IoT Anomaly Detection Using Multi-Dimensional Device Grouping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for monitoring large groups of IoT devices are resource-intensive, requiring numerous assessment modules to identify abnormal behavior, which becomes impractical with large deployments.
Innovation Solution
Assigning IoT devices to a multi-dimensional space with orthogonal dimensions, where each device is monitored by a subset of assessment modules, and combining outputs to identify non-compliant devices, using one-class classification and machine learning on frame headers to analyze time series data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If one uses a conventional monitoring system with one assessment module per IoT device, then each device can be monitored individually, but the resource consumption becomes extremely high when deploying large numbers of devices
Solution Approach 1:
The patent segments the monitoring task by grouping IoT devices into clusters and assigning a single assessment module to each cluster rather than having one module per device. This segmentation approach maintains monitoring capability while significantly reducing the total number of assessment modules required, directly resolving the contradiction between monitoring accuracy and system complexity
Solution Approach 2:
Each assessment module is designed to serve multiple IoT devices within its cluster by analyzing aggregated behavioral patterns. The module performs universal monitoring functions across multiple devices, enabling one module to replace what would traditionally require many individual modules, thus reducing resource consumption while maintaining monitoring effectiveness
2Adaptability or versatility
If one increases the number of assessment modules to monitor more IoT devices, then coverage increases, but the system becomes less scalable and more resource-intensive
Solution Approach 1:
The patent introduces a hierarchical dimension to the monitoring architecture by organizing devices into clusters at multiple levels. This dimensional organization allows the system to scale by adding clusters rather than adding individual assessment modules, improving scalability while reducing per-device resource consumption through aggregated analysis
3Measurement precision
If one analyzes payload data from IoT devices to detect abnormal behavior, then detection accuracy improves, but privacy concerns arise and data security risks increase
Solution Approach 1:
The patent extracts only the necessary behavioral metadata from device communications rather than analyzing the full payload data. By taking out only the essential features needed for anomaly detection (such as communication patterns, timing, and protocol behavior) while excluding sensitive payload content, the system maintains detection accuracy while eliminating privacy risks associated with payload analysis
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Methods and apparatus automatically identify which Internet-of-Things (loT) devices within a set are behaving in a manner non-compliant to a target behaviour. Each loT device (11) is assigned to a grid point in a notional m-dimensional space. A respective assessment module (2/3) is arranged to monitor behaviour of a group (12/13) of loT devices assigned to grid points that are aligned with one another at a respective position along the respective dimension, and to produce an output indicative of non-compliant behaviour in the event that the monitoring indicates that behaviour in the group of loT devices deviates from a behavioural model (15) of the loT devices of said group. An identification module (5) identifies at least one non-compliant loT device in the set of loT devices by combining outputs from the assessment modules assigned to the different dimensions of the space. The assessment modules may use trained machine-learning algorithms embodying a model of normal behaviour of the group of devices.