Method for the automated creation of rules for a rule-based anomaly recognition in a data stream

Patent metadata

Field	Value
Publication number	US-10958675-B2
Application number	US-201816179195-A
Country	US
Kind code	B2
Filing date	Nov 2, 2018
Priority date	Dec 13, 2017
Publication date	Mar 23, 2021
Grant date	Mar 23, 2021

Abstract

A method for creating rules for recognizing anomalies in a data stream of data packets. The method includes: providing a reference time signal having successive reference points in time; for at least two data portions from one or multiple data packets determined by a selected data packet type in a data stream section, ascertaining a time series of successive values of the relevant data portion, the values of the time series corresponding to the values of the relevant data portion or being a function of these values, the values of the relevant data portion each being assigned to a respective reference point in time of the respective reference points in time; carrying out a correlation method in order to ascertain, in each case, one correlation value for at least two different time series; creating a rule for the rule-based anomaly recognition method as a function of the ascertained correlation values.

First claim

What is claimed is:

1. A method for creating at least one rule for a rule-based anomaly recognition method for recognizing anomalies in a data stream made up of data packets, each of the data packets including a respective data segment made up multiple data portions, and each data packet of the data packets having a respective time stamp contained within the data packet and a respective data packet type contained within the data packet, the method comprising:
providing a reference time signal having successive reference points in time;
selecting multiple data packets from the data packets of the data stream based on at least one selected data packet type;
ascertaining, for each respective data portion of at least two of the multiple data portions from the selected multiple data packets, a respective time series of successive values of the respective data portion, wherein values of each of the respective time series are the successive values of the respective data portion extracted from the selected multiple data packets or are ascertained via an interpolation method from the successive values of the respective data portion extracted from the selected multiple data packets, each of the values of the respective data portion being assigned to a respective reference point in time of the reference points in time;
carrying out a correlation method to ascertain, in each case, a respective correlation value for two different time series of the respective time series, the respective correlation value indicating of how strongly the two different time series are correlated to each other; and
creating the at least one rule for the rule-based anomaly recognition method as a function of the ascertained respective correlation value.

2. The method as recited in claim 1 , wherein the reference time signal is predefined by points in time of time stamps of successive data packets having a selected data packet type or by points in time of an equidistant time vector at a predefined frequency.

3. The method as recited in claim 1 , wherein the values of each respective data portion of the at least two of the multiple data portions are assigned to the reference points in time by selecting, for each of the reference points in time, a time stamp from the time stamps of the selected multiple data packets, the time stamp being nearest the reference point in time, and the value of the each respective data portion from a data packet of the selected multiple data packets having the selected time stamp is added to the respective time series.

4. The method as recited in claim 1 , wherein the values of each of the respective time series are ascertained via the interpolation method from the values of the respective data portion, the interpolation method including Nearest Neighbor, or Linear Mixed Neighbor, or Previous Neighbor, or Shape-Preserving Piecewise Cubic Interpolation.

5. The method as recited in claim 1 , wherein the ascertained respective correlation value is ascertained using a Pearson correlation.

6. The method as recited in claim 1 , wherein the at least one rule for the anomaly recognition is derived from the ascertained respective correlation value by creating a rule for those data portions, for which the ascertained respective correlation value has an absolute value that is greater than a predefined correlation threshold, the rule specifying that a chronological change of values of related data portions in data packets transmitted in chronological succession is concurrent or is non-concurrent.

7. The method as recited in claim 1 , wherein the at least one rule for the anomaly recognition is derived from the ascertained respective correlation value by ascertaining correlation values for two different data portions, in each case, for multiple data stream sections of the data stream, the rule specifying that a change of the correlation values obtained from the multiple data stream sections falls below a predefine threshold value, in terms of absolute value.

8. The method as recited in claim 1 , wherein the respective data packet type contained within each of the data packets is an ID identifier.

9. The method as recited in claim 1 , wherein the at least one rule is generated using a convolutional autoencoder, of a Long short-term memory (“LSTM”) of a Generative Adversarial Network (GAN).

10. A method for recognizing anomalies, the method comprising:
checking data packets of a data stream for anomalies in accordance with at least one rule, each of the data packets including a respective data segment made up of multiple data portions, and each data packet of the data packets having a time stamp contained within the data packet and a data packet type contained within the data packet, the at least one rule being created by performing:
providing a reference time signal having successive reference points in time;
selecting multiple data packets from the data packets of the data stream based on at least one selected data packet type;
ascertaining, for each respective data portion of at least two of the multiple data portions from the selected multiple data packets, a respective time series of successive values of the respective data portion, wherein values of each of the respective time series are the successive values of the respective data portion extracted from the selected multiple data packets or are ascertained via an interpolation method from the successive values of the respective data portion extracted from the selected multiple data packets, each of the values of the respective data portion being assigned to a respective reference point in time of the reference points in time;
carrying out a correlation method to ascertain, in each case, a respective correlation value for two different time series of the respective time series, the respective correlation value indicating of how strongly the two different time series are correlated to each other; and
creating the at least one rule for the rule-based anomaly recognition method as a function of the ascertained respective correlation value.

11. An electronic, non-transitory memory medium on which is stored a computer program for creating at least one rule for a rule-based anomaly recognition method for recognizing anomalies in a data stream made up of data packets, each of the data packets including a respective data segment made up of multiple data portions, and each data packet of the data packets having a respective time stamp contained within the data packet and a respective data packet type contained within the data packet, the computer program, when executed by a computer, causing the computer to perform:
providing a reference time signal having successive reference points in time;
selecting multiple data packets from the data packets of the data stream based on at least one selected data packet type;
ascertaining, for each respective data portion of at least two of the multiple data portions from the selected multiple data packets a respective time series of successive values of the respective data portion, wherein values of each of the respective time series are the successive values of the respective data portion extracted from selected multiple data packets or are ascertained via an interpolation method from the successive values of the respective data portion extracted from the selected multiple data packets, each of the values of the respective data portion each being assigned to a respective reference point in time of the reference points in time;
carrying out a correlation method to ascertain, in each case, a respective correlation value for two different time series of the respective time series, the respective correlation value indicating of how strongly

Assignees

• Bosch Gmbh Robert

Inventors

• La Marca Antonio
• Hanselmann Markus
• Strauss Thilo

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• H04L41/142 Primary

  using statistical or mathematical methods · CPC title

• H04L2463/121

  Timestamp · CPC title

• G06N20/00

  Machine learning · CPC title