Systems and methods for detecting a communication anomaly
AssigneeThe Aerospace Corporation
InventorsMohammad Mozumdar, Philip A. Dafesh
Life of this patent
Estimating the term…
Abstract
Cyberattacks are rampant and can play a major role in modern warfare, particularly on a widely adopted platforms such as the MIL-STD-1553 standard. To protect a 1553 communication bus system from attacks, a trained statistical or machine learning model can be used to monitor commands from a bus controller of the 1553 communication bus system. The statistical and/or machine learning model can be trained to recognize communication anomalies based at least on the probability distribution of patterns of one or more commands. The statistical model can be stochastic model such as a Markov chain that describes a sequence of possible commands in which the probability of each command depends on the occurrence of a group of one or more commands.
Claims20
A method for detecting a communication anomaly on a communication bus, the method comprising:
- segmenting a training data set into a plurality of segments, wherein the training data set comprises of commands from a bus controller of the communication bus;
- identifying patterns of commands within each of the plurality of segments, wherein each pattern comprises one or more commands from the bus controller of the communication bus using a pattern recognition module;
- generating a statistical model within a training module, the statistical model representing probability relationships between identified patterns of commands, wherein the probability relationships define the probability of a first pattern of commands to occur after a second pattern of commands;
- and
- determining whether the first command is abnormal based at least on a probability value of a transition between one or more preceding groups of command and the first command, the determination based on an undefined transition probability.
A system for detecting a communication anomaly on a communication bus, the system comprising:
- a memory;
- one or more processors coupled to the memory, the one or more processors configured to:
- segment a training data set into a plurality of segments, wherein the training data set comprises of commands from a bus controller of a communication bus;
- identify patterns of commands within each of the plurality of segments, wherein each pattern comprises one or more commands from the bus controller of the communication bus using a pattern recognition module;
- and
- generate a Markov chain model representing probability relationships between identified patterns of commands, wherein the probability relationships define the probability of a first pattern to occur after a second pattern,
- wherein the one or more processors are configured to determine whether the first command is abnormal based at least on a probability value of a transition between one or more preceding groups of command and the first command, the determination based on an undefined transition probability.
A method for detecting a communication anomaly on a communication bus, the method comprising:
- monitoring commands transmit from a bus controller to one or more remote terminals, wherein the bus controller and the one or more remote terminals are coupled to the communication bus;
- determining, using a pattern recognition module, whether a first command in a group of commands from the bus controller to the one or more remote terminals is abnormal using a trained Markov chain model within a training module that defines a probability of the first command occurring after a group of one or more commands previously sent by the bus controller, wherein the Markov chain model is trained using identified patterns of commands in each of a plurality of training data segments, wherein training data segments are segmented based on a statistical analysis of time intervals between two consecutive commands of an entire training data set;
- and
- determining whether the first command is abnormal based at least on a probability value of a transition between one or more preceding groups of command and the first command, the determination based on an undefined transition probability.
Dependencies are inferred from the claim text.