Two effective methods to detect anomalies in embedded systems

摘要

Current-day embedded systems are very vulnerable to faults and defects. Anomaly detection is often the primary means of providing early indication of faults and defects. This paper presents two methods for detecting anomalies in embedded systems. The first method, buffer based detector, constructs a buffer consisting of events from a stream of data considered to be normal. Consequently, during test stage, if an event does not exist in the buffer, a miss will happen. An anomaly exists in test data provided that the hit rate of the buffer does not reach a predefined threshold. The second method namely probabilistic detector employs the probability of data events to evaluate the behavior of system. In order to measure the probability of events in the system, sampling of two events with distinct distance is done. Eventually, during test stage, the probability of events can be measured. An anomaly exists in test data provided that this probability does not reach a predefined threshold. A comparison between these two methods and other typical methods has been done based on detection coverage, area overhead and delay overhead. The experiments on 112 standard benchmarks show that the proposed methods can detect 100% of anomalies. Also, the area overhead of the proposed detectors grows linearly, while the area overhead of other typical detectors grows exponentially by the increase in one of the detector's parameters.