FI20215386A1 - A method, an apparatus and a computer program product for analysing property-related usage data - Google Patents

Abstract

Suoritusmuodot liittyvät menetelmään ja tekniseen välineistöön valvontakohteen, kuten kiinteistön, käytön valvontaa varten. Menetelmässä vastaanotetaan tietoja yhdestä tai useammasta tietolähteestä, jotka tiedot liittyvät valvontakohteen käyttöön; käsitellään tietoja poikkeamien havaitsemiseksi verrattuna valvontakohteen normaaliin käyttöön; muodostetaan poikkeamien perusteella tulos; ja muodostetaan tuloksen perusteella ohjaussignaali; ja lähetetään ohjaussignaali ulkoiseen laitteeseen ja/tai järjestelmään sen toiminnan ohjaamista varten.

Description

A METHOD, AN APPARATUS AND A COMPUTER PROGRAM PRODUCT

FOR ANALYSING PROPERTY-RELATED USAGE DATA

Technical Field

The present solution generally relates to management of property-related usage data. In particular, the solution relates to analyzing usage data, which is derived from a monitoring target, for example from a real estate.

Background

Office buildings, business premises, factories, personnel-free service providers, campuses, hospitals etc. provide access to their premises for permitted visitors and users. The permission may be controlled and/or managed by means of an access control/management system which identifies users entering to the real estate. The users have an identification means (such as an access key, a badge, etc.) which is shown at a door terminal, according to which the access through that door is either allowed or declined.

In addition to access control, buildings can have surveillance cameras, i.e. security cameras, within the building to monitor visitors and users visiting the building. The functioning of the surveillance cameras is generally based on a great amount of video material, which can be retroactively analyzed, when a misuse of premises has been noticed.

N Aforementioned buildings may also have presence detectors to detect

N presence of persons in a certain room or space. Presence detectors may 3 generally identify whether a person is located in a certain place, however, an en identification of a person is not known. = 30 o Summary 3

N Purpose of the present invention is to provide an improved solution for

N monitoring the usage of real estate or any other monitoring target. Various aspects include a method, an apparatus and a computer readable medium comprising a computer program stored therein, which are characterized by what is stated in the independent claims. Various embodiments are disclosed in the dependent claims.

According to a first aspect, there is provided a method for monitoring a usage of a monitoring target, comprising receiving data from one or more data sources, wherein the data relates to usage of the monitoring target; detecting individual objects in said received data; analyzing behavior of each of the detected objects according to said received data to detect deviations on object’s behaviour compared to a normal behaviour relating to the monitoring target; and generating output based on the detected deviations.

According to a second aspect, there is provided an apparatus for monitoring a usage of a monitoring target, comprising means for receiving data from one or more data sources, wherein the data relates to usage of the monitoring target; means for detecting individual objects in said received data; means for analyzing behavior of each of the detected objects according to said received data to detect deviations on object's behaviour compared to a normal behaviour relating to the monitoring target; and means for generating output based on the detected deviations.

According to a third aspect, there is provided an apparatus comprises at least one processor, memory including computer program code, the memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following: receiving data from one or more data sources, wherein the data relates to usage of the monitoring

N target; detecting individual objects in said received data; analyzing behavior of

N each of the detected objects according to said received data to detect 3 deviations on object's behaviour compared to a normal behaviour relating to en the monitoring target; and generating output based on the detected deviations. = 30 o According to a fourth aspect, there is provided a computer program product 3 comprising computer program code configured to, when executed on at least = one processor, cause an apparatus or a system to receive data from one or more data sources, wherein the data relates to usage of the monitoring target; detect individual objects in said received data; analyses behavior of each of the detected objects according to said received data to detect deviations on object’s behaviour compared to a normal behaviour relating to the monitoring target; and generate output based on the detected deviations.

According to an embodiment, a control signal is generated based on the output.

According to an embodiment, the control signal is transmitted to an external device and/or system for controlling its operation.

According to an embodiment, a feedback is received from a user concerning the generated output; and the feedback is used to train a machine learning algorithm performing the analysis.

According to an embodiment, a route relating to the object's behaviour is — visualized on a map or a floor plan as an output.

According to an embodiment, at least part of more than one data sources are independent from each other.

According to an embodiment, the external device is one or more of the following: a display, a mobile device, an access control system, an alarm system, a security system, or the data source.

According to an embodiment, historical data is retrieved to be used for processing the received data.

N

N According to an embodiment, the data being received from said one or more 3 data sources is harmonized. n

I 30 According to an embodiment, the floor plan or the map is retrieved from a a © memory, wherein said floor plan is a floor plan of the monitoring target, and 3 wherein said map is a map of a planned route of the monitoring target.

LO a

N According to an embodiment, the apparatus comprises at least one processor, memory including computer program code, the memory and the computer program code.

Description of the Drawings

In the following, various embodiments will be described in more detail with reference to the appended drawings, in which

Fig. 1 is an illustration of a monitoring target entity comprising monitoring target units and objects;

Fig. 2 shows an example of a system according to an embodiment;

Fig. 3 shows an example of an analysis apparatus according to an embodiment;

Fig. 4 shows an example of structure of an analysis module according to an embodiment;

Fig. 5 shows an example of a visualization of a user movement on a building mapped to a floor map; and

Fig. 6 is a flowchart illustrating a method according to an embodiment.

Description of Example Embodiments

N The present embodiments relate to gathering data concerning access control

N and monitoring, and processing and reporting such data in an improved 3 manner. n

I 30 The following description and drawings are illustrative and are not to be a © construed unnecessarily as limiting. The specific details are provided for a 3 thorough understanding of the disclosure. However, in certain instances, well-

LO

N known or conventional details are not described to avoid obscuring the

N description. References to one or an embodiment in the present disclosure can be, but not necessarily are, reference to the same embodiment and such references mean at least one of the embodiments.

Reference in this specification to “one embodiment’ or “an embodiment’ means that a particular feature, structure, or characteristic described in connection with the embodiment in included in at least one embodiment of the 5 disclosure. The appearance of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Moreover, various features are described which may be exhibited by some embodiments and not by others. Similarly, various requirements are described which may be requirements for some embodiments but no other embodiments.

The terms used in this specification generally have their original meanings in the art, within the context of the disclosure, and in the specific context where each term is used. Certain terms that are used to describe the disclosure are discussed below, or elsewhere in the specification, to provide additional guidance to the practitioner regarding the description of the disclosure.

As mentioned, the present solution is about gathering usage data concerning usage of a monitoring target. Term “monitoring target” refers to one or more real properties/real estates, e.g. office buildings, government office buildings, premises, campus, factory, industrial hall, industrial properties and areas, service providers, hospitals, military properties, recreational properties, etc. In addition, whenever term “monitoring target” is used in the following description, the interpretation should cover movable entities also. Examples of movable

N entities comprise anything that can be transported on railway, on the road, over

N the sea or by air, e.g. ships, freight, cargo. Thus, the present solution provides 3 a tool for managing and controlling usage of properties, despite whether they n are moving, i.e. movable, or not. To do that, the solution gathers behavioral

I 30 and usage data relating to users (i.e. visitors, employees, clients, customers) o based on their being and moving in the real estate or in/with the monitoring 3 target in question. In addition to users, the solution is able to gather and = analyze behavioral data of non-human items, such as freight, cargo, truck, or other carriers, and/or behavioral data of humans working with such non-human items.

Figure 1 further clarifies the terminology. In Figure 1 several types of monitoring targets are illustrated. Monitoring target can be one or more monitoring target units located in one or more locations, wherein the monitoring target unit may be movable or non-movable. Each monitoring target comprises objects, which can be human or non-human, whereupon the purpose of the present embodiments is to gather data on the objects with respect to the monitoring target. Human objects are people visiting or staying or moving in the monitoring target. Non-human objects refer to valuable assets, tools, materials etc.

Figure 1 illustrates a monitoring target entity (MTE) comprising one or more monitoring target units (MTU1, MTU2, MTU3). The monitoring target entity (MTE) may comprises one or more objects (OBJ1, OBJ2, OBJ3, OBJ9,

OBJ10) whose behavior is monitored. Also monitoring target units (MTU1,

MTU2, MTU3) comprise objects (OBJ2, OBJ4, OBJ5) whose behavior is monitored. Is it to be noticed from Figure 1 that an object, such as object OBJ3, may also be a monitoring target unit MTU2. Figure 1 also illustrates other monitoring target units (MTU2, MTU4) which are not necessarily part of any monitoring target entity. Such monitoring target units (MTU2, MTU4) also comprise objects (0BJ6, OBJ7, OBJ8) whose behavior is monitored. When speaking of monitoring of a behavior, such operation refers to gathering data concerning the movements and actions of an object from several data sources being arranged to each of the monitoring target units but also to monitoring target entities.

N The objects are detectable by the system by means of tokens, wherein — even

N though the token may be mapped to an object identity — the tokens are only 3 used by the system for detecting a certain object in a certain monitoring target. n Therefore, a token is linked to an object, and it is — in the last resort — the

I 30 behavior of the token that is being monitored by the system. Token may be a o badge, a register plate, an iris of a person, or any other item or element that 3 can be used for detecting an object. Token is therefore an item that provides = data to the data source.

O

N

Thus, the purpose of the of the present embodiments is to gather data relating to behavior of objects (by means of tokens) with respect to a monitoring target,

wherein the monitoring target may be a monitoring target entity comprising one or more monitoring target units, or the monitoring target may be a monitoring target unit. The solution is based on a data that is produced by various systems on the usage of monitoring target, which usage is determined by monitoring behavior of objects, i.e. a token representing the object in the monitoring target, and on an intelligent analysis that is provided based on such data. When the monitoring target unit is a real estate or a building or similar, the usage refers to objects’, i.e. people's, visit and/or staying in such place. When the monitoring target unit is a carrier, such as a truck or a ship, the object may be a driver of the carrier, but also — in addition or instead — a load of the carrier, such as a cargo or similar. Thus, the usage refers to the behavior or moving of such object. The data may be obtained from various data sources. Examples of such data sources are access control systems, network access points (e.g.

Wi-Fi), surveillance cameras, electronic booking systems, elevator usage counters, door counters, etc.

Currently, the data concerning the real estates and their usage has been siloed to various systems, which systems are not integrated nor compatible with each other. Therefore, the object of the present embodiments is to produce a view tothe overall situation on the usage of a real estate (or other monitoring target) and their users in timely manner independently from the source system and source data. In addition, another object of the present embodiments is to provide a learning system, which uses real-time and historical data that is gathered from various source systems to learn variation in the use and consumption of the monitoring target. This expects tailoring both from the

N monitoring side's point of view and also from reporting side's point of view. Yet,

N as a further object of the present embodiments is to enable reacting to isolated 3 and individual exceptions and emergencies promptly. This expects means to en make decisions fast during a state of emergency. = 30 o Figure 2 illustrates a system according to an embodiment in a simplified 3 manner. The system is configured for a specific monitoring target, for example = for a monitoring target entity and/or a monitoring target unit. The system comprises an analysis apparatus 210, which collects (or receives) data from various source systems 201, 202, 203, ... 20N, i.e. one or more data sources.

The analysis apparatus 210 may be a computing device comprising an analysis computer program according to the present embodiments. The analysis computer program comprises computer instructions for carrying out the analysis method by respective computer modules. In order to execute the analysis computer program, the analysis apparatus 210 comprises a processor, a memory and a communication interface. The memory stores the analysis computer program, and may also store historical data concerning the previous usage of the monitoring target. The historical data may comprise usage reports that have been provided by various data sources during past one or more year(s), if available. The historical data may be used to (pre-)train the analysis algorithms. Instead of being stored in the memory of the analysis apparatus, the historical data may be stored in an external memory, e.g. in a cloud server.

In addition, the analysis apparatus 210 may comprise user interface means.

The user interface means may comprise one or both of the following a display for displaying visual information, such as images, video, text; or an audio receiver/transmitter with a microphone and/or loudspeakers.

The data from the various source systems 201, 202, 203, ... 20N may be received via a communication channel being created between the analysis apparatus 210 and the source systems 201, 202, 203, ... 20N. The communication channel can be formed by means of a long-range or short- range wireless network, for example a wireless local area network, a Bluetooth, a cellular network of any generation, a sensor-based network, a satellite network. In some example, a data source may have a wired connection with

N the analysis apparatus 210. In this respect, each of the data source systems

N comprise a data transmitter in order to send data to the analysis system. The 3 interfaces between the analysis apparatus 210 and the various sources en systems 201, 202, 203, ... 20N may be implemented by means of standard z 30 interfaces, for example REST API (Representational State Transfer c Application Programming Interface). The interface may be a push or a pull type 3 of an interface. In the pull interface, the analysis apparatus retrieves the data = from a data source. In the push interface, the data source automatically provides data to the analysis apparatus.

The data can be one or more of the following: access control data, network usage data, room booking data, counter data from usage of doors, elevators, alarms, locking data, weather condition, problems/exceptions at the monitoring target unit, traffic exceptions, environmental sensor data (temperature, moisture, noise, carbon dioxide), contaminant detection data (gas, radiation, metals), etc., data relating to people’s presence in buildings, data relating to object's movements with respect to monitoring target, etc. Thus, the source systems 201, 202, 203, ... 20N may comprise an access control system, a network access point, a calendar or a booking system, a counter, a presence detector system, etc. More examples on the type of data will come up in the examples that will be given later in this disclosure. It is thus appreciated, that the given examples should not be unnecessarily considered limiting examples.

The data is gathered by the analysis apparatus 210 and stored in the memory of the analysis apparatus 210. Instead of the memory of the analysis apparatus 210, the data being gathered may be stored in an external memory, e.g. a cloud server being accessible by the analysis apparatus.

The analysis apparatus 210 performs analysis on the received and stored data by means of the analysis computer program, and for doing it, the analysis apparatus 210 may also use the historical data. The purpose of the analysis is to identify exceptions, to create simulations on the situation, and to generate scenarios and predictions based on the present situation and the obtained historical data. As a result, the analysis and its outcome may be provided as a report and/or as control signals to target systems 211, 212, ... 21N. In addition,

N the analysis and the outcome may be displayed and/or otherwise output to the

N user on the user interface. The target systems 211, 212, ... 21N may comprise, 3 as an example, a display, a mobile device, an access control system, an alarm en system, a security system, etc. According to an embodiment, one or more of x 30 the target systems may be the same as the source systems.

O

3 The results of the analysis may be communicated to the target system 211, = 212, ... 21N via a communication channel being created between the analysis apparatus 200 and the various target systems 211, 212, ... 21N. The communication channel can be formed by means of a long-range or short- range wireless network, for example a wireless local area network, a Bluetooth,

a cellular network of any generation, a sensor-based network, a satellite network. In some example, a target system may have a wired connection with the analysis apparatus 200. In this respect, each of the target systems comprises a data receiver in order to obtain control instructions from the analysis system.

Figure 3 illustrates an analysis apparatus 300 (Fig. 2: 210) in a more detailed manner, according to an embodiment. The analysis apparatus 300 comprises an integration interface 301 to the source systems providing the source data. — The source data from different source systems may be in various formats. For example, the data may be presented in a human-readable table format having columns for “actor identifier”, “resource code”, “area code”, “timestamp”, “action”, “error code”. Instead, or in addition, the data may be presented only as a computer-readable code from which needed indications can be derived.

The integration interface 301 may, according to some example embodiments, perform data harmonization for some or all of the data.

In any case, the source data is converted into a data model 303, which is a predefined model according to which the heterogeneous data is harmonized, whereupon the data becomes processable by a processor 302. The purpose of the data model 303 is to generate a general and comparable format for the source data. The harmonization of the data may comprise one or more of the following: data clean-up (e.g. removal of blank lines), filtering of the data, re- ordering of the data, automatic data labelling (e.g. by adding further information, e.g. temperature). For example, a video data may be converted

N into a table format by detecting movement during unordinary times, or by

N detecting unordinary movement (e.g. fast-moving entities, crowd, chaos, etc.) 3 during ordinary times. Such exceptions may be identified in the table format by en indicating a point in time and the event during that time. = 30 o The processor 302 uses intelligent tools for processing. The intelligent tools 3 may comprise machine learning models (e.g. a neural network) enabling

N artificial intelligence, e.g. as a result of a supervised and/or an unsupervised

N learning. By means of the data model 303, the data can be processed by the processor 302 and by the machine learning solutions equally and predefined manner thus generating enriched data 304.The enriched data can be used for making the analysis and action proposals.

The analysis and actions proposals are built according to rules, limit values and threat limits that have been predefined to the analysis apparatus. The rules, limit values and threat limits may be stored in a memory of the analysis apparatus, and are retrievable from there. The rules, limit values and threat limits can be updated, and they will become more accurate due to the usage of the system. Instead of being stored in the apparatus’ memory, the rules, limit values and threat limits may be entered by a user case-by-case, or they may be stored in an externa memory.

A simplified example on the user case, is a human object, i.e. a visitor, who has a token, e.g. an access key, for certain doors in a building representing the monitoring target. The visitor tries to use the access key on a door, to which the access is not permitted. After e.g. a third attempt, the system according to present embodiments may automatically generate a report and/or an indication according to which the user of the analysis system checks the access key, and checks whether the use of the access key by the visitor been appropriate.

Therefore, when a limit value or a threat limit is exceeded, or when an event that has been defined in the rules is identified in the data that has been received from data sources, an output is resulted. The output can be a pre- defined action recommendation or an automatic reaction. The output, according to an example, can be a data transfer to an emergency system or a

N launch of an emergency. The output, according to another example, can be a

N control signal to orientate cameras into a new direction, or other action reguest, 3 or a verification request to a remote control room, an alarm to a security in a en remote control room or directly to personnel, or a data transfer to other security

I 30 system. The outputs can be classified according to their urgency. For example, c some of the output can be an immediate alarm in another system or to a user, 3 and some of the output can be non-urgent issues to be checked.

N

N The analysis apparatus 300 may comprise a user interface 305, which is configured to display - and/or in some other way output - the results of the analysis, action recommendations, actions point, etc. as visual items and/or indications and/or reports to a user. In addition, the user interface 305 comprises user input means to receive from the user at least feedback on the analysis, i.e. reactions to alarms or to identified exceptions. The reaction may be an indication on whether an alarm was justified and/or whether an alarm was a false alarm. At least the false alarms are provided to the processor 302 to train the machine learning solution, which further enriches the data. The reports and/or control signals are provided to the external system(s) for further utilization.

The source data, as specified in Figure 3, may be obtained from internal security organization, external security service providers, real estate administrators, data center service provider, emergency centers, or any other service provider that is related to real estate services or other services/systems relating to the monitoring target. Therefore the source data may originate from a video surveillance system, fire alarm system, any other alarm system, a booking system, a system that controls truck traffic and other traffic, Wi-Fi or other network data system, [oT sensors, just to mention few as examples.

Example on a use case

The present solution is clarified by means of a use case, where the source data comprises at least a first data set. The first data set comprises e.g. a list of an access control data and is composed of data that concerns usage of building doors during 12 months. The first data set is gathered by a door security system or access control/management system. In addition, the

N analysis system retrieves a floor plan of the building in which door terminals

N have been indicated. The floor plan — on the other hand — may not be received 3 as an input but may be prestored in the memory of the property manager en system or in a memory of the analysis system as a prerequisite. Therefore,

I 30 any input data (i.e. data sets) being received from one or more data sources c will be mapped to the floor plan as will be described next. Both data can be 3 displayed on a user interface of the system for a human user.

N

N By using at least the first data set, i.e. access control/ management data in this use case, the analysis system according to present embodiments aims to identify threat level indicators. At first user-specific door openings are determined and calculated. This will reveal number of things, e.g. users having the most door openings; doors that are opened the most frequently; and users having the greatest number of individual doors being opened. The outcome defines limit values for a normal and possibly a suspicious use. In addition, the usage of doors based on timeslots is determined. The usage may be classified into categories “early”, “normal” and “late”. This will generate preliminary limit values to an office time. All the information derived from the access control data, can be statistically represented on a user interface of the system for a human user.

A certain user, i.e. an object, may be detected from the source data, and a complete behaviour of such object may be determined with respect to the monitoring target. If more than one data set is available, which other data sets are obtained from other data sources, these data sets may be utilized to determine the overall behaviour. It is to be noticed, that the identity of the user is not needed when monitoring the behaviour. What is needed, is the token that is specific and associated for a certain user, and therefore the token's movements and behaviour is monitored. The token can be a badge or other identification means, such as an iris of the user, fingerprint, or any other — feature/identifier which can be used to detect (not necessarily) identify a certain user or object from a group of users or objects.

Based on the analysis and their outcome, the threat level indicators and detailed analysis may be automatically generated. As an example, the threat level indicator may be a human object who has used doors outside the normal

N office hours, or a non-human object having moved/been transferred to a

N prohibited location. Such an object may be indicated by the system, or selected 3 by the user, for a more detailed analysis. n

I 30 When an object has been selected for a detailed analysis, his/her/its activity o during a specific time, e.g. during one day and during a year can be examined 3 by the human user with the help of the analysis system. The purpose of = examination is to find deviation from the normal behaviour. When a year is

N taken under examination, recurrence in behaviour can be detected — even if the behaviour in daily basis was seen abnormal.

The behaviour within the year, or during another time, may be processed according to machine learning and neural network based algorithms, whereupon deviations from a normal behaviour can be detected. Further, the behaviour during the specific points of time can be further analysed based on the door terminals.

The deviations may be classified in relation to the deviant times and to the door terminals, and the classification may be visualized per user.

When such an analysis is performed for all objects that have been indicated as threat level indicators, various behavioural patterns can be detected, which patterns need to be analysed in more detailed manner. This can be implemented by a path analysis, which is targeted to visualizing objects’ behaviour, e.g. paths, on the floorplan. Figure 5 illustrates an example of user's movement within a building, when visualized on a floor plan 500. The numbered items refer to different floors of the building. The lines 501 between the floors indicate user's movement. More lines indicate more usage, and therefore deviating behaviour can be seen as singular lines. The visualization on the used paths on the floorplan can be done for all users, which — together with the threat level indicators and data clustering — may reveal deviant behaviour in more detailed manner.

In above, a use case concerning a usage of a real property was described.

However, when the monitoring target is a moving monitoring target, the movement of the monitoring target and/or objects related to it, can be tracked,

N and visualized on a map. If the tracked path deviates from the conventional

N route, this is considered as a deviation. Deviating behaviour is also indicated, 3 if the monitoring target and/or objects related to it, stays longer at a certain en location than normally, and/or if the time of travel between two locations is

E 30 longer than expected. Such behaviour is examined in more detailed manner.

O

3 As has been described, the operation of the present analysis solution is based = on a machine learning algorithm. The functionality of the machine learning algorithm may be based on neural network model, having a plurality of network layers. An input layer of the neural network obtains input data from a plurality of data sources; a plurality of hidden layers processes the data; and an output layer provides an outcome relating to the analysis and the decision being made on the input data, i.e. whether a threat has been identified or detected. Thus, the outcome, i.e. output, of the machine learning algorithm is a decision that a threat level indicator has been determined based on the data that has been received from one or more data sources. The output can be a flag indicating a threat level, or a visualization on a map where the threat level indicator appeared, or any audial or visual (graphical or textual) indication of the detected threat. Each of the layers has units, i.e. nodes, which individually decides based on any input they receive from other nodes and based on a — weight which defines node's relative importance. Each layer i.e. input layer, hidden layer, output layer, may comprise multiple nodes.

The machine learning algorithm can be pretrained with a data that has been gathered from various databases (various examples given with reference to

Figures 2 and 3) comprising monitoring target's usage data. The training may be implemented with a historical data, by means of which training data sets are generated. The training can be done individually for various data sources, for example one machine learning algorithm can be trained with access control/management data relating to door openings, another machine learning algorithm can be trained with carrier routes and service areas and/or stop points. The training data set may comprise information on an event and a token relating to that event, i.e. the type of the event and time of the day for the event and token to which the event happened.

However, since the functionality rely on detecting deviating use, the training

N expects user feedback. Therefore, the solution is preferably continuously

N trained during the operation of the system, and according to the live usage 3 data and/or according to the analysis being made and/or according to the en monitoring user feedback. For example, when the analysis system has been

I 30 classified a certain object as a threat level indicator since s/he visits unregularly c in an archive, the monitoring user may enter feedback to the system informing 3 that this user has a certain role whereupon s/he needs to visit the archive once = in every other year. This feedback is registered by the system, and thereafter any user having such a role is not indicated as a threat level for his/her behaviour directed to the archive.

In the present solution, the analysis system may begin to operate with one machine learning algorithm that is tailored for a certain data source, e.g. an access control/management system. However, the operation of the analysis system may be broadened with other machine learning models tailored for other data sources. The final analysis may be generated by using such one or more machine learning solutions, each of which is making an analysis for its respective input data to detect deviations on such input data, whereupon their decisions and outputs can be fused by a yet further machine learning algorithm, which makes the final analysis. For example, data from surveillance cameras may be analysed and labelled by a first machine learning algorithm: and data from access control system may be analysed and labelled by a second machine learning algorithm. Both outputs are input to the third machine learning algorithm, which is configured to analyse and label the input data further. In any phase of the process, the monitoring user may manually label data and/or give feedback to the system. Each machine learning algorithm may increase the threat level of an individual aspect being analysed. Changes in the threat level are monitored, and automatic alarms or control instructions to other system will be created based on them. Feedback is reguested (automatically or manually) to the alarms and control instructions to determine their relevancy. By this, the system can be trained to adjust its threshold-value dynamically and in context-wise manner (context being for example a weather condition, exceptional traffic or an event that increases the number of people temporally. Instead of having respective algorithms, the data from multiple data sources may be processed by a single machine learning algorithm.

N In previous disclosure, the solution has been described from real estate's point

N of view. However, the analysis system is applicable in management of any 3 monitoring target, such as industries, logistics, campuses, large properties, en and real estate entities. In industries, the source data may comprise the access

I 30 control data, but also data that is resulted from monitoring and tracking c vehicles and other logistic devices. In addition, the solution is applicable in 3 other logistics, for example in marine traffic, where the monitoring is targeted 5 to ships or individual freights.

N

Any individual monitoring target, e.g. a monitoring target entity or a monitoring target unit, e.g. a real estate, a campus, a hospital, a ship, a cargo, etc. is represented as independently monitorable item in the analysis system. They are interfaced with their respective data sources, and have their own database(s), whereupon the analysis on the usage is reported in their respective user interface.

The method according to an embodiment is shown in Figure 6. The method generally comprises receiving 610 data from one or more data sources, wherein the data relates to usage of the monitoring target; detecting 620 individual objects in said received data; analysing 630 behaviour of each of the detected objects according to said received data to detect deviations on object’s behaviour compared to a normal behaviour relating to the monitoring target; and generating 640 output based on the detected deviations. Each of the steps can be implemented by a respective module of a computer system.

An apparatus according to an embodiment comprises means for receiving data from one or more data sources, wherein the data relates to usage of the monitoring target; means for detecting individual objects in said received data; means for analysing behaviour of each of the detected objects according to said received data to detect deviations on object's behaviour compared to a normal behaviour relating to the monitoring target; and means for generating output based on the detected deviations. The means comprises at least one processor, and a memory including a computer program code, wherein the processor may further comprise processor circuitry. The memory and the computer program code are configured to, with the at least one processor, cause the apparatus to perform the method of Figure 6 according to various

N embodiments. & 3 The various embodiments can be implemented with the help of computer en program code that resides in a memory and causes the relevant apparatuses

I 30 to carry out the method. For example, a device may comprise circuitry and o electronics for handling, receiving and transmitting data, computer program 3 code in a memory, and a processor that, when running the computer program = code, causes the device to carry out the features of an embodiment.

O

N

The present embodiments greatly improve the operation of conventional access control/management systems, because due to the present embodiments any access or any passage or any movement can be immediately classified as a threat level indicator or a normal usage. Therefore, the present solution enables immediate reactions to threats.

The present embodiments also enable continuous training of the system whereupon the system will become able to determine whether a detected deviation is a false deviation, and to discard such by itself.

If desired, the different functions discussed herein may be performed in a different order and/or concurrently with other. Furthermore, if desired, one or more of the above-described functions and embodiments may be optional or may be combined.

Although various aspects of the embodiments are set out in the independent claims, other aspects comprise other combinations of features from the described embodiments and/or the dependent claims with the features of the independent claims, and not solely the combinations explicitly set out in the claims. lt is also noted herein that while the above describes example embodiments, these descriptions should not be viewed in a limiting sense. Rather, there are several variations and modifications, which may be made without departing from the scope of the present disclosure as, defined in the appended claims.

N

O

N

O

<Q n

I a a

O

00

O

LO

N

O

N

Claims (15)

Claims:

1. A method for monitoring a usage of a monitoring target, comprising: - receiving data from one or more data sources, wherein the data relates to usage of the monitoring target; - detecting individual objects in said received data; - analysing behaviour of each of the detected objects according to said received data to detect deviations on object's behaviour compared to a normal behaviour relating to the monitoring target; and - generating output based on the detected deviations.

2. The method according to claim 1, further comprising generating a control signal based on the output.

3. The method according to claim 2, further comprising transmitting the control signal to an external device and/or system for controlling its operation.

4. The method according to claim 1 or 2 or 3, further comprising receiving from a user a feedback concerning the generated output; and using the feedback to train a machine learning algorithm performing the analysis.

5. The method according to any of the claims 1 to 4, further comprising visualizing a route relating to the object’s behaviour on a map or a floor plan as an output. N

N 6. An apparatus for monitoring a usage of a monitoring target, comprising: 3 - means for receiving data from one or more data sources, wherein the en data relates to usage of the monitoring target; I 30 - means for detecting individual objects in said received data; o - means for analysing behaviour of each of the detected objects 3 according to said received data to detect deviations on object's = behaviour compared to a normal behaviour relating to the monitoring target; and - means for generating output based on the detected deviations.

7. The apparatus according to claim 6, further comprising means for generating a control signal based on the output.

8. The apparatus according to claim 7, further comprising means for transmitting said control signal to an external device and/or system for controlling its operation.

9. The apparatus according to claim 6 or 7 or 8, further comprising means for receiving from a user a feedback concerning the generated output; and means for using the feedback to train a machine learning algorithm performing the analysis.

10. The apparatus according to any of the preceding claims 6 to 9, further comprising means for visualizing a route relating to the object's behaviour on a map or a floor plan as an output.

11. The apparatus according to any of the preceding claims 6 to 10, wherein at least part of more than one data sources are independent from each other.

12. The apparatus according to any of the preceding claims 6 to 11, wherein the external device is one or more of the following: a display, a mobile device, an access control system, an alarm system, a security system, or the data source. N N

13. The apparatus according to any of the preceding claims 6 to 12, further 3 comprising means for retrieving historical data to be used for processing n the received data. = 30 o

14. The apparatus according to any of the preceding claims 6 to 13, further 3 comprising means for retrieving the floor plan or the map from a = memory, wherein said floor plan is a floor plan of the monitoring target, and wherein said map is a map of a planned route of the monitoring target.

15. The apparatus according to any of the preceding claims 6 to 14, further comprising at least one processor, memory including computer program code, the memory and the computer program code.

N O N O <Q n I a a O 00 O LO N O N