IoT/OT Network Device Anomaly Detection with Convolutional Autoencoders
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting anomalies in IoT and OT devices using time series data are inefficient and impractical for real-time analysis, especially for newly deployed devices, due to the need for extensive historical data and lack of scalability in traditional SQL databases.
Innovation Solution
A method utilizing a Convolutional Autoencoder with overlapping sliding time windows and local scaling for time series data, allowing for real-time anomaly detection by analyzing reconstructed time series values through a 10-layer deep model with predefined thresholds, capable of identifying anomalous behaviors in IoT and OT devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional SQL databases are used to store and analyze time series data from IoT and OT devices, then data storage and analysis can be performed, but the system cannot scale efficiently and real-time detection becomes impractical
Solution Approach 1:
The patent replaces traditional SQL database systems with a specialized time series database architecture that is optimized for storing and querying temporal data. This substitution enables efficient handling of massive amounts of time series data from IoT and OT devices, allowing real-time anomaly detection without the scalability limitations of traditional databases.
Solution Approach 2:
The patent changes the fundamental parameters of the data storage system by implementing a time series database with optimized data structures for temporal data. This includes changing how data is stored, indexed, and retrieved, enabling the system to handle high-volume time series data efficiently and support real-time analytics.
2Measurement precision
If extensive historical data is collected before deploying anomaly detection for newly deployed devices, then detection accuracy can be improved, but the activation time increases from ~15 hours to 22 days
Solution Approach 1:
The patent performs preliminary actions by pre-configuring the anomaly detection system with baseline models and detection algorithms before devices are deployed. This allows the system to start detecting anomalies almost immediately upon deployment, eliminating the need to wait for extensive historical data accumulation while maintaining detection accuracy.
Solution Approach 2:
The patent implements a dynamic anomaly detection system that can adapt its parameters and thresholds based on incoming data in real-time. This dynamic approach allows the system to achieve accurate anomaly detection with minimal historical data, as the system continuously learns and adjusts rather than requiring a fixed, extensive training period.
3Adaptability or versatility
If a simple two-phase anomaly detection approach is used with learned items, then the method can be adapted to any network without previous knowledge, but it is not well-suitable for networks with increasing numbers of IoT and OT devices
Solution Approach 1:
The patent segments the anomaly detection approach by implementing device-specific detection models that analyze time series data from individual IoT and OT devices. This segmentation allows the system to handle the unique characteristics of each device type while maintaining overall system-wide anomaly detection capability, making it suitable for heterogeneous IoT and OT networks.
Solution Approach 2:
The patent introduces an intermediary layer that translates diverse device protocols and data formats into a unified time series representation. This intermediary processing layer enables the anomaly detection system to handle various IoT and OT device types without requiring device-specific configuration, maintaining adaptability while improving detection efficiency.
Data Source
AI summary
The present invention relates to a method for detecting anomalies in time series data produced by devices of an infrastructure in a network comprising, for each of the devices through computerized data processing means, retrieving a time series data for the device in the network, extracting a plurality of time series samples relating to respective time windows and having a predefined window size and a predefined stride, by sliding the time windows to overlap the time series data, supplying the time series samples as input to a Convolutional Autoencoder to define reconstructed time series values having a predefined percentile intervals, analysing the reconstructed time series values to identify anomalous behaviours of the time series data, signalling an anomaly of the device when at least one anomalous behaviour is identified.