Anomaly Detection Event Handling via Randomized Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems in motor vehicles face challenges in efficiently handling anomalies without overloading the system, ensuring data integrity, and preventing unauthorized manipulation or deletion of logging entries.
Innovation Solution
A method where the decision to further process, store, or reduce events is made randomly, ensuring nondeterministic behavior and reducing the number of events to simplify processing. This involves using vehicle-specific random numbers to select events, storing them in memory, and adjusting the selection based on memory fill state to prevent overflow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all detected anomalies are stored and processed, then complete logging coverage is achieved, but system overload and memory overflow occur under high event rates
Solution Approach 1:
The system applies partial action by randomly selecting only a subset of detected anomalies for storage and processing. Instead of handling all anomalies deterministically, the logger uses probabilistic sampling to process approximately 10% of events, thereby reducing processing load while maintaining representative logging coverage. This resolves the contradiction by accepting partial logging in exchange for system stability under high event rates.
2Ease of operation
If deterministic logging behavior is used, then predictable processing is achieved, but intrusion patterns become detectable and manipulable
Solution Approach 1:
The system transitions from deterministic to dynamic behavior by introducing randomness into the logging selection process. The logger dynamically decides which anomalies to store based on random probability rather than fixed rules, making the logging pattern unpredictable to intruders. This dynamic approach maintains processing simplicity while enhancing security by preventing pattern recognition and manipulation.
3Quantity of substance
If memory buffering is increased to handle high event rates, then logging capacity is improved, but memory overflow risk increases under prolonged intrusions
Solution Approach 1:
The system applies partial action by storing only a random subset of anomalies rather than buffering all detected events. This probabilistic sampling approach limits memory usage to approximately 10% of the total event volume, preventing memory overflow under prolonged intrusions while maintaining representative logging coverage. The trade-off accepts partial data loss in exchange for memory stability.
Data Source
AI summary
A method for handling an anomaly of data, in particular in a motor vehicle. At least one sensor obtains data for the anomaly detection. The sensor examines the obtained data for anomalies, and generates an event as a function of the associated data when an anomaly is detected. It is decided whether the event is further processed, in particular stored and/or further communicated, at least in part.