Detecting Attacks Against Robotic Vehicles: A Control Invariant Approach Hongjun Choi, Wen-Chuan Lee, Yousra Aafer, Fan Fei, Zhan Tu, Xiangyu Zhang, Dongyan Xu, Xinyan Deng Purdue University CCS 2018

Motivation Utilizing the control invariant to detect physical attacks against RV.

Motivation example

Control Invariant Approach

Framework Overview

Adversary model 1. Attackers corrupt or inject signals through external means. 2. Attackers have no access to the control program 3. Traditional cyber attacks are not the focus of this paper

Control Invariant Extraction

System Identification Two key observations: All vehicles of similar type/organization share the same dynamics template. The basic PID controller can approximate complex control algorithms reasonably well for external attack detection Determining quadrotor dynamics Linear acceleration along x, y, z Angular acceleration along xB, yB, zB

System Identification Instantiating PID controller Completing system identification

Monitoring Parameters Selection Monitor window size Dynamic time-warping: find the largest w in all the primitive operation Threshold Maximum observed model-induced errors within the window

Control Program Reverse Engineering and Instrumentation Control loop identification: Callgrind tool

Control Program Reverse Engineering and Instrumentation Identifying memory location for critical state variables ARM binary rewriting

Runtime Control Invariant Monitoring

Evaluation Subject vehicles Vehicle simulation

Evaluation Attacks Sensor spoofing attacks Compromising inertial sensors and GPS sensors Control signal spoofing attacks Targeting the motor pulse width modulation signals Parameter corruption attacks Adding attacking code to the control program that modifies control parameters

Evaluation Experiments and results - efficiency

Evaluation Experiments and results - effectiveness The extracted control invariants can properly predict normal vehicle behaviors and do not raise false alarms during normal operation.

Evaluation Experiments and results - effectiveness The false negative rate of attack detection (0%) The time of attack detection (0.2s)

Evaluation Experiments and results - effectiveness Control invariants are vehicle specific

Evaluation Experiments and results – effectiveness The the effectiveness of monitoring parameter setting techniques

Evaluation Experiments and results - effectiveness Error changes under various environmental conditions

Evaluation Case studies

Discussion Mimicry attacks More adaptive detection Attack response

Contribution By modeling the physical/control properties and normal dynamics of a subject vehicle, the control invariants directly expose any violation caused by physical, external attacks; With monitoring window and threshold, our framework achieves high detection accuracy by filtering out false positive invariant violations. Our framework enables software-based detection of physical attacks without hardware modification or addition.

Conclusion The authors presented a new comprehensive framework Control Invariant for detecting external physical attacks against RVs, based on the definition, derivation, and monitoring of control invariants for the vehicles.

Thanks!