Efficient graph pattern matching framework for network-based in-vehicle fault detection

Abstract

Abnormal messages propagated from faulty operations in an in-vehicle network may severely harm a vehicular system, but they cannot be easily detected when their information is not known in advance. To support an efficient detection of faulty message patterns propagated in the in-vehicle network, this paper presents a novel graph pattern matching framework built upon a message log-driven graph modeling. Our framework models the unknown operation of the in-vehicle network as a query graph and the reference database of normal operations as data graphs. Given a query graph and data graphs, we determine whether the query graph represents normal or fault operation by using the distance measure on the data graphs. The analysis of the faulty message propagation requires to consider the sequence of events in the distance measure, and thus, using the conventional graph distance measures can generate false negatives due to the lack of consideration of the sequence relationships among the events. We therefore propose a novel distance metric based on the maximum common subgraph (MCS) between two graphs and the sequence numbers of messages, which works robustly even for the abnormal faulty patterns and can avoid false negatives in large databases. Since the problem of MCS computation is NP-hard, we also propose two efficient filtering techniques, one based on the lower bound of the MCS distance for a polynomial-time approximation and the other based on edge pruning. Experiments performed on real and synthetic datasets to assess our framework show that ours significantly outperforms the previously existing methods in terms of both performance and accuracy of query responses.