Embedded Threat Detector for Avionics Malware Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current aircraft computing systems are vulnerable to threats like Zero Day Attacks and Man-in-the-middle attacks, which can compromise avionics systems and flight safety, and existing malware protection methods are inadequate for airborne applications due to space and weight constraints.

Innovation Solution

An Embedded Threat Detector (ETD) is integrated within a non-bypassable root virtual machine in the avionics system controller, generating and comparing real-time signatures with pre-defined controlled signatures to detect deviations exceeding a tolerance threshold, alerting users to potential threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional intrusion detection mechanisms are used to monitor for illicit activity, then threat detection capability is improved, but hardware modifications are required which increase space and weight

Engineering Contradiction:
Improvethreat detection capabilityVSAvoidhardware weight
Core Design Contradiction:
ReliabilityVSWeight of moving object

Solution Approach 1:

The patent replaces traditional hardware-based intrusion detection mechanisms with a software-based solution. The ETD is implemented as a virtual machine monitor or kernel module that runs on the existing avionics processor, eliminating the need for additional hardware components. This substitution maintains threat detection capability while avoiding the weight and space penalties of hardware modifications.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The ETD is designed to provide multiple functions within a single software component: it monitors system calls, analyzes binary code, detects malware signatures, and generates alerts. This multi-functional approach consolidates what would traditionally require multiple separate hardware components into a single software solution that leverages the existing avionics system's processing capabilities.

Inventive Principle:
Principle #6Universality (Multi-functionality)

2Reliability

If enterprise firewall solutions are deployed to protect against malware, then malware protection is improved, but the system requires specific threat definitions and hardware modifications

Engineering Contradiction:
Improvemalware protectionVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The ETD operates autonomously within the avionics system, monitoring its own environment and making real-time security decisions without requiring external intervention. The system self-manages threat detection, analysis, and response, eliminating the need for complex external firewall infrastructure and reducing overall system complexity.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The patent implements a learning mode where the ETD pre-establishes a baseline of normal system behavior before entering detection mode. By capturing and analyzing normal system call patterns and binary code execution during a learning phase, the system prepares threat detection parameters in advance, enabling faster and more accurate real-time detection without requiring complex runtime analysis.

Inventive Principle:
Principle #10Preliminary action

3Measurement precision

If exact signature matching is used for threat detection, then detection precision is improved, but false positives increase due to normal system variations

Engineering Contradiction:
Improvesignature matching precisionVSAvoidfalse positive rate
Core Design Contradiction:
Measurement precisionVSReliability

Solution Approach 1:

The patent transitions from static exact signature matching to dynamic signature verification. The ETD learns normal system behavior patterns during a learning mode and adapts its detection thresholds based on observed variations. This dynamic approach allows the system to distinguish between benign variations and actual threats, reducing false positives while maintaining detection precision.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The system changes the detection parameter from exact binary matching to statistical deviation analysis. Instead of requiring perfect signature matches, the ETD measures deviations from learned baseline behavior and triggers alerts only when deviations exceed dynamically determined thresholds. This parameter change enables the system to tolerate normal variations while detecting actual malware.

Inventive Principle:
Principle #35Parameter changes

4Adaptability or versatility

If connectivity is increased for IT integration, then system flexibility is improved, but vulnerability to network threats increases

Engineering Contradiction:
Improvesystem flexibilityVSAvoidnetwork vulnerability
Core Design Contradiction:
Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The ETD acts as an intermediary layer between the avionics system and external networks. It monitors and controls all system calls and binary code execution, blocking malicious traffic while allowing legitimate communication. This intermediary function enables the system to maintain IT connectivity and flexibility while protecting against network-based threats.

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentEP3764261B1Embedded threat detector
Publication Date: 2025.11.05 ROCKWELL COLLINS INC
  • EP3764261B1 patent drawingFigure 1
  • EP3764261B1 patent drawingFigure 2
  • EP3764261B1 patent drawingFigure 3

AI summary

A method for detecting a threat to an avionics system includes an Embedded Threat Detector (ETD) (100) providing a non-bypassable module which compares run time signatures (124) of each running application with pre-defined database of signatures. Any variation outside of pre-defined bounds implies an existence of malware. The ETD is located in a root Virtual Machine (VM0) and has two modes of operation. A learning mode (110) in a controlled environment generates a database of controlled signatures for each software thread as the software is executed. Conversely, in the run mode (120) during operations, the ETD generates signatures in real time and compares the real time signatures with the controlled signatures. A mismatch exceeding specified limits generates an alert and notifies a user.