Anomaly detection at edge devices
AssigneeVicOne Corporation
InventorsShih-Han Hsu, Yen-Kai Wang, Yi-Ting Chen
Life of this patent
Estimating the term…
Abstract
An edge device extracts a data segment of monitoring data and generates a summary of the data segment. The summary is classified using a generative artificial intelligence (AI) model. The classification is validated based on similarity of the summary to previous summaries that have the same classification as the summary. The summary and the previous summaries are stored as event data in an event database. Event data in the event database are marked for upload to a backend system as feedback data, which is used to update the generative AI model.
Claims12
A method of detecting intrusions at an edge device of a computer network, the method to be performed by the edge device and comprising:
- collecting monitoring data of the computer network;
- extracting a data segment of the monitoring data;
- generating a summary of the data segment;
- in a first intrusion detection operation, classifying the summary using a generative artificial intelligence (AI) model into one of a plurality of classifications that include at least an intrusion event and a normal event;
- retrieving, from a database of summaries, a set of summaries that have been classified as intrusion events;
- in a second intrusion detection operation, in response to the summary being classified by the generative AI model as an intrusion event, determining similarity of the summary to the set of summaries;
- detecting an intrusion at the edge device in response to the summary being similar to one or more summaries of the set of summaries;
- and
- raising an alert responsive to detecting the intrusion,
- wherein the edge device is an electronic control unit (ECU) of a connected vehicle and the computer network is a controller area network (CAN).
A system for detecting intrusions at edge devices, the system comprising:
- a backend system comprising at least one processor and a memory, the memory of the backend system storing instructions that when executed by the at least one processor cause the backend system to:
- train a generative artificial intelligence (AI) model using a training dataset of normal events and intrusion events;
- and
- provide an update to the generative AI model to the edge device;
- and
- the edge device comprising at least one processor and a memory, the memory of the edge device storing instructions that when executed by the at least one processor of the edge device cause the edge device to:
- collect monitoring data of a computer network;
- generate a summary of the monitoring data;
- in a first intrusion detection operation, classify the summary using the generative AI model into one of a plurality of classifications that include at least an intrusion event and a normal event;
- in a second intrusion detection operation, in response to the summary being classified by the generative AI model as an intrusion event, validate the classification of the summary based on similarity of the summary to previous summaries that have a same classification as the summary;
- and
- detect an intrusion at the edge device in response to the classification of the summary as an intrusion event and the summary is similar to one or more of the previous summaries that have been classified as intrusion events,
- wherein the edge device is an electronic control unit (ECU) of a connected vehicle, and
- wherein the computer network is a controller area network (CAN) of the connected vehicle, and the monitoring data comprises CAN bus data.
Dependencies are inferred from the claim text.