IoT Traffic Sensor Modeling for Cross-Device Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional traffic sensors struggle to recognize similar abnormal communication patterns across multiple IoT devices due to varying learning methods, and the similarity and correlation of abnormal communication patterns in networks, and fail to detect common abnormalities in networks, and the similarity and correlation of abnormal communication patterns across networks, and the detection of these patterns is delayed or overdetection occurs, leading to missed or false alerts.
Innovation Solution
A traffic sensor that calculates the spread of normal communication models, classifies them into stable and unstable models, and extracts effective features to detect anomalies, and analyzes anomalies across networks, and reconstructs models to identify anomalies, and analyzes anomalies across networks, and outputs anomalies across networks, and analyzes anomalies across networks, and outputs alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a sensor learns a normal communication model in units of target IoT devices to detect abnormal communication, then abnormal communication of a single IoT device can be detected, but similarity and correlation of abnormal communication occurring in multiple IoT devices cannot be recognized
Solution Approach 1:
The patent merges individual communication models of multiple IoT devices into a unified network-wide communication model. By combining communication data from multiple devices and learning common patterns, the system can detect abnormal communication that occurs across multiple devices, such as coordinated malware attacks, while maintaining the ability to detect device-specific anomalies.
2Reliability
If the sensor secures a long learning time of normal communication model for IoT devices with many communication patterns, then the model becomes more accurate, but the risk of learning unauthorized communication behavior and machine load increase
Solution Approach 1:
The patent implements preliminary classification of communication patterns before full model learning. By pre-processing communication data to identify and categorize different types of communication patterns, the system can focus learning resources on relevant patterns while filtering out normal variations, thereby reducing learning time and machine load while maintaining model accuracy.
Solution Approach 2:
The patent applies different learning strategies to different types of IoT devices based on their communication characteristics. Devices with stable communication patterns use simpler models with shorter learning periods, while devices with highly variable patterns use more sophisticated models. This localized approach optimizes the balance between model accuracy and learning resource consumption.
3Measurement precision
If the sensor uses a learned normal communication model for communication abnormality detection, then abnormal communication can be detected, but overdetection of IoT devices with unstable models occurs frequently
Solution Approach 1:
The patent implements dynamic adjustment of detection thresholds and model parameters based on the stability characteristics of each IoT device's communication patterns. For devices with unstable communication patterns, the system dynamically adapts the normal communication model to accommodate legitimate variations, thereby reducing false positive detections while maintaining sensitivity to actual abnormal communication.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A sensor calculates a degree of spread of a range of normal communication for each normal communication model of an IoT device. Then, the sensor classifies a normal communication model in which a degree of spread is less than a predetermined value as a normal communication model of a stable model, and classifies a normal communication model in which a degree of spread is equal to or greater than a predetermined value as a normal communication model of an IoT device of an unstable model. Thereafter, the sensor detects abnormal communication in the IoT device by using the normal communication model of the IoT device of the stable model, and reconstructs the normal communication model of the IoT device of the unstable model by using the feature amount in which the contribution degree to the detection of the abnormal communication is equal to or greater than a predetermined value among the feature amounts used in the normal communication model. The sensor analyzes abnormal communication common to each IoT device by using abnormal communication of the IoT device of the stable model detected by using the normal communication model and abnormal communication of the IoT device of the unstable model detected by using the reconstructed normal communication model.