Patent Application
20140114442
The subject matter described herein relates to embedded control systems, and more particularly to systems and methods to implement real time embedded control system behavior monitoring and anomaly detection.
Embedded control systems are an integral part of manufacturing operations and aerospace applications such as airplane and mission systems operations. Networked embedded sensors, controllers, and actuators increase performance efficiencies that result from more information gathered and computer-driven controls. However, over time the characteristics of these systems can deviate significantly from the nominal state or degrade due to different reasons such as normal usage, damage or even cyber attacks. Furthermore, with a global-supply chain of embedded devices and increase sophistication of cyber attacks, the presence of zero-day exploits and potential for exploitation of design vulnerabilities has also increased.
Failure or degradation of these embedded control systems can be subtle and difficult to detect. Accordingly, this evinces a need for a systems and methods to detect abnormal behaviors of a networked embedded control systems in real-time.
Systems and methods for real time control system management in networked environments are disclosed. In one embodiment, a computer-based method for real time embedded control system behavior monitoring and anomaly detection comprises generating a behavior training set for the embedded control system, wherein the behavior training set correlates inputs to the embedded control system with outputs from the embedded control system during a training process to define behavior fingerprints for the embedded control system, monitoring inputs to the embedded control system and outputs from the embedded control system in real time during operation of the embedded control system, and generating an alert when one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation represent an anomaly.
In another embodiment, a computer-based system for real time embedded control system behavior monitoring and anomaly detection comprises a processor and logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to generate a behavior training set for the embedded control system, wherein the behavior training set correlates inputs to the embedded control system with outputs from the embedded control system during a training process to define behavior fingerprints for the embedded control system, to monitor inputs to the embedded control system and outputs from the embedded control system in real time during operation of the embedded control system, and generate an alert when one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation represent an anomaly.
In another embodiment, a computer program product comprising logic instructions stored in a tangible computer-readable medium coupled to a processor which, when executed by the processor, configure the processor to generate a behavior training set for the embedded control system, wherein the behavior training set correlates inputs to the embedded control system with outputs from the embedded control system during a training process to define behavior fingerprints for the embedded control system, to monitor inputs to the embedded control system and outputs from the embedded control system in real time during operation of the embedded control system, and generate an alert when one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation represent an anomaly.
Further areas of applicability will become apparent from the description provided herein. It should be understood that the description and specific examples are intended for purposes of illustration only and are not intended to limit the scope of the present disclosure
Embodiments of methods, systems, and computer program products in accordance with the teachings of the present disclosure are described in detail below with reference to the following drawings.
Systems and methods for real time embedded control system behavior monitoring and anomaly detection are described herein. Specific details of certain embodiments are set forth in the following description and figures to provide a thorough understanding of such embodiments. One skilled in the art will understand, however, that alternate embodiments may be practiced without several of the details described in the following description.
Various embodiments described here are set in the context of one or more computer-based systems which may implement operations to generate a behavior training set for the embedded control system. For example, in some embodiments the computer-based system may develop a training set which correlates inputs to the embedded control system with outputs from the embedded control system during a training process to define behavior fingerprints for the embedded control system operating under normal or stable conditions. The behavior fingerprints may be stored in a suitable data store, e.g., a database, in a form which associates inputs to the embedded control system with outputs from the embedded control system.
In real time operation the computer-based system may monitor inputs to the embedded control system and outputs from the embedded control system during operation of the embedded control system. In some embodiments the outputs collected from the system may be compared to one or more outputs collected during the training process. If a deviation between the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation and the one or more outputs collected during the training process exceeds a threshold then the one or more inputs into the embedded control system or the outputs collected from the embedded control system in real time operation may be characterized as an anomaly. The system may generate an alert when one or more inputs into the embedded control system, or one or more outputs collected from the embedded control system in real operation represent an anomaly.
System 100 comprises one or more behavior attribute input application(s) 120, behavior input and classifier correlator application(s) 125, behavior input and classification data store 130, reservoir computing parameter(s) data store 140, and behavior training set data store 145. In some embodiments the applications 120, 125, 135 may be implemented as logic instructions stored in a non-transitory computer readable medium which, when executed by a processor, configure the processor to implement operations to generate a behavior training set which correlates inputs to and outputs from network embedded control systems 110 under stable and/or predetermined operating conditions.
Referring now to
In the monitoring configured depicted in
In some embodiments both the various components of the system 100 depicted in
The computing device 208 includes system hardware 220 and memory 230, which may be implemented as random access memory and/or read-only memory. A file store 280 may be communicatively coupled to computing device 208. File store 280 may be internal to computing device 108 such as, e.g., one or more hard drives, CD-ROM drives, DVD-ROM drives, or other types of storage devices. File store 280 may also be external to computer 208 such as, e.g., one or more external hard drives, network attached storage, or a separate storage network.
System hardware 220 may include one or more processors 222, one or more graphics processors 224, network interfaces 226, and bus structures 228. As used herein, the term “processor” means any type of computational element, such as but not limited to, a microprocessor, a microcontroller, a complex instruction set computing (CISC) microprocessor, a reduced instruction set (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or any other type of processor or processing circuit.
Graphics processor(s) 224 may function as adjunct processors that manages graphics and/or video operations. Graphics processor(s) 224 may be integrated onto the motherboard of computing system 200 or may be coupled via an expansion slot on the motherboard.
In one embodiment, network interface 226 could be a wired interface such as an Ethernet interface (see, e.g., Institute of Electrical and Electronics Engineers/IEEE 802.3-2002) or a wireless interface such as an IEEE 802.11a, b or g-compliant interface (see, e.g., IEEE Standard for IT-Telecommunications and information exchange between systems LAN/MAN—Part II: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) specifications Amendment 4: Further Higher Data Rate Extension in the 2.4 GHz Band, 802.11G-2003). Another example of a wireless interface would be a general packet radio service (GPRS) interface (see, e.g., Guidelines on GPRS Handset Requirements, Global System for Mobile Communications/GSM Association, Ver. 3.0.1, December 2002).
Bus structures 228 connect various components of system hardware 228. In one embodiment, bus structures 228 may be one or more of several types of bus structure(s) including a memory bus, a peripheral bus or external bus, and/or a local bus using any variety of available bus architectures including, but not limited to, 11-bit bus, Industrial Standard Architecture (ISA), Micro-Channel Architecture (MSA), Extended ISA (EISA), Intelligent Drive Electronics (IDE), VESA Local Bus (VLB), Peripheral Component Interconnect (PCI), Universal Serial Bus (USB), Advanced Graphics Port (AGP), Personal Computer Memory Card International Association bus (PCMCIA), and Small Computer Systems Interface (SCSI).
Memory 230 may include an operating system 240 for managing operations of computing device 208. In one embodiment, operating system 240 includes a hardware interface module 254 that provides an interface to system hardware 220. In addition, operating system 240 may include a file system 250 that manages files used in the operation of computing device 208 and a process control subsystem 252 that manages processes executing on computing device 208.
Operating system 240 may include (or manage) one or more communication interfaces that may operate in conjunction with system hardware 220 to transceive data packets and/or data streams from a remote source. Operating system 240 may further include a system call interface module 242 that provides an interface between the operating system 240 and one or more application modules resident in memory 130. Operating system 240 may be embodied as a Windows® brand operating system or as a UNIX operating system or any derivative thereof (e.g., Linux, Solaris, etc.), or other operating systems.
As described above, in some embodiments the various applications of system 100 may be implemented include logic instructions encoded in a tangible computer-readable medium such as memory 230 which, when executed by processor 222, cause the processor 222 to implement operations. Thus, in some embodiments memory 230 may comprise one or more behavior attribute input application(s) 120, behavior input and classifier correlator application(s) 125, behavior input and classification data store 130, reservoir computing parameter(s) data store 140, behavior training set data store 145, behavior model applications(s) 165, anomaly behavior classifier application(s) 170, and behavior alert publisher applications(s) 175.
Having described structural components of system 100, operations of system 100 will be described with reference to
Referring to
The behavior input and classifier correlator application 125 receives the outputs generated by the one or more network embedded, associates the outputs generated by the one or more network embedded control systems 110 with the input provided to the one or more network embedded control systems 110 and stores the outputs and the association in a behavior input and classification data store 130. Further, the behavior input and classifier correlator application 125 receives normal behavior classification input 115, which may be provided by an external source, for the one or more network embedded control systems 110 and uses the normal behavior classification input 115 to classify the outputs from the one or more network embedded control system(s) 110.
The behavior trainer application 135 allows a user of the system to access training sets in the behavior training set data store 145 and associated parameters from the Reservoir Computing Parameter database. In addition, the behavioral trainer application 135 may apply one or more reservoir computing parameters to the training set(s) to tune the training set(s) to achieve a level of sensitivity. In some embodiments six parameters are available for tuning, as follows:
Reservoir Size: a parameter which defines a number of nodes inside the reservoir computing network, based on statistical learning theory, it affects the modeling capacity.
Input Scaling: a parameter which weights the input attributes which directly impacts reservoir dynamics, which helps to normalize reservoir dynamics dealing with small input amplitudes with large input amplitudes with equal importance, and determines the degree of non-linearity of the reservoir
Output Feedback Scaling: a parameter which defines an amount of feedback for the reservoir computing network for stability control, assists in recognizing the degree of oscillating behavior patterns, and determines the how independent a trained network embedded system controller(s) 120 pattern generation component is.
Reservoir Weight Matrix Spectral Radius: a parameter which controls the reservoir computing network's impulse responses and input value range of interactions, assists in behavior sensitivities determinations, and depends on whether or not the task in question requires a long or short memory to allow past inputs to affect future outputs
Leaking Rate: a parameter which controls the reservoir computing network sensitivity to noisy behaviors, time-warped behavior patterns, and/or very slow, dynamic systems
Noise Scaling: a parameter which controls the reservoir computing network's importance of noise integrators, which affects the classification sensitivity of stable/chaotic aspects of a behavioral pattern
Thus, in the learning/training configuration depicted in
Referring back to
Data collected by the behavior attribute input application(s) 120 is forwarded to the behavior model application(s) 165. In some embodiments the behavior model application 165 may be implemented as a trained and deployed reservoir computing network. The behavior model application(s) 165 is trained by the behavioral trainer application 135. Thus, the behavior model application 165 will have its reservoir computing parameters and reservoir computing network matrix configured. The behavior model application 165 monitors behavioral attribute inputs and outputting the classification based on the configuration and training sets learned.
Outputs generated by the behavior model application 165 are forwarded to the anomaly behavior classifier application(s) 170, which interprets results of the behavioral model application 165 and determines whether a result is an anomaly. By way of example, in some embodiments one or more outputs collected from the network embedded control system(s) 110 in real time operation are compared (operation 320) to one or more outputs collected during the training process, and characterized as an anomaly when a deviation between the one or more outputs collected from the embedded control system in real time operation and the one or more outputs collected during the training process exceeds a threshold (operations 325, 330). The threshold may be a fixed value, a value proportional to a magnitude of an output, or may be dynamic. In some embodiments the anomaly behavior classification 170 may also determine the severity of the anomaly (operation 335).
The output generated by the anomaly behavior classification application(s) 170 are forwarded to the behavior alert publisher application 175 so that alerts can be generated and published (operation 340) to one or more external applications 180. Also, the results may be forwarded to the behavior input and classifier correlator application 125 for processing. In some embodiments the behavior input and classifier correlator application 125 stores the one or more outputs collected from the embedded control system in real time operation in a memory (operation 345) and updates the behavior training set (operation 350) using the one or more outputs collected from the embedded control system in real time operation in a memory, e.g., by updating the behavior input and classification data store 130.
While the embodiment depicted in
In the foregoing discussion, specific implementations of exemplary processes have been described, however, it should be understood that in alternate implementations, certain acts need not be performed in the order described above. In alternate embodiments, some acts may be modified, performed in a different order, or may be omitted entirely, depending on the circumstances. Moreover, in various alternate implementations, the acts described may be implemented by a computer, controller, processor, programmable device, firmware, or any other suitable device, and may be based on instructions stored on one or more computer-readable media or otherwise stored or programmed into such devices (e.g., including transmitting computer-readable instructions in real time to such devices). In the context of software, the acts described above may represent computer instructions that, when executed by one or more processors, perform the recited operations. In the event that computer-readable media are used, the computer-readable media can be any available media that can be accessed by a device to implement the instructions stored thereon.
While various embodiments have been described, those skilled in the art will recognize modifications or variations which might be made without departing from the present disclosure. The examples illustrate the various embodiments and are not intended to limit the present disclosure. Therefore, the description and claims should be interpreted liberally with only such limitation as is necessary in view of the pertinent prior art.
