Hardware acceleration system for anomaly detection of isolated forest algorithm based on FPGA (Field Programmable Gate Array)
By using an FPGA hardware acceleration system, modular design, and parallel processing, the problem of low efficiency of the isolated forest algorithm on computers is solved, achieving efficient anomaly detection that is suitable for various anomaly detection scenarios.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING HUANJIA TELECOMM CO LTD
- Filing Date
- 2025-11-28
- Publication Date
- 2026-04-21
AI Technical Summary
In existing technologies, the Isolation Forest algorithm has low operating efficiency and high resource consumption when implemented on a computer, making it difficult to meet the needs of efficient anomaly detection.
An FPGA hardware acceleration system is adopted to achieve hardware acceleration of the isolated forest algorithm through modular design and parallel processing. The system includes an algorithm implementation module, a read/write module, a register module, and a mathematical calculation module. It utilizes the parallel computing characteristics of FPGA to generate multiple trees or the entire forest in parallel, simplifying complex mathematical logic and optimizing the storage scheme.
It improves the operating efficiency of the isolated forest algorithm, reduces resource consumption, is applicable to various anomaly detection scenarios, enhances computing speed and throughput, and improves the flexibility and versatility of the system.
Smart Images
Figure CN121901145A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of electronic information technology, and more specifically to a hardware acceleration system for anomaly detection using the isolated forest algorithm based on FPGA. Background Technology
[0002] FPGA is a further development based on devices such as Programmable Array Logic (PAL), General Purpose Array Logic (GAL), and Erasable Programmable Logic Device (EPLD). It is a programmable logic chip that can perform general-purpose functions, that is, it can be programmed to implement certain logic processing functions.
[0003] Computer implementations of the Isolation Forest algorithm typically use object-oriented languages such as C++ and Python. While the algorithm itself is not difficult to implement, it suffers from low efficiency and high resource consumption. Summary of the Invention
[0004] This invention provides a hardware acceleration system for anomaly detection using the isolated forest algorithm based on FPGA to improve operating efficiency and reduce resource consumption.
[0005] In a first aspect of the present invention, a hardware acceleration system for anomaly detection of the isolated forest algorithm based on FPGA is provided, comprising: an algorithm implementation module, a read / write module, a register module, and a mathematical calculation module;
[0006] The algorithm implementation module is used to construct the trees and forest in the isolated forest algorithm, calculate and record anomaly scores, and make judgments.
[0007] The read / write module is mainly used to interact with external systems, read and write data, and use multiple interfaces to read, write and process complex data.
[0008] The register module is used to store the generated trees, forests, and computational data;
[0009] The mathematical calculation module is used to assist the algorithm implementation module, encapsulating and integrating complex mathematical logic and functions.
[0010] In some optional embodiments of the present invention, the algorithm implementation module is specifically used to generate multiple isolated trees for the same dataset, each isolated tree being a binary tree that is divided into left and right subtrees based on the data size.
[0011] In some optional embodiments of the present invention, the generation method of each isolated tree in the process of generating multiple isolated trees includes:
[0012] A random number is selected from the dataset as the criterion for comparison to determine the size of the numbers.
[0013] Store small data in the left subtree and large data in the right subtree;
[0014] The maximum depth is reached by repeating the process multiple times based on the sample size, or by having only one or more identical data points remaining in the subtree;
[0015] Record the path length from each data segment to the root node as a flag for identifying anomalies.
[0016] In some optional embodiments of the present invention, the read / write module transmits data via the AXI4 bus, I / O port, or directly reads analog or digital parameters on the circuit board components.
[0017] In some alternative embodiments of the present invention, the register module is specifically used to store the original data, the isolated forest and the mean score of the outlier paths calculated therefrom.
[0018] In some alternative embodiments of the present invention, IP cores are used to simplify the register module in order to increase operating efficiency.
[0019] In some alternative embodiments of the present invention, the complex mathematical logic and functions include: logarithmic functions or natural logarithmic functions.
[0020] In some alternative embodiments of the present invention, the mathematical calculation module encapsulates complex mathematical logic and functions into IP cores for use.
[0021] The beneficial effects provided by this invention are:
[0022] First, the manufacturing and usage costs of FPGAs are far lower than those of CPUs used in ordinary computers. Furthermore, while computer implementations of the Isolation Forest algorithm typically use object-oriented languages such as C++ and Python, although the algorithm's implementation difficulty is not high, their operating efficiency is lower than that of FPGAs, and their resource consumption is higher. Second, the parallel computing and modular design of FPGAs enable parallel processing, resulting in higher speed and efficiency than using a computer CPU in suitable scenarios. Additionally, implementing the algorithm on an FPGA can process a larger dataset within the same timeframe.
[0023] For the tree-spanning algorithm in the Isolation Forest algorithm, this solution proposes to utilize the parallel processing capabilities unique to FPGAs. Compared to other languages or platforms that require continuous recursive iteration to generate trees, this solution proposes a parallel, pipelined hardware architecture that allows FPGAs to simultaneously build or evaluate multiple trees or even the entire forest. Therefore, this solution is more time-efficient, has higher overall throughput, and is more flexible in design, easier to read and modify, effectively showcasing the advantages of FPGAs and making it suitable for various high-speed monitoring scenarios.
[0024] In terms of on-chip storage, the relatively simple and easy-to-monitor design scheme gives the FPGA a lot of room for operation of both internal and external storage. In actual use, it can directly call the IP cores such as RAM, which is faster and has lower latency than general storage methods.
[0025] The architecture is simple and clear, with complete modularity, allowing for the free addition of functional and adaptive modules. In practical applications, one solution can adapt to multiple scenarios, and the interface is simple with fast data flow, suitable for AXI bus interfaces. This solution greatly increases the versatility of the algorithm in various scenarios, whether it's a high-throughput, short-time monitoring system or the detection of subtle anomalies. Through actual sample parameter settings, it can handle various production and distribution situations.
[0026] In terms of data algorithms, this solution significantly optimizes the original algorithms. More complex formulas have been simplified, and some mathematical constants have been adjusted. The hardware environment has been adapted without compromising the original efficiency and accuracy, enabling most mathematical algorithms and formulas to produce results faster on the FPGA.
[0027] In summary, the system innovates in both hardware and algorithms, making it more cost-effective and applicable to a wider range of scenarios.
[0028] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description
[0029] Figure 1 This is a distribution diagram of abnormal data in a two-dimensional dataset provided in an embodiment of the present invention;
[0030] Figure 2 This is an example diagram of generating an isolated tree provided in an embodiment of the present invention;
[0031] Figure 3 This is a pseudocode diagram of an isolated tree provided in an embodiment of the present invention;
[0032] Figure 4 A pseudocode diagram of an isolated forest provided for an embodiment of the present invention;
[0033] Figure 5 This is a schematic diagram of path calculation provided in an embodiment of the present invention;
[0034] Figure 6 This is a schematic diagram of the left and right subtree nodes of a binary tree generated according to an embodiment of the present invention;
[0035] Figure 7 This is a schematic diagram of an LFSR linear shift register provided in an embodiment of the present invention;
[0036] Figure 8 This is a diagram illustrating the log2 algorithm provided in an embodiment of the present invention;
[0037] Figure 9 This is a hardware acceleration system architecture diagram for anomaly detection using the FPGA-based isolated forest algorithm, provided in an embodiment of the present invention. Detailed Implementation
[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.
[0039] In this embodiment of the invention, the Isolation Forest algorithm is implemented on an FPGA using the System Verilog language. The product is designed with four modules: an algorithm implementation module, a read / write module, a register module, and a mathematical calculation module. The algorithm implementation module is primarily responsible for building the trees and forest in the Isolation Forest algorithm, calculating and recording anomaly scores, and making judgments. The read / write module is mainly responsible for interacting with external systems, reading and writing data, and can use multiple interfaces for reading, writing, and processing complex data. The register module is mainly responsible for storing the generated trees, forest, and related calculation data; in practical applications, IP cores can be used to simplify some design aspects and increase operating efficiency. The mathematical calculation module mainly assists the algorithm implementation module by encapsulating and integrating some complex mathematical logic and functions; in practical applications, it can be encapsulated as an IP core.
[0040] The core algorithm of the algorithm implementation module is the Isolation Forest algorithm. The Isolation Forest algorithm is a widely used anomaly detection algorithm, mainly applied to various anomaly detection scenarios. Compared to traditional anomaly detection algorithms, such as LOF, it consumes less computational resources to identify anomalies in two-dimensional or even multi-dimensional datasets, making it more convenient and faster. In the Isolation Forest algorithm, an "isolated forest" consists of multiple isolated trees. Multiple isolated trees can be generated from the same dataset. Each isolated tree is a binary tree that divides data into left and right subtrees based on data size. Specifically, an isolated tree is generated by randomly selecting a number from the dataset as the criterion, determining its size, storing smaller data in the left subtree, and larger data in the right subtree. This process is repeated multiple times based on the sample capacity until the maximum depth is reached or only one or more identical data items remain in the subtree. The path length from each data item to the root node after partitioning is recorded as a flag for anomaly detection. The Isolation Forest itself consists of multiple isolated trees. The specific algorithm calculates the average path length from each data item to the root node under different partitioning methods, which serves as the final judgment criterion. Because anomalies are discrete in the dataset, such as... Figure 1 As shown, in segmentation based on size, it is easier to be segmented than a normal point, meaning that in earlier segmentations, it has become an isolated subtree, and the path length to the root node will be shorter.
[0041] The read / write module can be implemented in different ways depending on the scenario. Common implementations include using the AXI4 bus, I / O ports to transfer data, or directly reading analog or digital parameters from circuit board components. Because the data sets used for anomaly detection are not limited to real integers, even floating-point or negative numbers can be scaled to the data types that the FPGA can handle. This greatly enhances the operability of the read / write module and expands the overall application scope of the design.
[0042] Register modules are common data storage modules in most FPGA-related designs. In this solution, their main purpose is to store raw data, isolated forests, and the average score of abnormal paths calculated by them. In practice, they can be implemented using IP cores such as RAM.
[0043] The mathematical calculation module is primarily responsible for processing complex mathematical functions, such as log or ln functions that cannot be directly called in Verilog. This module can also be encapsulated. For example, it might include an LSFR (Linear Feedback Shift Register) to generate random numbers and use corresponding algorithms to implement mathematical functions like log2x.
[0044] First, let's look at the algorithm implementation for generating isolated trees, and observe specific examples. Figure 2 As shown:
[0045] exist Figure 2In this algorithm, a random number between the maximum and minimum values in the dataset is used as the split point to divide the dataset into a left subtree for smaller data and a right subtree for larger data. This process is repeated on both subtrees until each subtree contains only one element or reaches its maximum depth. The path from each element to the root node is recorded as the standard for subsequent calculations. In specific cases, to save computational resources or accelerate the separation process, random elements from the data nodes, or the median or mean, can be used for splitting in simpler datasets. This eliminates the need for generating random numbers or finding the maximum and minimum values, further increasing system efficiency without affecting the algorithm's accuracy.
[0046] Based on the specific examples above, we can summarize the standard pseudocode for illustration, such as... Figure 3 As shown.
[0047] This pseudocode uses recursion to represent the generation of an isolated tree. Because it needs to be implemented on an FPGA platform using SystemVerilog, recursion is not feasible. Therefore, it requires either a for loop or a state machine. The implementation is not significantly different from recursion; simply add a for loop with a maximum iteration count at the outermost level, or use a state machine to check the iteration count and repeatedly enter the generation state. Furthermore, the parallel processing capabilities of FPGAs can be leveraged to pipeline the design, generating multiple numbers or the entire forest simultaneously within a single clock cycle, thus achieving advantages such as time savings and faster processing.
[0048] An "isolated forest" is composed of many "isolated trees," and controlling the number and height of the trees in the isolated forest is also part of the algorithm. Assuming the sample size is n, we can use log₂n to limit the tree height, allowing for faster outlier identification with less computational resources. Similarly, the number of trees determines the overall accuracy of the algorithm; more trees result in more accurate average calculations and smaller errors, but also increase resource consumption. It is generally considered that a number of isolated trees between 50 and 100 is sufficient for adequate accuracy. To reduce resource consumption, 50 is typically chosen as the number of trees in the "forest" when the data volume is small. The pseudocode for building an isolated forest is given below. Figure 4 As shown.
[0049] The concept of log2n will be explained in the subsequent mathematical calculation module.
[0050] The method used here can utilize the parallel pipeline structure unique to FPGAs. Specifically, the code for generating multiple trees is parallelized to form a pipeline structure, generating multiple trees or even an entire forest at the same time, and storing and computing the forest uniformly. Although this sacrifices some code space, it can achieve higher time efficiency.
[0051] After completing the construction of the isolated forest, it is necessary to evaluate the path length of all elements within it. The following pseudocode is provided: Figure 5 As shown.
[0052] The calculation formula for c(T.size) is quite complex; here, a simpler but effective approximation, c(n) = log₂(n+1) - 1, is used. Similarly, in practical applications, this recursion needs to be replaced with a iterative approach or a state machine to match the SystemVerilog language.
[0053] After calculating the path anomaly score for each element, the required anomaly threshold can be determined based on the sample test. The anomaly score is then compared with the threshold to determine whether the element is an anomaly.
[0054] The register module implementation uses SystemVerilog structures and multidimensional arrays for storage, defining the structure of nodes and assigning values to them. Nodes are stored using two-dimensional or multidimensional arrays depending on the dataset requirements; RAM can also be used for read and write operations. Tree generation can be achieved using methods such as... Figure 6 The left and right subtree nodes of the binary tree are generated in the manner shown.
[0055] In practical applications, some nodes may be idle, leading to resource waste. The storage method can be further optimized based on actual usage. The number of nodes is affected by the maximum generation depth; to save resources, the generation depth can be limited or pruning operations can be performed. In addition, the register module also has functions such as storing input and output data, which can be stored more clearly and explicitly using a structure.
[0056] The mathematical calculation module primarily assists in algorithm implementation, and can be designed as a separate, optimized module. The most important algorithm implemented is random number generation, mainly utilizing an LFSR (Linear Shift Register). The LFSR works by using a seeded linear register of 0s and 1s. In each clock cycle, it selects one or more bits of 0s and 1s to form a binary number, shifts it forward in the next cycle, reads the next number, and discards the preceding number through bit manipulation, generating the preceding number. This makes it appear infinite and non-repeating within a finite time, exhibiting pseudo-randomness. Figure 7 As shown, the desired fractional number can be obtained by taking the remainder of the generated large number, which can be applied to the generation of random numbers.
[0057] Another mathematical function that might be needed is log2. Log2 can be obtained by repeatedly right-shifting the number to be calculated using a loop and recording the number of shifts. A brief code example is provided below. Figure 8 As shown.
[0058] Figure 9 This is a rough outline of the entire design. The arrows indicate the direction of data transmission, and the main transmission method is interface transmission.
[0059] It should be understood that in the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples" refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this description, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate different embodiments or examples described in this specification, as well as some features of different embodiments or examples.
[0060] Of course, those skilled in the art can make various corresponding changes and modifications based on the present invention without departing from its spirit and essence, but such changes and modifications should all fall within the protection scope of the claims of the present invention.
Claims
1. A hardware acceleration system for anomaly detection using the Isolation Forest algorithm based on FPGA, characterized in that, include: Algorithm implementation module, read / write module, register module, and mathematical calculation module; The algorithm implementation module is used to construct the trees and forest in the isolated forest algorithm, calculate and record anomaly scores, and make judgments. The read / write module is mainly used to interact with external systems, read and write data, and use multiple interfaces to read, write and process complex data. The register module is used to store the generated trees, forests, and computational data; The mathematical calculation module is used to assist the algorithm implementation module, encapsulating and integrating complex mathematical logic and functions.
2. The hardware acceleration system for anomaly detection using the FPGA-based isolated forest algorithm according to claim 1, characterized in that, The algorithm implementation module is specifically used to generate multiple isolated trees for the same dataset. Each isolated tree is a binary tree that is divided into left and right subtrees based on the data size.
3. The hardware acceleration system for anomaly detection using the FPGA-based isolated forest algorithm according to claim 2, characterized in that, In the process of generating multiple isolated trees, the generation method of each isolated tree includes: A random number is selected from the dataset as the criterion for comparison to determine the size of the numbers. Store small data in the left subtree and large data in the right subtree; The maximum depth is reached by repeating the process multiple times based on the sample size, or by having only one or more identical data points remaining in the subtree; Record the path length from each data segment to the root node as a flag for identifying anomalies.
4. The hardware acceleration system for anomaly detection using the FPGA-based isolated forest algorithm according to claim 1, characterized in that, The read / write module transmits data via the AXI4 bus or I / O ports, or directly reads analog or digital parameters from components on the circuit board.
5. The hardware acceleration system for anomaly detection using the FPGA-based isolated forest algorithm according to claim 1, characterized in that, The register module is specifically used to store the raw data, the isolated forest, and the mean score of the outlier paths calculated therefrom.
6. The hardware acceleration system for anomaly detection using the FPGA-based isolated forest algorithm according to claim 5, characterized in that, Use IP cores to simplify the register module and increase operating efficiency.
7. The hardware acceleration system for anomaly detection using the FPGA-based isolated forest algorithm according to claim 1, characterized in that, Complex mathematical logic and functions include: logarithmic functions or natural logarithmic functions.
8. The hardware acceleration system for anomaly detection using the FPGA-based isolated forest algorithm according to claim 7, characterized in that, The mathematical calculation module encapsulates complex mathematical logic and functions into IP cores for use.