Anomaly Detection for IoT Devices Using Traffic Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection methods for IoT devices are inadequate in identifying anomalous behaviors effectively, as they lack a comprehensive pipeline and require specific data input approaches that are not applicable to all IoT devices, limiting their ability to guarantee connectivity and service quality.
Innovation Solution
A computer-implemented method that transforms raw signaling traffic into feature matrices, groups devices with similar traffic patterns using clustering techniques, and applies a bow-tie architecture variational autoencoder for anomaly detection, enabling the identification of deviating devices without labeled data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep learning algorithms are applied for anomaly detection, then detection capability is improved, but the complexity of the solution increases and full pipeline implementation is not provided
Solution Approach 1:
The patent segments the anomaly detection process into distinct modules: data preprocessing module, feature extraction module, clustering module, and anomaly detection module. Each module handles a specific aspect of the pipeline, making the complex deep learning solution manageable and implementable while maintaining high detection capability.
Solution Approach 2:
The patent performs preliminary actions by pre-processing raw signaling traffic data and extracting features before applying clustering and anomaly detection. This prepares the data in advance, allowing the deep learning algorithms to work more effectively while reducing the complexity of real-time processing.
2Measurement precision
If unsupervised machine learning is used for TCP level traffic analysis, then anomaly detection is achieved, but the approach cannot be applied to present invention's problem due to different data input requirements
Solution Approach 1:
The patent creates a universal data processing pipeline that can handle multiple types of signaling traffic data (GPRS, EDGE, HSPA, LTE, 5G) through the same feature extraction and clustering approach. The system is designed to be adaptable to different IoT devices and network technologies while maintaining consistent anomaly detection capabilities.
Solution Approach 2:
The patent transforms raw signaling traffic data into standardized feature representations through parameter changes in the data structure. By converting diverse input formats into a common feature space suitable for clustering analysis, the system achieves both accuracy and versatility across different data types.
3Measurement precision
If clustering is applied to group devices with similar patterns, then detection accuracy is improved, but computational requirements increase
Solution Approach 1:
The patent applies clustering to group devices with similar traffic patterns, but focuses computational resources on detecting anomalies within each cluster rather than analyzing all devices uniformly. This partial action approach improves detection accuracy for anomalous devices while reducing overall computational requirements by leveraging the normal behavior patterns established by cluster members.
Data Source
Figure 1
AI summary
A method for detecting anomalous behaviors of electronic devices is proposed. The method comprises receiving raw signaling traffic, in the form of records, generated by electronic devices; transforming the received traffic into features by encoding some fields of the records; generating a data matrix of features for each device, each row representing an encoded feature and each column representing a counter of the number of occurrences of each encoded feature; computing a signaling traffic volume metric for each device considering the number of records generated by each device during; performing a grouping process to the devices using the computed signaling traffic volume metric to allocate the devices having similar signaling traffic patterns into a same cluster, generating a set of clusters as a result; and identifying the devices having an anomalous behavior by applying an anomaly detection model to each set of clusters using the generated data matrix of features.