Anomaly Detection

Security Checks

IoTDA continuously detects device security threats. This section describes security check items and how to view and handle detected security risks.

Common detection items

The preceding common check items are enabled by default. You can manually enable other non-common check items as required.

Disconnection Analysis

IoTDA help you analyze device disconnection causes by collecting statistics on the disconnection time range and characteristics of disconnected devices.

Procedure

1. Access the IoTDA service page and click Access Console. Click the target instance card.
2. In the navigation pane, choose O&M > Anomaly Detection and click Authorize. To use anomaly detection, authorize IoTDA service to perform operations on LTS.
   Figure 1 Anomaly detection - Access authorization
   

3. After authorization, Security Checks and Disconnection Analysis pages are available. Click Enable to enable the two functions. Otherwise, they cannot be used.
   Figure 2 Anomaly detection - Security checks
   
   Figure 3 Anomaly detection - Offline analysis
   
   NOTE:

   1. When this function is enabled, IoTDA automatically creates a log group, a log stream, and a data forwarding rule with the data source set to run logs of all resource spaces.

   The log group name is {domainName}-device-exception-group, the log stream name is {domainName}-device-exception-stream, and the forwarding rule name is {domainName}-device-exception-rule.

   If you delete the rule with the data source set to run logs, this function will be affected. If you disable this function, rules will not be deleted and will be reused when you enable this function again.

   2. Pay attention to the storage space occupied by anomaly detection logs. When the free quota (500 MB) is used up, LTS will discard data or continue collecting data after you purchase LTS. You can click Quota in the upper right corner to modify the quota.

4. To enable Security Checks, perform the following steps. Otherwise, skip them.
   1. On the Security Checks tab page, click Security Check Configuration. In the displayed dialog box, click Add.
      Figure 4 Anomaly detection - Security check configuration
      
   2. On the configuration page, select the resource space and product name to be configured, and enable the corresponding check items as required.
      Figure 5 Anomaly detection - Security check item configuration
      
      NOTE:

      Memory/CPU usage/Disk space/Battery level checks: The system compares the values reported by the device with the thresholds configured in the check items to determine whether to generate alarms. Abnormal port/Malicious IP address checks: Enter whitelisted ports or IP addresses for checks. The system compares the parameters reported by the device and the configured whitelist members. You can add IP address segments to the whitelist, for example, 192.168.1.10/24.

5. You can click Disable on the corresponding pages to manually disable the security check and disconnection analysis functions, and click Enable to use them again.
   Figure 6 Anomaly detection - Disabling the function
   
   NOTE:

   • After you enable security checks, IoTDA starts security checks on devices. Security check data of the last seven days can be stored at most. You can search for anomaly records by device ID, resource space, product, check item, and time range, and click the button to check record details.
     Figure 7 Anomaly detection - Security check overview
     
   • After you enable disconnection analysis, IoTDA automatically analyzes the causes of device disconnections. Disconnection analysis data of the last seven days can be stored at most. You can search for disconnection data by device ID, resource space, product, cause, and time range, and click the button to check record details.
     Figure 8 Anomaly detection - Offline analysis overview