Method and system for incremental centroid clustering
AssigneeBlackBerry Limited
InventorSteven John Henkel
Life of this patent
Estimating the term…
Abstract
A method at a computing device for anomaly detection, the method including storing, at the computing device, a full batch model for a plurality of data points, wherein each of the plurality of data points is associated with one of a plurality of clusters, and wherein the storing comprises a table for storing information about the plurality of clusters without storing the plurality of data points; receiving a new data point from a hardware sensor; determining that the new data point falls outside the full batch model, thereby detecting an anomaly; and performing an action based on the anomaly.
Claims19
A method at a computing device for anomaly detection, the method comprising:
- storing, at the computing device, a full batch model for a plurality of data points, wherein each of the plurality of data points is associated with one of a plurality of clusters, and wherein the storing comprises a table for storing information about the plurality of clusters without storing the plurality of data points;
- determining that a number of clusters exceeds a threshold;
- removing all clusters with a single data point;
- receiving a new data point from a hardware sensor;
- determining that the new data point falls outside the full batch model, thereby detecting an anomaly;
- and
- performing an action based on the anomaly.
A computing device for anomaly detection, the computing device comprising:
- a processor;
- and
- a communications subsystem, wherein the computing device is configured to:
- store a full batch model for a plurality of data points, wherein each of the plurality of data points is associated with one of a plurality of clusters, and wherein the storing comprises a table for storing information about the plurality of clusters without storing the plurality of data points;
- determine that a number of clusters exceeds a threshold;
- remove all clusters with a single data point;
- receive a new data point from a hardware sensor;
- determine that the new data point falls outside the full batch model, thereby detecting an anomaly;
- and
- perform an action based on the anomaly.
A computer storage medium for storing instruction code for anomaly detection, which, when executed by a processor on a computing device, cause the computing device to:
- store a full batch model for a plurality of data points, wherein each of the plurality of data points is associated with one of a plurality of clusters, and wherein the storing comprises a table for storing information about the plurality of clusters without storing the plurality of data points;
- receive a new data point from a hardware sensor;
- determine that a number of clusters exceeds a threshold;
- remove all clusters with a single data point;
- determine that the new data point falls outside the full batch model, thereby detecting an anomaly;
- and
- perform an action based on the anomaly.
Dependencies are inferred from the claim text.