One-Class Model for Anomaly Detection via Data Frequency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting abnormality or normality using static rules, such as blacklists and whitelists, lack flexibility and can misclassify data, especially in scenarios where new data similar to learned models is generated, leading to incorrect determination of normality or abnormality, particularly in systems like SCADA networks where data types and packets are limited.
Innovation Solution
A method and apparatus for generating a one-class model based on data frequency using a machine learning approach, where spatial coordinates are created, internal and external coordinates are classified based on data frequency, and a one-class model is generated by calculating similarity distances and a data accommodation radius to include external data within the model, thereby improving the flexibility and accuracy of anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a static rule-based method (blacklist/whitelist) is used for anomaly detection, then the detection process is simple and fast, but the system lacks flexibility and cannot adapt to new normal data patterns
Solution Approach 1:
The patent transforms the static whitelist into a dynamic one-class model that automatically adapts to new normal data patterns. The model is trained on normal data and continuously updated, allowing the system to adapt to evolving normal behaviors without manual intervention, thereby resolving the contradiction between adaptability and complexity.
Solution Approach 2:
The one-class model performs self-learning by automatically training on normal data and generating decision boundaries without requiring manual rule updates. This self-service capability enables the system to adapt to new patterns autonomously, improving adaptability while maintaining manageable complexity through automated processes.
2Reliability
If all normal data is registered in the whitelist, then the coverage of normal data is complete, but the rule becomes vast and difficult to manage
Solution Approach 1:
The patent replaces the manual mechanical process of whitelist management with an automated machine learning system. The one-class model automatically learns from normal data, generates decision boundaries, and performs anomaly detection, eliminating the need for manual rule creation and management while maintaining high detection accuracy.
Solution Approach 2:
The patent transforms the discrete whitelist entries into a continuous decision boundary defined by mathematical parameters (hyperplane in feature space). This parameter transformation allows the system to represent vast amounts of normal data patterns using a compact set of model parameters, improving both accuracy and manageability.
3Adaptability or versatility
If a one-class support vector machine is used to generate a learning model, then the system can adapt to new data, but it may misclassify normal data as abnormal due to frequency issues
Solution Approach 1:
The patent applies local quality by considering the frequency distribution of data at different spatial coordinates in the feature space. High-frequency coordinates (representing common normal patterns) are treated differently from low-frequency coordinates, allowing the model to maintain flexibility while improving classification accuracy by weighting local data characteristics appropriately.
Solution Approach 2:
The patent introduces frequency as an additional dimension for analyzing data coordinates. By examining data distribution across multiple frequency levels, the model can better distinguish between normal variations and actual anomalies, enhancing both flexibility and reliability through multi-dimensional analysis.
Data Source
AI summary
Provided is a method for generating a one class model based on a data frequency. The method for generating a one class model based on a data frequency includes: generating, by a machine learning apparatus, a plurality of spatial coordinates by arranging a plurality of learning data in corresponding coordinates in a feature space; classifying, by the machine learning apparatus, the plurality of spatial coordinates into a plurality of internal coordinates PI and a plurality of external coordinates PO based on a frequency of the learning data arranged in the respective spatial coordinates which belong to the plurality of spatial coordinates; and generating, by the machine learning apparatus, a one class model based on the plurality of internal coordinates PI based on mutual spatial distances of the plurality of external coordinates PO and the plurality of internal coordinates PI.