"Unlike existing approaches, iSentinel utilizes three stages for anomaly detection with low false alarms: (1) the neuromorphic chip for continuous online monitoring and classification, (2) our EWS algorithms run on the mobile device CPU for closer inspection of alerts, and (3) the offline backend server for group behavior analysis"
HRL Labs have a couple of relevant patents/applications.
US10986113 is directly related to the article.
They do not describe their neurons or NPU, but their custom NN contains 576 neurons, so this does not exclude the use of Akida IP.
As to STDP, they use it and "neuron" in the manner of res ipsa loquiter, something which would displease Ella.
US10986113B2 System for continuous validation and threat protection of mobile applications
equivalent to WO2019147330A1 SYSTEM FOR CONTINUOUS VALIDATION AND PROTECTION OF MOBILE APPLICATIONS
Described is a low power system for mobile devices that provides continuous, behavior-based security validation of mobile device applications using neuromorphic hardware. A mobile device comprises a neuromorphic hardware component that runs on the mobile device for continuously monitoring time series related to individual mobile device application behaviors, detecting and classifying pattern anomalies associated with a known malware threat in the time series related to individual mobile device application behaviors, and generating an alert related to the known malware threat. The mobile device identifies pattern anomalies in dependency relationships of mobile device inter-application and intra-applications communications, detects pattern anomalies associated with new malware threats, and isolates a mobile device application having a risk of malware above a predetermined threshold relative to a risk management policy.
[0094] In one embodiment, a neuromorphic chip 306 is used in the first stage 310 of the system. There are several unique features of the hardware design. First, the hardware 306 computes with spikes 320 (fixed voltage pulses of very narrow width (i.e., on the order of 1-2 ms) rather than analog or digital encoding. This mode of encoding is data agnostic and is orders of magnitude more energy efficient compared to a digital system since it only consumes energy during the generation of spikes 320 . Spiking hardware 306 represents signals based on the inter-spike intervals and, thus, is more area efficient since it requires a single wire to encode and transmit information unlike digital systems. Finally, it is more scalable than pure analog systems as spike based systems only require to transmit the timing but not both timing and amplitude parts of the signal in large scale systems
[0095] Various models and algorithms have been developed that can compute with spikes 320 and, in particular, have shown that these models can perform multimodal pattern clustering and recognition as well as associative memories with high storage capacity. For instance, the on-chip learning capabilities can enable the neuromorphic chip 306 to be deployed in one of three modes of operation: unsupervised learning mode (see Literature Reference No. 33) where there is no human in the loop or ground truth, supervised learning mode (see Literature Reference No. 34) where the user can train the chip 306 to learn (for example the classes of objects) and then deployed after the learning is completed or in a reinforcement learning mode (see Literature Reference Nos. 35 and 40), where the chip 306 receives periodic quality of performance feedback (for example, good, bad, etc.) that enables the neuromorphic chip 306 to adapt and learn on-chip. This on-chip learning capability also offers minimal programming, interfacing and software cost while enabling rapid prototyping possibilities. The inputs to the chip 306 will be in the form of spike trains (element 320 ) encoded offline and then fed to the chip 306 , and the neural network on the chip 306 will process the incoming spikes 320 .
[0096] In this mode of operation, the chip 306 functions as a plastic reservoir where the synapses between neurons in the reservoir adapt the gain on the synapses based on spike timing dependent plasticity (STDP). This process is akin to a nonlinear and high-dimensional projection of sensory data into a spatio-temporal space where the data can be readily separated using linear decision boundaries. More specifically, during training, to realize the linear decision boundaries, the spiking activity of a subset of the neurons in the chip 306 is decoded via the output pads and performs a linear regression based learning operation, wherein the firing rates of the neurons sampled at the output pads are linearly combined to cause an output label neuron to fire.
[0098] ... Each synapse includes a weight adaptation circuit based on STDP. To operate, the chip custom boards are specified. These boards are used to interface the chip 306 with a computer. The boards can be used for initial evaluation of different processing neural networks in the chip 306
[0102] The 576-neuron neuromorphic hardware 306 described above has been utilized to perform learned classification of input signals. FIG. 7 depicts a random neural net as configured on a 576-neuron neuromorphic chip.
########################################################
US9336239 is a much earlier HRL patent which also relates to cyber security, and may have been the original basis for the above, albeit it uses "conventional computer" neural network software, possibly something like BrainChip Studio.
US9336239B1 System and method for deep packet inspection and intrusion detection
The present invention relates to a system for deep packet inspection and intrusion detection. The system uses a pattern matching module receiving as an input a data stream in a neural network. Neurons are activated such that when active, the neuron fires to all connecting output neurons to form a neuron spike, each neuron spike from the assigned neuron to a connecting output neuron having a delay. A delay is associated with each input character in the pattern, such that a position of each input character relative to an end of the pattern is stored in an alphabet-pattern-delay matrix (APDFM). An activation matrix (AM) is used to match each input character with a stored pattern to generate a similarity match and determine if the string of characters is the stored pattern.
[0001] This is a Continuation-in-Part application of U.S. Non-Provisional Application No. 13/358,095, filed on Jan. 25, 2012, and entitled, “Neural Network Device with Engineered Delays for Pattern Storage and Matching,” which is a non-provisional application of U.S. Provisional Application No. 61/501,636, filed on Jun. 27, 2011 and entitled, “Neural Network Device with Engineered Delays for Pattern Storage and Matching.”
[0002] This is ALSO non-provisional patent application of U.S. Provisional Application No. 61/589,666. filed on Jan. 23, 2012, entitled, “System and Method for Deep Packet Inspection and Intrusion Detection.”
[0015] ... For example, the system receives as an input a data stream in a neural network. The data stream has a sequence of characters in a pattern and is received in the neural network such that at each time t, only a single input character is received. Each single input character assigned to a neuron in the neural network. The neuron assigned to the single character is activated such that when active, the neuron fires to all connecting output neurons to form a neuron spike, with each neuron spike from the assigned neuron to a connecting output neuron having a delay. A delay associated with each input character in the pattern is determined, such that a position of each input character relative to an end of the pattern is stored in an alphabet-pattern-delay matrix (APDFM). Finally, using an activation matrix (AM), each input character is matched with a stored pattern to generate a similarity match, such that if the similarity match exceeds a predetermined threshold, the sequence of characters in the input data stream is identified as the stored pattern.
[0061] ... the present invention is directed to an intrusion detection system that is operable for performing Deep Packet Inspection (DPI) at wire speeds in software running on conventional processors. The system uses an underlying detection engine (MagicNet) that is based on the relatively new theory of polychronous spiking neural models. The system uses a new and different paradigm than other recent spiking models and liquid state machines in that the network conduction delays are set to optimize detection of specific known patterns of interest (exact pattern matching). By setting the network conduction delays, the system is adapted to provide a more efficient detection than previous methods. In special purpose parallel hardware or a neuromorphic implementation, the system and method is operable for detecting attack signatures at wire speeds greater than 1 Tbps, and with much lower size, weight, and power than conventional methods.
FF
FF
