Hybrid intrusion detection model for cyberattacks in avionics internet gateways using edge analytics

1. A method for detecting an intrusion event in a network of computing devices, the method comprising:

at a gateway device in the network, monitoring device performance and context parameters of the gateway device using live data traffic and operational parameters;

defining a steady-state operation based on expected performance of the device performance and context parameters;

comparing the steady-state operation to the monitored device performance and context parameters; and

activating a hybrid network intrusion detection technique, the hybrid network intrusion detection technique determining a presence of an intrusion event based on a comparison result of the comparing the steady-state operation to the monitored device performance and context parameters,

wherein the hybrid network intrusion detection technique includes both a signature-based detection technique having a low computation overhead and an anomaly detection technique having a higher computation overhead than the signature-based detection technique.

2. The method of claim 1 , wherein the hybrid network intrusion detection technique comprises:

comparing the steady-state operations and the device performance and context parameters to a known network intrusion signature to determine a match; and

using a first technique to detect the intrusion event when the comparing does not indicate the match; and

using a second technique to activate an anomaly detection technique when the comparing does indicate the match.

3. The method of claim 2 , wherein using the second technique comprises using the second technique when a new network intrusion event is detected.

4. The method of claim 2 , wherein the anomaly detection technique is activated using a game theory approach.

5. The method of claim 4 , wherein the game theory approach utilizes a Nash equilibrium to activate the anomaly detection technique.

6. The method of claim 2 , wherein the anomaly detection technique comprises:

simulating a network attack based on the monitored device performance and context parameters and the steady-state operations; and

based on the simulating, determining whether the monitored device performance and context parameters are indicative of a new network intrusion event.

7. The method of claim 6 , further comprising instructing an intrusion detection system to disable the new network intrusion event.

8. The method of claim 6 , further comprising:

generating a new network intrusion signature based on the new network intrusion event; and

storing the new network intrusion signature in a database of signatures for network intrusion events.

9. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a computer system, cause the processor to perform a method for detecting an intrusion event in a network of computing devices, the method comprising:

monitoring device performance and context parameters of a gateway device;

defining a steady-state operation based on expected performance of the device performance and context parameters using live data traffic and operational parameters;

comparing the steady-state operation to the monitored device performance and context parameters; and

activating a hybrid network intrusion detection technique, the hybrid network intrusion detection technique determining a presence of an intrusion event based on a comparison result of the comparing the steady-state operation to the monitored device performance and context parameters,

wherein the hybrid network intrusion detection technique includes both a signature-based detection technique having a low computation overhead and an anomaly detection technique having a higher computation overhead than the signature-based detection technique.

10. The non-transitory computer-readable medium of claim 9 , wherein the hybrid intrusion detection technique comprises:

comparing the steady-state operations and the device performance and context parameters to a known network intrusion signature to determine a match; and

using a first technique to detect the intrusion event when the comparing does not indicate the match; and

using a second technique to activate an anomaly detection technique when the comparing does indicate the match.

11. The non-transitory computer-readable medium of claim 10 , wherein using the second technique comprises using the second technique when a new network intrusion event is detected.

12. The non-transitory computer-readable medium of claim 10 , wherein the anomaly detection technique is activated using a game theory approach.

13. The non-transitory computer-readable medium of claim 10 , wherein the anomaly detection technique comprises:

simulating a network attack based on the monitored device performance and context parameters and the steady-state operations; and

based on the simulating, determining whether the monitored device performance and context parameters are indicative of a new network intrusion event.

14. The non-transitory computer-readable medium of claim 13 , wherein the method further comprises instructing an intrusion detection system to disable the new network intrusion event.

15. A server device for detecting an intrusion event in a network of computing devices, comprising:

an interface unit configured to receive information;

a data storage device storing instructions for detecting an intrusion event in a network of computing devices; and

a processor configured to execute the instructions to:

monitor device performance and context parameters of a gateway device using live data traffic and operational parameters;

define a steady-state operation based on expected performance of the device performance and context parameters;

compare the steady-state operation to the monitored device performance and context parameters; and

activate a hybrid network intrusion detection technique, the hybrid network intrusion detection technique determining a presence of an intrusion event based on a comparison result of the comparing the steady-state operation to the monitored device performance and context parameters,

wherein the hybrid network intrusion detection technique includes both a signature-based detection technique having a low computation overhead and an anomaly detection technique having a higher computation overhead than the signature-based detection technique.

16. The server device of claim 15 , wherein the processor is further configured to:

compare the steady-state operations and the device performance and context parameters to a known network intrusion signature to determine a match; and

use a first technique to detect the intrusion event when the comparing does not indicate the match; and

use a second technique to activate an anomaly detection technique when the comparing does indicate the match.

17. The server device of claim 16 , wherein the processor is further configured to use the second technique when a new network intrusion event is detected.

18. The server device of claim 16 , wherein the anomaly detection technique is activated using a game theory approach.

19. The server device of claim 16 , wherein the processor is further configured to:

simulate a network attack based on the monitored device parameters and the steady-state operations; and

based on the simulating, determine whether the monitored device parameters are indicative of a new network intrusion event.

20. The server device of claim 19 , wherein the processor is further configured to instruct an intrusion detection system to disable the new network intrusion event.