BEHAVIOUR TECHNICAL FIELD 1. 1. 1. 1. id="p-1" id="p-1"

[0001] The present disclosure relates to the field of identifying abnormal behaviourand in particular to identifying abnormal behaviour based on access data from an access control system.

BACKGROUND 2. 2. 2. 2. id="p-2" id="p-2"

[0002] Abnormal behaviour is a constant problem in modern societies. For instance,it is beneficial to be able to identify certain types of abnormal behaviour such aspsychological problems, health emergencies, drug sales and prostitution. Traditionally,such behaviour is identified when observed by someone, either a professional in the field or by a third-party witness that reports the situation. 3. 3. 3. 3. id="p-3" id="p-3"

[0003] Certain types of abnormal behaviour can create great personal suffering.Hence, it would be of great benefit if there were to be a way to automatically flag up potential abnormal behaviour. Such instances could then be manually evaluated.

SUMMARY 4. 4. 4. 4. id="p-4" id="p-4"

[0004] One object is to improve identification of abnormal behaviour. . . . . id="p-5" id="p-5"

[0005] According to a first aspect, it is provided a method for identifying abnormalbehaviour of a user. The method is performed in a behaviour determiner. The methodcomprises: obtaining, from an access control system, access data of the user, the accessdata indicating when the user has accessed an electronic lock in the access controlsystem to gain access to a physical space secured by the electronic lock; and determining that the access data indicates abnormal behaviour. 6. 6. 6. 6. id="p-6" id="p-6"

[0006] The determining may comprise determining that the access data indicatesabnormal behaviour when the access data indicates that the user accesses an electronic lock less than a threshold amount. 7. 7. 7. 7. id="p-7" id="p-7"

[0007] The determining may comprises determining that the access data indicatesabnormal behaviour when the access data indicates that the user accesses an electronic lock more than a threshold amount. 8. 8. 8. 8. id="p-8" id="p-8"

[0008] The determining may comprise determining that the access data indicatesabnormal behaviour when the access data indicates that the user deviates more than a threshold from average behaviour of other users of the access control system. 9. 9. 9. 9. id="p-9" id="p-9"

[0009] The determining may comprise determining that the access data indicates abnormal behaviour based on a machine learning, ML, model.[0010] The ML model may comprise both a local ML model and a central ML model.[0011] The determining may be based also on a current time. 12. 12. 12. 12. id="p-12" id="p-12"

[0012] The method may further comprise: transmitting an alert message, indicating that the user exhibits abnormal behaviour. 13. 13. 13. 13. id="p-13" id="p-13"

[0013] The method may be repeated, in which case the determining comprisesdetermining an increased level of confidence of abnormal behaviour, when abnormal behaviour is repeatedly determined in successive iterations of the method. 14. 14. 14. 14. id="p-14" id="p-14"

[0014] The method may further comprise: obtaining auxiliary data; in which case the step of determining is based also on the auxiliary data. . . . . id="p-15" id="p-15"

[0015] The auxiliary data may comprise energy consumption of a dwelling of the user, secured by the electronic lock.[0016] The auxiliary data may comprise wireless-traffic data of the user. 17. 17. 17. 17. id="p-17" id="p-17"

[0017] According to a second aspect, it is provided a behaviour determiner foridentifying abnormal behaviour of a user. The behaviour determiner comprises: aprocessor; and a memory storing instructions that, when executed by the processor,cause the behaviour determiner to: obtain, from an access control system, access data of the user, the access data indicating when the user has accessed an electronic lock in the 3 access control system to gain access to a physical space secured by the electronic lock; and determine that the access data indicates abnormal behaviour. 18. 18. 18. 18. id="p-18" id="p-18"

[0018] The instructions to determine may comprise instructions that, when executedby the processor, cause the behaviour determiner to determine that the access dataindicates abnormal behaviour when the access data indicates that the user accesses an electronic lock less than a threshold amount. 19. 19. 19. 19. id="p-19" id="p-19"

[0019] The instructions to determine may comprise instructions that, when executedby the processor, cause the behaviour determiner to determine that the access dataindicates abnormal behaviour when the access data indicates that the user accesses an electronic lock more than a threshold amount. . . . . id="p-20" id="p-20"

[0020] The instructions to determine may comprise instructions that, when executedby the processor, cause the behaviour determiner to determine that the access dataindicates abnormal behaviour when the access data indicates that the user deviatesmore than a threshold from average behaviour of other users of the access control system. 21. 21. 21. 21. id="p-21" id="p-21"

[0021] The instructions to determine may comprise instructions that, when executedby the processor, cause the behaviour determiner to determine that the access data indicates abnormal behaviour based on a machine learning, ML, model.[0022] The ML model may comprise both a local ML model and a central ML model. 23. 23. 23. 23. id="p-23" id="p-23"

[0023] The instructions to determine comprise instructions that, when executed bythe processor, cause the behaviour determiner to determine that the access data indicates abnormal behaviour based also on a current time. 24. 24. 24. 24. id="p-24" id="p-24"

[0024] The behaviour determiner may further comprise instructions that, whenexecuted by the processor, cause the behaviour determiner to: transmit an alert message, indicating that the user exhibits abnormal behaviour. . . . . id="p-25" id="p-25"

[0025] The behaviour determiner according may further comprise instructions that,when executed by the processor, cause the behaviour determiner to repeat the instructions to obtain and determine, and wherein the instructions to determine 4 comprise instructions that, when executed by the processor, cause the behaviourdeterminer to determine an increased level of confidence of abnormal behaviour, when abnormal behaviour is repeatedly determined in successive iterations of the method. 26. 26. 26. 26. id="p-26" id="p-26"

[0026] The behaviour determiner may further comprise instructions that, whenexecuted by the processor, cause the behaviour determiner to: obtain auxiliary data, inwhich case the instructions to determine comprise instructions that, when executed bythe processor, cause the behaviour determiner to determine abnormal behaviour also based on the auxiliary data. 27. 27. 27. 27. id="p-27" id="p-27"

[0027] The auxiliary data may comprise energy consumption of a dwelling of the user, secured by the electronic lock.[0028] The auxiliary data may comprise wireless-traffic data of the user. 29. 29. 29. 29. id="p-29" id="p-29"

[0029] According to a third aspect, it is provided a computer program for identifyingabnormal behaviour of a user. The computer program comprises computer programcode which, when executed on a behaviour determiner causes the behaviour determinerto: obtain, from an access control system, access data of the user, the access dataindicating when the user has accessed an electronic lock in the access control system togain access to a physical space secured by the electronic lock; and determine that the access data indicates abnormal behaviour. . . . . id="p-30" id="p-30"

[0030] According to a fourth aspect, it is provided a computer program productcomprising a computer program according to the third aspect and a computer readable means on which the computer program is stored. 31. 31. 31. 31. id="p-31" id="p-31"

[0031] Generally, all terms used in the claims are to be interpreted according to theirordinary meaning in the technical field, unless explicitly defined otherwise herein. Allreferences to "a/ an /the element, apparatus, component, means, step, etc." are to beinterpreted openly as referring to at least one instance of the element, apparatus,component, means, step, etc., unless explicitly stated otherwise. The steps of anymethod disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.

BRIEF DESCRIPTION OF THE DRAWINGS 32. 32. 32. 32. id="p-32" id="p-32"

[0032] Aspects and embodiments are now described, by way of example, with refer- ence to the accompanying drawings, in which: 33. 33. 33. 33. id="p-33" id="p-33"

[0033] Fig 1 is a schematic diagram illustrating an environment in which embodiments presented herein can be applied; 34. 34. 34. 34. id="p-34" id="p-34"

[0034] Figs 2A-D are schematic diagrams illustrating embodiments of where the behaviour determiner can be implemented; . . . . id="p-35" id="p-35"

[0035] Fig 3 is a flow chart illustrating embodiments of methods for identifying abnormal behaviour of a user; 36. 36. 36. 36. id="p-36" id="p-36"

[0036] Fig 4 is a schematic diagram illustrating components of the behaviour determiner of Figs 2A-D according to one embodiment; and 37. 37. 37. 37. id="p-37" id="p-37"

[0037] Fig 5 shows one example of a computer program product comprising computer readable means.

DETAILED DESCRIPTION 38. 38. 38. 38. id="p-38" id="p-38"

[0038] The aspects of the present disclosure will now be described more fullyhereinafter with reference to the accompanying drawings, in which certainembodiments of the invention are shown. These aspects may, however, be embodied inmany different forms and should not be construed as limiting; rather, theseembodiments are provided by way of example so that this disclosure will be thoroughand complete, and to fully convey the scope of all aspects of invention to those skilled in the art. Like numbers refer to like elements throughout the description. 39. 39. 39. 39. id="p-39" id="p-39"

[0039] According to embodiments presented herein, a behaviour determiner usesaccess data from an access control system to determine abnormal behaviour. This canbe used e.g. to detect when someone has fallen ill or certain criminal activity. The accessdata from access control systems, e.g. for a residential property for multiple residents, isoften collected in any case. Hence, this data is often readily available and can be used to efficiently determine abnormal behaviour. Since this process can, to a large extent, be automated, this allows cases to be flagged up earlier than with traditional methods, whereby more of these cases do not go unnoticed. 40. 40. 40. 40. id="p-40" id="p-40"

[0040] Fig 1 is a schematic diagram illustrating an environment in whichembodiments presented herein can be applied. An (electronic) access control system 10contains a plurality of electronic locks 12a-i and optionally one or more online components, such as a server 3. 41. 41. 41. 41. id="p-41" id="p-41"

[0041] A set of electronic locks 12a-i are provided in a building 20, for securingaccess to respective physical spaces (i.e. rooms or set of rooms) 16a-i, by selectivelylocking or unlocking respective doors 15a-i. It is to be noted that more buildings withrespective electronic locks can be provided, forming part of the same access control system 10. The building 20 can e.g. be a residential property for multiple residents. 42. 42. 42. 42. id="p-42" id="p-42"

[0042] A first user 6a carries a first electronic key device 2a. The first electronic keydevice 2a can be in any suitable format that allows an electronic lock to communicate(wirelessly or conductively) with the electronic key device to evaluate whether to grantaccess. For instance, the first electronic key device 2a can be in the form of a key fob, akey card, a hybrid mechanical/ electronic key or a smartphone. Depending on the accessrights for the first electronic key device 2a, it can be used to unlock one or more of theelectronic locks 12a-i. Analogously, a second user 6b is shown carrying a secondelectronic key device 2b, which can be of the same type or a different type compared to the first electronic key device. 2a. 43. 43. 43. 43. id="p-43" id="p-43"

[0043] The physical spaces 16a-i have different purposes. In this example, thebuilding 20 is a college dormitory with a common area 16a, a kitchen 16b and a corridor16c. Additionally, there are six dormitory rooms 16d-i. The first user 6a is here located outside the building 20, while the second user 6b is in her dormitory room 16e. 44. 44. 44. 44. id="p-44" id="p-44"

[0044] It is to be noted that, while two electronic key devices 2a-b and two users 6a-b are shown in Fig 1, there can be any suitable number of users with respective electronic key devices. 45. 45. 45. 45. id="p-45" id="p-45"

[0045] The server 3 can be used to control access rights for electronic key devices in the access control system 10 and can be provided in what is sometimes known as “the 7 cloud”. The server 3 can be connected to a communication network 7, which can be anInternet protocol (IP) based network. The communication network 7 can e.g. compriseany one or more of a wired local area network, a local wireless network, a cellularnetwork, a wide area network (such as the Internet), etc. The communication network 7can be used for communication between the server 3 and any online components of theaccess control system 10, e.g. all or a subset of the electronic locks 12a-i and/ or the electronic key devices 2a-b. 46. 46. 46. 46. id="p-46" id="p-46"

[0046] When one of the electronic key device 2a-b is brought up to one of theelectronic locks 12a-i, the electronic lock in question checks the access rights for theelectronic key device to determine whether to grant or deny access, according to anysuitable method. For instance, the access rights can be supplied by the electronic keydevices 2a-b to the electronic lock, in which case the access rights can becryptographically signed and/ or encrypted by a party trusted by the electronic lock, suchas the server 3. Alternatively, the electronic lock is online and, after obtaining theidentity of the electronic key devices 2a-b, the electronic lock checks with the server 3 todetermine whether the electronic key device is to be allowed access. Alternatively oradditionally, the electronic lock has access (locally or remotely) to white lists (indicatingidentities of electronic key devices to be granted access) and/ or blacklists (indicating identities of electronic key devices to be denied access). 47. 47. 47. 47. id="p-47" id="p-47"

[0047] Figs 2A-D are schematic diagrams illustrating embodiments of where the behaviour determiner 1 can be implemented. 48. 48. 48. 48. id="p-48" id="p-48"

[0048] In Fig 2A, the behaviour determiner 1 is shown implemented in the server 3.The server 3 is thus the host device for the behaviour determiner 1 in thisimplementation. The behaviour determiner 1 can be based on a central ML model in theserver 3 and/ or based on rule-based logic. When implemented in the server 3, thebehaviour determiner has access to significant resources, e.g. in terms of processing power, memory, power, etc. 49. 49. 49. 49. id="p-49" id="p-49"

[0049] In Fig 2B, the behaviour determiner 1 is shown implemented in the electronickey device 2, e.g. one of the electronic key devices 2a-b of Fig 1. The electronic key device 2 is thus the host device for the behaviour determiner 1 in this implementation. 8 In this case, the electronic key device 2 can e.g. be a smartphone, capable of running a local ML model and/ or rule-based logic. 50. 50. 50. 50. id="p-50" id="p-50"

[0050] In Fig 2C, the behaviour determiner 1 is shown implemented in one or moreelectronic lock 12 (corresponding to the electronic locks 12a-i of Fig 1). The electroniclock 12 is thus the host device for the behaviour determiner 1 in this implementation.

The lock 12 is then capable of running a local ML model and/ or rule-based logic. 51. 51. 51. 51. id="p-51" id="p-51"

[0051] In Fig 2D, the behaviour determiner 1 is shown implemented as a stand-alonedevice. The behaviour determiner 1 thus does not have a host device in thisimplementation. The behaviour determiner 1 is capable of running a local ML model, a central ML model and/ or rule-based logic. 52. 52. 52. 52. id="p-52" id="p-52"

[0052] Fig 3 is a flow chart illustrating embodiments of methods for identifyingabnormal behaviour of a user 6a, 6b. The method is performed in a behaviourdeterminer 1. The method is performed for a single user, but multiple instances of the method can run in parallel for respective users. 53. 53. 53. 53. id="p-53" id="p-53"

[0053] In an obtain access data step 40, the behaviour determiner 1 obtains, froman access control system 10, access data of the user 6a, 6b. The access data indicateswhen the user has accessed an electronic lock 12a-i in the access control system to gainaccess to a physical space secured by the electronic lock 12a-i. Hence, the access datacan be in the form of access logs. This access data is relatively easy to obtain from theaccess control system 10, since this data is readily available. It is to be noted that accessdata indicating no access for the user is also valuable access data, as long as the access data covers a meaningful time period. 54. 54. 54. 54. id="p-54" id="p-54"

[0054] In an optional obtain auxiliary data step 42, the behaviour determiner 1obtains auxiliary data. The auxiliary data can e. g. comprise energy consumption of adwelling 16d-i of the user, secured by the electronic lock 12a-i. Alternatively oradditionally, the auxiliary data may comprise wireless-traffic data of the user, e.g. in theform of WiFi-traffic data and/ or cellular-traffic data. 55. 55. 55. 55. id="p-55" id="p-55"

[0055] In a conditional abnormal behaviour step 44, the behaviour determiner 1 determines that the access data indicates abnormal behaviour. This can be determined 9 by first determining a percentage, indicating a level of confidence of abnormalbehaviour. This level of confidence can then be converted to a threshold level toconclude whether abnormal behaviour is determined or not. This threshold level can beconfigured and reconfigured to adjust the sensitivity of the determining of abnormalbehaviour. When abnormal behaviour is determined, this is used for other processing,or the method proceeds to an optional transmit alert message step 46. When abnormalbehaviour is not determined, the method returns to the obtain access data 40, optionally after a wait period (not shown). 56. 56. 56. 56. id="p-56" id="p-56"

[0056] The determining can comprise determining that the access data indicatesabnormal behaviour when the access data indicates that the user accesses an electroniclock less than a threshold amount. For instance, if the access data indicates that user hasnot accessed any of the electronic locks for a period longer than a threshold time, thiscan be an indictor of abnormal behaviour, e.g. due to the user having a health emergency and being incapacitated. 57. 57. 57. 57. id="p-57" id="p-57"

[0057] Alternatively, the determining can comprise determining that the access dataindicates abnormal behaviour when the access data indicates that the user accesses anelectronic lock more than a threshold amount. For instance, if there are openings on aregular basis throughout the night, particularly if the electronic lock is then unlocked from the inside, this can be an indication of drug sales or prostitution. 58. 58. 58. 58. id="p-58" id="p-58"

[0058] The degree of abnormality can also be determined from how much the userdeviates from the average behaviour of other users of the access control system. This canprevent e.g. inactivity from being considered abnormal behaviour in a college dormitory in the summertime, when nobody is living there. 59. 59. 59. 59. id="p-59" id="p-59"

[0059] The determination of whether abnormal behaviour exists can be based on amachine learning (ML) model. An ML model can be trained to detect the types ofabnormal behaviours that are desired to be detected, and thus can be tailored accordingly. 1O 60. 60. 60. 60. id="p-60" id="p-60"

[0060] The ML model can be locally based, on a local model e.g. in the electronic keydevice or the electronic lock. Alternatively, the ML model can be centrally based, on a central model in the server 3 or in a stand-alone behaviour determiner 1. 61. 61. 61. 61. id="p-61" id="p-61"

[0061] In one embodiment, the ML model comprises both a local ML model and acentral ML model, in a distributed ML architecture. In a distributed ML architecture,the local ML can be of a simpler type and the central model can then be used to obtain asecond opinion on determinations by the local ML model. Alternatively, thedeterminations of the local ML model and the central ML model determine their ownlevels of confidence and these are combined with different weights, to gain a compositelevel of confidence. The level of confidence is then compared to the level threshold todetermine if abnormal behaviour exists or not. When ML is first used, an initial modelcan be based on a base model for a certain demographic group (age, sex, etc. ). Thisinitial model can then be tailored using continuous learning to learn what is normal and what is abnormal behaviour for the particular user. 62. 62. 62. 62. id="p-62" id="p-62"

[0062] The determining can also be based also on a current time. For instance,certain behaviour can be normal when it occurs in the afternoon, but abnormal when it occurs in the middle of the night. 63. 63. 63. 63. id="p-63" id="p-63"

[0063] When step 42 is performed, the abnormal behaviour determining is basedalso on the auxiliary data. For instance, if energy consumption is reduced withoutexplanation (e.g. when compared to other users), this can indicate a health emergency.Similarly, longer-than-expected absence of data wireless-data traffic can indicate a health emergency. 64. 64. 64. 64. id="p-64" id="p-64"

[0064] In optional transmit alert message step 46, the behaviour determiner 1transmits an alert message, indicating that the user exhibits abnormal behaviour. Thiscan e. g. be transmitted to a security company employing security agents that can go and check on the user to see if she/ he is ok. 65. 65. 65. 65. id="p-65" id="p-65"

[0065] The method can be repeated. In this case, the conditional abnormal behaviour step 44 step can comprise determining an increased level of confidence of 11 abnormal behaviour when abnormal behaviour is repeatedly determined in successive iterations of the method. 66. 66. 66. 66. id="p-66" id="p-66"

[0066] It is to be noted that the determination of abnormal behaviour is not decisive;the determination of abnormal behaviour results is an indication that should be verified by other means, e.g. by manual confirmation. 67. 67. 67. 67. id="p-67" id="p-67"

[0067] Fig 4 is a schematic diagram illustrating components of the behaviourdeterminer 1 of Figs 2A-D. It is to be noted that, when implemented in a host device,one or more of the mentioned components can be shared with the host device. Aprocessor 60 is provided using any combination of one or more of a suitable centralprocessing unit (CPU), graphics processing unit (GPU), multiprocessor, microcontroller,digital signal processor (DSP), etc., capable of executing software instructions 67 storedin a memory 64, which can thus be a computer program product. The processor 60could alternatively be implemented using an application specific integrated circuit(ASIC), field programmable gate array (FPGA), etc. The processor 60 can be configured to execute the method described with reference to Fig 3 above. 68. 68. 68. 68. id="p-68" id="p-68"

[0068] The memory 64 can be any combination of random-access memory (RAM)and/ or read-only memory (ROM). The memory 64 also comprises persistent storage,which, for example, can be any single one or combination of magnetic memory, optical memory, solid-state memory or even remotely mounted memory. 69. 69. 69. 69. id="p-69" id="p-69"

[0069] A data memory 66 is also provided for reading and/ or storing data duringexecution of software instructions in the processor 60. The data memory 66 can be anycombination of RAM and/ or ROM. 70. 70. 70. 70. id="p-70" id="p-70"

[0070] The behaviour determiner 1 further comprises an I/ O interface 62 forcommunicating with external and/ or internal entities. Optionally, the I/ O interface 62 also includes a user interface. 71. 71. 71. 71. id="p-71" id="p-71"

[0071] Other components of the behaviour determiner 1 are omitted in order not to obscure the concepts presented herein. 12 72. 72. 72. 72. id="p-72" id="p-72"

[0072] Fig 5 shows one example of a computer program product 90 comprisingcomputer readable means. On this computer readable means, a computer program 91can be stored, which computer program can cause a processor to execute a methodaccording to embodiments described herein. In this example, the computer programproduct is in the form of a removable solid-state memory, e.g. a Universal Serial Bus(USB) drive. As explained above, the computer program product could also be embodiedin a memory of a device, such as the computer program product 64 of Fig ###. Whilethe computer program 91 is here schematically shown as a section of the removablesolid-state memory, the computer program can be stored in any way which is suitablefor the computer program product, such as another type of removable solid-statememory, or an optical disc, such as a CD (compact disc), a DVD (digital versatile disc) or a Blu-Ray disc. 73. 73. 73. 73. id="p-73" id="p-73"

[0073] The aspects of the present disclosure have mainly been described above withreference to a few embodiments. However, as is readily appreciated by a person skilledin the art, other embodiments than the ones disclosed above are equally possible withinthe scope of the invention, as defined by the appended patent claims. Thus, whilevarious aspects and embodiments have been disclosed herein, other aspects andembodiments will be apparent to those skilled in the art. The various aspects andembodiments disclosed herein are for purposes of illustration and are not intended to be limiting, with the true scope and spirit being indicated by the following claims.

Claims (26)

1. A method for identifying abnormal behaviour of a user (6a, 6b), the method beingperformed in a behaviour determiner (1), the method comprising:obtaining (40), from an access control system (10), access data of the user (6a, 6b), the access data indicating when the user has accessed an electronic lock (12a-i) in theaccess control system to gain access to a physical space secured by the electronic lock(12a-i); and determining (44) that the access data indicates abnormal behaviour.

2. The method according to claim 1, wherein the determining (44) comprisesdetermining that the access data indicates abnormal behaviour when the access data indicates that the user accesses an electronic lock less than a threshold amount.

3. The method according to claim 1 or 2, wherein the determining (44) comprisesdetermining that the access data indicates abnormal behaviour when the access data indicates that the user accesses an electronic lock more than a threshold amount.

4. The method according to any one of the preceding claims, wherein the determining(44) comprises determining that the access data indicates abnormal behaviour when theaccess data indicates that the user deviates more than a threshold from average behaviour of other users of the access control system.

5. The method according to any one of the preceding claims, wherein the determining(44) comprises determining that the access data indicates abnormal behaviour based on a machine learning, ML, model.

6. The method according to claim 5, wherein the ML model comprises both a localML model and a central ML model.

7. The method according to any one of the preceding claims, wherein the determining (44) is based also on a current time.

8. The method according to any one of the preceding claims, further comprising:transmitting (46) an alert message, indicating that the user exhibits abnormal behaviour.

9. The method according to any one of the preceding claims, wherein the method isrepeated and wherein the determining (44) comprises determining an increased level ofconfidence of abnormal behaviour, when abnormal behaviour is repeatedly determined in successive iterations of the method.

10. The method according to any one of the preceding claims, further comprising:obtaining (42) auxiliary data; and wherein the step of determining (44) is based also on the auxiliary data.

11. The method according to claim 10, wherein the auxiliary data comprises energy consumption of a dwelling (16d-i) of the user, secured by the electronic lock (12a-i).

12. The method according to claim 10 or 11, wherein the auxiliary data comprises wireless-traffic data of the user.

13. A behaviour determiner (1) for identifying abnormal behaviour of a user (6a, 6b),the behaviour determiner (1) comprising: a processor (60); and a memory (64) storing instructions (67) that, when executed by the processor,cause the behaviour determiner (1) to: obtain, from an access control system (10), access data of the user (6a, 6b), theaccess data indicating when the user has accessed an electronic lock (12a-i) in the accesscontrol system to gain access to a physical space secured by the electronic lock (12a-i);and determine that the access data indicates abnormal behaviour.

14. The behaviour determiner (1) according to claim 13, wherein the instructions todetermine comprise instructions (67) that, when executed by the processor, cause thebehaviour determiner (1) to determine that the access data indicates abnormalbehaviour when the access data indicates that the user accesses an electronic lock less than a threshold amount.

15. The behaviour determiner (1) according to claim 13 or 14, wherein the instructionsto determine comprise instructions (67) that, when executed by the processor, cause thebehaviour determiner (1) to determine that the access data indicates abnormalbehaviour when the access data indicates that the user accesses an electronic lock more than a threshold amount.

16. The behaviour determiner (1) according to any one of claims 13 to 15, wherein theinstructions to determine comprise instructions (67) that, when executed by theprocessor, cause the behaviour determiner (1) to determine that the access dataindicates abnormal behaviour when the access data indicates that the user deviatesmore than a threshold from average behaviour of other users of the access control system.

17. The behaviour determiner (1) according to any one of claims 13 to 16, wherein theinstructions to determine comprise instructions (67) that, when executed by theprocessor, cause the behaviour determiner (1) to determine that the access data indicates abnormal behaviour based on a machine learning, ML, model.

18. The behaviour determiner (1) according to claim 17, wherein the ML model comprises both a local ML model and a central ML model.

19. The behaviour determiner (1) according to claim 18, wherein the instructions todetermine comprise instructions (67) that, when executed by the processor, cause thebehaviour determiner (1) to determine that the access data indicates abnormal behaviour based also on a current time.

20. The behaviour determiner (1) according to any one of claims 13 to 19, furthercomprising instructions (67) that, when executed by the processor, cause the behaviourdeterminer (1) to: transmit an alert message, indicating that the user exhibits abnormal behaviour.

21. The behaviour determiner (1) according to any one of claims 13 to 20, furthercomprising instructions (67) that, when executed by the processor, cause the behaviourdeterminer (1) to repeat the instructions to obtain and determine, and wherein theinstructions to determine comprise instructions (67) that, when executed by theprocessor, cause the behaviour determiner (1) to determine an increased level ofconfidence of abnormal behaviour, when abnormal behaviour is repeatedly determined in successive iterations of the method.

22. The behaviour determiner (1) according to any one of claims 13 to 21, furthercomprising instructions (67) that, when executed by the processor, cause the behaviourdeterminer (1) to: obtain auxiliary data;and wherein the instructions to determine comprise instructions (67) that, whenexecuted by the processor, cause the behaviour determiner (1) to determine abnormal behaviour also based on the auxiliary data.

23. The behaviour determiner (1) according to claim 22, wherein the auxiliary datacomprises energy consumption of a dwelling (16d-i) of the user, secured by the electronic lock (12a-i).

24. The behaviour determiner (1) according to claim 22 or 23, wherein the auxiliary data comprises wireless-traffic data of the user.

25. A computer program (67, 91) for identifying abnormal behaviour of a user (6a, 6b),the computer program comprising computer program code which, when executed on abehaviour determiner (1) causes the behaviour determiner (1) to:obtain, from an access control system (10), access data of the user (6a, 6b), the access data indicating when the user has accessed an electronic lock (12a-i) in the accesscontrol system to gain access to a physical space secured by the electronic lock (12a-i);and determine that the access data indicates abnormal behaviour.

26. A computer program product (64, 90) comprising a computer program according to claim 25 and a computer readable means on which the computer program is stored.