Real-time adaptive sensor attack detection in autonomous cyber-physical systems

Francis Akowuah, Fanxin Kong

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Scopus citations

Abstract

Cyber-Physical Systems (CPS) tightly couple information technology with physical processes, which rises new vulnerabilities such as physical attacks that are beyond conventional cyber attacks. Attackers may non-invasively compromise sensors and spoof the controller to perform unsafe actions. This issue is even emphasized with the increasing autonomy in CPS. While this fact has motivated many defense mechanisms against sensor attacks, a clear vision on the timing and usability (or the false alarm rate) of attack detection still remains elusive. Existing works tend to pursue an unachievable goal of minimizing the detection delay and false alarm rate at the same time, while there is a clear trade-off between the two metrics. Instead, we argue that attack detection should bias different metrics when a system sits in different states. For example, if the system is close to unsafe states, reducing the detection delay is preferable to lowering the false alarm rate, and vice versa. To achieve this, we make the following contributions. In this paper, we propose a real-time adaptive sensor attack detection framework. The framework can dynamically adapt the detection delay and false alarm rate so as to meet a detection deadline and improve the usability according to different system status. The core component of this framework is an attack detector that identifies anomalies based on a CUSUM algorithm through monitoring the cumulative sum of difference (or residuals) between the nominal (predicted) and observed sensor values. We augment this algorithm with a drift parameter that can govern the detection delay and false alarm. The second component is a behavior predictor that estimates nominal sensor values fed to the core component for calculating the residuals. The predictor uses a deep learning model that is offline extracted from sensor data through leveraging convolutional neural network (CNN) and recurrent neural network (RNN). The model relies on little knowledge of the system (e.g., dynamics), but uncovers and exploits both the local and complex long-term dependencies in multivariate sequential sensor measurements. The third component is a drift adaptor that estimates a detection deadline and then determines the drift parameter fed to the detector component for adjusting the detection delay and false alarms. Finally, we implement the proposed framework and validate it using realistic sensor data of automotive CPS to demonstrate its efficiency and efficacy.

Original languageEnglish (US)
Title of host publicationProceedings - 2021 IEEE 27th Real-Time and Embedded Technology and Applications Symposium, RTAS 2021
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages237-250
Number of pages14
ISBN (Electronic)9781665403863
DOIs
StatePublished - May 2021
Event27th IEEE Real-Time and Embedded Technology and Applications Symposium, RTAS 2021 - Virtual, Online
Duration: May 18 2021May 21 2021

Publication series

NameProceedings of the IEEE Real-Time and Embedded Technology and Applications Symposium, RTAS
Volume2021-May
ISSN (Print)1545-3421

Conference

Conference27th IEEE Real-Time and Embedded Technology and Applications Symposium, RTAS 2021
CityVirtual, Online
Period5/18/215/21/21

Keywords

  • autonomous cyber-physical systems
  • detection
  • physical attacks
  • real-time
  • security

ASJC Scopus subject areas

  • Engineering(all)

Fingerprint

Dive into the research topics of 'Real-time adaptive sensor attack detection in autonomous cyber-physical systems'. Together they form a unique fingerprint.

Cite this