Anomaly Detection Device Dual Counter Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing satellite and network communication systems struggle to effectively detect short-term mild anomalies and long-term severe anomalies in application programs, leading to computing resource crowding and communication interrupts.
Innovation Solution
An anomaly detection device and method that accumulate data amounts processed by application programs and monitor operation times to detect first and second anomaly states, enabling effective detection of short-term mild and long-term severe anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If watchdog timers are used to monitor application program operation time, then system reliability is improved, but the ability to detect short-term mild anomalies deteriorates
Solution Approach 1:
The anomaly detection function is segmented into two independent counter systems: a first counter for short-term anomaly detection and a second counter for long-term anomaly detection. Each counter operates with its own counting frequency and detection threshold, allowing precise detection of different anomaly types without interfering with each other. This segmentation resolves the contradiction by enabling both high precision for short-term anomalies and system reliability through the dual-counter architecture.
Solution Approach 2:
The first counter acts as an intermediary mechanism between the traditional watchdog timer (second counter) and the anomaly detection system. It captures short-term anomalies that would otherwise be missed by the slower second counter, while the second counter maintains overall system reliability monitoring. This intermediary layer enables detection of mild short-term anomalies without compromising the reliability function of the original watchdog timer.
2Productivity
If computing resources are allocated to application programs, then system productivity is improved, but computing resource crowding occurs causing communication function failures
Solution Approach 1:
The system implements feedback monitoring through the dual-counter anomaly detection mechanism. When anomalies are detected (either short-term by the first counter or long-term by the second counter), the system can trigger resource reallocation or application termination. This feedback loop prevents computing resource crowding from causing communication function failures, while still allowing high productivity through efficient resource allocation to non-communication applications.
3Productivity
If data processing speed is increased to improve throughput, then productivity is improved, but anomaly detection capability deteriorates
Solution Approach 1:
The system uses periodic sampling with two different counting frequencies: a first higher counting frequency for the first counter to detect short-term anomalies, and a second lower counting frequency for the second counter for long-term anomalies. This periodic action with multiple frequencies allows the system to maintain high data throughput while effectively detecting anomalies at different time scales, resolving the contradiction between processing speed and detection capability.
Data Source
AI summary
An anomaly detection device, used to detect a first anomaly state and a second anomaly state of an application program, which includes the following elements. A data amount accumulating unit, for accumulating a first data amount processed by the application program. An operating time counter, for accumulating a first count value according to a first counting frequency. An anomaly state counter, for selectively accumulating a second count value according to the first anomaly state. A monitoring unit, for monitoring whether the first data amount reaches a predefined data amount. When the first data amount reaches the predefined data amount, determining whether the application program is in the first abnormal state according to the first count value. When the application program is in the first anomaly state, accumulating the second count value and determining the application program as in the second abnormal state according to the second count value.