Staged ML Vehicle Cyberattack Detection With Fewer False Positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern vehicles, especially those with automated and connected systems, are vulnerable to cyber threats due to the presence of compromised computing devices, posing a significant challenge for cybersecurity in vehicle operational environments.
Innovation Solution
A method and system using a staged pipeline of unsupervised and supervised Machine Learning (ML) models to detect potential malicious attacks in vehicle operational environments. This involves creating feature vectors from vehicle operational data, detecting anomaly feature vectors using unsupervised ML models, and identifying potential cyberattack events using supervised ML models, with the aim of generating alerts for such events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unsupervised ML models are used to detect anomalies in vehicle operational data, then the detection coverage is improved, but the false positive rate increases
Solution Approach 1:
The detection system is segmented into two distinct stages: an unsupervised learning stage for comprehensive anomaly detection and a supervised learning stage for precise cyberattack identification. This segmentation allows each stage to specialize - the unsupervised stage casts a wide net to catch all potential anomalies, while the supervised stage precisely identifies true cyberattacks, thereby resolving the contradiction between detection coverage and false positive rate
Solution Approach 2:
The supervised ML model acts as an intermediary between the unsupervised anomaly detection and the final cyberattack identification. It filters the anomaly detections from the first stage, eliminating false positives while preserving true cyberattacks. This intermediary layer reconciles the high sensitivity of unsupervised detection with the precision needed for accurate cyberattack identification
2Measurement precision
If a staged pipeline with both unsupervised and supervised ML models is implemented, then the false positive rate is reduced, but the system complexity increases
Solution Approach 1:
The system is divided into two sequential processing stages with distinct functions. The first stage handles unsupervised anomaly detection, and the second stage performs supervised cyberattack classification. This functional segmentation reduces complexity by allowing each stage to be independently designed, trained, and optimized, rather than requiring a single complex model to handle both anomaly detection and false positive filtering simultaneously
Solution Approach 2:
The unsupervised ML model serves itself by automatically generating anomaly detections that are then processed by the supervised model. The system is self-configuring in the sense that the output of the first stage automatically becomes the input of the second stage, reducing the need for manual intervention and complex integration logic, thereby managing system complexity while achieving false positive reduction
Data Source
AI summary
Disclosed herein are systems and methods for detecting potential malicious attacks in vehicles operational environment using staged Machine Learning (ML), comprising creating a plurality of features vectors each comprising a plurality of features extracted from vehicle operational data generated by a plurality of devices deployed in one or more vehicles which is indicative of operation of the one or more vehicles, detecting, in real-time, a plurality of anomaly feature vectors using one or more unsupervised ML models applied to the plurality of feature vectors, identifying, in real-time, one or more potential cyberattack events using one or more supervised ML models applied to the plurality of anomaly feature vectors, and generating an alert indicative of the one or more potential cyberattack events.