Patent Publication Number: US-2022214677-A1

Title: Detecting anomalous events using a microcontroller

Description:
TECHNICAL FIELD 
     This disclosure relates generally to mobile electronic device managements, and in particular relates to detecting anomalous events on a mobile electronic device. 
     BACKGROUND 
     A mobile electronic device—such as a smartphone, tablet computer, or laptop computer—may include functionality for determining its location, direction, or orientation, such as a GPS receiver, compass, gyroscope, or accelerometer. Such a device may also include functionality for wireless communication, such as BLUETOOTH communication, near-field communication (NFC), or infrared (IR) communication or communication with a wireless local area networks (WLANs) or cellular-telephone network. Such a device may also include one or more cameras, scanners, touchscreens, microphones, or speakers. Mobile electronic devices may also execute software applications, such as games, web browsers, or social-networking applications. A mobile electronic device may experience abnormal behaviors of hardware or software. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  illustrates an example electronic device, in accordance with presently disclosed embodiments. 
         FIG. 2  illustrates an example sensor stack on an electronic device. 
         FIG. 3  illustrates an example scenario for deploying a pre-trained machine-learning model to electronic devices. 
         FIG. 4  illustrates an example delivery of a notification using a system interrupt. 
         FIG. 5  illustrates an example visual notification regarding an anomalous event. 
         FIG. 6  illustrates an example method for determining whether an anomalous event has occurred on an electronic device. 
         FIG. 7  illustrates an example computer system. 
         FIG. 8  illustrates a diagram of an example artificial intelligence (AI) architecture. 
     
    
    
     DESCRIPTION OF EXAMPLE EMBODIMENTS 
     Mobile Client System Overview 
       FIG. 1  illustrates an example electronic device  100 , in accordance with presently disclosed embodiments. In particular embodiments, the electronic device  100  may include, for example, any of various personal electronic devices  102 , such as a mobile phone electronic device, a tablet computer electronic device, a laptop computer electronic device, and so forth. In particular embodiments, as further depicted by  FIG. 1 , the personal electronic device  102  may include, among other things, one or more processor(s)  104 , memory  106 , sensors  108 , cameras  110 , a display  112 , input structures  114 , network interfaces  116 , a power source  118 , and an input/output (I/O) interface  120 . It should be noted that  FIG. 1  is merely one example of a particular implementation and is intended to illustrate the types of components that may be included as part of the electronic device  100 . 
     In particular embodiments, the one or more processor(s)  104  may be operably coupled with the memory  106  to perform various algorithms, processes, or functions. Such programs or instructions executed by the processor(s)  104  may be stored in any suitable article of manufacture that includes one or more tangible, computer-readable media at least collectively storing the instructions or routines, such as the memory  106 . The memory  106  may include any suitable articles of manufacture for storing data and executable instructions, such as random-access memory (RAM), read-only memory (ROM), rewritable flash memory, hard drives, and so forth. Also, programs (e.g., an operating system) encoded on such a computer program product may also include instructions that may be executed by the processor(s)  104  to enable the electronic device  100  to provide various functionalities. 
     In particular embodiments, the sensors  108  may include, for example, one or more cameras (e.g., depth cameras), touch sensors, microphones, motion detection sensors, thermal detection sensors, light detection sensors, time of flight (ToF) sensors, ultrasonic sensors, infrared sensors, or other similar sensors that may be utilized to detect various user inputs (e.g., user voice inputs, user gesture inputs, user touch inputs, user instrument inputs, user motion inputs, and so forth). The cameras  110  may include any number of cameras (e.g., wide cameras, narrow cameras, telephoto cameras, ultra-wide cameras, depth cameras, and so forth) that may be utilized to capture various 2D and 3D images. The display  112  may include any display architecture (e.g., AMLCD, AMOLED, micro-LED, and so forth), which may provide further means by which users may interact and engage with the electronic device  100 . In particular embodiments, as further illustrated by  FIG. 1 , one more of the cameras  110  may be disposed behind, underneath, or alongside the display  112  (e.g., one or more of the cameras  110  may be partially or completely concealed by the display  112 ), and thus the display  112  may include a transparent pixel region and/or semi-transparent pixel region through which the one or more concealed cameras  110  may detect light, and, by extension, capture images. It should be appreciated that the one more of the cameras  110  may be disposed anywhere behind or underneath the display  110 , such as at a center area behind the display  110 , at an upper area behind the display  110 , or at a lower area behind the display  110 . 
     In particular embodiments, the input structures  114  may include any physical structures utilized to control one or more global functions of the electronic device  100  (e.g., pressing a button to power “ON” or power “OFF” the electronic device  100 ). The network interface  116  may include, for example, any number of network interfaces suitable for allowing the electronic device  100  to access and receive data over one or more cloud-based networks (e.g., a cloud-based service that may service hundreds or thousands of the electronic device  100  and the associated users corresponding thereto) and/or distributed networks. The power source  118  may include any suitable source of power, such as a rechargeable lithium polymer (Li-poly) battery and/or an alternating current (AC) power converter that may be utilized to power and/or charge the electronic device  100  for operation. Similarly, the I/O interface  120  may be provided to allow the electronic device  100  to interface with various other electronic or computing devices, such as one or more auxiliary electronic devices. 
     Detecting Anomalous Events 
       FIG. 2  illustrates an example sensor stack on an electronic device  100 . One or more sensors  211  may collect sensor data from corresponding hardware. The one or more sensors  211  may comprise hardware-based sensors or software-based sensors. A sensor hub  213  may be a microcontroller unit that helps to integrate data from different sensors and process them. The sensor hub  213  may off-load the sensor data processing jobs from a processor, thus may save battery consumption and provide a performance improvement. Drivers/kernel  217  may provide a software interface to hardware devices. The drivers/kernel may enable an Operating System (OS) and other computer programs to access hardware functions without needing to know precise details about the hardware being used. The sensors  211 , the sensor hub  213 , and the drivers/kernel  217  of an electronic device  100  may be provided by the manufacturer  210  of the electronic device  100 . The Hardware Abstraction Layer (HAL)  221  may be a layer of programming that may allow the OS to interact with a hardware device at a general or abstract level rather than at a detailed hardware level. The native libraries  223  may be a set of modules that may provide accesses to native services of the OS. The API framework  225  may allow applications  231  to access the native libraries  223 . The HAL  221 , the native libraries  223 , and the API framework  225  may be provided by an OS  220 . The applications  231 , provided by corresponding applications developers  230 , may be a program mainly designed to provide services to end-users. Examples of the application  231  may include, but not limited to, messengers, email clients, image viewers, games, or any suitable applications. In particular embodiments, data may flow in the upward direction. Control may flow in the downward direction. In particular embodiments, the electronic device  100  may comprise one or more displays  112 , one or more non-transitory computer-readable storage media  106 , one or more processors  104  coupled to the storage media  106 , one or more sensors  211 , and a microcontroller  213 . In particular embodiments, the electronic device  100  may be a mobile electronic device. In particular embodiments, the microcontroller  213  may be a sensor hub associated with the electronic device  100 . The microcontroller  213  may access one or more real-time sensor data associated with the one or more sensors  211 . The one or more real-time sensor data may comprise a current clock speed for one of the one or more processors, a current storage media utilization, a current battery level, a current network utilization, a current status for one of the one or more displays, a current device temperature, or any suitable real-time sensor data associated with the electronic device  100 . The microcontroller  213  may determine that an anomalous event has occurred on the electronic device  100  by processing the one or more real-time sensor data with a machine-learning model  215  running on the microcontroller  213 . In particular embodiments, the machine-learning model  215  may be a Tiny Machine Learning (TinyML)-based model. The microcontroller  213  may send a notification regarding the anomalous event to a system level application  231  running on the electronic device  100  upon the determination that the anomalous event has occurred. The microcontroller  213  may trigger a system interrupt to send the notification. In particular embodiments, the system level application  231  may take further actions to determine whether the anomalous event is associated with an abnormal operation mode of the electronic device  100 . The system level application  231  may provide a result of the determination whether the anomalous event is associated with an abnormal operation mode of the electronic device  100  to the microcontroller  213 . Upon receiving the result from the application  231 , the microcontroller  213  may update the machine-learning model  215  based on the received result. As used herein, “electronic devices having hardware configurations substantially similar to a particular electronic device” may refer to electronic devices having hardware configurations identical to the hardware configurations of the particular electronic device with zero or more minor exceptions. As used herein, “electronic devices having software configurations substantially similar to a particular electronic device” may refer to electronic devices having software configurations identical to the hardware configurations of the particular electronic device with zero or more minor exceptions. Although this disclosure describes determining that an anomalous event has occurred on an electronic device using a microcontroller in a particular manner, this disclosure contemplates determining that an anomalous event has occurred on an electronic device using a microcontroller in any suitable manner. 
     Certain technical challenges exist for monitoring performance and utilizations of hardware resources to determine whether an anomalous event has occurred on an electronic device  100 . Legacy electronic device may have utilized one or more system level applications to monitor the performance and the utilization of the underlying hardware. The one or more system level applications may send raw device data to a cloud application at a predefined interval for a deeper analysis. One technical challenge for this approach may include consuming of unnecessary device resources including computing, storage, and network resources. The system level applications may need to collect and store the raw device data and send the collected/stored raw device data to the cloud application at the predefined interval. Those activities may consume computing, storage, and network resources of the electronic device. Another technical challenge may include consuming of battery. A mobile electronic device may be battery powered. When the system level applications collect raw device data or send the raw device data to the cloud application, the electronic device may need to enter into an active mode from an idle mode. The electronic device in active mode may consume significantly more battery than in idle mode. The solution presented by the embodiments disclosed herein to address these challenges may be utilizing a microcontroller  213  for an always-on monitoring of the performance and the utilization of underlying hardware. The microcontroller  213  may access sensor data from one or more sensors  211 . The microcontroller may process the sensor data with a machine-learning model  215  running on the microcontroller  213  to determine whether an anomalous event has occurred on the electronic device  100 . 
     Certain embodiments disclosed herein may provide one or more technical advantages. A technical advantage of the embodiments may include avoiding unnecessary consumption of device resources. The microcontroller  213 , a sensor hub, may be able to access sensor data from the one or more sensors  211  and the microcontroller analyze the accessed sensor data using the machine-learning model  215  running on the microcontroller  213 . Thus, the embodiments disclosed herein may avoid unnecessary consumption of device resources. Another technical advantage of the embodiments may include reducing battery consumption. The analysis on the microcontroller  213  may not cause the electronic device  100  to enter into the active mode. Thus, the embodiments disclosed herein may reduce battery consumption caused by the monitoring performance and utilizations of hardware resources in the legacy electronic devices. Yet another technical advantage of the embodiments may include customizing analysis to a device or a group of devices and/or a user or a group of users. The machine-learning model  215  for determining whether an anomalous event has occurred on the electronic device  100  may be trained using collected data from electronic devices having hardware configurations substantially similar to the hardware configurations of the electronic device  100  and/or having software configurations substantially similar to the software configurations of the electronic device  100 . The machine-learning model  215  for determining whether an anomalous event has occurred on the electronic device  100  may be updated based on data from the electronic device  100  itself. The electronic device  100  may have a particular hardware and software configurations. The electronic device  100  may be used by a particular user. The data collected from the electronic device  100  may reflect the particular hardware and software configurations as well as particular usage patterns associated with the particular user. Certain embodiments disclosed herein may provide none, some, or all of the above technical advantages. One or more other technical advantages may be readily apparent to one skilled in the art in view of the figures, descriptions, and claims of the present disclosure. 
     In particular embodiments, an electronic device  100  may comprise one or more displays  112 , one or more non-transitory computer-readable storage media  106 , one or more processors  104  coupled to the storage media  106 , one or more sensors  211 , and a microcontroller  213 . In particular embodiments, the electronic device  100  may be a mobile electronic device. In particular embodiments, the microcontroller  213  may be a sensor hub associated with the electronic device  100 . The microcontroller  213  may access one or more real-time sensor data associated with the one or more sensors  211 . As an example and not by way of limitation, a mobile phone  100  may comprise a touch display  112 , memory  106 , one or more processors  104 , one or more sensors  211  for hardware monitoring, and a sensor hub  213 . The sensor hub  213  may be a microcontroller. The sensor hub  213  was originally introduced to off-load sensor data processing load from the one or more processors  104 . The sensor hub  213  may save battery consumption and provide a performance improvement of the mobile phone  100 . The mobile phone may further comprise a battery-based power source  118 , network interface  116  and I/O interfaces  120 . Although this disclosure describes a particular electronic device to monitor performance and utilization of the underlying hardware, this disclosure contemplates any suitable electronic device to monitor performance and utilization of the underlying hardware. 
     In particular embodiments, the one or more real-time sensor data may comprise a current clock speed for one of the one or more processors  104 , a current utilization of the storage media  106 , a current level of battery, a current network connectivity, a current network utilization, a current status for one of the one or more displays  112 , a current device temperature, or any suitable real-time sensor data associated with the electronic device  100 . As an example and not by way of limitation, continuing with a prior example, the mobile phone may have one or more sensors  221 . Each of the one or more sensors  221  may be associated with the one or more processors  104 , the one or more non-transitory computer-readable storage media  106 , the one or more displays  112 , the battery-based power source  118 , the network interface  116 , the I/O interfaces  120  or any suitable hardware component of the mobile device. Each of the one or more sensors  221  may monitor a corresponding hardware component and generate corresponding sensor data. The sensor hub  223  of the mobile phone  100  may access the generated sensor data. The generated sensor data. Although this disclosure describes particular real-time sensor data generated by particular sensors, this disclosure contemplates any suitable real-time sensor data generated by any suitable sensors. 
     In particular embodiments, the microcontroller  213  may determine that an anomalous event has occurred on the electronic device  100  by processing the one or more real-time sensor data with a machine-learning model running on the microcontroller  213 . In particular embodiments, the microcontroller  213  may process the one or more real-time sensor data with the machine-learning model  215  at a regular interval. In particular embodiments, the machine-learning model  215  may take a snapshot of the one or more real-time sensor data as input. In particular embodiments, the machine-learning model  215  may be a recursive neural network that considers a trend of the one or more real-time sensor data to produce an output. In particular embodiments, the machine-learning model  215  may be a binary classifier that may determine whether an anomalous event has occurred on the electronic device  100 . In particular embodiments, the machine-learning model  215  may be a multiclass classifier that may determine what type of anomalous event has occurred. As an example and not by way of limitation, continuing with a prior example, a TinyML-based classifier  215  may be installed on the sensor hub  213 . TinyML may be used for embedded machine-learning applications. TinyML may be optimized for resource constrained environments. For example, a TinyML-based machine-learning model may run on a microcontroller with a few kilobytes memory and the processing power in a few megahertz. The sensor hub  213  may process the sensor data from the one or more sensors  211  with the classifier  215  at a predefined interval. The classifier  215  may be a Long Short-Term Memory (LSTM) model that may take a sequence of the sensor data to determine whether an anomalous event has occurred on the mobile phone  100 . In particular embodiments, the classifier  215  may produce a binary output indicating whether an anomalous event has occurred on the mobile phone  100  or not. In particular embodiments, the classifier  215  may produce one of a plural values. Each of the plural values may indicate a type of anomalous event including, but not limited to, no anomalous event, an anomalous event associated with overloaded processors, an anomalous event associated with high memory utilization, an anomalous event associated with lost network connectivity, an anomalous event associated with high network utilization, an anomalous event associated with high device temperature, or an anomalous event associated with any suitable condition for an anomalous event. Although this disclosure describes determining that an anomalous event has occurred on an electronic device in a particular manner, this disclosure contemplates determining that an anomalous event has occurred on an electronic device in any suitable manner. 
     In particular embodiments, the machine-learning model  215  may have been trained using sensor data collected from electronic devices having hardware configurations substantially similar to the electronic device  100 . The collected sensor data may be labelled.  FIG. 3  illustrates an example scenario for deploying a pre-trained machine-learning model to electronic devices. As an example and not by way of limitation, illustrated in  FIG. 3 , an employer may distribute smartphones  320 A,  320 B,  320 C,  320 D, and  320 E to its employees. The distributed smartphones may be one of a number of selected models from a smartphone manufacturer. Thus, hardware configurations for those distributed smartphones may be substantially similar to each other. The employer may want to deploy a microcontroller-based system monitoring tool on each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E. A central controller  310  may have a pre-trained machine-learning model with training data collected from electronic devices that have hardware configurations substantially similar to each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E. The collected training data may have been labelled. The central controller  310  may load the pre-trained machine-learning model to each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E through a network  305  when each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E is activated. The central controller  310  may update the pre-trained machine-learning model with new training data. Then, the central controller  310  may replace the loaded machine-learning model on each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E with the updated pre-trained machine-learning model through the network  305 . In particular embodiments, the central controller  310  may be associated with the employer. In particular embodiments, the central controller  310  may be associated with the manufacturer of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E. Although this disclosure describes loading a machine-learning model trained with training data collected from electronic devices having hardware configurations substantially similar to an electronic device in a particular manner, this disclosure contemplates loading a machine-learning model trained with training data collected from electronic devices having hardware configurations substantially similar to an electronic device in any suitable manner. 
     In particular embodiments, the machine-learning model may have been trained using sensor data collected from electronic devices having software configurations substantially similar to the electronic device  100 . The collected sensor data may be labelled. As an example and not by way of limitation, continuing with a prior example illustrated in  FIG. 3 , a set of work-related applications may be installed on the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E. Each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E may also have a number of applications installed by a corresponding employee. Thus, the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E may have software configurations substantially similar to each other. A central controller  310  may have a pre-trained machine-learning model with training data collected from electronic devices that have the set of work-related applications. Thus, the electronic devices that have produced the training data may have software configurations substantially similar to each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E. The collected training data may have been labelled. The central controller  310  may load the pre-trained machine-learning model to each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E through a network  305  when each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E is activated. The central controller  310  may update the pre-trained machine-learning model with new training data collected from electronic device having software configurations substantially similar to each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E. Then, the central controller  310  may replace the loaded machine-learning model on each of the distributed smartphones  320 A,  320 B,  320 C,  320 D, and  320 E with the updated pre-trained machine-learning model through the network  305 . Although this disclosure describes loading a machine-learning model trained with training data collected from electronic devices having software configurations substantially similar to an electronic device in a particular manner, this disclosure contemplates loading a machine-learning model trained with training data collected from electronic devices having software configurations substantially similar to an electronic device in any suitable manner. 
     In particular embodiments, the microcontroller  213  may send a notification regarding the anomalous event to an application running on the electronic device  100  upon the determination that the anomalous event has occurred. In particular embodiments, the microcontroller  213  may trigger a system interrupt to send the notification. In particular embodiments, the microcontroller  213  may send a notification to the application in any suitable way other than triggering a system interrupt.  FIG. 4  illustrates an example delivery of a notification using a system interrupt. As an example and not by way of limitation, illustrated in  FIG. 4 , a sensor hub  213 , at step  410 , may determine that an anomalous event has occurred on the electronic device  100  by processing the real-time sensor data with a machine-learning model  215  running on the sensor hub  213 . At step  420 , the sensor hub  213  may generate a system interrupt to send a notification to a system monitoring application  405  on the electronic device  100 . The operating system  401  on the electronic device may halt a module running on one of the processors  104  and store the state information associated with the halted module. At step  430 , the operating system  401  may resume the system monitoring application  405  on the one of the processors  104  by calling a function of the system monitoring application  405  associated with the interrupt. Although this disclosure describes sending a notification regarding an anomalous event to an application in a particular manner, this disclosure contemplates sending a notification regarding an anomalous event to an application in any suitable manner. 
     In particular embodiments, the application  405  may take further actions to determine whether the anomalous event is associated with an abnormal operation mode of the electronic device  100 . In particular embodiments, at least one hardware component of the electronic device  100  may be malfunctioning when the electronic device  100  is in the abnormal operation mode. In particular embodiments, at least one software component of the electronic device  100  may be malfunctioning when the electronic device  100  is in the abnormal operation mode. As an example and not by way of limitation, continuing with a prior example illustrated in  FIG. 4 , at step  440 , the system monitoring application  405  may take further actions to determine whether the anomalous event is associated with an abnormal operation mode of the electronic device  100 . In particular embodiments, for taking the further actions, the system monitoring application  405  may access the real-time sensor data used for determining that an anomalous event has occurred by the sensor hub  213 . The system monitoring application  405  may collect additional data from hardware and software of the electronic device  100 . In particular embodiments, the system monitoring application  405  may analyze the accessed sensor data and the collected additional data to determine whether the anomalous event is associated with an abnormal operation mode of the electronic device  100 . The system monitoring application  405  may use a machine-learning model for the analysis. In particular embodiments, the system monitoring application  405  may send the accessed sensor data and the collected additional data to a cloud application. The cloud application may perform a deep analysis on the received sensor data and the collected additional data to determine whether the anomalous event is associated with an abnormal operation mode. The cloud application may send a response including a result to the system monitoring applications  405 . The cloud application may store the received sensor data and the result of the deep analysis. The stored sensor data and the result may be used as training data for training the pre-trained machine-learning model in the example illustrated in  FIG. 3 . Although this disclosure describes particular actions for determining whether the anomalous event is associated with an abnormal operation mode of the electronic device, this disclosure contemplates any suitable actions for determining whether the anomalous event is associated with an abnormal operation mode of the electronic device. 
     In particular embodiments, the application  405  may provide a visual notification to a user on one or more of the displays  112 . The visual notification may comprise one or more choices for the user to provide a confirmation or a rejection to the visual notification. The application may receive a selection among the one or more choices from the user.  FIG. 5  illustrates an example visual notification regarding an anomalous event. As an example and not by way of limitation, illustrated in  FIG. 5 , continuing with a prior example illustrated in  FIG. 4 , the system monitoring application  405  may provide a message box  520  on a touch-enabled display  510  of the electronic device  100 . The message box  520  may comprise a message: “System detects that the battery drains unusually fast in the last 30 minutes. Do you cause the fast battery drain?” In the example illustrated in  FIG. 5 , the anomalous event may be associated with fast battery drain. In particular embodiments, the system monitoring application  405  may identify a type of the anomalous event based on the notification from the sensor hub  213 . In particular embodiments, the system monitoring application  405  may identify a type of the anomalous event based on an analysis of additional information gathered by the system monitoring application  405 . In particular embodiments, the system monitoring application  405  may identify a type of the anomalous event based on a feedback from the cloud application. The message box may also comprise two buttons  521  and  523  for the user to select her answer to the given question. If the user has been playing a video game that consume the battery fast on the electronic device  100 , the user may select ‘Yes’  521  to indicate that the anomalous event is caused by the user. Thus, the electronic device  100  may not be in an abnormal operation mode. Based on this selection of the user, the machine-learning model  215  may be updated such that a probability for determining that an anomalous event has occurred on the electronic device  100  based on the substantially similar sensor data is reduced. If the user is not aware of any activity that potentially drain the battery fast, the user may select ‘No’  523 . On receiving ‘No’  523  from the user in this particular example, the system monitoring application  405  may determine that the anomalous event is associated with an abnormal operation mode of the electronic device  100 . Although this disclosure describes a particular user interface for getting input associated with the anomalous event from a user, this disclosure contemplates any suitable user interface for getting input associated with the anomalous event from a user. 
     In particular embodiments, the application may provide a result of the determination whether the anomalous event is associated with an abnormal operation mode of the electronic device  100  to the microcontroller  213 . As an example and not by way of limitation, continuing with a prior example illustrated in  FIG. 4 , the system monitoring application  405 , at step  450 , may provide a feedback including a result of the determination whether the anomalous event is associated with an abnormal operation mode of the electronic device  100  to the sensor hub  213 . The result of determination may be that the anomalous event is associated with an abnormal operation mode, or the anomalous event is not associated with an abnormal operation mode. In particular embodiments, the system monitoring application  405  may determine whether the anomalous event is associated with an abnormal operation mode of the electronic device  100  based on an analysis performed by the system monitoring application  405 . In particular embodiments, the system monitoring application  405  may determine whether the anomalous event is associated with an abnormal operation mode of the electronic device  100  based on a feedback from the cloud application after providing data to the cloud application. In particular embodiments, the system monitoring application  405  may determine whether the anomalous event is associated with an abnormal operation mode of the electronic device  100  based on an input from a user associated with the electronic device  100 . Although this disclosure describes providing a feedback to the microcontroller in a particular manner, this disclosure contemplates providing a feedback to the microcontroller in any suitable manner. 
     In particular embodiments, the microcontroller  213  may receive the result from the application. The microcontroller  213  may update the machine-learning model based on the received result. As an example and not by way of limitation, continuing with a prior example illustrated in  FIG. 4 , the sensor hub  213 , at step  450 , may receive a feedback indicating a result of the determination whether the anomalous event is associated with an abnormal operation mode of the electronic device  100  from the system monitoring application  405 . The sensor hub  213  may update the machine-learning model  215  running on the sensor hub  213  with the sensor data used for determining that the anomalous event has occurred on the electronic device  100  and the feedback from the system monitoring application  405 . The feedback may be used as a label for the sensor data used for determining the anomalous event has occurred on the electronic device  100 . With a pair of the sensor data and the feedback, the machine-learning model  215  may be updated. The sensor hub  213  may produce a result by processing the sensor data with the machine-learning model  215 . The sensor hub  213  may compute a loss by comparing the produced result and the feedback from the system monitoring application  405 . The sensor hub  213  may compute gradients based on the computed loss. The sensor hub  213  may update parameters of the machine-learning model  215  during a gradient descent backpropagation procedure. Although this disclosure describes updating a machine-learning model based on a feedback from an application in a particular manner, this disclosure contemplates updating a machine-learning model based on a feedback from an application in any suitable manner. 
     In particular embodiments, the electronic device  100  may enter into an idle mode when the electronic device  100  has not detected any activity on installed applications for a pre-determined duration of time. The electronic device  100  enters into an active mode when the electronic device  100  detects an activity on any of the installed applications. The microcontroller  213  may keep the determining regardless of a mode the electronic device  100  is on. As an example and not by way of limitation, continuing with a prior example illustrated in  FIG. 4 , the electronic device  100  in the idle mode may not enter into the active mode when the sensor hub  213  accesses the sensor data, or analyzes the accessed sensor data using the machine-learning model  215 . The electronic device  100  may enter into the active mode only when the system monitoring application  405  is taking further actions upon receiving a notification from the sensor hub  213 . Since the sensor hub  213  performs operations independent of the mode of the electronic device  100 , an always-on monitoring of the performance and the utilization of the underlying hardware on the sensor hub  213  may preserve the battery considerably compared to a monitoring of the performance and the utilization of the hardware on a system level application. Although this disclosure describes preserving battery using a microcontroller in a particular manner, this disclosure contemplates preserving battery using a microcontroller in any suitable manner. 
       FIG. 6  illustrates is a flow diagram of a method  600  for determining whether an anomalous event has occurred on an electronic device, in accordance with the presently disclosed embodiments. The method  600  may begin at step  610 , where a microcontroller associated with an electronic device may access one or more real-time sensor data associated with the one or more sensors. At step  620 , the microcontroller may determine that an anomalous event has occurred on the electronic device by processing the one or more real-time sensor data with a machine-learning model that is running on the microcontroller. At step  630 , the microcontroller may send, upon the determination that the anomalous event has occurred, a notification regarding the anomalous event to an application running on the electronic device. Particular embodiments may repeat one or more steps of the method of  FIG. 6 , where appropriate. Although this disclosure describes and illustrates particular steps of the method of  FIG. 6  as occurring in a particular order, this disclosure contemplates any suitable steps of the method of  FIG. 6  occurring in any suitable order. Moreover, although this disclosure describes and illustrates an example method for determining whether an anomalous event has occurred on an electronic device including the particular steps of the method of  FIG. 6 , this disclosure contemplates any suitable method for determining whether an anomalous event has occurred on an electronic device including any suitable steps, which may include all, some, or none of the steps of the method of  FIG. 6 , where appropriate. Furthermore, although this disclosure describes and illustrates particular components, devices, or systems carrying out particular steps of the method of  FIG. 6 , this disclosure contemplates any suitable combination of any suitable components, devices, or systems carrying out any suitable steps of the method of  FIG. 6 . 
     Systems and Methods 
       FIG. 7  illustrates an example computer system  700  that may be utilized to perform determining whether an anomalous event has occurred on an electronic device, in accordance with the presently disclosed embodiments. In particular embodiments, one or more computer systems  700  perform one or more steps of one or more methods described or illustrated herein. In particular embodiments, one or more computer systems  700  provide functionality described or illustrated herein. In particular embodiments, software running on one or more computer systems  700  performs one or more steps of one or more methods described or illustrated herein or provides functionality described or illustrated herein. Particular embodiments include one or more portions of one or more computer systems  700 . Herein, reference to a computer system may encompass a computing device, and vice versa, where appropriate. Moreover, reference to a computer system may encompass one or more computer systems, where appropriate. 
     This disclosure contemplates any suitable number of computer systems  700 . This disclosure contemplates computer system  700  taking any suitable physical form. As example and not by way of limitation, computer system  700  may be an embedded computer system, a system-on-chip (SOC), a single-board computer system (SBC) (e.g., a computer-on-module (COM) or system-on-module (SOM)), a desktop computer system, a laptop or notebook computer system, an interactive kiosk, a mainframe, a mesh of computer systems, a mobile telephone, a personal digital assistant (PDA), a server, a tablet computer system, an augmented/virtual reality device, or a combination of two or more of these. Where appropriate, computer system  700  may include one or more computer systems  700 ; be unitary or distributed; span multiple locations; span multiple machines; span multiple data centers; or reside in a cloud, which may include one or more cloud components in one or more networks. 
     Where appropriate, one or more computer systems  700  may perform without substantial spatial or temporal limitation one or more steps of one or more methods described or illustrated herein. As an example, and not by way of limitation, one or more computer systems  700  may perform in real time or in batch mode one or more steps of one or more methods described or illustrated herein. One or more computer systems  700  may perform at different times or at different locations one or more steps of one or more methods described or illustrated herein, where appropriate. 
     In particular embodiments, computer system  700  includes a processor  702 , memory  704 , storage  706 , an input/output (I/O) interface  708 , a communication interface  710 , and a bus  712 . Although this disclosure describes and illustrates a particular computer system having a particular number of particular components in a particular arrangement, this disclosure contemplates any suitable computer system having any suitable number of any suitable components in any suitable arrangement. In particular embodiments, processor  702  includes hardware for executing instructions, such as those making up a computer program. As an example, and not by way of limitation, to execute instructions, processor  702  may retrieve (or fetch) the instructions from an internal register, an internal cache, memory  704 , or storage  706 ; decode and execute them; and then write one or more results to an internal register, an internal cache, memory  704 , or storage  706 . In particular embodiments, processor  702  may include one or more internal caches for data, instructions, or addresses. This disclosure contemplates processor  702  including any suitable number of any suitable internal caches, where appropriate. As an example, and not by way of limitation, processor  702  may include one or more instruction caches, one or more data caches, and one or more translation lookaside buffers (TLBs). Instructions in the instruction caches may be copies of instructions in memory  704  or storage  706 , and the instruction caches may speed up retrieval of those instructions by processor  702 . 
     Data in the data caches may be copies of data in memory  704  or storage  706  for instructions executing at processor  702  to operate on; the results of previous instructions executed at processor  702  for access by subsequent instructions executing at processor  702  or for writing to memory  704  or storage  706 ; or other suitable data. The data caches may speed up read or write operations by processor  702 . The TLBs may speed up virtual-address translation for processor  702 . In particular embodiments, processor  702  may include one or more internal registers for data, instructions, or addresses. This disclosure contemplates processor  702  including any suitable number of any suitable internal registers, where appropriate. Where appropriate, processor  702  may include one or more arithmetic logic units (ALUs); be a multi-core processor; or include one or more processors  702 . Although this disclosure describes and illustrates a particular processor, this disclosure contemplates any suitable processor. 
     In particular embodiments, memory  704  includes main memory for storing instructions for processor  702  to execute or data for processor  702  to operate on. As an example, and not by way of limitation, computer system  700  may load instructions from storage  706  or another source (such as, for example, another computer system  700 ) to memory  704 . Processor  702  may then load the instructions from memory  704  to an internal register or internal cache. To execute the instructions, processor  702  may retrieve the instructions from the internal register or internal cache and decode them. During or after execution of the instructions, processor  702  may write one or more results (which may be intermediate or final results) to the internal register or internal cache. Processor  702  may then write one or more of those results to memory  704 . In particular embodiments, processor  702  executes only instructions in one or more internal registers or internal caches or in memory  704  (as opposed to storage  706  or elsewhere) and operates only on data in one or more internal registers or internal caches or in memory  704  (as opposed to storage  706  or elsewhere). 
     One or more memory buses (which may each include an address bus and a data bus) may couple processor  702  to memory  704 . Bus  712  may include one or more memory buses, as described below. In particular embodiments, one or more memory management units (MMUs) reside between processor  702  and memory  704  and facilitate accesses to memory  704  requested by processor  702 . In particular embodiments, memory  704  includes random access memory (RAM). This RAM may be volatile memory, where appropriate. Where appropriate, this RAM may be dynamic RAM (DRAM) or static RAM (SRAM). Moreover, where appropriate, this RAM may be single-ported or multi-ported RAM. This disclosure contemplates any suitable RAM. Memory  704  may include one or more memory devices  704 , where appropriate. Although this disclosure describes and illustrates particular memory, this disclosure contemplates any suitable memory. 
     In particular embodiments, storage  706  includes mass storage for data or instructions. As an example, and not by way of limitation, storage  706  may include a hard disk drive (HDD), a floppy disk drive, flash memory, an optical disc, a magneto-optical disc, magnetic tape, or a Universal Serial Bus (USB) drive or a combination of two or more of these. Storage  706  may include removable or non-removable (or fixed) media, where appropriate. Storage  706  may be internal or external to computer system  700 , where appropriate. In particular embodiments, storage  706  is non-volatile, solid-state memory. In particular embodiments, storage  706  includes read-only memory (ROM). Where appropriate, this ROM may be mask-programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically alterable ROM (EAROM), or flash memory or a combination of two or more of these. This disclosure contemplates mass storage  706  taking any suitable physical form. Storage  706  may include one or more storage control units facilitating communication between processor  702  and storage  706 , where appropriate. Where appropriate, storage  706  may include one or more storages  706 . Although this disclosure describes and illustrates particular storage, this disclosure contemplates any suitable storage. 
     In particular embodiments, I/O interface  708  includes hardware, software, or both, providing one or more interfaces for communication between computer system  700  and one or more I/O devices. Computer system  700  may include one or more of these I/O devices, where appropriate. One or more of these I/O devices may enable communication between a person and computer system  700 . As an example, and not by way of limitation, an I/O device may include a keyboard, keypad, microphone, monitor, mouse, printer, scanner, speaker, still camera, stylus, tablet, touch screen, trackball, video camera, another suitable I/O device or a combination of two or more of these. An I/O device may include one or more sensors. This disclosure contemplates any suitable I/O devices and any suitable I/O interfaces  706  for them. Where appropriate, I/O interface  708  may include one or more device or software drivers enabling processor  702  to drive one or more of these I/O devices. I/O interface  708  may include one or more I/O interfaces  706 , where appropriate. Although this disclosure describes and illustrates a particular I/O interface, this disclosure contemplates any suitable I/O interface. 
     In particular embodiments, communication interface  710  includes hardware, software, or both providing one or more interfaces for communication (such as, for example, packet-based communication) between computer system  700  and one or more other computer systems  700  or one or more networks. As an example, and not by way of limitation, communication interface  710  may include a network interface controller (NIC) or network adapter for communicating with an Ethernet or other wire-based network or a wireless NIC (WNIC) or wireless adapter for communicating with a wireless network, such as a WI-FI network. This disclosure contemplates any suitable network and any suitable communication interface  710  for it. 
     As an example, and not by way of limitation, computer system  700  may communicate with an ad hoc network, a personal area network (PAN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), or one or more portions of the Internet or a combination of two or more of these. One or more portions of one or more of these networks may be wired or wireless. As an example, computer system  700  may communicate with a wireless PAN (WPAN) (such as, for example, a BLUETOOTH WPAN), a WI-FI network, a WI-MAX network, a cellular telephone network (such as, for example, a Global System for Mobile Communications (GSM) network), or other suitable wireless network or a combination of two or more of these. Computer system  700  may include any suitable communication interface  710  for any of these networks, where appropriate. Communication interface  710  may include one or more communication interfaces  710 , where appropriate. Although this disclosure describes and illustrates a particular communication interface, this disclosure contemplates any suitable communication interface. 
     In particular embodiments, bus  712  includes hardware, software, or both coupling components of computer system  700  to each other. As an example, and not by way of limitation, bus  712  may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a front-side bus (FSB), a HYPERTRANSPORT (HT) interconnect, an Industry Standard Architecture (ISA) bus, an INFINIBAND interconnect, a low-pin-count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCIe) bus, a serial advanced technology attachment (SATA) bus, a Video Electronics Standards Association local (VLB) bus, or another suitable bus or a combination of two or more of these. Bus  712  may include one or more buses  712 , where appropriate. Although this disclosure describes and illustrates a particular bus, this disclosure contemplates any suitable bus or interconnect. 
     AI Architecture 
       FIG. 8  illustrates a diagram  800  of an example artificial intelligence (AI) architecture  802  that may be utilized to perform determining whether an anomalous event has occurred on an electronic device, in accordance with the presently disclosed embodiments. In particular embodiments, the AI architecture  802  may be implemented utilizing, for example, one or more processing devices that may include hardware (e.g., a general purpose processor, a graphic processing unit (GPU), an application-specific integrated circuit (ASIC), a system-on-chip (SoC), a microcontroller, a field-programmable gate array (FPGA), a central processing unit (CPU), an application processor (AP), a visual processing unit (VPU), a neural processing unit (NPU), a neural decision processor (NDP), and/or other processing device(s) that may be suitable for processing various data and making one or more decisions based thereon), software (e.g., instructions running/executing on one or more processing devices), firmware (e.g., microcode), or some combination thereof. 
     In particular embodiments, as depicted by  FIG. 8 , the AI architecture  802  may include machine leaning (ML) algorithms and functions  804 , natural language processing (NLP) algorithms and functions  806 , expert systems  808 , computer-based vision algorithms and functions  810 , speech recognition algorithms and functions  812 , planning algorithms and functions  814 , and robotics algorithms and functions  816 . In particular embodiments, the ML algorithms and functions  804  may include any statistics-based algorithms that may be suitable for finding patterns across large amounts of data (e.g., “Big Data” such as user click data or other user interactions, text data, image data, video data, audio data, speech data, numbers data, and so forth). For example, in particular embodiments, the ML algorithms and functions  804  may include deep learning algorithms  818 , supervised learning algorithms  820 , and unsupervised learning algorithms  822 . 
     In particular embodiments, the deep learning algorithms  818  may include any artificial neural networks (ANNs) that may be utilized to learn deep levels of representations and abstractions from large amounts of data. For example, the deep learning algorithms  818  may include ANNs, such as a multilayer perceptron (MLP), an autoencoder (AE), a convolution neural network (CNN), a recurrent neural network (RNN), long short term memory (LSTM), a grated recurrent unit (GRU), a restricted Boltzmann Machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), a generative adversarial network (GAN), and deep Q-networks, a neural autoregressive distribution estimation (NADE), an adversarial network (AN), attentional models (AM), deep reinforcement learning, and so forth. 
     In particular embodiments, the supervised learning algorithms  820  may include any algorithms that may be utilized to apply, for example, what has been learned in the past to new data using labeled examples for predicting future events. For example, starting from the analysis of a known training dataset, the supervised learning algorithms  820  may produce an inferred function to make predictions about the output values. The supervised learning algorithms  820  can also compare its output with the correct and intended output and find errors in order to modify the supervised learning algorithms  820  accordingly. On the other hand, the unsupervised learning algorithms  822  may include any algorithms that may applied, for example, when the data used to train the unsupervised learning algorithms  822  are neither classified nor labeled. For example, the unsupervised learning algorithms  822  may study and analyze how systems may infer a function to describe a hidden structure from unlabeled data. 
     In particular embodiments, the NLP algorithms and functions  806  may include any algorithms or functions that may be suitable for automatically manipulating natural language, such as speech and/or text. For example, in particular embodiments, the NLP algorithms and functions  806  may include content extraction algorithms or functions  824 , classification algorithms or functions  826 , machine translation algorithms or functions  828 , question answering (QA) algorithms or functions  830 , and text generation algorithms or functions  832 . In particular embodiments, the content extraction algorithms or functions  824  may include a means for extracting text or images from electronic documents (e.g., webpages, text editor documents, and so forth) to be utilized, for example, in other applications. 
     In particular embodiments, the classification algorithms or functions  826  may include any algorithms that may utilize a supervised learning model (e.g., logistic regression, naïve Bayes, stochastic gradient descent (SGD), k-nearest neighbors, decision trees, random forests, support vector machine (SVM), and so forth) to learn from the data input to the supervised learning model and to make new observations or classifications based thereon. The machine translation algorithms or functions  828  may include any algorithms or functions that may be suitable for automatically converting source text in one language, for example, into text in another language. The QA algorithms or functions  830  may include any algorithms or functions that may be suitable for automatically answering questions posed by humans in, for example, a natural language, such as that performed by voice-controlled personal assistant devices. The text generation algorithms or functions  832  may include any algorithms or functions that may be suitable for automatically generating natural language texts. 
     In particular embodiments, the expert systems  808  may include any algorithms or functions that may be suitable for simulating the judgment and behavior of a human or an organization that has expert knowledge and experience in a particular field (e.g., stock trading, medicine, sports statistics, and so forth). The computer-based vision algorithms and functions  810  may include any algorithms or functions that may be suitable for automatically extracting information from images (e.g., photo images, video images). For example, the computer-based vision algorithms and functions  810  may include image recognition algorithms  834  and machine vision algorithms  836 . The image recognition algorithms  834  may include any algorithms that may be suitable for automatically identifying and/or classifying objects, places, people, and so forth that may be included in, for example, one or more image frames or other displayed data. The machine vision algorithms  836  may include any algorithms that may be suitable for allowing computers to “see”, or, for example, to rely on image sensors cameras with specialized optics to acquire images for processing, analyzing, and/or measuring various data characteristics for decision making purposes. 
     In particular embodiments, the speech recognition algorithms and functions  812  may include any algorithms or functions that may be suitable for recognizing and translating spoken language into text, such as through automatic speech recognition (ASR), computer speech recognition, speech-to-text (STT), or text-to-speech (TTS) in order for the computing to communicate via speech with one or more users, for example. In particular embodiments, the planning algorithms and functions  838  may include any algorithms or functions that may be suitable for generating a sequence of actions, in which each action may include its own set of preconditions to be satisfied before performing the action. Examples of AI planning may include classical planning, reduction to other problems, temporal planning, probabilistic planning, preference-based planning, conditional planning, and so forth. Lastly, the robotics algorithms and functions  840  may include any algorithms, functions, or systems that may enable one or more devices to replicate human behavior through, for example, motions, gestures, performance tasks, decision-making, emotions, and so forth. 
     Herein, a computer-readable non-transitory storage medium or media may include one or more semiconductor-based or other integrated circuits (ICs) (such, as for example, field-programmable gate arrays (FPGAs) or application-specific ICs (ASICs)), hard disk drives (HDDs), hybrid hard drives (HHDs), optical discs, optical disc drives (ODDs), magneto-optical discs, magneto-optical drives, floppy diskettes, floppy disk drives (FDDs), magnetic tapes, solid-state drives (SSDs), RAM-drives, SECURE DIGITAL cards or drives, any other suitable computer-readable non-transitory storage media, or any suitable combination of two or more of these, where appropriate. A computer-readable non-transitory storage medium may be volatile, non-volatile, or a combination of volatile and non-volatile, where appropriate. 
     Miscellaneous 
     Herein, “or” is inclusive and not exclusive, unless expressly indicated otherwise or indicated otherwise by context. Therefore, herein, “A or B” means “A, B, or both,” unless expressly indicated otherwise or indicated otherwise by context. Moreover, “and” is both joint and several, unless expressly indicated otherwise or indicated otherwise by context. Therefore, herein, “A and B” means “A and B, jointly or severally,” unless expressly indicated otherwise or indicated otherwise by context. 
     Herein, “automatically” and its derivatives means “without human intervention,” unless expressly indicated otherwise or indicated otherwise by context. 
     The embodiments disclosed herein are only examples, and the scope of this disclosure is not limited to them. Embodiments according to the invention are in particular disclosed in the attached claims directed to a method, a storage medium, a system and a computer program product, wherein any feature mentioned in one claim category, e.g. method, can be claimed in another claim category, e.g. system, as well. The dependencies or references back in the attached claims are chosen for formal reasons only. However, any subject matter resulting from a deliberate reference back to any previous claims (in particular multiple dependencies) can be claimed as well, so that any combination of claims and the features thereof are disclosed and can be claimed regardless of the dependencies chosen in the attached claims. The subject-matter which can be claimed comprises not only the combinations of features as set out in the attached claims but also any other combination of features in the claims, wherein each feature mentioned in the claims can be combined with any other feature or combination of other features in the claims. Furthermore, any of the embodiments and features described or depicted herein can be claimed in a separate claim and/or in any combination with any embodiment or feature described or depicted herein or with any of the features of the attached claims. 
     The scope of this disclosure encompasses all changes, substitutions, variations, alterations, and modifications to the example embodiments described or illustrated herein that a person having ordinary skill in the art would comprehend. The scope of this disclosure is not limited to the example embodiments described or illustrated herein. Moreover, although this disclosure describes and illustrates respective embodiments herein as including particular components, elements, feature, functions, operations, or steps, any of these embodiments may include any combination or permutation of any of the components, elements, features, functions, operations, or steps described or illustrated anywhere herein that a person having ordinary skill in the art would comprehend. Furthermore, reference in the appended claims to an apparatus or system or a component of an apparatus or system being adapted to, arranged to, capable of, configured to, enabled to, operable to, or operative to perform a particular function encompasses that apparatus, system, component, whether or not it or that particular function is activated, turned on, or unlocked, as long as that apparatus, system, or component is so adapted, arranged, capable, configured, enabled, operable, or operative. Additionally, although this disclosure describes or illustrates particular embodiments as providing particular advantages, particular embodiments may provide none, some, or all of these advantages.