Patent Description:
Document <CIT> discloses a device and a method for scalable training of random forests for high precise malware detection. Document <CIT> discloses methods and arrangements for message time series intrusion detection for in-vehicle network security that reduce the latency and increase the confidence in a vehicle system.

In general, the present disclosure provides to accelerate classification for an intrusion detection system based on incomplete feature sets. Said differently, the present disclosure provides to classify an actor (e.g., electronic control unit, or the like) or action (a message transmitted on an IVN, or the like) as malicious or not for purposes of intrusion detection using less than all features of the classification paradigm. The present disclosure provides an IDS with low-latency (e.g., lower latency than IDS systems that rely on the entire feature set before classification, or the like) to provide for identification of malicious behavior and initiate counter measures in real-time. In particular, the present disclosure provides that compute and time efficiency is gained by not requiring the entire set of features needed to infer, or classify malicious actors or actions. This further translates to compute savings by reducing the number of features that must be extracted from collected data and samples.

In general, the present disclosure provides to accelerate classification for decision tree models by speculating on a likely classification given currently available set of features. The following descriptions are exemplified based on random forest classification. For example, as features are made available, a speculation as to the likely classification (or label) can be made based on a classification trend indicated by the extracted features. Furthermore, as features are extracted and nodes in the random forest tree are committed, labels that are unreachable may be removed from the speculative labels. In a specific example, where committed nodes indicate that benign labels are unreachable, the IDS system can speculate that the actor and activity is malicious without completing the entire feature extraction and classification.

In the following description, numerous specific details such as processor and system configurations are set forth in order to provide a more thorough understanding of the described embodiments. However, the described embodiments may be practiced without such specific details. Additionally, some well-known structures, circuits, and the like have not been shown in detail, to avoid unnecessarily obscuring the described embodiments.

<FIG> illustrates an example IDS device <NUM>, which can be implemented to accelerate classification for an intrusion detection system (IDS). IDS device <NUM> can be implemented in a vehicle (e.g., car, truck, automobile, motorcycle, airplane), a train, a factory, or the like. In addition, the present disclosure could be applied to intrusion detection systems in other disciplines, such as, for example, network and/or computer security, or the like. Although the example described herein often reference automobiles, this is done for convenience in describing examples of the disclosure and not to be limiting.

IDS device <NUM> includes processing circuitry <NUM>, memory <NUM>, and network interconnect circuitry <NUM>. Network interconnect circuitry <NUM> is arranged to couple IDS device <NUM> to a communication bus <NUM>. Communication bus <NUM> can be an in-vehicle network (IVN), such as, a CAN bus, a FlexRay bus, a CAN FD bus, an automotive ethernet bus, or a local interconnected network (LIN) bus. Additionally, where implemented in contexts outside of the automotive space, the communication bus <NUM> can be a network bus adapted to the particular implementation, such as, for example, a communication network for manufacturing equipment, the Internet, or the like.

Memory <NUM> includes instructions <NUM> (e.g., firmware, or the like) that can be executed by processing circuitry <NUM>. Memory <NUM> further includes random forest model <NUM>, data <NUM>, extracted features <NUM>, temporary extracted features <NUM>, checkpoint <NUM>, and classification result <NUM>. During operation, processing circuitry <NUM> can execute instructions <NUM> to identify accelerate generation of classification result <NUM> from random forest model <NUM> and extracted features <NUM>. This is described in greater detail below. Further, an example of extracted features and classification results are provided below.

However, in general, processing circuitry <NUM> executes instructions <NUM> to identify extracted features <NUM> from data <NUM>, or generate temporary extracted features <NUM> from data <NUM>. In general, data <NUM> can be any information, such as, sensor output, messages, indications of electronic control units, network traffic, or the like. With some examples, extracted features <NUM> may be simply data <NUM>. That is, random forest model <NUM> can operate on data <NUM> without modification. In other examples, extracted features <NUM> can be processed data <NUM>, or can be generated from data <NUM>. For example, if data <NUM> is an indication of raw traffic on communication bus <NUM>, extracted features <NUM> can be an indication of the latency, bandwidth consumption, actors (e.g., electronic control units, etc.) transmitting on instructions <NUM>, or the like.

Random forest model <NUM> operates on extracted features <NUM> to generate classification result <NUM>. In general, random forest model <NUM> is a machine learning model for classification, regression, or other operations. Although the present disclosure uses random forest model <NUM> as an example, the concepts detailed herein to accelerate classification can be applied other such machine learning classification paradigms, such as, decision trees. As will be described in greater detail below, processing circuitry <NUM> can execute instructions <NUM> to speculate on a label with which the classification is trending based on temporary extracted features <NUM> to generate speculated label <NUM>. As another example, processing circuitry <NUM> can execute instructions <NUM> to identify confirmed nodes in random forest model <NUM> from extracted features <NUM> to generate subset classification <NUM>.

Processing circuitry <NUM> can include any of a variety of processors, such as, for example, commercial central processing units, application specific integrated circuits, or the like. Processing circuitry <NUM> can be a microprocessor or a commercial processor and can include one or multiple processing core(s) and can also include cache.

Memory <NUM> can be based on any of a wide variety of information storage technologies. For example, memory <NUM> can be based on volatile technologies requiring the uninterrupted provision of electric power or non-volatile technologies that do not require and possibly including technologies entailing the use of machine-readable storage media that may or may not be removable. Thus, each of these storages may include any of a wide variety of types (or combination of types) of storage devices, including without limitation, read-only memory (ROM), random-access memory (RAM), dynamic RAM (DRAM), Double-Data-Rate DRAM (DDR-DRAM), synchronous DRAM (SDRAM), static RAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, polymer memory (e.g., ferroelectric polymer memory), ovonic memory, phase change or ferroelectric memory, silicon-oxide-nitride-oxide-silicon (SONOS) memory, magnetic or optical cards, one or more individual ferromagnetic disk drives, or a plurality of storage devices organized into one or more arrays (e.g., multiple ferromagnetic disk drives organized into a Redundant Array of Independent Disks array, or RAID array). Additionally, memory <NUM> can include storage devices.

Network interconnect circuitry <NUM> can include any circuitry arranged to send and/or receive information elements (e.g., data, messages, etc.) via a network, such as, instructions <NUM>.

<FIG> illustrates an example system <NUM>, which can be implemented to accelerate classification, such as, for example, for an intrusion detection system (IDS). In particular, system <NUM> includes IDS device <NUM> coupled to communication bus <NUM>. System <NUM> could be implemented in a vehicle, an airplane, a train, a factory, a data center, or other such system as might utilize an IDS.

System <NUM> includes a number of electronic control units (ECUs), for example, ECU <NUM>, ECU <NUM>, and ECU <NUM>. In general, each of ECU <NUM>, ECU <NUM>, and ECU <NUM> include circuitry arranged to generate and transmit messages onto communication bus <NUM> and/or receive and consume messages from communication bus <NUM>. For example, message <NUM> is depicted on communication bus <NUM>. ECUs (e.g., ECU <NUM>, ECU <NUM>, and ECU <NUM>) can be any of a variety of devices, such as, for example, sensor devices, actuator devices, microprocessor control devices, or the like.

IDS device <NUM> can be arranged to identify (e.g., classify) actors (e.g., ECUs, or the like) and/or actions (e.g., messages, traffic on communication bus <NUM>, or the like) as malicious or benign.

For example, <FIG> depicts an example random forest model <NUM>, which can be random forest model <NUM> of <FIG> described above. Random forest model <NUM> includes a number of trees, such as, tree 302a and tree 302b. In practice, a random forest model will have numerous trees, often more than two as depicted in <FIG> with respect to random forest model <NUM>. Each tree of random forest model <NUM> includes a number of nodes coupled like branches of a tree and terminating at labels. For example, random forest model <NUM>, and particularly tree 302a, is depicted including node <NUM>, node <NUM>, node <NUM>, node <NUM>, node <NUM>, node <NUM>, and node <NUM>. Furthermore, random forest model <NUM> is depicted including label <NUM>, label <NUM>, label <NUM>, label <NUM>, label <NUM>, label <NUM>, label <NUM>, and label <NUM>. The nodes (e.g., node <NUM>, etc.) and labels (e.g., label <NUM>, etc.) are coupled via branches, such as, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, branch <NUM>, and branch <NUM>.

During operation, each tree outputs an indication of one of the labels and the output from all the trees (e.g., tree 302a, tree 302b, etc.) is used to vote on the output label (or classification) of the random forest model <NUM>. As described herein, random forest model <NUM> can be used to classify extracted features <NUM> using labels (e.g., label <NUM>, etc.) to identify malicious actors or activity. Said differently, random forest model <NUM> can classify actors or activity as either malicious or benign based on labels (e.g., label <NUM>, etc.). For example, label <NUM> can be benign label <NUM> and indicate the actor or action associated with the extracted features <NUM> are benign while the other labels (e.g., label <NUM>, label <NUM>, label <NUM>, label <NUM>, label <NUM>, label <NUM>, and label <NUM>) can be malicious labels (not numbered in this figure) to indicate the actor or action associated with extracted features <NUM> is malicious.

As introduced above, the present disclosure can be applied to speculate on a classification result (e.g., classification result <NUM>, or the like) of a random forest model (e.g., random forest model <NUM>, random forest model <NUM>, or the like). For example, <FIG>, <FIG>, <FIG>, and <FIG> illustrate examples of speculating a classification result <NUM> using paths within a tree of random forest model <NUM>. Said differently, these figures illustrate various trends towards a label or labels in a tree of random forest model <NUM> based on temporary extracted features. These temporary features can be used to "speculate" on the ultimate classification result <NUM>, or rather, to generate speculated label <NUM>. It is to be appreciate, that as a single label is benign, such as, benign label <NUM>, then all other labels (e.g., label <NUM>, etc.) are interpreted or inferred to be malicious. It is noted, the example depicted in <FIG>, <FIG>, <FIG>, and <FIG>, particularly with respect to benign label <NUM> is an example of a binary case, or rather, where one of the labels is benign while the other labels are malicious. In some examples, one of the labels could be malicious while the other labels are benign. In other examples, multiple labels could be benign and multiple labels could be malicious. Examples are not limited in this context.

For example, <FIG> illustrates a trend to label <NUM> and label <NUM> through nodes of tree 400a based on temporary extracted features <NUM>. As used herein, temporary extracted features <NUM> are ones whose final result depends on the entire sample set. Said differently, temporary features are derived based on a partial set of samples, or less than all the samples needed for a final result. For example, a mean feature needs the entire sample set to yield the final mean value. The current (temporary) mean can be used to speculate on a label based on the other nodes that have committed and the others that are still temporary. Depending on the feature, a temporary value can enable a node to commit. For instance, minimum and maximum features are monotonic, which allow for a node to make a decision if such a feature is above, equal, below, or the like a certain value. The reason being is that once the maximum or minimum value reaches a certain level, it will not reduce or increase to previous values. This monotonic behavior allows for nodes to commit to decisions even when the entire sample set has not been through the complete computation of maximum or minimums.

Final features are those where all samples required for committing a node have been acquired and the feature computation has finished while temporary features are those derived based on a partial set of samples at a moment in time. This can be referred to as "speculating" on a commitment. Furthermore, the features themselves may have a number of classes. For example, features can be monotonic or nonmonotonic. Monotonic features are those that only increase (or decrease) and do not decrease (or increase) with new samples. Examples of monotonic features are maximum, minimum, or the like. Nonmonotonic features are those features that can both increase and decrease with new samples. Examples of nonmonotonic features are mean, standard deviation, skewness, kurtosis, top, bottom, or the like.

Accordingly, <FIG>, <FIG>, <FIG>, <FIG> illustrates tree 400a, tree 400b, tree 400c, and tree 400d, respectively, of random forest model <NUM>. Each tree is used to speculate on a label, or provide a temporary label based on partial samples as described above. It is noted, that tree a final classification to a label by a tree is there the nodes of the tree have enough information (e.g., samples, or the like) to determine a final label. Where, a speculative classification is where the nodes do not have enough information (e.g., samples, or the like) to determine a final result and the result could change based on additional information. It is further noted that final and speculative results can be referenced with respect to nodes, trees, and forests. It is to be appreciated that the result discussed will be apparent from the context. Speculative results from trees (e.g., as illustrated in <FIG>, <FIG>, <FIG>, and <FIG>, or the like) can be combined to a forest to produce a final speculative classification.

Furthermore, it is to be appreciated that trees within a random forest may not have all labels of the random forest. For example, a tree may have a subset of the labels of the random forest while another tree has a different subset. Additionally, the trees within a random forest may have different topologies one from another. However, the trees used herein share the same topology and reference the same labels for purposes of clarity of explanation and not to be limiting. In practice, the trees may have many more nodes and labels than depicted, may include subsets of the labels, may have different topologies, or the like.

Based on the trend indicated in <FIG>, tree 400a might classify the extracted features <NUM> to either label <NUM> or label <NUM> based on trend <NUM>. Accordingly, processing circuitry <NUM> can execute instructions <NUM> to speculate, based on trend <NUM>, that the classification result <NUM> will be either label <NUM> or label <NUM>. In particular, trend <NUM> indicates that node 402a and node 404a of tree 400a have committed or are speculating on a decision while the other nodes (e.g., node 406a, node 408a, node 410a, node 412a, and node 414a) are uncommitted. As such, speculated label <NUM> (including label <NUM> or label <NUM>) is a possible classification of tree 400a based on trend <NUM>.

<FIG> illustrates a trend <NUM> to label <NUM> through tree 400b. In particular, this figure illustrates trend <NUM> through node 402b, node 404b, and node 410b of tree 400b based on temporary extracted features <NUM>. Based on the trend <NUM> indicated in <FIG>, tree 400b might classify the extracted features <NUM> to label <NUM>. Accordingly, processing circuitry <NUM> can execute instructions <NUM> to speculate, based on trend <NUM>, that the classification result <NUM> will be label <NUM>. In particular, trend <NUM> indicates that node 402b, node 404b, and node 410b of tree 400b have committed or are speculating on a decision while the other nodes (e.g., node 406b, node 408b, node 412b, and node 414b) are uncommitted. As such, speculated label <NUM> (including label <NUM>) is a possible classification by tree 400b based on trend <NUM>.

<FIG> illustrates a trend <NUM> to label <NUM> through tree 400c. In particular, this figure illustrates trend <NUM> through node 402c, node 040c, and node 408c of tree 400c based on temporary extracted features <NUM>. Based on the trend <NUM> indicated in <FIG>, tree 400c might classify the extracted features <NUM> to label <NUM>. Accordingly, processing circuitry <NUM> can execute instructions <NUM> to speculate, based on trend <NUM>, that the classification result <NUM> will be label <NUM>. In particular, trend <NUM> indicates that node 402c, node 404c, and node 408c of tree 400c have committed or are speculating on a decision while the other nodes (e.g., node 406c, node 410c, node 412c, and node 414c) are uncommitted. As such, speculated label <NUM> (including label <NUM>) is a possible classification by tree 400c based on trend <NUM>.

<FIG> illustrates a trend <NUM> to label <NUM> through tree 400d. In particular, this figure illustrates trend <NUM> through node 402d, node 404d, and node 408d of tree 400d based on temporary extracted features <NUM>. Based on the trend <NUM> indicated in <FIG>, tree 400d might classify the extracted features <NUM> to label <NUM> based on trend <NUM>. Accordingly, processing circuitry <NUM> can execute instructions <NUM> to speculate, based on trend <NUM>, that the classification result <NUM> will be label <NUM>. In particular, trend <NUM> indicates that node 402d, node 404d, and node 408d of tree 400c have committed or are speculating on a decision while the other nodes (e.g., node 406d, node 410d, node 412d, and node 414d) are uncommitted. As such, speculated label <NUM> (including label <NUM>) is a possible classification by tree 400d based on trend <NUM>.

Accordingly, temporary extracted features <NUM> can be used to speculate on a number of possible labels with which trees (e.g., tree 400a, tree 400b, tree 400c, and tree 400d, etc.) of random forest model <NUM> can classify extracted features <NUM>. Using the examples from <FIG>, random forest model <NUM> might classify extracted features <NUM> as either label <NUM>, label <NUM> or label <NUM> with label <NUM> being the label in the majority of the trends. As none of the labels, and particularly the majority label (e.g., label <NUM>) are the benign label <NUM>, it can be inferred that the actor or action with which processing circuitry <NUM> is executing instructions <NUM> to speculate on is malicious.

<FIG> depict logic flow <NUM>. Logic flow <NUM> can be implemented by an intrusion detection system (IDS). As a specific example, IDS device <NUM> (and particularly processing circuitry <NUM> in executing instructions <NUM>) can implement logic flow <NUM> to accelerate classification for an IDS. The logic flows described herein, including logic flow <NUM>, as well as other logic flows described herein, are representative of exemplary methodologies for performing novel aspects of the disclosed architecture. While, for purposes of simplicity of explanation, the one or more methodologies shown herein, for example, in the form of a flow chart or flow diagram, are shown and described as a series of acts, it is to be understood and appreciated that the methodologies are not limited by the order of acts, as some acts may, in accordance therewith, occur in a different order and/or concurrently with other acts from that shown and described herein. For example, those skilled in the art will understand and appreciate that a methodology could alternatively be represented as a series of interrelated states or events, such as in a state diagram. Moreover, not all acts illustrated in a methodology may be required for a novel implementation.

Turning more specifically to <FIG> and logic flow <NUM>, it is noted that logic flow <NUM> could be considered a sub-flow within a larger overall logic flow to classify a final result from trees of a random forest model. In particular, logic flow <NUM> illustrates operations to speculate on a result using a random forest model. However, logic flow <NUM> can be iteratively repeated, for example, until enough nodes have committed within all the trees, such that the combined trees forms a majority leading to a final result. Once enough nodes in all the trees have committed, derivation of temporary features for other trees with uncommitted nodes can be aborted. In particular, all temporary features still being computed can be discarded and logic flow <NUM> could be repeated (e.g., to classify a new result) with a new sample set. As such, logic flow <NUM> can be implemented to speed up classification as well as speculate on the classification result while deriving the final classification.

Logic flow <NUM> may begin at block <NUM>. At block <NUM> "identify temporary extracted features" processing circuitry can identify temporary extracted features. For example, processing circuitry <NUM> of IDS device <NUM>, in executing instructions <NUM>, can identify temporary extracted features <NUM> (e.g., from data <NUM>, or the like).

Continuing to block <NUM> "identify a trend to a label based on temporary extracted features" processing circuitry can identify a trend to a label based on temporary extracted features. For example, processing circuitry <NUM> can execute instructions <NUM> to identify a trend to a label (e.g., trend <NUM>, trend <NUM>, trend <NUM>, trend <NUM>, and trend <NUM>) based on temporary extracted features <NUM>.

Continuing to decision block <NUM> "additional temporary extracted features?" a determination whether additional temporary extracted features exist. For example, processing circuitry <NUM> can execute instructions <NUM> to determine whether additional temporary extracted features <NUM> exist. From decision block <NUM>, logic flow <NUM> can return to block <NUM> or continue to block <NUM>. In particular, logic flow <NUM> can return to block <NUM> from decision block <NUM> based on a determination that additional temporary extracted features do exist while logic flow <NUM> can continue from decision block <NUM> to block <NUM> based on a determination that that additional temporary extracted features do not exist.

At block <NUM> "sum trends to each label" the trends to each label can be summed. For example, processing circuitry <NUM> can execute instructions <NUM> to sum the trends to each label. As a specific example, processing circuitry <NUM> can execute instructions <NUM> to sum trends to label <NUM> (e.g., trend <NUM> and trend <NUM>). Additionally, processing circuitry <NUM> can execute instructions <NUM> to sum trends to <NUM> (e.g., trend <NUM> and trend <NUM>).

Continuing to block <NUM> "speculate on label based on majority of trends" processing circuitry can speculate on a label based on the label with the majority of trends. For example, processing circuitry <NUM> in executing instructions <NUM> can identify the label (e.g., label <NUM>) with the majority of trends. That is, using the examples depicted in <FIG>, label <NUM> has <NUM> trends (e.g., trend <NUM> and trend <NUM>) while the other labels have less. As such, processing circuitry <NUM> in executing instructions <NUM> can speculate that random forest model <NUM> will generate classification result <NUM> from extracted features <NUM> comprising an indication of label <NUM>. More specifically, processing circuitry <NUM> can execute instructions <NUM> to identify speculated label <NUM>.

With some examples, logic flow <NUM> could include a decision block (not shown) to determine whether the speculated label is malicious or benign. Based on such a determination, logic flow <NUM> could include a block (not shown) to generate a checkpoint. For example, processing circuitry <NUM> could execute instructions <NUM> to determine whether label indicated in speculated label <NUM> is malicious or benign and generate checkpoint <NUM> based on a determination that the label indicated by speculated label <NUM> is malicious.

In some examples, processing circuitry <NUM> can execute instructions <NUM> to generate checkpoint <NUM> where speculated label <NUM> indicates malicious actors or actions in order to provide reduced time to recover where the classification result <NUM> actually indicates malicious actor or actions. As such, the present disclosure provides to shorten the time between when IDS classification actually finishes and recovery takes place.

As introduced above, the present disclosure can be applied to classify based on a sub-set of the features. Said differently, the present disclosure can be applied to generate classification result <NUM> based on part (or less than all) of extracted features <NUM>. For example, <FIG>, <FIG>, and <FIG> illustrate examples of identifying a classification result <NUM> using a random forest model (e.g., random forest model <NUM>, random forest model <NUM>, or the like) from less than all of the extracted features <NUM>. As noted above, as a single label is benign, such as, benign label <NUM>, then all other labels (e.g., label <NUM>, etc.) are interpreted or inferred to be malicious. As such, where committed nodes (e.g., based on portions of extracted features <NUM>, indicate that the benign label <NUM> is unreachable, then it is inferred that the actor or action is malicious, even without identifying the ultimate label.

For example, <FIG> illustrates a tree 600a of a random forest model <NUM>, with node <NUM> depicted as committed (indicated by cross hatch shading) to the right, while the other nodes are depicted as uncommitted. More particularly, <FIG> depicts node <NUM> committed to branch <NUM>. As such, branch <NUM> and all labels downstream from the uncommitted branch, branch <NUM>, such as, label <NUM> to label <NUM> are unreachable. Likewise, all labels downstream from the committed branch, branch <NUM>, such as, label <NUM> to label <NUM> are still reachable. That is, branch <NUM> is foreclosed if node <NUM> commits to the right branch, or branch <NUM>. As such, the benign label <NUM> is still reachable. The present disclosure provides that processing circuitry <NUM> can execute instructions <NUM> to identify a committed node of random forest model <NUM> from extracted features <NUM>. For example, processing circuitry <NUM>, in executing instructions <NUM> can identify node <NUM> as committed.

Conversely, referring to <FIG>, if in tree 600b of random forest model <NUM>, node <NUM> commits (indicated by cross hatch shading) to the left while the other nodes are uncommitted, then the reachable and unreachable labels shifts. More particularly, <FIG> depicts node <NUM> committed to branch <NUM>. As such, branch <NUM> and all labels downstream from the uncommitted branch, branch <NUM>, such as, label <NUM> to label <NUM> are unreachable. Likewise, all labels downstream from the committed branch, branch <NUM>, such as, label <NUM> to label <NUM> are still reachable. That is, branch <NUM> is foreclosed if node <NUM> commits to the left branch, or branch <NUM>. As such, the benign label <NUM> is not reachable. The present disclosure provides that processing circuitry <NUM> can execute instructions <NUM> to identify a committed node of random forest model <NUM> from extracted features <NUM>. For example, processing circuitry <NUM>, in executing instructions <NUM> can identify node <NUM> as committed.

Identification of whether the benign label <NUM> is reachable or not can be a recursive process. For example, given node <NUM> committed to the right as depicted in <FIG>, the benign label <NUM> is still reachable. Turning to <FIG>, which illustrates tree 600c of random forest model <NUM>, with node <NUM> committed to the right and node <NUM> committed to the left with the other nodes uncommitted. As can be seen, with node <NUM> committed to branch <NUM> and node <NUM> committed to branch <NUM>, only label <NUM> and label <NUM> are still reachable. As such, label <NUM> to label <NUM> as well as label <NUM> and label <NUM> are unreachable. Of note, the benign label <NUM> is unreachable. The present disclosure provides that processing circuitry <NUM> can execute instructions <NUM> to identify a committed node of random forest model <NUM> from extracted features <NUM>. For example, processing circuitry <NUM>, in executing instructions <NUM> can identify committed node (e.g., node <NUM>, node <NUM>, etc.). Additionally, processing circuitry <NUM> can execute instructions <NUM> to identify labels which are no longer reachable based on the identified committed nodes.

It is noted that, in practice, tree 600c could be a further iteration of tree 600a or could be an entirely different tree in random forest model <NUM>. Furthermore, it is to be appreciated that all trees in a random forest can contribute their label to the majority voting of the random forest. In this case, some trees may be still speculating on the output label, while others may have committed (though some of their internal nodes may still be speculating). The majority voting of the random forest would take the current value of the trees' labels and output a speculative label. Once the majority of the tree labels are committed, the majority voting of the random forest would be able to commit on the final label of the random forest (though some trees may still be speculating).

Accordingly, the present disclosure provides that an IDS system can accelerate identification of malicious activity, for example, based on accelerating classification of a random forest model as described herein. As a specific example, an IDS arranged to identify masquerading of messages (e.g., message <NUM>) by ECUs (e.g., ECU <NUM>, etc.) could implement the present disclosure to accelerate identification of malicious or benign messages. As only one label can be benign, provided classification with partial features (e.g., as described herein with respect to <FIG>, <FIG> and <FIG>) indicates that the benign label is unreachable, the IDS system can avoid computing the entire classification. As such, a reduction is compute resources as well as time to identify malicious behavior can be achieved.

Turning more specifically to <FIG> and logic flow <NUM>, which may begin at block <NUM>. At block <NUM> "identify a committed node in a random forest model" processing circuitry can identify a committed node in a random forest model. For example, processing circuitry <NUM> of IDS device <NUM>, in executing instructions <NUM>, can identify a committed node (e.g., node <NUM>, or the like) of a random forest model (e.g., random forest model <NUM>, or the like).

Continuing to block <NUM> "identify reachable labels of the random forest model based on committed nodes" processing circuitry can identify labels of the random forest model that are reachable based on committed nodes. For example, processing circuitry <NUM> can execute instructions <NUM> to identify labels (e.g., label <NUM>, etc.) of the random forest model (e.g., random forest model <NUM>) that are reachable based on the committed nodes.

Continuing to decision block <NUM> "benign label still reachable?" processing circuitry can make a determination whether the benign label is still reachable. For example, processing circuitry <NUM> can execute instructions <NUM> to determine whether the benign label (e.g., benign label <NUM>) is still reachable given the committed nodes. From decision block <NUM>, logic flow <NUM> can return to block <NUM> or continue to block <NUM>. In particular, logic flow <NUM> can return to block <NUM> from decision block <NUM> based on a determination that the benign label is still reachable while logic flow <NUM> can continue from decision block <NUM> to block <NUM> based on a determination that that benign label is not reachable.

At block <NUM> "identify malicious context" processing circuitry can identify malicious context (e.g., a malicious actor, malicious action, or the like). For example, processing circuitry <NUM> can execute instructions <NUM> to identify the context (e.g., ECU, message, etc.) as malicious (e.g., based on the determination that the benign label is not reachable).

<FIG> illustrates an example of a storage device <NUM>. Storage device <NUM> may comprise an article of manufacture, such as, any non-transitory computer readable medium or machine readable medium, such as an optical, magnetic or semiconductor storage. Storage device <NUM> may store various types of computer executable instructions <NUM>, such as instructions to implement logic flow <NUM> or logic flow <NUM>. Examples of a computer readable or machine readable storage medium may include any tangible media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or rewriteable memory, and so forth. Examples of computer executable instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, and the like. The examples are not limited in this context.

<FIG> illustrates an in-vehicle communication architecture <NUM> according to one or more embodiments of the disclosure. For example, one or more vehicular devices, components, or circuits, such as circuitry <NUM> and/or circuitry <NUM>, may communicate with each other via a communications communication framework <NUM>, which may be an in-vehicle network, such as a CAN bus, implemented to facilitate fingerprinting of ECUs as described above.

The in-vehicle communication architecture <NUM> includes various common communications elements, such as a transmitter, receiver, transceiver, and so forth. The embodiments, however, are not limited to implementation by the in-vehicle communication architecture <NUM>. As shown in this figure, the vehicular circuitry <NUM> and circuitry <NUM> may each be operatively connected to one or more respective data devices, such as, data device <NUM> and/or data device <NUM> that can be employed to store information local to the respective circuitry <NUM> and/or circuitry <NUM>, such as random forest models, extracted features, committed nodes, reachable labels, or the like. It may be understood that the circuitry <NUM> and circuitry <NUM> may be any suitable vehicular component, such as sensor, an ECU, microcontroller, microprocessor, processor, ASIC, field programmable gate array (FPGA), a neural compute circuit, an machine learning accelerator, any electronic device, computing device, or the like. Moreover, it may be understood that one or more computing devices (containing at least a processor, memory, interfaces, etc.) may be connected to the communication framework <NUM> in a vehicle.

Further, the communication framework <NUM> may implement any well-known communications techniques and protocols. As described above, the communication framework <NUM> may be implemented as a CAN bus protocol or any other suitable in-vehicle communication protocol. The communication framework <NUM> may also implement various network interfaces arranged to accept, communicate, and connect to one or more external communications networks (e.g., Internet). A network interface may be regarded as a specialized form of an input/output (I/O) interface. Network interfaces may employ connection protocols including without limitation direct connect, Ethernet (e.g., thick, thin, twisted pair <NUM>/<NUM>/<NUM> Base T, and the like), token ring, wireless network interfaces, cellular network interfaces, IEEE <NUM>. 7a-x network interfaces, IEEE <NUM> network interfaces, IEEE <NUM> network interfaces, and the like. Further, multiple network interfaces may be used to engage with various communications network types. The communication framework <NUM> may employ both wired and wireless connections.

<FIG> illustrates an embodiment of a system <NUM>. System <NUM> is a computer system with multiple processor cores such as a distributed computing system, supercomputer, high-performance computing system, computing cluster, mainframe computer, mini-computer, client-server system, personal computer (PC), workstation, server, portable computer, laptop computer, tablet computer, handheld device such as a personal digital assistant (PDA), or other device for processing, displaying, or transmitting information. Similar embodiments may comprise, e.g., entertainment devices such as a portable music player or a portable video player, a smart phone or other cellular phone, a telephone, a digital video camera, a digital still camera, an external storage device, or the like. Further embodiments implement larger scale server configurations. In other embodiments, the system <NUM> may have a single processor with one core or more than one processor. Note that the term "processor" refers to a processor with a single core or a processor package with multiple processor cores. In at least one embodiment, the computing system <NUM> is representative of the components of the IDS device <NUM>. More generally, the computing system <NUM> is configured to implement all logic, systems, logic flows, methods, apparatuses, and functionality described herein with reference to <FIG>. In particular, system <NUM> can be arranged to accelerate classification by a random forest model using the circuity, components, and/or devices depicted and described with respect to <FIG>.

As used in this application, the terms "system" and "component" and "module" are intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution, examples of which are provided by the exemplary system <NUM>. For example, a component can be, but is not limited to being, a process running on a processor, a processor, a hard disk drive, multiple storage drives (of optical and/or magnetic storage medium), an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a server and the server can be a component. One or more components can reside within a process and/or thread of execution, and a component can be localized on one computer and/or distributed between two or more computers. Further, components may be communicatively coupled to each other by various types of communications media to coordinate operations. The coordination may involve the uni-directional or bi-directional exchange of information. For instance, the components may communicate information in the form of signals communicated over the communications media. The information can be implemented as signals allocated to various signal lines. In such allocations, each message is a signal. Further embodiments, however, may alternatively employ data messages. Such data messages may be sent across various connections. Exemplary connections include parallel interfaces, serial interfaces, and bus interfaces.

As shown in this figure, system <NUM> comprises a motherboard or system-on-chip(SoC) <NUM> for mounting platform components. Motherboard or system-on-chip(SoC) <NUM> is a point-to-point (P2P) interconnect platform that includes a first processor <NUM> and a second processor <NUM> coupled via a point-to-point interconnect <NUM> such as an Ultra Path Interconnect (UPI). In other embodiments, the system <NUM> may be of another bus architecture, such as a multi-drop bus. Furthermore, each of processor <NUM> and processor <NUM> may be processor packages with multiple processor cores including core(s) <NUM> and core(s) <NUM>, respectively. While the system <NUM> is an example of a two-socket (<NUM>) platform, other embodiments may include more than two sockets or one socket. For example, some embodiments may include a four-socket (<NUM>) platform or an eight-socket (<NUM>) platform. Each socket is a mount for a processor and may have a socket identifier. Note that the term platform refers to the motherboard with certain components mounted such as the processor <NUM> and chipset <NUM>. Some platforms may include additional components and some platforms may only include sockets to mount the processors and/or the chipset. Furthermore, some platforms may not have sockets (e.g. SoC, or the like).

The processor <NUM> and processor <NUM> can be any of various commercially available processors, including without limitation an Intel® Celeron®, Core®, Core (<NUM>) Duo®, Itanium®, Pentium®, Xeon®, and XScale® processors; AMD® Athlon®, Duron® and Opteron® processors; ARM® application, embedded and secure processors; IBM® and Motorola® DragonBall® and PowerPC® processors; IBM and Sony® Cell processors; and similar processors. Dual microprocessors, multi-core processors, and other multi-processor architectures may also be employed as the processor <NUM> and/or processor <NUM>. Additionally, the processor <NUM> need not be identical to processor <NUM>.

Processor <NUM> includes register <NUM>, an integrated memory controller (IMC) <NUM> and point-to-point (P2P) interface <NUM> and P2P interface <NUM>. Similarly, the processor <NUM> includes register <NUM>, an IMC <NUM> as well as P2P interface <NUM> and P2P interface <NUM>. IMC <NUM> and IMC <NUM> couple the processors processor <NUM> and processor <NUM>, respectively, to respective memories (e.g., memory <NUM> and memory <NUM>). Memory <NUM> and memory <NUM> may be portions of the main memory (e.g., a dynamic random-access memory (DRAM)) for the platform such as double data rate type <NUM> (DDR3) or type <NUM> (DDR4) synchronous DRAM (SDRAM). In the present embodiment, the memories memory <NUM> and memory <NUM> locally attach to the respective processors (i.e., processor <NUM> and processor <NUM>). In other embodiments, the main memory may couple with the processors via a bus and shared memory hub.

System <NUM> includes chipset <NUM> coupled to processor <NUM> and processor <NUM>. Furthermore, chipset <NUM> can be coupled to storage device <NUM>, for example, via an interface (I/F) <NUM>. The I/F <NUM> may be, for example, a Peripheral Component Interconnect-enhanced (PCI-e). Storage device <NUM> can store instructions executable by circuitry of system <NUM> (e.g., processor <NUM>, processor <NUM>, GPU <NUM>, ML accelerator <NUM>, vision processing unit <NUM>, or the like). For example, storage device <NUM> can store instructions for random forest model <NUM>, logic flow <NUM>, logic flow <NUM>, or the like.

Processor <NUM> couples to a chipset <NUM> via P2P interface <NUM> and P2P <NUM> while processor <NUM> couples to a chipset <NUM> via P2P interface <NUM> and P2P <NUM>. Direct media interface (DMI) <NUM> and DMI <NUM> may couple the P2P interface <NUM> and the P2P <NUM> and the P2P interface <NUM> and P2P <NUM>, respectively. DMI <NUM> and DMI <NUM> may be a high-speed interconnect that facilitates, e.g., eight Giga Transfers per second (GT/s) such as DMI <NUM>. In other embodiments, the processor <NUM> and processor <NUM> may interconnect via a bus.

The chipset <NUM> may comprise a controller hub such as a platform controller hub (PCH). The chipset <NUM> may include a system clock to perform clocking functions and include interfaces for an I/O bus such as a universal serial bus (USB), peripheral component interconnects (PCIs), serial peripheral interconnects (SPIs), integrated interconnects (I2Cs), and the like, to facilitate connection of peripheral devices on the platform. In other embodiments, the chipset <NUM> may comprise more than one controller hub such as a chipset with a memory controller hub, a graphics controller hub, and an input/output (I/O) controller hub.

In the depicted example, chipset <NUM> couples with a trusted platform module (TPM) <NUM> and UEFI, BIOS, FLASH circuitry <NUM> via I/F <NUM>. The TPM <NUM> is a dedicated microcontroller designed to secure hardware by integrating cryptographic keys into devices. The UEFI, BIOS, FLASH circuitry <NUM> may provide pre-boot code.

Furthermore, chipset <NUM> includes the I/F <NUM> to couple chipset <NUM> with a high-performance graphics engine, such as, graphics processing circuitry or a graphics processing unit (GPU) <NUM>. In other embodiments, the system <NUM> may include a flexible display interface (FDI) (not shown) between the processor <NUM> and/or the processor <NUM> and the chipset <NUM>. The FDI interconnects a graphics processor core in one or more of processor <NUM> and/or processor <NUM> with the chipset <NUM>.

Additionally, ML accelerator <NUM> and/or vision processing unit <NUM> can be coupled to chipset <NUM> via I/F <NUM>. ML accelerator <NUM> can be circuitry arranged to execute ML related operations (e.g., training, inference, etc.) for ML models. Likewise, vision processing unit <NUM> can be circuitry arranged to execute vision processing specific or related operations. In particular, ML accelerator <NUM> and/or vision processing unit <NUM> can be arranged to execute mathematical operations and/or operands useful for machine learning, neural network processing, artificial intelligence, vision processing, etc..

Various I/O devices <NUM> and display <NUM> couple to the bus <NUM>, along with a bus bridge <NUM> which couples the bus <NUM> to a second bus <NUM> and an I/F <NUM> that connects the bus <NUM> with the chipset <NUM>. In one embodiment, the second bus <NUM> may be a low pin count (LPC) bus. Various devices may couple to the second bus <NUM> including, for example, a keyboard <NUM>, a mouse <NUM> and communication devices <NUM>.

Furthermore, an audio I/O <NUM> may couple to second bus <NUM>. Many of the I/O devices <NUM> and communication devices <NUM> may reside on the motherboard or system-on-chip(SoC) <NUM> while the keyboard <NUM> and the mouse <NUM> may be add-on peripherals. In other embodiments, some or all the I/O devices <NUM> and communication devices <NUM> are add-on peripherals and do not reside on the motherboard or system-on-chip(SoC) <NUM>.

The components and features of the devices described above may be implemented using any combination of: processing circuitry, discrete circuitry, application specific integrated circuits (ASICs), logic gates and/or single chip architectures, etc. Further, the features of the devices may be implemented using microcontrollers, programmable logic arrays and/or microprocessors or any combination of the foregoing where suitably appropriate. It is noted that hardware, firmware and/or software elements may be collectively or individually referred to herein as "logic" or "circuit.

Some embodiments may be described using the expression "one embodiment" or "an embodiment" along with their derivatives. These terms mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Further, some embodiments may be described using the expression "coupled" and "connected" along with their derivatives.

It is emphasized that the Abstract of the Disclosure is provided to allow a reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing Detailed Description, it can be seen that various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Thus, the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment. In the appended claims, the terms "including" and "in which" are used as the plain-English equivalents of the respective terms "comprising" and "wherein," respectively. Moreover, the terms "first," "second," "third," and so forth, are used merely as labels, and are not intended to impose numerical requirements on their objects.

Claim 1:
A method for an autonomous vehicle, comprising:
identifying (<NUM>) a first one or more temporary extracted features (<NUM>), the extracted features associated with inputs to a random forest model (<NUM>, <NUM>), the random forest model arranged to classify the extracted features into one of a plurality of labels (<NUM>-<NUM>);
processing (<NUM>), via circuitry, the first one or more temporary extracted features to identify a first trend (<NUM>), wherein the first trend indicates a first one or more of the plurality of labels (<NUM>, <NUM>);
identifying a speculated label (<NUM>, <NUM>) of the plurality of labels based on the first trend indicating the first one or more of the plurality of labels (<NUM>, <NUM>); and
generating a speculated classification result based on the speculated label,
wherein the temporary extracted features are identified based on a partial set of samples at a moment in time.