WO2011006210A1

WO2011006210A1 - Intrusion detection

Info

Publication number: WO2011006210A1
Application number: PCT/AU2010/000909
Authority: WO
Inventors: Seedahmed Mahmoud
Original assignee: Future Fibre Technologies Pty Ltd
Priority date: 2009-07-17
Filing date: 2010-07-16
Publication date: 2011-01-20

Abstract

An intrusion detection system for generating alarm signals on detection of intrusion events is able to discriminate between intrusion events and nuisance events such as wind, rain, vehicular traffic and other environmentally related non-intrusion events. A signal monitor monitors a time variable detected signal for a occurrence of a signal characteristic indicative of a detected event. A signal processor is operative on a detected event to evaluate whether over a time interval the detected signal satisfies a combination of separate criteria indicating an intrusion event or a different combination of separate criteria indicative of a nuisance event and to generate an alarm signal only if the evaluation is indicative of an intrusion event. In one system, the signal characteristic indicative of a detected event occurs when the detected signal exceeds a level crossing threshold and the signal processor is configured to extract from the detected signal a measure of continuity of signal over the time interval, a maximum signal amplitude strength measure and a maximum amplitude deviation measure and to perform a decision tree process in which successive decisions are made as to whether a combination of criteria identifying an intrusion event has occurred.

Description

INTRUSION DETECTION

Field of the Invention

This invention relates to intrusion detection systems and methods for detecting intrusions in or on buildings or other structures or into particular locations . The invention has particular, but not exclusive, application to intrusion detection systems which employ buried sensors , for example buried fibre optic sensors .

Background of the Invention

One of the challenges of all sensing systems is to be able to operate in a number of hostile environments. Intrusion detection systems which are often installed in outdoor environments are no exception. These systems often need to operate during periods of heavy wind or rain , or close to nearby traffic carriageways or other non-intrusion related disturbances .

In any sensing system, a nuisance alarm can be considered as an alarm caused by an event that is not of interest for that sensing system. For intrusion detection systems, this relates to non-intrusion events such as wind, rain, vehicular traffic and other environmentally related nonintrusion events . Nuisance alarms can adversely affect the performance of intrusion detection systems, as well as the confidence of the system operator. The minimization of the nuisance alarm rate of intrusion detection systems , and indeed of any sensing system, is therefore critical for its successful performance and confidence of operation. An important part of nuisance alarm handling involves being able to recognize the nuisance event being detected by the sensing system, as well as being able to discriminate between nuisance events and intrusion events. Buried-fibre optic sensors which are designed to detect physical disturbances generated by third party interference (TPI) and tampering activities, such as those implemented for protecting oil and gas pipelines as well as communications links , are particularly susceptible to a range of ground based nuisance events such as road and railway traffic and other nearby construction activities . These events can reduce an intrusion detection system' s effectiveness with an unacceptably high rate of nuisance alarms. It is therefore important to reduce the effect of these nuisance events without compromising the system' s overall sensitivity or capability to recognise valid intrusion signals .

Summary of the Invention

According to one aspect the invention may provide a method of processing a time variable detected signal in an intrusion detection system to produce alarm signals indicative of intrusion events, comprising:

monitoring the signal for occurrence of a signal characteristic indicative of a detected event,

for a detected event evaluating whether over a time interval the detected signal satisfies a combination of separate criteria indicating an intrusion event or a different combination of said separate criteria indicative of a nuisance event, and

generating an alarm signal only if the evaluation determines that the detected signal satisfies the combination indicating an intrusion event.

Said signal characteristic may occur when the detected signal exceeds a threshold rate of level crossings , where each level crossing occurs when the detected signal goes from below a set level to above that level . The method may further comprise extracting from the detected signal over said time interval a plurality of features with potential to discriminate between intrusion events and nuisance events,

setting thresholds for said plurality of features , and

determining said separate criteria according to whether the features exceed or do not exceed the respective thresholds for said features .

Evaluation of whether the separate feature criteria satisfy a combination indicative of an intrusion event or a different combination indicative of a nuisance event may be carried out by a decision tree process in which successive decisions are made as to the feature criteria of differing features .

One of said features may be a measure of continuity of signal over the time domain and the decision tree process may require determination as to whether the continuity of signal measure exceeds or does not exceed the respective threshold for that measure before proceeding to a decision in relation to any other of said features .

Said features may also include any one or more of a maximum signal amplitude strength measure and a maximum signal amplitude deviation measure.

According to another aspect the invention may provide a method of protecting a location against intrusion, comprising

monitoring a sensing device producing a time variable detected signal sensitive to intrusion at said location,

processing said detected signal by a method as defined above, and producing an alarm in response to an alarm signal indicative of an intrusion event at said location .

The sensing device may comprise a sensor element buried at said location.

The sensor may be a buried fibre optic sensor and the monitoring step may comprise launching light into a wave guide so that light is caused to propagate through the wave guide, and detecting the light propagating through the wave guide to produce said time variable signals.

According to a further aspect the invention may provide apparatus for processing a time variable detected signal in an intrusion detection system so as to produce alarm signals indicative of intrusion events, comprising a signal monitor for monitoring the detected signal for occurrence of a signal characteristic indicative of a detected event, and

a signal processor operative on a detected event to evaluate whether over a time interval the detected signal satisfies a combination of separate criteria indicating an intrusion event or a different combination of separate criteria indicative of a nuisance event and to generate an alarm signal only if the evaluation is indicative of an intrusion event.

The signal processor may be operative to extract from the detected signal over said time interval a plurality of features with potential to discriminate between intrusion events and nuisance events , to set thresholds for said plurality of features , and to determine said separate criteria according to whether the features exceed or do not exceed the respective thresholds for said features . The signal processor may be configured to perform a decision tree process in which successive decisions are made as to the feature criteria of differing features .

According to a further aspect the invention may provide an intrusion detection system for monitoring a location against intrusion, comprising

a sensing device for producing a time variable detected signal affected by intrusion at the location to be monitored; and

a signal processing apparatus as defined above to process the detected signal produced by the sensing device and to produce an alarm signal in response to an intrusion at said location.

The sensing device may comprise a sensor to be buried at said location, for example an optical fibre sensor.

The sensing device may comprise a light source , a wave guide for receiving light from the light source so that light is caused to propagate through the wave guide, and a detector for detecting the light propagating through the wave guide and to produce said time variable signals.

The invention may be applied to an intrusion detection system of the type described in US patents 6621947 and 6778717, and US patent application 11/311,009. This system is based on a bidirectional Mach Zehnder (MZ) which can be used as a distributed sensor to detect and locate a perturbation anywhere along its sensing arms . It will be referred to as a locator sensor. The content of this patent and the application are incorporated into this specification by this reference . Some of the content of WO 2008/119107 may also be useful in the implementation of the present invention and the contents of that publication is also incorporated into this specification by this reference . Brief Description of the Drawings

In order that the invention may be more fully explained one particular method and apparatus will be described by way of example with reference to the accompanied drawings , in which:

Figure 1 illustrates a basic locator system using a bi-directional MZ with input polarization control;

Figure 2 illustrates a cross-section of a buried fibre optic intrusion detection system for detection of third-party interference to a buried pipeline;

Figure 3 illustrates an intrusion signal caused by digging with a pick-axe above a buried gas pipeline protected by a locator intrusion detection system;

Figure 4 illustrates an intrusion signal caused by digging with a backhoe above a buried gas pipeline protected by a locator intrusion detection system;

Figure 5 illustrates an intrusion signal caused by digging with a pick-axe above a buried oil pipeline protected by a locator intrusion system;

Figure 6 illustrates an intrusion signal caused by digging with an excavator at 1 meter above a buried fibre optic cable at a digging test site;

Figure 7 illustrates an intrusion signal caused by digging with a backhoe above a buried oil pipeline protected by a locator intrusion detection system over a time period of 102.5ms; Figure 8 illustrates a nuisance signal from traffic on a nearby road for a gas pipeline intrusion detection system;

Figure 9 illustrates a strong periodic nuisance signal from a railway crossing for a gas pipeline intrusion detection system, the railway running perpendicularly over the pipeline;

Figure 10 illustrates a nuisance signal from a train on a nearby railway for an oil pipeline intrusion detection system;

Figure 11 illustrates a nuisance signal from an excavator in the vicinity of a buried intrusion detection system;

Figure 12 illustrates a low level nuisance signal from traffic on a nearby road for a buried oil pipeline intrusion detection system;

Figure 13 illustrates a nuisance signal from traffic on a nearby road for a buried oil pipeline intrusion detection system;

Figure 14 illustrates a time domain nuisance signal caused by a road crossing perpendicularly over an oil pipeline intrusion detection system;

Figure 15 is a block diagram illustrating the operation of a signal processor operable in accordance with the invention to extract features from a detected signal for discriminating between nuisance events and intrusion events;

Figures 16 to 20 illustrate how the signal is analysed to extract the discriminating features; and Figure 21 illustrates a decision tree for implementing a nuisance suppression algorithm.

Figure 22 to Figure 26 illustrate the evaluation of various signals obtained from one particular buried gas pipeline intrusion detection system.

Detailed Description of the Preferred Embodiments

Most buried fibre-optic intrusion detection systems operate close to sources of nuisance alarms which can typically include traffic from road or railway crossings , as well as nearby excavation equipment. The effectiveness of such an intrusion detection system depends on how well it can suppress any alarms caused by these nuisance events .

Figures 3 to 14 show some examples of intrusion and nuisance signals recorded by a number of buried pipeline intrusion detection systems. These systems use a locator which is based on a bidirectional fibre optic Mach Zehnder to detect third party interference on a buried gas or oil pipeline as illustrated in Figures 1 and 2.

The Locator sensor locates perturbations on its sensing arms by using the difference in time of arrival of the counter-propagating signals at Detl and Det2. By implementing the bidirectional Mach Zehnder in a fibre optic cable , it is possible to use a buried fibre cable to detect ground vibrations . The sensing cable can be buried next to an underground pipeline to detect third party interference (TPI) activities. Inevitably it will also be sensitive to other non-intrusion events such as those from nearby traffic and railway crossings . To be able to discriminate between different intrusion and nuisance events such as those described above, it is necessary to study these signals from buried systems to determine which signal features can be used to ultimately suppress nuisance alarms .

Intrusion signals

Figures 3 to 7 show examples of digging induced intrusion events from a number of sites with cables placed next to buried pipelines. These signals are typical of that obtained from these events . Figures 3 to 7 are represented as a voltage amplitude versus sample number where the sample rate is 4OkHz. Each sample increment corresponds to a time increment of 25 microseconds .

It can be seen from Figures 3 to 7 that the digging events produce signals with relatively high amplitudes and varying continuities . These features will be an important consideration when devising a nuisance suppression technique .

Nuisance signals

Figures 8 to 14 show examples of signals generated by nuisance events from a number of sites with cables placed next to buried pipelines . These signals are typical of those obtained from these events for buried locator systems . The sample rate is 4OkHz .

On comparing the different nuisance signals shown in Figures 8 to 14 with the digging intrusion signals of Figures 3 to 7 it can be seen that nuisance signals from nearby road or railway traffic on carriageways that run along the buried pipelines give relatively lower amplitude but higher continuity signals as is seen in Figures 8, 10, 11, 12 and 13. These traffic nuisances will be referred to as adjacent traffic.

For road or rail crossings that run over a buried intrusion detection system, the nuisance signals caused by associated traffic show higher amplitude and transient behaviour, as well as some periodicity or heartbeat-like features. This would be due to the impact of vehicle axles as they pass over the buried sensing cable . This type of traffic nuisance will be referred to as crossing traffic. A train with a large number of equally spaced wheel axles would give more periodic signals of this type when compared to a road with numerous different vehicles crossing. Figure 9 is an example of a nuisance signal caused by a railway crossing that runs over the intrusion detection system. Figure 14 is an example of the nuisance signals received from a road which crosses over a buried intrusion detection system with no periodicity, that is, more like an irregular heartbeat. This would correspond to the irregular crossings of vehicles with 2 or a few axles at the most.

Whilst it appears relatively simple to discriminate between traffic noise from nearby carriageways which run along the intrusion detection system and those which run across , it is important that the intrusion detection system can also tell the difference between the digging events and traffic nuisance events . The digging events shown in Figures 3 to 7 exhibit a relatively higher amplitude when compared with the more continuous nuisance events of adjacent traffic. At the same time, they can also exhibit more periods of signal inactivity when compared with some nuisance events of crossing traffic. An effective nuisance alarm suppression algorithm must be able to distinguish between intrusion signals of varying amplitude and continuity, and nuisance signals also of varying amplitude and continuity. The Proposed Solution

Alarms in fibre optic intrusion detection systems are normally generated by monitoring changes in selected features in the detected optical signals . These can include a number of temporal and spectral features . Any nuisance alarm suppression algorithm needs to be able to discriminate between intrusion and nuisance events . The use of simple amplitude or frequency threshold techniques which are often employed is not very effective in discriminating between intrusion and nuisance events . More sophisticated alarming algorithms are needed which will be described herein .

The novel nuisance alarm suppression algorithm described herein consists of a number of signal features extracted from the time domain representation of the signals and a simple decision tree classifier. After pre-processing the signals to extract the necessary features, a decision is made about the class that the signal belongs to, that is, whether it is an intrusion or nuisance event. This process is performed in a classifier block using a decision tree.

Pre-processing and Features Extraction

Figure 15 shows a summary of the pre-processing and feature extraction stages of the nuisance suppression algorithm. The different stages of the algorithm are presented below.

Pre-processing Stage

Once a signal is detected from the intrusion detection system, it undergoes a pre-processing stage that involves the following steps : Step 1 : Detection of signal : Monitor the detected time domain signal and capture a preconfigured amount of the signal (for example, 0.512 second) of data from the trigger point when the voltage level exceeds a defined Threshold Limit voltage.

Step 2: Rectify the captured signal and divide it into 10 equal segments as shown in Figure 16, (rectification= abs (x (n) ) .

Step 3 : Evaluate the maximum amplitude in each segment as illustrated by Figure 17.

Step 4: Find the amplitude-strength of each segment. The amplitude strength relates to how much of a signal is above a given amplitude threshold and is defined by Equation 1.

(No of samplesin the specφedsegment> Thresh ) , _Λ »

Theamplιtude_strengthoj eachsegment=-> r * ll)(J \ *■ )

{total samplesof samplesin the specifiedsegmenv₎

Intrusion signals such as those caused by digging will show relatively higher amplitude-strengths, whilst nuisance alarms, caused by both adjacent and crossing nuisances described earlier will have lower amplitude- strengths .

For this example, the number of samples in each segment of the captured data is 2048 sampled at a frequency of 4OkHz. The plot of amplitude-strength (%) against segment is shown in Figure 18.

Feature Extraction Stage

After the pre-processing stage, a number of features can be extracted to be used in the decision tree . Four features in particular will be considered for nuisance alarm suppression. These features are described below:

1- Event Detection: This feature determines whether or not an event (intrusion or nuisance) has been detected and is based on the Total Level Crossings (LC) per block for the captured signal . The total number of level crossings per block is calculated for the detected signal whereby a level crossing is defined by when the time domain signal goes from below a set threshold voltage to above that threshold voltage . By dividing the signal into a number of blocks, the total level crossings per block can be calculated. An alternate event detection method could also use a simple voltage threshold such that when a signal's amplitude exceeds a threshold voltage it is deemed an event and captured. Another method could also look at the cycle density of the signal over a given time period.

2- Continuity of the signal: This is a measure of how continuous the signal is over its duration. It is determined by using the maximum amplitudes versus segment information from the pre-processing stage (see Figure 17) and can be given by .

_ {No. of segments with amplitude > thresh. )

Continuity = - = = — ( 2 )

No. of segments

The parameter thresh₂ is normally set above the system noise as in the case of LCs . The maximum possible continuity is unity. Figure 19 shows how the continuity is measured. In this example the continuity is 1 as all segment maxima are above the set threshold. This feature is very important when the system encounters adjacent nuisance vehicular traffic event. These traffic events typically have longer duration and uniformly low amplitude as shown in Figures 8, 10 11, 12 and 13. 3- Maximum amplitude strength (count %) : The maximum amplitude-strength is the maximum value calculated by equation 1 over the whole duration of the signal (see Figure 18) . It is effectively a measure of what percentage of a signal is above a given threshold value and is given as a percentage value. This feature is important for distinguishing digging events from traffic nuisances that have similar continuity values. The intrusion signals will typically have higher maximum amplitude strengths .

4- Ratio of the amplitude strength: The ratio of the amplitude strength refers to the ratio of segments in a signal whose amplitude strength is above a given threshold (thresh₃) to the total number of segments. Its value is given by the following equation and can be derived from Figure 18.

(No.of segments with amplitude strength > thresh ) , _o .

Ratio _ amplitude _ strength = =— = — ( 3 )

No. of segments

For the example of Fig. 18, the ratio of the amplitude- strength is equal to 1/10 = 0.1 for a thresh₃ > 0.08 (see Figure 20) . This feature can also be used in combination with the continuity to separate traffic and intrusion events .

5- Maximum deviation: The maximum deviation is measured using step 3 of the pre-processing stage and is calculated by subtracting the mean of the segment amplitudes from the maximum segment amplitude .

Maximum deviation = Maximum segment amplitude - Mean segment amplitude ( 4 )

This feature is important to discriminate between digging intrusion events and adjacent nuisance events of comparably high continuities , even if they have roughly similar maximum amplitudes . In this situation the digging events will have a higher maximum deviation owing to their higher variation in segment maxima . This can be seen by comparing the two signals represented by Figure 4 (intrusion) and Figure 9 (crossing nuisance) where there are more periods of inactivity in the digging signal (lower in amplitude) when compared with the continuous nuisance signal . This translates into a higher maximum deviation for the digging signal .

Classification Using Simple Decision Tree

By using the features described above in the right combination it is possible to suppress a large number of nuisance alarms in buried intrusion detection systems . This can be done by implementing a decision tree . Decision trees represent a series of IF...THEN type rules which are linked together and can be used to classify or predict events based upon the values of a select number of features. A simple decision tree can be used to discriminate between intrusion and nuisance events . A neural network could also be used with these features to discriminate between alarm and nuisance events . Intrusion events will generate alarms while nuisance events will be ignored.

Figure 21 shows a decision tree that uses four features only . The features that are used here are : 1) The LCs , 2 ) continuity, 3) maximum amplitude strength and 4) maximum deviation . Other similar decision tree structures are also possible and will depend on the site where the system is installed and the type of nuisance events affecting it. The implementation of the decision tree can be flexible to allow future expansion whenever new nuisances are encountered in the field. With reference to Figure 21, the decision tree is made up of a number of decision points . Once a signal is received from the intrusion detection system that satisfies the level crossing criteria it is captured as a detected event. After this its continuity is calculated using Equation 2 and compared against a set continuity threshold value (threshi) . This threshold value is set such that short heartbeat-like nuisance signals (such as crossing nuisances) or shorter period intrusion events such as manual digging yield a continuity value that is below the threshold value . To discriminate between low continuity nuisance and low continuity intrusion signals, the maximum amplitude strength is calculated for the signal . Low continuity intrusion signals will have a higher maximum amplitude strength than low continuity nuisance signals . If the maximum amplitude strength is lower than the set threshold (thresh₂) , the signal is classed as a nuisance and no alarm is generated (Node-1, alarm suppression) . If its maximum amplitude strength is higher than thresh₂ , it is classed as an intrusion and an alarm is generated (Node-2) .

If the detected event yields a continuity that is higher than threshi, its maximum amplitude strength is calculated relative to thresh₃. Note that thresh₂ and thresh₃ do not necessarily have the same values. If it is lower than thresh3 it is classed as a nuisance event and no alarm is generated (Node-3) . If it is higher than thresh3 then another decision has to be made before it is classed as a nuisance or intrusion event based on the maximum deviation as described by Equation 4. If the maximum deviation of the signal exceeds the set threshold (thresh4) , then it is classed as an intrusion and an alarm is generated (Node-5) . If the maximum deviation is below thresh4 , then it is classed as a nuisance event and no alarm is generated (Node-4) . The decision tree can therefore be used to classify signals received from buried intrusion detection systems as either nuisances or intrusions and therefore suppress nuisance alarms .

Table 1 summarises results of using the decision tree in Figure 21 to classify the signals represented by Figures 3 to 14.

Table 1 : Practical examples of intrusion and nuisance events with their classes.

An example of how the decision tree in Figure 21 can be used to classify event signals captured from a buried gas pipeline intrusion detection system is shown below. The intrusion detection system that captured these signals was a locator sensor with an insensitive lead-in length (Li_ead2) of 2.67km, a sensing length (L₈) of 2.66km and a lead-out length (L_leadl) of 5.335km. The sensing fibre is buried 1 metre below the surface next to the pipeline .

For the examples below, the threshold values which were used are : threshi = 0.8, thresh₂ = 10, thresh₃ = 15, and thresh₄ = 0.9. For all the signals , a Threshold Limit voltage of 0.6V and event detection level crossing (LC) threshold of 2 level crossings per block was used. Figures 22 - 26 show event signals captured by the intrusion detection system and accompanying LCs vs Block number, Amplitude vs , Block number and the Maximum Amplitude Strength as Counts (%) vs Block number. The sample rate used for the signals is 4OkHz.

The first graph in Figure 22 shows a background nuisance event signal captured where the number of level crossings exceeds the level crossing threshold. Using the Amplitude versus block number graph (second graph) , a continuity value of 0.6 can be calculated from Equation 2. Using the decision tree, since the continuity is less than threshi, we move to the left of the tree and check the maximum amplitude strength using the final graph in Figure 22. The maximum amplitude strength is 0% which is less than thresh₂ and brings the decision tree to Node-1. This classifies the event as a nuisance and the alarm is suppressed.

The first graph in Figure 23 shows a backhoe digging event signal captured where the number of level crossings exceeds the level crossing threshold. Using the Amplitude versus block number graph, a continuity value of 0.4 can be calculated from Equation 2. Using the decision tree , since the continuity is less than threshi , we move to the left of the tree and check the maximum amplitude strength using the final graph in Figure 23. The maximum amplitude strength is 34.86% which is larger than thresh₂ and brings the decision tree to Node-2. This classifies the event as an intrusion and an alarm is generated.

The first graph in Figure 24 shows an adjacent traffic event signal captured where the number of level crossings exceeds the level crossing threshold. Using the Amplitude versus block number graph, a continuity value of 1 can be calculated from Equation 2. Using the decision tree , since the continuity is larger than threshi, we move to the right of the tree and check the maximum amplitude strength using the final graph in Figure 24. The maximum amplitude strength is 1.86% which is less than thresh₃. The decision tree goes to Node-3. This classifies the event as a nuisance and the alarm is suppressed.

The first graph in Figure 25 shows a crossing traffic event signal captured where the number of level crossings exceeds the level crossing threshold. Using the Amplitude versus block number graph, a continuity value of 1 can be calculated from Equation 2. Using the decision tree , since the continuity is larger than threshi, we move to the right of the tree and check the maximum amplitude strength using the final graph in Figure 25. The maximum amplitude strength is 18.99% which is larger than thresh₃ which means that the maximum deviation of the signal must be checked. This is required because some nuisance signals such as crossing traffic can have both high continuity and high maximum amplitude strengths similar to some intrusion signals. The maximum deviation is calculated to be 0.4712 using Equation 4. Since this is less than thresh₄ the decision tree goes to Node-4. This classifies the event as a nuisance and the alarm is suppressed.

The first graph in Figure 26 shows a backhoe digging event signal captured where the number of level crossings exceeds the level crossing threshold. Note also that this signal has more continuity to it than that in Figure 23. Using the Amplitude versus block number graph, a continuity value of 0.8 can be calculated from Equation 2. Using the decision tree, since the continuity is larger than threshi , we move to the right of the tree and check the maximum amplitude strength using the final graph in Figure 26. The maximum amplitude strength is 37.842% which is larger than thresh₃ which means that the maximum deviation of the signal must be checked. The maximum deviation is calculated to be 2.76 using equation 4. Since this is larger than thresh₄ the decision tree goes to Node-5. This classifies the event as an intrusion and an alarm is generated.

Claims

1. A method of processing a time variable detected signal in an intrusion detection system to produce alarm signals indicative of intrusion events, comprising:

2. A method as claimed in claim 1 , wherein said signal characteristic occurs when the detected signal exceeds a level crossing threshold criterion .

3. A method as claimed in claim 1 , wherein the level crossing threshold criterion is a threshold rate of level crossings, where each level crossing occurs when the detected signal goes from below a set level to above that level .

4. A method as claimed in any one of the preceding claims, comprising extracting from the detected signal over said time interval a plurality of features with potential to discriminate between intrusion events and nuisance events ,

setting thresholds for said plurality of features , and

5. A method as claimed in claim 4 , wherein evaluation of whether the separate feature criteria satisfy a combination indicative of an intrusion event or a different combination indicative of a nuisance event is carried out by a decision tree process in which successive decisions are made as to the feature criteria of differing features .

6. A method as claimed in claim 4 or claim 5 , wherein one of said features is a measure of continuity of signal over the time interval .

7. A method as claimed in claim 5 , wherein one of said features in a measure of continuity of signal and the decision tree process requires determination as to whether the continuity of signal measure exceeds or does not exceed the respective threshold for that measure before proceeding to a decision in relation to any other of said features .

8. A method as claimed in any one of claims 4 to 7 , wherein said features include any one or more of a maximum signal amplitude strength measure and a maximum signal amplitude deviation measure.

9. A method of protecting a location against intrusion , comprising

processing said detected signal by a method as claimed in any of the preceding claims, and

producing an alarm in response to an alarm signal indicative of an intrusion event at said location.

10. A method as claimed in claim 9, wherein the sensing device comprises a sensor element buried at said location.

11. A method as claimed in claim 10 wherein the sensor is a buried fibre optic sensor .

12. A method as claimed in any one of claims 9 to

11, wherein the monitoring step comprises launching light into a wave guide so that light is caused to propagate through the wave guide , and

detecting the light propagating through the wave guide to produce said time variable signals .

13. Apparatus for processing a time variable detected signal in an intrusion detection system so as to produce alarm signals indicative of intrusion events , comprising a signal monitor for monitoring the detected signal for occurrence of a signal characteristic indicative of a detected event, and

14. Apparatus as claimed in claim 13, wherein said signal characteristic occurs when the detected signal exceeds a level crossing threshold.

15. Apparatus as claimed in claim 14, wherein the level crossing threshold criterion is a threshold rate of level crossings, where each level crossing occurs when the detected signal goes from below a set level to above that level .

16. Apparatus as claimed in any one of claims 13 to 15, wherein the signal processor is configured to extract from the detected signal over said time interval a plurality of features with potential to discriminate between intrusion events and nuisance events,

to set thresholds for said plurality of features , and

to determine said separate criteria according to whether the features exceed or do not exceed the respective thresholds for said features .

17. Apparatus as claimed in claim 16, wherein the signal processor is configured to perform a decision tree process in which successive decisions are made as to the feature criteria of successive features .

18. Apparatus as claimed in any one of claims 13 to

17 , wherein one of said features is a measure of continuity of signal over the time interval.

19. Apparatus as claimed in claim 17, wherein one of said features is a measure of continuity of signal and the signal processor is configured to make a decision as to whether the continuity of signal measure exceeds or does not exceed the respective threshold for this measure before proceeding to any decision in relation to another of said features .

20. Apparatus as claimed in any one of claims 13 to

18, wherein said features include any one or more of a maximum signal amplitude strength measure and a maximum signal amplitude deviation measure .

21. An intrusion detection system for monitoring a location against intrusion, comprising a sensing device for producing a time variable detected signal affected by intrusion at the location to be monitored;

a signal processing apparatus as claimed in any one of claims 13 to 20 to process the detected signal produced by the sensing device and to produce an alarm signal in response to an intrusion at said location .

22. An intrusion detection system as claimed in claim 21, wherein the sensing device comprises a sensor to be buried at said location.

23. An intrusion detection system as claimed in claim 21 or claim 22, wherein the sensing device comprises a light source, a wave guide for receiving light from the light source so that light is caused to propagate through the wave guide , and a detector for detecting the light propagating through the wave guide and to produce said time variable signals .

24. An intrusion detection system as claimed in any one of claims 21 to 23, comprising a bidirectional Mach Zehnder, the wave guide including sensing arms of the Mach Zehnder for sensing perturbations at locations along the sensing arms.