Distributed Learning Machine for Anomaly Detection in Low Power Lossy Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low Power and Lossy Networks (LLNs) face challenges in routing, Quality of Service (QoS), security, network management, and traffic engineering due to their complex nature, which existing technologies struggle to address effectively, especially with the large number of nodes and limited resources, making it difficult to implement efficient network monitoring and anomaly detection.
Innovation Solution
A distributed Learning Machine (LM) architecture is deployed on Field Area Routers (FARs) to build a regression function using network properties and performance metrics, employing a modified Variational Bayes Least Squares (VBLS) algorithm for feature selection and anomaly detection, reducing the need for centralized data processing and minimizing control plane traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If centralized data processing is used for network anomaly detection, then detection accuracy is improved, but control plane traffic increases and processing overhead becomes unmanageable in large-scale LLNs
Solution Approach 1:
The patent divides the centralized anomaly detection system into distributed learning machines deployed at individual routers. Each router independently processes local network data to detect anomalies, eliminating the need to aggregate all data to a central point. This segmentation reduces control plane traffic while maintaining detection capability at the edge of the network.
Solution Approach 2:
The patent transforms the anomaly detection problem from centralized statistical analysis to distributed machine learning inference. By pre-training models centrally and then deploying them distributedly, the system moves from one-dimensional centralized processing to multi-dimensional distributed processing across the network fabric, reducing traffic overhead.
2Measurement precision
If more network parameters are monitored to improve anomaly detection capability, then detection accuracy is improved, but processing complexity and resource requirements increase
Solution Approach 1:
The patent performs feature selection and model training in advance during an offline phase. The learning machine pre-identifies which network parameters are most relevant for anomaly detection and pre-computes the detection models. During online operation, only the pre-selected features need to be monitored, significantly reducing real-time processing complexity while maintaining high detection accuracy.
Solution Approach 2:
The patent extracts and selects only the most relevant network parameters for anomaly detection using the learning machine's feature selection capability. Instead of processing all available network data, the system identifies and monitors only the critical features that contribute most to anomaly detection, reducing processing complexity while preserving detection effectiveness.
3Reliability
If traditional routing protocols are used in LLNs, then protocol compatibility is maintained, but energy consumption increases and network efficiency decreases
Solution Approach 1:
The patent implements distributed learning machines at each router that enable the network to self-monitor and self-diagnose anomalies. Each router independently performs anomaly detection on its local traffic using pre-trained models, eliminating the need for extensive inter-router communication and centralized analysis. This self-service approach reduces control plane traffic and energy consumption while maintaining protocol compatibility.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, techniques are shown and described relating to learning machine based detection of abnormal network performance. In particular, in one embodiment, a border router receives a set of network properties x; and network performance metrics M; from a network management server (NMS), and then intercepts x; and M; transmitted from nodes in a computer network of the border router. As such, the border router may then build a regression function F based on x; and Mi, and can detect one or more anomalies in the intercepted x; and M; based on the regression function F. In another embodiment, the NMS, which instructed the border router, receives the detected anomalies from the border router.