Staged ML Vehicle Cyberattack Detection With Fewer False Alerts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern vehicles, especially connected and autonomous ones, are vulnerable to cyber threats due to their reliance on electronic systems, which existing cybersecurity methods struggle to address effectively, often balancing false negative and false positive detection tradeoffs in anomaly identification.
Innovation Solution
A staged pipeline of unsupervised and supervised Machine Learning models is employed to detect potential cyberattacks, where unsupervised models identify anomaly feature vectors with high recall to minimize false negatives, and supervised models filter out false positives and identify potential cyberattacks with reduced labeled training data requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unsupervised ML models are used to detect anomalies with high recall, then false negative detection is minimized, but false positive detection increases
Solution Approach 1:
The detection system is segmented into two distinct stages: an unsupervised ML model for initial anomaly detection with high recall, followed by a supervised ML model for filtering false positives. This segmentation allows each model to be optimized for its specific function, resolving the contradiction between minimizing false negatives and reducing false positives.
Solution Approach 2:
The supervised ML model acts as an intermediary between the unsupervised anomaly detector and the final alert generation. It receives anomaly feature vectors from the unsupervised model, applies learned patterns from labeled data, and filters out false positives before generating alerts, thus mediating the trade-off between sensitivity and precision.
2Measurement precision
If supervised ML models are trained with extensive labeled data, then detection accuracy improves, but computational and manual effort increases
Solution Approach 1:
The supervised ML model is trained only on anomaly feature vectors identified by the unsupervised model, rather than training on all possible feature vectors. This partial action approach uses a subset of relevant labeled data, reducing training effort while maintaining detection accuracy for the specific anomaly detection task.
Solution Approach 2:
The unsupervised ML model performs preliminary filtering to identify anomaly feature vectors before the supervised model processes them. This preliminary action reduces the volume of data requiring expensive labeled training, allowing the supervised model to achieve high accuracy with less training effort.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Disclosed herein are systems and methods for detecting potential malicious attacks in vehicles operational environment using staged Machine Learning (ML), comprising creating a plurality of features vectors each comprising a plurality of features extracted from vehicle operational data generated by a plurality of devices deployed in one or more vehicles which is indicative of operation of the one or more vehicles, detecting, in real-time, a plurality of anomaly feature vectors using one or more unsupervised ML models applied to the plurality of feature vectors, identifying, in real-time, one or more potential cyberattack events using one or more supervised ML models applied to the plurality of anomaly feature vectors, and generating an alert indicative of the one or more potential cyberattack events.