Anomaly detection for device application maintenance

Abstract

The invention relates to a method for monitoring at least one device in a communication network, the method comprising: obtaining an observation sequence (sij(k)) from observations of a network stream involving the device and implementing at least one given artificial intelligence model (MODij) associated with a firmware version (j) of at least one reference device, the given model being trained to produce a reconstructed sequence (ŝij(k)) from the observation sequence and a previous observation sequence and to determine a reconstruction error between the reconstructed sequence and the observation sequence, an error lower than a threshold characterising that the device is operating in the network with said firmware version, the reconstructed sequence being produced as a function of intra-sequence relationships (zk) between elements of the observation sequence (sij(k)) and inter-sequence relationships (zk-1) between the observation sequence (sij(k)) and the previous observation sequence (sij(k-1)).

Description

Anomaly detection for device application maintenance

[0001] This disclosure falls within the field of communicating device management services, also called connected devices or connected objects.

[0002] More particularly, the present disclosure relates to a method for managing a communicating device in a local communication network and to a corresponding system, device, computer program and recording medium.

[0003] This disclosure may find application, for example, in digital services for remote management of communicating devices by an operator and / or by a digital service provider.

[0004] Typically, such digital services rely primarily on two types of entities.

[0005] A management server, located in the network of the operator or digital service provider, is responsible for remotely performing maintenance, configuration and / or diagnostic operations on communicating devices present in local networks.

[0006] Management clients, present on the managed communicating devices, ensure secure communication with the management server.

[0007] Operating anomalies may occur in a local network. However, in the context of local networks comprising heterogeneous communicating devices, not integrated into any digital remote management service or managed by different digital remote management services, it is not possible for the operator to determine which communicating device may be the source of operating anomalies.

[0008] Indeed, the operator can only perform diagnostics limited to the communicating devices it manages to determine the origin of a malfunction. This is sufficient when the communicating devices provided by the operator are responsible for the malfunction. However, local dependencies may exist between communicating devices. For example, connectivity dependencies may exist when connecting a communicating device provided by the operator to a third-party Wi-Fi repeater.

[0009] To protect the end user from a degraded experience due to the appearance of operating anomalies, the operator relies on its own remote digital management service to keep the communicating devices linked to this digital service up to date. These firmware updates generally correct the latest malfunctions reported by end users. The operator schedules more or less frequent update campaigns depending on the criticality of the firmware change.

[0010] A communicating device on the local network may be the cause of the malfunction. Indeed, it is not possible for the remote digital management service to simultaneously trigger the firmware update of all communicating devices managed by the digital service. The end user may therefore still encounter a problem with a particular communicating device even though it is part of the update campaign. In this case, a local management interface is generally made available to the end user so that they can trigger this operation manually and immediately.

[0011] It is in the common interest of the operator and its end users that updates are regular for all end users' communicating devices, and not just for communicating devices directly linked to the digital remote management service provided by the operator. The operator therefore proactively seeks to encourage the end user to manually trigger the installation of the latest versions available for each family of communicating devices.

[0012] However, the operator is not able to know the version of each communicating device connected to an end user's local network since some of these communicating devices are managed by third-party suppliers who do not make such information accessible to the operator.

[0013] Attempting to infer the firmware version of a communicating device from studying the network traffic of the communicating device during operation is difficult to conduct.

[0014] Anomalies in network flows can be of three types: point, collective or contextual. To illustrate these types of anomalies, reference is made to the which represents different network flows in the form of four smoothed univariate signals: a first reference, or nominal, network flow (3), a second network flow (4) comprising a point anomaly, a third network flow (5) comprising a contextual anomaly, and a fourth network flow (6) comprising a collective anomaly.

[0015] When a data item in a time series is distant in the sense of Euclidean distance from the other data in the series, it is considered a point anomaly. If a subset of data differs from the other data in the series, this characterizes a collective anomaly. The contextual anomaly is the most difficult to detect since it occurs when a data item is judged abnormal in a specific context.

[0016] In the context of application maintenance operations, it may be desirable for a digital remote management service, provided for example by an operator, to be able to detect the versions of a family of devices communicating with an end user's local network.

[0017] The following reference describes a well-known method for anomaly detection in time series: Z. Chen, D. Chen, X. Zhang, Z. Yuan and X. Cheng, Learning Graph Structures with Transformer for Multivariate Time Series Anomaly Detection in IoT, IEEE Internet of Things Journal, 2021.

[0018] In this reference, the authors propose to detect temporal anomalies using transformer-type neural networks (or self-attentive models). In particular, this approach assigns each network flow an anomaly score and observations that have a score higher than a predefined threshold are considered abnormal.

[0019] However, this method has limitations that make it not very applicable to the inference of firmware version of a device communicating in real time.

[0020] Notably, this method is not robust to anomalies that may contaminate the training base. Indeed, the authors assume that all training data are nominal. In practice, anomalies may infiltrate the data collected for training. In this case, the performance of this approach can be significantly impacted.

[0021] There is a need for a method for remedying shortcomings and / or drawbacks of the state of the art and / or making improvements thereto and in particular enabling robust detection of contextual anomalies in time series of network flow metadata of communicating devices. Summary

[0022] This disclosure improves the situation.

[0023] A method for monitoring at least one device in a communication network is provided, the method comprising:obtaining an observation sequence from observations of a network flow involving the device,implementing at least one given artificial intelligence model associated with a firmware version of at least one reference device, the given model being trained to produce a reconstructed sequence from the observation sequence and a previous observation sequence and to determine a reconstruction error between the reconstructed sequence and the observation sequence, a reconstruction error lower than a threshold characterizing that the device operates in the network with said firmware version,the reconstructed sequence being produced as a function of intra-sequence relationships between elements of the observation sequence and inter-sequence relationships between the observation sequence and the previous observation sequence.

[0024] The proposed monitoring method enables robust detection of anomalies, including contextual ones, in observations of a network flow involving one or more devices. The network flow is understood as a set of digital data transiting over the communication network. It may, for example, be packets of digital data transmitted over time by different source devices to different destination devices. Observations of the network flow are digital data relating to the network flow. It may, for example, be metadata extracted from headers of these packets. Observations of the network flow may, for example, be collected continuously, so as to form a time series divisible into observation sequences. Thus, observation sequences are defined as being digital data relating to the network flow, collected during an observation window.The robustness of anomaly detection is conferred by the use of intra-sequence and inter-sequence relationships discussed as the basis for the reconstruction of an observation sequence.

[0025] The proposed method allows for real-time anomaly detection from the network flow. The computational time required for the implementation of the method is indeed compatible with this continuous implementation. Furthermore, it does not require complex algorithm parameterization or supervised learning. Finally, it is robust to noisy data and outliers during training.

[0026] The proposed monitoring method finds applications in particular in the field of remote assistance where it offers the possibility of determining whether or not one or more devices are operating in a communication network with the same given firmware version as one or more reference devices.

[0027] A method for managing at least one communicating device in a communication network is proposed, the method comprising: monitoring the communicating device according to the above monitoring method, and issuing a management instruction for the communicating device on the basis of a comparison between the reconstruction error determined during the implementation of the given model and the threshold.

[0028] The proposed management method, which encompasses the aforementioned monitoring method and has the same advantages, finds applications in the field of maintenance in that it facilitates automatic maintenance operations. For example, it makes it possible to detect devices whose network traffic has abnormal characteristics to trigger advanced diagnostics, identify the origin of the problem, and allow automatic repair before any request for assistance from end users.

[0029] Also provided is a computer program comprising instructions for implementing one of the above methods when this program is executed by a processor.

[0030] Also provided is a non-transitory computer-readable recording medium having recorded thereon a program for implementing one of the above methods when that program is executed by a processor.

[0031] Also provided is a data processing circuit comprising a processor connected to the above non-transitory recording medium.

[0032] Also provided is a system comprising a plurality of communicating devices in a communication network, at least one of the communicating devices comprising the above data processing circuit.

[0033] The above monitoring method may optionally include certain additional functions as defined below.

[0034] In some examples, implementing at least one given model comprises implementing a plurality of models respectively associated with a respective firmware version of the at least one reference device, each said model being respectively trained to produce a respective reconstructed sequence from the observation sequence and the previous observation sequence and to determine a respective reconstruction error between the respective reconstructed sequence and the observation sequence, the reconstruction error determined when implementing the given model having the lowest value among the respective reconstruction errors.

[0035] By implementing such a plurality of models, it is possible to determine the precise firmware version of a monitored device operating in the network, by identifying it from a set of predefined possible versions, each of which is respectively associated with a respective model.

[0036] Indeed, when the monitored device and the at least one reference device belong to the same family of devices, and when, in addition, the reconstruction error determined during the implementation of a model is lower than the threshold mentioned, then the firmware version with which the monitored device operates in the network is identified precisely as being that associated with this model.

[0037] A family of communicating devices is defined as a grouping of communicating devices sharing the same firmware version. However, these communicating devices may differ, for example, in their operation or form factor.

[0038] In some examples, implementing at least one given model comprises implementing a set of models comprising a plurality of subsets respectively associated with a respective family of reference devices and each comprising at least one model associated with a firmware version of at least one reference device of the respective family, the given model belonging to one of the subsets, the reconstruction error, determined during the implementation of the given model (MOD ij ), lower than the threshold further characterizing that the device belongs to the family associated with the subset comprising the given model.

[0039] By implementing such a set of models, it is possible to determine both the device family to which a monitored device belongs and the firmware version with which it operates in the network.

[0040] Conversely, when the reconstruction errors determined during the implementation of each model are all greater than a threshold, then the network flow involving the monitored device can simply be considered as unknown, or as presenting an anomaly.

[0041] Such a case occurs, for example, when none of the subassemblies is associated with a family to which the monitored device belongs, or when none of the models is associated with the firmware version with which the monitored device operates in the network, or when this firmware version is corrupted.

[0042] The above management method may optionally include certain additional functions as defined below.

[0043] In some examples, when the determined reconstruction error is below the threshold and the firmware version associated with the given model is outdated, the management instruction includes a recommendation to update the firmware version with which the device operates in the network.

[0044] Thus, a notification and recommendation service can offer targeted firmware updates for one or more monitored and managed devices whose firmware version is identified as no longer up to date.

[0045] In some examples, the method further comprises, when the determined reconstruction error is greater than the threshold, an anomaly detection, and the management instruction is issued based on the anomaly.

[0046] For example, a notification and recommendation service may only offer general firmware updates for all devices present on the precondition that the firmware version of one or more monitored devices could not be identified.

[0047] Other features, details and advantages will become apparent upon reading the detailed description below, and upon analyzing the attached drawings, in which: Fig. 1

[0048] illustrates different types of anomalies in time series for a univariate signal. Fig. 2

[0049] illustrates a system comprising a plurality of communicating devices in a local communication network in an exemplary embodiment. Fig. 3

[0050] illustrates a system comprising a plurality of communicating devices in a local communication network in an alternative embodiment. Fig. 4

[0051] illustrates a general algorithm of a computer program for implementing, when this program is executed by a processor, a method of training at least one artificial intelligence model in an exemplary embodiment. Fig. 5

[0052] illustrates a general algorithm of a computer program for implementing, when this program is executed by a processor, an artificial intelligence model in an exemplary embodiment. Fig. 6

[0053] illustrates a general algorithm of a computer program for the implementation, when this program is executed by a processor, of a method for managing at least one communicating object in an exemplary embodiment. Fig. 7

[0054] illustrates a data processing circuit in an exemplary embodiment.

[0055] The proposed technique overcomes drawbacks of the state of the art and provides monitoring of communicating objects in a communication network. This monitoring provides robust detection of anomalies, including contextual anomalies, in time series of network flow metadata of communicating devices. The detected anomalies make it possible, in particular, to trigger requests for updating the firmware version of communicating devices to their latest functional version.

[0056] The general principle of the proposed technique is based on a confrontation of a behavior of a communicating device with different possible behaviors identified. Each of these possible behaviors is modeled independently and is associated with a possible firmware version for a reference device or for a family of reference devices. To do this, for a plurality of reference devices, metadata is extracted from network traffic during a time interval subdivided into sub-intervals, forming as many observation windows. This metadata may include, for example, source IP addresses, destination IP addresses, incoming and outgoing packet sizes, timestamps, etc. The metadata extracted from the network traffic during an observation window forms an observation sequence.

[0057] The observation sequences serve as a basis for modeling the behavior of each reference device, so that a list of models noted MOD ij is generated. In this notation, the index j denotes a reference device family among a set of considered families, and the index i denotes a firmware version among a set of possible versions for the considered family i. In other words, each MOD model ij is the result of automatic training aimed at compressing and then reconstructing observation sequences continuously for a family of communicating devices.

[0058] From the observation sequence and the sequence reconstructed by the MOD model ij, a reconstruction error is determined. When this reconstruction error is less than a threshold, it is possible to infer that the observation sequence corresponds to network traffic involving a device of family i operating under firmware version j.

[0059] When none of the MOD models ijfrom the list of generated models fails to correctly reconstruct an observation sequence, i.e. when the reconstruction errors determined for each of the reconstructed sequences are all greater than a threshold, this means that the network traffic for this device has unknown characteristics. These unknown characteristics can be grouped under the generic term anomaly. An anomaly occurs, for example, when the device does not belong to any of the predefined families. An anomaly can also occur when the device, although belonging to one of the predefined families, does not operate under any of the predefined firmware versions, or operates under a corrupted firmware version.

[0060] In the remainder of the description, we will describe in detail an example of implementation of the proposed technique with reference to figures 2 to 7. We will also consider the particular case where the communication network is a local communication network.

[0061] Illustrates a system comprising a plurality of communicating devices (10, 11, 12, 13, 14, 15) in a local LAN / WLAN communication network (1). One of the communicating devices is a network access gateway GW (10), also called a network gateway, interfacing the local communication network (1) with a wide area communication network WAN (2) and allowing the communicating devices to access the wide area network. The communicating devices may comprise different types of devices EQ1, EQ2, EQ3, EQ4 (11, 12, 13, 14) for use by a user, such as a computer, a mobile phone, a touch pad, a communicating speaker, a game console, a communicating device in the field of lighting, health, security, heating, air quality, etc.Furthermore, the communicating devices may include one or more network devices other than the access gateway, such as a switch, a hub, a router, an RPT repeater (15), etc.

[0062] On the, the topology of the local network (1) is represented in a tree. Some communicating devices EQ1 (11), EQ2 (12) communicate directly with the network gateway (10), while other user devices EQ3 (13), EQ4 (14) communicate with a repeater RPT (15) whose main role is to extend the coverage of the network gateway (10). However, the proposed technique is not limited to any particular topology of the local network (1) and is applicable to any installation, for example domestic or within a company, whatever the network devices present and whatever the number and nature of the communicating devices.

[0063] An EXT device (20), external to the local network (1), is also represented on the and designates a device capable of communicating with one or more entities of the local network, for example the network gateway GW (10). Depending in particular on the topology of the local network, this communication is carried out either directly via the extended network (2), or indirectly through both the extended network (2) and the local network (1).

[0064] At least one of the devices shown comprises a processing circuit CT (100) configured for implementing the proposed technique. In the example of the, such a processing circuit CT (100) is integrated into the network access gateway GW (10), which allows the processing circuit CT (100) to have direct access to all the traffic passing through the local network. The specifically describes the structure of such a processing circuit (100). This comprises at least one processor CPU (101) connected to at least one non-transitory memory MEM (102) and to a communication interface COM (103) with the local network (1). The non-transitory memory (102) stores one or more instructions of a computer program for implementing a method for managing the system of the when this program is executed by a processor. The operation of the program may also require the presence of a transient memory within the processing circuit.Functionally, during the execution of the program, such a processing circuit (100) or such a set of processing circuits can be seen as a grouping of functional, or logical, modules respectively dedicated to specific tasks.

[0065] In a variant illustrated in the, several CT processing circuits (100) can be collectively configured to implement the proposed method. Such CT processing circuits (100), each comprising a structure corresponding to that of the, can be integrated into different devices such as the network access gateway GW (10) and the EXT device (20). Thus, a first CT processing circuit (100) at the network gateway (10) can for example be configured to implement a management client and a second CT processing circuit (100) at the external device (20) to implement a management server dialoguing with the management client, the steps of the proposed technique then being distributed between the management server and the management client.

[0066] We now describe, in a particular exemplary embodiment, a method for managing communicating equipment. This method is based on artificial intelligence models.

[0067] Each of these models, noted MOD ij , is associated with a family i of reference devices and a firmware version j of the reference devices of family i. The index i is between 1 and I, where I denotes the number of families of reference devices considered by the training method, and the index j is between 1 and J I , where J I denotes the number of firmware versions supported for family i, this number being variable from one supported family to another. The model training method can be implemented by any processing circuit (100) in any system comprising one or more reference devices in a communication network, such as for example the systems of figures 2 and 3.

[0068] An example of a method (1000) for training, or learning, an artificial intelligence model MOD is now described with reference to the ij (1101) suitable for the implementation of the management process.

[0069] A data collector (1001) records during a reference period (e.g. a period of 7 days), metadata of network traffic involving, at least, one or more reference devices of family i operating in the network with firmware version j.

[0070] For example, in the system of laou 3, this metadata can be collected from a probe provided on a device, such as the network gateway (10), through which the entire network flow involving the reference device(s) of family i operating in the network with firmware version j passes. When the reference period is sufficiently long with regard to the family i considered, the metadata thus collected is likely to reflect all the nominal operating situations of this or these reference devices.

[0071] Otherwise, when the metadata is collected at the level of a device through which only part of the network flow involving the reference device(s) of family i operating in the network with firmware version j passes, the metadata thus collected may still reflect part of the nominal operating situations of this or these reference devices. Such a case is possible, for example, in the context of a mesh network where network traffic does not always follow the same route.

[0072] At the output of the data collector, a data filter (1002) makes it possible to sort the recorded metadata by selecting those considered useful for training the MOD model. ij(for example, MAC addresses - for "Medium Access Control" -, IP addresses - for "Internet Protocol" -, packet sizes, source addresses, destination addresses, etc.). This selection may be supervised or unsupervised. For example, the filter may be configured to specifically select metadata relating to a family i in version j, i.e. metadata corresponding, for example, to a source address and / or a destination address appearing in a list of listed addresses, associated with a reference device of family i operating in the network with firmware version j. Generally speaking, the implementation of such a selection is an approach well known to those skilled in the art and which is not further developed here.

[0073] At the output of the data filter, a segmenter (1003) makes it possible to form, from all the selected metadata, groups of metadata to be analyzed jointly. The size of these groups of metadata can be fixed beforehand, a group defining an analysis window. In an example implementation, the recorded metadata is segmented into groups of 100 samples without overlap.

[0074] At the output of the segmenter, one or more preprocessing modules (1004) are used to perform preprocessing on the metadata groups formed. Various examples of preprocessing that can be performed by these preprocessing modules are now discussed, in a non-exhaustive manner. One-hot encoding, or 1-out-of-n encoding, consists of encoding a variable with n states on n bits. Such encoding is common in machine learning to represent a categorical variable in digital data. Frequency encoding, or "count encoding" in English, is used to reflect the frequency of appearance of categories. Normalization aims to standardize the data by resizing them so that they are comparable on a common scale. Resampling is used to draw, based on the samples forming a metadata group, new hypothetical samples that reflect the same distribution characteristics.

[0075] At the end of the pre-processing(s), data sequences, or observation sequences, noted s ij (k) and indexed by k = 1…n in order of appearance, are obtained. In an example implementation, n can be set equal to 100. The observation sequences thus obtained are the training sequences of the artificial intelligence model MOD ij .

[0076] A learning module (1005) is provided to perform the learning of the MOD model ij . MOD model training ij is carried out by successively providing the observation sequences as input to the learning module, which attempts to reconstruct them.

[0077] The detailed operation of the learning module (1005) is now described with reference to the, in an exemplary embodiment.

[0078] Two consecutive observation sequences ij (k) (111) and s ij (k-1)(112) are provided as input to the learning module (1005). The current observation sequence s ij (k) is the sequence to be reconstructed. The previous observation sequence s ij (k-1) represents an element of a history of observation sequences.

[0079] Two branches of operations are carried out in parallel.

[0080] According to a first branch of operations, the current observation sequence s ij (k)is processed by a first module formed by a self-attention module (212) and an encoder (312). Self-attention is a learning mechanism for artificial intelligence models that is known to those skilled in the art and is described in particular in A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. Gomez, Ł. Kaiser, and I. Polosukhin, Advances in Neural Information Processing Systems, page 5998--6008. (2017). By applying a self-attention mechanism to the current observation sequence, the self-attention module provides as output intra-sequence relationships denoted z k , that is, relationships within the current observation sequence s ij (k) . The encoder (312) is configured to encode these intra-sequence relationships.

[0081] According to a second branch of operations, the current observation sequence and, at least, the previous observation sequence s ij (k-1), are processed by a second module formed by a co-attention module (211) and an encoder (311). Co-attention is a learning mechanism for artificial intelligence models that is known to those skilled in the art and is described in particular in Haoran Zhang and Diane Litman, 2018, Co-Attention Based Neural Network for Source-Dependent Essay Scoring, Proceedings of the Thirteenth Workshop on Innovative Use of NLP for Building Educational Applications, pages 399–409, New Orleans, Louisiana, Association for Computational Linguistics. By applying a co-attention mechanism to the current observation sequence, the co-attention module provides inter-sequence relationships as output, i.e. relationships between the current observation sequence s ij (k) and an observation sequence history. In an example implementation, the observation sequence history is represented by the single previous observation sequence s ij(k-1) and inter-sequence relations are denoted z k-1 . In other implementation examples, the observation sequence history can be represented by p previous observation sequences (s ij (k-1) , s ij (k- 2 ) , …, s ij (k- p ) ) and inter-sequence relations are denoted z k -p . The encoder (311) is configured to encode these intra-sequence relationships.

[0082] Although the first and second modules can be implemented as completely separate and distinct modules, in a particular embodiment these modules are implemented as a Siamese neural network. This particular embodiment allows for better robustness in detecting anomalies, in particular contextual anomalies. Alternatively, it is also possible to construct a learning module having an architecture functionally similar to that of a Siamese neural network.

[0083] In an example implementation, the first and second modules are implemented as a transformer-type Siamese neural network, self-attention is defined by: and co-attention is defined by: .The quantities q, v and e tare usually defined, in the field of transformer-type neural networks, as designating the "query", the "value", and the element of the observation sequence considered at time t. Additional information, in particular on the quantities q, v and e t , and more generally on the implementation of attention mechanisms using transformer-type neural networks, are available in A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. Gomez, Ł. Kaiser, and I. Polosukhin. Advances in Neural Information Processing Systems, page 5998-6008, (2017).

[0084] In an example implementation by a fully connected neural network, the relationships encoded by the first and second modules are merged by a merger (410), then processed by a third module to produce, as output, a reconstructed sequence ŝ ij (k) (711) which is a reconstruction of the input sequence sij (k) (111). Functionally, the third module comprises, at least, a decoder (610) configured to decode the encoded relationships. In an exemplary implementation, the third module further comprises a transformation module (510) configured to transform the encoded relationships using a self-attention mechanism before decoding them.

[0085] During the training phase, the encodings performed by the first and second modules, as well as the decoding performed by the third module, are progressively refined with each processing of a new observation sequence, so that the reconstructed sequences are, collectively, as similar as possible to the training sequences. Thus, the MOD model ij learns to correctly reconstruct observation sequences from family i of reference devices operating in a network with firmware version j.

[0086] In one embodiment, the MOD model ij learns to reconstruct training sequences by minimizing the robust Geman-McClure function. This function is defined by:

[0087] The greatness e k is the result of a reconstruction error calculation of the observation sequence s ij (k) . This calculation involves the Euclidean distance d ij (k) between the observation sequence s ij (k) and the reconstructed sequence ŝ ij (k) , as well as a parameter denoted c, which controls the robustness of the function and is fixed as a multiple of the interquartile range (IQR) of all the metadata of family i in version j, with λ = 0.1 for example.

[0088] Once the MOD model training ij(1101) completed, this can be stored in a reference base (1100), noted DB_REF, then a new iteration of the process can be triggered in order to train a new MOD model i , j +1 for another firmware version j+1 of the i family if such a version exists, or a new MOD model i+1,1 for another family i+1 of reference devices. This process can be repeated until as many families as desired are covered and, for each family covered, as many firmware versions as desired.

[0089] A method for managing communicating devices is now described with reference to the. This management method comprises a procedure for collecting and preprocessing metadata (2000) carried out using a collector (2001), a filter (2002), a segmenter (2003) and one or more preprocessing modules (2004).

[0090] The entities (2001, 2002, 2003, 2004) provided for the implementation of the metadata collection and pre-processing procedure (2000) have many similarities with those (1001, 1002, 1003, 1004) provided for the implementation of the first stages of the training method (1000) previously described in connection with the, with two nuances.

[0091] Specifically, in the proposed management method: the collector (2001) continuously collects metadata relating to current network flows, likely to involve all types of communicating devices, operating under any firmware version, and the filter (2002) organizes this collected metadata according to a procedure modeled on that of the filter (1002), so that the observation sequences at the output of the preprocessing module(s) (2004) have a format identical or similar to that of the observation sequences resulting from observations of network flows involving the reference devices.

[0092] As an alternative embodiment, the filter (2002) can extract a subset of metadata considered useful for collectively managing a group of communicating devices presumed to be linked, i.e. presumed to belong to the same family and presumed to operate in the network with the same firmware version.

[0093] In the proposed management method, the operation of the segmenter (2003) and that of the pre-processing module(s) (2004) are unchanged from those described in connection with the.

[0094] The management method also comprises a procedure for processing data and managing communicating devices (2100).

[0095] A loader (2106) loads a set of artificial intelligence models MOD into memory ij previously trained. This could be, for example, all the models stored in the reference database DB_REF (1100) described above.

[0096] A sequence reconstructor (2107) is planned to implement each MOD artificial intelligence model ij previously charged by the charger.

[0097] Functionally, the sequence reconstructor can be considered as comprising a plurality of parallel instances, each instance being associated with a MOD model ij respective and having an identical operation to that of the learning module described in connection with the and in more detail in connection with the.

[0098] We now consider, for the purposes of implementing any number of MOD models ij , that at a current time, a current observation sequence s ij (k) and at least one previous observation sequence s ij (k-1), relating to the same device, are obtained as sequences to be analyzed. The analysis of these observation sequences aims to characterize the family to which this communicating device belongs and / or the firmware version with which this communicating device operates in the network.

[0099] Implement each of the MOD artificial intelligence models ij involves: providing the same current observation sequence to be analyzed ij (k) to the set of first modules to determine intra-sequence relationships, provide the same current observation sequences to analyze s ij (k) and previous observation sequence to be analyzed s ij (k-1) to the set of second modules to determine the inter-sequence relationships, and obtain, for each of the artificial intelligence models implemented, a reconstructed sequence ŝ ij(k)respective qui est une reconstruction, par un troisième module respectif, de la séquence d’observation courante à analyser sij(k).

[0100] For each reconstructed sequence thus obtained, a reconstruction error calculation, noted e k ij , is performed, for example according to equation (3). For a reconstructed sequence ŝ ij (k) through the implementation of the MOD model ij , the result of the reconstruction error calculation is thus, for example, a Euclidean distance between this reconstructed sequence ŝ ij (k) and the current observation sequence s ij (k) which is at its origin. This Euclidean distance is a positive quantity indicative of the quality of the reconstruction. The closer it is to zero, the better the quality of the reconstruction. The reconstruction errors for each reconstructed sequence can be compared with each other in order to identify the family of communicating devices to which the communicating device to be managed belongs and the firmware version with which it operates in the network.

[0101] More precisely, comparing the reconstruction errors with each other allows us to determine the minimum error noted e k , that is, the minimum error value obtained for all error calculations performed. Among all MOD models ij , the one whose implementation produced as output the reconstructed sequence presenting the minimal error e k is a given model noted MOD î ĵ , this is the model representing the behavior in the network of communicating devices belonging to the î family and operating with the ĵ firmware version.

[0102] A comparator (2108) compares the minimum reconstruction error e k at a threshold τ min whose value, fixed, is specific to the given model MOD î ĵ .

[0103] If the minimum reconstruction error e k is less than the threshold τ min, then the communicating device to which the observation sequence relates is identified as belonging to family î and operating with firmware version ĵ. If this version ĵ is final for family î, then it can be concluded that the communicating device is already operating in the network with up-to-date firmware, and there is no need to trigger any update of this communicating device. If, conversely, version ĵ is not final for family î, a notification and recommendation service can issue a notification (2109) proposing an update of the firmware of the communicating device of family î.

[0104] If the minimum reconstruction error e k is greater than the threshold τ min, then the communicating device to which the observation sequence relates is identified as unknown, i.e. belonging to an unknown family, or operating with an unknown firmware version, or presenting anomalies. Optionally, when the communicating device to which the observation sequence relates is identified as unknown, provision may be made to store the observation sequence in memory, for later analysis. A notification and recommendation service may further, for example, issue a notification (2110) recommending an update of all the firmware available for the communicating devices identified as unknown.

[0105] The notification service may be a tailored and customized service to inform the appropriate party (e.g., a client, an object manager, etc.) that a firmware update of one or more communicating devices, or one or more families of communicating devices, is required.

Claims

A method for monitoring at least one device (10, 11, 12, 13, 14, 15, 20) in a communication network, the method comprising: obtaining an observation sequence (111) from observations of a network flow involving the device; implementing at least one given artificial intelligence model (1101) associated with a firmware version of at least one reference device, the given model being trained to produce a reconstructed sequence (711) from the observation sequence and a previous observation sequence (112) and to determine a reconstruction error between the reconstructed sequence and the observation sequence, a reconstruction error less than a threshold characterizing that the device is operating in the network with said firmware version, the reconstructed sequence being produced according to intra-sequence relations (z k ) between elements of the observation sequence and inter-sequence relations (z k- 1) between the observation sequence and the previous observation sequence. A method according to claim 1, wherein the implementation of at least one given model comprises the implementation of a plurality of models respectively associated with a respective firmware version of at least one reference device, each said model being respectively trained to produce a respective reconstructed sequence from the observation sequence and the previous observation sequence and to determine a respective reconstruction error between the respective reconstructed sequence and the observation sequence, the reconstruction error determined during the implementation of the given model (MOD î ĵ ) having the lowest value among the respective reconstruction errors. A method according to claim 1 or 2, wherein the implementation of at least one given model comprises the implementation of a set of models comprising a plurality of subsets respectively associated with a respective family of reference devices and comprising, each, at least one model associated with a firmware version of at least one reference device of the respective family, the given model belonging to one of the subsets, the reconstruction error, determined during the implementation of the given model (MOD ij ), lower than the threshold further characterizing that the device belongs to the family associated with the subset comprising the given model. A method for managing at least one communicating device in a communication network, the method comprising: monitoring the communicating device according to the monitoring method of any one of claims 1 to 3, and issuing a management instruction for the communicating device based on a comparison between the reconstruction error determined during the implementation of the given model (MOD). ij ) and the threshold. A method according to claim 4, wherein, when the determined reconstruction error is less than the threshold and the firmware version associated with the given model is obsolete, the management instruction includes a recommendation to update the firmware version with which the device operates in the network. A method according to claim 4 or 5, a method further comprising, when the determined reconstruction error is greater than the threshold, an anomaly detection, and wherein the management instruction is issued on the basis of the anomaly. Computer program comprising instructions for implementing the method according to any one of claims 1 to 6 when this program is executed by a processor. Non-transient recording medium (102) readable by a computer on which is recorded a program for the implementation of the method according to any one of claims 1 to 6 when this program is executed by a processor. Data processing device (100) comprising a processor (101) connected to a non-transient recording medium (102) according to claim 8. System comprising a plurality of communicating devices (10, 11, 12, 13, 14, 15, 20) in a communication network, at least one of the communicating devices comprising a processing device (100) according to claim 9.

Images