Incremental Centroid Clustering for Edge Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning algorithms for anomaly detection in IoT devices require significant processing and memory resources, making them impractical for edge devices due to storage and processing limitations, and cloud-based solutions face high communication costs and latency issues.
Innovation Solution
An incremental centroid clustering method that stores only cluster information, allowing for efficient anomaly detection on edge devices by incrementally adding data points to existing clusters, reducing storage and processing requirements, and eliminating the need for cloud connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional machine learning algorithms (One Class SVM, Random Forest) are used for anomaly detection, then detection accuracy is improved, but processing and memory requirements increase significantly making them impractical for edge devices
Solution Approach 1:
The patent extracts only the essential cluster centroid information from the full dataset, storing merely the computed centroids and their associated metadata rather than the complete data points. This extraction principle reduces memory requirements from storing all training data to storing only the condensed cluster representations, enabling deployment on edge devices with limited memory while preserving anomaly detection capability.
Solution Approach 2:
The patent transforms the anomaly detection approach by changing the parameter representation from storing raw data points to storing computed cluster centroids with their distance metrics. This parameter transformation allows the system to operate with reduced memory footprint while maintaining the ability to detect anomalies through distance-based classification against the stored centroids.
2Measurement precision
If traditional machine learning algorithms are used for anomaly detection, then detection accuracy is improved, but processing overhead increases making them impractical for resource-constrained edge devices
Solution Approach 1:
The patent extracts and pre-computes the essential anomaly detection parameters (cluster centroids and their metrics) during an offline training phase, removing the computationally intensive iterative learning process from the edge device. This extraction of computational burden to an offline phase significantly reduces the processing overhead and energy consumption required during runtime on resource-constrained edge devices.
Solution Approach 2:
The patent performs the computationally intensive clustering and centroid computation as a preliminary action during an offline training phase before deployment. By completing the heavy processing work beforehand and only storing the results, the system minimizes runtime processing requirements and energy consumption on edge devices while maintaining detection accuracy.
3Power
If cloud-based anomaly detection solutions are used, then processing power is sufficient, but communication costs and latency increase
Solution Approach 1:
The patent extracts the anomaly detection model (cluster centroids) from the cloud environment and embeds it directly on the edge device. This extraction enables the system to perform local inference without continuous cloud communication, eliminating communication latency for real-time anomaly detection while maintaining sufficient processing capability on the edge device.
Solution Approach 2:
The patent enables the edge device to self-perform anomaly detection using the locally stored cluster centroids, making the system independent of cloud connectivity for inference operations. This self-service capability allows real-time local anomaly detection without communication delays, while the device can periodically update its model from the cloud when needed.
Data Source
AI summary
A method at a computing device for anomaly detection, the method including storing, at the computing device, a full batch model for a plurality of data points, wherein each of the plurality of data points is associated with one of a plurality of clusters, and wherein the storing comprises a table for storing information about the plurality of clusters without storing the plurality of data points; receiving a new data point from a hardware sensor; determining that the new data point falls outside the full batch model, thereby detecting an anomaly; and performing an action based on the anomaly.