Method and system for incremental centroid clustering

Abstract

To provide a method and system for incremental centroid clustering.SOLUTION: A method at a computing device for anomaly detection is provided. The method includes: storing, at the computing device, a full batch model for multiple data points, where each of the data points is associated with one of multiple clusters, and where the storing comprises a table for storing information about the multiple clusters without storing the multiple data points; receiving a new data point from a hardware sensor; determining that the new data point falls outside the full batch model, thereby detecting an anomaly; and performing an action based on the anomaly.SELECTED DRAWING: Figure 12

Description

[Technical field]

[0001] FIELD OF THE DISCLOSURE The present disclosure relates to anomaly detection systems, and more particularly, to machine learning for anomaly detection systems. [Background technology]

[0002] Anomaly detection is the process by which outliers in a dataset can be identified. It plays a role in complex software systems, e.g. distributed systems, allowing, among other benefits, threats to the system to be detected, the root causes of errors to be identified, the health of the system to be monitored, data cleaning, etc.

[0003] Traditionally, anomaly detection systems have been built manually, which involved considerable domain knowledge and foresight regarding problems that might be encountered. Furthermore, such systems tend to be static, which is undesirable as threats to the system may evolve.

[0004] In this regard, machine learning algorithms have recently been used to create such anomaly detection systems. Such machine learning algorithms generally create systems that can handle large data sets, can be adaptive over time, and can perform better than manual creation. Examples of such machine learning algorithms include One Class Support Vector Method (SVM), Random Forest, Local Outlier Factor Method, etc., among others.

[0005] However, such machine learning algorithms have significant overhead, both in terms of processing and memory requirements, and therefore, these algorithms are impractical to implement in distributed systems, and processing modules on the edge of such systems may not have the memory or processing power required to effectively execute such algorithms. Summary of the Invention [Means for solving the problem]

[0006] The present invention provides, for example, the following items. (Item 1) 1. A method in a computing device for anomaly detection, the method comprising: storing, in the computing device, a full batch model for a plurality of data points, each of the plurality of data points being associated with one of a plurality of clusters, the storing including a table for storing information about the plurality of clusters without storing the plurality of data points; receiving new data points from a hardware sensor; determining that the new data point is outside of the full batch model, thereby detecting an anomaly; and taking an action based on said anomaly; A method comprising: (Item 2) The computing device comprises: Selecting data points; determining that the data points fall within a threshold average distance to a cluster center; adding said data points to said clusters; performing said determining and adding iteratively for subsequent data points in a training set of data points; The method according to the preceding item, wherein the full batch model is created by: (Item 3) Adding the data points to the clusters comprises: incrementing an index indicating the number of data points in the cluster; adding information for said data point to a feature sum for said cluster; updating the centroids of the clusters; updating values ​​including approximate distances between points in the cluster; The method according to any one of the above items, comprising: (Item 4) determining that a second data point does not fall within the threshold of the average distance to the center of the cluster; creating a new cluster for said data points; The method according to any one of the preceding items, further comprising: (Item 5) determining that a number of clusters in the anomaly detection system exceeds a function; removing from the anomaly detection system all clusters that have a single data point within the cluster; updating said threshold to a higher value; The method according to any one of the preceding items, further comprising: (Item 6) Item 11. The method of any one of the preceding items, wherein the function is a square root function less than the total number of data points processed. (Item 7) 2. The method of any one of the preceding claims, wherein the computing device stores only incremental information about each cluster. (Item 8) The action is: Providing alerts; and automatically controlling a device associated with said computing device; The method according to any one of the preceding items, comprising at least one of the following: (Item 9) 5. The method according to any one of the preceding claims, wherein the computing device is an edge device in an Internet of Things (IoT) system. (Item 10) 1. A computing device for anomaly detection, the computing device comprising: A processor; Communication Subsystem and Equipped with The computing device comprises: storing a full batch model for a plurality of data points, each of the plurality of data points being associated with one of a plurality of clusters, the storing including a table for storing information about the plurality of clusters without storing the plurality of data points; receiving new data points from a hardware sensor; determining that the new data point is outside of the full batch model, thereby detecting an anomaly; and taking an action based on said anomaly; 16. A computing device configured to: (Item 11) The computing device comprises: Selecting data points; determining that the data points fall within a threshold average distance to a cluster center; adding said data points to said clusters; performing said determining and adding iteratively for subsequent data points in the training data point set; 2. The computing device of claim 1, further comprising: (Item 12) The computing device comprises: incrementing an index indicating the number of data points in the cluster; adding information for said data point to a feature sum for said cluster; updating the centroids of the clusters; updating values ​​including approximate distances between points in the cluster; 2. The computing device of claim 1, further configured to add the data point to the cluster by (Item 13) The computing device comprises: determining that a second data point does not fall within the threshold of the average distance to the center of the cluster; creating a new cluster for said data points; 2. The computing device of claim 1, further configured to: (Item 14) The computing device comprises: determining that a number of internal clusters for anomaly detection exceeds a function; removing all clusters that have a single data point within said cluster; updating said threshold to a higher value; 2. The computing device of claim 1, further configured to: (Item 15) 2. The computing device of claim 1, wherein the function is a square root function less than the total number of data points processed. (Item 16) 2. The computing device of claim 1, wherein the computing device stores only incremental information about each cluster. (Item 17) The action is: Providing alerts; and automatically controlling a device associated with said computing device; 2. The computing device of claim 1, further comprising at least one of: (Item 18) 2. The computing device of claim 1, wherein the computing device is an edge device in an IoT system. (Item 19) 1. A computer storage medium for storing instruction code for anomaly detection, the instruction code, when executed by a processor on a computing device, causing the computing device to: storing a full batch model for a plurality of data points, each of the plurality of data points being associated with one of a plurality of clusters, the storing including a table for storing information about the plurality of clusters without storing the plurality of data points; receiving new data points from a hardware sensor; determining that the new data point is outside the full batch model, thereby detecting an anomaly; taking an action based on said anomaly; A computer storage medium that causes (Summary) A method in a computing device for anomaly detection, the method including: storing, on the computing device, a full batch model for a plurality of data points, each of the plurality of data points being associated with one of a plurality of clusters, the storing including a table for storing information about the plurality of clusters without storing the plurality of data points; receiving a new data point from a hardware sensor; determining that the new data point is outside of the full batch model, thereby detecting an anomaly; and performing an action based on the anomaly. [Brief description of the drawings]

[0007] The present disclosure may be better understood with reference to the drawings.

[0008] [Figure 1] FIG. 1 is a block diagram showing processing and storage for a full batch anomaly detection system, where processing and storage occurs at the edge device.

[0009] [Diagram 2] FIG. 2 is a block diagram showing processing and storage for a full batch anomaly detection system, where processing and storage occurs in a cloud device.

[0010] [Diagram 3] FIG. 3 is a block diagram showing processing and storage for a full batch anomaly detection system, where processing and storage occurs in a cloud device and the full batch model is pushed to an edge device.

[0011] [Figure 4] FIG. 4 is a block diagram illustrating an example vehicle system.

[0012] [Diagram 5]FIG. 5 is a block diagram illustrating an example data structure for storing incremental centroid cluster information.

[0013] [Figure 6] FIG. 6 is a process diagram showing a process for training an incremental centroid cluster model.

[0014] [Figure 7] FIG. 7 is a process diagram illustrating the process for adding data points to a cluster.

[0015] [Figure 8] FIG. 8 is a block diagram illustrating processing and storage for an incremental centroid clustering model for anomaly detection, where processing and storage occurs at an edge device.

[0016] [Figure 9] FIG. 9 is a graph showing eight exemplary clusters being processed in three dimensions.

[0017] [Figure 10] FIG. 10 is a graph showing the clustering of benign data points and the identification of anomalies from the plot of FIG.

[0018] [Figure 11] FIG. 11 is a block diagram of an exemplary confusion matrix.

[0019] [Figure 12] FIG. 12 is a process diagram for taking action upon detection of an anomaly.

[0020] [Figure 13] FIG. 13 is a block diagram of a simplified computing device that can be used with embodiments of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Detailed Description of the Drawings The present disclosure provides a method in a computing device for anomaly detection, the method including: storing, in the computing device, a full batch model for a plurality of data points, each of the plurality of data points being associated with one of a plurality of clusters, the storing including a table for storing information about the plurality of clusters without storing the plurality of data points; receiving a new data point from a hardware sensor; determining that the new data point is outside the full batch model, thereby detecting an anomaly; and performing an action based on the anomaly.

[0022] The present disclosure further provides a computing device for anomaly detection, the computing device further providing a processor and a communication subsystem, the computing device being configured to: store a full batch model for a plurality of data points, each of the plurality of data points being associated with one of a plurality of clusters, the storing including a table for storing information about the plurality of clusters without storing the plurality of data points; receive a new data point from a hardware sensor; determine that the new data point is outside the full batch model, thereby detecting the anomaly; and perform an action based on the anomaly.

[0023] The present disclosure further provides a computer storage medium for storing instruction code for anomaly detection, which when executed by a processor on a computing device causes the computing device to: store a full batch model for a plurality of data points, each of the plurality of data points being associated with one of a plurality of clusters, the storing including a table for storing information about the plurality of clusters without storing the plurality of data points; receive a new data point from a hardware sensor; and determine that the new data point is outside the full batch model, thereby detecting an anomaly; and performing an action based on the anomaly.

[0024] The present disclosure relates to Internet of Things (IoT) devices. For example, such devices may include automotive systems. However, the methods and systems described herein may be used equally well in other systems. Thus, the techniques of the present disclosure are not limited to any particular system.

[0025] In some cases, software programs may be executed in systems that are connected to or accessible through a public network, such as the Internet. Malicious actors may use a variety of exploitation techniques to affect the behavior of network-connected software programs. In other cases, malicious actors with access to a system may insert malicious code into the system software to affect the behavior of the software.

[0026] In particular, as IoT devices become more prevalent, the threat surface that attackers can target for nefarious purposes also continues to increase. While protection-based mechanisms may prevent the initiation of an intrusion, when such methods fail, it may be beneficial to have a method for detecting anomalous behavior on an endpoint and prompting action to protect the endpoint, business, or user from harm.

[0027] For example, a modern vehicle may have over 100 million lines of software code. As the software within a vehicle grows, so does the attack surface, making such software vulnerable to attacks. Each poorly configured piece of software represents a potential vulnerability that can be exploited by an attacker.

[0028] The "castle walls" used to keep hackers out of the system may be insufficient or may be circumvented by malicious actors over time. The system may in some cases not be able to detect compromised devices.

[0029] In this regard, methods and systems are provided that can analyze data (e.g., logs, etc.) in a system to detect anomalies. Such systems can use machine learning to find data anomalies.

[0030] Furthermore, on edge systems such as vehicles, there may be limitations in memory, communication, and processing. For example, IoT devices typically do not optimize hard drive space, meaning that the ability to store data may be limited. Furthermore, IoT devices often have limited processing power, and not all IoT devices may be able to easily connect to the cloud all the time.

[0031] An additional factor that can cause problems with analyzing logs is that IoT devices can have different behaviors: in particular, normal behavior can appear different between similar IoT devices depending on how a user uses the IoT device or how it is configured within the system.

[0032] As used herein, edge devices and IoT devices are used synonymously.

[0033] Current anomaly detection systems may use "full batch model" algorithms. Such models refer to anomaly detection systems that need to be trained on all data at once, and examples may include One Class SVM, Isolation Forest, Local Outlier Factor, among others. Such models require all benign data to be stored for processing. In this regard, a significant amount of storage space may be required at the edge IoT device, which may not exist.

[0034] In particular, reference is made to FIG. 1, which illustrates the steps involved during edge training 102, edge retraining 104, and edge inference 106, where the full batch model is deployed on the edge device.

[0035] 1 uses an in-vehicle infotainment system (IVI) 110 as an example edge device, however, such a device is provided for illustrative purposes only and the present disclosure is not limited to in-vehicle infotainment systems.

[0036] The IVI 110 creates a system log 112 and engineer features 114 from the system log.

[0037] Such features are converted into feature vectors in block 116. This occurs for all of edge training 102, edge retraining 104, and edge inference 106.

[0038] For edge training 102 and edge retraining 104, the edge device needs to store the vectors in block 120. This is done for eventual clustering on the collection. For edge devices, the need to store the vectors on the edge device can lead to an infeasible solution if the desired disk allocation is too small. This can be exacerbated if the model needs to be retrained. For example, when new software updates are provided to the edge device and new applications are installed, storage issues are added, among other factors.

[0039] From the stored vector, a model is trained in block 122. The model may need to be trained on all available benign data. For some full batch models (e.g., One Class SVM, etc.), this may take a long time and require a lot of resources for training. In some cases, the model may not be able to train the entire data set without failure. Other models (e.g., Isolation Forest, etc.) may not suffer from this, but they typically suffer in effectiveness compared to One Class SVM.

[0040] From the training in block 122, a full batch model 130 may be created. For edge retraining 104, the retrained model 140 may be used to create an updated full batch model 130.

[0041] The full batch model 130 may then be used during inference, as shown in block 150, which may then generate output 152.

[0042] Full batch models typically cannot train the model incrementally, but instead may need to start from scratch, which may require more resources than an edge device may have.

[0043] Thus, according to the embodiment of Fig. 1, one of the main problems is the space limitation of the edge device. In this regard, an alternative approach may be possible if storage and processing is moved to a cloud solution. Reference is now made to Fig. 2.

[0044] In particular, the edge device may send a constant stream of log data to a cloud server or service to be analyzed, which may overwhelm the communication channel from the edge device and therefore become excessively expensive to implement.

[0045] In the case of FIG. 2, four processes are shown, specifically edge collection 202 occurring on the edge device, cloud training 204 occurring in the cloud, edge re-collection 206 occurring on the edge device, and edge inference 208 (with input from the cloud) occurring on the edge device.

[0046] Similar to the embodiment of FIG. 1, edge device IVI 110 creates a system log 112 and engineered characteristics 114 from the system log.

[0047] Such features are converted into feature vectors in block 116. This occurs for all of edge collection 202, edge recollection 206, and edge inference 208.

[0048] For edge collection 202 and edge recollection 206, the edge device provides the vectors to the cloud for cloud storage in block 210.

[0049] From the stored vectors, a model is trained in block 212. Further, from the training in block 212, a full batch model 220 can be created in the cloud.

[0050] The full batch model 220 may then be used during inference, as shown in block 150, which may then generate output 152.

[0051] The embodiment of FIG. 2 fixes the problem of storing too much data at the edge device, but this may come at the cost of interacting with the cloud. In particular, the edge device may be capable of generating thousands of records per second. Some filtering, aggregation, among other factors, may be applied, which may result in a significant amount of bandwidth per endpoint. Such communication costs may be further inflated by the number of endpoints expected to transmit data.

[0052] Furthermore, for retraining during edge recollection 206, more data needs to be sent to the cloud, with the same problems as above.

[0053] Therefore, for both training and retraining, the cost for training in the cloud can be prohibitive given the amount of data required for training.

[0054] Furthermore, once the model is trained, it needs to send data back to the endpoint for inference, which can make the data heavy and also increase the latency for inference, potentially slowing down taking action on the inference in some cases. In particular, communication with the cloud adds latency for each round trip and requires additional components with internet connectivity to and from the cloud. If an attacker is able to take the endpoint offline, the anomaly detection function may fail.

[0055] Based on the above, an alternative approach for edge devices is to move the full batch model to the edge once training is complete. Reference is now made to FIG.

[0056] In the case of FIG. 3, four processes are shown, specifically edge collection 302 occurring on the edge device, cloud training 304 occurring in the cloud, edge re-collection 306 occurring on the edge device, and edge inference 308 occurring on the edge device.

[0057] Similar to the embodiment of FIGS. 1 and 2, on the edge device IVI 110, a system log 112 is created and from the system log, characteristics 114 are engineered.

[0058] Such features are converted into feature vectors in block 116. This occurs for all of edge gathering 302, edge regathering 306, and edge inference 308.

[0059] For edge collection 302 and edge recollection 306, the edge device provides the vectors to the cloud for cloud storage in block 210.

[0060] From the stored vectors, a model is trained in block 212. Further, from the training in block 212, a full batch model 220 can be created in the cloud.

[0061] The full batch model 220 may then be unfolded onto edges, as shown in block 310, which may then create a full batch model 320 that can be used during inference, as shown in block 330, which may then generate output 332.

[0062] Although the embodiment of FIG. 3 reduces the performance of shutting down the anomaly detection mechanism by turning off Internet connectivity during inference, there are still areas of concern with this approach. In particular, there is the issue of transmitting significant amounts of data from the endpoint to the cloud, which can be prohibitive in terms of communication functionality and cost. Furthermore, retraining suffers from the same problems as the embodiment of FIG. 2. Termination training also faces the same limitations for all full batch models.

[0063] Thus, the present disclosure provides an incremental centroid clustering method and system for anomaly detection on complex systems.

[0064] Vehicle Software Systems

[0065] The incremental centroid clustering method and system of the present disclosure may be used on any computing system (e.g., IoT systems, etc.), but in one embodiment, it may be used within a vehicle system. However, the present disclosure is not limited to vehicle systems, which are provided herein for illustrative purposes only.

[0066] Reference is now made to FIG. 4, which illustrates an exemplary vehicle system.

[0067] In the embodiment of Figure 4, a vehicle 400 may be equipped with computing and communication systems. Some of the computing systems may include a domain 410, which may have applications that create log data. Additionally, some of the computing systems on the vehicle 400 perform anomaly detection, as described below.

[0068] In the example of Figure 4, vehicle 400 utilizes the communication system to communicate with a cellular base station, shown in Figure 4 as eNB 420. The base station may communicate with a core network 430, which may then forward the communications through network 432 to a cloud service provider 440. Network 432 may be, for example, a wide area network (e.g., the Internet, etc.).

[0069] In other embodiments, rather than the core network 430, any technology associated with a particular cellular or wireless communication protocol may be used.

[0070] In some embodiments, cloud services 440 may provide processing for a domain or may provide information used within a domain.

[0071] Additionally, devices 460, rather than vehicles, may be used for anomaly detection. Devices 460 may be any computing device, including IoT devices, mobile devices, medical equipment, vehicles, or equipment associated with vehicles, among other options. Devices 460 may communicate over network 432 utilizing a variety of wired or wireless technologies (including, but not limited to, Ethernet, fiber, cellular, Wi-Fi, satellite, among other options).

[0072] In the FIG. 4 embodiment, the domain 410 and device 450 on the vehicle 400 may in some cases be considered edge devices, having limited storage and / or processing.

[0073] Incremental centroid clustering

[0074] As mentioned above, the use of existing machine learning models on edge devices is impractical. In particular, when utilizing existing machine learning anomaly detection algorithms to analyze log or tabular data, the main problems are that there is not enough space to store the information required for such algorithms, there is not enough processing to create a full batch model, and / or there is not enough communication performance to provide all the data to the cloud. Furthermore, the data is required up front and is difficult to update incrementally.

[0075] In this regard, an algorithm for incremental centroid clustering is described herein. As described in detail below, a first data point may be used to create a cluster, and then subsequent points may be analyzed to determine whether they are within a threshold distance of the average distance between all points in the cluster. If so, a new data point may be added to the cluster, and the shape of the cluster may be adjusted based on the new addition. If not, a new cluster is formed.

[0076] Furthermore, in some embodiments, the number of clusters may be limited to be proportional to the number of points processed so that inference time does not become excessive. In this case, small clusters (e.g., those of size 1, which are typically outliers) may be opportunistically removed if a desired maximum cluster proportion threshold is exceeded. When this occurs, the threshold may be increased by a threshold adjustment factor to encourage fewer new clusters to be created.

[0077] Once the model is trained, anything predicted within a threshold distance of an existing cluster is considered as benign, otherwise it is considered as anomalous.

[0078] In the incremental centroid clustering model, the data stored are only clusters that are at most a function of the square root of the number of points processed, or each cluster contains a single vector that contains all the information for the algorithm to function.

[0079] Furthermore, incremental centroid clustering is incremental: as opposed to needing all the data to perform the clustering, incremental centroid clustering can cluster one data point at a time.

[0080] As described below, the effectiveness of such an algorithm was tested against other machine learning algorithms and found to be close to or better than the best full batch algorithms tested.

[0081] Reference is now made to Figure 5. The embodiment of Figure 5 illustrates an example of a data structure for storing information about clusters. However, the example of Figure 5 is only one option for storing such information. The information stored in the exemplary data structure is illustrative of the type of information that may be stored for clusters.

[0082] In the example of Figure 5, a system with multiple clusters may be represented in a table where each row has information about one cluster. The information may include data regarding the centroid of the cluster for the particular dimension or feature for which the information is processed. In the example of Figure 5, "n" dimensions or features are processed, and thus columns 1 through n contain data regarding the centroid for the cluster for that particular dimension or feature. Collectively, these columns are shown in Figure 5 as columns 510.

[0083] The next n columns store values ​​that provide the sums of all features across all points that belong to a cluster. In particular, columns n+1 through 2n, represented as column 520, provide the cumulative feature sums for the clusters for each of the dimensions or features being analyzed, as described in more detail below.

[0084] Column 530 provides the number of points in the cluster, in other words the number of data points that have been analyzed and stored in that cluster is represented by column 530.

[0085] Column 540 provides the approximate total distance between points in the cluster. In other words, the distance measure between data points can be updated when new data points are added to the cluster.

[0086] The data structure of FIG. 5 or a similar data structure may be used in training an incremental centroid clustering algorithm according to the embodiment of FIG.

[0087] In particular, the process of FIG. 6 begins at block 610 and proceeds to block 612 where a data point is selected. As can be appreciated by one of ordinary skill in the art, data point selection may involve using lines in a log file, processing the data as it is created, using feature vectors, among other options, as described in FIGS. 1-3 above. In some cases, the data points represent data from a sensor (e.g., a vehicle sensor, or a group of sensors from a vehicle). In some cases, the data points may be received directly from a sensor, an electronic control unit (ECU), or other computing unit to be processed. In some cases, data from a sensor or ECU may be stored in a log file and some processing may be performed beforehand. Other options are possible.

[0088] From block 612, the process proceeds to block 620 where a check is made to determine if the selected data point from block 612 is the first data point for the incremental centroid clustering algorithm. If yes, the process proceeds to block 630 where the data point is assigned to a new cluster. In particular, the values ​​for column 510 in FIG. 5 correspond to the n features or dimensions being analyzed for the data point passed to the algorithm.

[0089] Additionally, column 520 is populated with values ​​corresponding to the n features of the data point being processed, since the sum of the features in a dimension can only have one data point, and therefore the sum is the original value.

[0090] Row 530 is assigned a value of 1 and represents a single data point.

[0091] Column 540 is assigned a value of 0, indicating that there is currently no distance between the data points in the cluster. In particular, there is only one data point, so the distance between the data points is 0.

[0092] Referring back to FIG. 6, from block 630 the process proceeds to block 632 where the new cluster is added to a table for the system.

[0093] Conversely, from block 620, if the data point is not the first data point for the system, the process proceeds to block 640 where a check is made to determine whether the data point is within a threshold of the average distance to the cluster center of any existing clusters in the system.

[0094] The average distance to the cluster center starts at 0. To start building the clusters, a global variable (referred to herein as "cluster distance") may be used that monitors the distance from the new point to the nearest cluster. At each iteration past the first data point, the distance between the new data point and the nearest cluster is added to this variable, starting at 0.

[0095] A second variable (referred to herein as "count") may indicate the total number of data points saved for the system.

[0096] The check in block 640 multiplies the "threshold distance" by the "cluster distance" divided by the "count". In this way, the "cluster distance" divided by the "count" is intended to represent the average distance of each point to the nearest cluster. This is useful because it can be difficult to determine in advance a good choice for the "threshold distance" hyperparameter, and the condition can be more flexible if clusters become denser or less dense over time.

[0097] Such a global variable may in some cases be used for all training. In other cases, the global variable may be used until a cluster has enough points in it. After this, a check in block 640 then multiplies the "threshold distance" by the value of column 540 divided by the count in column 530. In particular, the value of column 540 divided by the value of column 530 is intended to represent the average distance of each point to its cluster center.

[0098] In other words, the check at block 640 finds whether the data points are within a threshold distance of the average distance of the points' average distance to their nearest cluster.

[0099] In some cases, the threshold distance may be a value assigned to the system, which may be adjusted in some cases, as described below. Additionally, in some embodiments, the distance used is Euclidean distance.

[0100] If, in block 640, it is determined that the data point is not within the threshold average distance to the cluster center, the process proceeds to block 630, where the data point is assigned to a new cluster, and then proceeds to block 632, where the new cluster is added to the system.

[0101] Conversely, if at block 640 it is determined that the data point is within the threshold of the average distance to the cluster center, the process proceeds to block 642 where the data point is mapped to the nearest cluster. In particular, the mapping may be performed according to the embodiment of FIG.

[0102] 7, the process begins at block 710 and proceeds to block 720, where a value for the new data point that is mapped to the cluster is calculated and added to the feature sum in column 520. This new sum is then stored in column 520.

[0103] The process then proceeds to block 730 where the value in column 530 is incremented by one to indicate that the cluster now has an additional data point.

[0104] The process then proceeds to block 740, where the sum of the feature values ​​stored in block 720 is divided by the total number of data points stored in block 730. These values ​​are then stored in column 510 as centroid values.

[0105] The process then proceeds to block 750, where the distance values ​​of the new data points are added to the previous cluster centers. These values ​​are then divided by the total number of data points stored in block 730 and then averaged to create an approximation to the average distance between all points to the cluster centers, which can then be stored in column 540.

[0106] Referring back to FIG. 6, the columns representing the clusters may therefore be updated with the new data points in block 642 .

[0107] From block 632, if a new cluster is being added, in one optional embodiment, a check may be made to see if the maximum cluster count exceeds a predetermined threshold when compared to the total number of data points. In particular, hyperparameters for the machine learning incremental centroid clustering algorithm may be set that indicate the maximum cluster proportion. In one embodiment, the check at block 650 is true if the total number of clusters exceeds a square root function less the total points being processed.

[0108] From block 650, if the check is true, the process proceeds to block 652 where the number of clusters may be reduced. In some cases, the number of clusters may be reduced by removing all clusters of size 1 (because these represent outliers).

[0109] Additionally, to mitigate future growth in the number of clusters with size 1, the hyperparameters dealing with the threshold distance may be increased. In particular, the threshold distance used for the check in block 640 may be increased by a certain amount to allow data points to be placed in clusters at greater distances.

[0110] The increase in the threshold may in some cases be by a pre-set factor, for example specified as a threshold adjustment hyperparameter. In some cases, the increase may be based on an enumerated list of increases. In some cases, the increase may be based on some function of the size of the dataset or the number of data points being processed. Other options for the size increase are also possible.

[0111] If the maximum cluster proportion has not been exceeded, from block 642, 652, or block 650, the process proceeds to block 660 where a check is made to determine if there are more data points to be processed. If yes, the process proceeds to block 662 where the next data point is selected and the process then proceeds back to block 640.

[0112] Conversely, if there are no more data points to analyze, the process proceeds to block 670 and ends.

[0113] Thus, the process of Figure 6 illustrates the training steps for the incremental centroid clustering algorithm. Once training is complete, during inference, a data point may be analyzed and found to belong to a cluster if it is within a distance threshold of any of the existing clusters in the model. In this case, the data point may be considered benign. Conversely, if a data point does not belong to a cluster, it may be considered anomalous.

[0114] Utilizing the process of FIGS. 6 and 7, in terms of disk usage, the only component that needs to be saved to disk is the incremental model; no other data for incremental centroid clustering needs to be stored.

[0115] Furthermore, the incremental centroid clustering model can process one record at a time, keeping its peak resource requirements as low as feasible.

[0116] Additionally, the embodiments of FIGS. 6 and 7 do not require cloud connectivity since all training and inference occurs on the edge device.

[0117] Furthermore, a separate model may be trained for each edge device.

[0118] For example, referring to FIG. 8, three processes are shown, referenced as edge training 802, edge retraining 804, and edge inference 806, all of which occur at the edge device.

[0119] 8 uses an in-vehicle infotainment system (IVI) 110 as an example edge device, however, such a device is provided for illustrative purposes only and the present disclosure is not limited to in-vehicle infotainment systems.

[0120] The IVI 110 creates a system log 112 and crafts features 114 from the system log.

[0121] Such features are converted into feature vectors in block 116. This occurs for all of edge training 802, edge retraining 804, and edge inference 806.

[0122] Since each record is then processed incrementally, the storage shown in Figure 1 is not required. Instead, the feature vector 116 is used to train a model as shown in block 810 or to update a model as shown in block 830. The trained or updated model may be stored (as a table in Figure 5) for full batch model 820.

[0123] The full batch model 820 may then be used during inference, as shown in block 840, which may then generate output 842.

[0124] Thus, in accordance with the embodiment of FIG. 8, the limitations of the full batch model are alleviated.

[0125] Furthermore, if an endpoint is likely to have very similar benign behavior, incremental models can be federated to the device and model updates can be applied to tailor any behavior of that endpoint. As models do not need to be trained from scratch, they can update existing models with any new behaviors that are observed.

[0126] test

[0127] For testing, the process of Figure 6 was used on a data set having eight clusters with three-dimensional features, as shown in the embodiment of Figure 9. In particular, the embodiment of Figure 9 shows the eight clusters in grayscale, and graphs 910, 920, and 930 are the same eight clusters shown with a rotation along one of three axes.

[0128] In the test case, the cluster partially designated by reference numeral 940 (points within the cluster are indicated by "x") was designated as anomalous behavior, and the remaining seven clusters were designated as benign behavior. Thus, the process of FIG. 6 was run as a training model for benign behavior.

[0129] The inference process was then performed on the remaining data points. In this case, the graph of FIG. 10 was produced, with graphs 1010, 1020, and 1030 showing the same clusters rotated along one of the axes of different dimensions. In particular, as can be seen in FIG. 10, many overlapping clusters cover benign activity, but visually, anomalous behavior, indicated by the "x" symbol and generally designated by reference numeral 1040, is barely touched upon.

[0130] The process may be evaluated based on a confusion matrix, such as the one shown with respect to Figure 11. In particular, as seen in Figure 11, the matrix compares predicted outcomes with actual outcomes. If both the predicted and actual values ​​for a data point are such that the data point is benign, then it is classified as a true positive 1110.

[0131] If the prediction is that the data point is anomalous, but the actual value for the data point is that the data point is benign, this is classified as a false negative 1120.

[0132] If the prediction is that the data point is benign, but the actual value for the data point is that the data point is anomalous, this is classified as a false positive 1130.

[0133] If both the predicted and actual values ​​for a data point are such that the data point is anomalous, it is classified as a true negative 1140.

[0134] Based on the confusion matrix of FIG. 11, the goal of the system is to maximize the values ​​of true positives 1110 and true negatives 1140 while minimizing the false negatives 1120 and false positives 1130.

[0135] For the example of Figures 5 and 6, the confusion matrix was found to be: [Table 1]

[0136] Therefore, from Table 1, the accuracy for benign data points was 99.2% and the accuracy for anomalous data points was 93.3%.

[0137] Furthermore, the recall of the test, specifically what percentage of all positives are predicted to be positive, is 99.5% for benign data points and 90.9% for anomalous data points.

[0138] The F1 score of a test is the harmonic mean of precision and recall, taking into account both false positives and false negatives. This can be expressed as Equation 1 below: [ka]

[0139] The F1 score for the benign data points is 99.3 and for the anomalous data points is 92.3.

[0140] Thus, the general accuracy of the test was 98.8% and the harmonic F1 score was 95.7, indicating high classification validity.

[0141] Therefore, the model can be used with high efficiency on computing devices with limited storage and / or processing. The only storage required is for a table for multiple clusters. In particular, the data stored are only clusters that are at most a function of the square root of the number of points processed, or each cluster contains a single vector that contains all the information for the process to function.

[0142] The process can be aided by reducing the number of clusters when the cluster proportions exceed a threshold, and then by increasing the size of the distance threshold used, which further aids in tuning the parameters of the algorithm.

[0143] The process is incremental and does not require all the data to perform the clustering, in particular the method can cluster one data point at a time.

[0144] comparison

[0145] In testing, the effectiveness of the incremental centroid clustering of the present disclosure was found to be close to or better than the best of the full batch algorithms tested.

[0146] In particular, in a further test to that mentioned above, the incremental centroid clustering model was tested against a One Class SVM model. The same training, validation, and test data were used. The training data was used to train each model. The validation data was used to find the best choice of hyperparameters that resulted in a good separation of anomaly detections, and the test data was used to compare the results.

[0147] The following hyperparameters were tuned for the one-class SVM model: [Table 2]

[0148] The following hyperparameters were tuned for incremental centroid clustering: [Table 3]

[0149] After running multiple tests varying the hyperparameters, the best performance was found on the dataset for One Class SVM for the RBF kernel with gamma set to 'scale', tolerance set to 'insignificant', and Nu set to 0.001. For this setting of hyperparameters, the following confusion matrix was found: [Table 4]

[0150] From the above, the precision for the benign data was 96.6, and the precision for the anomalous data was 85.7. The recall for the benign data was 99.1, and the recall for the anomalous data was 60.0. The F1 score for the benign data was 97.9, and the F1 score for the anomalous data was 70.6.

[0151] Overall, the accuracy for One Class SVM was 96.0, the harmonic F1 was 82.0, and the area under the curve (AUC) was 79.6.

[0152] Similarly, after varying the hyperparameters and running multiple tests, the model performed worse when the threshold was too low (0.3) and the cluster proportions were too high (>0.8). The following confusion matrix was found for this model: [Table 5]

[0153] From the above, the prediction for the benign data was 98.6 and the prediction for the anomalous data was 92.6. The recall for the benign data was 99.4 and the recall for the anomalous data was 83.3. The F1 score for the benign data was 99.0 and the F1 score for the anomalous data was 87.7.

[0154] Overall, the accuracy of incremental centroid clustering was 98.1, with a harmonic F1 of 93.0 and an AUC of 91.46.

[0155] Based on these results, after tuning the incremental centroid clustering model, the fit became more accurate than the One Class SVM. Furthermore, the incremental centroid clustering was found to perform faster than the One Class SVM model.

[0156] Using Anomaly Detection

[0157] In practice, the use of anomaly detection may be made to perform various actions either at an edge device, a server, a cloud, and / or other computing devices. In particular, reference is now made to FIG.

[0158] The embodiment of Figure 12 begins at block 1210 and proceeds to block 1212 where anomaly detection is performed. In this case, the anomaly detection performed may use the full batch model created in the embodiments of Figures 6 and 7 described above. New data points are then received, for example from a log file, which may be created based on input from a hardware sensor or, in some cases, based on a software processor.

[0159] A new data point may be checked to determine if it will enter the full batch model by determining if the point is a distance threshold away from any existing clusters in the full batch model. If yes, the data point is considered to be a benign data point. If no, the data point is considered to be an anomalous data point. This is repeated each time a data point is created based on log file contents, among other options.

[0160] Once anomaly detection has been performed (or is performed in a system that performs continuous analysis), the process proceeds to block 1220 where a check is made to determine whether any anomalies have been found in the data being processed. If no, the process may proceed to block 1212 and continue performing anomaly detection.

[0161] Conversely, if an anomaly is found in block 1220, the process may proceed to block 1230, where an action may be performed. The action performed may be specific to the type of application in which the edge device is deployed. For example, in a vehicle system, if an anomaly is detected, one possible action may be to provide an alert to the driver of the vehicle. For example, the alert may include a message on the infotainment system, on the vehicle's dashboard, an audio alert to the driver, haptic feedback to the steering wheel, among other options. The alert may indicate that the driver should service the vehicle, pull over and stop driving the vehicle, contact the manufacturer or dealer, reset the system, etc., among other options.

[0162] In other cases, the action may be an alert to a third party rather than the driver. Such an alert may be sent to the vehicle manufacturer, dealer, fleet operator, corporate IT department, etc., among other options. The alert may include the data that caused the anomaly, the context around the anomaly, other vehicle sensor readings, etc., among other information. This allows the third party to make decisions regarding the vehicle (e.g., whether to have the vehicle serviced, whether to remove the vehicle from the road, whether to reset the software on the vehicle, whether a software update should be pushed to the vehicle, etc., among other such actions).

[0163] In some cases, the action may involve the vehicle itself automatically taking the action: for example, the vehicle may stop if the vehicle has autonomous functionality, the vehicle may ignore anomalous sensor readings in some cases, the vehicle may be speed limited in some cases, among other such actions.

[0164] For non-vehicle situations, actions may similarly include alerting a user, a third party, or implementing some functionality on an edge device based on anomalous data detection.

[0165] In some cases, the action may be to use the new data points in retraining the model.

[0166] This disclosure is not intended to be limited to any particular action that may be taken based on the detection of an anomaly, and the above examples are provided for illustrative purposes only.

[0167] Computing Devices

[0168] The above domains, network elements, IoT or edge devices, cloud services, nodes, and other computing platforms may be implemented using any computing device. A simplified diagram of one of the computing devices is shown with respect to Figure 13. The computing device of Figure 13 may be any fixed or mobile computing device.

[0169] 13, the device 1310 includes a processor 1320 and a communication subsystem 1330, which cooperate to perform the methods of the embodiments described above. The communication subsystem 1330 enables the device 1310 to communicate with other devices or network elements and may vary based on the type of communication performed. Additionally, the communication subsystem 1330 may include multiple communication technologies (including any wired or wireless communication technologies).

[0170] The processor 1320 is configured to execute programmable logic, which may be stored on the device 1310 along with data, and is shown in the example of FIG. 13 as memory 1332. The memory 1332 may be any tangible, non-transitory computer-readable storage medium that stores instruction codes that, when executed by the processor 1320, cause the device 1310 to perform the methods of the present disclosure. The computer-readable storage medium may be a tangible or transitory / non-transitory medium, such as, for example, optical (e.g., CD, DVD, etc.), magnetic (e.g., tape), flash drive, hard drive, or other memory known in the art.

[0171] Alternatively, or in addition to the memory 1332, the device 1310 may access data or programmable logic from an external storage medium, for example through the communications subsystem 1330.

[0172] 13, one or more sensors 1340 may be associated with the computing device 1310. However, this is optional and in some cases, the computing device 1310 may not be associated with any sensors.

[0173] Communication between the various elements of the device 1310 may, in one embodiment, be through an internal bus 1360. However, other forms of communication are possible.

[0174] The embodiments described herein are examples of structures, systems, and methods having elements that correspond to elements of the technology of the present application. The description herein may enable one of ordinary skill in the art to construct and use embodiments having alternative elements that similarly correspond to elements of the technology of the present application. The intended scope of the technology of the present application therefore includes other structures, systems, or methods that do not differ from the technology of the present application described herein, and further includes other structures, systems, or methods that have insubstantial differences from the technology of the present application described herein.

[0175] Although operations are depicted in the figures in a particular order, this should not be understood as requiring that such operations be performed in the particular order or sequential order shown, or that all illustrated operations be performed, to achieve desired results. In certain circumstances, multitasking and parallel processing may be employed. Furthermore, it should be understood that the separation of various system components in the implementations described above should not be understood as requiring such separation in all implementations, and that the program components and systems described may generally be integrated together in a single software product or packaged in multiple software products.

[0176] Also, techniques, systems, subsystems, and methods described and illustrated in various implementations as being discrete or separate may be combined or integrated with other systems, modules, techniques, or methods. Other items shown or discussed as being coupled or directly coupled or in communication with each other may be indirectly coupled or in communication through some interface, device, or intermediate component, whether electrical, mechanical, or otherwise. Other modifications, substitutions, and alternatives can be ascertained and configured by those skilled in the art.

[0177] While the above detailed description has illustrated, described and pointed out the basic novel features of the present disclosure as applied to various implementations, it will be understood that various omissions, substitutions and changes in the form and details of the illustrated systems may be made by those skilled in the art. In addition, the order of method steps is not implied by the order in which they appear in the claims.

[0178] When messages are sent to / from an electronic device, such actions may not be immediate or direct from a server. They may be delivered synchronously or asynchronously from a server or other computing system infrastructure supporting the devices / methods / systems described herein. The steps described above may include synchronous / asynchronous communications to / from the device / infrastructure, in whole or in part. Additionally, communications from the electronic device may be to one or more endpoints on the network. These endpoints may be served by, for example, a server, a distributed computing system, a stream processor, etc. Also, a content delivery network (CDN) may provide communications to the electronic device. For example, unlike a typical server response, a server may provide or indicate data to a content delivery network (CDN) to await download by the electronic device at a later time, such as subsequent activity of the electronic device. Thus, data may be sent directly from a server or may be sent from other infrastructures (e.g., distributed infrastructures or CDNs, etc.) as part of the system or separate from the system.

[0179] Typically, the storage medium may include any or some combination of semiconductor memory devices (e.g., dynamic or static random access memory (DRAM or SRAM), erasable and programmable read-only memory (EPROM), electrically erasable and programmable read-only memory (EEPROM), and flash memory, etc.), magnetic disks (e.g., fixed disks, floppy disks, removable disks, etc.), other magnetic media including tape, optical media (e.g., compact disks (CDs) or digital video disks (DVDs), etc.), or other types of storage devices. The instructions described above may be provided on one computer-readable or machine-readable storage medium, or alternatively, may be provided on multiple computer-readable or machine-readable storage media distributed within a larger system that may have multiple nodes. Such a computer-readable or machine-readable storage medium or multiple computer-readable or machine-readable storage media are considered to be part of an article (or product). An article or product may refer to any manufactured single component or multiple components. The storage medium or media may be located within the machine that executes the machine-readable instructions, or may be located at a remote site from which the machine-readable instructions can be downloaded over a network for execution.

[0180] In the above description, numerous details are set forth to provide an understanding of the subject matter disclosed herein. However, implementations may be practiced without some of these details. Other implementations may include modifications or variations from the details described above. The appended claims are intended to cover such modifications and variations.

Claims

1. A method in a computing device for anomaly detection, wherein the method is The computing device stores a full batch model for a plurality of data points, each of which is associated with one of a plurality of clusters, and the storage includes storing information about the plurality of clusters in a table without storing the plurality of data points, wherein for each cluster of the plurality of clusters, the number of data points in the cluster, the centroid of the cluster, the sum of the features across all the data points in the cluster, and the approximate distance between points in the cluster. Receiving new data points from hardware sensors, Based on the stored information, it is determined that the new data point is outside the full batch model, thereby detecting an anomaly. Based on the aforementioned anomaly, take action. Methods that include...

2. The computing device is Selecting data points, The determination that the aforementioned data point falls within the threshold of the average distance to the center of the cluster, Adding the aforementioned data points to the aforementioned cluster, The process of making the above determination and adding to subsequent data points in the data point training set is repeated. The method according to claim 1, wherein the full batch model is created by the present invention.

3. Adding the aforementioned data points to the cluster means Increment an index that indicates the number of data points within the aforementioned cluster, Adding the information for the aforementioned data point to the sum of the features for the aforementioned cluster, Updating the centroid of the aforementioned cluster, To update the value including the approximate distance between points within the cluster. The method according to claim 2, including the method described in claim 2.

4. Determining that the second data point does not fall within the threshold of the average distance to the center of the cluster, Creating a new cluster for the aforementioned data point The method according to claim 2, further comprising:

5. Determining that the number of clusters in the anomaly detection system exceeds a function, To remove all clusters having a single data point within the cluster from the anomaly detection system, To update the aforementioned threshold to a higher value and The method according to claim 4, further comprising:

6. The method according to claim 5, wherein the function is a function of the square root less than or equal to the total number of data points to be processed.

7. The method according to claim 1, wherein the computing device stores only incremental information relating to each cluster.

8. The aforementioned Action is, To provide alerts, Automatically control the computing device and the associated devices. The method according to claim 1, comprising at least one of the following.

9. The method according to claim 1, wherein the computing device is an edge device in an IoT (Internet of Things) system.

10. A computing device for anomaly detection, wherein the computing device is Processor and Memory and Communication subsystem and Equipped with, The computing device is The method involves storing a full batch model for multiple data points, each of which is associated with one of a plurality of clusters, and the storage includes storing information about the plurality of clusters in a table without storing the multiple data points, wherein for each cluster of the plurality of clusters, the number of data points in the cluster, the centroid of the cluster, the sum of the features across all the data points in the cluster, and the approximate distance between the points in the cluster. Receiving new data points from hardware sensors, Based on the stored information, it is determined that the new data point is outside the full batch model, thereby detecting an anomaly. Based on the aforementioned anomaly, take action. A computing device configured to perform the following actions.

11. The computing device is Selecting data points, The determination that the aforementioned data point falls within the threshold of the average distance to the center of the cluster, Adding the aforementioned data points to the aforementioned cluster, The process of making the above determination and adding to subsequent data points within the training data point set is repeated. The computing device according to claim 10, configured to create the full batch model.

12. The computing device is Increment an index that indicates the number of data points within the aforementioned cluster, Adding the information for the aforementioned data point to the sum of the features for the aforementioned cluster, Updating the centroid of the aforementioned cluster, To update the value including the approximate distance between points within the cluster. The computing device according to claim 11, configured to add the data points to the cluster accordingly.

13. The computing device is Determining that the second data point does not fall within the threshold of the average distance to the center of the cluster, Creating a new cluster for the aforementioned data point The computing device according to claim 11, further configured to perform the following:

14. The computing device is Determining that the number of internal clusters for anomaly detection exceeds the function, To remove all clusters that have a single data point within the aforementioned cluster, To update the aforementioned threshold to a higher value and The computing device according to claim 13, further configured to perform the following:

15. The computing device according to claim 14, wherein the function is a function of the square root less than the total number of data points to be processed.

16. The computing device according to claim 10, wherein the computing device stores only incremental information relating to each cluster.

17. The aforementioned Action is, To provide alerts, Automatically control the computing device and the associated devices. The computing device according to claim 10, comprising at least one of the following.

18. The computing device according to claim 10, wherein the computing device is an edge device in an IoT system.

19. A non-transient computer storage medium for storing instruction code for anomaly detection, wherein the instruction code, when executed by a processor on a computing device, is stored on the computing device. The method involves storing a full batch model for multiple data points, each of which is associated with one of a plurality of clusters, and the storage includes storing information about the plurality of clusters in a table without storing the multiple data points, wherein for each cluster of the plurality of clusters, the number of data points in the cluster, the centroid of the cluster, the sum of the features across all the data points in the cluster, and the approximate distance between the points in the cluster. Receiving new data points from hardware sensors, Based on the stored information, it is determined that the new data point is outside the full batch model, thereby detecting an anomaly. Based on the aforementioned anomaly, take action. A non-transient computer storage medium that enables the following actions.

Images