Anomaly Detection in Digital Systems in the Absence of Data Based on Correlation and Adaptive Analysis

Abstract

The invention is a system that detects anomalies based on data absence in digital systems; it includes modules that continuously monitor data flow, create reference behavioral models, and detect silence states caused by interruptions in the expected data flow. The system classifies the detected silence states according to their structural types and performs correlation analysis on multi-device data to generate a silence score indicating the anomaly risk. The invention has an infrastructure that dynamically updates behavioral models through an adaptive learning mechanism and generates notifications upon anomaly detection.

Description

1 TARIFF Anomalies Based on Correlation and Adaptive Analysis in the Absence of Data in Digital Systems Detection Technical Area The invention relates to IoT systems, industrial automation infrastructures, smart device networks, and cybersecurity. It is aimed at data monitoring systems used in applications. The system expects from the devices. By analyzing situations such as interruptions, reductions, or irregularities in data flow, the data It allows for the detection of anomalies through absence and silence behaviors. 10 State of the Art Today, IoT systems, industrial automation infrastructures, smart device networks, and cybersecurity are all interconnected. Data monitoring systems used in security applications analyze data coming from devices. It monitors the status of the system by doing so. However, current systems only process the generated data. 15 It is unable to analyze and effectively assess situations where data is missing. The devices... The system often considers the failure to generate data as normal, and critical errors... This is being overlooked. There are different types of data flow interruptions (sudden interruption, periodic interruption, etc.) It cannot be separated. Simultaneous data loss situations occurring on multiple devices are analyzed. is not done. 20 In conclusion, due to the negative aspects described above and the current solutions being the subject of discussion... Due to its shortcomings, it has become necessary to make improvements in the relevant technical field. Purpose of the Invention The invention was created by drawing inspiration from existing situations and addressing the aforementioned drawbacks. 25 It aims to solve the problem. The main purpose of the invention is to detect anomalies by actively analyzing data absence situations. to provide. Another aim of the invention is to differentiate between malfunction and attack by classifying silent behaviors. The aim is to make it possible to solve systemic and local problems through multi-device correlation. 30 The goal is to discriminate; to improve system accuracy over time through adaptive learning. To achieve the purposes described above, the invention enables the use of digital systems in the absence of data. It is an anomaly detection system based on correlation and adaptive analysis, and its features include: • Continuously monitoring data flow from devices within the system and capturing timestamped data. The data monitoring unit that compiled the records, 35 2 • By analyzing the normal data generation frequency and time intervals of the devices, reference behavior is determined. The behavioral modeling module that created the model, • Identifying situations where the expected data flow does not occur, thus determining data absence situations. silence detection module, • Detected silence instances can be categorized as sudden interruptions, periodic interruptions, or gradual decreases. The silence analysis and classification module, which separates into types, • Correlation analysis by evaluating silence levels from multiple devices together. a correlation and scoring module that performs and generates a silence score, • Updates the model based on system outputs and generates alarms in case of anomalies. Adaptive learning and notification module 10 It includes. The structural and characteristic features and all the advantages of the invention are given in the figures below. Thanks to the detailed explanation written with references to the figures, it becomes clearer. It will be understood. Figures that will help understand the invention. Figure 1 shows the general architecture of the system that is the subject of the invention. Explanation of Part References 1. Data monitoring unit 20 2. Behavioral modeling module 3. Silence detection module 4. Silence analysis and classification module 5. Correlation and scoring module 6. Adaptive learning and notification module 25 Detailed Description of the Invention This detailed explanation describes the correlation and data absence in the digital systems that are the subject of the invention. Anomaly detection systems based on adaptive analysis are preferred structures, not only for the subject matter. It is explained in order to facilitate a better understanding. 30 The invention is based on correlation and adaptive analysis of anomalies in the absence of data in digital systems. It is a detection system that continuously monitors the data flow from the devices within the system over time. Data monitoring unit (1) which creates stamped data records, normal data production frequency of devices and Behavioral modeling that creates a reference behavioral model by analyzing time intervals. module (2) determines the cases where the expected data flow does not occur, data absence 35 The silence detection module (3) detects the silence conditions and immediately detects the detected silence conditions. 3 Silence analysis categorizes sounds into types such as interruptions, periodic interruptions, or gradual reductions. Classification module (4) combines silence states from multiple devices. Correlation and scoring, which performs correlation analysis and generates a silence score by evaluating the situation. module (5) updates the model in line with the system outputs and in case of anomalies It includes an adaptive learning and notification module (6) that generates alarms. 5 The system continuously monitors the data flow from the devices via the data monitoring unit (1). The data obtained are analyzed by the behavior modeling module (2) and the devices Normal data production behaviors are determined. According to this model, the silence detection module (3) determines the data. It detects situations where the flow is interrupted or reduced. These detected situations are called silence. The type of silence is determined by evaluation by the analysis and classification module (4). 10 Correlation and scoring module (5) analyzes silence data from multiple devices. By analyzing them together, it creates a silence score across the system. Finally, adaptive Learning and notification module (6) updates the system model and triggers an alarm in case of anomalies. It produces. The steps involved in the system are as follows: 15 • Continuous monitoring of data flow from devices by the data monitoring unit (1), • Data generation patterns are analyzed by the behavior modeling module (2) creation of a reference model, • Situations where data generation is interrupted or reduced by the silence detection module (3) determination, 20 • Determination of the type of silence by the silence analysis and classification module (4), • Multi-device analysis and silence score by correlation and scoring module (5) creation, • Model update and alarm by adaptive learning and notification module (6) creation. 25

Claims

4 REQUESTS 1. Anomaly detection in digital systems in the absence of data, based on correlation and adaptive analysis. It is a system, and its feature is; • Continuously monitoring data flow from devices within the system and capturing timestamped data. Data monitoring unit (1) which creates the records, 5 • By analyzing the normal data generation frequency and time intervals of the devices, reference behavior is determined. Behavioral modeling module (2) which forms the model • Identifying situations where the expected data flow does not occur, thus determining data absence situations. Silence detection module (3), • Detected silence instances can be categorized as sudden interruptions, periodic interruptions, or gradual decreases. Type-dividing silence analysis and classification module (4), • Correlation analysis by evaluating silence levels from multiple devices together. Correlation and scoring module (5) which produces silence score. • Updates the model based on system outputs and generates alarms in case of anomalies. adaptive learning and notification module (6) 15 It includes.

Images