Modern automotive systems are evolving into complex cyber-physical platforms, where traditional fixed-policy fault recovery mechanisms prove insuficient against sophisticated faults and cyber-attacks. This work presents an anomaly detection framework for RISC-V-based automotive systems, combining Hardware Performance Counters (HPC) with additional hardware metrics to improve detection accuracy under realistic conditions. The methodology is validated by running FreeRTOS workloads on a full-system RISC-V architecture with controlled fault injection using the CHAOS framework. A comparative analysis of sequence-aware and classical machine learning models demonstrates that integrating temporal data significantly enhances detection, with the GRUAutoencoder showing the best trade-of between performance and computational eficiency for safety-critical scenarios.
ISSN1613-0073 c m Fault Fault Fault Fault
Checking Checking Checking Checking
Check su ive Period ttaSnio Defetc tu al xeE Nor Artificial Intelligence
Detaelcetritoinngand Application Execution (clock cycles)
The framework logic has been presented and analyzed in [
FreeRTOS is a lightweight, open-source real-time operating system kernel widely adopted in embedded
and automotive applications due to its minimal resource footprint and portability across heterogeneous
hardware platforms, including RISC-V. Through FreeRTOS, it becomes possible to analyze system
behavior in more realistically accurate environments, which is why it has been employed as the
operating system executing tasks for the purposes of this work. The selected tasks correspond to the
MiBench benchmarks [
In order to classify the execution status as normal or defective, this work employs HPC, following
established approaches in the literature [
port SystemXBar membus badaddr_responder
pio
cpu_side_ports default mem_side_ports
inspired by the methodology presented in [
HiFive platform GenericRiscvPciHost RiscvRTC RiscvUart8250 pio int_pin pio
pio bridge cpu_side_port mem_side_port clint int_pin
IOXBar iobus
mem_side_ports
cpu_side_ports
The concrete evaluation of normal or defective execution classification necessitated the use of a fault
injector. The Controlled Hardware fAult injectOr System (CHAOS) [
This section provides a comprehensive review of experiments designed to determine which machine
learning algorithm and hardware metrics set are most suitable for realistically accurate scenarios
compared to those presented in [
The simulated RISC-V system employs a FullSystem configuration based on the HiFive platform,
operating at 1 GHz with a three-level cache hierarchy: 16 KiB L1I, 64 KiB L1D, and 256 KiB L2, backed
by 2048 MiB of DDR4 DRAM. An out-of-order (O3) processor in RV64 mode executes the workload with
a CP interval of 1,000,000 clock cycles, whose selection rationale is detailed in [
CHAOS has been configured to initiate fault injection at a randomly selected clock cycle at the beginning of each simulation, with fault probabilities ranging from 1 × 10−1 to 1 × 10−8 and a random number of bits to alter using a random fault mask.
Furthermore, to diversify FreeRTOS executions and present results based on increasingly realistic scenarios, the parameters of BasicMath and BitCount tasks have been randomized at compile time. Each fault-free simulation operates with a distinct parameter set.
The identification of the most efective machine learning approach for anomaly detection necessitated an analysis across multiple algorithmic paradigms. Eight distinct methodologies were evaluated: Isolation Forest, K-means clustering, K-nearest neighbors (KNN), Local Outlier Factor (LOF), Support Accuracy and F1 Score of various Machine Learning Algorithms Using HPC Only. reflects established practices within the field [
The experimental dataset comprised 500 normal execution traces complemented by 14,000 synthetically generated faulty instances. These defective samples were systematically created through randomized fault injection across diferent temporal points and hardware abstraction layers within the CHAOS framework, ensuring comprehensive fault space coverage. This unsupervised learning approach allows the models to internalize the fundamental characteristics of correct system operation, subsequently enabling detection of any deviation from expected behavior patterns. Consequently, the trained models can identify novel anomalies without prior exposure to specific fault signatures, demonstrating superior generalization capabilities compared to supervised approaches constrained by predefined fault categories. Each algorithm was evaluated in two distinct configurations: a sequenced (S) variant, where the input consists of a temporal window of 14 consecutive multivariate HPC samples; and a non-sequenced (NS) variant, where the input is limited to a single multivariate sample. Notably, certain models–such as the LSTM-Autoencoder and GRU-Autoencoder–are inherently designed to process sequential data and therefore cannot be applied in the non-sequenced setting. In addition, for each algorithm we analyzed how detection accuracy varies depending on the specific architectural component afected by fault injection. Overall, results indicate that, except for the LOF algorithm in its non-sequenced variant and the MLP in its sequenced variant, most approaches achieve reasonably acceptable accuracy. However, it is worth highlighting that none of the models shows satisfactory performance when faults are injected into main memory, which remains the most challenging scenario.
To enhance detection performance in scenarios where faults are injected into the main memory, an additional set of hardware metrics–introduced in Section 2.2–has been integrated into the analysis. The resulting performance improvements are reported in Table 2. The data demonstrate that incorporating additional hardware metrics beyond HPC alone yields comparable average accuracies across nearly all experimental classes, with the notable exception of the non-sequenced MLP, which exhibits significant performance degradation. However, this mechanism enables improved accuracy for faults injected into main memory, resulting in satisfactory solutions. Contrary to the results obtained using only HPC (Table 1), the present analysis with an extended set of metrics (Table 2) reveals a marked diference between sequenced and non-sequenced configurations. This divergence can be attributed to the intrinsic characteristics of the algorithms employed. Traditional machine learning algorithms–Isolation Forest, K-Means, KNN, LOF, SVM, and MLP–were originally designed for static data processing and lack inherent mechanisms for handling temporal sequences. When the number of features per sequence is increased, these algorithms exhibit performance degradation in processing sequential inputs, as they are unable to efectively capture temporal dependencies in the data. Conversely, algorithms based on recurrent neural networks–LSTM-Autoencoder and GRU-Autoencoder–are specifically designed for temporal sequence processing and demonstrate greater robustness in handling extended sequential data. Their architecture enables the retention and utilization of previous temporal information, resulting in more stable performance regardless of the data presentation modality. Among the solutions that best adapt to the scope of the present work from an accuracy perspective are the KNN algorithms (both sequenced and non-sequenced variants), LOF (sequenced version), SVM (non-sequenced version), and the GRU-Autoencoder.
Given the stringent computational constraints inherent to automotive applications, the selection of algorithmically eficient mechanisms becomes paramount. Consequently, the evaluation framework must encompass not merely predictive accuracy but also the computational complexity profiles of candidate algorithms to ensure real-time feasibility in resource-constrained environments. The complexity analysis reveals distinct computational signatures: KNN operates with ( ⋅ ) , complexity, where represents the dataset cardinality and the feature dimensionality. LOF demonstrates quadratic scaling at ( 2 ⋅ ) , attributed to the intensive pairwise distance computations required for local density estimation. In contrast, SVM exhibits ( ⋅ ) complexity, with denoting the support vector cardinality—a parameter typically orders of magnitude smaller than the full dataset. The GRU-Autoencoder exhibits a complexity of ( ⋅ (ℎ 2 + ℎ ⋅ )) , where represents the sequence length, ℎ denotes the hidden state dimension, and represents the input dimension. Given that in our case ℎ ≫ , this expression simplifies to ( ⋅ ℎ 2), since each GRU cell requires (ℎ 2) operations for the hidden-to-hidden transformations at each time step, and this quadratic term dominates the linear input-to-hidden term (ℎ ⋅ ) .
The GRU-Autoencoder is favored over traditional methods such as KNN, LOF, and SVM for sequential temporal data due to its capability to capture temporal dependencies and evolutionary patterns that these conventional approaches, which rely on static local density estimation or geometric separation principles, are inherently unable to detect. While KNN and LOF operate under the assumption of point independence with computational complexity directly proportional to dataset size, and SVM, despite also assuming point independence, achieves inference complexity dependent on support vectors rather than full dataset size, the GRU-Autoencoder demonstrates superior scalability by operating with complexity dependent on sequence length and embedding dimensionality, thereby achieving enhanced computational eficiency for inference on sequential data where temporal anomalies necessitate a sequence-aware methodology rather than conventional point-wise data analysis.
This work has presented an adaptive anomaly detection framework for RISC-V-based automotive systems, addressing the limitations of traditional fixed-policy fault recovery by exploiting both HPC and complementary hardware metrics. Through realistic simulations using FreeRTOS workloads and controlled fault injection, we demonstrated that sequential models—particularly the GRU-Autoencoder—can efectively capture temporal execution patterns, improving detection accuracy even in challenging scenarios like faults injected into main memory. While classical methods such as KNN, LOF, and SVM remain competitive, our results show that sequence-aware approaches ofer a better balance between accuracy and computational eficiency for safety-critical applications. As next steps, future work will focus on integrating concrete fault mitigation and recovery strategies into the framework, moving from pure detection to active resilience.
Acknowledgments This work has been (partially) supported by the Spoke 1 ”FutureHPC & BigData” of the Italian Research Center on High-Performance Computing, Big Data and Quantum Computing (ICSC) funded by MUR Missione 4 - Next Generation EU (NGEU) and MUR PRIN COLTRANE-V E53D23008060006.
During the preparation of this work, the author(s) used ChatGPT-4o in order to: Paraphrase and reword, Grammar and spelling check. After using this tool/service, the author(s) reviewed and edited the content as needed and take(s) full responsibility for the publication’s content.