Online behavior classification for anomaly detection in self‐x real‐time systems. (21st July 2015)

• Record Type: Journal Article
• Authors: Rammig, Franz; Stahl, Katharina
• Other Names: Higuera‐Toledano M. Teresa guestEditor.; Brinkschulte Uwe guestEditor.; Rettberg Achim guestEditor.; Qiang Weizhong guestEditor.; Zheng Xianghan guestEditor.; Hsu Ching‐Hsien guestEditor.
• Is Part Of: Concurrency and computation. Volume 28:Number 14(2016)
• Page Start: 3751
• Page End: 3772
• Publication Date: 2015-07-21
• Subjects: anomaly detection -- behavior classification -- real‐time operating systems -- self‐x systems -- danger theory -- artificial immune systems -- online pattern matching -- suffix trees; Parallel processing (Electronic computers) -- Periodicals; Parallel computers -- Periodicals; 004.35
• DOI: 10.1002/cpe.3567
• Languages: English
• ISSNs: 1532-0626

Abstract

Summary: Autonomous adaptation in self‐adapting embedded real‐time systems introduces novel risks as it may lead to unforeseen system behavior. An anomaly detection framework integrated in a real‐time operating system can ease the identification of such suspicious novel behavior and, thereby, offers the potential to enhance the reliability of the considered self‐x system. However, anomaly detection is based on knowledge about normal behavior. When dealing with self‐reconfiguring applications, normal behavior changes. Hence, knowledge base requires adaptation or even re‐construction at runtime. The stringent restrictions of real‐time systems considering runtime and memory consumption make this task to a really challenging problem. We present our idea for online construction of application behavior knowledge that does not rely on training phase. The applications' behavior is defined by the application's system call invocations. For the knowledge base, we exploit suffix trees as they offer potentials to represent application behavior patterns and associated information in a compact manner. The online algorithm provided by suffix trees is a basis to construct the knowledge base with low computational effort. Anomaly detection and classification is integrated into the online construction method. New behavioral patterns do not unconditionally update the behavior knowledge base. They are evaluated in a context‐related manner inspired by Danger Theory, a special discipline of artificial immune systems. Copyright © 2015 John Wiley & Sons, Ltd.