Patent attributes
A system includes a database, a sensor, and a processor. The sensor obtains a mobile device identifier transmitted by a mobile device located within a range of the sensor. The processor receives the identifier from the sensor and stores the identifier and a first time when the mobile device was located within the range in a log. The processor receives an indication that an event associated with a security breach took place within the sensor range at a particular time that is within a tolerance of the first time. In response, the processor determines, based at least in part on the particular time and the presence of the identifier and first time in the log, that a user of the mobile device is associated with the event. In response, the processor stores the identifier in the database to indicate that the mobile device is associated with a security threat.
