Markov-Based Anomaly Correction in Embedded Systems

In this paper, an anomaly correction method is proposed which is based on Markov anomaly detection method. The proposed method employs the probability of transitions between events to evaluate the behavior of a system. This method consists of three steps: 1) Construction of transition matrix by probability of transitions between events and list of known events are generated in training phase; 2) Detection of anomaly based on Markov detection method will be done. In test data when the probability of transition previous event to current event does not reach a predefined threshold, an anomaly is detected. Threshold is determined based on constructed transition matrix in step 1; 3) Check the defined constraints for each anomalous event to find source of anomaly and the suitable way to correct the anomalous event. Next, an event with the highest compliance with the constraints is selected. Evaluation of the proposed method is done using a total of 7000 data sets. The operational scope of corrector and the number of injected anomalies varied between 3 and 5, 1 and 7, respectively. The simulation experiments have been done to measure the correction coverage rate which is between 53.5% and 97.2% with average of 77.66%. For evaluation of hardware consumptions of the proposed method, this method is implemented by VHDL. Power, area and time consumptions are on average 87.43 w, 415.48 m, and 4.12ns, respectively.