US Patent 7944469 System and method for using self-learning rules to enable adaptive security monitoring

Rules “learn” what is typical or expected for a certain attribute of device data for a given location, premises, time period, etc. Using a rule for a standard deviation the variance between newly collected data and the data stored in a fact table is either ignored or an alert (or some action) is generated. Data in the fact table is sampled for a specific time, or time period. Newly collected data may be used to update the fact table or discarded.