Unsupervised Anomaly Alerting for IoT-Gateway Monitoring using Adaptive Thresholds and Half-Space Trees

Through increasingly powerful hardware, the computational resources of IoT-Gateways are growing, enabling more sophisticated data analytics, service deployments and virtualisation capabilities. However, the difficulty of ensuring high reliability of IoT-Gateways and its deployed services increases along with the complexity of digital systems. Reliable operation of such gateways and devices therefore depends on automated methods for detecting abnormal behaviour as early as possible, in order to remediate the situation before the complete failure of a system component. We propose an unsupervised anomaly detection algorithm by extending the concept of Half-Space Trees through online adaptive thresholds for real-time computation. The anomaly detector consumes multidimensional time series data from an external monitoring component and is fixed in computational complexity to support real-time operation. In order to determine valuable hyperparameters, we propose a data stream and anomaly simulation system, providing options for pattern induced load simulations and different types of anomalies. Further, we evaluate the anomaly detection method on monitoring data originating from a deployment of the open source software Project Clearwater, a lightweight implementation of the IP-Multimedia Subsystem capable of running on VMs with limited resources. Results show the applicability of Half-Space Tree based anomaly detection with high detection rates (99:4%) and low number of false alarms (< 3%).