Isolation Forest Model for In-Vehicle Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection technologies for in-vehicle networks are insufficient in effectively addressing unauthorized control attacks, particularly due to high erroneous detection rates and resource constraints in Electronic Control Units (ECUs).
Innovation Solution
An information processing device and method that utilize Isolation Forest with noise-added training data, where data elements are normalized and divided into hypercubes, and noise elements are added to regions with fewer data elements to generate a learning model with reduced erroneous detection rates, adaptable to varying processing loads and resource limitations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly detection is performed using conventional methods on in-vehicle networks, then unauthorized control attacks can be detected, but the erroneous detection rate is high and false positives occur frequently
Solution Approach 1:
The patent applies preliminary action by pre-processing training data through normalization and adding noise elements before generating the learning model. This preprocessing step prepares the data in advance to improve detection accuracy and reduce erroneous detections during actual anomaly detection operations.
Solution Approach 2:
The patent changes parameters by adding noise elements to training data and normalizing data distributions. These parameter modifications to the training process improve the robustness of the learned model, enabling more accurate anomaly detection with fewer false positives in production environments.
2Reliability
If comprehensive anomaly detection processing is implemented to improve detection accuracy, then security is enhanced, but the processing load and resource consumption in ECUs increase
Solution Approach 1:
The patent performs data normalization and noise element addition in advance during the training phase. This preliminary processing creates a more robust learning model that requires less computational resources during actual anomaly detection, reducing the processing load on ECUs while maintaining high security standards.
Solution Approach 2:
The patent creates a simplified representation of normal data patterns through the learning model generated from pre-processed training data. This model copy can then be efficiently deployed in resource-constrained ECUs for real-time anomaly detection without requiring the full complexity of the original training process.
3Measurement precision
If more training data is used to improve the learning model accuracy, then detection precision increases, but the data processing time and computational resources required increase
Solution Approach 1:
The patent applies preliminary action by normalizing training data and adding noise elements before model generation. This preprocessing accelerates the learning process and improves convergence, enabling the system to achieve high detection precision with efficient use of training data and reduced processing time.
Solution Approach 2:
The patent changes the parameters of training data through normalization and noise addition, which improves the quality and distribution of training samples. This enhances detection precision while the efficient preprocessing methods keep the overall processing time manageable even with extensive training datasets.
Data Source
Figure 1A~1B
Figure 1C~3
Figure 4~5
AI summary
An information processing device has a processor. The processor receives input of data elements that are two or more vectors to be used as training data, normalizes the training data so as to be distributed throughout a first region, divides a multi-dimensional second region that encompasses the first region into third regions that are hypercubes of equal sizes, obtains a count S data elements that each of the third regions contains, and with regard to each third region including data elements of a count smaller than a first threshold value T, adds a count of (T - S) noise elements that are vectors with a uniform distribution to the third regions, generates noise-added training data including the vectors in the second region, and generates and outputs Isolation Forest learning model data using the generated noise-added training data.