A framework for enhancing dependability in self-x systems by Artificial Immune Systems

Abstract

In self-adapting embedded real-time systems, operating systems and software provide mechanisms to self-adapt to changing requirements. Autonomous adaptation decisions introduce novel risks as they may lead to unforeseen system behavior that could not have been specified within a design-time model. However, as part of its functionality the operating system has to ensure the reliability of the entire self-x system during run-time.In this paper, we present our work in progress for an operating system framework which aims to identify anomalous or malicious system states at run-time without a sophisticated specificationtime model. Inspired by the Artificial Immune Systems Danger Theory, we propose an anomaly detection mechanism that operates not only on the local system behavior information of the monitored component. Furthermore, to ensure an efficient behavior evaluation, the anomaly detection mechanism implies system-wide input signals that indicate e.g the existence of a potential danger within the overall system or the occurrence of a system adaption. Due to the ability of this framework to cope with dynamically changing behavior and to identify unintended behavioral deviations, it seems to be a promising approach to enhance the run-time dependability of a self-x system.

Online behavior classification for anomaly detection in self‐x real‐time systems

“…In our previous work, the basic idea of our anomaly detection framework was introduced in detail and will be presented in short here. The anomaly detection framework has been inspired by the Danger Theory that has actually attracted great attention for anomaly detection techniques as it offers new potentials in terms of adaptivity and learning.…”

Online Behavior Classification for Anomaly Detection in Self-X Real-Time Systems

“…The basic idea of our anomaly detection framework has been introduced in [23]. For integrating anomaly detection as a service of the operating system, the underlaying operating system has been extended by components that are responsible for monitoring, analysis and evaluation, and controlling.…”

“…a sequence P 4 = EEEEE consisting of 5 consecutive calls of the same system call E may lead to an overallocation of the resources used by that system call. Furthermore, referring to the anomaly detection framework proposed in [23], observed behavioral patterns are evaluated online and can be classified as malicious in correlation with a certain density of so called PAMP Signals (standing for Pathogen-Associated-Molecular-Pattern) or Danger Signals. Such patterns indicating dangerous behavior need also to be stored in a knowledge base in order to enhance future identification of known dangers.…”

“…In order to realize that, our anomaly detection framework needs to be informed about a reconfiguration happened. The danger theory provides an Inflammation Signal as a general alarm signal which, in our approach (see [23]), is used to display a system reconfiguration. The Inflammation Signal announces a change that has to be taken into account by the anomaly detection framework.…”

“…In [23], we have proposed a framework for anomaly detection in a real-time operating system for self-reconfiguring applications. In this paper, we propose an idea for an online knowledge discovery method that determines behavior of self-x real-time applications.…”