Two effective anomaly correction methods in embedded systems

Abstract

In this paper, two anomaly correction methods are proposed which are based on Markov and Stide detection methods. Both methods consist of three steps: 1) Training, 2) Anomaly detection and 3) Anomaly Correction. In training step, the Morkov-based method constructs a transition matrix; Stidebased method makes a database by events with their frequency. In detection step, when the probability of transition from previous event to current event does not reach a predefined threshold, the morkov-based method detects an anomaly. While, if frequency of unmatched events exceeds from the threshold value, Stide-based method determined an anomaly. In the correction step, the methods check the defined constraints for each anomalous event to find source of anomaly and a suitable way to correct the anomalous event. Evaluation of the proposed methods are done using a total of 7000 data sets. The window size of corrector and the number of injected anomalies varied between 3 and 5, 1 and 7, respectively. The experiments have been done to measure the correction coverage rate for Markov-based and Stide-based methods which are on average 77.66% and 60.9%, respectively. Area consumptions in Makov-based and Stide-based methods are on average 415.48μm2 and 239.61μm2, respectively.