# US 2026/0087136 A1 · Method and system for incremental centroid clustering

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0087136 A1
- Document ID: US20260087136A1
- Status: Published application
- Kind: A1
- Application number: 19/401,095
- Filed: 2025-11-25
- Published: 2026-03-26
- Earliest claimed: 2022-12-16
- Assignees: BlackBerry Limited
- Applicants: BlackBerry Limited
- Inventors: Steven John Henkel
- Web page: https://patentgrep.com/patent/US20260087136A1

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06N 20/00: Machine learning
- G06F 16/285: {Clustering or classification}
- G06F 2221/034: Test or assess a computer or a system
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A method at a computing device for anomaly detection, the method including storing, at the computing device, a full batch model for a plurality of data points, wherein each of the plurality of data points is associated with one of a plurality of clusters, and wherein the storing comprises a table for storing information about the plurality of clusters without storing the plurality of data points; receiving a new data point from a hardware sensor; determining that the new data point falls outside the full batch model, thereby detecting an anomaly; and performing an action based on the anomaly.

## Claims

### Claim 1

A method at a computing device for anomaly detection, the method comprising:
storing, at the computing device, a full batch model for a plurality of data points, wherein each of the plurality of data points is associated with one of a plurality of clusters, and wherein the storing comprises a table for storing information about the plurality of clusters without storing the plurality of data points;
determining that a number of clusters exceeds a threshold;
removing all clusters with a single data point;
receiving a new data point from a hardware sensor;
determining that the new data point falls outside the full batch model, thereby detecting an anomaly; and
performing an action based on the anomaly.

### Claim 2 (depends on 1)

The method of claim 1, wherein the computing device creates the full batch model by:
selecting a data point;
determining that the data point falls within a threshold an average distance to a center of a cluster;
adding the data point to the cluster; and
iteratively performing the determining and adding for subsequent data points in a data point training set.

### Claim 3 (depends on 2)

The method of claim 2, wherein the adding the data point to the cluster comprises:
incrementing an index indicating a number of data points within the cluster;
adding information for the data point to a sum of features for the cluster;
updating a centroid of the cluster; and
updating a value comprising an approximate distance between points in the cluster.

### Claim 4 (depends on 2)

The method of claim 2, further comprising:
determining that a second data point does not fall within the threshold of the average distance to the center of the cluster; and
creating a new cluster for the data point.

### Claim 5 (depends on 1)

The method of claim 1, further comprising updating the threshold to a higher value.

### Claim 6 (depends on 5)

The method of claim 5, wherein the threshold is a function of a square root below a total number of data points processed.

### Claim 7 (depends on 1)

The method of claim 1, wherein the computing device stores only incremental information about each cluster.

### Claim 8 (depends on 1)

The method of claim 1, wherein the action comprises at least one of:
providing an alert; and
autonomously controlling a device associated with the computing device.

### Claim 9 (depends on 1)

The method of claim 1, wherein the computing device is an edge device within an internet of things system.

### Claim 10

A computing device for anomaly detection, the computing device comprising:
a processor; and
a communications subsystem, wherein the computing device is configured to:
store a full batch model for a plurality of data points, wherein each of the plurality of data points is associated with one of a plurality of clusters, and wherein the storing comprises a table for storing information about the plurality of clusters without storing the plurality of data points;
determine that a number of clusters exceeds a threshold;
remove all clusters with a single data point;
receive a new data point from a hardware sensor;
determine that the new data point falls outside the full batch model, thereby detecting an anomaly; and
perform an action based on the anomaly.

### Claim 11 (depends on 10)

The computing device of claim 10, wherein the computing device is configured to create the full batch model by:
selecting a data point;
determining that the data point falls within a threshold an average distance to a center of a cluster;
adding the data point to the cluster; and
iteratively perform the determining and adding for subsequent data points in a training data point set.

### Claim 12 (depends on 11)

The computing device of claim 11, wherein the computing device is configured to add the data point to the cluster by:
incrementing an index indicating a number of data points within the cluster;
adding information for the data point to a sum of features for the cluster;
updating a centroid of the cluster; and
updating a value comprising an approximate distance between points in the cluster.

### Claim 13 (depends on 11)

The computing device of claim 11, wherein the computing device is further configured to:
determine that a second data point does not fall within the threshold of the average distance to the center of the cluster; and
create a new cluster for the data point.

### Claim 14 (depends on 10)

The computing device of claim 10, wherein the computing device is further configured to update the threshold to a higher value.

### Claim 15 (depends on 14)

The computing device of claim 14, wherein the threshold is a function of a square root below a total number of data points processed.

### Claim 16 (depends on 10)

The computing of claim 10, wherein the computing device stores only incremental information about each cluster.

### Claim 17 (depends on 10)

The computing device of claim 10, wherein the action comprises at least one of:
providing an alert; and
autonomously controlling a device associated with the computing device.

### Claim 18 (depends on 10)

The computing device of claim 10, wherein the computing device is an edge device within an internet of things system.

### Claim 19

A computer storage medium for storing instruction code for anomaly detection, which, when executed by a processor on a computing device, cause the computing device to:
store a full batch model for a plurality of data points, wherein each of the plurality of data points is associated with one of a plurality of clusters, and wherein the storing comprises a table for storing information about the plurality of clusters without storing the plurality of data points;
receive a new data point from a hardware sensor;
determine that a number of clusters exceeds a threshold;
remove all clusters with a single data point;
determine that the new data point falls outside the full batch model, thereby detecting an anomaly; and
perform an action based on the anomaly.