Methodology for intelligent pattern detection and anomaly detection in machine to machine communication network

Patent metadata

Field	Value
Publication number	US-12375508-B2
Application number	US-202117502622-A
Country	US
Kind code	B2
Filing date	Oct 15, 2021
Priority date	Jun 26, 2012
Publication date	Jul 29, 2025
Grant date	Jul 29, 2025

Abstract

The present invention relates generally to network communications, and more particularly to machine-to-machine (M2M) data communications. The present invention provides for a method, apparatus and computer program product for detecting anomalous performance event across a machine-to-machine (M2M) network and thereafter alerting users of performance issues in real-time or near real-time.

First claim

What is claimed is:

1. A method for detecting an abnormal performance event across a machine-to-machine (M2M) network, comprising:
determining one or more performance events to monitor;
acquiring data of one or more monitored performance events including “bytes in” and “bytes out” from a data stream that captures the monitored performance event;
comparing the acquired event data with one or more predetermined event characteristic limits over a predetermined period to assess for asymmetry in the data stream based on “bytes in” and “bytes out”; and
issuing an alert in response to compared acquired event data exceeding the one or more predetermined event characteristic limits.

2. The method of claim 1 , wherein the acquiring data further includes identifying one or more event data streams to monitor and identifying data within the one or more event data streams by sourcing information from one or more log files of a server.

3. The method of claim 2 , wherein the server is an authentication, authorization and accounting server.

4. The method of claim 1 , wherein acquiring data further includes collecting firewall data including destination IP address and device IP address.

5. The method of claim 4 , further comprising combining the “bytes in” and “bytes out” data with the destination IP address using device internet protocol (IP) address and time of the event to produce “bytes in” and “bytes out” to a particular destination IP address.

6. The method of claim 5 , wherein the comparing further includes using the “bytes in” and “bytes out” to a particular IP address of the data stream in view of history, captured data over a period of time, or other performance characteristics to detect anomaly.

7. The method of claim 1 , wherein the comparing further includes comparing the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.

8. The method of claim 1 , wherein the issuing an alert further includes directing an asynchronous alert command to a command interface message queue associated with a predetermined output routing for receipt by one or more receiving devices associated with the predetermined output routing.

9. The method of claim 8 , wherein the predetermined output is the alert is sent to a device having an application programming interface of an interested party.

10. The method of claim 9 , wherein the alert includes one or more of: a voice call, an email and a text message.

11. The method of claim 9 , wherein the application programming interface of an interested party comprises at least one or more of an Alerts section displaying near real time alerts from multiple sources and a Device Details section displaying details of events in relation to a device.

12. An apparatus for detecting an abnormal performance event across a machine-to-machine (M2M) network, comprising:
a device protocol capable of communications with a server across a M2M network,
a device capable of communicating with a server system across the network using a communication adapter;
the server system having an application module for
determining one or more performance events to monitor;
acquiring event data of one or more events as “bytes in” and “bytes out” from a data stream that captures the monitored performance event;
comparing acquired event data with one or more predetermined event characteristic limits over a predetermined period to assess for asymmetry in the data stream based on “bytes in” and “bytes out”; and
issuing a command in response to compared acquired event data exceeding the one or more predetermined event characteristic limits; and

a notification means for issuing an alert to one or more recipients in response to the issued command, wherein the alert includes information in relation the event.

13. The apparatus of claim 12 , wherein the server is in communication with one or more receiving devices.

14. The apparatus of claim 12 , wherein the application module further includes logic to identify one or more event data streams to monitor and identify data within the one or more event data streams by sourcing information from one or more log files of a server.

15. The apparatus of claim 12 , wherein the application module further includes logic to collect firewall data including destination IP address and device IP address, and combining the “bytes in” and “bytes out” data with the destination IP address using device internet protocol (IP) address and time of the event to produce “bytes in” and “bytes out” to a particular destination IP address.

16. The apparatus of claim 12 , wherein the application module further includes logic to compare the acquired data identified from the one or more event streams with one or more predetermined event characteristic limits over a predetermined period to identify asymmetry.

17. The apparatus of claim 15 , wherein the application module further includes logic to use the “bytes in” and “bytes out” to a particular IP address of the data stream in view of history, captured data over a period of time, or other performance characteristics to detect anomaly.

18. The apparatus of claim 17 , wherein the application module further includes logic to issue an alert to the one or more receiving devices.

19. The apparatus of claim 17 , wherein the alert includes one or more of: a voice call, an email and a text message.

20. A computer program product stored on a non-transitory computer readable storage medium, comprising: computer readable program means for causing a computer to control an execution of an application to perform a method for detecting anomalous performance event data across a machine-to-machine (M2M) network, comprising:
determining one or more performance events to monitor;
acquiring data of one or more monitored performance events as “bytes in” and “bytes out” from a data stream that captures the monitored performance event;
comparing the acquired event data with one or more predetermined event characteristic limits over a predetermined period to assess for asymmetry in the data stream based on “bytes in” and “bytes out”; and
issuing an alert in response to compared acquired event data exceeding the one or more predetermined event characteristic limits.

Assignees

• Aeris Communications Inc

Inventors

• George Jins
• Balakrishnan Subramanian
• Sharma Narendra

Classifications

• H04W12/121

  Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS] · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• H04W12/122

  Counter-measures against attacks; Protection against rogue devices · CPC title

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title