Abstract :
This paper proposes and compares three anomaly correction methods in
embedded systems: 1) Markov-based; 2) Stide-based (sequence time-delay embedding); 3)
Cluster-based correction methods. All these methods work online on data streams coming
from sensors of embedded systems. In these methods, detection is rst obtained using
training on normal data, and next in runtime, the correction mechanisms can be applied.
Markov-based method is based on probabilities between states, Stide-based method is
based on storing common events, and Cluster-based one is based on clustering similar
members. In the detection phase, these methods check normal behavior of input data
based on what is learned at the training phase. Evaluation is performed using 7000 data
sets. The window size and number of injected anomalies vary between 3 and 5, 1 and
7, respectively. Correction coverage for Markov-based, Stide-based, and Cluster-based
methods is on average 77.66%, 60.9%, and 70.36%, respectively. Therefore, Markov-based
method is the best in terms of correction coverage. Moreover, area overheads of these
methods are 249.64, 63.35, and 2.08 m2, respectively. As a trade-o , Cluster-based method
shows the best correction coverage compared to area, power, and delay overheads.
