Avionics Network Anomaly Attribution for Faults and Cyberattacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Avionics and vetronics systems are vulnerable to cyberattacks and traditional cybersecurity measures are inadequate in detecting anomalies and attributing them to either component failures or cyber threats, which can lead to severe disruptions.
Innovation Solution
A system and method using a condition-based maintenance model and a cyber-defense model to monitor cyber-physical systems in real-time, detect anomalies, differentiate between component failures and cyberattacks, and generate alerts for appropriate action.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional cybersecurity measures are used to monitor avionics and vetronics systems, then basic security protection is provided, but the system cannot effectively detect anomalies or distinguish between component failures and cyberattacks
Solution Approach 1:
The monitoring system is segmented into two specialized models: a condition-based maintenance model for detecting component failures and a cyber-defense model for detecting cyberattacks. Each model focuses on specific types of anomalies, improving detection precision without requiring a single monolithic complex system to handle all detection scenarios
Solution Approach 2:
The patent introduces an intermediary anomaly detection layer that sits between the physical system and the response mechanisms. This intermediary layer processes raw system data through both maintenance and cyber-defense models, distinguishes between different anomaly types, and triggers appropriate responses, thereby enhancing detection capability while managing complexity through modular architecture
2Reliability
If the system monitors all data parameters in real-time to detect all possible anomalies, then detection coverage is improved, but processing time and computational resources increase
Solution Approach 1:
The monitoring system applies different quality levels of analysis to different data parameters based on their criticality. The cyber-defense model focuses on specific parameters indicative of cyberattacks (communication patterns, access attempts), while the maintenance model focuses on parameters indicative of component degradation. This localized focus improves detection reliability for critical parameters without processing all parameters at maximum depth, reducing overall processing time
Solution Approach 2:
The system performs partial monitoring of all parameters but applies excessive (deep) analysis only to parameters that show anomaly indicators or are critically important. Normal parameters receive routine monitoring with lower processing overhead, while suspicious parameters trigger deeper analysis using both models, balancing comprehensive coverage with efficient resource utilization and timely detection
3Measurement precision
If the system uses a single model to detect all anomalies, then system simplicity is maintained, but the ability to accurately attribute anomalies to specific causes (component failure vs. cyberattack) deteriorates
Solution Approach 1:
The detection system is segmented into two specialized models with distinct purposes: the condition-based maintenance model specializes in identifying component failures through patterns like gradual degradation and operational parameter deviations, while the cyber-defense model specializes in identifying cyberattacks through patterns like unauthorized access attempts and malicious communication patterns. This segmentation enables accurate anomaly attribution by matching observed anomalies to the appropriate specialized model
Solution Approach 2:
The system changes the parameters and metrics monitored by each model to match their specialized detection goals. The maintenance model monitors parameters related to component health, wear, and operational conditions, while the cyber-defense model monitors parameters related to network traffic, access patterns, and security events. This parameter specialization improves attribution accuracy without requiring a single model to master all detection parameters, managing complexity through differentiated monitoring
Data Source
AI summary
A method for detecting and attributing the cause of anomalies within a cyber-physical system such as in avionics or vetronics network is disclosed. The method comprises monitoring, via at least one processor, data of one or more components within the avionics and vetronics network in real time; determining, via the at least one processor, one or more anomalies from the monitored data using a condition-based maintenance model and a cyber-defense model; determining, via the at least one processor, whether the one or more anomalies is related to a cascading fault using the condition-based maintenance model and the cyber-defense model; determining, via the at least one processor, the one or more anomalies corresponding to a component failure or an evidence of the cyberattack; and generating, via the at least one processor, one or more alerts for a user associated with the one or more anomalies.