SYSTEMS AND METHODS FOR DETECTING AND CLASSIFYING ANOMALIES IN A NETWORK OF MOVING THINGS

• US 20170085449A1
• Filed: 06/06/2016
• Published: 03/23/2017
• Est. Priority Date: 09/22/2015
• Status: Active Grant

• Current Assignee: Nexar Ltd.
• Original Assignee: Veniam Inc.
• Inventors: Mota, Eduardo, Costa, Rui, Carreira, Diogo
• Granted Patent: US 10,313,212 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 4/046 involving vehicles, e.g. floating traffic data [FTD] or vehicle traffic prediction

Abstract

Systems and methods for detecting and classifying anomalies in a network of moving things. As non-limiting examples, various aspects of this disclosure provide configurable and adaptable systems and methods, for example in a network of moving things, for detecting various operational anomalies, classifying such anomalies, and/or reporting such anomalies.

Claims

1. A vehicle communication network comprising:

an Access Point (AP); and

an anomaly detection system comprising at least one module operable to, at least;

receive a metric provided by the AP;

retrieve a previous report prepared by the at least one module;

determine at least a first portion of a next report based, at least in part, on the received metric;

determine, based at least in part on the first portion of the next report, whether to communicate the next report to a destination; and

if it is determined to communicate the next report to the destination, then communicate the next report to the destination.

2. The vehicle communication network of claim 1, wherein the AP is a Mobile AP.

3. The vehicle communication network of claim 1, wherein the first portion of the next report comprises a severity classification of the next report.

4. The vehicle communication network of claim 3, wherein the at least one module is operable to determine the destination for the next report based, at least in part, on the severity classification of the next report.

5. The vehicle communication network of claim 3, wherein the at least one module is operable to determine a network over which to communicate the next report based, at least in part, on the severity classification of the next report.

6. An anomaly detection system for a vehicle communication network, the anomaly detection system comprising:

at least one module operable to, at least;

receive a metric provided by a node of the vehicle communication network;

retrieve a previous report prepared by the at least one module;

determine at least a first portion of a next report based, at least in part, on the received metric;

determine, based at least in part on the first portion of the next report, whether to communicate the next report to a destination; and

if it is determined to communicate the next report to the destination, then communicate the next report to the destination.

7. The anomaly detection system of claim 6, wherein the at least one module comprises:

a task manager; and

a set of tasks independently executable by the task manager.

8. The anomaly detection system of claim 7, wherein the task manager is operable to:

detect a new task; and

in response to the detected new task, at least;

start execution of the new task; and

continue execution of other tasks.

9. The anomaly detection system of claim 6, wherein the retrieved metric comprises:

a traffic level metric and/or a communication session metric.

10. The anomaly detection system of claim 6, wherein the retrieved metric identifies a Mobile Access Point and/or a vehicle.

11. The anomaly detection system of claim 6, wherein the at least one module is operable to receive the metric by, at least in part, requesting the metric from another node of the vehicle communication network.

12. The anomaly detection system of claim 6, wherein the at least one module is operable to retrieve the previous report by, at least in part, retrieving the previous report from a local memory of the anomaly detection system.

13. The anomaly detection system of claim 6, wherein the first portion of the next report comprises a severity classification of the next report.

14. The anomaly detection system of claim 13, wherein the at least one module is operable to determine the severity classification based, at least in part, on the retrieved previous report.

15. The anomaly detection system of claim 14, wherein the at least one module is operable to:

determine a threshold level based, at least in part, on the retrieved previous report; and

determine the severity classification level based, at least in part, on the determined threshold level.

16. An anomaly detection system for a vehicle communication network, the anomaly detection system comprising:

at least one module operable to, at least;

receive a metric provided by an access point (AP) of the vehicle communication network;

retrieve a previous report prepared by the at least one module;

determine at least a first portion of a next report based, at least in part, on the received metric;

determine, based at least in part on the first portion of the next report, whether to communicate the next report to a destination; and

if it is determined to communicate the next report to the destination, then;

determine one or more destinations for the next report based, at least in part, on the next report; and

communicate the next report to the determined one or more destinations.

17. The anomaly detection system of claim 16, wherein:

the first portion of the next report comprises a severity classification of the next report; and

the at least one module is operable to determine whether to communicate the next report to a destination based, at least in part, on the severity classification of the next report.

18. The anomaly detection system of claim 17, wherein the at least one module is operable to determine whether to communicate the next report to a destination based further, at least in part, on a type of the metric.

19. The anomaly detection system of claim 16, wherein:

the first portion of the next report comprises a severity classification of the next report; and

the at least one module is operable to determine one or more destinations for the next report based, at least in part, on the severity classification of the next report.

20. The anomaly detection system of claim 19, wherein the at least one module is operable to determine the one or more destinations for the next report based further, at least in part, on a type of the metric.

21. The anomaly detection system of claim 19, wherein the one or more destinations comprises a plurality of destinations.

22. The anomaly detection system of claim 16, wherein the at least one module is operable to determine one or more communication networks over which to communicate the next report.

23. The anomaly detection system of claim 22, wherein:

the first portion of the next report comprises a severity classification of the next report; and

the at least one module is operable to determine the one or more communication networks over which to communicate the next report based, at least in part, on the severity classification of the next report.

24. The anomaly detection system of claim 22, wherein the one or more communication networks comprises a plurality of communication networks.