Hybrid intrusion detection model for cyberattacks in avionics internet gateways using edge analytics
AssigneeHoneywell International Inc.
InventorsKirupakar Janakiraman, Narayanan Srinivasan, Nayyar Rao, Rajeev Mohan, Srihari Jayathirtha
Life of this patent
Estimating the term…
Abstract
Techniques are provided for detecting an intrusion event in a network. At a gateway device in the network, performance parameters of the gateway device are monitored. Steady-state operations are defined based on expected performance of the device parameters. The steady-state operations are compared to the monitored device performance and other context parameters. A hybrid network intrusion detection technique is activated to determine a presence of the intrusion event for known and unknown attacks.
Claims20
A method for detecting an intrusion event in a network of computing devices, the method comprising:
- at a gateway device in the network, monitoring device performance and context parameters of the gateway device using live data traffic and operational parameters;
- defining a steady-state operation based on expected performance of the device performance and context parameters;
- comparing the steady-state operation to the monitored device performance and context parameters;
- and
- activating a hybrid network intrusion detection technique, the hybrid network intrusion detection technique determining a presence of an intrusion event based on a comparison result of the comparing the steady-state operation to the monitored device performance and context parameters,
- wherein the hybrid network intrusion detection technique includes both a signature-based detection technique having a low computation overhead and an anomaly detection technique having a higher computation overhead than the signature-based detection technique.
A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a computer system, cause the processor to perform a method for detecting an intrusion event in a network of computing devices, the method comprising:
- monitoring device performance and context parameters of a gateway device;
- defining a steady-state operation based on expected performance of the device performance and context parameters using live data traffic and operational parameters;
- comparing the steady-state operation to the monitored device performance and context parameters;
- and
- activating a hybrid network intrusion detection technique, the hybrid network intrusion detection technique determining a presence of an intrusion event based on a comparison result of the comparing the steady-state operation to the monitored device performance and context parameters,
- wherein the hybrid network intrusion detection technique includes both a signature-based detection technique having a low computation overhead and an anomaly detection technique having a higher computation overhead than the signature-based detection technique.
A server device for detecting an intrusion event in a network of computing devices, comprising:
- an interface unit configured to receive information;
- a data storage device storing instructions for detecting an intrusion event in a network of computing devices;
- and
- a processor configured to execute the instructions to:
- monitor device performance and context parameters of a gateway device using live data traffic and operational parameters;
- define a steady-state operation based on expected performance of the device performance and context parameters;
- compare the steady-state operation to the monitored device performance and context parameters;
- and
- activate a hybrid network intrusion detection technique, the hybrid network intrusion detection technique determining a presence of an intrusion event based on a comparison result of the comparing the steady-state operation to the monitored device performance and context parameters,
- wherein the hybrid network intrusion detection technique includes both a signature-based detection technique having a low computation overhead and an anomaly detection technique having a higher computation overhead than the signature-based detection technique.
Dependencies are inferred from the claim text.