Risk-informed Security System. The Use of Surveillance Cameras for the Particularly Hazardous Facilities Safety M.A. Berberova1,2, A.S.Oboimov1, A.Kh.Khakimova2, O.V.Zolotarev3 maria.berberova@gmail.com | anton.oboimov@gmail.com | aida_khatif@mail.ru | ol-zolot@yandex.ru 1 International Nuclear Safety Center, Moscow, Russia 2 ANO «Scientific and Research Center for Information in Physics and Technique», Nizhny Novgorod, Russia 3 ANO «Russian New University», Moscow, Russia In the context of a difficult criminal situation in the world, taking into account the globalization of world development processes, international political and economic relations, which pose new risks for the development of the individual, society and the state. In the Russian Federation, as well as throughout the world, threats to the safety of industrial facilities are steadily increasing. Moreover, in connection with the improvement of organization and the expansion of the technical equipment of potential violators (terrorists, extremists, etc.), the improvement of methods and methods of illegal actions, issues related to the rationalization of technologies aimed at protecting vital interests and resources of enterprises. One of such technologies includes the creation of an effective automated security system and counteraction against unauthorized entry of individuals - a physical protection system, technically based on a set of engineering and technical means. The process of designing a set of engineering and technical means of a physical protection system for industrial facilities includes two main stages: conceptual and detailed design, and the optimality of design and engineering solutions in general depends on the successful implementation of work at the conceptual design stage. The assessment of the scale of the intruder's invasion is characterized by the time spent by the intruders in the control zone by television cameras, their tactics of overcoming this zone, time of day, illumination, etc. In this work, we use the analysis of images obtained from surveillance cameras. Keywords: risk, security system, physical protection system, risk-informed security system. have one common critical feature - the «failure» of the human 1. Introduction factor. The physical protection system (PPS) model consists of several components: the intruder model, the object model. An intruder model is a combination of an intruder’s action strategy and skill matrices: a probability matrix Р11 and times matrix Т12. 𝑝1,1 𝑝1,2 ⋯ 𝑝1,𝑛 𝑝2,1 𝑝2,2 ⋯ 𝑝2,𝑛 𝑃= ( ⋯ ⋯ ⋯ ⋯ ) (1) 𝑝𝑚,1 𝑝𝑚,2 ⋯ 𝑝𝑚,𝑛 The element of the times matrix Ti,j is the time of overcoming the ith type PPS element, using the jth skill from the Fig. 1. The Peach Bottom NPP violator's skill set. 𝑇1,1 𝑇1,2 ⋯ 𝑇1,𝑛 𝑇2,1 𝑇2,2 ⋯ 𝑇2,𝑛 𝑇= ( ) (2) ⋯ ⋯ ⋯ ⋯ 𝑇𝑚,1 𝑇𝑚,2 ⋯ 𝑇𝑚,𝑛 In modern conditions, the physical security culture of nuclear facilities attracts increased attention. Among other benefits, an effective safety culture requires staff to take action and innovative approaches in situations where threats and risks are too numerous for even the most forward-looking leaders to predict [1]. In 2007, the U.S. public was shocked by the news that several professional guards were found sleeping at their posts while serving at the Peach Bottom NPP (Fig. 1, 2) [2]. Around Fig. 2. Axial relative power profile evolution in the Peach the same time, four armed intruders broke into the Pelindaba Bottom NPP nuclear installation in South Africa, where hundreds of kilograms of weapons-grade uranium were stored. The Italian psychologists say that of all employees in any criminals managed to disable several levels of physical company, 25% are honest people, 25% expect an opportunity protection of the object, but they were not detected by the to divulge secrets, and 50% will act depending on the guard, because no one was watching surveillance cameras. circumstances (Fig. 3) [3]. After the collapse of the Soviet Union, hundreds of radioactive sources that pose a serious danger to the population and contain radioisotopes that can be used to create dirty bombs were thrown into the territory of a number of newly formed states. Such sources harmful to human health and the environment are still annually removed from remote areas of Georgia. These and other, seemingly random and unrelated incidents, nevertheless Copyright © 2019 for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). inexplicable phenomenon does not happen again are given after the third «cup of tea» and are inexpensive. And again, if we are talking about nuclear facilities, there can be no «sweat» either for security personnel or for its management. There is no doubt that the professional readiness of security structures depends on maintaining and maintaining the appropriate psychological state of their employees. Specialists from police structures claim that only 25% of employees retain the ability to reasonably act in extreme conditions; 75% temporarily lose it; 10-12% lose it for a long time. According to psychologists, every fifth employee is doomed to professional psychological trauma. Psychological Fig. 3. The results of a study by Italian psychologists unpreparedness is the reason for the inability to assemble in In 1994, three reporters of the London Sunday Times extreme conditions (73%). Only about 30% of the employees conducted an experiment. Posing as businessmen, they went to of the structures under consideration are able to independently twenty deputies of the British Parliament with a proposal to overcome crisis events, while maintaining the integrity of the send a request to the government in which they are interested personality and internal balance, are able to withstand the so- and receive a thousand pounds in cash or by check. 20 out of called phenomenon of professional personality deformation 27 immediately refused, three agreed. Similar experiments [1]. were carried out by the FBI in the early 80s: FBI agents under People in the extreme conditions characteristic of security the guise of Arab sheikhs appealed to members of the American activities often cannot act competently, and this is a general Congress, offering them rewards of tens of thousands of dollars pattern. It is rather difficult to find «ideal men»; you need to be for all sorts of concessions to be arranged for the «sheikhs» [3]. able to work with representatives of most homo sapience, From this it follows that the likelihood of a «refusal» of the forming professionals from them. This problem can be guard or the dispatcher on the remote control as a result of effectively solved only with the organization of psychological bribery is quite high. But there are also possible scenarios with support. the elimination of the protection of the checkpoint as a result of However, in this paper it is not a question of psychological a military collision or an error of the dispatcher. preparation, but it is proposed to approach the issue of No less problematic is predicting the actions of people in increasing the level of security on the other hand. At the stage an extreme situation similar to an attack on the object of of analyzing the effectiveness of the PPS of an object, using violators. Even despite scrupulously designed instructions and tools of a risk-informed approach, fundamentally possible a natural logic of behavior, a person in extreme conditions quite violators, tactics and scenarios of their actions were described, often behaves completely unpredictably, sometimes even both invasion scenarios and counter-action scenarios to reducing the effectiveness of the entire system to zero [1]. neutralize the intruder were modeled. Violation of the instructions sometimes costs much more The task of keeping in memory all the instructions for all than the failure of an expensive video camera or computer. cases of attackers' actions, and, more importantly, the task of According to statistics, the largest fires begin with a fire, to timely detection and recognition of unauthorized, hostile which the on-duty shifts of specialists do not respond. Most actions, these tasks are very difficult for operators or security robberies of collectors occur when they violate simple service personnel on duty of any more or less large object, this also instructions. Guarded offices, restaurants, shops "hand over" to explains the high psychological load on the operator. And this the criminals psychologically unprepared security guards. task can be greatly simplified by providing information support More than half of the confidential information is distributed by to the operator, issuing accurate data on the current state of their own employees, pushed by personal dissatisfaction and affairs, helping to detect possible attacks at an early stage, simple tricks of interested parties. There are many more such issuing clear instructions on what to do in a particular case. examples. And if we are talking about objects of increased technological risk, and in particular, nuclear power facilities, 2. Prototype risk-informed security system then the issue of the reliability of personnel in general and As part of this work, a prototype risk-informed security physical protection personnel in particular becomes critical. system was developed. For tasks related to physical counteraction in conflict A video surveillance system was chosen as the main system situations, this problem is extremely relevant. It is impossible supplying information for processing. Modern video analytics to assume the absence of criminal threats to protected objects, has impressive capabilities, including recognizing people, the results of the PPS analysis contradict this, the very fact of tracking (tracking) people, including in multi-camera systems, the creation of the PPS contradicts this. Of course, the head of recognizing prominent, suspicious behavior, such as running, the security service assures the management or owner of the loitering, and much more [4]. facility and must be sure that the security officer will strictly However, these capabilities are largely used idle, to the comply with the approved service instructions and in the maximum, including recording to detect moving objects and conditions of criminal or terrorist threats will ensure security signaling the operator about it. The whole burden of further without violating the laws and obligations assumed by the analysis and decision-making rests solely with the operator. security. This is especially important when using weapons. However, firstly, as already indicated, the operator’s efficiency However, for most security leaders, the guard’s behavior in an depends strongly on the time of day, the total load, and many emergency situation remains a mystery. So, for example, two other factors and is insufficient for many cases. And secondly, teenagers who went into the boutique with an air pistol as practice shows, often operators ignore what is happening on screamed heartily on the floor of a hefty security guard, whose video cameras out of habit, for example, after several false appearance alone assumed guaranteed protection against a positives or after a long period of absence of any attempts to thug's platoon. Adolescents strolling among showcases violate the security of the protected object. demanded and received a ring from the guard's hand. In the The developed prototype shows the principle of the entire course of the trial, the reason for what happened remained system on the example of one room in a building. unclear, the security company lost the facility, the guard quit, the management changed. However, guarantees that such an To demonstrate the principle of operation of the entire likely that he will not penetrate there either: he will not system, one room is considered - a corridor, Figures 4-6 show be in time and will be delayed by the response group, screenshots of a working program. The entrance to the premises or he will bypass it, or suddenly turn around and leave, is guarded by an employee of the facility’s security service, in for example, if he realizes that he will be caught and addition, the entrance to the premises is blocked by a lock, such must be leave. However, if he entered this zone, this as a combination lock. The premises are supposed to have a automatically means the failure of the response group, certain «forbidden» zone in which any object of physical which did not have time or was unable for some reason protection is located - the target of the offender. The camera to detain the attacker, the refusal of the lock or any monitors what is happening in the room in automatic mode, access control system to the «restricted» zone, if any, without operator intervention. Data from the camcorder is well as well as the failure of the entire protection processed by the program. In the event that anyone appears in system, which allowed the intruder to enter the the room, the program starts tracking detected people, tracking restricted area. all their actions and movements, while analyzing them. The event tree functions: A tree of events and a tree of failures are constructed for the - Shows current recognized events that somehow affect premises, corresponding to the penetration of the intruder into the level of safety and risk and can lead to a negative the restricted area. Initial probabilities of events and failures are outcome.; given. The probabilities of possible final events and failures are - Shows further possible ways and scenarios of events calculated in accordance with logical operations, tree gates. in an explicit form on the operator’s monitor; If any of the events detected in the event tree is detected, - Provides a numerical estimate of the probability of the the program automatically marks the event as occurring (its outcome of certain events. probability becomes equal to one), recounts the entire tree and The fault tree in this case performs the following functions: signals an increase in the level of risk (and, therefore, an - shows the failure of which particular elements led to increase in the level of security threat), if any . All detected the fact that the offender was in a particular place, events, as well as their corresponding failures, are recorded in overcame this or that safety line; the system, which will subsequently, if necessary, trace the - shows the impact of the failure on the entire system as development of events, analyze the actions of the violator and a whole, explicitly shows the consequences, both PPS personnel, and develop proposals for improving the PPS possible and occurred. The fact is that modern and increasing efficiency. protection systems were built on the principle of a The event tree in this program displays the following key single failure - it was assumed that if one of the system events: components failed, the entire system was able to - The presence of movement (Fig. 4). The camera provide the required level of security. However, this is recorded the presence of movement in the room. First far from always the case, in complex systems the of all, this means that the detected attacker somehow failure of some elements can explicitly or implicitly got into the room, which means that the lock on the affect the work of others, increasing the likelihood of door or the security guard at the entrance to the room their failure, and hence the current level of risk. This failed (either the guard is neutralized or he is in program clearly shows this on the operator’s monitor, collusion with the intruder). giving a sound notification; - Movement to the restricted area (Fig. 5). The presence - if there are appropriate instructions, it gives a warning of a person moving to a dangerous zone does not about the need to turn on reserve PPS elements, send automatically mean that he is moving in the direction a response team to check the situation and, if of the «restricted area», however, if the movement is necessary, detain the intruder, predicts possible directed in this direction, this further increases the risk. failures of elements that depend in some way on - Penetration into the restricted area (Fig. 6). While the already failed ones, etc. potential intruder has not yet entered the zone, it is Fig. 4. Program window. The room (real-time picture from the video camera), the «restricted» area in the room, the event tree (top) and the fault tree (bottom) Fig. 5. Intruder detected moving towards restricted area Fig. 6. The intruder entered the restricted area. PPS failure The assessment of the scale of the invasion is characterized 𝛼 - camera viewing angle (degrees); by the time spent by intruders in the control zone by television 𝑉𝑛𝑎𝑟 - intruder speed (m/s). cameras, their tactics of overcoming this zone, time of day, For television cameras controlling the perimeter of the light exposure, etc. Depending on these data, it is possible to object, it is assumed that the intruder moves perpendicular to select the closest of the intruder’s actions available in the the main optical axis of the camera. database, obtained at the stage of the analysis of effectiveness Introducing into the system a module that simulates the and modeling, and predict the most likely actions of the actions of the intruder described in the previous chapter. Using intruder, the most likely routes and goals, and, as a result, this module combined with the methodology for assessing the quickly organize adequate countermeasures. scale of the invasion will give the operator information about The time spent by the intruder in the control zone is the exact location of the intruder, its number, and also show determined by the camera as the quotient of dividing the length further possible routes of the intruder, the most probable of the controlled zone by the speed of movement: targets, the most optimal points for deploying the reaction 𝛼 forces, as well as the probability of interception at one or 2 ∙ 𝐷 ∙ 𝑡𝑔 𝜏𝑛𝑎𝑟 = 2 (3) another point, which will allow you to plan further actions 𝑉𝑛𝑎𝑟 depending on the situation. where: D - distance from the camera to the point of intersection of the intruder’s trajectory with the main optical axis of the camera (m); 3. Results Work with the video stream is implemented using the OpenCV open computer vision library. The program highlights moving objects against a motionless background, and tracks them (tracking an object). In addition, the program works as a motion detector, in case the object is somehow masked, and it is not possible to select it explicitly. In this case, tracking of moving parts is carried out. This prototype shows the possibilities of using the object’s video surveillance system to automate the operator’s work: assessing the operational situation, monitoring the level of security and risk level, demonstrating the results of the analysis in real time on the operator’s monitor, if available, displaying relevant instructions and recommendations for further actions, depending on setting. 4. Conclusions Further development of this software product and its integration into existing physical protection systems involves connecting the following functions to the program: - connection to the information processing system from other PPS elements: motion sensors, infrared sensors, other signal elements. - integration with the access control and management system - including for tracking the actions of the facility’s personnel and identifying an internal violator using his powers to disrupt the facility’s operation. This program also allows with a high degree of reliability (higher than that of a human operator) to estimate the scale of the invasion. In the future, it is planned to consider the location of CCTV cameras at especially dangerous facilities and make suggestions for improving the layout and the possibility of using images received from them. 5. Acknowledgments The study was carried out within the framework of grants 17-07-01475, 18-07-01111, 18-07-00909 and 19-07-00455. 6. References: [1] Oboymov A.S. Safety Analysis of Physical Protection of Potentially Hazardous Objects / M.A. Berberova, R.Sh. Kalmetev, R.T.Islamov, I.A. Kirillov, S.V. Klimenko, D.V. Minaev, A.S. Oboimov, V.P. Petrov // MEDIAS- 2011: proceedings of the International Scientific Conference. - Protvino-Moscow: Ed. ICPT, 2011 - p. 114- 134. [2] Bartosh O.V., Izmailov A.V., Litvinenko E.I., Turkin V.M. Methods and algorithms for the analysis of operational actions of security forces at objects such as buildings of complex configuration // Special issues of atomic science and technology. Ser. Security equipment. Scientific and technical Sat - 1978. - Vol. 1 (10). - p. 60- 65. [3] Andronova E. The weakest link in the security system. // Magazine «BDI» No. 2 (53) - 2004. [4] Development of recommendations for conducting a risk- informed vulnerability analysis and evaluating the effectiveness of the physical protection systems of nuclear hazardous facilities: a research report on reg. No. 2142OT11 // International Nuclear Safety Center - M., 2011. - 61 p.