Kernel Herding Representative Point Extraction for IoT Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anomaly detection systems for IoT devices face challenges in ascertaining normal communication features due to the diverse nature of IoT device communications, which involves various protocols and characteristics, making it difficult to determine traffic feature amount tendencies through statistical processing alone.
Innovation Solution
The use of kernel herding as a method to extract representative points from traffic feature amounts for learning, allowing the system to provide data for ascertaining the tendency of these features, and when combined with a generative model like VAE, helps in understanding what kind of communication is considered normal by the model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If statistical processing such as average value or median value calculation is performed on traffic feature amounts, then processing simplicity is improved, but the ability to ascertain communication tendencies deteriorates due to the diverse nature of IoT device communications
Solution Approach 1:
The patent introduces an intermediary component (tendency ascertaining unit) that processes traffic feature amounts to extract meaningful communication tendencies. This intermediary transforms raw diverse traffic data into structured tendency information that can be used by the anomaly detection system, resolving the contradiction between processing simplicity and information preservation.
2Adaptability or versatility
If the anomaly detection system detects anomalies without knowing all malignant conditions, then detection coverage is improved, but the ability to understand detection reasons deteriorates
Solution Approach 1:
The patent implements a feedback mechanism where the tendency ascertaining unit provides contextual information about normal communication patterns back to the anomaly detection system. This feedback loop enables the system to not only detect anomalies but also understand the reasons for detection by comparing detected traffic against established communication tendencies.
3Reliability
If generative models like VAE are used to learn normal communication patterns, then anomaly detection capability is improved, but the complexity of ascertaining what constitutes normal communication deteriorates
Solution Approach 1:
The patent extracts interpretable tendency information from the complex generative model outputs through the tendency ascertaining unit. This extraction process separates the black-box model predictions from the meaningful communication patterns, allowing operators to understand what constitutes normal communication without being overwhelmed by model complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A learning device (10) includes an acquisition unit (131) that acquires pieces of communication data for learning, a feature amount extraction unit (132) that extracts feature amounts of the communication data, a training unit (1331) that trains a VAE model (121) with the feature amounts of the communication data, a representative point extraction unit (1332) that extracts representative points of the feature amounts of the communication data using kernel herding, and an output unit that outputs the representative points extracted by the representative point extraction unit (1332).