Identifying Anomalies in User Internet of Things Activity Profile Using Analytic Engine

• US 20200134061A1
• Filed: 10/29/2018
• Published: 04/30/2020
• Est. Priority Date: 10/29/2018
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Gaber, Shiri, Sagi, Omer, Gefen, Avitan
• Granted Patent: US 11,126,612 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: G06F 16/25 Integrating or interfacing systems involving database management systems
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/047 Pattern matching networks; Rete networks
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/308 using the Internet of Things
• CPC Class Codes: G06Q 20/321 using wearable devices
• CPC Class Codes: G06Q 20/4015 using location information

Abstract

Techniques are provided for identifying anomalies in an Internet of Things (IoT) activity profile of a user using an analytic engine. An exemplary method comprises obtaining data from a plurality of IoT devices of a user, wherein at least one IoT device comprises an agent device that performs an action on behalf of the user; applying the obtained data to a feature engineering module to convert the obtained data into time-series features that capture behavior and/or characteristics of an IoT environment of the user, and applying the time-series features to an analytic engine comprising a multi-variate anomaly detection method that learns one or more patterns in the IoT activity profile of the user for a normal state and identifies an anomaly with respect to an action performed by the agent device based on a health score indicating a deviation from the learned patterns.

Claims

1. A method, comprising:

obtaining data from a plurality of Internet of Things (IoT) devices of a user, wherein at least one of the IoT devices comprises an agent device that performs at least one action on behalf of the user,

applying, using at least one processing device, the obtained data to a feature engineering module to convert the obtained data into a plurality of time-series features that capture one or more of behavior of an IoT environment of the user and characteristics of the IoT environment of the user; and

applying, using the at least one processing device, the plurality of time-series features to an analytic engine comprising a multi-variate anomaly detection method that learns one or more patterns in an IoT activity profile of the user for a normal state and identifies an anomaly with respect to an action performed by the agent device based on a health score indicating a deviation from the learned one or more patterns.

2. The method of claim 1, wherein the step of obtaining data from the plurality of IoT devices of the user employs a plurality of device connectors for connecting to IoT devices of corresponding device types.

3. The method of claim 1, wherein the time-series features are defined based on predefined high-level information to be determined about one or more of the user and the IoT environment of the user.

4. The method of claim 1, wherein the step of applying the plurality of time-series features to the analytic engine is performed substantially close in time to the obtaining of the corresponding data.

5. The method of claim 1, further comprising the step of generating one or more new engineered features by crossing at least two of the time-series features at a substantially same point in time.

6. The method of claim 1, wherein the multi-variate anomaly detection method comprises a Gaussian Mixture Model that calculates a multi-dimensional probability distribution function describing the IoT activity profile of the user, wherein each dimension captures a pattern in a corresponding monitored feature.

7. The method of claim 6, wherein the Gaussian Mixture Model calculates, for the plurality of time-series features corresponding to a new data point, a weighted distance from a plurality of centers of the multi-dimensional probability distribution, wherein an anomaly alert is generated when the weighted distance exceeds a predefined threshold.

8. The method of claim 1, wherein the step of applying the plurality of time-series features to the analytic engine is performed by one or more applications running in a domain of the user.

9. The method of claim 1, wherein the data comes from one or more service providers that one or more of the user interacts with and at least one device of the user interacts with.

10. The method of claim 1, wherein the action performed by the agent device comprises a financial transaction performed by the agent device.

11. A system, comprising:

a memory; and

at least one processing device, coupled to the memory, operative to implement the following steps;

obtaining data from a plurality of Internet of Things (IoT) devices of a user, wherein at least one of the IoT devices comprises an agent device that performs at least one action on behalf of the user,

applying the obtained data to a feature engineering module to convert the obtained data into a plurality of time-series features that capture one or more of behavior of an IoT environment of the user and characteristics of the IoT environment of the user, and

applying the plurality of time-series features to an analytic engine comprising a multi-variate anomaly detection method that learns one or more patterns in an IoT activity profile of the user for a normal state and identifies an anomaly with respect to an action performed by the agent device based on a health score indicating a deviation from the learned one or more patterns.

12. The system of claim 11, further comprising the step of generating one or more new engineered features by crossing at least two of the time-series features at a substantially same point in time.

13. The system of claim 11, wherein the multi-variate anomaly detection method comprises a Gaussian Mixture Model that calculates a multi-dimensional probability distribution function describing the IoT activity profile of the user, wherein each dimension captures a pattern in a corresponding monitored feature.

14. The system of claim 13, wherein the Gaussian Mixture Model calculates, for the plurality of time-series features corresponding to a new data point, a weighted distance from a plurality of centers of the multi-dimensional probability distribution, wherein an anomaly alert is generated when the weighted distance exceeds a predefined threshold.

15. The system of claim 11, wherein the action performed by the agent device comprises a financial transaction performed by the agent device.

16. A computer program product, comprising a tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

obtaining data from a plurality of Internet of Things (IoT) devices of a user, wherein at least one of the IoT devices comprises an agent device that performs at least one action on behalf of the user;

applying the obtained data to a feature engineering module to convert the obtained data into a plurality of time-series features that capture one or more of behavior of an IoT environment of the user and characteristics of the IoT environment of the user, and

applying the plurality of time-series features to an analytic engine comprising a multi-variate anomaly detection method that learns one or more patterns in an IoT activity profile of the user for a normal state and identifies an anomaly with respect to an action performed by the agent device based on a health score indicating a deviation from the learned one or more patterns.

17. The computer program product of claim 16, further comprising the step of generating one or more new engineered features by crossing at least two of the time-series features at a substantially same point in time.

18. The computer program product of claim 16, wherein the multi-variate anomaly detection method comprises a Gaussian Mixture Model that calculates a multi-dimensional probability distribution function describing the IoT activity profile of the user, wherein each dimension captures a pattern in a corresponding monitored feature.

19. The computer program product of claim 18, wherein the Gaussian Mixture Model calculates, for the plurality of time-series features corresponding to a new data point, a weighted distance from a plurality of centers of the multi-dimensional probability distribution, wherein an anomaly alert is generated when the weighted distance exceeds a predefined threshold.

20. The computer program product of claim 16, wherein the action performed by the agent device comprises a financial transaction performed by the agent device.