Markov-Based Anomaly Correction in Embedded Systems

Abstract

Abstract-In this paper, an anomaly correction method is proposed which is based on Markov anomaly detection method. The proposed method employs the probability of transitions between events to evaluate the behavior of a system. This method consists of three steps: 1) Construction of transition matrix by probability of transitions between events and list of known events are generated in training phase; 2) Detection of anomaly based on Markov detection method will be done. In test data when the probability of transition previous event to current event does not reach a predefined threshold, an anomaly is detected. Threshold is determined based on constructed transition matrix in step 1; 3) Check the defined constraints for each anomalous event to find source of anomaly and the suitable way to correct the anomalous event. Next, an event with the highest compliance with the constraints is selected. Evaluation of the proposed method is done using a total of 7000 data sets. The operational scope of corrector and the number of injected anomalies varied between 3 and 5, 1 and 7, respectively. The simulation experiments have been done to measure the correction coverage rate which is between 53.5% and 97.2% with average of 77.66%. For evaluation of hardware consumptions of the proposed method, this method is implemented by VHDL. Power, area and time consumptions are on average 87.43 w, 415.48 m 2 , and 4.12ns, respectively.

Comparison and Analysis of Three Anomaly Correction Methods in Embedded Systems

“…Another correction method, Cluster-based one [13], is also added to this work to be compared with two other methods, i.e. Markov-based [14] and Stidebased ones [12], to get better considerations of correction methods; Detection and correction algorithms of Clusterbased method are presented in detail; Correction algorithm of Markov-based method is presented in detail; Comparisons between results achieved by three di erent methods are done and their advantages/disadvantages are discussed; The best trade-o between correction coverage versus area, power and delay overhead is introduced and the best method is speci ed.…”