The present invention relates to a building-specific anomalous event detection and alerting system, particularly for allowing individual users to view anomalous events in a specific building location. A method of determining anomalous events at a specific building location is also provided.

Security systems in most buildings, in particular in residential and small to medium-sized commercial properties, are binary in nature. For example, burglar alarms are either activated and triggerable upon detection of an intruder, or are inactive. Such sensors are typically closed systems, and are therefore not readily capable of interlinking with other sensor systems. Such systems are also quite crude in that they must be individually activated by the owner, user or monitor of the building, and therefore control of a plurality of different systems is relatively cumbersome, as a result of the lack of interoperability of said systems. Similarly, some systems allow for conditional programming to overcome this issue to a degree, for example, allowing a user to activate a system only during periods in which the building is occupied. However, such systems can be relatively inflexible and/or not adaptable to changing requirements, and changes to the usage pattern of a building can result in unusual consequences. Users of such systems are often discouraged from activating the systems due to the potential to trigger unexpected and/or undesirable alarm events, or to trigger unwanted actions, for instance, deactivation of a lighting system in an unmonitored part of a building. It is therefore an object of the present invention to provide a single point of access for a user to monitor the presence of anomalous events in a specific building location in order to overcome and/or obviate the above-mentioned difficulties.

According to a first aspect of the invention, there is provided a building-specific anomalous event detection and alerting system comprising: a plurality of building status sensors arranged at a specific building to monitor at least one building status characteristic thereof; a controller arranged to receive an output signal from each of the plurality of building status sensors, the controller having a processor capable of calculating a building context model from at least one unperturbed said building status characteristic from which can be determined an anomalous alteration of the or each of the monitored building status characteristics; and an alert output means for alerting a user to a said anomalous alteration of the or each monitored building status characteristic which is indicative of an anomalous event at the building; and a building occupancy determining circuit associated with the processor which is arranged to determine an occupancy status of the building, wherein the controller is arranged to selectively activate the alert output means based on the occupancy status of the building. According to a second aspect of the invention, there is provided a building-specific anomalous event detection and alerting system comprising: a plurality of building status sensors arranged at a specific building to monitor at least one building status characteristic thereof; a controller arranged to receive an output signal from each of the plurality of building status sensors, the controller having a processor capable of calculating a building context model from at least one unperturbed said building status characteristic from which can be determined an anomalous alteration of the or each of the monitored building status characteristics; a timing data acquisition means associated with the controller permitting chronological information data to be associated with each of the plurality of different building status characteristics; and an alert output means for alerting a user to a said anomalous alteration of the or each monitored building status characteristics which is indicative of an anomalous event at the building, the alert output means being triggered when a plurality of said anomalous alterations are detected sequentially as determined by reference to the chronological information data

By determining a building context model for a specific building location, it is possible for the system to account for perturbations to the status of the building which is indicative of anomalous events from normal conditions. This allows the system to account for, for example, the expected occupancy status of a building prior to triggering an alert which is indicative of an anomalous event, advantageously reducing the burden for condition programming on the part of the user. The context model can also permit the tailoring of alert routing and security level of the building based on a detailed, contextually-appropriate understanding of the location, such as the occupancy status.

Preferably, the or each unperturbed building status characteristic may be determined from historical building status characteristics retrieved from the plurality of building status sensors, in which case, the processor may be arranged to determine the or each predefined unperturbed building status characteristic from historical building status characteristics using a machine-learning algorithm, predictive analysis and/or artificial neural network.

The controller of the system is beneficially able to learn from the normal conditions within the building in order to generate the context model. This ensures that the nominal default status of the building is assembled based on actual data, rather than particular assumptions about the status of a building at any given time from, for example, averaged data for buildings of the specific type.

The plurality of building status sensors may be pre-existing building status sensors for a specific building location.

Preferably, the plurality of building status sensors may be arranged to monitor a plurality of different building status characteristics. These may, for example, include at least one of: an optical imaging device; a motion sensor; a fire and/or smoke sensor; a fluid leak or flow sensor; an existing building automation control system; an embedded software capability in a building component; or an energisable device or system activation sensor.

In a preferred scenario, it is envisaged that the system is able to receive output information from pre-existing building sensors, such as smoke detectors, burglar alarms, lighting systems, or leak detectors. In doing so, the present system is able to construct a complete picture of the normal status of the building in its building context model, allowing a plurality of different characteristics to be simultaneously and simply monitored.

The system may further comprise a timer in communication with the controller, the timer permitting time-dependent building status characteristics to be monitored.

By providing a timer, chronological information data can be provided as part of the system. Since the triggering of different types or differently-positioned sensors within the building may be indicative of particular building usage patterns, it may therefore be possible to use timing information to classify or categorize events that might be anomalous to normal building usage patterns, as and when they occur. Such information could also be utilised to select a most appropriate response to a given alert.

A user device may be provided in communication with the controller, the alert output means outputting alerts which are indicative of the anomalous event to the user device. Said user device may be in bi-directional communication with the controller to permit manual control of the controller from the user device. Additionally or alternatively, there may be a third party device, the alert output means outputting alerts which are indicative of the anomalous event to the third party device. Remote control of the system advantageously allows a user who is remote to the building to take appropriate steps to rectify any issues which arise as a result of anomalous events. For example, overriding of clearly erroneous alerts could be achieved remotely, for instance, if the building was validly occupied outside of normal operating hours. Preferably, the processor may include a categorization means for categorizing indicative anomalous events at the said building. The processor may include a sensor output linking means for determining contextual links between building status characteristics of the building.

By providing means for categorizing and/or determining contextual links between the outputs of different sensors, it may become possible to determine exactly what is occurring in the building, and therefore effectively triage the response to the anomalous event without significant effort on the part of the user to investigate of their own accord.

There may be further provided an alert escalation means in communication with the alert output means for alerting a third party to the anomalous event, in the event that the user does not adequately respond to the said anomalous event. If the initial respondent is not available for any reason, an escalation means may allow for secondary points of contact for the building management to be contacted in the event of particularly serious anomalous activity. For example, flood damage is a particularly destructive force for affected buildings, and rapid response is imperative. Escalation of the alerts allows for a coherent response to be organised in a quick and effective manner. Optionally, the plurality of building status sensors may be grouped according to a predefined use pathway of the building. Said predefined use pathway of the building may be an entrance and/or exit passageway of the building.

The determining of nominal pathways in the buildings, that is, contextually linked sensors which are indicative of particular characteristics of the building, may further assist with the categorization of particular anomalous events. For example, the triggering of sequential motion sensors in a building that differ from the normal pathways of sequential triggers, for example, the detection of movement at a perimeter window followed by a perimeter office and service corridor, is a fairly clear indicator of unauthorised intrusion into the building.

According to a third aspect of the invention, there is provided a method of determining anomalous events at a specific building location, the method comprising the steps of: a] providing a context model for the specific building location comprising at least one unperturbed building status characteristic of the building; b] determining a real-time status of the specific building location using at least one monitored building status characteristic of the said location; and c] comparing the real-time status of the specific building location to the context model of the specific building location to determine whether an anomalous event has occurred or is occurring.

By comparison of a context model of a building to the real-time status of the said building, it becomes much more straightforward to both detect and categorize anomalous events. This beneficially reduces the alert overload which may be experienced by a user were they to receive individual information regarding each individual building status characteristic.

Optionally during step a], the or each unperturbed building status characteristic may be determined from historical building status characteristics monitored at the specific location in the absence of an anomalous event.

Preferably, the context model may be a time-dependent context model of building status characteristics of the specific locations.

By reviewing historical building status characteristics, and/or applying timestamps to particular events, it becomes easier to identify a benchmark from which to determine what constitutes an anomalous event, and therefore ensures that a response can be adequately organised.

There may further comprise a step d], which is subsequent to step c], of outputting an alert to a user and/or third party in the event of an anomalous event.

The alerting of individuals to the presence of an anomalous event ensures that an organised response to the event can be arranged, if necessary, which can advantageously limit the damage caused by deleterious anomalous events, such as leakages, fires or intrusion, or energy wastage through lighting or heating systems remaining active in areas which are regularly unoccupied for many hours.

Step c] may include a further stage of determining an occupancy status of specific location in order to determine whether an anomalous event has occurred.

Determining the occupancy status of the building may result in a change in the threshold for what is considered an anomalous event; in a residential property, for example, the occupant is typically present during evenings and weekends, and therefore will be likely to trigger motion sensors if active during this period.

Preferably there may be a step e], which is subsequent to step c], of determining a severity of the anomalous event and prioritising the severities of the anomalous events where a plurality of different anomalous events is determined.

Categorization of the severity of anomalous events can advantageously result in anomalous events of greater importance, such as a fire, being treated in an appropriate manner compared with, for instance, a broken thermostat.

During step c], a plurality of real-time statuses may be compared to the context model of the specific building location, an anomalous event being determined only in the event of a sequential change in more than one said monitored building status characteristic.

By applying sequential monitoring of contextually linked building status sensors, it may become possible to retrieve more accurate information relating to the exact nature of a particular anomalous event, which may in turn advantageously inform the type of response. According to a fourth aspect of the invention, there may be provided a building-specific anomalous event detection and alerting system comprising: a plurality of building status sensors arranged at a specific building to monitor at least one building status characteristic thereof; a controller arranged to receive an output signal from each of the plurality of building status sensors, the controller having a processor capable of calculating a building context model from at least one unperturbed said building status characteristic from which can be determined an anomalous alteration of the or each of the monitored building status characteristics; an alert output means for alerting a user to a said anomalous alteration of the or each monitored building status characteristic which is indicative of an anomalous event at the building; and an alert escalation means in communication with the alert output means for alerting a third party to the anomalous event, in the event that the user does not adequately respond to the said anomalous event.

According to a fifth aspect of the invention, there is provided a building-specific anomalous event detection and alerting system comprising: a plurality of building status sensors arranged at a specific building to monitor at least one building status characteristic thereof; a controller arranged to receive an output signal from each of the plurality of building status sensors, the controller having a processor capable of calculating a building context model from at least one unperturbed said building status characteristic from which can be determined an anomalous alteration of the or each of the monitored building status characteristics; and an alert output means for alerting a user to a said anomalous alteration of the or each monitored building status characteristic which is indicative of an anomalous event at the building.

The invention will now be more particularly described, by way of example only, with reference to the accompanying drawings, in which:

Figure 1 shows a diagrammatic representation of the inside of a building having a first embodiment of a building-specific anomalous event detection and alerting system in accordance with the first aspect of the invention, the building being in a normal, occupied condition;

Figure 2 shows a diagrammatic representation of the building of Figure 1 in a normal, unoccupied condition;

Figure 3 shows a diagrammatic representation of the building of Figure 1 following an anomalous event, which is represented by an intruder in the building;

Figure 4 shows a diagrammatic representation of the building of Figure 1, the intruder having been detected by a plurality of building status sensors to thereby trigger an alert output means of the building-specific anomalous event detection and alerting system;

Figure 5 shows a diagrammatic representation of the building of Figure 1, indicating a response to the alert output by the alert output means in response to the detection of the intruder;

Figure 6 shows a diagrammatic representation of a second embodiment of a building-specific anomalous event detection and alerting system in accordance with the first aspect of the invention;

Figure 7 shows a diagrammatic representation of a method of determining anomalous events at a specific building location in accordance with the second aspect of the invention;

Figure 8 shows an exemplary embodiment of a user interface of a building-specific anomalous event detection and alerting system in accordance with the first aspect of the invention; and Figure 9 shows a flow diagram of an escalation procedure following the detection of an anomalous event at a specific building location.

Referring firstly to Figure 1, there is shown a building, indicated globally at 10, into which is installed a building-specific anomalous event detection and alerting system 12 which comprises several component parts.

There are provided in specific locations in the building 10 a plurality of building status sensors 14, each building status sensor 14 here being illustrated as a motion sensor for detecting the presence of individuals 16 within the building 10. Whilst motion sensors are illustrated for the purposes of this detailed description, it will be appreciated that a variety of different types of building status sensor 14 could feasibly be provided, and this will be discussed in more detail hereafter.

The building-specific anomalous event detection and alerting system 12 also comprises a controller 18 which is arranged to receive and subsequently process an output signal from each of the plurality of building status sensors 14. The controller 18 is in communication with, directly or indirectly, an alert output means 20 or alert output circuit which is able to provide a means of alerting interested parties, such as the building owner, to the presence of an anomalous event in the building 10.

In practice, this can be achieved by determining a context model of the building 10, using the building status sensors 14, for instance. This context model can assist with the rationalisation of what determines an anomalous event in any given set of circumstances.

In the embodiment of the invention depicted in Figure 1, the building 10 is occupied, and the controller 18 is able to construct a context model of the building 10 under normal, occupied circumstances. In such a context, the building status sensors 14 may be triggered repeatedly and expectedly so; where individuals 16 are present in the building 10, for instance, during the evenings, motion sensors which may be part of a standard burglar alarm installation may be triggered with no effect. The controller 18 is preferably able to receive this information in order to build up a context model of the building 10 under normal, expectedly-occupied conditions.

Similarly, a normal unoccupied condition could be conceived, for example, whilst the occupying individuals 16 of the building were necessarily at other locations, such as their places of work. Such a scenario is illustrated in Figure 2; the depicted intruder 22 is outside of the building 10. In the normal unoccupied condition, the controller 18 is preferably able to build up a context model of the building 10 via an on-board processor, for situations where it would not be expected that the building status sensors 14 are detecting the presence of an individual 16 in the building 10. The processor may have a building occupancy determining circuit which is arranged to determine an occupancy status of the building 10.

The controller 18 is optionally able to combine the determined context models of the building 10 into a full, time-dependent context model of the building 10, in which an unperturbed state at any given time can be presented. For an expected occupied condition, the controller 18 could be programmed so as to return an anomalous event only in exceptional circumstances, whereas in an expected unoccupied condition, determined from the occupancy status of the building, it would be expected that any detection of the presence of an intruder 22 would be registered as an anomalous event by the controller 18.

Figure 3 illustrates such a scenario; the intruder 22 has illicitly entered the building 10 whilst the building 10 is unoccupied, and therefore the context model of the building will reflect this. The intruder 22 is detected by one of the building status sensors 14, and at this point, the controller 18 may raise an alert via the alert output means 20.

However, the set-up of the building status sensors 14 may be such that the sensors 14 are grouped according to a predefined use pathway of the building 10, such as in the depicted embodiment of Figure 4, having a plurality of motion sensors spaced along corridors of the building 10. In providing such a grouped arrangement, it becomes possible for the controller 18 to receive sequential information from the building status sensors 14 which may be more clearly indicative of an anomalous event occurring.

For instance, disturbances in airflow in the building 10 could cause accidental triggering of a motion sensor system in a building. However, if an intruder 22 is present in the building 10, there will be an expected pathway that they might follow through the building 10. For example, the detection of movement at a perimeter window of the building, followed by similar detection in a perimeter office and/or service corridor, during a period when the building is expected to be unoccupied, is indicative of intrusion. As such, the controller 18 can be arranged to discern between various different types of anomalous alteration in the building 10, allowing for the categorization of anomalous events within the building 10 which would otherwise not be possible. The building-specific anomalous event detection and alerting system 12 is set up or configured so as to raise an alert using the alert output means 20, and, as illustrated in Figure 5, this could be as simple as contacting the requisite authorities appropriate for the situation, such as the security officer 24 shown. The categorization of anomalous events may be used to determine the response to the anomalous event. It is expected that the controller 18 would be arranged so as to selectively activate the alert output means 20 for situations in which the building would be unoccupied or only partially occupied; this can be determined via the building occupancy determining circuit. However, it will be appreciated that as the building-specific anomalous event detection and alerting system 12 could be continuously operation, such a building occupancy determining circuit could feasibly be dispensed with.

The embodiment of the invention as illustrated in Figures 1 to 5 is merely a simple means of indicating how the building-specific anomalous event detection and alerting system 12 is intended to work; however, this is a very limited depiction of how the system 12 might operate, and there may be several different operations possible. For instance, whilst the building status sensors 14 are illustrated as motion sensors, there are many different building status sensors 14 available which may be indicative of different building status characteristics. For instance, optical imaging devices or similar building occupancy sensors, such as video cameras, could be utilised alone or in combination with other devices, with the controller 18 analysing the video feeds for anomalous events. Fire and/or smoke sensors could be provided so as to determine the presence of fire or smoke, and therefore fire hazards in the building 10. Water damage to properties is also a leading cause of building damage, and therefore fluid leak or flow sensors could be provided, for instance to detect the bursting of pipes, perhaps by using water pressure sensors, flow meters on the main supply, or flood water detectors could be provided. Such changes in water flow or pressure, when monitored during a period of expected non-occupancy, would seem to be highly indicative of a leak or burst pipe.

An existing building automation control system or an embedded software capability in a building component could also be utilised to provide contextual output, based on pre-existing capability installed within the building. Furthermore, energisable devices or system activation sensors may be a preferable type of sensor; the activation of, for example, lighting in a building can often be a simple indicator of unexpected presence in a building 10. Other types of building status sensor 14 will be apparent to the skilled person. Any or all of these types of building status sensors 14 could be used to construct the necessary context model of the building 10, and it is indeed preferable that the context model is constructed from a plurality of different building status characteristics so as to be able to provide a fuller depiction of the status of the building 10 thereby indicating when anomalous events occur.

Furthermore, it will be appreciated that the alert output means 20 is illustrated as being a generic form of alert device in Figures 1 to 5, and the skilled person would be able to determine a contextually appropriate alert output means 20. In the depicted embodiment, the alert output means 20, this would typically be an audible and/or visible alarm, indicative of the presence of an intruder 22 into the building 10, which is capable of being investigated by a security officer 24 as indicated. However, in one preferred embodiment of the building-specific anomalous event detection and alerting system, indicated globally in Figure 6 as 112, the alert output means 120 may be considerably more sophisticated. The embodiment depicted in Figure 6 utilises identical or similar reference numerals to those used in respect of the embodiment illustrated in Figures 1 to 5, and further detailed description will be omitted for brevity. A plurality of building status sensors 114 are positioned in a building 10 and these may be indicative of different building status characteristics of the building 10. Each of the building status sensors 114 is in communication with the controller 118, typically in wireless communication, and the outputs thereof can be processed so as to generate a building context model. When an anomalous event is detected, that is, when at least one building status characteristic has been determined by the controller 118 so as to be sufficiently different to that expected in accordance with the building context model, the alert output means 120 can be triggered.

In this embodiment, the alert output means 120 is not necessarily a local alert output; instead, it may comprise a transmitter associated with the controller 118 and capable of outputting an alert to an external device 126. This may be a computing external device 126, for example, being a mobile computing device belonging to an owner or user of the building 10, in which case, textual updates on the status of the building 10 can be directly forwarded to the user. Additionally or alternatively, the external device 126 may belong to a third party, such as a security firm monitoring the security status of the building 10. Optionally, the external device 126 may be in bi-directional communication with the controller 118, thereby allowing an operator of the external device 126 to exercise some form of control over the system 112. For example, if a water leak is detected, the operator could remotely shut down the water supply to the building 10 so as to minimise further property damage, should such functionality be available in the building 10. The methodology of the present invention can therefore be summarised as illustrated in Figure 7, indicated globally as S200. A plurality of unperturbed building status characteristics 228 can be supplied, determined or measured, which can be used to provide a context model for a specific building location, step S201. A plurality of real-time building status characteristics 230 can then be determined or measured in situ, to thereby determine a real-time status of the specific building location, step S202. Comparison of the real-time status to the context model can therefore allow an anomalous event to be determined, step S203, as and when it arises.

The presence of the central controller 118 of the building-specific anomalous event detection and alerting system 112 does, however, permit for more complicated analysis of anomalous events to be performed. For instance, if a timing data acquisition means, such as a timer, timing circuit, clock or similar, is provided, chronological information data can be associated with particular building status characteristics, and therefore classification of anomalous events can be performed based on the time at which or sequence in which they occur. This could, of course, be provided regardless of the presence of any sort of occupancy determination of the building.

The controller 118 can also take advantage of machine learning so as to learn or determine the normal usage patterns of a building 10, which is particularly useful when combined with chronological information data. The controller 118 may be capable of correlating between different building status characteristics and determining whether a sequence of events is expected or indeed anomalous. If machine learning is employed, the building-specific anomalous event detection and alerting system 112 would not require explicit programmatic intervention to allow for judgment calls to be made based on the outputs of the different building status sensors 114, but will instead be able to determine anomalous events based on the updated building context model.

By way of example, if a leak were to be detected at 10am on a Saturday morning in a residential building 10, this may be less important than a leak which is detected at 10am on a Monday morning, where the occupant of the building 10 is more than likely to be at work and the building 10 would be expected to be unoccupied for approximately six hours. This classification of the changes in the building status characteristics, in particular but not necessarily based on timing data, allows for the controller 118 to act as a categorization means, preferably having a specific categorization circuit which is adapted for such a purpose, for categorizing indicative anomalous events at the building 10. The alert output by the alert output means 120 can then be tailored based on the categorization of the anomalous event, for example, according to severity.

An exemplary embodiment of a user interface 332 of a building-specific anomalous event detection and alerting system 112 is illustrated in Figure 8, and might be what would be expected to be transmitted to a user device 126 in the event of a leak. Should a building status sensor 114 have detected a leak, and determined that an anomalous event has therefore occurred by comparison to the building context model, and then the alert output means 120 can generate an alert. In the indicated embodiment of the user interface, the categorization means of the system 112 has determined that there is not expected to be anybody occupying the building 10, and therefore has deemed the anomalous event to be "SERIOUS". This has been stated as such to the user.

As can be seen from the user interface 332, there may also be some form of escalation procedure applicable, whereby third parties are informed of the anomalous event, and this may be performed following the categorization of the anomalous event, for example, by severity.

A procedure for escalation of the alerting following an anomalous event is illustrated by the flow diagram of Figure 9, and indicated globally at S400.

As an anomalous event occurs, step S401, the system detects its presence, step S402, and an alert 434 is triggered from the alert output means 120. A timer can also be triggered, step S403, at the issuing of the alert 434. If, after a set period of time, a response has been received, step S404, then the alert 434 can be stopped, step S405. However, if no response is received, step S406, then escalation occurs, step S406 and the process is repeated for a second recipient; the alert 480' is triggered, the timer started S403', and a response expected. The alert 480' is stopped is a response is received, step S404', else, the escalation can be repeated S406'.

Such a system allows for automatic escalation control, but in each case, the recipient of the alert may be provided with a centralised control or access point to the building-specific anomalous event detection and alerting system 112. This could, for example, include a web-hosted dashboard via which the system 112 can be administered, or could be a user interface such as that shown in Figure 8, in which the users or operators of the building can readily receive alerts and potentially control the functionality of the building-specific anomalous event detection and alerting system 112.

This escalation control could be provided independently of the use of the occupancy determination of the building; it may therefore be possible to provide a system comprising a plurality of sensors 114 with a controller 118 which has a processor capable of calculating a building context model from at least one unperturbed said building status characteristic 228 from which can be determined an anomalous alteration of the or each of the monitored building status characteristics 230, the alert output means 120 for alerting a user to a said anomalous alteration of the or each monitored building status characteristic 230 indicative of an anomalous event, and an alert escalation means in communication with the alert output means 120 for alerting a third party to the anomalous event, in the event that the user does not adequately respond to the said anomalous event. The could be provided with any or all of the above-described features described in respect of the previous embodiments of the invention.

It will be appreciated that although the controller may utilise machine learning in order to construct the context model in the first instance, there may be pre-determined or pre-programmed context models which are applied to the system.

Although the presence of a literal pathway through a building has been alluded to previously, and therefore groups of building status sensors can be provided for, this can be extended beyond mere physical location so as to extend to contextually linked building status characteristics; this may be achieved by providing a sensor output linking means, such as a network interface circuit, associated with a wireless computer network for example, associated with the processor of the controller.

By way of example, a leak in a pipe might be contextually linked to the temperature in a building, as a central heating system shuts down, or motion sensors might be triggered sequentially with the activation of lighting in a particular room. Anomalous events can therefore be determined from unexpected changes to building status characteristics out of sequence, or out of logical conjunction with other building status characteristics with which they should be grouped. Whilst a building is referred to throughout for the building-specific anomalous event detection and alerting system, it will be appreciated that this could refer to a part of a building, or a building complex comprising a plurality of different buildings, and the invention should not be taken to be limited to use in a single self-contained building. It is therefore possible to provide a building-specific anomalous event detection and alerting system which allows for anomalous event sot be detected and a user alerted by building an overall context model of the building which is being monitored, so as to create an overall impression of how the normal building operation appears when monitored.

This can be most readily achieved by linking a plurality of different building status sensors to a single point of control, enabling all alerts and indications of anomalous events to be funnelled through a single point of access, greatly simplifying anomalous event detection.

It may also be possible to provide a means of determining the sequential occurrence of incidents at a building location in order to differentiate between normal and anomalous patterns. Furthermore, it may also be possible to monitor the user's response to the identification of anomalous events, and in turn escalate problem situations automatically if no response is apparent.

The words 'comprises/comprising' and the words 'having/including' when used herein with reference to the present invention are used to specify the presence of stated features, integers, steps or components, but do not preclude the presence or addition of one or more other features, integers, steps, components or groups thereof.

It is appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable sub-combination. The embodiments described above are provided by way of examples only, and various other modifications will be apparent to persons skilled in the field without departing from the scope of the invention herein described and defined.