Systems and methods for applying machine learning based anomaly detection in a constrained network

A system for signal anomaly detection, the system comprising:

• a processor;
• and
• a memory including instructions that, when executed by the processor, cause the processor to:
• receive at least one signal via a communication bus of a vehicle;
• determine, using at least one machine learning anomaly detection model, whether a value associated with the at least one signal is within a range of an expected value for the at least one signal;
• in response to a determination that the value associated with the at least one signal is not within the range of the expected value for the at least one signal, increment a counter;
• in response to a determination that a value of the counter is greater than or equal to a threshold value, identify, based on the at least one signal, signal anomaly information;
• communicate the signal anomaly information to a remote computing device;
• receive, from the remote computing device, diagnostics information responsive to the signal anomaly information, wherein the remote computing device is disposed remotely from the vehicle and wherein the remote computing device is configured to execute a detection algorithm having a higher fidelity than a detection algorithm disposed on the vehicle;
• and
• in response to receiving the diagnostics information, initiate at least one corrective action procedure, wherein the at least one corrective action procedure includes, in response to the diagnostics information indicating a request for additional signal anomaly information, updating at least one monitoring parameter based on the request for additional signal anomaly information, and generating the additional signal anomaly information based on the updated at least one monitoring parameter.

An apparatus for signal anomaly detection, the apparatus comprising:

• a processor;
• and
• a memory including instructions that, when executed by the processor, cause the processor to:
• receive at least one signal via a communication bus;
• determine whether a value associated with the at least one signal is within a range of an expected value for the at least one signal;
• in response to a determination that the value associated with the at least one signal is not within the range of the expected value for the at least one signal, increment a counter;
• in response to a determination that a value of the counter is greater than or equal to a threshold value, identify, based on the at least one signal, signal anomaly information;
• communicate the signal anomaly information to a remote computing device, wherein the remote computing device is disposed remotely from the processor and wherein the remote computing device is configured to execute a detection algorithm having a higher fidelity than a detection algorithm disposed executable by the processor;
• receive, from the remote computing device, diagnostics information responsive to the signal anomaly information;
• and
• in response to the diagnostics information indicating a request for additional signal anomaly information:
• update at least one monitoring parameter based on the request for additional signal anomaly information;
• generate the additional signal anomaly information based on the updated at least one monitoring parameter;
• and
• communicate the additional signal anomaly information to the remote computing device.