Systems and methods for signal jamming detection and remediation

Abstract

Disclosed are systems and methods of a novel framework that automatically and dynamically detects jamming events of a security system and provides computerized mechanisms for addressing and mitigating such events. The disclosed framework provides configurations and operations for robust and reliable security systems that are resistant to jamming and enhances the confidence of users, knowing that their safety and security are well-protected against sophisticated tampering attempts. The disclosed systems and methods operate to significantly mitigate WiFi, RF and cellular jamming impacts to security systems, which improve the robustness and reliability of such security systems.

Description

Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025SYSTEMS AND METHODS FOR SIGNAL JAMMING DETECTION AND REMEDIATIONCROSS REFERENCE TO RELATED APPLICATION

[0001] This application claims the benefit of, and priority to, U.S. Provisional Patent Application No. 63 / 689,928 filed September 3, 2024, the entire contents of which are incorporated herein by reference.FIELD OF THE DISCLOSURE

[0002] The present disclosure is generally related to security control mechanisms, and more particularly, to a decision intelligence (Dl)-based computerized framework that automatically and dynamically detects jamming events of a security system and provides computerized mechanisms for addressing and mitigating such eventsSUMMARY OF THE DISCLOSURE

[0003] Wireless Fidelity (WiFi or Wi-Fi, used interchangeably) jammers work by flooding the 2.4 GHz or 5 GHz bands with noise to disrupt WiFi signals. Cellular jammers similarly overwhelm cellular frequencies to block phone communications. Radio frequency (RF) jammers can target specific radio frequencies used by wireless sensors and alarms. These devices essentially create signal interference to prevent security components from communicating properly.

[0004] Conventional security systems employ various strategies to counteract jamming attempts. These include frequency7hopping technology, which rapidly switches between multiple frequencies to evade interference, and signal strength monitoring to detect sudden drops that might indicate jamming. Many systems utilize redundant communication methods, combining cellular, landline, and internet connections to ensure constant communication even if one channel is compromised.

[0005] Existing techniques, however, face several significant shortcomings. Frequency hopping, while effective against narrow-band jamming, can be overcome by wideband jamming techniques and requires precise synchronization between transmitter and receiver. It may also face regulatory restrictions on bandwidth usage. Directional antennas offer protection only from specific angles, reducing overall coverage and increasing system complexity' and cost. Increasing transmission power can overcome some jamming but risks violating regulations, consuming more energy, and potentially raising health concerns. Spread spectrum techniques.1ACTIVE 714371921v1Resideo Ref. No 214474- WOAttorney Docket No. 203863-016801 / PCTElectronically Filed: September 3, 2025 though robust, can still be defeated by high-power jamming and often result in reduced data rates. Adaptive filtering introduces latency and can be fooled by sophisticated, rapidly changing jamming signals. Encryption protects data confidentiality but does not prevent the jamming itself. Emerging technologies like cognitive radio show promise but face reliability issues and potential regulatory hurdles. Physical shielding is often impractical, especially for mobile devices, and can interfere with desired signals.

[0006] Indeed, legal and regulatory approaches to prevent jamming are difficult to enforce, particularly against state actors, and jamming equipment remains widely available. These limitations highlight the ongoing challenges in developing comprehensive anti-jamming solutions for RF communications.

[0007] To that end, the disclosed systems and methods provide a novel computerized framework that addresses such shortcomings, among others, and by providing advanced mechanisms that address and / or mitigate jamming situations for maintaining the integrity and reliability of a location’s security infrastructure. As discussed herein, by preventing RF jamming, for example, the disclosed framework can enhance the overall security of the premises, ensuring that unauthorized individuals cannot disable or interfere with security devices. This ensures that alarms, cameras, and other critical systems remain operational, providing continuous surveillance and protection.

[0008] Moreover, reliable communication between security devices is maintained, which is vital for the proper functioning of the system. For example, in the event of a break-in. the alarm system can effectively alert authorities without any signal disruption. This helps in prompt response and potentially deterring criminal activities. Additionally, addressing RF jamming issues ensures that there are no gaps in surveillance footage or loss of data, which is essential for investigations and evidence collection.

[0009] Furthermore, mitigating RF jamming scenarios can help maintain the trust of those relying on the security system, whether they are homeowners, business operators, or clients of a security' service provider. Accordingly, as discussed herein, the disclosed framework can operate to analyze security events, inclusive of jamming events and / or other detected activities which may ty pically activate an alarm, and confirming their veracity as they relate to a security concem / breach, thereby avoiding situations where a false alarm is generated, while increasing the trustw orthiness of actual security alerts when they are triggered. Thus, disclosed is a robust and reliable security system that is resistant to jamming and enhances the confidence of users, knowing that their safety and security’ are well-protected against sophisticated tampering2ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025 attempts. Accordingly, as discussed herein, the disclosed systems and methods operate to significantly mitigate WiFi, RF and cellular jamming impacts to security systems, which can improve the robustness and reliability of such security systems.

[0010] According to some embodiments, a method is disclosed that automatically and dynamically detects jamming events of a security system and provides computerized mechanisms for addressing and mitigating such events. In accordance with some embodiments, the present disclosure provides anon-transitory computer-readable storage medium for carrying out the above-mentioned technical steps of the framework’s functionality. The non-transitory computer-readable storage medium has tangibly stored thereon, or tangibly encoded thereon, computer readable instructions that when executed by a device cause at least one processor to perform a method that automatically and dynamically detects jamming events of a security system and provides computerized mechanisms for addressing and mitigating such events.

[0011] In accordance with one or more embodiments, a system is provided that includes one or more processors and / or computing devices configured to provide functionality in accordance with such embodiments. In accordance with one or more embodiments, functionality is embodied in steps of a method performed by at least one computing device. In accordance with one or more embodiments, program code (or program logic) executed by a processor(s) of a computing device to implement functionality in accordance with one or more such embodiments is embodied in, by and / or on a non-transitory computer-readable medium.DESCRIPTIONS OF THE DRAWINGS

[0012] The features, and advantages of the disclosure will be apparent from the following description of embodiments as illustrated in the accompanying drawings, in which reference characters refer to the same parts throughout the various views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating principles of the disclosure:

[0013] FIG. 1 A is a block diagram of an example configuration within which the systems and methods disclosed herein could be implemented according to some embodiments of the present disclosure;

[0014] FIG. IB is a block diagram illustrating components of an exemplary system according to some embodiments of the present disclosure;

[0015] FIG. 2 depicts a non-limiting example embodiment according to some embodiments of the present disclosure;3ACTIVE 714371921v1Resideo Ref. No 214474- WOAttorney Docket No. 203863-016801 / PCTElectronically Filed: September 3, 2025

[0016] FIG. 3 illustrates an exemplary workflow according to some embodiments of the present disclosure;

[0017] FIG. 4 depicts an exemplary implementation of an architecture according to some embodiments of the present disclosure;

[0018] FIG. 5 depicts an exemplary implementation of an architecture according to some embodiments of the present disclosure; and

[0019] FIG. 6 is a block diagram illustrating a computing device showing an example of a client or server device used in various embodiments of the present disclosure.DETAILED DESCRIPTION

[0020] The present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, which form a part hereof, and which show, by way of non-limiting illustration, certain example embodiments. Subject matter may, however, be embodied in a variety of different forms and. therefore, covered or claimed subject matter is intended to be construed as not being limited to any example embodiments set forth herein; example embodiments are provided merely to be illustrative. Likewise, a reasonably broad scope for claimed or covered subject matter is intended. Among other things, for example, subject matter may be embodied as methods, devices, components, or systems. Accordingly, embodiments may, for example, take the form of hardware, software, firmware or any combination thereof (other than software per se). The following detailed description is. therefore, not intended to be taken in a limiting sense.

[0021] Throughout the specification and claims, terms may have nuanced meanings suggested or implied in context beyond an explicitly stated meaning. Likewise, the phrase "in one embodiment’7as used herein does not necessarily refer to the same embodiment and the phrase “in another embodiment” as used herein does not necessarily refer to a different embodiment. It is intended, for example, that claimed subject matter include combinations of example embodiments in whole or in part.

[0022] In general, terminology may be understood at least in part from usage in context. For example, terms, such as “and”, “or”, or “and / or,” as used herein may include a variety of meanings that may depend at least in part upon the context in which such terms are used. Typically, “or” if used to associate a list, such as A, B or C, is intended to mean A, B, and C, here used in the inclusive sense, as well as A, B or C, here used in the exclusive sense. In addition, the term “one or more” as used herein, depending at least in part upon context, may4ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025 be used to describe any feature, structure, or characteristic in a singular sense or may be used to describe combinations of features, structures or characteristics in a plural sense. Similarly, terms, such as “a,” “an,” or “the,” again, may be understood to convey a singular usage or to convey a plural usage, depending at least in part upon context. In addition, the term “based on” may be understood as not necessarily intended to convey an exclusive set of factors and may, instead, allow for existence of additional factors not necessarily expressly described, again, depending at least in part on context.

[0023] The present disclosure is described below with reference to block diagrams and operational illustrations of methods and devices. It is understood that each block of the block diagrams or operational illustrations, and combinations of blocks in the block diagrams or operational illustrations, can be implemented by means of analog or digital hardware and computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer to alter its function as detailed herein, a special purpose computer, ASIC, or other programmable data processing apparatus, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, implement the functions / acts specified in the block diagrams or operational block or blocks. In some alternate implementations, the functions / acts noted in the blocks can occur out of the order noted in the operational illustrations. For example, two blocks shown in succession can in fact be executed substantially concurrently or the blocks can sometimes be executed in the reverse order, depending upon the functionality / acts involved.

[0024] For the purposes of this disclosure a non-transitory computer readable medium (or computer-readable storage medium / media) stores computer data, which data can include computer program code (or computer-executable instructions) that is executable by a computer, in machine readable form. By way of example, and not limitation, a computer readable medium may include computer readable storage media, for tangible or fixed storage of data, or communication media for transient interpretation of code-containing signals. Computer readable storage media, as used herein, refers to physical or tangible storage (as opposed to signals) and includes without limitation volatile and non-volatile, removable and nonremovable media implemented in any method or technology for the tangible storage of information such as computer-readable instructions, data structures, program modules or other data. Computer readable storage media includes, but is not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other solid state memory technology, optical storage, cloud storage, magnetic storage devices, or any other physical or material medium which can be used5ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025 to tangibly store the desired information or data or instructions and which can be accessed by a computer or processor.

[0025] For the purposes of this disclosure the term ‘'server” should be understood to refer to a sendee point which provides processing, database, and communication facilities. By way of example, and not limitation, the term “server” can refer to a single, physical processor with associated communications and data storage and database facilities, or it can refer to a networked or clustered complex of processors and associated network and storage devices, as well as operating software and one or more database systems and application software that support the services provided by the server. Cloud servers are examples.

[0026] For the purposes of this disclosure a “network” should be understood to refer to a network that may couple devices so that communications may be exchanged, such as between a server and a client device or other types of devices, including between wireless devices coupled via a wireless network, for example. A network may also include mass storage, such as network attached storage (NAS), a storage area network (SAN), a content delivery network (CDN) or other forms of computer or machine-readable media, for example. A network may include the Internet, one or more local area networks (LANs), one or more wide area networks (WANs), wire-line type connections, wireless type connections, cellular or any combination thereof. Likewise, sub-networks, which may employ differing architectures or may be compliant or compatible with differing protocols, may interoperate within a larger network.

[0027] For purposes of this disclosure, a "wireless network” should be understood to couple client devices with a network. A wireless network may employ stand-alone ad-hoc networks, mesh networks, Wireless LAN (WLAN) networks, cellular networks, or the like. A wireless network may further employ a plurality' of network access technologies, including Wi-Fi, Long Term Evolution (LTE), WLAN. Wireless Router mesh, or 2nd. 3rd, 4thor 5thgeneration (2G, 3G, 4G or 5G) cellular technology, mobile edge computing (MEC), Bluetooth, 802.1 Ib / g / n, or the like. Network access technologies may enable wide area coverage for devices, such as client devices with vary ing degrees of mobility', for example.

[0028] In short, a yvireless network may include virtually any ty pe of wireless communication mechanism by which signals may be communicated between devices, such as a client device or a computing device, between or yvithin a net vork, or the like.

[0029] A computing device may be capable of sending or receiving signals, such as via a wired or yvireless network, or may be capable of processing or storing signals, such as in memory’ as physical memory states, and may, therefore, operate as a server. Thus, devices capable of6ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025 operating as a server may include, as examples, dedicated rack-mounted servers, desktop computers, laptop computers, set top boxes, integrated devices combining various features, such as two or more features of the foregoing devices, or the like.

[0030] For purposes of this disclosure, a client (or user, entity', subscriber or customer) device may include a computing device capable of sending or receiving signals, such as via a wired or a wireless network. A client device may, for example, include a desktop computer or a portable device, such as a cellular telephone, a smart phone, a display pager, a radio frequency (RF) device, an infrared (IR) device a Near Field Communication (NFC) device, a Personal Digital Assistant (PDA), a handheld computer, a tablet computer, a phablet, a laptop computer, a set top box, a wearable computer, smart watch, an integrated or distributed device combining various features, such as features of the forgoing devices, or the like.

[0031] A client device may vary' in terms of capabilities or features. Claimed subject matter is intended to cover a wide range of potential variations, such as a web-enabled client device or previously mentioned devices may include a high-resolution screen (HD or 4K for example), one or more physical or virtual keyboards, mass storage, one or more accelerometers, one or more gyroscopes, global positioning system (GPS) or other location-identifying type capability, or a display with a high degree of functionality, such as a touch-sensitive color 2D or 3D display, for example.

[0032] Certain embodiments and principles will be discussed in more detail with reference to the figures. With reference to FIG. 1 A, a system is depicted for a location 100 which includes security panel 102 (e g., base unit), user equipment (UE) 112 (e g., a client device, as mentioned above and discussed below in relation to FIG. 10), sensors 110, network 104, cloud system 106, database 108 and alarm engine 200. It should be understood that while system 100 is depicted as including such components, it should not be construed as limiting, as one of ordinary skill in the art would readily understand that varying numbers of smoke detectors, UEs, sensors, cloud systems, databases and networks can be utilized; however, for purposes of explanation, system 100 is discussed in relation to the example depiction in FIG. 1A.

[0033] According to some embodiments, security panel 102 serves as the central control hub for a location’s security system, offering a range of essential functions. Users can arm and disarm the system by entering unique access codes on the keypad, allowing authorized individuals to enter or leave without triggering alarms. The panel 102 can continuously monitor various sensors 110 (discussed below) throughout the premises, including door and window contacts, motion detectors, and environmental sensors. As discussed herein, when a threat is7ACTIVE 714371921v1Resideo Ref. No 214474- WOAttorney Docket No. 203863-016801 / PCTElectronically Filed: September 3, 2025 detected, the panel 102 can activate alarms and can notify both occupants and monitoring services.

[0034] In some embodiments, panel 102 can offer zone control, enabling users to secure specific areas while leaving others accessible. Panel 102 can integrate with smart home systems, allowing remote access and control via mobile applications. Additionally, panel 102 can feature emergency buttons for quick access to first responders and may include voice commands for hands-free operation. In some embodiments, the display screen of the security panel 102 can provide real-time status updates, while indicator lights offer at-a-glance system information. In some embodiments, panel 102 can incorporate video verification capabilities and can manage access control systems for enhanced security. In some embodiments, security panel 102 can incorporate advanced features like Wi-Fi connectivity for remote control and programmability for energy efficiency.

[0035] According to some embodiments, UE 112 can be any type of device, such as, but not limited to, a mobile phone, tablet, laptop, sensor, Internet of Things (loT) device, autonomous machine, and any other device equipped with a cellular or wireless or wired transceiver. In some embodiments, UE 112 can be a device associated with an individual (or set of individuals) for which security control services are being provided. In some embodiments, UE 112 may correspond to a device of a smart home and / or security' service provider entity.

[0036] In some embodiments, a peripheral device (not shown) can be connected to UE 112, and can be any type of peripheral device, such as, but not limited to. a wearable device (e.g.. smart watch), printer, speaker, sensor, and the like. In some embodiments, a peripheral device can be any type of device that is connectable to UE 112 (and / or sensor 110 and / or security panel 102) via any type of known or to be know n pairing mechanism, including, but not limited to, Wi-Fi, Bluetooth™, Bluetooth Low Energy (BLE), NFC, and the like.

[0037] According to some embodiments, sensors 110 can correspond to sensors associated with a location of system 100. In some embodiments, the sensors 110 can be, but are not limited to, temperature sensors (e.g., thermocouples, resistance temperature detectors (RTDs), thermistors, semiconductor based integrated circuits (IC), thermometers, and the like, for example), humidity sensors, cameras, glass break detectors, motion detectors, door and window contacts, heat and smoke detectors, WiFi sensors (e.g., 802.15.4, for example), RF sensors, cellular sensors, carbon monoxide (CO) and / or carbon dioxide (CO2) detectors, PIR sensors, time-of-flight (ToF) sensors, and the like. For example, sensor 110 can be a motion sensor associated with and / or connected to security panel 102.8ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025

[0038] In some embodiments, the sensors 110 can involve an Internet of Things (loT) environment and / or be associated with devices associated with the location of system 100, such as, for example, lights, smart locks, garage doors, smart appliances (e.g., thermostat, refrigerator, television, personal assistants (e.g., Alexa®, Nest®, for example)), smart phones, smart watches or other wearables, tablets, personal computers, and the like, and some combination thereof. For example, the sensors 110 can include the sensors on UE 112 (e.g., smart phone) and / or peripheral device (e.g., a paired smart watch).

[0039] In some embodiments, network 104 can be any type of network, such as, but not limited to, a wireless network, cellular network, the Internet, and the like (as discussed above). Network 104 facilitates connectivity of the components of system 100, as illustrated in FIG. 1A.

[0040] According to some embodiments, cloud system 106 may be any type of cloud operating platform and / or network based system upon which applications, operations, and / or other forms of network resources may be located. For example, system 106 may be a sendee provider and / or network provider from where services and / or applications may be accessed, sourced or executed from. For example, system 106 can represent the cloud-based architecture associated with a security control system provider, which has associated network resources hosted on the internet or private network (e.g., network 104), which enables (via engine 200) the location management discussed herein.

[0041] In some embodiments, cloud system 106 may include a server(s) and / or a database of information which is accessible over network 104. In some embodiments, a database 108 of cloud system 106 may store a dataset of data and metadata associated with local and / or network information related to a user(s) of UE 112 / security panel 102 and the UE 112 / security panel 102, sensors 110, and the services and applications provided by cloud system 106 and / or alarm engine 200.

[0042] In some embodiments, for example, cloud system 106 can provide a private / propnetary management platform, whereby engine 200, discussed infra, corresponds to the novel functionality system 106 enables, hosts and provides to a network 104 and other devices / platforms operating thereon.

[0043] Turning to FIG. 4 and FIG. 5, in some embodiments, the exemplary computer-based systems / platforms, the exemplary computer-based devices, and / or the exemplary computer- based components of the present disclosure may be specifically configured to operate in a cloud computing / architecture 106 such as, but not limiting to: infrastructure a service (laaS) 510,9ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025 platform as a service (PaaS) 508, and / or software as a service (SaaS) 506 using a web browser, mobile app, thin client, terminal emulator or other endpoint 504. FIG. 4 and FIG. 5 illustrate schematics of non-limiting implementations of the cloud computing / architecture(s) in which the exemplar}7computer-based systems for administrative customizations and control of network-hosted APIs of the present disclosure may be specifically configured to operate.

[0044] Turning back to FIG. 1A. according to some embodiments, database 108 may correspond to a data storage for a platform (e.g., a network hosted platform, such as cloud system 106, as discussed supra), a plurality of platforms, and / or security panel 102, UE 112 and / or sensors 110. Database 108 may receive storage instructions / requests from, for example, engine 200 (and associated microservices), which may be in any type of known or to be known format, such as, for example, standard query' language (SQL). According to some embodiments, database 108 may correspond to any type of known or to be known storage, for example, a memory' or memory' stack of a device, a distributed ledger of a distributed netw ork (e.g., blockchain, for example), a look-up table (LUT), and / or any other type of secure data repository.

[0045] Alarm engine 200, as discussed above and further below' in more detail, can include components for the disclosed functionality. According to some embodiments, alarm engine 200 may be a special purpose machine or processor, and can be hosted by a device on network 104, within cloud system 106, on UE 112, and / or security panel 102 (and / or on sensors 110). In some embodiments, engine 200 may be hosted by a server and / or set of servers associated with cloud system 106.

[0046] According to some embodiments, as discussed in more detail below', alarm engine 200 may be configured to implement and / or control a plurality of services and / or microservices, where each of the plurality of services / microservices are configured to execute a plurality of workflows associated with performing the disclosed location (e.g., security) management. Non-limiting embodiments of such workflows are provided below.

[0047] According to some embodiments, as discussed above, alarm engine 200 may function as an application provided by cloud system 106. In some embodiments, engine 200 may function as an application installed on a servetys), network location and / or other type of network resource associated with system 106. In some embodiments, engine 200 may function as an application installed and / or executing on UE 112 and / or security panel 102. In some embodiments, such application may be a web-based application accessed by UE 112, security panel 102 and / or devices associated with sensors 110 over network 104 from cloud system 106.10ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025In some embodiments, engine 200 may be configured and / or installed as an augmenting script, program or application (e.g., a plug-in or extension) to another application or program provided by cloud system 106 and / or executing on UE 112, sensors 110 and / or security panel 102.

[0048] As illustrated in FIG. IB, according to some embodiments, alarm engine 200 includes identification module 202, analysis module 204, determination module 206 and output module 208. It should be understood that the engine(s) and modules discussed herein are non- exhaustive, as additional or fewer engines and / or modules (or sub-modules) may be applicable to the embodiments of the systems and methods discussed. More detail of the operations, configurations and functionalities of engine 200 and each of its modules, and their role within embodiments of the present disclosure will be discussed below.

[0049] Turning to FIG. 2. depicted is a non-limiting example embodiment of the disclosed security controls. As discussed herein, the disclosed systems and methods provide a computerized framework that operates to identity' a jamming event and activate an alarm and siren to “scare"’ the intruder away potentially prior to a break in.

[0050] According to some embodiments, by way of a non-limiting example, once a security system sensor (e.g., one or more sensors 110 from FIG. 1) are detected as being subject to a jamming event / signal (e.g., a signal by the security panel 102 respective to and / or to / from such sensor(s) 110 are no longer being received), then engine 200 can operate to confirm whether an alarm event (e.g., to trigger the alarm / siren) is actually occurring. Such operation can include, as discussed below, collecting activity at the location to determine, discern, derive or otherwise identity' if another event is being detected. For example, such other event can be related to motion, sound, and the like, via other sensors not impacted by the jamming event, and / or via sensors operating via alternative functionality (e.g.. cellular sensor connectivity' when the jamming event is a WiFi jamming event), for example. If an event is being detected, or additionally jamming is detected (e.g., cellular jamming in addition to the WiFi jamming), then an alarm can be sounded. If not, then an alarm clear message can be triggered, and the system reset for continued monitoring of the location.

[0051] By way of example, as in FIG. 2, depicted is a location with security’ panel 102 (e.g., base unit (B)), sensors (S) and cameras (C). In some embodiments, for example, the security system base unit (B) is in constant communications with each sensor (S) and camera (C) - for example, sensors (S) can be, but are not limited to, door / window contacts, motion sensors, smoke sensors. CO sensors, water leak sensors, and the like; and cameras (C) can be, but are not limited to, doorbell cameras, video cameras, and the like.11ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025

[0052] Thus, for example, intruders from the rear near the ‘‘Laundry room” (as depicted in FIG. 2) could jam the rear camera (C) and base unit (B). In another example, intruders from the front could jam the front camera (C) and sensors (S) near the front (e.g., the (S) along the front wall of the location).

[0053] Accordingly, as discussed herein, since the position of the sensors (S) and base unit (B) within the location are known (e.g. as well as the cameras (C), the potential entry point of the intruder can be determined and reported (for example - Intruder at front door, intruder at rear door, and the like). As provided herein, knowledge of the entry point can assist anyone in the house to move away from that area to call for help or escape. Moreover, such entry point can be utilized to track for secondary events to confirm the authenticity of the initially jamming / entry event, as provided herein and in more detail below with reference to FIG. 3.

[0054] Thus, as provided herein, the disclosed framework provides components and operations for a robust and reliable security system that is resistant to jamming and enhances the confidence of users, knowing that their safety and security are well-protected against sophisticated tampering attempts. Accordingly, as discussed herein, the disclosed systems and methods operate to significantly mitigate WiFi, RF and cellular jamming impacts, which can improve the robustness and reliability of security systems at locations.

[0055] Turning to FIG. 3, Process 300 provides non-limiting example embodiments of the disclosed framework that provides features, capabilities and / or functionality for enhanced and / or improved customization and integration of security controls for security systems at locations (e g., home, office, building, and the like).

[0056] According to some embodiments, Steps 302-306 can be performed by identification module 202 of alarm engine 200; Step 308 can be performed by analysis module 204; Step 310 can be performed by determination module 206; and Steps 312-316 can be performed by output module 208.

[0057] According to some embodiments, Process 300 begins with Step 302 where engine 200 can operate to monitor activity at / within a location. According to some embodiments, such monitoring can correspond to tracking users’ movements around a location. In some embodiments, such tracking may only correspond to tracking unknown (or non-resident) users, which can be performed via a variety of know mechanisms (e.g., using computer vision, for example, to perform facial recognition of the user from captured imagery', detecting the user’s device being within the perimeter of the location, and the like, for example).12ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025

[0058] For purposes of the discussion of the steps of Process 300, the operations will be discussed with reference to a single human user; however, one of ordinary- skill in the art would easily recognize that the disclosed mechanisms can be extended to a plurality of users without departing from the scope of the instant disclosure.

[0059] Accordingly, in Step 302, engine 200 can monitor the location for movement and / or presence activity of a user at the location. For example, a person is detected walking up the driveway towards the house; a person is spotted walking in the backyard, and the like. The location, as discussed herein, can be any type of known or to be known structure for which a security' system can be used to secure its premises (e.g., home, office, garage, and the like).

[0060] According to some embodiments, such monitoring can occur according to, but not limited to, periodically, continuously, a criteria, a detected event, request, and the like, or some combination thereof. In some embodiments, such criteria can correspond to, but is not limited to, measurements, a time period, date, user identity' (ID), threshold values (e.g., measurements meet or satisfy a threshold - for example, a movement at or below a threshold distance and / or rate (e.g., velocity), for example), mode / settings on the security panel 102 and / or sensors 110. movements of a user, and the like, or some combination thereof.

[0061] In Step 304, engine 200 can detect event information corresponding to a jamming signal. For example, as discussed above with respect to FIG. 2, a jamming signal or jamming event can be detected when communication is lost by at least one of the base unit (B) and / or any of the sensors (S) in the location. In some embodiments, sensors (S) in the same frequency band (e g., 802. 15.4) may all lose connectivity (e.g., being jammed) when one of them are subject to a jamming event, which can be detected upon engine 200 determining its loss of signal, as discussed herein. In some embodiments, detection of such event can be indicative of a jamming event that warrants confirmation via the below discussed mechanisms / operations of Process 300.

[0062] In some embodiments, engine 200 can detect a jamming signal through various methods that can be based on the monitoring (in Step 302) of the communication channels for unusual patterns and inconsistencies. In some embodiments, engine 200 can use signal strength detection, where engine 200 can continuously measure the strength of the signals being transmitted and received. A significant and sudden drop in signal strength (e.g., at or below7a threshold value) can indicate the presence of a jamming signal.

[0063] In some embodiments, engine 200 can employ spectrum analysis to detect any anomalies or irregularities in the frequency spectrum. Jamming signals often exhibit a high13ACTIVE 714371921v1Resideo Ref. No 214474- WOAttorney Docket No. 203863-016801 / PCTElectronically Filed: September 3, 2025 level of interference across a wide range of frequencies, which can be identified by analyzing the spectrum for unexpected spikes or noise.

[0064] In some embodiments, engine 200 can check for an increased error rate in the data being transmitted by and / or between sensors 110 and panel 102. For example, if / when error rate suddenly increases (e.g., to or above a threshold value and / or by a threshold satisfying rate of change), engine 200 can determine that a jamming attempt is disrupting normal communication.

[0065] In some embodiments, a type of jamming event may be a factor in the detection. For example, if the jamming signal is related to cellular transmit beacons from cell towers, then secondary confirmations from WiFi jamming and / or camera detection may be warranted. Such can be provided via the analysis as provided herein. In another example, if the jamming signal corresponds to the closest cell tower, then this may be indicative as signal strength to the other towers may be weaker and cause alarm signals to fail, which should be authenticated via the disclosed steps, discussed infra.

[0066] Thus, upon the detection of the jamming event in Step 304, engine 200 can collect the data related to the jamming event, as in Step 306. Such collection can be performed by sensors in the proximity to the jammed sensors, sensors being jammed on one frequency whereby collection can occur on another frequency, and the like.

[0067] For example, with reference to FIG. 2, if sensors (S) can camera (C) on along the wall of the front porch are jammed, engine 200 can trigger collection operations from sensors (S) in the living area, as that would be the next location an intruder can enter given the floorplan of the house. As mentioned above, such location and position within the home would be known via the security' system initiation and integration with the premises; therefore, such knowledge can be leveraged to trigger sensor collection activities.

[0068] In another non-limiting example, if sensors (S) on the front wall of the front porch are subject to WiFi jamming, and such sensors (S) are configured with cellular capabilities, then they can collect data via such cellular operations.

[0069] In some embodiments, such ty pe of data collected during this detection process can include, but is not limited to, signal strength measurements, frequency spectrum data, error rates, timestamps of these occurrences, and the like. For example, signal strength measurements can provide information on the power levels of the signals, helping to identify' significant drops that may indicate jamming. Frequency spectrum data can help to pinpoint the specific frequencies affected by the interference and the nature of the jamming signal. Error rates can indicate the reliability of the communication channel and any disruptions caused by14ACTIVE 714371921v1Resideo Ref. No 214474- WOAttorney Docket No. 203863-016801 / PCTElectronically Filed: September 3, 2025 interference. Timestamps can be used to correlate these events with other system activities and for identifying patterns over time.

[0070] In some embodiments, if / when a jamming signal is detected (in Step 304), engine 200 may cause the alarm to be generated, which can occur prior to the security event (e.g., break- in), which may enable the warning to the potential / intended intruder, for example. In some embodiments, such collected data can be stored in database 108, as discussed above.

[0071] In Step 308, engine 200 can analyze the collected data. As discussed herein, by analyzing this collected data, engine 200 and the corresponding security system for which it is operating can not only detect the presence of a jamming signal but also take appropriate countermeasures to mitigate its effects.

[0072] Accordingly. Step 308 can involve engine 200 performing a computational analysis on the collected data by engine 200 implementing / executing any type of known or to be known computational analysis technique, algorithm, mechanism or technology7.

[0073] In some embodiments, engine 200 may include a specific trained artificial intelligence / machine learning model (AI / ML). a particular machine learning model architecture, a particular machine learning model type (e.g., convolutional neural network (CNN), recurrent neural network (RNN), autoencoder, support vector machine (SVM), and the like), or any other suitable definition of a machine learning model or any suitable combination thereof.

[0074] In some embodiments, engine 200 may be configured to utilize one or more AI / ML techniques chosen from, but not limited to. computer vision, feature vector analysis, decision trees, boosting, support-vector machines, neural netw orks, nearest neighbor algorithms, Naive Bayes, bagging, random forests, logistic regression, and the like. By way of a non-limiting example, engine 200 can implement an XGBoost algorithm for regression and / or classification to analyze the collected data, as discussed herein.

[0075] According to some embodiments and, optionally, in combination of any embodiment described above or below7, a neural network technique may be one of, without limitation, feedforward neural network, radial basis function network, recurrent neural network, convolutional network (e.g., U-net) or other suitable network. In some embodiments and. optionally, in combination of any embodiment described above or below, an implementation of Neural Network may be executed as follows: a. define Neural Network architecture / model, b. transfer the input data to the neural netw ork model, c. train the model incrementally,15ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025 d. determine the accuracy for a specific number of timesteps, e. apply the trained model to process the newly-received input data, f. optionally and in parallel, continue to train the trained model with a predetermined periodicity.

[0076] In some embodiments and, optionally, in combination of any embodiment described above or below, the trained neural network model may specify a neural network by at least a neural network topology, a series of activation functions, and connection weights. For example, the topology of a neural network may include a configuration of nodes of the neural network and connections between such nodes. In some embodiments and, optionally, in combination of any embodiment described above or below, the trained neural network model may also be specified to include other parameters, including but not limited to, bias values / functions and / or aggregation functions. For example, an activation function of a node may be a step function, sine function, continuous or piecewise linear function, sigmoid function, hyperbolic tangent function, or other type of mathematical function that represents a threshold at which the node is activated. In some embodiments and, optionally, in combination of any embodiment described above or below, the aggregation function may be a mathematical function that combines (e.g., sum, product, and the like) input signals to the node. In some embodiments and, optionally, in combination of any embodiment described above or below, an output of the aggregation function may be used as input to the activation function. In some embodiments and, optionally, in combination of any embodiment described above or below, the bias may be a constant value or function that may be used by the aggregation function and / or the activation function to make the node more or less likely to be activated.

[0077] In Step 310, based on the analysis in Step 308, engine 200 can determine whether a second event is detected. In some embodiments, such second event can correspond to detected motion, sound, occupancy, and the like, or some combination thereof, as determined from the analysis of the collected data, discussed supra. Thus, for example, once a first sensor is jammed, an alarm can be queued up as the next step, which is subject to the determination in Step 310 — for example, did another sensor detect activity at / in / around the location that would support an unlawful / unwanted entry and / or entry attempt (e.g., broken window) to the location.

[0078] In some embodiments, the information related to the analysis and determination in Steps 308-310 can be stored in database 108, as discussed above.

[0079] Accordingly, in some embodiments, when Step 310 results in a determination that the jamming event (in Step 304) preceded an intruder’s entry into the home (e.g.. via an unjammed16ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025 sensor picking up motion in the home within a threshold period of time from the j amming event (e.g.. less than 60 seconds, for example), engine 200 can proceed to Step 312 whereby an alarm can be triggered. In some embodiments, if / when jamming occurs on RF and / or WiFi receivers / transmitters of a sensor(s) and / or base unit, then cellular communications can be utilized whereby engine 200 can connect with a local cell tower to transmit the alarm to first responders.

[0080] In some embodiments, when a second event is not detected (e.g., no further activity at / around the location), processing can proceed from Step 310 to Step 314 where an indication of a false alarm can be communicated (e.g., to the base unit, first responders, and / or security' service provider). And, in Step 316, instructions can be communicated to reconfigure the devices subject to the suspected jamming signal (in Step 304). Such reconfiguration can involve resetting the device so that its transmi t / receive antennas are rendered functional, which can be associated with an “alarm clear message.” Accordingly, continued monitoring can occur, as indicated via the recursive line back to Step 302.

[0081] In some embodiments, if another jamming event is detected within a threshold period of time (e.g., 5 minutes of less), and / or for the same set of sensors (from Step 304), upon such subsequent jamming event, engine 200 can trigger an alarm, as it may be more likely than not that a true jamming event is occurring by a malicious actor.

[0082] FIG. 6 is a schematic diagram illustrating a client device showing an example embodiment of a client device that may be used within the present disclosure. Client device 600 may include many more or less components than those shown in FIG. 6. However, the components shown are sufficient to disclose an illustrative embodiment for implementing the present disclosure. Client device 600 may represent, for example, UE 112 discussed above at least in relation to FIG. 1A.

[0083] As shown in the figure, in some embodiments. Client device 600 includes a processing unit (CPU) 622 in communication with a mass memory 630 via a bus 624. Client device 600 also includes a power supply 626, one or more network interfaces 650, an audio interface 652, a display 654, a keypad 656, an illuminator 658, an input / output interface 660. a haptic interface 662, an optional global positioning systems (GPS) receiver 664 and a camera(s) or other optical, thermal or electromagnetic sensors 666. Device 600 can include one camera / sensor 666, or a plurality7of cameras / sensors 666, as understood by those of skill in the art. Power supply 626 provides power to Client device 600.17ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025

[0084] Client device 600 may optionally communicate with a base station (not shown), or directly with another computing device. In some embodiments, network interface 650 is sometimes known as a transceiver, transceiving device, or network interface card (NIC).

[0085] Audio interface 652 is arranged to produce and receive audio signals such as the sound of a human voice in some embodiments. Display 654 may be a liquid crystal display (LCD), gas plasma, light emitting diode (LED), or any other type of display used with a computing device. Display 654 may also include a touch sensitive screen arranged to receive input from an object such as a stylus or a digit from a human hand.

[0086] Keypad 656 may include any input device arranged to receive input from a user. Illuminator 658 may provide a status indication and / or provide light.

[0087] Client device 600 also includes input / output interface 660 for communicating with external. Input / output interface 660 can utilize one or more communication technologies, such as USB, infrared, Bluetooth™, or the like in some embodiments. Haptic interface 662 is arranged to provide tactile feedback to a user of the client device.

[0088] Optional GPS transceiver 664 can determine the physical coordinates of Client device 600 on the surface of the Earth, which typically outputs a location as latitude and longitude values. GPS transceiver 664 can also employ other geo-positioning mechanisms, including, but not limited to, triangulation, assisted GPS (AGPS), E-OTD, CI, SAI, ETA, BSS or the like, to further determine the physical location of client device 600 on the surface of the Earth. In one embodiment, however, Client device 600 may through other components, provide other information that may be employed to determine a physical location of the device, including for example, a MAC address, Internet Protocol (IP) address, or the like.

[0089] Mass memory 630 includes a RAM 632, a ROM 634, and other storage means. Mass memory 630 illustrates another example of computer storage media for storage of information such as computer readable instructions, data structures, program modules or other data. Mass memory 630 stores a basic input / output system (‘"BIOS”) 640 for controlling low-level operation of Client device 600. The mass memory also stores an operating system 641 for controlling the operation of Client device 600.

[0090] Memory 630 further includes one or more data stores, which can be utilized by Client device 600 to store, among other things, applications 642 and / or other information or data. For example, data stores may be employed to store information that describes various capabilities of Client device 600. The information may then be provided to another device based on any of a variety of events, including being sent as part of a header (e.g., index file of the HLS stream)18ACTIVE 714371921v1Resideo Ref. No 214474- WOAttorney Docket No. 203863-016801 / PCTElectronically Filed: September 3, 2025 during a communication, sent upon request, or the like. At least a portion of the capability information may also be stored on a disk drive or other storage medium (not shown) within Client device 600.

[0091] Applications 642 may include computer executable instructions which, when executed by Client device 600, transmit, receive, and / or otherwise process audio, video, images, and enable telecommunication with a server and / or another user of another client device. Applications 642 may further include a client that is configured to send, to receive, and / or to otherwise process gaming, goods / services and / or other forms of data, messages and content hosted and provided by the platform associated with engine 200 and its affiliates.

[0092] As used herein, the terms “computer engine’' and “engine’' identify at least one software component and / or a combination of at least one software component and at least one hardw are component which are designed / programmed / configured to manage / control other software and / or hardware components (such as the libraries, software development kits (SDKs), objects, and the like).

[0093] Examples of hardware elements may include processors, microprocessors, circuits, circuit elements (e.g., transistors, resistors, capacitors, inductors, and so forth), integrated circuits, application specific integrated circuits (ASIC), programmable logic devices (PLD), digital signal processors (DSP), field programmable gate array (FPGA), logic gates, registers, semiconductor device, chips, microchips, chip sets, and so forth. In some embodiments, the one or more processors may be implemented as a Complex Instruction Set Computer (CISC) or Reduced Instruction Set Computer (RISC) processors; x86 instruction set compatible processors, multi-core, or any other microprocessor or central processing unit (CPU). In various implementations, the one or more processors may be dual-core processor(s), dual-core mobile processor(s), and so forth.

[0094] Computer-related systems, computer systems, and systems, as used herein, include any combination of hardware and software. Examples of software may include software components, programs, applications, operating system software, middleware, firmware, software modules, routines, subroutines, functions, methods, procedures, software interfaces, application program interfaces (API), instruction sets, computer code, computer code segments, words, values, symbols, or any combination thereof. Determining whether an embodiment is implemented using hardware elements and / or software elements may van' in accordance with any number of factors, such as desired computational rate, power levels, heat19ACTIVE 714371921v1Resideo Ref. No 214474- WOAttorney Docket No. 203863-016801 / PCTElectronically Filed: September 3, 2025 tolerances, processing cycle budget, input data rates, output data rates, memory resources, data bus speeds and other design or performance constraints.

[0095] For the purposes of this disclosure a module is a software, hardware, or firmware (or combinations thereof) system, process or functionality, or component thereof, that performs or facilitates the processes, features, and / or functions described herein (with or without human interaction or augmentation). A module can include sub-modules. Software components of a module may be stored on a computer readable medium for execution by a processor. Modules may be integral to one or more servers, or be loaded and executed by one or more servers. One or more modules may be grouped into an engine or an application.

[0096] One or more aspects of at least one embodiment may be implemented by representative instructions stored on a machine-readable medium which represents various logic within the processor, which when read by a machine causes the machine to fabricate logic to perform the techniques described herein. Such representations, known as “IP cores,” may be stored on a tangible, machine readable medium and supplied to various customers or manufacturing facilities to load into the fabrication machines that make the logic or processor. Of note, various embodiments described herein may, of course, be implemented using any appropriate hardware and / or computing software languages (e.g., C++, Objective-C, Swift, Java, JavaScript, Python, Perl, QT, and the like).

[0097] For example, exemplary software specifically programmed in accordance with one or more principles of the present disclosure may be dow nloadable from a network, for example, a website, as a stand-alone product or as an add-in package for installation in an existing software application. For example, exemplary software specifically programmed in accordance with one or more principles of the present disclosure may also be available as a client-server software application, or as a web-enabled software application. For example, exemplary softw are specifically programmed in accordance w ith one or more principles of the present disclosure may also be embodied as a softw are package installed on a hardware device.

[0098] For the purposes of this disclosure the term “user”, “subscriber” “consumer” or “customer” should be understood to refer to a user of an application or applications as described herein and / or a consumer of data supplied by a data provider. By way of example, and not limitation, the term “user” or “subscriber” can refer to a person who receives data provided by the data or service provider over the Internet in a brow ser session, or can refer to an automated software application which receives the data and stores or processes the data. Those skilled in the art will recognize that the methods and systems of the present disclosure may be20ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025 implemented in many manners and as such are not to be limited by the foregoing exemplary embodiments and examples. In other words, functional elements being performed by single or multiple components, in various combinations of hardware and software or firmware, and individual functions, may be distributed among software applications at either the client level or server level or both. In this regard, any number of the features of the different embodiments described herein may be combined into single or multiple embodiments, and alternate embodiments having fewer than, or more than, all of the features described herein are possible.

[0099] Functionality may also be, in whole or in part, distributed among multiple components, in manners now known or to become known. Thus, myriad software / hardware / firmware combinations are possible in achieving the functions, features, interfaces and preferences described herein. Moreover, the scope of the present disclosure covers conventionally known manners for carrying out the described features and functions and interfaces, as well as those variations and modifications that may be made to the hardware or software or firmware components described herein as would be understood by those skilled in the art now' and hereafter.

[0100] Furthermore, the embodiments of methods presented and described as flow charts in this disclosure are provided by way of example in order to provide a more complete understanding of the technology. The disclosed methods are not limited to the operations and logical flow presented herein. Alternative embodiments are contemplated in which the order of the various operations is altered and in which sub-operations described as being part of a larger operation are performed independently.

[0101] While various embodiments have been described for purposes of this disclosure, such embodiments should not be deemed to limit the teaching of this disclosure to those embodiments. Various changes and modifications may be made to the elements and operations described above to obtain a result that remains within the scope of the systems and processes described in this disclosure.21ACTIVE 714371921v1

Claims

Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025CLAIMSWhat is claimed is:

1. A method comprising: monitoring, over a network, devices at a location, the monitoring corresponding to an operational status of each device as part of a security system; detecting, based on the monitonng, a jamming event at the location; collecting, upon the detection of the jamming event, data via at least a portion of the devices at the location, the collection based on a monitoring for an occurrence of activity occurring at the location at a time proximate to the jamming event; analyzing the collected data; determining, based on the analysis, that a second event is detected, the second event corresponding to the occurrence of the activity after the jamming event; and triggering an alarm at the location based on the second event.

2. The method of claim 1, further comprising: determining, based on the analysis, that a second event is not detected; and communicating an indication of a false alarm.

3. The method of claim 2. further comprising: re-establishing operation of the devices to a state prior to the jamming event.

4. The method of claim 1. further comprising: communicating the alarm via a communication protocol that is operational via the security system and not subject to the jamming event.

5. The method of claim 1, wherein the jamming event corresponds to a jam of at least one of the network, at least one of the devices and a signal of at least one of the devices.

6. The method of claim 1, wherein the jamming event corresponds to cellular network capability associated with the devices at the location.22ACTIVE 714371921v1Resideo Ref. No 214474- WOAttorney Docket No. 203863-016801 / PCTElectronically Filed: September 3, 20257. The method of claim 1, wherein the devices comprise security devices and a base unit.

8. The method of claim 1, wherein the data collected respective to the jamming event includes information related to at least one of a signal strength measurement, frequency spectrum data, error rate, type of jam, identifier of a device being jammed and timestamp of the jamming event.

9. The method of claim 1, wherein the network is a Wi-Fi network.

10. A system comprising: a processor configured to: monitor, over a network, devices at a location, the monitoring corresponding to an operational status of each device as part of a security system; detect, based on the monitoring, a jamming event at the location; collect, upon the detection of the jamming event, data via at least a portion of the devices at the location, the collection based on a monitoring for an occurrence of activity occurring at the location at a time proximate to the jamming event; analyze the collected data; determine, based on the analysis, that a second event is detected, the second event corresponding to the occurrence of the activity after the jamming event; and trigger an alarm at the location based on the second event.

11. The system of claim 10, wherein the processor is further configured to: determine, based on the analysis, that a second event is not detected; and communicate an indication of a false alarm.

12. The system of claim 11, wherein the processor is further configured to: re-establish operation of the devices to a state prior to the jamming event.

13. The system of claim 10, wherein the processor is further configured to: communicate the alarm via a communication protocol that is operational via the security system and not subject to the jamming event.23ACTIVE 714371921v1Resideo Ref. No 214474- WOAttorney Docket No. 203863-016801 / PCTElectronically Filed: September 3, 202514. The system of claim 10, wherein the jamming event corresponds to a jam of at least one of the network, at least one of the devices and a signal of at least one of the devices.

15. The system of claim 10, wherein the jamming event corresponds to cellular network capability associated with the devices at the location.

16. The system of claim 10, wherein the devices comprise security' devices and a base unit.

17. The system of claim 10, wherein the data collected respective to the jamming event includes information related to at least one of a signal strength measurement, frequency spectrum data, error rate, type of jam, identifier of a device being jammed and timestamp of the jamming event.

18. A non-transitory computer-readable storage medium tangibly encoded with computer-executable instructions that when executed by a processor, perform a method comprising: monitoring, over a network, devices at a location, the monitoring corresponding to an operational status of each device as part of a security system; detecting, based on the monitoring, a jamming event at the location; collecting, upon the detection of the jamming event, data via at least a portion of the devices at the location, the collection based on a monitoring for an occurrence of activity occurring at the location at a time proximate to the jamming event; analyzing the collected data; determining, based on the analysis, that a second event is detected, the second event corresponding to the occurrence of the activity' after the jamming event; and triggering an alarm at the location based on the second event.

19. The non-transilory computer-readable storage medium of claim 18, further comprising: determining, based on the analysis, that a second event is not detected; communicating an indication of a false alarm; and24ACTIVE 714371921v1Resideo Ref. No 214474- WO Attorney Docket No. 203863-016801 / PCT Electronically Filed: September 3, 2025 re-establishing operation of the devices to a state prior to the jamming event.

20. The non-transitory computer-readable storage medium of claim 18, further comprising: communicating the alarm via a communication protocol that is operational via the security’ system and not subject to the jamming event.25ACTIVE 714371921v1

Images