Anomaly Detection Model for Terminal Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for user behavior anomaly detection on terminal devices face challenges due to limited storage and computing capacity, making it difficult to effectively analyze large amounts of user behavior data and adapt to varying behavior patterns, which leads to cumbersome and resource-intensive model updates.
Innovation Solution
A method that determines and updates an anomaly score threshold based on user behavior data, using a small anomaly detection model to adapt to changing patterns, reducing computational and storage demands while maintaining effective anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional anomaly detection model is used on terminal devices, then anomaly detection capability is provided, but storage capacity and computing capacity are exceeded
Solution Approach 1:
The patent extracts only the essential anomaly detection functionality from the traditional model, implementing a lightweight version that retains core detection capabilities while removing redundant components. This allows the anomaly detection capability to be deployed on terminal devices with limited storage capacity.
Solution Approach 2:
Instead of reducing anomaly detection capability to fit existing model sizes, the patent inverts the approach by designing the model structure to inherently require minimal storage, allowing full detection capability without compromising performance for the sake of size constraints.
2Reliability
If a traditional anomaly detection model is used on terminal devices, then anomaly detection capability is provided, but computing capacity is exceeded
Solution Approach 1:
The patent extracts and removes computationally intensive operations from the traditional anomaly detection model, retaining only the essential computational functions that can be executed within the limited processing power of terminal devices while maintaining detection effectiveness.
Solution Approach 2:
The patent changes key parameters of the model including reducing the number of layers, decreasing filter counts, and optimizing activation functions to lower computational complexity. These parameter adjustments enable the model to operate within the computing capacity constraints of terminal devices.
3Adaptability or versatility
If the anomaly detection model is updated frequently to adapt to varying behavior patterns, then adaptability is improved, but resource consumption increases
Solution Approach 1:
The patent implements dynamic threshold adjustment mechanisms that allow the anomaly detection system to adapt to varying user behavior patterns without requiring frequent model updates. The thresholds are dynamically modified based on observed behavior, providing adaptability while avoiding the high resource cost of retraining the entire model.
Solution Approach 2:
Instead of updating the complete model structure, the patent changes only specific parameters such as detection thresholds and weighting factors. This selective parameter adjustment maintains adaptability to new behavior patterns while significantly reducing computational and energy resources compared to full model updates.
Data Source
AI summary
Embodiments of the present disclosure relate to a computer-implemented method, device, and computer program product. The method includes: determining, based on a set of user behavior data over a first time period, a set of behavioral features for a user behavior over the first time period. The method further includes: determining, based on the set of behavioral features, a set of anomaly scores for the user behavior according to an anomaly detection model. The anomaly detection model is trained based on user behavior data over a second time period. The method further includes: updating a previously determined anomaly score threshold based on comparison of the determined set of anomaly scores with the anomaly score threshold. The anomaly score threshold is used for indicating whether the user behavior is anomalous. By continuously updating the anomaly score threshold, the solution uses the updated anomaly score threshold for anomaly detection of user behavior.