# US 10,313,212 B2 · Systems and methods for detecting and classifying anomalies in a network of moving things > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,212 B2 - Document ID: US10313212B2 - Status: Granted - Kind: B2 - Application number: 15/174,759 - Filed: 2016-06-06 - Published: 2017-03-23 - Granted: 2019-06-04 - Earliest claimed: 2015-09-22 - Assignees: Veniam, Inc. - Applicants: Veniam, Inc. - Inventors: Eduardo Mota; Rui Costa; Diogo Carreira - Web page: https://patentgrep.com/patent/US10313212B2 ## CPC - H04W 4/046 - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/062: related to network traffic - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 41/142: using statistical or mathematical methods - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for detecting and classifying anomalies in a network of moving things. As non-limiting examples, various aspects of this disclosure provide configurable and adaptable systems and methods, for example in a network of moving things, for detecting various operational anomalies, classifying such anomalies, and/or reporting such anomalies. ## Claims ### Claim 1 A vehicle communication network comprising: an Access Point (AP), wherein the AP is a Mobile AP that is operable to provide wireless LAN connectivity to client devices while the Mobile AP is moving; and an anomaly detection system comprising at least one module that comprises a processor and a memory, wherein the at least one module is operable to, based at least in part on movement of the Access Point (AP), at least: receive a metric provided by the AP; retrieve a previous report prepared by the at least one module; determine at least a first portion of a next report based, at least in part, on the received metric; determine, based at least in part on the first portion of the next report, whether to communicate the next report to a destination; and if it is determined to communicate the next report to the destination, then communicate the next report to the destination. ### Claim 2 (depends on 1) The vehicle communication network of claim 1, wherein the first portion of the next report comprises a severity classification of the next report. ### Claim 3 (depends on 2) The vehicle communication network of claim 2, wherein the at least one module is operable to determine the destination and determine a communication network address for the next report based, at least in part, on the severity classification of the next report. ### Claim 4 (depends on 2) The vehicle communication network of claim 2, wherein the at least one module is operable to determine a network over which to communicate the next report based, at least in part, on the severity classification of the next report. ### Claim 5 An anomaly detection system for a vehicle communication network that comprises a Mobile Access Point (MAP) that is operable to provide Wireless Local Area Network (WLAN) connectivity to client devices while the MAP is moving, the anomaly detection system comprising: at least one module comprising a processor and a memory, wherein the at least one module is operable to, based at least in part on movement of the MAP, at least: receive a metric provided by a node of the vehicle communication network, the metric concerning operation of the vehicle communication network during a first time period; retrieve a previous report prepared by the at least one module, the previous report concerning operation of the vehicle communication network during a second time period prior to the first time period; determine at least a first portion of a next report based, at least in part, on the received metric; determine, based at least in part on the first portion of the next report, whether to communicate the next report to a destination; and if it is determined to communicate the next report to the destination, then communicate the next report to the destination. ### Claim 6 (depends on 5) The anomaly detection system of claim 5, wherein the at least one module comprises: a task manager; and a set of tasks independently executable by the task manager. ### Claim 7 (depends on 6) The anomaly detection system of claim 6, wherein the task manager is operable to: detect a new task added to the set of tasks; and in response to the detected new task, at least: start execution of the new task; and continue execution of other tasks. ### Claim 8 (depends on 5) The anomaly detection system of claim 5, wherein the received metric comprises: a traffic level metric and/or a communication session metric. ### Claim 9 (depends on 5) The anomaly detection system of claim 5, wherein the received metric identifies the Mobile Access Point and/or a vehicle carrying the Mobile Access Point. ### Claim 10 (depends on 5) The anomaly detection system of claim 5, wherein the at least one module is operable to receive the metric by, at least in part, requesting the metric from another node of the vehicle communication network. ### Claim 11 (depends on 5) The anomaly detection system of claim 5, wherein the at least one module is operable to retrieve the previous report by, at least in part, retrieving the previous report from a local memory of the anomaly detection system. ### Claim 12 (depends on 5) The anomaly detection system of claim 5, wherein the first portion of the next report comprises a severity classification of the next report. ### Claim 13 (depends on 12) The anomaly detection system of claim 12, wherein the at least one module is operable to determine the severity classification based, at least in part, on the retrieved previous report. ### Claim 14 (depends on 13) The anomaly detection system of claim 13, wherein the at least one module is operable to: determine a threshold level based, at least in part, on the retrieved previous report; and determine the severity classification level based, at least in part, on the determined threshold level. ### Claim 15 An anomaly detection system for a vehicle communication network that comprises a Mobile Access Point (MAP) that is operable to provide Wireless Local Area Network (WLAN) connectivity to client devices while the MAP is moving, the anomaly detection system comprising: at least one module that comprises a processor and a memory, wherein the at least one module is operable to, based at least in part on movement of the MAP, at least: receive a metric provided by an access point (AP) of the vehicle communication network; retrieve a previous report prepared by the at least one module prior to receiving the metric provided by the AP; determine at least a first portion of a next report based, at least in part, on the received metric; determine, based at least in part on the first portion of the next report, whether to communicate the next report to a destination; and if it is determined to communicate the next report to the destination, then: determine one or more destinations for the next report based, at least in part, on the next report; and communicate the next report to the determined one or more destinations. ### Claim 16 (depends on 15) The anomaly detection system of claim 15, wherein: the first portion of the next report comprises a severity classification of the next report; and the at least one module is operable to determine whether to communicate the next report to a destination based, at least in part, on the severity classification of the next report. ### Claim 17 (depends on 16) The anomaly detection system of claim 16, wherein the at least one module is operable to determine whether to communicate the next report to a destination based further, at least in part, on a type of the metric. ### Claim 18 (depends on 15) The anomaly detection system of claim 15, wherein: the first portion of the next report comprises a severity classification of the next report; and the at least one module is operable to determine one or more destinations for the next report based, at least in part, on the severity classification of the next report. ### Claim 19 (depends on 18) The anomaly detection system of claim 18, wherein the at least one module is operable to determine the one or more destinations for the next report based further, at least in part, on a type of the metric. ### Claim 20 (depends on 18) The anomaly detection system of claim 18, wherein the one or more destinations comprises a plurality of destinations. ### Claim 21 (depends on 15) The anomaly detection system of claim 15, wherein the at least one module is operable to determine one or more communication networks over which to communicate the next report. ### Claim 22 (depends on 21) The anomaly detection system of claim 21, wherein: the first portion of the next report comprises a severity classification of the next report; and the at least one module is operable to determine the one or more communication networks over which to communicate the next report based, at least in part, on the severity classification of the next report. ### Claim 23 (depends on 21) The anomaly detection system of claim 21, wherein the one or more communication networks comprises a plurality of communication networks.