Method for designing an intrusion detection system (IDS) in an embedded system on board an aeronautical, space or naval vehicle

Abstract

Method for designing an intrusion detection system (IDS) in an embedded system on board an aeronautical, space, or naval vehicle. Method for designing an intrusion detection system (IDS) embedded on board an aeronautical, space, or naval vehicle, configured to perform at least one mission determined by constraint values ​​including a power value (VP) and a system inference time value (VT) of the system (IDS), the system (IDS) including the embedding of AI classification algorithms, comprising the following steps: first determination (E1), by using an optimization algorithm, of the system architecture (IDS) including at least one decision module (DM) and at least one management module (DMMS); second determination (E2), for each decision module (DM), by using an optimization algorithm, of a routing tree of the decision module (DM), per mission.and third determination (E3) of at least one management module (DMMS). Figure for the abstract: [Fig.1],

Description

Title of the invention: Method for designing an intrusion detection system (IDS) in an embedded system on board an aeronautical, space or naval vehicle

[0001] The present invention relates to a method for designing an intrusion detection system (IDS) in an embedded system on board an aeronautical, space or naval vehicle.

[0002] The invention addresses fields using highly constrained systems, such as those found in anti-submarine warfare or anti-aircraft warfare. More generally, all fields requiring classification via an artificial intelligence algorithm could be concerned.

[0003] In practice, the main area is related to cybersecurity in an embedded environment being subject to energy, execution time, or resource constraints.

[0004] Classification algorithms can be used in anomaly detection employed in intrusion detection systems (IDS), object recognition, natural language processing, risk assessment, predictive analytics, decision-making (drone and vehicle piloting), predictive maintenance, and diagnostic support. These algorithms are already implemented in a number of application areas, but the difficulty lies in their use on constrained systems. It is important to minimize several criteria such as energy consumption, bandwidth usage, operating speed, and resource consumption to allow other algorithms to run in parallel without monopolizing a computing unit.

[0005] In the technical fields concerned, we are faced with a number of physical constraints related to the equipment used. Indeed, the equipment used in embedded systems must comply with strict technical specifications. Often, these constraints include size, energy, and weight, consequently leading to limitations in terms of resources.

[0006] The problem is therefore the implementation of effective and efficient AI algorithms on embedded systems with few resources and / or subject to strong constraints (energy, resources, bandwidth, etc.).

[0007] Since these algorithms are very resource-intensive, they are very difficult to implement. To address this, it is known to use lighter algorithms, or optimization techniques, but these lead to a reduction in classification performance and / or a significant increase in inference time making it impossible to use in a real-world system.

[0008] To overcome this problem, numerous techniques have been proposed to adapt the inference phase. Two main subcategories are known: the first involves optimizing and / or refining an existing algorithm to enable it to meet the specifications of the constraints to be respected, and the second involves using a multi-model architecture.

[0009] These two categories nevertheless add a certain complexity to the system, and although they offer better compromises than more conventional solutions, they do not solve the problem. Indeed, some techniques, such as early exits, have many advantages but are insufficient; others, such as those that replace the single-model architecture with a multi-model architecture, cannot be applied when the information to be transmitted between the models is sensitive and when the necessary bandwidth is not available.

[0010] There is a lot of research on intrusion detection systems, acronym IDS for "Intrusion Detection System".

[0011] It is known that systems make trade-offs between prediction quality and resource consumption, notably by minimizing resources and / or maximizing the workload to be analyzed. This amounts to either minimizing inference time or increasing hardware power, at the cost of a significant decrease in prediction quality. They take little or no account of the external situation, the constraints that are likely to change throughout the mission. Furthermore, to integrate a classification algorithm on a highly constrained system at present, it is often necessary to reduce the model size or distribute the processing locally and / or in the cloud to obtain results that are just barely satisfactory for a given system.

[0012] In the context of intrusion detection, the consequences are a decrease in the quality of predictions, which is characterized by undetected attacks (most of the least represented cases, such as the most difficult to detect and most dangerous attacks) and / or false positives which lower the operator's confidence in the capabilities of the intrusion detection system.

[0013] Moreover, the metrics used in existing solutions cannot be dynamically modified during the inference phase. They are either functions defined during the preparation phase or fixed metrics hard-coded with fixed thresholds. Finally, in multi-exits, the conditions are not independent. These limitations prevent model optimization.

[0014] One object of the invention is to overcome the problems mentioned above.

[0015] According to one aspect of the invention, a method is proposed for designing an intrusion detection system embedded on board an aeronautical, space, or naval vehicle, configured to perform at least one mission, a mission being determined by operational constraint values ​​including a power value used by the system, and a system inference time value, the intrusion detection system comprising the integration of a plurality of AI classification algorithms, including: - a first step of determining, using an optimization algorithm, the system architecture (IDS) comprising at least one decision module (DM) and at least one management module (DMMS) of the decision module(s) (DM), based on: - characteristics of the system platform (IDS) including internal or external metrics to the system (IDS), system platform (IDS) resources; types of possible attacks on the system (IDS) depending on the communication protocols used by the system platform (IDS); - types of AI classification algorithms available; and - operational constraints including a limit (LP) on the power used by the system (IDS) that must not be exceeded, a limit (LT) on the system (IDS) inference time, and a desired level of system (IDS) classification accuracy; and - a second step of determining, for each decision module (DM), using an optimization algorithm, a routing tree of the decision module (DM), per mission, from: - of the system architecture (IDS) determined in the first step; - characteristics of the system platform (IDS) including internal or external metrics to the system (IDS), system platform (IDS) resources; types of possible attacks on the system (IDS) depending on the communication protocols used by the system platform (IDS); - Comparison threshold intervals comprising a set of discrete values ​​to explore (e.g., from 10% to 90% in 5% increments); and - operational constraint values ​​of the vehicle's current mission including a value (VP) of power used by the system (IDS), and a value (VT) of system inference time (IDS);

[0016] a decision module being configured to store in memory the routing tree of the current mission; and - a third step of determining at least one management module (DMMS) of the decision module(s) (DM), from the system architecture (IDS), determined in the first step configured to store in memory all the decision trees of the decision module(s) (DM), and to modify the routing tree of the decision module(s) (DM) in case of modification of the current mission.

[0017] In one implementation mode, a routing tree is configured to define the routing of a signal sample received by the system to another branch of the classification algorithm being run, to the input of another of said AI classification algorithms, or to the continuation of the classification algorithm being run.

[0018] According to one embodiment, an internal metric of the intrusion detection system (IDS) belongs to the following list: signal sample entropy, signal sample patience, time budget allocated to the signal, confidence in the current classification AI algorithm, margin of the current classification AI algorithm.

[0019] In one implementation, a metric external to the intrusion detection system (IDS) belongs to the following list: vehicle battery level (NB), system power limit (LP), vehicle resource usage limit (LR), vehicle operating parameter, vehicle environment parameter

[0020] According to one implementation method, at least one management module (DMMS) is internal to the decision module (DM).

[0021] In one implementation mode, at least one management module (DMMS) is external to the decision module (DM).

[0022] According to one implementation method, the external management module (DMMS) audits at least one decision module (DM) is included in a calculation module different from the calculation module comprising the decision module (DM) comprising the internal management module (DMMS).

[0023] In one implementation mode, the optimization algorithm is a genetic algorithm.

[0024] The invention will be better understood upon examination of some embodiments described by way of non-limiting examples and illustrated by the accompanying drawings, in which:

[0025] [Fig.1] schematically illustrates a method for designing an intrusion detection system in an embedded system on board an aeronautical, space or naval vehicle, according to one aspect of the invention;

[0026] [Fig.2] schematically illustrates an example of an intrusion detection system (IDS) designed using the method of [Fig.1], with a decision module (DM), a module of DMMS management of the DM decision module, and two different AI classification algorithms, according to one aspect of the invention;

[0027] [Fig.3] schematically illustrates an example of an intrusion detection system (IDS) designed by the method of [Fig.1], with two decision modules (DM), a management module (DMMS) for the decision modules (DM), and two different AI classification algorithms, and an early output of the first algorithm, according to one aspect of the invention; and

[0028] [Fig.4] schematically illustrates an example of an IDS intrusion detection system by the method of [Fig.1], with two DM decision modules, an external DMMS management module for the DM decision modules, an internal DMMS management module for one of the DM decision modules, and two different AI classification algorithms, and an early output of the first algorithm, according to one aspect of the invention.

[0029] Across all figures, elements with identical references are similar.

[0030] Figure 1 schematically illustrates a method for designing an intrusion detection system (IDS) embedded on board an aeronautical, space, or naval vehicle, configured to perform at least one mission. A mission is determined by operational constraint values ​​comprising a VP value of the power used by the IDS system and a VT value of the IDS system's inference time, according to one aspect of the invention. The IDS intrusion detection system includes the integration of a plurality of AI classification algorithms.

[0031] The method for designing an intrusion detection system (IDS) comprises: - a first step of determining, using an optimization algorithm, the architecture of the IDS system comprising at least one decision module (DM) and at least one management module (DMMS) for the decision module(s), based on: - characteristics of the IDS system platform including internal or external metrics to the IDS system, resources of the IDS system platform; types of possible attacks on the IDS system depending on the communication protocols used by the IDS system platform; - types of AI classification algorithms available; and - operational constraints including a maximum LP limit on the power used by the IDS system, a maximum LT limit on the inference time of the IDS system, and a desired NP level of classification accuracy for the IDS system; and - a second step of determining, for each DM decision module, using a genetic optimization algorithm, a routing tree of the DM decision module, per mission, from: - of the architecture of the IDS system determined in the first step; - characteristics of the IDS system platform including internal or external metrics to the IDS system, resources of the IDS system platform, types of attacks possible on the IDS system depending on the communication protocols used by the IDS system platform; - Comparison threshold intervals comprising a set of discrete values ​​to explore (e.g., from 10% to 90% in 5% increments); and - operational constraint values ​​of the vehicle's current mission including a VP value of power used by the IDS system, and a VT value of IDS system inference time;

[0032] a DM decision module being configured to store the routing tree of the current mission in memory; and - a third step of determining at least one DMMS management module of the DM decision module(s), from the architecture of the IDS system, determined in the first step configured to store in memory all the decision trees of the DM decision module(s), and to modify the routing tree of the DM decision module(s) in case of modification of the current mission.

[0033] In the example described, a genetic optimization algorithm is used because this type of algorithm is particularly effective in the case of large and complex search spaces and can adapt to changes in the problem, making it suitable for dynamic and real-time applications. This type of algorithm is less likely to get stuck in local optima compared to traditional optimization methods, thanks to its use of crossover and mutation operations, and can be applied to a wide range of problems, including planning, machine learning, and even creative tasks such as artistic and musical generation. Furthermore, this type of algorithm is easily parallelizable.

[0034] Alternatively, other optimization algorithms can be used, such as (non-exhaustive list): - Integer linear optimization, acronym OLNE in French or MILP for "Mixed-Integer Linear Programming" in English; - Bayesian optimization algorithm, acronym BOA for "Bayesian Optimization Algorithm" in English; - Particle swarm optimization, acronym OEP in French or PSO for "Particle Swann Optimization" in English; - Random optimization of the acronym RS for "Random Search" in English; - GridSearch in English.

[0035] Anomaly detection by the IDS intrusion detection system is the identification of elements or events that raise suspicions because they differ significantly from the majority of other data. In the case of IDS intrusion detection systems, these cases are potentially fraudulent and involve the intent and / or capability to harm the system.

[0036] An anomaly can be defined as one or more data signals containing fraudulent data (replay of illegitimate command sequences, sending of incorrect information (e.g., erroneous sensor state)). It can be characterized by a signal sent by a user / module not supposed to be able to send that particular data stream.

[0037] Anomaly detection consists of identifying data that does not follow the expected or normal behavior. An anomaly is an observation that clearly differs from other observations in a dataset. These anomalies can indicate errors, fraud, failures, or rare and significant events. The desired precision level (PN) is understood to be a parameter representative of a binary or multiclass level. In the case of a binary level, the detection of an output will determine whether an attack has been detected or not. In the case of a multiclass level, the detection of an output will determine whether there has been jamming, replay, infiltration, reconnaissance, etc.—that is, a specific type of attack.

[0038] The architecture of the IDS intrusion detection system comprises AI classification algorithms interconnected by at least one decision module (DM). The role of the first step, El, of architecture determination or design is to determine the best architecture based on the inputs of this step. At the end of this first step, El, the decision module(s) (DM) act only as interconnection or linking blocks between the AI ​​classification algorithms; there is no comparison and no comparison threshold, and when a sample passes through the algorithm(s), the sample exits through all available outputs to the other AI classification algorithm(s) or to an anticipated output.

[0039] A signal sample is understood to be a network signal transmitted through a physical medium such as network communication cards, the physical medium The interconnection router is characterized by a communication protocol that depends on the implementation platform (public example: TCP / IP, UDP, HTTP, IP, FTP). Each protocol has its own characteristics (in an OT ("Operation Technology") environment, packets containing commands and value updates may be found, while in an IT system, user data may be found).

[0040] A cyber-attack is characterized by an unplanned and / or unauthorized transfer of byte blocks in the normal operation defined in the specification in the functional analysis of the system.

[0041] Each architecture adheres to constraints and must adapt to the platform (and therefore adopt its metrics, resources, and communication protocols). Each solution corresponds to an architecture, and the set of all solutions (search space) represents the total number of possible combinations. At this stage, the DMMS management module(s) are also placed within the architecture but are empty, as are the DM decision-making module(s).

[0042] An optimization algorithm is used to intelligently explore the solution space; that is, not all solutions will be explored. A genetic algorithm is used for this optimization.

[0043] A so-called generic genetic algorithm can be used for this task and operates according to the following steps: - Initialization: an initial population of potential solutions is created, often generated randomly. - Evaluation: each potential solution, or individual, is evaluated to determine its quality or suitability to solve the problem. - Selection: the best solutions are selected for reproduction. This step is analogous to the survival of the fittest in nature. - Crossover: pairs of selected solutions are combined to create new solutions, hoping that they inherit the good characteristics of their parents (with a crossover threshold of 70%). - Mutation: with a small probability (less than a threshold usually set at 1%), random changes are introduced into new solutions to maintain genetic diversity and explore new regions of the search space. - New generation: new solutions replace the worst ones from the previous population, and the process repeats until a satisfactory solution is found or a predefined number of generations is reached.

[0044] The second step E2 determines, for each DM decision module, by using a genetic optimization algorithm, a routing tree of the DM decision module, per mission.

[0045] Once the first step El of determining the IDS architecture has been completed, the routing tree for the decision modules must be determined. As with the determination El of the architecture, a large number of possibilities remain, and an optimization algorithm is used to select the best tree that meets the mission constraints.

[0046] The minimal case consists of a DMMS (internal or external) and a DM. Therefore, the positioning of the DMMS management module depends on its implementation on the vehicle. In the case of a vehicle using multiple computing hardware (e.g., SoC), the DM decision module and the inference algorithm can be located on one computing unit (processor), while the DMMS can be located on another.

[0047] In a more specific example with a Xilinx FPGA SoC containing 1 FPGA chip, an ARM CPU and an AMD GPU, the AI ​​classification algorithms can be configured on the FPGA part, as well as the DM decision modules, while the DMMS management module can be located on the higher level ARM processor in the chain to allow network traffic analysis for adding headers in packets for updating metrics and thresholds which the lower DM decision modules have access to.

[0048] In this second step E2, of determining, for each decision module DM, a routing tree of the decision module DM, for each mission of the vehicle, a genetic optimization algorithm takes as input: the architecture of the IDS system determined in the first step El; characteristics of the platform of the IDS system including metrics internal or external to the IDS system, resources of the platform of the IDS system, types of possible attacks on the IDS system depending on the communication protocols used by the platform of the IDS system; threshold intervals for comparisons including a set of discrete values ​​to explore (for example from 10% to 90% with a step of 5%); and operational constraint values ​​of the current mission of the vehicle, including a value VP of power used by the IDS system, and a value VT of inference time of the IDS system.

[0049] A DM decision module being configured to store in memory the routing tree of the current mission.

[0050] This second step E2 of determining the DM decision module(s) can also be carried out directly during the first step El of architecture design.

[0051] The optimization algorithm makes it possible to obtain the best solution for a given set of constraints, and therefore for a specific mission. Two types of missions can be given as examples. The first, which can be called mission 1, requires the processing of a larger quantity of data and therefore implies a shorter inference time for the IDS. The second, called mission 2, prioritizes the quality of the results, even at the expense of processing speed. For each DM, there will be several possible "configurations" that will depend on the mission (and therefore on the mission constraints).

[0052] This second step E2 of determining the DM decision module(s) therefore generates a routing tree per mission per decision module (a mission being characterized by a set of mission constraints and precise metric values).

[0053] For a DM decision module, there is therefore a current routing tree, stored in the memory of the DM decision module for the current or ongoing mission of the IDS intrusion detection system and a number of other trees depending on the constraints which may evolve according to a mission evolution.

[0054] The third step E3 determines or designs at least one DMMS management module of the DM decision module(s), based on the IDS system architecture determined in the first step, configured to store in memory all the decision trees of the DM decision module(s), and to modify the routing tree of the DM decision module(s) in case of a change in the current mission.

[0055] The role of a DMMS management module is to interact with the DM decision module(s) according to external conditions and / or the mission and thus to update their partial configuration (just the thresholds), or their total configuration (change the routing tree).

[0056] It must also create the information exchange data structure by analyzing the flow of samples and determining their complexity (via a model drift algorithm or "concept drift" in English).

[0057] The number and position of the DMMS management module(s) is defined according to the metrics and their access by the first step El of determining the architecture of the IDS intrusion detection system.

[0058] A DMMS management module therefore contains a set of routing trees per DM decision module and per mission. It also has the role of creating the data structure for information exchange for the module placed between the samples and the IDS intrusion detection system.

[0059] During this third step E3, a concept drift detector (CDD) is trained to be able to detect changing the incoming samples and classifying them for example into three levels of difficulty: low / medium / high or "low / mid / high" in English, respectively for easy to classify, medium to classify, and difficult to classify.

[0060] During its operation, a DMMS management module updates DM management modules.

[0061] For example, the second step of DM determination determined that if the atmospheric pressure dropped by 10% and the sample was average, the routing tree indexed 3 is needed for a DM indexed 2, then the relevant DMMS management module updates the DM indexed 2 with the routing tree indexed 3.

[0062] An example of an information exchange data structure particularly relevant for signal samples of this process is the following data structure named SRS for acronym of "Sample Routing Structure" in English.

[0063] This data structure allows the exchange of information within an AI classification algorithm, and between AI classification algorithms within the IDS. It is as follows:

[0064] [Header] [metrics refresh] [DM reconfiguration] [original sample] [intermediate sample] [prediction] [path] [complexity / drift]

[0065] In which:

[0066] The "Header" field contains information about the sample type,

[0067] The "metric update" field contains a list of metrics present in the current algorithm and allows metric updates to be transmitted to the DM decision modules each time a sample is passed.

[0068] The "DM reconfiguration" field is generated by a DMMS management module and allows the new DM action rules to be specified (i.e., the new routing tree or the new thresholds),

[0069] The "original sample" field contains all the original information of the sample and is used when passing to another AI classification algorithm that is incompatible with the previous (current) one. For example, passing from a neural network to a RandomForest.

[0070] The "intermediate sample" field corresponds to the values ​​updated by the different processing steps carried out in the current AI classification algorithm.

[0071] Fig. 2 represents an example of an IDS intrusion detection system designed by the method of the invention, with a DM decision module, a DMMS management module of the DM decision module, and two different AI classification algorithms.

[0072] Figure 3 shows an example of an intrusion detection system (IDS) designed by the method of the invention, with two decision modules (DM) and one management module. DMMS of DM decision modules, and two different AI classification algorithms, and an early output of the first algorithm.

[0073] Fig. 4 represents an example of an IDS intrusion detection system designed by the method of the invention, with two DM decision modules, an external DMMS management module for the DM decision modules, an internal DMMS management module for one of the DM decision modules, and two different AI classification algorithms, and an early output of the first algorithm.

Claims

1. Demands Method for designing an intrusion detection system (IDS) in an embedded system on board an aeronautical, space, or naval vehicle, configured to perform at least one mission, a mission being determined by operational constraint values ​​including a value (VP) of power used by the system (IDS), and a value (VT) of system (IDS) inference time, the intrusion detection system (IDS) including the integration of a plurality of AI classification algorithms, comprising: - a first step (El) of determining, by using an optimization algorithm, the architecture of the system (IDS) including at least one decision module (DM) and at least one management module (DMMS) of the decision module(s) (DM), from: - characteristics of the system platform (IDS) including internal or external metrics to the system (IDS), system platform (IDS) resources; types of possible attacks on the system (IDS) depending on the communication protocols used by the system platform (IDS); - the types of AI classification algorithms available; and - operational constraints including a limit (LP) on the system power used (IDS) that must not be exceeded, a limit (LT) on the system inference time (IDS), and a desired level (NP) of system classification accuracy (IDS); and - a second step (E2) of determination, for each decision module (DM), by use of an optimization algorithm, of a routing tree of the decision module (DM), per mission, from: - the architecture of the system (IDS) determined in the first step (El); - characteristics of the system platform (IDS) including internal or external metrics to the system (IDS), system platform (IDS) resources, types of possible attacks on the system (IDS) depending on the communication protocols used by the system platform (IDS); - comparison threshold intervals comprising a set of discrete values ​​to be explored; and - operational constraint values ​​of the vehicle's current mission, including a value (VP) of power used by the system (IDS), and a value (VT) of system inference time (IDS); a decision module (DM) being configured to store in memory the routing tree of the current mission; and - a third step (E3) of determining at least one management module (DMMS) of the decision module(s) (DM), from the system architecture (IDS), determined in the first step configured to store in memory all the decision trees of the decision module(s) (DM), and to modify the routing tree of the decision module(s) (DM) in case of a change in the current mission.

2. A method according to claim 1, wherein a routing tree is configured to define the routing of a signal sample received by the system to another branch of the classification algorithm being run, to the input of another of said AI classification algorithms, or to the continuation of the classification algorithm being run.

3. A method according to any one of the preceding claims, wherein an internal metric of the intrusion detection system (IDS) belongs to the following list: signal sample entropy, signal sample patience, time budget allocated to the signal, confidence in the current classification AI algorithm, margin of the current classification AI algorithm.

4. A method according to any one of the preceding claims, wherein a metric external to the intrusion detection system (IDS) belongs to the following list: vehicle battery level (NB), limit (LP) of power used by the system (IDS), limit (LR) of vehicle resource usage, parameter representative of vehicle operation, parameter representative of the vehicle environment.

5. A method according to any one of the preceding claims, wherein at least one management module (DMMS) is internal to the decision module (DM).

6. A method according to any one of the preceding claims, wherein at least one management module (DMMS) is external to the decision module (DM).

7. 15 Method according to claim 6 in combination with claim 4, wherein the external management module (DMMS) audits at least one decision module (DM) is included in a calculation module different from the calculation module comprising the decision module (DM) comprising the internal management module (DMMS).

8. A method according to any one of the preceding claims, wherein the optimization algorithm is a genetic algorithm.

Images