Detecting Suspicious Activity

Events in a stream often form patterns. In previous posts, I describe a few simple algorithms that can be used to identify event patterns in a stream of events. These algorithms are focused on different types of events occurring in a sequence, chronologically. When the same type of event occurs repeatedly within a fixed time period, the repetition may also be recognized as a pattern. In some situations, multiple occurrences of the same type of event may even be considered suspicious activity.

A simple example of this is a vehicle circling around a block. Usually, when a vehicle circles around the block lots of times, something's up. Think of the creepy white van in espionage thriller movies.



In this hypothetical scenario, the video stream from a single IP camera positioned adequately to capture high quality images, is fed to video analytics algorithms that detect vehicles moving through the scene. More specifically, there are two video analytics algorithms applied here, one to detect motion in one direction, and another to recognize an object based on object type and color.

In the animation above, the red car moving through a region of interest in the camera's field of view (the green circle) generates a specific type of event. The analysis of the images generates this event each time directional motion is detected and the object type, a red car, is recognized. To simplify things further, let's say the analytics generate event type "A" when these things happen.

My next post focuses on how to detect the re-occurrence of this event within a time constraint and how to setup data conditions in the rules engine to spot this kind of suspicious activity in real-time.