Anomaly detection in chain-of-custody information

• US 20140324786A1
• Filed: 04/24/2013
• Published: 10/30/2014
• Est. Priority Date: 04/24/2013
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Li, Mingyan, Benson, Matthew Lee
• Granted Patent: US 9,336,248 B2
• Time in Patent Office: Days
• US Class Current: 707/690
• CPC Class Codes: G06F 16/215 Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors
• CPC Class Codes: G07C 5/08 Registering or indicating performance data other than driving, working, idle, or waiting time, with or without registering driving, working, idle or waiting time

Abstract

A method includes receiving first vehicle log data related to modification of a first software part at a first vehicle. The method also includes receiving first ground log data of a first ground system. The first ground log data indicates first chain-of-custody information regarding the first software part. The method further includes analyzing the first vehicle log data and the first ground log data based on baseline data to detect an anomaly. The method also includes sending a notification in response to detecting the anomaly.

Claims

1. A method comprising:

receiving first vehicle log data related to modification of a first software part at a first vehicle;

receiving first ground log data of a first ground system, the first ground log data indicating first chain-of-custody information regarding the first software part;

analyzing the first vehicle log data and the first ground log data based on baseline data to detect an anomaly; and

sending a notification in response to detecting the anomaly.

2. The method of claim 1, wherein the first chain-of-custody information includes at least one of a timestamp associated with an event or an identifier associated with the event.

3. The method of claim 2, wherein the event includes at least one of the first ground system receiving the first software part from a first device or the first ground system forwarding the first software part to a second device.

4. The method of claim 2, wherein the identifier includes at least one of an event identifier, a device identifier, a software part identifier, a hardware part identifier, a user identifier, a maintenance computer identifier, a vehicle identifier, or a ground system identifier.

5. The method of claim 1, further comprising:

synchronizing the first vehicle log data and the first ground log data based on a common event that is included within each of the first vehicle log data and the first ground log data, a first timestamp of the first vehicle log data, and a second timestamp of the first ground log data, wherein the first timestamp and the second timestamp are associated with the common event;

performing a comparison of the synchronized first vehicle log data and the synchronized first ground log data; and

generating a first dataset based on the comparison of the synchronized first vehicle log data and the synchronized first ground log data.

6. The method of claim 5, further comprising:

identifying a first event of the synchronized first vehicle log data, wherein the first event is associated with the first identifier; and

identifying a second event of the synchronized first ground log data, wherein the second event is associated with the first identifier,

wherein the first dataset is generated to indicate a time duration indicating a difference between a first event timestamp associated with the first event and a second event timestamp associated with the second event.

7. The method of claim 5, further comprising determining a status of the first vehicle at a time of the first event based on the synchronized first vehicle log data, wherein the first dataset indicates the status.

8. The method of claim 5, further comprising detecting the anomaly based on a comparison of the first dataset to a corresponding second dataset of the baseline data.

9. The method of claim 8, wherein the anomaly is detected in response to the comparison of the first dataset to the second dataset indicating that a first time duration of the first dataset exceeds a corresponding second time duration of the second dataset.

10. The method of claim 9, wherein the first time duration indicates a time difference between the first ground system sending the first software part to the first vehicle and the first vehicle receiving the first software part from the first ground system and wherein the second time duration indicates a threshold duration.

11. The method of claim 8, wherein the anomaly is detected in response to the comparison of the first dataset to the second dataset indicating that a first state value of the first dataset does not correspond to a second state value of the second data set and wherein the first state value indicates a status of the first vehicle at a time of the first event.

12. The method of claim 11, wherein the first vehicle includes an aircraft, wherein the first state value indicates a first weight-on-wheels status of the first vehicle, and wherein the second state value indicates a second weight-on-wheels status.

13. The method of claim 1, wherein the anomaly indicates at least one of a gap between the first chain-of-custody information and second chain-of-custody information received from a second ground system, that the first software part was received out-of-order by the first ground system, or that the first software part was forwarded out-of-order by the first ground system.

14. The method of claim 1, further comprising aggregating audit data, wherein the aggregated audit data includes data regarding the anomaly.

15. The method of claim 1, further comprising at least one of generating the baseline data or updating the baseline data.

16. A system comprising:

a processor; and

a memory storing instructions that, when executed by the processor, cause the processor to perform operations comprising;

receiving first vehicle log data related to modification of a first software part at a first vehicle;

receiving first ground log data of a first ground system, the first ground log data indicating first chain-of-custody information regarding the first software part;

analyzing the first vehicle log data and the first ground log data based on baseline data to detect an anomaly; and

sending a notification in response to detecting the anomaly.

17. The system of claim 16, wherein the operations further comprise generating the baseline data including:

receiving second vehicle log data related to modification of a second software part at a second vehicle;

receiving second ground log data, the second ground log data indicating second chain-of-custody information regarding the second software part;

synchronizing the second vehicle log data and the second ground log data;

performing a comparison of the synchronized second vehicle log and the synchronized second ground log data; and

generating a dataset based on the comparison of the synchronized second vehicle log data and the synchronized second ground log data, wherein the dataset indicates that the modification of the second software part is without a detected anomaly.

18. The system of claim 17, wherein the operations further comprise determining that the first vehicle and a second vehicle have at least one of a common software module or a common hardware module based on a first vehicle specification of the first vehicle and a second vehicle specification of the second vehicle, wherein the dataset is used to generate the baseline data based on determining whether the dataset corresponds to the at least one of the common software module or the common hardware module.

19. The system of claim 17, wherein the operations further comprise:

modifying the baseline data based on a security requirement; and

modifying the baseline data based on a statistical model.

20. A computer-readable storage device storing instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving first vehicle log data related to modification of a first software part at a first vehicle;

receiving first ground log data of a first ground system, the first ground log data indicating first chain-of-custody information regarding the first software part;

analyzing the first vehicle log data and the first ground log data based on baseline data to detect an anomaly; and

sending a notification in response to detecting the anomaly.

21. The computer-readable storage device of claim 20, wherein the first vehicle includes an aircraft.