Aircraft On-board Incident Detection System with Distributed Agents
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software solutions for monitoring aircraft computer resources in the flight control domain are hindered by resource-intensive requirements for storage and computing power, and lack sufficient log data for analysis, making it impossible to implement Security Information and Event Management (SIEM) systems on board aircraft effectively.
Innovation Solution
A system on board an aircraft that detects and responds to incidents with minimal computing power and storage needs, utilizing multiple agents and a collector to analyze events, apply incident detection logic, and record logs, which can then be transmitted to a security operations center, allowing for real-time identification and reporting of security incidents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SIEM software is implemented on board aircraft to monitor information security, then security incident detection capability is improved, but computing power and storage requirements increase significantly
Solution Approach 1:
The system segments the monitoring function into multiple independent agents (file agent, network agent, registry agent, etc.), each responsible for specific monitoring tasks. This segmentation reduces the computational burden on any single component and allows distributed log collection across multiple system locations, thereby improving security monitoring capability without concentrating excessive computing and storage demands in one place.
Solution Approach 2:
The patent introduces a log collector as an intermediary component that centralizes log data from various agents and system sources. This intermediary consolidates the storage and processing demands, allowing agents to focus on lightweight monitoring tasks while the collector handles the heavier burden of log aggregation, analysis, and security incident detection, thus resolving the contradiction between detection capability and resource consumption.
2Loss of information
If comprehensive log collection is implemented across all applications, then analysis material availability is improved, but device complexity and resource consumption increase
Solution Approach 1:
The patent implements a universal log collection architecture where multiple specialized agents (file agent, network agent, registry agent, process agent) all feed into a single standardized log collector. This universal interface allows comprehensive log collection from diverse sources without increasing overall system complexity, as each agent follows the same collection and transmission protocol to the central collector.
Solution Approach 2:
The system employs self-configuring agents that automatically identify and collect relevant logs from their designated sources without requiring manual configuration or complex management. Each agent autonomously monitors its specific domain (files, network, registry, processes) and automatically transmits logs to the collector, reducing the operational complexity while maintaining comprehensive log coverage.
Data Source
Figure 1
Figure 2
AI summary
The invention relates to an aircraft-mounted incident detection and response system with log logging. The aircraft comprises a computer (12) including applications (30, 32, 34, 36) that use and generate data and are configured to detect events based on this data and predefined information specifying these events. The system includes, for the computer (12), an agent (A, B, C, F) and a collector (22). The agent is an application component dedicated to a specific application and is configured to apply incident detection logic to detected events, to detect at least one incident, and to transmit each detected incident (42) to the collector (22) via detection messages, following a configurable transmission logic. The collector (22) is configured to receive the messages and to apply a configurable logging logic to the messages, storing them in one or more logs.