Variable Window and Deadline-Aware Sensor Attack Detector for Automotive CPS
Variable Window and Deadline-Aware Sensor Attack Detector for Automotive CPS
复制标题
DOI：
10.1109/isorc58943.2023.00018
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Francis Akowuah;Kenneth Fletcher;Fanxin Kong
中科院分区：
文献类型：
--
作者：
Francis Akowuah;Kenneth Fletcher;Fanxin Kong
网络物理系统（CPS）容易受到物理攻击，研究人员正在探索检测它们的方法。一种方法是在设定的时间内监测系统，即时间窗口，并识别超过预定阈值的残余误差。然而，这种方法意味着任何传感器攻击警报只能在时间窗口过去后触发。时间窗口的长度影响检测延迟和误报的可能性，时间窗口越短，检测速度越快，但误报率越高；时间窗口越长，检测速度越慢，但误报率越低。虽然研究人员的目标是选择一个固定的时间窗口来平衡低假阳性率和短检测延迟，但由于两者之间的权衡，这一目标很难实现。本文提出的另一种解决方案是具有可变的时间窗口，该时间窗口可以根据CPS的当前状态进行调整。例如，如果CPS正走向不安全状态，减少检测延迟（通过减少时间窗口）比减少误报率更重要，反之亦然。提出了一种动态调整时间窗的传感器攻击检测框架，在系统进入危险区域之前触发攻击警报，保证及时检测。该框架由三个部分组成：攻击检测器、状态预测器和窗口适配器。我们使用真实世界的数据评估了我们的工作，结果表明我们的解决方案提高了基于时间窗口的攻击检测器的可用性和及时性。
Cyber-physical systems (CPS) are susceptible to physical attacks, and researchers are exploring ways to detect them. One method involves monitoring the system for a set duration, known as the time-window, and identifying residual errors that exceed a predetermined threshold. However, this approach means that any sensor attack alert can only be triggered after the time-window has elapsed. The length of the time-window affects the detection delay and the likelihood of false alarms, with a shorter time-window leading to quicker detection but a higher false positive rate, and a longer time-window resulting in slower detection but a lower false positive rate.While researchers aim to choose a fixed time-window that balances a low false positive rate and short detection delay, this goal is difficult to attain due to a trade-off between the two. An alternative solution proposed in this paper is to have a variable time-window that can adapt based on the current state of the CPS. For instance, if the CPS is heading towards an unsafe state, it is more crucial to reduce the detection delay (by decreasing the time-window) rather than reducing the false alarm rate, and vice versa. The paper presents a sensor attack detection framework that dynamically adjusts the time-window, enabling attack alerts to be triggered before the system enters dangerous regions, ensuring timely detection. This framework consists of three components: attack detector, state predictor, and window adaptor. We have evaluated our work using real-world data, and the results demonstrate that our solution improves the usability and timeliness of time-window-based attack detectors.