Real-time machine learning at an edge of a distributed network

{
  "publication_number": "US11762442B1",
  "country": "US",
  "kind": "B1",
  "title": "Real-time machine learning at an edge of a distributed network",
  "abstract": "Various implementations of the present application set forth a computer-implemented method comprising obtaining, by a low-power hub device, a first set of data published by an edge device, where the low-power hub device subscribes to at least a subset of data published by the edge device, generating, by the low-power hub device, a second set of data from the first set of data by inputting the first set of data into a machine learning (ML) model executing on the low-power hub device, and transmitting the second set of data to a remote server computer system.",
  "claims": [
    "1. A computer-implemented method comprising: obtaining, by a low-power hub device, a first set of data published by an edge device, wherein the low-power hub device subscribes to at least a subset of data published by the edge device; generating, by the low-power hub device, a second set of data from the first set of data by inputting the first set of data into a machine learning (ML) model executing on the low-power hub device; updating, by the low-power hub device, the ML model with the second set of data to generate an updated ML model to replace the ML model executing on the low-power hub device; and transmitting the second set of data to a remote server computer system.",
    "2. The computer-implemented method of claim 1, wherein: the edge device includes a sensor that acquires sensor data; and the subset of data includes a portion of the acquired sensor data.",
    "3. The computer-implemented method of claim 1, wherein the ML model generates the second set of data by performing a filtering operation on the first set of data.",
    "4. The computer-implemented method of claim 1, wherein: the first set of data is associated with a pre-determined event occurring within an environment; and the second set of data includes an estimated frequency of the event occurring.",
    "5. The computer-implemented method of claim 1, wherein: the ML model is trained using a third set of data to generate a threshold, the third set of data includes data previously published by the edge device; and the ML model generates the second set of data by analyzing the first set of data for an anomaly compared to the generated threshold.",
    "6. The computer-implemented method of claim 1, further comprising receiving, from the remote server computer system, the ML model, wherein the ML model was trained using a training set associated with data published by the edge device.",
    "7. The computer-implemented method of claim 1, further comprising: receiving, from the remote server computer system, the ML model, wherein the ML model was trained using a training data set associated with data published by the edge device; receiving, from the remote server computer system, a second updated ML model, wherein the updated ML model is based on an updated training data set associated with the data published by the edge device; and replacing the updated ML model with the second updated ML model.",
    "8. The computer-implemented method of claim 1, wherein the low-power hub device executes the ML model in a virtual runtime environment.",
    "9. The computer-implemented method of claim 1, wherein the low-power hub device is included in a set of low-power hub devices, and the remote server computer system: receives, from each low-power hub device included in the set of low-power hub devices, a data set associated with a first topic; and aggregates the data sets to generate an aggregate data set.",
    "10. The computer-implemented method of claim 1, further comprising storing, in a local data store, the second set of data.",
    "11. The computer-implemented method of claim 1, wherein the low-power hub device is a subscriber to a first topic, and the edge device is a publisher to the first topic.",
    "12. One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of: obtaining, by a low-power hub device, a first set of data published by an edge device, wherein the low-power hub device subscribes to at least a subset of data published by the edge device; generating, by the low-power hub device, a second set of data from the first set of data by inputting the first set of data into a machine learning (ML) model executing on the low-power hub device; updating, by the low-power hub device, the ML model with the second set of data to generate an updated ML model to replace the ML model executing on the low-power hub device; and transmitting the second set of data to a remote server computer system.",
    "13. The one or more non-transitory computer-readable media of claim 12, wherein: the edge device includes a sensor that acquires sensor data; and the subset of data includes a portion of the acquired sensor data.",
    "14. The one or more non-transitory computer-readable media of claim 12, wherein: the ML model is trained using a third set of data to generate a threshold, the third set of data includes data previously published by the edge device; and the ML model generates the second set of data by analyzing the first set of data for an anomaly compared to the generated threshold.",
    "15. The one or more non-transitory computer-readable media of claim 12, further comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform the steps of: receiving, from the remote server computer system, the ML model, wherein the ML model was trained using a training data set associated with data published by the edge device; receiving, from the remote server computer system, a second updated ML model, wherein the updated ML model is based on an updated training data set associated with the data published by the edge device; and replacing the updated ML model with the second updated ML model.",
    "16. The one or more non-transitory computer-readable media of claim 12, wherein the low-power hub device executes the ML model in a virtual runtime environment.",
    "17. A computing system comprising: an edge device that publishes data; a remote server computer system; and a low-power hub device comprising a memory that includes a sensor monitoring application, and a processor that is coupled to the memory and, when executing the sensor monitoring application, performs the steps of: obtaining a first set of data published by the edge device, wherein the low-power hub device subscribes to at least a subset of data published by the edge device; generating a second set of data from the first set of data by inputting the first set of data into a machine learning (ML) model executing on the low-power hub device; updating, by the low-power hub device, the ML model with the second set of data to generate an updated ML model to replace the ML model executing on the low-power hub device; and transmitting the second set of data to the remote server computer system.",
    "18. The computing system of claim 17, wherein: the edge device includes a sensor that acquires sensor data; and the subset of data includes a portion of the acquired sensor data.",
    "19. The computing system of claim 17, wherein: the ML model is trained using a third set of data to generate a threshold, the third set of data includes data previously published by the edge device; and the ML model generates the second set of data by analyzing the first set of data for an anomaly compared to the generated threshold.",
    "20. The computing system of claim 17, further comprising a set of low-power hub devices that includes the low-power hub device, wherein the remote server computer system: receives, from each low-power hub device included in the set of low-power hub devices, a data set associated with a first topic; and aggregates the data sets to generate an aggregate data set."
  ],
  "description_excerpt": "The present disclosure relates generally to computer networks, and more specifically, to real-time machine learning at an edge of a distributed network.\n\nMany information technology (IT) environments enable the access of massive quantities of diverse data stored across multiple data sources. For example, an IT environment could enable users to access text documents, user-generated data stored in a variety of relational database management systems, and machine-generated data stored in systems, such as SPLUNK® ENTERPRISE systems. While the availability of massive quantities of diverse data provides opportunities to derive new insights that increase the usefulness and value of IT systems, a common problem associated with IT environments is that curating, searching, and analyzing the data is quite technically challenging.\n\nIn particular, various deployments of devices within a distributed environment require near-constant processing of data. Various conventional approaches require that all relevant data be transmitted to centralized devices in order to perform complex processing and analysis based on the accumulated data. Based on acquiring and processing large volumes of data, users may identify certain behaviors and act with respect to particular devices or particular environmental conditions.\n\nSo that the manner in which the above recited features of the invention can be understood in detail, a more particular description of the invention may be had by reference to implementations, some of which are illustrated in the appended drawings.",
  "cpc": [
    "G06F 1/266",
    "G06F 1/3293",
    "G06F 1/3296",
    "G06N 20/00",
    "H04L 67/12"
  ],
  "ipc": [
    "G06F 1/26",
    "G06F 1/3296",
    "G06N 20/00",
    "H04L 67/12"
  ],
  "assignees": [
    "Splunk Inc"
  ],
  "inventors": [
    "Matteo Merli",
    "Karthikeyan Ramasamy",
    "Ram Sriharsha"
  ],
  "filing_date": "2020-07-31",
  "publication_date": "2023-09-19",
  "grant_date": "2023-09-19",
  "priority_date": "2020-07-31",
  "application_number": "US-202016945723-A",
  "family_id": "88067838",
  "cited_by_count": 16,
  "citations": [
    "US20030229471A1",
    "US7937344B2",
    "US8112425B2",
    "US8751529B2",
    "US8788525B2",
    "US9215240B2",
    "US10127258B2",
    "US9286413B1",
    "US20180018508A1",
    "US10007513B2",
    "US20180026942A1",
    "US20210279475A1",
    "US11108575B2",
    "US10980085B2",
    "US20190036716A1",
    "US11412574B2",
    "US20190098106A1",
    "US20210306361A1",
    "US20210302621A1",
    "US11195067B2",
    "US20200327371A1",
    "US20220290090A1",
    "US20210166083A1",
    "US20210177259A1",
    "US20210241926A1"
  ]
}