Systems and methods for detecting and classifying anomalies in a network of moving things

• US 10,313,212 B2
• Filed: 06/06/2016
• Issued: 06/04/2019
• Est. Priority Date: 09/22/2015
• Status: Active Grant

• Current Assignee: Nexar Ltd.
• Original Assignee: Veniam Inc.
• Inventors: Mota, Eduardo, Costa, Rui, Carreira, Diogo
• Primary Examiner(s): Coby, Frantz
• Application Number:
  US15/174,759
• Publication Number:
  US 20170085449A1
• Time in Patent Office: 1,093 Days
• Field of Search: 709203, 709223, 709224, 370329, 370337, 370338
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 4/046 involving vehicles, e.g. floating traffic data [FTD] or vehicle traffic prediction

Abstract

Systems and methods for detecting and classifying anomalies in a network of moving things. As non-limiting examples, various aspects of this disclosure provide configurable and adaptable systems and methods, for example in a network of moving things, for detecting various operational anomalies, classifying such anomalies, and/or reporting such anomalies.

Claims

1. A vehicle communication network comprising:

an Access Point (AP), wherein the AP is a Mobile AP that is operable to provide wireless LAN connectivity to client devices while the Mobile AP is moving; and

an anomaly detection system comprising at least one module that comprises a processor and a memory, wherein the at least one module is operable to, based at least in part on movement of the Access Point (AP), at least;

receive a metric provided by the AP;

retrieve a previous report prepared by the at least one module;

determine at least a first portion of a next report based, at least in part, on the received metric;

determine, based at least in part on the first portion of the next report, whether to communicate the next report to a destination; and

if it is determined to communicate the next report to the destination, then communicate the next report to the destination.

2. The vehicle communication network of claim 1, wherein the first portion of the next report comprises a severity classification of the next report.

3. The vehicle communication network of claim 2, wherein the at least one module is operable to determine the destination and determine a communication network address for the next report based, at least in part, on the severity classification of the next report.

4. The vehicle communication network of claim 2, wherein the at least one module is operable to determine a network over which to communicate the next report based, at least in part, on the severity classification of the next report.

5. An anomaly detection system for a vehicle communication network that comprises a Mobile Access Point (MAP) that is operable to provide Wireless Local Area Network (WLAN) connectivity to client devices while the MAP is moving, the anomaly detection system comprising:

at least one module comprising a processor and a memory, wherein the at least one module is operable to, based at least in part on movement of the MAP, at least;

receive a metric provided by a node of the vehicle communication network, the metric concerning operation of the vehicle communication network during a first time period;

retrieve a previous report prepared by the at least one module, the previous report concerning operation of the vehicle communication network during a second time period prior to the first time period;

determine at least a first portion of a next report based, at least in part, on the received metric;

determine, based at least in part on the first portion of the next report, whether to communicate the next report to a destination; and

if it is determined to communicate the next report to the destination, then communicate the next report to the destination.

6. The anomaly detection system of claim 5, wherein the at least one module comprises:

a task manager; and

a set of tasks independently executable by the task manager.

7. The anomaly detection system of claim 6, wherein the task manager is operable to:

detect a new task added to the set of tasks; and

in response to the detected new task, at least;

start execution of the new task; and

continue execution of other tasks.

8. The anomaly detection system of claim 5, wherein the received metric comprises:

a traffic level metric and/or a communication session metric.

9. The anomaly detection system of claim 5, wherein the received metric identifies the Mobile Access Point and/or a vehicle carrying the Mobile Access Point.

10. The anomaly detection system of claim 5, wherein the at least one module is operable to receive the metric by, at least in part, requesting the metric from another node of the vehicle communication network.

11. The anomaly detection system of claim 5, wherein the at least one module is operable to retrieve the previous report by, at least in part, retrieving the previous report from a local memory of the anomaly detection system.

12. The anomaly detection system of claim 5, wherein the first portion of the next report comprises a severity classification of the next report.

13. The anomaly detection system of claim 12, wherein the at least one module is operable to determine the severity classification based, at least in part, on the retrieved previous report.

14. The anomaly detection system of claim 13, wherein the at least one module is operable to:

determine a threshold level based, at least in part, on the retrieved previous report; and

determine the severity classification level based, at least in part, on the determined threshold level.

15. An anomaly detection system for a vehicle communication network that comprises a Mobile Access Point (MAP) that is operable to provide Wireless Local Area Network (WLAN) connectivity to client devices while the MAP is moving, the anomaly detection system comprising:

at least one module that comprises a processor and a memory, wherein the at least one module is operable to, based at least in part on movement of the MAP, at least;

receive a metric provided by an access point (AP) of the vehicle communication network;

retrieve a previous report prepared by the at least one module prior to receiving the metric provided by the AP;

determine at least a first portion of a next report based, at least in part, on the received metric;

determine, based at least in part on the first portion of the next report, whether to communicate the next report to a destination; and

if it is determined to communicate the next report to the destination, then;

determine one or more destinations for the next report based, at least in part, on the next report; and

communicate the next report to the determined one or more destinations.

16. The anomaly detection system of claim 15, wherein:

the first portion of the next report comprises a severity classification of the next report; and

the at least one module is operable to determine whether to communicate the next report to a destination based, at least in part, on the severity classification of the next report.

17. The anomaly detection system of claim 16, wherein the at least one module is operable to determine whether to communicate the next report to a destination based further, at least in part, on a type of the metric.

18. The anomaly detection system of claim 15, wherein:

the first portion of the next report comprises a severity classification of the next report; and

the at least one module is operable to determine one or more destinations for the next report based, at least in part, on the severity classification of the next report.

19. The anomaly detection system of claim 18, wherein the at least one module is operable to determine the one or more destinations for the next report based further, at least in part, on a type of the metric.

20. The anomaly detection system of claim 18, wherein the one or more destinations comprises a plurality of destinations.

21. The anomaly detection system of claim 15, wherein the at least one module is operable to determine one or more communication networks over which to communicate the next report.

22. The anomaly detection system of claim 21, wherein:

the first portion of the next report comprises a severity classification of the next report; and

the at least one module is operable to determine the one or more communication networks over which to communicate the next report based, at least in part, on the severity classification of the next report.

23. The anomaly detection system of claim 21, wherein the one or more communication networks comprises a plurality of communication networks.