Anomaly Detection Engine Local Global Trend Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing devices are vulnerable to attacks due to always-on broadband internet connections, and traditional antivirus or anti-malware means struggle to detect intermittent or unpredictable misbehavior of applications, which can go undetected for extended periods.
Innovation Solution
A system and method that utilize a hardware platform with a processor and memory, including an anomaly detection engine that periodically collects telemetry data, computes local trend lines, receives global trend lines from a cloud service, and performs anomaly detection by analyzing these trend lines to identify deviations from normal behavior, leveraging machine learning classifiers like neural networks to assign device classes and detect anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus or anti-malware means are used, then security protection is provided, but intermittent or unpredictable misbehavior of applications cannot be detected timely
Solution Approach 1:
The system performs preliminary actions by continuously collecting telemetry data and computing local trend lines in advance, maintaining a baseline of normal device behavior. This allows the system to detect anomalies immediately when they occur, rather than waiting for traditional antivirus signatures or rules to be triggered.
Solution Approach 2:
The system implements feedback by comparing real-time local trend lines against historical baseline data and global trend lines from cloud services. This continuous feedback loop enables timely detection of deviations from normal behavior, allowing security threats to be identified and addressed before they cause significant harm.
2Measurement precision
If telemetry data collection and trend line analysis are performed, then anomaly detection capability is improved, but device processing overhead increases
Solution Approach 1:
The system segments the anomaly detection process into distinct components: local trend line computation on the device, cloud-based global trend line analysis, and local comparison operations. This segmentation allows each component to be optimized independently, reducing overall processing overhead while maintaining detection precision.
Solution Approach 2:
The system performs partial action by computing trend lines selectively for specific performance parameters and device states rather than continuously analyzing all possible metrics. This approach maintains adequate anomaly detection capability while reducing unnecessary processing overhead on the device.
3Measurement precision
If local and global trend lines are compared for anomaly detection, then detection accuracy is improved, but data transmission requirements increase
Solution Approach 1:
The system extracts only the essential trend line data and anomaly indicators for transmission to cloud services, rather than transmitting raw telemetry data. This extraction approach maintains detection accuracy by preserving the key patterns and deviations while significantly reducing the quantity of data that needs to be transmitted over the network.
Data Source
AI summary
There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; and an anomaly detection engine including instructions encoded within the memory to instruct the processor to: periodically collect telemetry for a performance parameter; compute and maintain a local trend line for the performance parameter; receive from a cloud service a global trend line for the performance parameter for a class of devices including the computing apparatus; and perform anomaly detection including analyzing the local trend line and the global trend line to detect an anomaly.