Embedded Threat Detector for Avionics Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current aircraft computing systems are vulnerable to threats like Zero Day Attacks and Man-in-the-middle attacks, which can compromise avionics systems and flight safety, and existing malware protection methods are inadequate for airborne applications due to space and weight constraints.
Innovation Solution
An Embedded Threat Detector (ETD) is integrated within a non-bypassable root virtual machine in the avionics system controller, generating and comparing real-time signatures with pre-defined controlled signatures to detect deviations exceeding a tolerance threshold, alerting users to potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion detection mechanisms are used to monitor for illicit activity, then threat detection capability is improved, but hardware modifications are required which increase space and weight
Solution Approach 1:
The patent replaces traditional hardware-based intrusion detection mechanisms with a software-based solution. The ETD is implemented as a virtual machine monitor or kernel module that runs on the existing avionics processor, eliminating the need for additional hardware components. This substitution maintains threat detection capability while avoiding the weight and space penalties of hardware modifications.
Solution Approach 2:
The ETD is designed to provide multiple functions within a single software component: it monitors system calls, analyzes binary code, detects malware signatures, and generates alerts. This multi-functional approach consolidates what would traditionally require multiple separate hardware components into a single software solution that leverages the existing avionics system's processing capabilities.
2Reliability
If enterprise firewall solutions are deployed to protect against malware, then malware protection is improved, but the system requires specific threat definitions and hardware modifications
Solution Approach 1:
The ETD operates autonomously within the avionics system, monitoring its own environment and making real-time security decisions without requiring external intervention. The system self-manages threat detection, analysis, and response, eliminating the need for complex external firewall infrastructure and reducing overall system complexity.
Solution Approach 2:
The patent implements a learning mode where the ETD pre-establishes a baseline of normal system behavior before entering detection mode. By capturing and analyzing normal system call patterns and binary code execution during a learning phase, the system prepares threat detection parameters in advance, enabling faster and more accurate real-time detection without requiring complex runtime analysis.
3Measurement precision
If exact signature matching is used for threat detection, then detection precision is improved, but false positives increase due to normal system variations
Solution Approach 1:
The patent transitions from static exact signature matching to dynamic signature verification. The ETD learns normal system behavior patterns during a learning mode and adapts its detection thresholds based on observed variations. This dynamic approach allows the system to distinguish between benign variations and actual threats, reducing false positives while maintaining detection precision.
Solution Approach 2:
The system changes the detection parameter from exact binary matching to statistical deviation analysis. Instead of requiring perfect signature matches, the ETD measures deviations from learned baseline behavior and triggers alerts only when deviations exceed dynamically determined thresholds. This parameter change enables the system to tolerate normal variations while detecting actual malware.
4Adaptability or versatility
If connectivity is increased for IT integration, then system flexibility is improved, but vulnerability to network threats increases
Solution Approach 1:
The ETD acts as an intermediary layer between the avionics system and external networks. It monitors and controls all system calls and binary code execution, blocking malicious traffic while allowing legitimate communication. This intermediary function enables the system to maintain IT connectivity and flexibility while protecting against network-based threats.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for detecting a threat to an avionics system includes an Embedded Threat Detector (ETD) (100) providing a non-bypassable module which compares run time signatures (124) of each running application with pre-defined database of signatures. Any variation outside of pre-defined bounds implies an existence of malware. The ETD is located in a root Virtual Machine (VM0) and has two modes of operation. A learning mode (110) in a controlled environment generates a database of controlled signatures for each software thread as the software is executed. Conversely, in the run mode (120) during operations, the ETD generates signatures in real time and compares the real time signatures with the controlled signatures. A mismatch exceeding specified limits generates an alert and notifies a user.