Proactive IoT Anomaly Detection via Signaling Traffic Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection in IoT roaming is reactive, limiting the effectiveness of communication availability and reliability in global IoT managed connectivity services, as operation teams only address severe incidents after service compromise.
Innovation Solution
A proactive anomaly detection system using unsupervised clustering and machine learning algorithms on signaling traffic data to identify anomalies before they become critical, employing methods like PCA-GMM, Tukey fences, VAE, and Isolation Forest to analyze IoT devices' behavior across multiple vertical applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If reactive anomaly detection is used, then operational simplicity is maintained, but service reliability deteriorates as incidents are only addressed after service compromise
Solution Approach 1:
The system performs preliminary clustering of IoT devices based on signaling traffic patterns before anomaly detection. This segmentation allows the system to establish baseline behaviors in advance, enabling proactive identification of anomalies before they become critical incidents, thus improving service reliability without requiring complex reactive responses
Solution Approach 2:
The anomaly detection system is segmented into multiple components: clustering module that groups devices by behavior patterns, anomaly detection module that identifies deviations within clusters, and ranking module that prioritizes anomalies. This segmentation reduces overall system complexity by breaking down the monolithic reactive system into manageable modular components
2Measurement precision
If clustering is applied to IoT devices, then detection accuracy improves, but computational complexity increases
Solution Approach 1:
The system applies local quality by performing anomaly detection separately within each cluster rather than analyzing all devices uniformly. This allows the detection algorithm to focus on local deviations from cluster-specific baselines, improving detection accuracy for devices with similar behaviors while reducing computational complexity compared to analyzing the entire dataset as a single group
3Reliability
If proactive anomaly detection is implemented, then service availability improves, but system complexity increases
Solution Approach 1:
The system implements self-service by automatically clustering devices based on their signaling traffic patterns without requiring manual configuration or expert knowledge. The clustering and anomaly detection processes operate autonomously, enabling proactive detection that improves communication availability while keeping operational complexity low through automation
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, system, and computer programs for proactive anomaly detection of IoT devices in global roaming are proposed. The method comprises: receiving/accessing a dataset including control signaling traffic information of a variety of IoT devices operating worldwide, the dataset including SCCP data; for each IoT device, characterizing its overall behavior by extracting several statistical features from the control signaling traffic information; clustering the IoT devices with similar signaling traffic volume using an unsupervised clustering approach on the extracted statistical features, providing different clusters as a result; and generating a list of anomalous IoT devices by applying an anomaly detection strategy to each cluster. The anomaly detection strategy applies two or more machine learning algorithms on data of each IoT device; compares results obtained by each algorithm; establishes a learned baseline behavior using a result of said comparison; computes an anomaly score for each IoT device; and ranks the IoT devices using the anomaly score.