Reducing false alarms in security systems

Abstract

A security system includes a security system controller and a plurality of security sensors operably coupled with the security system controller. The security system includes a plurality of configuration settings that define when a particular alarm is issued by the security system based at least in part on events detected by the security sensors. The security system controller receives each of the events detected by the security sensors. The security system controller stores event data including an event type, a time value indicating when the event occurred, and an identifier of the security sensor that detected the event. The security system controller analyzes the stored event data to identify and output one or more changes to one or more of the plurality of configuration settings in order to reduce false alarms issued by the security system.

Description

Technical Field

[0001] This disclosure relates generally to security systems. More specifically, this disclosure relates to methods and systems for reducing false alarms in security systems. Background Technology

[0002] Security systems typically employ a variety of different security sensors to protect protected areas. Some security systems have static configuration settings configured when the system is initially installed. These static configuration settings can help reduce false alarms issued by the security system. Such static configuration settings may, for example, limit cross-area sensor pairs. Cross-area sensor pairs must typically both be triggered within a predetermined time before the security system will issue an alarm. In another example, a static configuration setting may limit an entry delay, whereby after entering the protected area, the user must enter a password, etc., within an entry delay period, otherwise the security system will issue an alarm. In yet another example, a static configuration setting may limit a departure delay, whereby after arming the security system, the user must leave the protected area within a departure delay period, otherwise the security system will issue an alarm. These are just examples.

[0003] Setting up static configuration settings can require significant expertise, and even then, optimal settings may not be achieved. Furthermore, over time, at least some of the static configuration settings may become less effective. What is desired are methods and systems for automatically updating the configuration settings of security systems. Summary of the Invention

[0004] This disclosure relates to security systems. In one example, a method for reducing false alarms issued by a security system is provided. An exemplary security system includes a security system controller and a plurality of security sensors operatively coupled to the security system controller. Each of the plurality of security sensors is configured to monitor and detect one or more predetermined events in a secure space. The exemplary security system also includes a plurality of configuration settings that define when a specific alarm is issued by the security system, at least in part, based on events detected by the plurality of security sensors. The exemplary method includes the security system controller receiving each of the events detected by the plurality of security sensors. The security system controller stores event data for each received event, including an event type, a time value indicating when the event occurred, and an identifier of the security sensor that detected the event. The security system controller analyzes the stored event data to identify one or more changes to one or more of the plurality of configuration settings defining when a specific alarm is issued by the security system, in order to reduce false alarms issued by the security system. The security system controller outputs one or more of the identified changes to the configuration settings. In some cases, the security system controller automatically implements one or more of the identified changes.

[0005] In another example, a security system is configured to monitor a protected space. The security system includes a security system controller configured to control the operation of the security system and multiple security sensors positioned around the protected space. Each of the multiple security sensors is operatively coupled to the security system controller such that each security sensor can transmit a detected event to the security system controller. The security system controller is configured to receive each of the events detected by the multiple security sensors. The security system controller is configured to reference multiple configuration settings that, at least in part, define when a specific alarm should be issued by the security system based on the events detected by the multiple security sensors. The security system controller is configured to analyze the received events to identify one or more changes to one or more of the configuration settings in order to reduce false alarms issued by the security system and to output one or more of the identified changes to the configuration settings. In some cases, the security system controller is configured to analyze the received events when the security system is armed or disarmed and / or when the security system is armed and disarmed.

[0006] In another example, a method is provided to improve the performance of a security system having multiple security sensors and multiple configuration settings assigned to at least some of the security sensors. The method includes tracking when each of the multiple security sensors is activated. Activation data over a period of time is stored, identifying which security sensor is activated and when it is activated. The stored activation data is analyzed to identify configuration settings that can be optimized, and one or more changes to one or more of the configuration settings are output to improve the performance of the security system.

[0007] The foregoing summary is provided to facilitate understanding of the innovative features unique to this disclosure and is not intended as a complete description. A full understanding of this disclosure can be obtained by considering the entire specification, claims, drawings, and abstract as a whole. Attached Figure Description

[0008] This disclosure can be more fully understood by considering the following description of various examples in conjunction with the accompanying drawings, in which:

[0009] Figure 1 It is a schematic block diagram of an exemplary safety system that includes safety sensors and a safety system controller;

[0010] Figure 2 It is shown Figure 1 A flowchart illustrating the exemplary configuration features of the safety system controller;

[0011] Figure 3 This is a flowchart illustrating an exemplary method;

[0012] Figure 4 This is a flowchart illustrating an exemplary method;

[0013] Figure 5 This is a schematic block diagram illustrating an exemplary safety system;

[0014] Figure 6 This is a flowchart illustrating an exemplary method;

[0015] Figure 7 This is a schematic diagram of the protected area; and

[0016] Figure 8 This is a schematic diagram of the protected area.

[0017] While this disclosure is subject to various modifications and alternatives, its details have been shown by way of example in the accompanying drawings and will be described in detail. However, it should be understood that this disclosure is not intended to limit it to the specific examples described. Rather, it is intended to cover all modifications, equivalents, and alternatives that fall within the substance and scope of this disclosure. Detailed Implementation

[0018] The following description should be read with reference to the accompanying drawings, in which similar elements in different drawings are numbered in the same manner. The drawings are not necessarily drawn to scale and depict examples that are not intended to limit the scope of this disclosure. While examples of various elements are shown, those skilled in the art will recognize that many of the examples provided have suitable alternatives that can be utilized.

[0019] This document assumes that all numbers are modified by the term “about” unless otherwise explicitly stated. Expressions of numerical ranges using endpoints include all numbers contained within that range (e.g., 1 to 5 includes 1, 1.5, 2, 2.75, 3, 3.80, 4, and 5).

[0020] As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” include plural references, unless otherwise expressly stated. As used in this specification and the appended claims, the term “or” is generally used in its meaning to include “and / or,” unless otherwise expressly stated.

[0021] It should be noted that references to "one embodiment," "some embodiments," or "other embodiments" in the specification indicate that the described embodiments may include specific features, structures, or characteristics, but each embodiment may not necessarily include that specific feature, structure, or characteristic. Furthermore, these phrases do not necessarily refer to the same embodiment. Additionally, when a specific feature, structure, or characteristic is described in conjunction with an embodiment, it is conceivable that, whether explicitly described or not, that feature, structure, or characteristic may be applied to other embodiments, unless otherwise expressly stated otherwise.

[0022] Figure 1 This is a schematic block diagram of an exemplary security system 10 configured to provide monitoring of a protected area (sometimes referring to a region of interest). The exemplary security system 10 includes a plurality of security sensors 12 (e.g., one or more) disposed within or otherwise covering at least a portion of the region of interest. In the example shown, the security sensors are labeled 12a, 12b, and 12c, respectively. Although a total of three security sensors 12 are shown, it should be understood that the security system 10 may include one security sensor or, for example, dozens, hundreds, or even thousands of security sensors 12 disposed around the protected area. Depending on the application, the security sensors 12 may include any of a variety of different security sensor types. For example, the security sensors 12 may include motion sensors, such as, but not limited to, PIR sensors. The security sensors 12 may include door contact sensors and / or window contact sensors. The security sensors 12 may include glass breakage detectors. The security sensors 12 may include one or more cameras, which optionally have video processing capabilities. Security sensor 12 may include access control card readers, biometric card readers, and / or beam-blocking detectors. Security sensor 12 may include smoke detectors, gas detectors, etc. These are just examples.

[0023] The exemplary security system 10 includes a security system controller 14 configured to control at least some aspects of the operation of the security system 10. In the illustrated example, the security system controller 14 is operatively coupled to each of the security sensors 12, enabling the security system controller 14 to receive signals from the security sensors 12 indicating possible intrusion or other potential security events. The security system controller 14 may be configured to interpret the signals from the security sensors 12 and determine whether a potential problem exists. The exemplary security system controller 14 includes a display 16, a memory 18, and a processor 20 operatively coupled to the display 16 and the memory 18. Although a single processor 20 is shown, it should be understood that the security system controller 14 may include, for example, two or more different processors. In some cases, the security system controller 14 may be distributed. In some cases, the security system controller 14 may be an operator console, etc.

[0024] In some cases, security sensor 12 may communicate directly with security system controller 14. In some cases, security system controller 14 may be distributed, including local security system controllers (such as a security system controller) and remote off-site security system controllers. As shown, in some cases, security sensor 12 may communicate directly with edge device 22. In some cases, edge device 22 may provide some of the functionality that might otherwise be provided by security system controller 14 and / or cloud-based server 24. When provided, cloud-based server 24 may be configured to send and receive information between edge device 22 and security system controller 14, and in some cases provide processing capabilities to support the methods described herein. In some cases, edge device 22 may be an edge controller. In some cases, the functionality of security system controller 14 may be distributed between security system controller 14 and edge device 22, between security system controller 14 and cloud-based server 24, between edge device 22 and cloud-based server 24, or between edge device 22, cloud-based server 24, and security system controller 14. In some cases, edge device 22 and / or cloud-based server 24 may provide the functionality of a remote off-site controller. In some cases, additional devices (not shown) may be provided to perform some or all of the functions of security system controller 14.

[0025] Figure 2This is a flowchart illustrating a series of steps 26 that the security system controller 14 can be configured to perform. The security system controller 14 can be configured to receive each of the events detected by each of the security sensors 12, as shown in box 28. It should be understood that the security system 10 may have an armed state and a disarmed state. When armed, the security system controller 14 actively listens for signals from the security sensors 12. During the disarmed state, the security system controller 14 may still receive signals from the security sensors 12, but does not trigger any alarms in response to those signals. It should be understood that the amount of data that can be analyzed when the security system 10 is disarmed increases significantly as it helps to understand how the security system 10 operates over time and the various interactions between the various security sensors, and how a particular event detected by one security sensor 12 is verified or confirmed by one or more other security sensors 12. This is because it corresponds to a greater presence of people in the building or building space corresponding to the protected space, and therefore more activities and activity patterns to detect by the security sensors 12.

[0026] The security system controller 14 can be configured to reference a plurality of configuration settings that, at least in part, define when a specific alarm should be issued by the security system 10 based on events detected by the security sensors 12, as shown in box 30. Configuration settings may include, for example, cross-region pairing settings that define how two (or more) security sensors 12 are paired together to form a cross-region sensor group, wherein the two (or more) security sensors 12 must indicate detected events within a specific time period to issue an alarm. Other configuration settings may include, for example, abort window settings, entry delay settings, exit delay settings, and exit restart settings. These configuration settings are merely examples and may be stored in memory 18.

[0027] Security system controller 14 can be configured to analyze received events to identify one or more changes to one or more configuration settings in the configuration settings to help reduce false alarms issued by the security system, as shown in box 32. In some cases, security system controller 14 can analyze received events to identify one or more patterns in stored event data to identify one or more changes to the configuration settings to reduce false alarms issued by the security system. Security system controller 14 may, for example, utilize machine learning to analyze received events. Security system controller 14 can be configured to output one or more of the identified changes to the configuration settings, as shown in box 34.

[0028] Figure 3 and Figure 4 It is a flowchart illustrating an exemplary method that can be coordinated by a cloud-based server 24, a security system controller 14, and / or an edge device 22 and thus executed by the security system 10. Figure 3This is a flowchart illustrating an exemplary method 36 for reducing false alarms issued by a security system (such as security system 10), which has a security system controller (such as security system controller 14) and a plurality of security sensors (such as security sensor 12) operatively coupled to the security system controller. Each of the plurality of security sensors is configured to monitor and detect one or more predetermined events in a secure space. The security system includes a plurality of configuration settings that define when a specific alarm is issued by the security system based at least in part on events detected by the plurality of security sensors. Method 36 includes the security system controller receiving each of the events detected by the plurality of security sensors, as shown in box 38. The security system controller stores event data, wherein the event data for each received event includes, for example, an event type, a time value indicating when the event occurred, and an identifier of the security sensor that detected the event, as shown in box 40.

[0029] The security system controller analyzes stored event data to identify one or more changes to one or more of a plurality of configuration settings that define when a specific alarm is issued by the security system, in order to reduce false alarms issued by the security system, as shown in box 42. In some cases, the security system controller analyzes stored event data to identify one or more patterns in the stored event data to identify changes to one or more of a plurality of configuration settings that define when a specific alarm is issued by the security system, in order to reduce false alarms issued by the security system. In some cases, the security system controller may leverage machine learning to analyze the stored event data.

[0030] An exemplary security system includes an armed state and a disarmed state. In some cases, the security system controller stores event data collected when the security system is in the disarmed state, and when the security system controller identifies one or more changes to configuration settings that define when a specific alarm is issued by the security system, it analyzes the stored event data corresponding to the disarmed state to reduce false alarms issued by the security system. The security system controller outputs one or more of the identified changes to the configuration settings, as shown in box 44. In some cases, the security system controller automatically implements one or more of the identified changes. In some cases, the user can selectively implement one or more of the identified changes.

[0031] In some cases, one of multiple configuration settings defines a first security sensor and a second security sensor among multiple security sensors as a set of over-area sensors (e.g., an over-area sensor pair), wherein each of the first and second security sensors must detect a corresponding event within an over-area time period associated with the set of over-area sensors before the security system will issue a corresponding alarm. In some cases, the first security sensor among multiple security sensors is a first sensor type for detecting a first event type, and the second security sensor among multiple security sensors is a second sensor type for detecting a second event type, wherein the first event type and the second event type are the same (or different).

[0032] In one example, one of the changes identified in the configuration settings output by the security system controller may include changing a second security sensor in a set of cross-area sensors mentioned above to a third security sensor in a set of multiple security sensors. In another example, one of the changes identified in the configuration settings output by the security system controller may include adding a third security sensor in a set of multiple security sensors to the set of cross-area sensors, wherein all three security sensors must detect the associated change or event within the cross-area time period associated with the set of cross-area sensors before the security system will issue a corresponding alarm. In another example, one of the changes identified in the configuration settings output by the security system controller may include changing the cross-area time period associated with the set of cross-area sensors. In yet another example, one of the changes identified in the configuration settings output by the security system controller may include adding two or more additional cross-area security sensors to a set of multiple security sensors.

[0033] In some cases, one of the multiple configuration settings may include an abort window with an abort time limit. When provided as such, one of the identified changes to the configuration setting may include a change to the abort time limit. In some cases, one of the multiple configuration settings may include an entry and / or exit delay. When provided as such, one of the identified changes to the configuration setting may include a change to the entry and / or exit delay.

[0034] Figure 4This is a flowchart illustrating an exemplary method 46 for improving the performance of a security system (such as security system 10) having multiple security sensors (such as security sensor 12) and multiple configuration settings covering at least some of the multiple security sensors. Exemplary method 46 includes tracking when each of the multiple security sensors is activated, as shown in box 48. Activation data identifying which security sensor is activated and when it is activated is stored over a period of time, as shown in box 50. The stored activation data is analyzed to identify configuration settings that can be optimized, as shown in box 52. One or more changes to one or more of the configuration settings are output to improve the performance of the security system, as shown in box 54.

[0035] Figure 5 This is a schematic block diagram of security system 56. The illustrative security system 56 can be considered an example of security system 10. Security system 56 includes multiple sensors 58, labeled 58a, 58b, 58c, and 58d respectively. Although a total of four sensors 58 are shown, it should be understood that security system 56 may include fewer or more sensors 58. At least some of the sensors 58 may include motion sensors, such as, but not limited to, PIR sensors. Alternatively or additionally, at least some of the sensors 58 may include door contact sensors and / or window contact sensors. Alternatively or additionally, at least some of the sensors 58 may include glass breakage detectors. Alternatively or additionally, at least some of the sensors 58 may include one or more cameras, which optionally have video processing capabilities. These are merely examples.

[0036] In the example shown, sensor 58 provides a signal to control panel 60. Control panel 60 provides suggestions as output to safety panel console 62. In some cases, safety panel console 62 can be considered as part of safety system controller 14, which may, for example, display the suggested improvements on display 16. It can be seen that control panel 60 can be considered to include multiple individual logic blocks. These logic blocks may each represent software with specific functions, although logic blocks may also be represented as hardware, i.e., individual circuits. In some cases, control panel 60 can be considered to include components that may exist in… Figure 1 The functions of one or more of the security system controller 14, edge device 22, and cloud-based server 24.

[0037] Sensor data from sensor 58 is passed to the security application box 64. Sensor events detected by the security application box 64 are passed to the data pool 66. Filtered events found in the data pool 66 are provided to the data analysis box 68. Analyzed events from the data analysis box 68 are passed to the machine learning box 70. It should be understood that events and corresponding actions can be passed back and forth between the security application box 64 and the machine learning box 70. The machine learning box 70 outputs suggestions to the security dashboard console 62.

[0038] Figure 6 This is a flowchart illustrating an exemplary method 72 that can be performed to improve the performance of a security system (such as security system 10 or security system 56). Security system events are reported, as shown in box 74. In some cases, via... Figure 5 The security application box 64 identifies security system events and reports them to data pool 66. Specific events can be filtered, as shown in box 76. Filtering can be used to limit reported events to, for example, specific locations, specific time ranges, specific sensor types, and / or specific event types (motion, glass breakage, etc.). These are merely exemplary filtering criteria. In some cases, filtered sensor alarm data and / or arming / disarming events are identified, as shown in box 78, and selectively paired together, as shown in box 80, to create new event patterns. In some cases, new event patterns may be generated by... Figure 5 The data analysis box 68 identifies new event patterns. New event patterns are analyzed and the historical sensor alarm pattern table 92 is updated, as shown in box 82. As shown in box 84, in some cases, the updated historical sensor alarm pattern table 92 is weighted, where existing data has a greater weight than new event patterns. For example, historical data may have a weight of 7 / 8 (0.875), while new data may have a weight of 1 / 8 (0.125). This is just an example, and other relative weight values ​​can be applied as needed.

[0039] Historical sensor alarm pattern table 92 identifies various patterns among sensor activations over time. For example, Figure 6The historical sensor alarm pattern table 92 has identified several patterns, including a strong dependency between the activation of the first sensor (sensor 1) and the activation of the second sensor (sensor 2), with a time difference of approximately 90 seconds; a strong dependency between the activation of the second sensor (sensor 2) and the activation of the third sensor (sensor 3), with a time difference of approximately 160 seconds; a strong dependency between the activation of the first sensor (sensor 1) and the activation of the third sensor (sensor 3), with a time difference of approximately 210 seconds; no dependency between the activation of the first sensor (sensor 1) and the activation of the fourth sensor (sensor 4); a very small dependency between the activation of the second sensor (sensor 2) and the activation of the fifth sensor (sensor 5); and a system arming specific to user 1 with a time difference of approximately 50 seconds between the activation of the second sensor (sensor 2). These patterns have been identified from sensor data and recorded in the historical sensor alarm pattern table 92. These patterns can be determined by... Figure 5 The machine learning box 70 processes data to identify suggested changes to the security system's configuration settings to help reduce false alarms.

[0040] In some cases, existing configuration parameters are validated against sensor alarm patterns in Historical Sensor Alarm Patterns Table 92, as shown in Box 86. At Decision Box 88, it is determined whether there is sufficient deviation to justify the configuration setting change. If not, control returns to Box 74. However, if it is determined at Decision Box 88 that there is sufficient deviation to justify the configuration setting change, control is passed to Box 90, where a recommended list is provided to the installer or other user to add, delete, and / or modify existing configuration settings.

[0041] These suggested changes may be in progress and can be adapted to changes in the security system and / or activity in the protected area. For example, if a sensor fails (such as sensor 1), the system can use sensor data to identify and suggest configuration setting changes to include using two or more of the remaining sensors and another cross-area sensor pair for a different cross-area time period to accommodate the sensor 1 failure. In another example, if a sensor is added to the security system, the system can use sensor data to identify and suggest configuration setting changes to include a cross-area sensor pair using the newly added sensor. In another example, if a new user (e.g., user 2) is hired, and the new user takes a long time to arm the security system and leaves the protected area, the system can use sensor data to identify and suggest configuration setting changes to increase user 2's departure delay. In another example, if activity within the protected area changes due to different traffic patterns or other reasons, the system can use sensor data to identify and suggest configuration setting changes to accommodate the change in activity. These are just examples.

[0042] Figure 7 This is a schematic diagram of a protected area 94 comprising a typical office space, including several offices, a meeting room, several restrooms, a kitchen, and a common area. The common area includes a door contact sensor 96 located near the door of the common area, a first motion sensor 98 located near the door of the kitchen, and a second motion sensor 100 located in a corner of the common area near one of the restrooms. For example, there is currently a cross-border pair formed between the first motion sensor 98 and the second motion sensor 100. One possible suggestion from the analysis for improving the performance of the security system could include modifying the cross-border timing, as shown in 102.

[0043] The analyzed historical data may suggest that it would be more effective to require one of the first motion sensor 98 and the second motion sensor 100 to detect motion within twenty seconds of the other for confirmation, rather than the current thirty-second time limit. This change could be suggested if, for example, the analyzed data indicates that a person crossing a public area from different directions would typically trigger the first and second motion sensors within ten or fifteen seconds of each other. Conversely, if more than thirty seconds are required to cross a public area and trigger the first and second motion sensors 98 and 100, the suggested crossing time could be increased.

[0044] As shown in 104, another possible suggestion would be to create a new cross-zone pair between the first motion sensor 98 and the door contact sensor 96. This suggestion could be made if analysis of historical data indicates a strong correlation between when someone enters a public area and triggers the door contact sensor 96 and when they trigger the first motion sensor 98. These are merely examples, as it should be understood that a particular space may include a variety of different sensors and sensor types, where the flow pattern is specific to that space.

[0045] Figure 8 This is a schematic diagram illustrating a protected area 106 of a typical office space, including several offices, a meeting room, several restrooms, a kitchen, and a common area. The common area includes a door contact sensor 96 positioned near the door of the common area. For example, the common area also includes a keypad 108 for arming and disarming the security system. For example, the security system may include an entry delay or an exit delay. The entry delay indicates the time required for a person to reach the keypad 108 and disarm the security system once the door contact sensor 96 is triggered. For example, this time is set to thirty seconds. If a person entering the common area does not disarm the system within thirty seconds, an alarm is triggered.

[0046] If analysis of historical data indicates that people need an average of ten to twelve seconds to cross the public area and enter the appropriate code on keypad 108 to disarm the system, it may be recommended to reduce the entry delay to only twenty seconds to improve security. Conversely, if the analysis indicates that people have difficulty entering the code within thirty seconds, it may be recommended to increase the entry delay to forty-five seconds to reduce the number of possible false alarms. A similar analysis can be performed relative to the exit delay, i.e., how long it takes for personnel who have armed the system via keypad 108 to leave the public area via a door operatively coupled to door contact sensor 96.

[0047] It should be understood that these are simplified examples, and security systems can include a significantly larger number of sensors. For example, this provides the possibility of more possible cross-area sensor pairs. In some cases, a cross-area sensor "pair" may include two, three, or more different sensors, which may have a variety of different sensor types. Over time, the patterns identified in the sensor data can change, and configuration settings can evolve along with the constantly changing patterns in the sensor data. Machine learning can be used to identify configuration setting changes by, for example, attempting to minimize false alarms issued by the security system while still detecting genuine alarm events. In some cases, the security system may identify possible false alarms to the operator, and the operator can confirm whether a possible false alarm is actually a false alarm. This confirmation can be used to teach machine learning algorithms to more accurately identify false alarms in the security system and to more accurately identify appropriate configuration setting changes over time.

[0048] Although several illustrative embodiments of this disclosure have been described thus, those skilled in the art will readily understand that other embodiments can be made and used within the scope of the appended claims. However, it should be understood that this disclosure is illustrative in many respects only. Changes may be made to details, particularly those relating to shape, size, arrangement of parts, and exclusion and order of steps, without departing from the scope of this disclosure. The scope of this disclosure is, of course, defined by the language expressed in the appended claims.

Claims

1. A method for reducing false alarms issued by a security system, the security system having a security system controller and a plurality of security sensors operatively coupled to the security system controller, wherein each of the plurality of security sensors is configured to monitor and detect one or more predetermined events in a secure space, the security system including a plurality of configuration settings that define when a specific alarm is issued by the security system based at least in part on the events detected by the plurality of security sensors, the method comprising: The security system controller receives each of the events detected by the plurality of security sensors; The security system controller stores event data, wherein the event data includes, for each received event, an event type, a time value indicating when the event occurred, and an identifier of the security sensor that detected the event; The security system controller analyzes the stored event data to identify one or more changes to one or more of the plurality of configuration settings that define when a specific alarm is issued by the security system, in order to reduce false alarms issued by the security system. as well as The security system controller outputs one or more changes to the identified changes in the configuration settings, wherein one of the multiple configuration settings defines a first security sensor and a second security sensor as a set of out-of-area sensors, wherein each of the first and second security sensors must detect a corresponding event within an out-of-area time period associated with the set of out-of-area sensors before the security system will issue a corresponding alarm.

2. The method of claim 1, wherein one of the identified changes to the configuration settings output by the security system controller includes one or more of the following: The set of cross-area sensors is changed to be located between the first security sensor and the third security sensor among the plurality of security sensors; Add the third security sensor from the plurality of security sensors to the set of cross-area sensors; Change the time period of the out-of-area movement associated with the set of out-of-area sensors; as well as Add an additional cross-zone group to two or more of the plurality of security sensors.

3. The method according to claim 1, wherein the first security sensor among the plurality of security sensors is a first sensor type for detecting a first event type, and the second security sensor among the plurality of security sensors is a second sensor type for detecting a second event type, wherein the first event type is different from the second event type.

4. The method of claim 1, wherein the security system controller analyzes the stored event data to identify one or more patterns in the stored event data to identify changes to one or more of the plurality of configuration settings that reduce false alarms issued by the security system during implementation.

5. The method of claim 4, wherein the security system controller uses machine learning to analyze the stored event data.

6. The method of claim 1, wherein the security system includes an armed state and a disarmed state, and wherein the security system controller stores event data collected when the security system is in the disarmed state, and the security system controller analyzes the stored event data corresponding to the disarmed state when it identifies one or more changes to the configuration settings that define when a specific alarm is issued by the security system, in order to reduce false alarms issued by the security system.

7. The method of claim 1, wherein one of the plurality of configuration settings includes one or more of the following: An abort time window, the abort time window having an abort time limit, wherein one of the identified changes to the configuration settings includes a change to the abort time limit; and Entry and / or exit delay, wherein a change in one or more identified changes to the configuration settings includes changing the entry and / or exit delay.

8. A security system configured to monitor a protected space, the security system comprising: A security system controller, configured to control the operation of the security system; A plurality of safety sensors are disposed around the protected space, each of the plurality of safety sensors being operatively coupled to the safety system controller such that each safety sensor can transmit detected events to the safety system controller; The security system controller is configured to: Receive each of the events detected by the plurality of security sensors; Referring to multiple configuration settings, which are at least in part based on the events detected by the multiple security sensors, the timing of a specific alarm issued by the security system is defined. Analyze the received events to identify one or more changes to one or more configuration settings in the configuration settings in order to reduce false alarms issued by the security system; as well as Output one or more of the identified changes to the configuration settings, wherein one of the multiple configuration settings defines a first security sensor and a second security sensor as a set of out-of-area sensors, wherein each of the first and second security sensors must detect a corresponding event within an out-of-area time period associated with the set of out-of-area sensors before the security system will issue a corresponding alarm.

9. The security system of claim 8, wherein the security system controller analyzes the received events to identify one or more patterns in the stored event data to identify one or more changes to the configuration settings that reduce false alarms issued by the security system during implementation.

Images