# US 12,002,591 B2 · Detection of anomalous computing environment behavior using glucose > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,002,591 B2 - Document ID: US12002591B2 - Status: Granted - Kind: B2 - Application number: 17/455,277 - Filed: 2021-11-17 - Published: 2022-05-26 - Granted: 2024-06-04 - Earliest claimed: 2020-11-24 - Assignees: DexCom, Inc. - Applicants: DexCom, Inc. - Inventors: Sarah Kate Pickus; Brian Bober - Web page: https://patentgrep.com/patent/US12002591B2 ## CPC - G16H 40/63: for local operation - G16H 50/70: for mining of medical data, e.g. analysing previous cases of other patients - A61B 5/14532: {for measuring glucose, e.g. by tissue impedance measurement} - A61B 5/6801: {specially adapted to be attached to or worn on the body surface} - A61B 5/7275: {Determining trends in physiological measurement data; Predicting development of a medical condition based on physiological measurements, e.g. determining a risk factor} - A61B 5/7278: {Artificial waveform generation or derivation, e.g. synthesizing signals from measured signals} - A61B 5/742: {using visual displays (displays for heart-related electrical signals, e.g. ECG, A61B5/339)} - A61B 5/746: {Alarms related to a physiological condition, e.g. details of setting alarm thresholds or avoiding false alarms} - G16H 10/60: for patient-specific data, e.g. for electronic patient records - G16H 40/67: for remote operation - G16H 50/20: for computer-aided diagnosis, e.g. based on medical expert systems - G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA - A61B: DIAGNOSIS; SURGERY; IDENTIFICATION (usefulness limited to only animals A61D) ## Abstract Detection of anomalous computing environment behavior using glucose is described. An anomaly detection system receives glucose measurements and event records during a first time period. Missing events that are missing from the event records during the first time period are identified by processing the glucose measurements using an event engine simulator. An anomaly detection model is generated based on the missing events during the first time period. Subsequently, the anomaly detection system receives additional glucose measurements and additional event records during a second time period. Missing events that are missing from the additional event records during the second time period are identified by processing the additional glucose measurements using the event engine simulator. Anomalous behavior is detected if the identified missing events that are missing from the event records during the second time period are outside a predicted range of missing events of the anomaly detection model. ## Claims ### Claim 1 A method executed by one or more processors, the method comprising: receiving glucose measurements collected by wearable glucose monitoring devices and event records associated with the glucose measurements during a first time period and a second time period; identifying missing events that are missing from the event records during the first time period and the second time period by processing the glucose measurements using an event engine simulator; training an anomaly detection machine learning model based on the identified missing events during the first time period; predicting, using the anomaly detection machine learning model, a non-anomalous range of missing events for the second time period; determining anomalous behavior for the second time period based on the identified missing events during the second time period and the predicted non-anomalous range of missing events for the second time period; and outputting the anomalous behavior. ### Claim 2 (depends on 1) The method of claim 1, wherein identifying the missing events that are missing from the event records during the first time period and the second time period further comprises: processing the glucose measurements using the event engine simulator to generate simulated events; and comparing the simulated events to actual events in the event records during the first time period and the second time period to identify the missing events that are missing from the event records during the first time period and the second time period. ### Claim 3 (depends on 2) The method of claim 2, wherein the missing events comprise the simulated events which do not have a matching actual event in the event records during the first time period and the second time period. ### Claim 4 (depends on 1) The method of claim 1, wherein the event engine simulator comprises a replication of an event engine of a glucose monitoring application associated with the wearable glucose monitoring devices. ### Claim 5 (depends on 1) The method of claim 1, wherein the predicted non-anomalous range of missing for the second time period corresponds to a predicted range of missing events per day that is non-anomalous, and wherein detecting the anomalous behavior comprises detecting the anomalous behavior when the missing events during the second time period for a first day during the second time period are outside the predicted range of missing events per day that is non-anomalous. ### Claim 6 (depends on 5) The method of claim 5, further comprising detecting non-anomalous behavior when the missing events during the second time period for a second day during the second time period are within the predicted range of missing events per day that is non-anomalous. ### Claim 7 (depends on 1) The method of claim 1, wherein the event records include low glucose alerts generated by the wearable glucose monitoring devices during the first time period. ### Claim 8 (depends on 1) The method of claim 1, wherein the first time period precedes the second time period. ### Claim 9 (depends on 1) The method of claim 1, further comprising causing display of an anomalous behavior user interface that plots the missing events during the first time period and the second time period. ### Claim 10 (depends on 9) The method of claim 9, wherein the anomalous behavior user interface visually indicates the predicted non-anomalous range of missing events. ### Claim 11 (depends on 10) The method of claim 10, wherein the missing events that are plotted outside the predicted non-anomalous range of missing events are displayed with a visual indicator to indicate that the missing events correspond to the anomalous behavior. ### Claim 12 A computer-readable storage device comprising stored instructions that, responsive to execution by one or more processors, cause the one or more processor to perform operations comprising: receiving glucose measurements collected by wearable glucose monitoring devices and event records associated with the glucose measurements during a first time period and a second time period; identifying missing events that are missing from the event records during the first time period and the second time period by processing the glucose measurements using an event engine simulator; training an anomaly detection machine learning model based on the identified missing events during the first time period; predicting, using the anomaly detection machine learning model, a non-anomalous range of missing events for the second time period; determining anomalous behavior for the second time period based on the identified missing events during the second time period and the predicted non-anomalous range of missing events for the second time period; and outputting the anomalous behavior. ### Claim 13 (depends on 12) The computer-readable storage device of claim 12, wherein identifying the missing events that are missing from the event records during the first time period and the second time period further comprises: processing the glucose measurements using the event engine simulator to generate simulated events; and comparing the simulated events to actual events in the event records during the first time period and the second time period to identify the missing events that are missing from the event records during the first time period and the second time period. ### Claim 14 (depends on 13) The computer-readable storage device of claim 13, wherein the missing events comprise the simulated events which do not have a matching actual event in the event records during the first time period and the second time period. ### Claim 15 (depends on 12) The computer-readable storage device of claim 12, wherein the event engine simulator comprises a replication of an event engine of a glucose monitoring application associated with the wearable glucose monitoring devices. ### Claim 16 (depends on 12) The computer-readable storage device of claim 12, wherein the predicted non-anomalous range of missing events for the second time period corresponds to a predicted range of missing events per day that is non-anomalous, and wherein detecting the anomalous behavior comprises detecting the anomalous behavior when the missing events during the second time period for a first day during the second time period are outside the predicted range of missing events per day that is non-anomalous. ### Claim 17 (depends on 16) The computer-readable storage device of claim 16, wherein the operations further comprise detecting non-anomalous behavior when the missing events during the second time period for a second day during the second time period are within the predicted range of missing events per day that is non-anomalous. ### Claim 18 (depends on 12) The computer-readable storage device of claim 12, wherein the event records include low glucose alerts generated by the wearable glucose monitoring devices during the first time period. ### Claim 19 (depends on 12) The computer-readable storage device of claim 12, wherein the first time period precedes the second time period. ### Claim 20 (depends on 12) The computer-readable storage device of claim 12, wherein the operations further comprise causing display of an anomalous behavior user interface that plots the missing events during the first time period and the second time period. ### Claim 21 (depends on 20) The computer-readable storage device of claim 20, wherein the anomalous behavior user interface visually indicates the predicted non-anomalous range of missing events. ### Claim 22 (depends on 21) The computer-readable storage device of claim 21, wherein the missing events that are plotted outside the predicted non-anomalous range of missing events are displayed with a visual indicator to indicate that the missing events correspond to the anomalous behavior. ### Claim 23 A computing system comprising: one or more memories comprising executable instructions; one or more processors in data communication with the one or more memories and configured to execute the executable instructions to: receive glucose measurements collected by wearable glucose monitoring devices and event records associated with the glucose measurements during a first time period and a second time period; identify missing events that are missing from the event records during the first time period and the second time period by processing the glucose measurements using an event engine simulator; train an anomaly detection machine learning model based on the identified missing events during the first time period; predict, using the anomaly detection machine learning model, a non-anomalous range of missing events for the second time period; determine anomalous behavior for the second time period based on the identified missing events during the second time period and the predicted non-anomalous range of missing events for the second time period; and output the anomalous behavior.