IoT Anomaly Detection via Feature Engineering and Gaussian Mixture Models

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

The proliferation of IoT devices acting as agents for human users necessitates efficient anomaly detection in their transactions to prevent financial harm and fraud, especially in decentralized and anonymous networks where real-time monitoring is impractical.

Innovation Solution

A method involving a feature engineering module that converts IoT data into time-series features, applied to a multi-variate anomaly detection method like the Gaussian Mixture Model to identify deviations from normal patterns and generate health scores for anomaly alerts, enabling holistic monitoring of IoT activity profiles.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If users individually authorize each transaction performed by IoT devices, then transaction security is improved, but user burden and time consumption increase significantly

Engineering Contradiction:
Improvetransaction securityVSAvoiduser time consumption
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system enables self-service by implementing automated anomaly detection that monitors IoT device transactions without requiring user intervention. The multi-variate anomaly detection method automatically analyzes transaction patterns, identifies deviations from normal behavior, and generates alerts only when anomalies are detected, allowing the system to serve itself rather than requiring users to authorize each transaction manually.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system implements feedback mechanisms by continuously monitoring IoT device transactions and providing real-time anomaly detection results. The multi-variate anomaly detection method analyzes transaction data streams and feeds back alerts to users only when suspicious patterns are identified, creating an efficient feedback loop that maintains security while minimizing user burden.

Inventive Principle:
Principle #23Feedback

2Measurement precision

If real-time monitoring of all IoT transactions is implemented, then anomaly detection capability is improved, but system complexity and computational resources increase

Engineering Contradiction:
Improveanomaly detection capabilityVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The system applies parameter changes by transforming raw transaction data into multiple engineered features that capture different aspects of device behavior. The feature engineering module creates time-series features, statistical features, and behavioral patterns from raw data, then applies multi-variate anomaly detection methods that analyze these transformed parameters rather than raw transactions, improving detection capability while managing complexity.

Inventive Principle:
Principle #35Parameter changes

Solution Approach 2:

The system segments the anomaly detection process into distinct modules: data collection, feature engineering, multi-variate anomaly detection, and alert generation. This segmentation allows each component to specialize in specific tasks, with the feature engineering module preparing data and the anomaly detection module analyzing patterns, thereby reducing overall system complexity while maintaining high detection precision.

Inventive Principle:
Principle #1Segmentation

3Measurement precision

If feature engineering is applied to convert raw IoT data into time-series features, then anomaly detection accuracy is improved, but data processing time and computational load increase

Engineering Contradiction:
Improveanomaly detection accuracyVSAvoiddata processing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system applies preliminary action by pre-computing and storing engineered features from historical IoT device data. The feature engineering module creates time-series features, statistical summaries, and behavioral patterns in advance, so that during anomaly detection, the system can quickly query pre-processed features rather than computing them in real-time, improving detection accuracy while reducing processing time.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS11126612B2Identifying anomalies in user internet of things activity profile using analytic engine
Publication Date: 2021.09.21 EMC IP HLDG CO LLC
  • US11126612B2 patent drawing
  • US11126612B2 patent drawing
  • US11126612B2 patent drawing

AI summary

Techniques are provided for identifying anomalies in an Internet of Things (IoT) activity profile of a user using an analytic engine. An exemplary method comprises obtaining data from a plurality of IoT devices of a user, wherein at least one IoT device comprises an agent device that performs an action on behalf of the user; applying the obtained data to a feature engineering module to convert the obtained data into time-series features that capture behavior and/or characteristics of an IoT environment of the user; and applying the time-series features to an analytic engine comprising a multi-variate anomaly detection method that learns one or more patterns in the IoT activity profile of the user for a normal state and identifies an anomaly with respect to an action performed by the agent device based on a health score indicating a deviation from the learned patterns.