Intellectual Property India Publishes Patent Application for Deep Learning-Based Real-Time Iot Network Anomaly Detection System With Multi-Model Ensemble And Threat Response Orchestration

MUMBAI, India, Sept. 22 -- Intellectual Property India has published a patent application (202641109597 A) filed by Dr. Jayasheela. C S; Sammeda Jain. T J; Dr. Sumantha. H S; Dr. Gunavathi. H S; Navya Sree. R; Dr. Jyothi. K. R; and Arunkumar. A S on September 12, 2026, for Deep Learning-Based Real-Time Iot Network Anomaly Detection System With Multi-Model Ensemble And Threat Response Orchestration.

Inventors include Dr. Jayasheela. C S; Sammeda Jain. T J; Dr. Sumantha. H S; Dr. Gunavathi. H S; Navya Sree. R; Dr. Jyothi. K. R; and Arunkumar. A S.

The application for the patent was published on September 18, 2026, under issue no. 38/2026.

Abstract: A Deep Learning-Based Real-Time Anomaly Detection System (100) for IoT Network Security provides comprehensive, signature-free detection of both known and novel IoT network attacks through a five-layer architecture. A streaming data ingestion and feature engineering pipeline (300) receives real-time IoT network packet streams via a Kafka or MQTT broker (310), reconstructs bidirectional flows, and computes 64-dimensional NetFlow/IPFIX feature vectors (330) normalised through Z- score standardisation (340) and assembled into 64-packet, 50%-overlap sliding window tensors (350). A multi-model deep learning inference engine (400) applies four concurrently executing model components to each window: an autoencoder reconstruction module (410) detecting novel attacks through mean squared error reconstruction error; a bidirectional LSTM temporal sequence analyser (420) with self-attention layer (430) capturing sequential traffic patterns across 128-unit forward and backward LSTM cells; a 1D CNN multi-class threat classifier (440) producing a 6-class probability vector over DDoS, Botnet, Man-in-the-Middle, Probe, Data Exfiltration, and Benign categories; and a weighted ensemble decision fusion layer (450) combining all three model scores through a learned weighted combination with dynamic weight calibration. High-confidence anomalies are routed to an automated threat response layer (500) executing firewall rule injection (520), device VLAN quarantine (530), SIEM integration (540), and automated incident report generation (550). An online incremental learning module (630) continuously fine-tunes all model components from analyst-confirmed labels using elastic weight consolidation, enabling sub-hourly adaptation to evolving IoT attack patterns. The system produces confirmed anomaly alerts within one second of packet capture.

Disclaimer: Curated by HT Syndication.