Anomaly Detection Using Inter-Arrival Curves for Real-time Systems

TitleAnomaly Detection Using Inter-Arrival Curves for Real-time Systems
Publication TypeConference Paper
Year of Publication2016
AuthorsSalem, M., M. Crowley, and S. Fischmeister
Conference NameInternational Euromicro Conference on Real-Time Systems (ECRTS)
Conference LocationToulouse, France

Real-time embedded systems are a significant class of applications, poised to grow even further as automated vehicles and the Internet of Things become a reality. An important problem for these systems is to detect anomalies during operation.  Anomaly detection is a form of classification, which can be driven by data collected from the system at execution time.  We propose inter-arrival curves as a novel analytic modelling technique for discrete event traces. Our approach relates to the existing technique of arrival curves and expands the technique to anomaly detection. Inter-arrival curves analyze the behaviour of events within a trace by providing upper and lower bounds to their inter-arrival occurrence. We exploit inter-arrival curves in a classification framework that detects deviations within these bounds for anomaly detection. Also, we show how inter-arrival curves act as good features to extract recurrent behaviour that these systems often exhibit. We demonstrate the feasibility and viability of the fully implemented approach with an industrial automotive case study (CAN traces) as well as a deployed aerospace case study (RTOS kernel traces).

Refereed DesignationRefereed
Related files: 


Looking for motivated students (undergrads and grads) interested in working on embedded software and systems research. Mail Sebastian Fischmeister for further information.