Embedding-Space Anomaly Detection for System-Wide Cyberattack Signals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods in computer systems, particularly in automotive and vehicular systems, struggle to identify abnormal combinations of processes and are prone to generating excessive alerts, failing to provide a system-wide view of cyber-attacks due to their focus on specific attack vectors.
Innovation Solution
Anomaly detection using embedding space representation of system states, where processes are categorized into bins based on features, probabilities are calculated, and normalized, transforming system snapshots into vectors in an embedding space for training an anomaly detection model to identify cyber-attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing anomaly detection methods focus on specific attack vectors, then they can detect known attack patterns, but they fail to provide a system-wide view and generate excessive alerts
Solution Approach 1:
The patent transforms the anomaly detection approach by moving from analyzing individual process features to representing entire system states as single points in an embedding space. This dimensional transformation allows the system to capture system-wide patterns and relationships that were previously invisible when focusing on specific attack vectors or individual processes.
Solution Approach 2:
The patent merges multiple process features and system state information into a single embedded vector representation. By combining information from all processes and features into one unified system state vector, the method achieves comprehensive system-wide coverage while reducing the complexity of analyzing individual components separately.
2Measurement precision
If traditional methods monitor individual processes separately, then they can identify specific process anomalies, but they fail to detect abnormal combinations of processes
Solution Approach 1:
The patent combines information from multiple individual process states into a unified system state representation in the embedding space. This merging allows the detection model to identify abnormal combinations of processes by analyzing the collective system state rather than individual processes in isolation.
Solution Approach 2:
By transforming individual process monitoring into system state embedding, the patent creates a new dimensional space where process combinations are naturally represented. This dimensional change enables the detection of complex multi-process attack patterns that cannot be detected by monitoring individual processes separately.
3Measurement precision
If anomaly detection algorithms use detailed process features, then they can identify specific attack behaviors, but they require manual listing of attack vectors and lack generalization
Solution Approach 1:
The patent creates an embedded copy or representation of the entire system state in a compressed vector form within the embedding space. This embedded representation captures the essential characteristics of system behavior without requiring explicit knowledge of specific attack vectors, enabling generalization to unseen attacks while maintaining detection precision.
Solution Approach 2:
The embedding space representation serves as a universal framework that can detect various types of attacks without requiring separate detection rules for each attack vector. The system-wide state embedding provides a multi-functional detection capability that generalizes across different attack scenarios, eliminating the need for manual attack vector listing.
Data Source
AI summary
A method, system, and computer program product for anomaly detection using embedding space representation of system states. An anomaly detection model is trained using an anomaly detection algorithm and a plurality of reference vectors obtained using an embedding space representation process configured for mapping to a single point vector in an embedding space each of a plurality of system state snapshots comprised in a training dataset and each capturing during a defined time window a plurality of features of each process operating in the system. Responsive to receiving a testing dataset comprising one or more system state snapshots, one or more vectors in the embedding space are obtained using the embedding space representation process for mapping each system state snapshot in the testing dataset, and the anomaly detection model is used to determine whether a vector of the one or more vectors being indicative of a cyber-attack on the system.