Low-level Anomaly Detection in Embedded Systems Using Machine Learning

Let us consider an embedded system as a specific combination of hardware and software that is capable of consistently providing a certain service. Depending on the boundary conditions of the system, such as the working environment and the number of users served, we can say that the statistical distribution of resource usage is a characterization of the embedded system itself and its footprint. The consequence of this distinguishable footprint for embedded systems is that it becomes possible to use the statistical deviation of the resource usage distribution to identify anomalies. In this paper, we will analyze which Performance Metric Unit counters (e.g., CPU usage, memory usage) and resource profiles (e.g., system logs, performance metrics) are most characteristic for detecting a lowlevel anomaly: an alteration of the firmware working cycle or the propagation of a hardware error in the system. We will do this by using baseband products for radio access networks. We will demonstrate that using a machine learning model makes it possible to distinguish both the firmware cycle alteration and the hardware error reporting with an accuracy of more than 99% on unseen and new dataset.