Alert throttling

A method for an Internet-of-Things (IoT) device, the method comprising:

• storing data to be used by a processor in a memory;
• enabling network communications with a data center via a network interface;
• maintaining, by the processor, a reporting policy for reporting anomalous events to the data center, the reporting policy having a plurality of reporting rules for determining a reporting action to be taken by the processor in response to an anomalous event, each of the plurality of reporting rules being indicative of a particular reporting probability;
• monitoring, by the processor, the IoT device for a report of an occurrence of the anomalous event;
• in response to the report of the occurrence of the anomalous event, determining, by the processor, a reporting rule among the plurality of reporting rules and performing, by the processor, the reporting action according to a reporting probability indicated by the determined reporting rule, wherein the reporting action comprises logging the anomalous event when the anomalous event is not reported according to the reporting probability indicated by the determined reporting rule;
• determining, by the processor, that the data center is sufficiently aware of the anomalous event when the anomalous event is reported to the data center a number of times greater than or equal to a threshold amount;
• when the data center is sufficiently aware of the anomalous event, receiving, at the processor, an update to the reporting policy from the data center, wherein the update indicates a decreased reporting probability that is determined based on a predefined desired number of times the anomalous event is expected to be reported to the data center;
• and
• modifying, by the processor, the reporting policy in accordance with the update such that future occurrences of the anomalous event are reported to the data center based upon the decreased reporting probability.

A software product, comprising a non transitory computer-readable medium in which program instructions are stored, which instructions, when read by a central processing unit (CPU), cause the CPU to:

• maintain a reporting policy for reporting anomalous events to the data center, the reporting policy having a plurality of reporting rules for determining a reporting action to be taken by the CPU in response to an anomalous event, each of the plurality of reporting rules being indicative of a particular reporting probability;
• monitor an Internet of Things (IoT) device for a report of an occurrence of the anomalous event;
• in response to the report of the occurrence of the anomalous event, determine a reporting rule among the plurality of reporting rules and perform the reporting action according to a reporting probability indicated by the determined reporting rule, wherein the reporting action comprises logging the anomalous event when the anomalous event is not reported according to the reporting probability indicated by the determined reporting rule;
• determine that the data center is sufficiently aware of the anomalous event when the anomalous event is reported to the data center a number of times greater than or equal to a threshold amount;
• when the data center is sufficiently aware of the anomalous event, receive an update to the reporting policy from the data center, wherein the update indicates a decreased reporting probability that is determined based on a predefined desired number of times the anomalous event is expected to be reported to the data center;
• and
• modify the reporting policy in accordance with the update such that future occurrences of the anomalous event are reported to the data center based upon the decreased reporting probability.