Real-time embedded systems are a significant classof applications, poised to grow even further as automated vehiclesand the Internet of Things become a reality. An importantproblem for these systems is to detect anomalies during operation. Anomaly detection is a form of classification, which can be drivenby data collected from the system at execution time. We propose inter-arrival curves as a novel analytic modellingtechnique for discrete event traces. Our approach relates to theexisting technique of arrival curves and expands the techniqueto anomaly detection. Inter-arrival curves analyze the behaviourof events within a trace by providing upper and lower boundsto their inter-arrival occurrence. We exploit inter-arrival curvesin a classification framework that detects deviations within thesebounds for anomaly detection. Also, we show how inter-arrivalcurves act as good features to extract recurrent behaviour thatthese systems often exhibit. We demonstrate the feasibility andviability of the fully implemented approach with an industrialautomotive case study (CAN traces) as well as a deployedaerospace case study (RTOS kernel traces).
['Mahmoud Salem', 'Mark Crowley', 'Sebastian Fischmeister']
Anomaly Detection Using Inter-Arrival Curves for Real-Time Systems