A model for detecting anomalous data based on the research of sample uniformity is proposed. The method is designed to solve the detecting changes problem in the flow' state of controlled data using normal and gamma distributions models based on the Spearman nonparametric statistics criterion. The research results about intensity values that influence on requests generating, the intensity of servicing applications, the system load, the volume of samples, the time points of measuring characteristics and significance levels on the change the control object state are presented. The method can be used to control the process of detecting changes in UMV resources states. Currently, the process of anomalies rapid detection in the monitoring data of critical infrastructure objects is a complex, time-consuming and difficult to formalize task. Intrusion detection systems are the most effective counter-measure and the most reliable approach to ensure the protection of automotive networks or traditional computer networks.
Research conducted to date in the field of vehicle protection has solved a number of safety problems and offered a many solutions. However, there are still open problems that require further study. The need to solve problems that ensure the security of the critical information infrastructure in the "smart city" is due not only to the growth trends of traffic flows, but also to significant changes in the digital technologies field used on vehicles, when interaction with the environment is carried out through the network through interfaces: V2V, V2X, V2P ,V2G, V2D. The article considers a simulation model that allows you to simulate the changes dynamics in the objects states, and can be considered as one of the possible approaches to improve the methods of protecting critical objects, in particular, intelligent vehicles in VANET networks.
Currently, the process of anomalies rapid detection in the monitoring data of critical infrastructure
objects is a complex, time-consuming and difficult to formalize task. Intrusion detection systems (IDS)
are the most effective counter-measure and the most reliable approach to ensure the protection of
automotive networks or traditional computer networks [
It is necessary to develop a software simulation model of a critical object in the form of a queuing system and conduct a series of experiments on it in order to test the effectiveness of the proposed intelligent methods for detecting changes in the monitoring objects state, as well as to investigate the critical parameters influence on changes in the object state: request generation rate – λ and σ(λ); application service intensity – μ and σ(μ); system load – ρ; sample sizes – n; significance levels – p. time moments of characteristics measurements – τ;
The influence of these parameters is estimated using normal and gamma distribution models based
on Spearman's nonparametric statistics criterion. To simulate the changing object state process, a
discrete-event model of the general-purpose simulation environment Anylogic was used [
Let’s conduct an experiments series in which the receipt intensity and applications processing in the
system are distributed according to the normal law [
Consider a single-channel QS with the following characteristics: request generation rate M(λ)=0.7, σ(λ)=0.09; application service intensity M(μ)=0.8 and σ(μ)=[0.17; 0.2; … ; 0.4]; storage capacity N=5; method of organizing and manipulating applications – FCFS.
The critical values of the Student's t-test for the given sample sizes and confidence probabilities are presented in Table 1.
n=40 2.711558 2.980293 3.565678
t(40‐2) 2.834956 3.098965 3.267130
n=60 2.663287 2.918394 3.466329
t(60‐2) 3.129703 3.325995 3.503136
The experimental results from Figure 1: are shown at the diagram on Figure 3:. Critical values are shown for the sample n=40. As we can see from the graphs with the sample size n=40, and significance level p=0.01, the model is constantly located in the hetero region, which calls into question the objectivity of the results obtained. In this example, we recommend using the significance level p=0.001.
E x p e r i m e n t a l r e s u l t s f o r d i f f e r e n t v o l u m e s n
We will conduct a series of experiments on the simulation model, varying the time points τ= 21, 31, 41] of characteristics, for samples with volume n= 20, 40, 60]. The generating requests intensity M(λ) and servicing requests intensity M(μ) don’t change. Critical values are shown for the sample n=20. The experimental results - t(n) for different time points τ, at n=20 are shown on Figure 2:. For the time points τ=21,41 at n=20 G- the effect does not appear.
E x p e r i m e n t a l r e s u l t s f o r d i f f e r e n t t i m e p o i n t s a t
n = 2 0 0.26 0.32 0.33 0.35 0.37 0.38 0.4 4,5
4 ts3,5 e ‐tt 3 2,5 2 5 4 t s3 e t ‐ t2 1 0 itself, and is stable for τ=31, 41.
At τ=21 the G-effect is unstable for the specified sample volumes.
Let’s conduct a series of experiments with the changed values of the mathematical expectation and the standard deviation: the intensity of requests received M(λ)=0.8, σ(λ)=0.02; request service intensity M(μ)=0.9 and σ(μ)= [0.17; 0.2; …; 0.43].
Experimental results - t(n) for n= [20, 40, 60] are shown at Figure 3:. Critical values are shown for the sample n=40.
E x p e r i m e n t a l r e s u l t s w i t h c h a n g e d v a l u e s o f m a t h . e x p e c t a t i o n s a n d m e a n s q u a r e d e v i a t i o n ts 2,5 e t ‐ t 4,5
4 3,5 3 2 1 0 1,5 0,5 ρ=0.5 and ρ=0.375 the model is permanently located in the hetero region. 4. Gamma distribution of requests intensities
Let’s conduct a series of experiments in which the intensity of receipt and processing of applications in the system is distributed according to the gamma law. The random value generator using the gamma distribution –gamma (α, β) has two parameters: α – shape parameter > 0, β – scale parameter > 0. The scale parameter and shape parameter of this distribution are related to the mathematical expectation and variance by two equations: α ∗ β α ∗ β σ
α=5.5, β=0.128.
The solution of this system of equations allows us to determine the maximum plausible values of the parameters of the gamma distribution. We convert the parameters values of the normal distribution to the gamma distribution. We get the following request generation rate: for M(λ)=0.7, σ(λ)=0.09 =>
Values of the requests service intensity are shown at the Table 3.
We present gamma distribution graphs for some examples of parameter values presented in Table 4 Table 4 Examples of parameter values for a gamma distribution
μ σ(μ) Parameter Example 1 alpha 3.7 beta 0.215 mathematical expectation dispersion mode α Example 2 2 0.4 0.80 0.32 0.40
β Example 3 1.6 0.5 0.80 0.40 0.30
α 3.7 3,2 2.7 2.45
2 1.92 1.8 1.73 1.7 1.6 10 8 t 6 s e t ‐t 4 2 0
After converting the parameters, we will perform a system simulation for the parameters from Figure 3:. The simulation results for different samples are presented on Table 5, where we note the observed values for p=0.001 – blue, p=0.005 – green, p=0.01 – red, which correspond to the G-effect. Table 5 Experimental results for different volumes of n
When the sample size is n=60 he model is constantly located in the hetero region. When comparing the results obtained for the gamma distribution with the normal distribution, the most stable areas of the G-effect were observed, as before, with a sample size of n=40, p=0.001.
Experiments were carried out to determine the influence of a number parameter values on changes in objects state using the gamma distribution. The results obtained allow us to state that the established parameters of the gamma distribution allow us to ensure the adequacy of the simulation model. The simulation results for the gamma distribution confirm the stable G-effect detection regions obtained for the normal law of intensity distribution. Moreover, in a model based on the gamma distribution, the hetero regions have a larger time span compared to the model using the normal distribution law.
Experiments have shown that the most optimal choice for the gamma distribution, which provides a high confidence in the detection of the G=effect, is to use a sample size of n=40. When using a sample of n=20, the heteroscedasticity is unstable, and when using a sample of n=60, the model was constantly in the hetero region.
Various points of time τ for measuring the characteristics were investigated. Thus, it was found that for τ = 21 and τ =41 the G-effect was rarely observed, and for τ=51 – it was practically not observed. Based on the above, it is recommended to use τ=31 in order to increase the reliability of monitoring objects.
The general recommendation for evaluating the detection of the G-effect is the following. Depending on the monitored system purpose, whether it is a critical purpose or not, the expert has the right to set values of the significance level – p, for which, on the one hand, high reliability of the characteristics values of the monitored objects will be ensured, on the other hand, the minimum errors number of the first and second kind is achieved, which means that the risks of making erroneous decisions will be reduced, which in turn will ensure minimal losses.
The results obtained in the conducted experiments with models based on various distribution laws of the requests flow intensity and the criteria used are used as input information for intelligent decision support systems for choosing a monitoring strategy, depending on the such parameters values as the required volume random variables samples; frequency, depth, monitoring frequency; moments of measurement of the characteristics of the control objects; the environment state, and others.
The research was carried out with the financial support of the RFBR in the framework of scientific projects № 19-29-06015 and № 19-29-06023.