Connected Car Network Anomaly Detection Using ML Baselines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Connected cars are vulnerable to network anomalies and security threats that can compromise safety and lead to fatal accidents, with existing solutions focusing on enterprise security or consumer cellular telephony, which are different problems in similar but distinct communication domains.
Innovation Solution
A mobility threat analytics platform for connected cars uses machine learning to recognize anomalies by training models on historical data, monitoring current network data, and generating alerts for potential threats, employing analytics modules to identify specific anomalies such as extreme volumetric changes, signal quality issues, and malicious disconnects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning models are trained on historical data to recognize anomalies, then measurement precision of anomaly detection is improved, but device complexity increases
Solution Approach 1:
The system segments the anomaly detection task into multiple specialized analytics modules, each trained to detect specific types of anomalies (e.g., volumetric anomalies, signal quality anomalies, disconnect anomalies). This modular approach improves detection precision for each anomaly type while managing overall system complexity through division of labor.
Solution Approach 2:
The system performs preliminary training of machine learning models on historical network data before deployment. This preliminary action creates pre-trained analytics modules that can immediately recognize anomaly patterns when deployed, improving detection precision without requiring complex real-time training mechanisms.
2Reliability
If analytics modules monitor current network data in real-time, then reliability of connected car communications is improved, but use of energy increases
Solution Approach 1:
The analytics modules monitor network data through periodic sampling rather than continuous analysis. The system collects network performance metrics at defined intervals and processes this periodic data to detect anomalies, maintaining communication reliability while reducing continuous energy consumption compared to constant monitoring.
Solution Approach 2:
The system uses network data as an intermediary to indirectly assess connected car communication health. Rather than directly monitoring all communication streams, the analytics modules analyze network performance metrics (volumetric data, signal quality, disconnect events) that serve as indicators of communication reliability, reducing energy requirements compared to direct comprehensive monitoring.
3Measurement precision
If the system characterizes normal behavior and learns unique network characteristics of each car brand, then measurement precision of anomaly recognition is improved, but loss of time for data processing increases
Solution Approach 1:
The system performs preliminary characterization of normal network behavior and learns unique network characteristics of each car brand during an initial training phase using historical data. This preliminary learning creates baseline models that enable rapid anomaly recognition during operational use, improving precision while minimizing real-time processing time requirements.
Solution Approach 2:
The analytics modules learn and adapt to specific parameter patterns unique to each car brand's network characteristics (e.g., typical data volumes, signal quality ranges, disconnect patterns). By tuning detection parameters based on learned brand-specific norms, the system improves anomaly recognition precision while reducing the computational time needed for comparison against standardized thresholds.
Data Source
AI summary
Aspects of the subject disclosure may include, for example, a device, having a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, including gathering and aggregating historical data provided to an APN gateway of a connected car manufacturer and a packet core of a communications network; using the historical data gathered and aggregated to train a ML model to recognize anomalies from the historical data, thereby creating a trained ML model; monitoring current data provided to the APN gateway and the packet core; and generating an alert when the trained ML model recognizes an anomaly. Other embodiments are disclosed.