Comparison and Analysis of Three Anomaly Correction Methods in Embedded Systems

Abstract

This paper proposes and compares three anomaly correction methods in embedded systems: 1) Markov-based, 2) Stide (Sequence Time-Delay Embedding)-based, and 3) Cluster-based correction methods. All these methods work online on data streams coming from sensors of embedded systems. In these methods, detection is first obtained using training on normal data, and next in runtime, the correction mechanisms can be applied. Markov-based method is based on probabilities between states, Stide-based method is based on storing common events and Cluster-based is based on clustering similar members. In detection phase, these methods check normal behavior of input data based on what is learned at train phase. Evaluation are performed using a total of 7000 data sets. The window size and the number of injected anomalies varied between 3 and 5, 1 and 7, respectively. Correction coverage for Markov-based, Stide-based, and Cluster-based methods are on average 77.66%, 60.9%, and 70.36%, respectively. Therefore, Markov-based method is the best in terms of correction coverage. Moreover, area overheads of these methods are 249.64, 63.35 and 2.08 μm2, respectively. As a trade-off, Cluster-based method shows best correction coverage compared to area, power and delay overheads.