Leveraging global explanations on a restricted edge environment

1 . A method comprising:

at an edge device, collecting a set of data;

at the edge device, applying an anomaly detection model to the set of data, wherein the anomaly detection model is tasked with analyzing the set of data to detect an anomaly;

in response to the anomaly being detected by the anomaly detection model, applying, at the edge device, an explanation model to the anomaly, wherein the explanation model is tasked with building an explanation for the anomaly, where the explanation includes a conjugation of multiple feature range thresholds comprising a minimum value and a maximum value for each feature;

at the edge device, creating a table comprising an anomaly instance identification for the anomaly and a listing that describes the conjugation of multiple feature range thresholds, wherein creating the table includes filtering additional anomaly instances having a same conjugation of feature-range thresholds so that only a single representative instance is included in the table; and

at the edge device, transmitting the table to a central service, wherein transmitting the table includes homomorphically encrypting the minimum and maximum values of the feature-range thresholds prior to transmission so that raw data values are not transmitted.

2 . The method of claim 1 , wherein the table is encrypted prior to being transmitted to the central service.

3 . The method of claim 1 , wherein the table omits data obtained from the set of data and instead includes the multiple feature ranges.

4 . The method of claim 1 , wherein the method further includes:

identifying an anomaly instance having a same explanation as said anomaly; and

filtering the anomaly instance so that the anomaly instance is omitted from the table.

5 . The method of claim 1 , wherein the edge device is one edge device among a plurality of edge devices that communicate with the central service.

6 . A method comprising:

receiving, from a first edge device, a first table comprising a first anomaly instance identification for a first anomaly and a first listing that describes a first conjugation of multiple feature ranges comprising homomorphically encrypted minimum and maximum feature-range values;

receiving, from a second edge device, a second table comprising a second anomaly instance identification for a second anomaly and a second listing that describes a second conjugation of multiple feature ranges comprising homomorphically encrypted minimum and maximum feature-range values;

creating a central table using the first table and the second table, wherein each row in the central table represents a combination of an edge and anomaly instance identification and each column in the central table represents a feature-range threshold;

applying a pattern mining algorithm comprising an itemset mining algorithm to the central table, wherein the pattern mining algorithm is tasked with identifying whether the second of multiple feature ranges corresponds with the first conjugation of multiple feature ranges;

computing, for each feature appearing in both the first and second conjugation, an intersection of the homomorphically encrypted minimum and maximum values to determine whether the feature-range thresholds overlap across the edge devices;

determining that the second conjugation of multiple feature ranges does correspond with the first conjugation of multiple feature ranges based on determining that the computed intersection is non-empty; and

flagging the first anomaly instance and the second anomaly instance as global anomalies.

7 . The method of claim 6 , wherein the method further includes:

receiving, from a third edge device, a third table comprising a third anomaly instance identification for a third anomaly and a third listing that describes a third conjugation of multiple feature ranges for the third anomaly instance;

including the third table in the central table;

applying the pattern mining algorithm to the central table;

determining that the third conjugation of multiple feature ranges does not correspond with the first conjugation of multiple feature ranges; and

flagging the third anomaly instance as a local anomaly.

8 . The method of claim 6 , wherein the method further includes determining that a third anomaly instance is a local anomaly.

9 . The method of claim 6 , wherein the method further includes notifying the first and second edge devices of the global anomalies.

10 . The method of claim 6 , wherein each row in the central table represents a combination of an edge and anomaly instance identification, and wherein each column in the central table represents a detected feature of a corresponding anomaly.

11 . A method comprising:

collecting a first set of data and a second set of data at respective edge devices;

detecting a first anomaly in the first set of data and a second anomaly in the second set of data;

building a first explanation for the first anomaly and a second explanation for the second anomaly, wherein the first explanation includes a first conjugation of feature ranges, and the second explanation includes a second conjugation of feature ranges, wherein building each explanation includes generating minimum and maximum values for each relevant feature and filtering additional anomaly instances having identical conjugation of feature range thresholds;

creating a central table based on the first and second conjugation of feature ranges, each conjugation including homomorphically encrypted minimum and maximum values;

applying a pattern mining algorithm comprising an itemset mining algorithm to the central table, wherein the pattern mining algorithm is tasked with identifying whether the second conjugation of feature ranges corresponds with the first conjugation of feature ranges;

computing intersections of the homomorphically encrypted feature-range thresholds to determine whether the feature-range thresholds overlap across the edge devices;

determining that the second conjugation of feature ranges does correspond with the first conjugation of feature ranges when the computed intersections are non-empty; and

flagging the first anomaly and the second anomaly as global anomalies.

12 . The method of claim 11 , wherein the first and second conjugation of feature ranges are encrypted.

13 . The method of claim 11 , wherein the method further includes determining that a third anomaly recorded in the central table is a local anomaly.

14 . The method of claim 11 , wherein each row in the central table represents a combination of an edge and anomaly instance identification.

15 . The method of claim 11 , wherein each column in the central table represents a detected feature of a corresponding anomaly.

16 . The method of claim 11 , wherein the first explanation is built using an explanation model.

17 . The method of claim 11 , wherein the second explanation is built using an explanation model.

18 . The method of claim 11 , wherein the first anomaly is detected using an anomaly detection model.

19 . The method of claim 11 , wherein the second anomaly is detected using an anomaly detection model.

20 . The method of claim 11 , wherein the first anomaly and the second anomaly correspond to a same anomaly.