Factorization-based Attribute Residual Summary for Adaptive Edge-based Autonomous System Security

Due to the particularity of the marginal environment, edge-based autonomous systems face significant risks associated with security operations. Traffic anomaly detection in edge-based autonomous systems has become increasingly crucial for ensuring the security of these systems. Existing works lack consideration of the relationship between traffic attributes and anomaly types. In particular, existing solutions struggle with detecting anomalies that primarily manifest statistical signs in only a few attributes. To address this, we propose a nonnegative factorization-based attribute residual summary and a nonparametric statistic framework for adaptive security monitoring in edge-based autonomous systems. Specifically, the nonnegative factorization, which depends on the multiplicative update rules, is introduced to extract attribute features. Using the tensor linear representation, the attribute residual summary is built, which depicts the statistic discrepancy well even if only a few of traffic attributes are affected, to implement adaptive security monitoring for various attacks in edge-based autonomous systems. Then, a nonparametric statistic framework is developed, which achieves the real-time detection by accumulating and comparing each statistic evidence. Extensive experiments with real-world traffic trace datasets validate the adaptivity, accuracy, real-time performance, and superiority of our method, particularly in dealing with anomalies that exhibit statistical signs in only a few traffic attributes.