Aircraft Cyber Event Trend Display Using PCA Biplot
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity detection systems for aircraft face challenges in real-time assessment and data transmission due to complex algorithms, bandwidth limitations, and the need to avoid decrypting encrypted traffic, making it difficult to effectively monitor cyber health during flight.
Innovation Solution
The system employs Principal Components Analysis (PCA) to derive and transmit loading vectors from a ground-based security module to an aircraft, allowing for real-time computation of numerical scores on board and minimal bandwidth usage, enabling graphical display of cyber event trends without revealing sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If complex algorithms are used for cyber event detection, then detection accuracy is improved, but computing power requirements increase beyond what is available on board the aircraft
Solution Approach 1:
The system divides the cyber event detection process into two segments: complex PCA algorithm execution is performed offline on the ground where computing resources are abundant, while only lightweight score computation is performed on-board the aircraft during flight. This segmentation allows high-accuracy detection without exceeding on-board computing power constraints.
Solution Approach 2:
The PCA loading vectors are pre-computed and stored on the aircraft before flight begins. During flight, the system only needs to compute simple scores by applying these pre-computed loading vectors to incoming log data, rather than performing the full PCA analysis in real-time. This preliminary action enables accurate cyber health assessment with minimal on-board computing resources.
2Loss of information
If all cyber log data is transmitted to the ground, then complete cyber health information is obtained, but bandwidth requirements exceed available offboard bandwidth limitations
Solution Approach 1:
The system extracts only the essential cyber health information by computing aggregated scores from the log data on-board the aircraft. Instead of transmitting all raw log data to the ground, only the computed scores are sent, which capture the critical cyber health status while occupying minimal bandwidth.
Solution Approach 2:
The system transforms the high-volume raw log data into low-volume score parameters through the PCA computation. This parameter transformation reduces the data volume from thousands of log entries to just a few numerical scores, enabling complete cyber health monitoring within bandwidth constraints.
3Loss of information
If detailed features of cyber assessment are displayed separately, then comprehensive cyber analysis is achieved, but the number of graphs required increases to hundreds for fleet-wide monitoring
Solution Approach 1:
The system merges multiple individual cyber feature assessments into a single unified score for each aircraft. By combining the PCA-derived scores into one comprehensive metric per aircraft, the system maintains full cyber analysis capability while reducing the display from hundreds of separate graphs to a single fleet-wide visualization.
4Measurement precision
If encrypted traffic is decrypted for logging, then proper cyber event inspection is enabled, but traffic performance is negatively impacted
Solution Approach 1:
Instead of decrypting the encrypted traffic, the system creates a copy of the encrypted data and computes PCA scores directly from this copy on-board the aircraft. This approach enables cyber event inspection without the need for decryption, thereby maintaining traffic performance while still achieving detection accuracy.
Data Source
AI summary
A system, method, and computer readable media for using principal components analysis (PCA) to graphically display cyber event information about an aircraft or fleet of aircraft. A ground-based security module collects historical cyber log data about the aircraft and performs PCA on the historical data to derive two principal components and their corresponding loading vectors. The loading vectors are transmitted to an air-based security module on the aircraft. The air-based security module collects real time cyber log data, computes numerical scores associated with the loading vectors on board the aircraft while the aircraft is in flight, and transmits the numerical scores to the ground-based module. The ground-based module graphically displays a comparison of the numerical scores to the corresponding loading vectors for the historical log data on a biplot to reveal trends in the cyber health of the aircraft.