Instrumentation Layer for Offline Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection techniques for applications on computing systems, particularly mobile devices, are impractical due to requirements for code changes, security expertise, and server connectivity, making them inefficient for detecting and addressing anomalies in real-time, especially when devices are disconnected from the network.
Innovation Solution
An anomaly detection mechanism that uses an instrumentation layer to intercept application activities, compares them with policies in a configuration file, and takes corrective actions without requiring code changes or server connectivity, allowing for dynamic updates and offline operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection techniques are used, then anomaly detection capability is provided, but code changes and security expertise are required making them impractical
Solution Approach 1:
The patent introduces an instrumentation layer as an intermediary component between the application and operating system. This layer contains the anomaly detection logic and policy configuration files, allowing anomaly detection to function without modifying the application code itself. The instrumentation layer acts as a mediator that intercepts application activities and performs detection independently, thus maintaining reliability while improving ease of operation.
Solution Approach 2:
The patent segments the anomaly detection system into distinct components: the instrumentation layer, policy configuration files, and application code. By separating the detection mechanism from the application, the system achieves reliability through specialized detection logic while improving ease of operation since each component can be developed, deployed, and updated independently without requiring changes to the application itself.
2Reliability
If server-based anomaly detection is used, then centralized analysis is achieved, but network connectivity is required increasing power consumption and reducing real-time response
Solution Approach 1:
The patent enables the mobile device to perform anomaly detection locally through the instrumentation layer, allowing it to serve itself rather than relying on external server infrastructure. This self-service capability eliminates the need for continuous network connectivity, thereby reducing power consumption while maintaining real-time anomaly detection and corrective action capabilities.
Solution Approach 2:
The patent transitions the anomaly detection architecture from a single dimension (server-based centralized analysis requiring network connectivity) to another dimension (device-based distributed detection operating independently). This dimensional shift allows the system to achieve both centralized analysis capability through periodic server synchronization and reduced power consumption through local offline operation.
3Reliability
If server-based anomaly detection is used, then centralized analysis is achieved, but real-time corrective action is delayed due to network dependencies
Solution Approach 1:
The patent implements preliminary action by enabling the instrumentation layer to detect anomalies and execute corrective actions locally in real-time without waiting for server analysis. The device performs detection and response actions immediately, and only synchronizes findings with the server afterward. This approach maintains centralized analysis capability through periodic server updates while eliminating response time delays associated with network connectivity.
4Ease of operation
If instrumentation layer is introduced, then anomaly detection is enabled without code changes, but device complexity increases
Solution Approach 1:
The patent designs the instrumentation layer with universality by making it compatible with multiple applications and operating system versions. The layer provides multi-functional capabilities including activity interception, policy configuration management, anomaly detection, and corrective action execution. This universal design approach enables anomaly detection across diverse applications without requiring separate implementations, thereby improving ease of operation while managing device complexity through standardized interfaces and protocols.
Data Source
AI summary
An example includes intercepting one or more activities performed by an application on a computing device. The intercepting uses an instrumentation layer separating the application from an operating system on the computing device. The one or more activities are compared with one or more anomaly detection policies in a policy configuration file to detect or not detect presence of one or more anomalies. In response to the comparison detecting presence of one or more anomalies, indication(s) of the one or more anomalies are stored. Another example includes receiving indication(s) of anomaly(ies) experienced by an application on computing device(s) and analyzing the indication(s) of the anomaly(ies) to determine whether corrective action(s) should be issued. Responsive to a determination corrective action(s) should be issued based on the analyzing, the corrective action(s) are issued to the computing device(s). Methods, program products, and apparatus are disclosed.