System and method for memory-less anomaly detection using anomaly levels

Methods and systems for anomaly detection in a distributed environment are disclosed. To manage anomaly detection, a system may include an anomaly detector and one or more data collectors. The anomaly detector may detect anomalies in data and classify the anomalies based on magnitudes of anomalies using an inference model. Different magnitudes of anomalies may be keyed to different action sets in response to the presence of anomalies in data. To perform anomaly detection, the inference model may require re-training. Data collected from the one or more data collectors may be used to re-train the inference model as needed. Following anomaly detection and/or inference model re-training, the data may be discarded to remove the data from the anomaly detector.

FIELD

Embodiments disclosed herein relate generally to anomaly detection. More particularly, embodiments disclosed herein relate to systems and methods to reduce computing resource expenditure and increase data security while performing anomaly detection.

BACKGROUND

DETAILED DESCRIPTION

In general, embodiments disclosed herein relate to methods and systems for anomaly detection in a distributed environment using an inference model. To perform anomaly detection in a distributed environment, the system may include an anomaly detector. The anomaly detector may host and operate the inference model while re-training the inference model as needed. These operations (e.g., hosting, operating, and re-training the inference model) may consume large quantities of computing resources of a device (e.g., more computing resources than desirable and/or available to the device) and may, in some embodiments, require storage of large amounts of data on the device as training data. Storing large amounts of data on the device may leave the data vulnerable to malicious attacks by unauthorized entities (e.g., attackers who desire access to the data).

To bolster data security, the anomaly detector may re-train the inference model as needed (e.g., when input values do not generate an expected output value when non-anomalous) and subsequently discard (e.g., remove from the device) the data used to re-train the inference model. In addition, other data obtained from the one or more data collectors (e.g., data including anomalies and/or any other data not used to re-train the inference model) may also be discarded. By doing so, the anomaly detector may perform memory-less anomaly detection (e.g., detection of anomalies in data without maintaining data in any memory or storage device). Therefore, even in the event of an unauthorized entity (e.g., an attacker) gaining access to the device, the attacker may not access the data.

In addition, to reduce computing resource consumption during anomaly detection, the inference model may be trained to map input values to a fixed output value. By doing so, the inference model may perform unsupervised anomaly detection and, therefore, reduce the quantity of computing resources required by the device to host and operate the inference model when compared to an anomaly detection algorithm requiring comparison of new data to existing (e.g., stored) data. Furthermore, re-training of the inference model may include a partial re-training process. Partial re-training of the inference model may include freezing (e.g., rendering unaffected by the re-training of the inference model) portions of the inference model. By doing so, only portions of the inference model not included in the frozen portion may be modified during the re-training process. Partial re-training of the inference model may utilize fewer computing resources (e.g., by only re-training a portion of the inference model rather than the entire inference model) than a complete re-training process.

Lastly, an entity responsible for responding to anomalies in the data (e.g., the anomaly detector itself, a downstream consumer, or the like) may wish to perform different action sets in response to different magnitudes of anomalies (e.g., different levels of criticality, etc.). To do so, the anomaly detector may assign anomaly levels to obtained data (e.g., representing different amounts of deviation from the expected output value) and may initiate different action sets in response to different anomaly levels of data. For example, an anomaly detector may assign an anomaly level of 8 (e.g., on a scale of 1 to 10 with 1 being the lowest degree of anomalousness and 10 being the highest level of anomalousness) to obtained data. The anomaly level of 8 may correspond to a critical anomaly and may initiate an action set tailored to remedy critical anomalies.

To perform memory-less anomaly detection, the anomaly detector may obtain data from one or more data collectors within a distributed environment. The anomaly detector may determine whether the data includes an anomaly using the inference model. To determine if the data includes an anomaly, a difference may be obtained (e.g., a difference between the inference and the fixed output value, the inference being intended to match the fixed output value when the data is not anomalous). The magnitude of the difference may be used to assign an anomaly level to the data, the anomaly level being based on a range of values of the difference. If the anomaly level is above an anomaly level threshold, the data may be classified as anomalous data and the magnitude of anomaly may be determined (e.g., critical, non-critical, and/or other magnitudes of anomalies) based on the anomaly level of the data. Based on the anomaly level and, therefore, the magnitude of anomaly, a process may be initiated (e.g., an action set keyed to an anomaly level and/or a range of anomaly levels of the data) by the entity responsible for responding to anomalies in the data (e.g., the anomaly detector itself, a downstream consumer, etc.). The process may include discarding the data following performance of the action set.

If the anomaly level is within the anomaly level threshold, the data may not include anomalous data. However, the data may be used to determine whether the inference model requires re-training. The inference model may require re-training if the anomaly level falls outside a calibration threshold for the inference model. Data with an anomaly level that falls outside the calibration threshold may indicate that the inference model no longer maps non-anomalous input values to the fixed output value as expected. In this example, the data may no longer comply with the needs of a downstream consumer. The data may then be treated as training data and used to re-train (through the partial re-training process described above) the inference model to obtain an updated inference model. The updated inference model may generate inferences more likely to discover anomalies given a changed environment which is now considered non-anomalous. As discussed above, all data (data used to re-train the inference model or otherwise) may be discarded to increase data security.

Thus, embodiments disclosed herein may provide an improved system for performing anomaly detection while securing data desired by attackers and minimizing computing resource expenditure on devices within a distributed environment. The system may improve data security on devices by not locally storing any data, thereby rendering the data unavailable to attackers. In addition, the device hosting the inference model may perform a partial re-training process (when re-training is needed) and, therefore, may not update the entire inference model. By doing so, fewer computing resources may be required to host, operate, and update the inference model on the device.

In an embodiment, a method of processing data is provided.

The method may include obtaining, by an anomaly detector, first data from a data collector; obtaining, by the anomaly detector, an inference using an inference model, the inference being intended to match a fixed output value when the data is not anomalous; making a first determination, by the anomaly detector, regarding an anomaly level of the data based on a schema for identifying a degree of anomalousness of the data using the inference; making a second determination, by the anomaly detector, regarding whether the anomaly level is outside an anomaly level threshold; and in a first instance of the second determination where the anomaly level is outside the anomaly level threshold, initiating a process, by the anomaly detector, based on the anomaly level of the data.

The method may also include: in a second instance of the second determination, where the anomaly level is within the anomaly level threshold: making a third determination, by the anomaly detector, regarding whether the data is useful to improve accuracy of the inference model through training; in a first instance of the third determination where the data is useful, re-training, by the anomaly detector, the inference model using the data as training data to obtain an updated inference model and discarding the data; and in a second instance of the third determination where the data is not useful, discarding the data without using the data for inference model updating purposes.

Making the first determination may also include: obtaining a difference, the difference being based on the inference and the fixed output value; and assigning an anomaly level of the data based on a magnitude of the difference and the schema for identifying the degree of anomalousness in the data.

The schema may categorize the data into one of a plurality of anomaly levels based on difference ranges corresponding to the anomaly levels, the categorization being made by identifying which of the difference ranges in which a magnitude of the difference resides.

The difference ranges may be non-overlapping, and in aggregate, the difference ranges may encompass a full range over which the magnitude of the difference ranges.

As a value of the anomaly level increases, the degree of anomalousness of the data may increase.

Making the third determination may include: making a fourth determination regarding whether the anomaly level of the data is within a calibration threshold for the inference model; in a first instance of the fourth determination where the anomaly level of the data is within a calibration threshold, classifying the data as not useful; and in a second instance of the fourth determination where the anomaly level of the data is outside the calibration threshold, classifying the data as useful.

The anomaly level threshold may define a first range of anomaly levels, the calibration threshold may define a second range of anomaly levels, and the anomaly levels within the first range may be larger than the anomaly levels within the second range.

Initiating the process based on the anomaly level of the data may include: performing an action set based on the anomaly level of the data, wherein a first anomaly level is associated with a first action set and a second anomaly level is associated with a second action set, the first action set being different from the second action set.

The first action set may include initiating re-training of the inference model and the second action set may include initiating an extensive analysis of the inference model.

Re-training the inference model may include: freezing a portion of the inference model prior to re-training the inference model to obtain a frozen portion of the inference model; and modifying portions of the inference model that are not part of the frozen portion of the inference model based on the data to obtain an updated inference model.

Freezing the portion of the inference model may render the frozen portion of the inference model unaffected by the re-training of the inference model.

In an embodiment, a non-transitory media is provided that may include instructions that when executed by a processor cause the computer-implemented method to be performed.

In an embodiment, a data processing system is provided that may include the non-transitory media and a processor, and may perform the computer-implemented method when the computer instructions are executed by the processor.

Turning to FIG. 1, a block diagram illustrating a system in accordance with an embodiment is shown. The system shown in FIG. 1 may provide computer-implemented services. The computer-implemented services may include any type and quantity of computer implemented services. For example, the computer-implemented services may include monitoring services (e.g., of locations), communication services, and/or any other type of computer-implemented services.

To provide memory-less anomaly detection services, the system may include anomaly detector 102. Anomaly detector 102 may provide all, or a portion of, the computer-implemented services. For example, anomaly detector 102 may provide computer-implemented services to users of anomaly detector 102 and/or other computing devices operably connected to anomaly detector 102. The computer-implemented services may include any type and quantity of services including, for example, memory-less anomaly detection.

To facilitate memory-less anomaly detection, the system may include one or more data collectors 100. Data collectors 100 may include any number of data collectors (e.g., 100A-100N). For example, data collectors 100 may include one data collector (e.g., 100A) or multiple data collectors (e.g., 100A-100N) that may independently and/or cooperatively facilitate the memory-less anomaly detection.

All, or a portion, of the data collectors 100 may provide (and/or participate in and/or support the) computer-implemented services to various computing devices operably connected to data collectors 100.

The computer-implemented services may include any type and quantity of services including, for example, memory-less anomaly detection in a distributed environment. Different data collectors may provide similar and/or different computer-implemented services.

When providing the computer-implemented services, the system of FIG. 1 may determine an anomaly level of the data, with data having an anomaly level outside an anomaly level threshold being treated as anomalous data and data having an anomaly level within the anomaly level threshold being treated as non-anomalous data. Anomalous data may be further categorized based on the anomaly level of the data to indicate a magnitude of anomaly (e.g., the degree of criticality of the anomaly, etc.). To do so, the system of FIG. 1 may utilize an inference model that generates inferences usable to determine the anomaly level of the data and, therefore, ascertain whether the data is anomalous.

However, the quality of the computer-implemented services may depend on how well the system of FIG. 1 is able to ascertain whether data is anomalous. The inference model may be trained to map non-anomalous input values to a fixed output value (e.g., a number other than zero). When encountering new data, the inference model may map non-anomalous data (previously unseen by the inference model during training or otherwise) to an output value other than the expected output value. To improve the anomaly detection capabilities of the inference model (so it is able to identify new non-anomalous data as non-anomalous), the inference model may be re-trained to obtain an updated inference model. However, hosting, operating, and re-training of the inference model may consume large quantities of computing resources (e.g., more computing resources than desirable for use by the device), may require large amounts of data to be stored on a device (e.g., training data and/or other data), and storing large amounts of data on the device may also leave the data vulnerable to malicious attacks by third parties (e.g., attackers who desire access to the data).

In addition, an entity (e.g., a downstream consumer) may wish to respond differently based on the anomaly level of the data to address different magnitudes of anomalies. Therefore, simply identifying an anomaly in data may not provide sufficient detail to meet the needs of the entity.

In general, embodiments disclosed herein may provide methods, systems, and/or devices for minimizing computing resource expenditure by devices in a distributed environment while performing anomaly detection and continuously updating inference models usable for the anomaly detection. To minimize computing resource expenditure during anomaly detection in data (and protect data from malicious attackers that may attempt to compromise devices storing copies of the data), the system of FIG. 1 may implement an inference model update framework and anomaly detection framework that allows (i) small amounts of data to be used for training and discarded thereby not requiring large amounts of data to be aggregated for training purposes, and (ii) data processed for anomaly detection purposes to be discarded after processing likewise reducing the amount of data subject to compromise by malicious attackers. The inference model utilized for anomaly detection may be trained to map input data to one output value and, therefore, may reduce storage requirements during inference generation due to the unsupervised nature of the inference model.

In addition, the inference model update framework may update inference models through a partial re-training process. Partial re-training of the inference model may utilize fewer computing resources (e.g., by only re-training a portion of the inference model rather than the entire inference model) than a complete re-training process.

Lastly, the data may be assigned an anomaly level based on the difference between the inference generated by the inference model and the fixed output value expected if the data is non-anomalous (e.g., a previously established number that is not zero). An anomaly level outside an anomaly level threshold may indicate the presence of anomalous data. However, each anomaly level (or ranges of anomaly levels) may be keyed to different action sets to respond to the anomaly. Therefore, in an example where data is anomalous, the anomaly level of the data may further indicate which action set to perform. The action set may be performed by any entity responsible for responding to the presence of an anomaly in the data (e.g., the anomaly detector itself, a downstream consumer, etc.).

For example, a data set may have an anomaly level of 8 (on a scale of 1-10 with 1 corresponding to the lowest magnitude of the difference and 10 corresponding to the highest magnitude of the difference) and may be considered anomalous data (due to being outside an anomaly threshold of 5). Further, data with an anomaly level between 6-7 may be considered to contain a non-critical anomaly and the response may include transmitting a notification of the anomaly to a downstream consumer (and/or other actions including, for example, re-training the inference model). In contrast, data with an anomaly level between 8-10 may be considered to contain a critical anomaly and the response may include transmitting a notification of the anomaly and performing an action set to intervene with the critical anomaly (e.g., closing a security door, alerting a response team, initiating an extensive analysis of the inference model, etc.). Therefore, the anomaly level of 8 may initiate an urgent response to rectify the critical anomaly detected in the data. By doing so, the entity responsible for responding to anomalies in data may perform tailored responses based on the magnitude of anomaly present in the data. While described above with respect to an example anomaly level grading system, it will be appreciated that anomalies may be graded using different systems.

To provide the above noted functionality, the system of FIG. 1 may include anomaly detector 102. Anomaly detector 102 may (i) determine an anomaly level of data (e.g., obtained from data collectors 100 and/or by itself) using an inference model, (ii) determine whether data is anomalous using the anomaly level and an anomaly level threshold, (iii) when anomalous data is identified, determine the magnitude of anomaly based on the anomaly level and perform an action set corresponding to the magnitude of anomaly, (iv) when non-anomalous data is identified, determine whether the non-anomalous data may be used to improve the anomaly detection capabilities of the inference model through re-training, (v) when the non-anomalous data is determined as being usable to improve the anomaly detection capabilities of the inference model, obtain an updated inference model using the non-anomalous data, and/or (vi) discard the data after its use so that the data is not available to malicious attackers if anomaly detector 102 is compromised.

When performing its functionality, anomaly detector 102 and/or data collectors 100 may perform all, or a portion, of the methods and/or actions shown in FIGS. 3A-4G.

In an embodiment, one or more of data collectors 100 and/or anomaly detector 102 are implemented using an internet of things (IoT) device, which may include a computing device. The IoT device may operate in accordance with a communication model and/or management model known to the anomaly detector 102, other data collectors, and/or other devices.

Any of the components illustrated in FIG. 1 may be operably connected to each other (and/or components not illustrated) with a communication system 101. In an embodiment, communication system 101 may include one or more networks that facilitate communication between any number of components. The networks may include wired networks and/or wireless networks (e.g., and/or the Internet). The networks may operate in accordance with any number and types of communication protocols (e.g., such as the internet protocol).

While illustrated in FIG. 1 as including a limited number of specific components, a system in accordance with an embodiment may include fewer, additional, and/or different components than those illustrated therein.

To further clarify embodiments disclosed herein, diagrams illustrating data flows and/or processes performed in a system in accordance with an embodiment are shown in FIG. 2.

FIG. 2 shows a diagram of anomaly detector 202 interacting with data collector 200 and downstream consumer 218. Anomaly detector 202 may be similar to anomaly detector 102 shown in FIG. 1. In FIG. 2, anomaly detector 202 may be connected to data collector 200 and downstream consumer 218 via a communication system (not shown). Data collector 200 may be similar to any of data collectors 100. Communications between anomaly detector 202, data collector 200, and downstream consumer 218 are illustrated using lines terminating in arrows. In some embodiments, downstream consumer 218 may not be required.

As discussed above, anomaly detector 202 may perform computer-implemented services by processing data (e.g., via memory-less anomaly detection) in a distributed environment in which devices may be subject to malicious attacks.

To perform memory-less anomaly detection in the distributed environment, anomaly detector 202 may obtain data 204 from data collector 200. Data 204 may include any type and quantity of data. Anomaly detector 202 may perform anomaly detection 206 process on data 204 to determine whether data 204 includes anomalous data. Anomaly detection 206 process may include generating an inference using an inference model trained to map non-anomalous data to a fixed output value (e.g., a number that is not zero). Anomaly detector 202 may generate a difference. The difference may be based on the inference and the fixed output value. Anomaly detector 202 may determine an anomaly level of the data based on the difference and a schema for identifying a degree of anomalousness of the data. The schema may categorize the data into one of a plurality of anomaly levels based on difference ranges corresponding to the anomaly levels. The anomaly detector 202 may determine whether the anomaly level of the data is outside an anomaly level threshold. The anomaly level threshold may indicate a first range of anomaly levels. Any anomaly level outside the anomaly level threshold may indicate that the inference does not sufficiently match the fixed output value and, therefore, includes anomalous data. Any anomaly level within the anomaly level threshold may indicate that the data does not include anomalous data. The anomaly level threshold may be set by a downstream consumer 218, and any data outside the anomaly threshold may be considered unacceptable for the needs of downstream consumer 218. Therefore, downstream consumer 218 may desire to be notified of any anomalies in collected data. In some embodiments, anomaly detector 202 may respond directly to any anomalies and downstream consumer 218 may not be included in the system. Anomaly detector 202 may perform different actions with respect to data 204 depending on whether data 204 includes anomalous data. If data 204 is anomalous, anomaly detector 202 may perform different actions depending on the anomaly level assigned to data 204.

In a first example of the actions that anomaly detector 202 may take, consider a scenario in which the anomaly level is outside the anomaly level threshold and, therefore, may include anomalous data 208. When data 204 is classified as anomalous data 208, anomaly detector 202 may initiate performance of an action set based on the anomaly level of the data. The anomaly level of the data, for example, may indicate the presence of a non-critical anomaly. Therefore, the action set may include sending the anomalous data 208 (and/or a notification of the presence of anomalies in data 204) to downstream consumer 218 (and/or other actions including, for example, re-training the inference model). By doing so, downstream consumer 218 may be notified of the non-critical anomaly and may perform actions in response to this notification. In contrast, the anomaly level of the data may indicate the presence of a critical anomaly to the downstream consumer. Therefore, the action set may include sending the anomalous data 208 (and/or a notification of the presence of anomalies in data 204) and may also include an additional action (e.g., alerting a security team, closing a security door, initiating a fire suppressant system, initiating an extensive analysis of the inference model, etc.) to interfere with the critical anomaly. Alternatively, anomaly detector 202 itself may perform the action set based on the presence of anomalous data 208. In this example, downstream consumer 218 may or may not be included in the system. Following this action set, anomalous data 208 may be discarded, transmitted to another device, and/or otherwise removed from anomaly detector 202. By doing so, anomalous data 208 may not be available to malicious attackers if anomaly detector 202 is compromised.

In a second example of the actions that anomaly detector 202 may take, consider a scenario in which the anomaly level is within the anomaly level threshold. When data 204 is classified as not including anomalous data, anomaly detector 202 may elect to use data 204 for training purposes if useful for training. To ascertain whether data 204 is useful for training, the anomaly level may be compared to a calibration threshold. The calibration threshold may indicate a second range of anomaly levels. Any anomaly level outside the calibration threshold (but within the anomaly level threshold) may indicate that data 204 is useful for training purposes and may be classified as training data 212. Any anomaly level within the calibration threshold may indicate that data 204 is not useful for training purposes.

Continuing with the second example, if the anomaly level is within the calibration threshold, then data 204 may be classified as accepted data 210. Accepted data 210 may be treated as not including anomalies and not useful for training (at least with respect to the level of improvement in the inference model that could be attained by training using accepted data 210 when weighed against the computing resource cost for the training). Accepted data 210 may be discarded, transmitted to another device, and/or otherwise removed from anomaly detector 202 so that, like anomalous data 208, accepted data 210 may not be available to malicious attackers should anomaly detector 202 be compromised.

When identified, training data 212 may be used for a continuous inference model training 214 process. Continuous inference model training 214 process may include a partial re-training of the inference model. Partial re-training of the inference model may include freezing (e.g., rendering unaffected by the re-training) a portion of the inference model. Therefore, only portions of the inference model not included in the frozen portion of the inference model may be modified during re-training. Partial re-training of the inference model may consume fewer computing resources than a complete re-training of the inference model, may reduce large changes in decisions boundaries of the inference model, and may facilitate discarding of data on a piece meal basis (e.g., by avoiding the need for establishing large training data sets through aggregation of large amounts of data that may be valued by a malicious attacker).

Continuous inference model training 214 process may generate an updated inference model 216 (e.g., by modifying the structure of the inference model). Updated inference model 216 may be used to generate inferences that better discover anomalies given a changed environment that is now considered non-anomalous. Following continuous inference model training 214 process, training data 212 may be discarded, transmitted to another device, and/or otherwise removed from anomaly detector 202 so that training data 212 may not be available to malicious attackers through compromise of anomaly detector 202.

By discarding all data (e.g., anomalous data 208, accepted data 210, and training data 212), no data may be stored on anomaly detector 202 for any significant duration of time. Therefore, malicious attackers attempting to compromise anomaly detector 202 may not be able to access any significant quantity of data in the event of an attack. Therefore, anomaly detection may be performed by anomaly detector 202 with improved security through continuous inference model updating and discarding of the data. In addition, by only performing partial re-training of the inference model, fewer computing resources may be consumed to update the inference model. Lastly, by assigning anomaly levels to the data, data corresponding to different anomaly levels (and, therefore, different degrees of anomalousness) may be keyed to different action sets (depending, for example, on the criticality of the anomaly to the operation of the downstream consumer). Therefore, the memory-less anomaly detection may allow for tailored action sets to be initiated depending on the anomaly level associated with the data (if the data has an anomaly level outside the anomaly level threshold and, therefore, may be categorized as anomalous data).

In an embodiment, anomaly detector 202 is implemented using a processor adapted to execute computing code stored on a persistent storage that when executed by the processor performs the functionality of anomaly detector 202 discussed throughout this application. The processor may be a hardware processor including circuitry such as, for example, a central processing unit, a processing core, or a microcontroller. The processor may be other types of hardware devices for processing information without departing from embodiments disclosed herein.

As discussed above, the components of FIG. 1 may perform various methods to perform anomaly detection in a distributed environment in which devices may be subject to malicious attacks. FIGS. 3A-3C illustrate methods that may be performed by the components of FIG. 1. In the diagrams discussed below and shown in FIGS. 3A-3C, any of the operations may be repeated, performed in different orders, and/or performed in parallel with or in a partially overlapping in time manner with other operations.

Turning to FIG. 3A, a flow diagram illustrating a method of anomaly detection using an inference model in accordance with an embodiment is shown. The method may be performed, for example, by an anomaly detector, a data collector, and/or another device.

At operation 300, data is obtained from a data collector. The data collector may be any device (e.g., a data processing system) that collects data. For example, the data collector may include a sensor that collects data (e.g., temperature data, humidity data, or the like) representative of an ambient environment, a camera that collects images and/or video recordings of an environment, and/or any other type of component that may collect information about an environment or other source.

The obtained data may include the live data (e.g., temperature readings, video recordings, etc.), aggregated statistics and/or other representation of the data (e.g., an average temperature, portions of the video, etc.) to avoid transmitting large quantities of data over communication system 101, and/or any other types of information.

The data may be obtained from data collectors 100 continuously, at regular intervals, in response to a request from anomaly detector 102, and/or in accordance with any other type of data collection scheme. For example, data collector 100A may include a camera that records continuous video of a property. The owners of the property may wish to be notified if any persons appear on the property outside the hours of 7:00 AM to 7:00 PM. Therefore, the video recordings collected during the hours of 7:00 PM to 7:00 AM may be selected by the data collector and transmitted to the anomaly detector for anomaly detection (e.g., identification of persons on the property outside the accepted times of 7:00 AM to 7:00 PM). The video recordings may be transmitted, for example, once per day after the time period has elapsed (e.g., at 7:00 AM). Following receipt of the data, the anomaly detector 102 may determine whether the data includes anomalous data as described below. In some embodiments, the data collectors 100 and anomaly detector 102 may be integrated into a single device.

At operation 302, the anomaly detector 102 determines whether the data includes anomalous data. Anomalous data may be data that deviates from typical data by a certain degree. Anomalous data may include, for example, an identification of a person at a particular location where the corresponding inference indicates that no person should be located. For additional details regarding anomaly detection, refer to FIG. 3B.

If the data includes anomalous data, the method may proceed to operation 308. If the data does include anomalous data, the method may proceed to operation 304.

At operation 308, an action set is performed based on the anomaly level of the data. Data with different anomaly levels may trigger different action sets. For example, the data may correspond to an anomaly level of 8 (e.g., on a scale of 1-10 with 1 indicating the lowest magnitude of the difference and, therefore, the lowest degree of anomalousness and 10 indicating the highest magnitude of the difference and, therefore, the highest degree of anomalousness). As an example, any data with an anomaly level between 6-10 may be considered anomalous. More specifically, any data with an anomaly level between 6-7 may be considered to contain a non-critical anomaly and any data with an anomaly level between 8-10 may be considered to contain a critical anomaly. Therefore, the data with an anomaly level of 8 may be considered to indicate the presence of a critical anomaly.

The action set may include transmitting a notification of the anomaly to a downstream consumer. The downstream consumer may be any entity desiring to be notified of anomalies in the data collected by the data collector. For example, the downstream consumer may be the owner of the property, a security team, and/or any other entity that may respond to the presence of anomalous data in the data. In the event of a non-critical anomaly, the downstream consumer may be notified by sending one or more messages (e.g., an email alert, a text message alert, an alert through an application on a device) to the downstream consumer. The messages may include information (e.g., that the data is anomalous) regarding the data, a copy of the data itself, and/or other information. The action set may also include initiating re-training of the inference model to remedy the non-critical anomaly. In the event of a critical anomaly, the downstream consumer may be notified as described with respect to non-critical anomalies and other actions (e.g., initiating an alarm, automatically shutting a security door, and/or processes) may be performed to directly address the critical anomaly. In addition, the critical anomaly may trigger initiating an extensive analysis of the inference model. In some embodiments, the downstream consumer may be the anomaly detector 102 itself, and the anomaly detector 102 may take action in response to the anomaly without notifying an additional entity of the presence of the anomaly.

At operation 310, the data is discarded. The data may be discarded to secure against data being accessed by a malicious attacker attempting to compromise an anomaly detector. The data may be discarded immediately following the action set described in operation 308, and/or may be discarded after a previously determined duration of time (e.g., twice per day, etc.).

Discarding data may include deleting the data, transmitting the data to a device at an offsite location to be archived, and/or transmitting the data to another device for other purposes (in net, resulting in no copies of the data being retained on the anomaly detector). The data may be discarded via other methods without departing from embodiments disclosed herein. By doing so, any unauthorized entity (e.g., a malicious attacker) gaining access to the anomaly detector 102 via a malicious attack would not be able to access any data (e.g., due to the data not being stored in any memory or storage on the compromised device).

Returning to operation 302, the method may proceed to operation 304 if the data does not include anomalous data. If the data does not include anomalous data, the data may (or may not) be useful to evaluate and/or improve the inference model through training, as described below.

At operation 304, it is determined whether the anomaly level is outside a calibration threshold for an inference model used to generate the inference to evaluate whether the data includes anomalous data in operation 302. An anomaly level within the calibration threshold may indicate that the inference model reliably maps non-anomalous data to a previously established fixed output value (e.g., a number that is not zero). Data within the calibration threshold may indicate, for example, that the inference model meets the requirements of a downstream consumer. An anomaly level outside the calibration threshold (but within the anomaly level threshold) may indicate that the inference model is not accurate enough to meet the requirements of the downstream consumer (or may otherwise be improved using the data to a significant enough degree that it outweighs the computing resource cost for updating the inference model). If the anomaly level is within the calibration threshold, the inference model may not use the data for training, and the data may be discarded as described with respect to operation 310 below. If the anomaly level is outside the calibration threshold, the method may proceed to operation 306 and the inference model may be use for training to obtain an updated inference model. Refer to FIG. 2 for additional details regarding the calibration threshold.

At operation 306, an updated inference model is obtained using the data. To obtain an updated inference model, the anomaly detector may treat the data as training data and may re-train the inference model to obtain the updated inference model. The retraining may be partial retraining where only the data is used to update the inference model. The updated inference model may be more likely to map new non-anomalous data to the previously established fixed output value for non-anomalous data than the inference model. Following re-training of the inference model, the data may be discarded as described with respect to operation 310. Refer to FIG. 3C for additional details regarding obtaining an updated inference model.

The method may end following operation 310.

Using the method illustrated in FIG. 3A, a system in accordance with embodiments disclosed herein may provide for anomaly detection and the performance of action sets tailored to the degree of anomalousness of the data with a continuously updated inference model while reducing the risk of undesired disclosure of data to malicious attackers.

Turning to FIG. 3B, a flow diagram illustrating a method of identifying anomalous data in accordance with an embodiment is shown. The operations in FIG. 3B may be an expansion of operation 302 in FIG. 3A.

At operation 312, an inference is obtained using an inference model. The inference may be intended to map to a previously established fixed output value (within a threshold) when the data is non-anomalous. The inference model may be, for example, a machine learning model (e.g., a neural network) and/or any other type of predictive model trained to assign anomaly levels to data obtained from data collectors 100. Refer to FIG. 4A for additional details regarding the inference model. The inference model may be trained using anomaly detection training data (not shown) to obtain an initially trained model. Anomaly detection training data may include a labeled dataset of data (e.g., including both anomalous and non-anomalous data) or may be unlabeled. For example, the anomaly detection training data may include frames of a video recording displaying a view of the property with no person present during certain times of the day and frames of the video recording displaying a few persons present during other times of the day. These frames may be labeled as including an expected number of persons within the frames (some or none depending on the frames). Therefore, the inference model may be trained to generate a fixed output value (e.g., 1 or any other value that is not zero) when the data is non-anomalous (e.g., video frames that include a few persons or no persons, depending on the time of the day). In the event of anomalous data, the inference model may generate an inference that does not match the fixed output value (e.g., when an output of 5 is generated as the inference when the fixed output value indicating that the data is non-anomalous is 1, where 5 does not equal (i.e., does not match) 1). The inference may be used in conjunction with the fixed output value to determine a level of anomalousness and, therefore, whether an anomaly is present in the data.

At operation 314, a difference is obtained, the difference being any reduced-size representation of data based on the inference and the fixed output value. The difference may be represented as a value difference, a percent difference, and/or any other representation of the difference between the inference and the fixed output value. For example, a frame of a video recording showing a person on the property may generate an inference of 2.8. This inference may have a value difference with a magnitude of 1.8 from the fixed output value of 1 (e.g., indicating that no persons should be present at that time). The magnitude of the difference may be utilized to assign an anomaly level to the data as described below.

At operation 316, the anomaly level of the data may be determined using the magnitude of the difference and a schema for identifying a degree of anomalousness of the data. The schema may categorize the data into one of a plurality of anomaly levels based on difference ranges corresponding to anomaly levels. The categorization may be made by identifying which of the difference ranges in which a magnitude of the difference resides. Continuing with the above example, the magnitude of the difference may be 1.8. Data with a magnitude of the difference between 0 and 0.5 may be categorized into anomaly level 1 (e.g., on a scale of 1 to 10 with 1 being the lowest degree of anomalousness and 10 being the highest degree of anomalousness). Similarly, data with a magnitude of the difference between 0.6 and 2.0 may be categorized as anomaly level 2. The difference ranges corresponding to the anomaly levels may be non-overlapping, and in aggregate, the difference ranges may encompass a full range over which the magnitude of the difference may range. Specifically, as the value of the anomaly level increases, the degree of anomalousness (e.g., and therefore the magnitude of deviation from the inference) of the data may increase.

The method may end following operation 316.

Turning to FIG. 3C, a flow diagram illustrating a method of determining whether data is useful to improve an inference model through re-training in accordance with an embodiment is shown. The operations in FIG. 3C may be an expansion of operation 306 in FIG. 3A.

At operation 320, the data may be used as training data. The data may be used as training data by labeling it as training data for ingest into a training process for an inference model.

At operation 322, the inference model is re-trained to obtain an updated inference model. The inference model may be retrained using a partial re-training process. The partial re-training process may include freezing (e.g., rendering unaffected by the re-training process) a portion of the inference model. The frozen portion may be chosen randomly during each instance of re-training. The size of the frozen portion may be selected via any method (e.g., heuristically, deterministically based on characteristics of the inference model such as size, accuracy level, etc.). For example, the anomaly detector 102 may freeze a random 75% of the inference model during each re-training process. Therefore, only the portion of the inference model not included in the frozen portion (e.g., the remaining 25% in this example) may be modified during re-training of the inference model.

In an embodiment, the inference model is re-trained by (i) freezing some of the parameters of a neural network (e.g., weights of connections between neurons), (ii) establishing an objective function that optimizes for the machine learning model to output the data for a given input, and (iii) iteratively modifying the parameters that are not frozen until the objective function is optimized. The re-training may be performed via other methods depending on the type of inference model (e.g., other than a neural network) and/or other factors without departing from embodiments disclosed herein.

Re-training the inference model may generate an updated inference model. The updated inference model may be used in place of the inference model and no copies of the inference model may be retained on the anomaly detector 102. By doing so, storage resources may be freed (e.g., by not retaining old copies of inference models) and the most up-to-date version of the inference model may be the only version of the inference model available for use. Therefore, the anomaly detection capabilities of the inference model may be continuously improved by anomaly detector 102 during collection of data and detection of anomalies in the data.

The method may end following operation 322.

Turning to FIG. 4A, three examples are shown of input data being mapped to a single output value using a neural network inference model (neural network 402). In these examples, neural network 402 is trained to map non-anomalous input data to a fixed output value of 1. Therefore, any non-anomalous data used as an ingest for neural network 402 will likely generate an output of 1, or the close to 1 depending on how well the training data used to train the neural network inference model covers the full range of non-anomalous ingest data.

In a first example (the topmost section of FIG. 4A), input 400 includes non-anomalous data. The non-anomalous data is treated as the ingest for neural network 402 and output 404 of 1 is generated. Therefore, in this first example, neural network 402 operates as intended and classifies output 404 as non-anomalous data.

In a second example (the middle section of FIG. 4A), input 406 includes non-anomalous data. However, input 406 may include data never before seen by neural network 402 (during training or otherwise). Therefore, even though the input 406 includes non-anomalous data, the neural network 402 generates output 408 of 1.3. As this output is not 1, an anomaly detector hosting the neural network 402 (not shown) may determine whether output 408 includes an anomaly. To do so, the anomaly detector may generate an anomaly level for output 408 and compare the anomaly level to a series of thresholds. The anomaly level for output 408 may be 2. A first threshold may be an anomaly level threshold dictating that any anomaly level over 5 indicates an anomaly. As the anomaly level of output 408 is not over 5, the anomaly detector may determine that output 408 does not include an anomaly. However, the anomaly detector may compare the anomaly level of output 408 to a second threshold (a calibration threshold). The calibration threshold may dictate that any anomaly level between 1 and 2 may include non-anomalous data unknown to neural network 402. The anomaly detector may consider anomaly levels between 0 and 1 as non-anomalous in accordance with the current training of the neural network 402. An anomaly level outside the calibration threshold (but within the anomaly level threshold) may include data useful for re-training of neural network 402 (in order to train neural network 402 to recognize non-anomalous data in potentially new situations and/or environments). Therefore, the anomaly detector may choose to re-train neural network 402 using data included in input 406.

In a third example (the lowest section of FIG. 4A), input 410 includes anomalous data. The anomalous data is treated as the ingest for neural network 402 and output 412 of 3 is generated. The anomaly detector may generate an anomaly level for output 412 of 7, compare the anomaly level of output 412 to the anomaly level threshold and may determine that output 412 contains anomalous data (e.g., via being outside the anomaly level threshold of 5). The anomaly detector may perform an action set based on the anomalous data, may inform a downstream consumer of the anomalous data, and/or may perform other actions as needed to address the presence of anomalous data in input 410.

To further clarify embodiments disclosed herein, an example implementation in accordance with an embodiment is shown in FIGS. 4B-4G. These figures show diagrams illustrating memory-less anomaly detection while protecting data in a distributed environment subject to attack by malicious attackers and continuously updating inference models usable for anomaly detection. FIGS. 4B-4G may show examples of processes for assigning an anomaly level to data and performing an action set based on the anomaly level to drive an environmental conservation effort in accordance with an embodiment. While described with respect to environmental conservation efforts, it will be understood that embodiments disclosed herein are broadly applicable to different use cases as well as different types of data processing systems than those described below.

Turning to FIG. 4B, consider a scenario in which a swarm of artificial bees (e.g., data processing systems coupled to electromechanical systems such as drones) may be configured to pollinate plants along a pollination route. A camera may monitor a portion of the pollination route (e.g., a geographical location) to determine whether the artificial bees follow their expected pollination route (e.g., by monitoring the time the artificial bees are expected to be visible on the portion of the pollination route monitored by the camera). The camera may collect data in the form of video recordings of the portion of the pollination route. The camera may use the video recordings to determine a number of artificial bees visible in the portion of the pollination route once per hour. To do so, the camera may record continuous video footage and generate an average number of artificial bees visible per hour. By doing so, the camera may account for errors occurring, for example, due to artificial bee overlap in the video recording, artificial bees straying temporarily outside the range of the camera, and/or other errors.

For example, the camera may capture frame 420, which may be a frame of a video recording associated with the hour of 3:00 PM-4:00 PM. Twenty five artificial bees may be visible in frame 420. As previously mentioned, the camera may calculate an average number of artificial bees based on multiple frames (not shown) recorded within the hour of 3:00 PM-4:00 PM. The camera may determine the average number of artificial bees visible during the hour of 3:00 PM-4:00 PM to be twenty five. Similarly, frame 422 may be a frame of the video recording associated with the hour of 7:00 PM-8:00 PM. Three artificial bees may be visible in frame 422. The camera may determine the average number of artificial bees visible during the hour of 7:00 PM-8:00 PM to be three.

Turning to FIG. 4C, the camera may include functionality to host and operate an inference model (e.g., a neural network). Once per hour, the camera may generate an inference using the live data as input data. The live data may include a number of artificial bees visible in the video recording for that hour. The inference model may be trained to generate a value of 1 when the data is non-anomalous and, therefore, may generate a value other than 1 when the data is anomalous based on the expected number of artificial bees for that hour. Graph 424 shows the expected number of visible artificial bees per hour (solid line) and the actual number of visible artificial bees per hour (dashed line). Graph 426 shows the inferences 428 generated over time using the live data as input data. The camera (or another system) may generate a difference based on the inferences 428 and the expected output value of 1. As described with respect to FIG. 3B, the magnitude of the difference may determine the anomaly level of the data, in this case number of bees.

The anomaly detector may determine that the difference has an overall magnitude of 0.5 from the expected value of 1 over the twenty-four hour period. A magnitude of the difference of 0.5 may correspond to an anomaly level of 1 (e.g., on a scale of 1 to 10 with 1 being the lowest degree of anomalousness and 10 being the highest level of anomalousness) as shown in anomaly data 432. Anomaly level classifications 430 displays the anomaly levels corresponding to different anomaly level classifications. Anomaly levels 1-5 correspond to non-anomalous data, with an anomaly threshold (e.g., indicating that any anomaly level within the anomaly threshold contains non-anomalous data) of 5. Anomaly levels 6-7 correspond to a non-critical anomaly, and anomaly levels 8-10 correspond to a critical anomaly. Therefore, an anomaly level of 1 may be within an anomaly threshold and, therefore, may be assigned an anomaly level classification of non-anomalous (e.g., does not include an anomaly) as shown in anomaly data 432.

The camera may then determine whether the anomaly level falls within a calibration threshold for the inference model (not shown). The range of anomaly levels categorized as within the calibration threshold may be 1-2 and the range of anomaly levels categorized as outside the calibration threshold may be 3-5. Therefore, the anomaly level may be within the calibration threshold and the data may not be considered useful for re-training the inference model. As a result, the action taken by the camera may include no action as shown in anomaly data 432.

Following the determination that no action is needed, the camera may discard (e.g., remove from the camera) all inferences and video recordings collected during a period of time (e.g., a twenty-four hour period). By doing so, the data related to the pollination route of the artificial bees may be safeguarded from malicious attackers (e.g., those who may wish to thwart the environmental conservation effort). In addition, by discarding all data, the camera may conserve storage computing resources.

Turning to FIG. 4D, the camera may continue to monitor the portion of the pollination route over time. One month after the events of FIG. 4B, the camera may collect the data shown in frame 440 and frame 442 (as examples, with data being continuously collected in the form of video recordings). Frame 440 shows eight artificial bees visible at 3:00 PM and frame 442 shows one artificial bees visible at 7:00 PM. As previously mentioned with respect to FIG. 4B, the anomaly detector may calculate an average number of visible artificial bees for the hour of 3:00 PM-4:00 PM to be eight artificial bees and may calculate the average number of visible artificial bees for the hour of 7:00 PM-8:00 PM to be one artificial bee.

Turning to FIG. 4E, according to the needs of a downstream consumer (e.g., an entity managing the artificial bees and determining the pollination routes taken by the artificial bees), the expected number of artificial bees over time (solid line) may be unchanged (e.g., may have the same values in graph 444 as in graph 424 from one month prior). However, the actual data shown in graph 444 (dashed line) may have a larger deviation from the expected data than in graph 424.

Graph 446 shows the inferences 448 generated over time using the live data as input data. The camera may then generate a difference, the difference being based on the inferences 448 and the expected output value of 1. As described with respect to FIG. 3B, the magnitude of the difference may determine the anomaly level of the data.

The anomaly detector may determine that the difference has an overall magnitude of 6.8 from the expected value of 1. A magnitude of the difference of 6.8 may correspond to an anomaly level of 6 (e.g., on a scale of 1 to 10 with 1 being the lowest degree of anomalousness and 10 being the highest level of anomalousness) as shown in anomaly data 452. This difference may occur due to, for example, abnormal weather patterns (e.g., storms, strong winds, or the like) disrupting and/or re-directing some of the artificial bees in the swarm of artificial bees.

As shown in anomaly data 452, the anomaly level of 6 may be assigned an anomaly level classification of non-critical anomaly. As previously mentioned, the range of anomaly levels considered non-anomalous may be 1-5 and the range of anomaly levels considered anomalous may be 6-10. However, within the range of anomaly levels considered anomalous, different anomaly levels may be assigned different anomaly level classifications. For example, anomaly levels 8-10 may be considered critical anomalies and anomaly levels 6-7 may be considered non-critical anomalies as shown by anomaly level classifications 450. Different responses may be keyed to different anomaly level classifications. For example, as shown in anomaly data 452, the camera may include instructions to increase the monitoring frequency for this portion of the pollination route (e.g., collect data twice per hour rather than once per hour). This action may be sufficient, as the non-critical anomaly may indicate that the number of artificial bees is still sufficient to meet the needs of the downstream consumer in terms of completing the pollination route.

As previously mentioned with respect to FIG. 4C, the inferences and live data (e.g., video recordings of the portion of the pollination route) may be discarded (e.g., removed from the camera) following the determination to change the monitoring frequency.

Turning to FIG. 4F, the camera may continue to monitor the portion of the pollination route over time. One month after the events of FIG. 4D, the camera may collect the data shown in frame 460 and frame 462 (as examples, with data being continuously collected in the form of video recordings). Frame 460 shows one artificial bee visible at 3:00 PM and frame 462 shows no artificial bees visible at 7:00 PM. The camera may determine the average number of visible artificial bees for the hour of 3:00 PM-4:00 PM to be one and the average number of visible artificial bees for the hour of 7:00 PM-8:00 PM to be zero.

Turning to FIG. 4G, according to the needs of a downstream consumer (e.g., an entity managing the artificial bees and determining the pollination routes taken by the artificial bees), the expected number of artificial bees over time (solid line) may be unchanged (e.g., may have the same values in graph 464 as in graph 444 from one month prior). However, the actual data shown in graph 464 (dashed line) may have a larger deviation from the expected data than in graph 444.

Graph 466 shows the inferences 468 generated over time using the live data as input data. The camera may then generate a difference, the difference being based on the inferences 468 and the expected output value of 1. As described with respect to FIG. 3B, the magnitude of the difference may determine the anomaly level of the data.

The anomaly detector may determine that the difference has an overall magnitude of 9.4 from the expected value of 1. A magnitude of the difference of 9.4 may correspond to an anomaly level of 9 (e.g., on a scale of 1 to 10 with 1 being the lowest degree of anomalousness and 10 being the highest level of anomalousness) as shown in anomaly data 472. This difference may occur due to, for example, destruction of a large proportion of the swarm of artificial bees following an attack by purple martins mistaking the artificial bees for living bees.

As shown in anomaly data 472, the anomaly level of 9 may be assigned an anomaly level classification of critical anomaly. As previously mentioned, the range of anomaly levels considered non-anomalous may be 1-5 and the range of anomaly levels considered anomalous may be 6-10. However, within the range of anomaly levels considered anomalous, different anomaly levels may be assigned different anomaly level classifications. For example, anomaly levels 8-10 may be considered critical anomalies and anomaly levels 6-7 may be considered non-critical anomalies as shown by anomaly level classifications 470. Different responses may be keyed to different anomaly level classifications. For example, as shown in anomaly data 472, the camera may include instructions to deploy (or request from an offsite entity the deployment of) a replacement swarm of artificial bees.

As previously mentioned with respect to FIG. 4E, the inferences and live data (e.g., video recordings of the portion of the pollination route) may be discarded (e.g., removed from the camera) following the determination to deploy the replacement swarm of artificial bees.

In one embodiment, system 500 includes processor 501, memory 503, and devices 505-507 via a bus or an interconnect 510. Processor 501 may represent a single processor or multiple processors with a single processor core or multiple processor cores included therein. Processor 501 may represent one or more general-purpose processors such as a microprocessor, a central processing unit (CPU), or the like. More particularly, processor 501 may be a complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or processor implementing other instruction sets, or processors implementing a combination of instruction sets. Processor 501 may also be one or more special-purpose processors such as an application specific integrated circuit (ASIC), a cellular or baseband processor, a field programmable gate array (FPGA), a digital signal processor (DSP), a network processor, a graphics processor, a network processor, a communications processor, a cryptographic processor, a co-processor, an embedded processor, or any other type of logic capable of processing instructions.

Processor 501, which may be a low power multi-core processor socket such as an ultra-low voltage processor, may act as a main processing unit and central hub for communication with the various components of the system. Such processor can be implemented as a system on chip (SoC). Processor 501 is configured to execute instructions for performing the operations discussed herein. System 500 may further include a graphics interface that communicates with optional graphics subsystem 504, which may include a display controller, a graphics processor, and/or a display device.

Processor 501 may communicate with memory 503, which in one embodiment can be implemented via multiple memory devices to provide for a given amount of system memory. Memory 503 may include one or more volatile storage (or memory) devices such as random access memory (RAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), static RAM (SRAM), or other types of storage devices. Memory 503 may store information including sequences of instructions that are executed by processor 501, or any other device. For example, executable code and/or data of a variety of operating systems, device drivers, firmware (e.g., input output basic system or BIOS), and/or applications can be loaded in memory 503 and executed by processor 501. An operating system can be any kind of operating systems, such as, for example, Windows® operating system from Microsoft®, Mac OS®/iOS® from Apple, Android® from Google®, Linux®, Unix®, or other real-time or embedded operating systems such as VxWorks.

System 500 may further include IO devices such as devices (e.g., 505, 506, 507, 508) including network interface device(s) 505, optional input device(s) 506, and other optional IO device(s) 507. Network interface device(s) 505 may include a wireless transceiver and/or a network interface card (NIC). The wireless transceiver may be a WiFi transceiver, an infrared transceiver, a Bluetooth transceiver, a WiMax transceiver, a wireless cellular telephony transceiver, a satellite transceiver (e.g., a global positioning system (GPS) transceiver), or other radio frequency (RF) transceivers, or a combination thereof. The NIC may be an Ethernet card.

Storage device 508 may include computer-readable storage medium 509 (also known as a machine-readable storage medium or a computer-readable medium) on which is stored one or more sets of instructions or software (e.g., processing module, unit, and/or processing module/unit/logic 528) embodying any one or more of the methodologies or functions described herein. Processing module/unit/logic 528 may represent any of the components described above. Processing module/unit/logic 528 may also reside, completely or at least partially, within memory 503 and/or within processor 501 during execution thereof by system 500, memory 503 and processor 501 also constituting machine-accessible storage media. Processing module/unit/logic 528 may further be transmitted or received over a network via network interface device(s) 505.

Processing module/unit/logic 528, components and other features described herein can be implemented as discrete hardware components or integrated in the functionality of hardware components such as ASICS, FPGAs, DSPs or similar devices. In addition, processing module/unit/logic 528 can be implemented as firmware or functional circuitry within hardware devices. Further, processing module/unit/logic 528 can be implemented in any combination hardware devices and software components.