In one example, a computing device is disclosed that includes: a hardware platform; a network interface to communicatively connect to a bus that lacks native support for authentication; and an anomaly detection engine operating on the hardware platform and configured to: receive a first data stream over a first time; Symbolizing and approximating the first data stream, which comprises calculating a first window sum; Receiving a second data stream over a second time equal in length substantially equal to the first time, the second data stream comprising data on the plurality of dimensions from the first data stream; Symbolizing and approximating the second data stream, which comprises calculating a second window sum; Calculating a difference between the first window sum and the second window sum; Determining that the difference exceeds a threshold and that the correlation across the plurality of dimensions is broken; and marking a potential anomaly.
展开▼
