Comparison and Analysis of Three Anomaly Correction Methods in Embedded Systems

Abstract

Abstract. This paper proposes and compares three anomaly correction methods in embedded systems: 1) Markov-based; 2) Stide-based (sequence time-delay embedding); 3) Cluster-based correction methods. All these methods work online on data streams coming from sensors of embedded systems. In these methods, detection is rst obtained using training on normal data, and next in runtime, the correction mechanisms can be applied. Markov-based method is based on probabilities between states, Stide-based method is based on storing common events, and Cluster-based one is based on clustering similar members. In the detection phase, these methods check normal behavior of input data based on what is learned at the training phase. Evaluation is performed using 7000 data sets. The window size and number of injected anomalies vary between 3 and 5, 1 and 7, respectively. Correction coverage for Markov-based, Stide-based, and Cluster-based methods is on average 77.66%, 60.9%, and 70.36%, respectively. Therefore, Markov-based method is the best in terms of correction coverage. Moreover, area overheads of these methods are 249.64, 63.35, and 2.08 m 2 , respectively. As a trade-o , Cluster-based method shows the best correction coverage compared to area, power, and delay overheads.