Device Anomaly Detection
AssigneeMcAfee, Inc.
InventorDavoud Maha
Life of this patent
Estimating the term…
Abstract
There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; and an anomaly detection engine including instructions encoded within the memory to instruct the processor to: periodically collect telemetry for a performance parameter; compute and maintain a local trend line for the performance parameter; receive from a cloud service a global trend line for the performance parameter for a class of devices including the computing apparatus; and perform anomaly detection including analyzing the local trend line and the global trend line to detect an anomaly.
Claims20
A computing apparatus, comprising:
- a hardware platform comprising a processor and a memory;
- and
- an anomaly detection engine comprising instructions encoded within the memory to instruct the processor to:
- periodically collect telemetry for a performance parameter;
- compute and maintain a local trend line for the performance parameter;
- receive from a cloud service a global trend line for the performance parameter for a class of devices including the computing apparatus;
- and
- perform anomaly detection comprising analyzing the local trend line and the global trend line to detect an anomaly.
One or more tangible, non-transitory computer readable storage media having stored thereon executable instructions to instruct a processor to:
- receive from a cloud service a class assignment;
- periodically collect local telemetry of data relevant to the class assignment;
- compute a local trend from the local telemetry;
- receive a global trend, based on global data collected, from the cloud service;
- and
- perform anomaly detection based on detecting substantial deviations in the local trend or the global trend.
A cloud server, comprising:
- a hardware platform;
- a telemetry module to collect telemetry from a plurality of endpoint devices;
- a machine learning classifier to define classes according to the telemetry, associate one or more performance indicators with the classes, and assign individual endpoints to the classes;
- and
- an anomaly detector to compute global trend lines for the performance indicators on a class-wise basis.
Dependencies are inferred from the claim text.