IoT Traffic Sensor Model Classification for Shared Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional traffic sensors struggle to detect abnormal communication patterns common to multiple IoT devices due to variations in normal communication models, leading to delayed recognition of network-wide incidents and high rates of overdetection.
Innovation Solution
A traffic sensor calculates the spread of normal communication models, classifies them into stable and unstable models, extracts effective feature amounts, and reconstructs unstable models to facilitate detection of common abnormal communication across IoT devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the sensor learns a normal communication model for each IoT device individually, then it can detect abnormalities in single device communication, but it cannot recognize similar abnormal communication patterns occurring in multiple devices due to malware spread
Solution Approach 1:
The patent merges individual normal communication models from multiple IoT devices to create a collective abnormal communication detection capability. By combining communication patterns across devices, the system can identify malware-induced abnormal patterns that affect multiple devices, thereby resolving the contradiction between individual device monitoring and network-wide threat detection.
Solution Approach 2:
The patent creates a universal abnormal communication detection mechanism that works across multiple device types and communication patterns. The system learns device-specific normal models but applies a unified approach to detect abnormalities, enabling the same detection logic to identify malware patterns regardless of the specific IoT device involved.
2Reliability
If the sensor uses a long learning period for IoT devices with many normal communication patterns, then it can reduce overdetection, but it increases the risk of learning unauthorized communication behavior and increases machine load
Solution Approach 1:
The patent performs preliminary classification of communication patterns to identify stable vs. unstable models before full learning occurs. This preliminary action allows the system to apply different learning strategies: stable models can use shorter learning periods while unstable models receive extended learning, thereby reducing overall learning time while maintaining detection reliability.
Solution Approach 2:
The patent implements dynamic learning period adjustment based on communication pattern stability. Rather than using a fixed long learning period for all devices, the system adaptively determines learning duration based on the observed stability of each device's communication patterns, optimizing both reliability and efficiency.
3Measurement precision
If the sensor classifies normal communication models into stable and unstable models, then it can reduce overdetection and improve detection of common abnormal patterns, but it increases device complexity
Solution Approach 1:
The patent segments the set of normal communication models into two distinct categories: stable models and unstable models. This segmentation allows the system to apply different detection and learning strategies to each category, improving overall detection precision while managing complexity through organized classification rather than treating all models uniformly.
Data Source
AI summary
A traffic sensor includes processing circuitry configured to calculate a degree of spread of a range of normal communication indicated by a normal communication model for each of the normal communication model for detecting abnormal communication of an Internet of Things (IoT) device learned for each of the IoT device to be monitored, classify a normal communication model in which the degree of spread is less than a predetermined value as a normal communication model of an IoT device of a first model, and classify a normal communication model in which the degree of spread is equal to or greater than the predetermined value as a normal communication model of an IoT device of a second model, detect abnormal communication in the IoT device by using the normal communication model of the IoT device of the first model, and extract a feature amount.