IoT Anomaly Detection Using Coupled Normal Communication Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices enter an unsecured state during the learning period for creating abnormality detection models, and this period can be lengthy, leaving them vulnerable to undetected abnormalities.
Innovation Solution
The detection apparatus uses coupled normal communication models to initially monitor IoT devices, with additional learning based on actual communication data to refine the models, preventing the unsecured state during model learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a model is learned to detect abnormality in communication, then detection accuracy is improved, but the communication device enters an unsecured state during the learning period
Solution Approach 1:
The system performs preliminary actions by accumulating communication data and creating an initial abnormality detection model before full deployment. This preliminary model enables basic detection capabilities to be established in advance, reducing the unsecured period when the device operates without protection.
Solution Approach 2:
The abnormality detection model is designed to be dynamic and continuously learnable. The system allows the model to be updated and refined over time while maintaining its operational detection capability, transitioning from a static pre-trained model to a dynamic adaptive system that improves accuracy without complete retraining periods.
2Adaptability or versatility
If learning covers all normal communication patterns, then detection comprehensiveness is improved, but the learning period becomes lengthy
Solution Approach 1:
The system applies partial action by initially accumulating a subset of communication data representing common normal patterns, rather than requiring complete coverage of all possible patterns before deployment. The model is deployed with this partial knowledge base, and continues to learn and expand its coverage of normal patterns in the background, reducing initial learning time while maintaining eventual comprehensiveness.
Solution Approach 2:
The system performs preliminary data accumulation and model creation with a focused scope initially, then expands coverage over time. This staged approach allows the system to become operational with core detection capabilities before progressively incorporating broader communication patterns, balancing speed with comprehensiveness.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A detection apparatus (10) includes a model acquisition unit configured to acquire, from a storage unit having stored therein normal communication models for determining, for each function of a communication device, whether or not communication of the communication device having the function is normal, at least one normal communication model that corresponds to a function of a monitoring target communication device; and a detection unit configured to monitor communication of the monitoring target communication device using the acquired normal communication model, and detect an abnormality in the communication.