PulseAnomaly: Unsupervised Anomaly Detection on Avionic Platforms With Seasonality and Trend Modeling in Transformer Networks

For communication within military avionic platforms (e.g., F-15 and F-35), the US Department of Defense established MIL-STD-1553 military standard. It has been released for more than 50 years and is still used in platforms other than military avionics. It was originally produced to be used with military avionics, but in the following decades, it was adopted into all branches of the armed forces, as well as spacecraft and commercial avionics. However, potential attacks against the MIL-STD-1553 may exist due to the demand for internet communication between planes and the lack of security. The current study presents <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">PulseAnomaly</i>, a novel unsupervised anomaly detection model for the MIL-STD-1553 bus that utilizes time-feature and message sequences. Our model demonstrates better performance compared to baseline models in the test, achieving a higher F1-score and showing excellent AUROC compared to existing methods. Additionally, we have used data from a recently developed open-source MIL-STD-1553 real-time bus simulator, which features a more diverse range of attacks and data points that more closely resemble real-world scenarios. Evaluation results show that our model outperforms existing unsupervised solutions.