US 12,463,993 B2
System and method for memory-less anomaly detection using anomaly thresholds based on probabilities
Ofir Ezrielev, Beer Sheva (IL); Nadav Azaria, Beer Sheva (IL); and Avitan Gefen, Tel Aviv (IL)
Assigned to Dell Products L.P., Round Rock, TX (US)
Filed by Dell Products L.P., Round Rock, TX (US)
Filed on Oct. 7, 2022, as Appl. No. 17/938,800.
Prior Publication US 2024/0121252 A1, Apr. 11, 2024
Int. Cl. H04L 9/40 (2022.01); H04L 41/16 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 41/16 (2013.01); H04L 63/1433 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method of processing data, the method comprising:
obtaining, by an anomaly detector, data from a data collector;
obtaining, by the anomaly detector, an inference using an inference model and the data;
obtaining, by the anomaly detector, an anomaly threshold, the anomaly threshold by at least fitting a normal distribution to outputs of the inference model when the inference model is exercised across an input range of the inference model;
making a first determination, directly by the anomaly detector, regarding whether the data is anomalous or not anomalous, the first determination being based at least in part on the inference and the anomaly threshold;
in a first instance of the first determination where the data anomaly detector directly determines that the data is anomalous, initiating a process based on the data being anomalous; and
in a second instance of the first determination where the data anomaly detector directly determines that the data is not anomalous:
making a second determination, by the anomaly detector, regarding whether the data is useful to improve anomaly detection capabilities of the inference model through training;
in a first instance of the second determination where the data is useful, re- training, by the anomaly detector, the inference model using the data as training data to obtain an updated inference model and then subsequently discarding the data after the training is completed; and
in a second instance of the second determination where the data is not useful, discarding the data without using the data for inference model updating purposes.