EXCELLENCE in RESEARCH: SECURING MACHINE LEARNING AGAINST ADVERSARIAL ATTACKS FOR CONNECTED AND AUTONOMOUS VEHICLES

这项研究的动机是需要通过加快采用威胁识别和抗攻击控制对策来提高美国的竞争力，并增加对智能系统的安全性、安全性和可靠性有深入了解的年轻人的数量。未来对联网和自动化车辆的网络攻击将需要研究和开发新的对策，以提高这些车辆技术的市场接受度，这些技术可以改善交通条件、车辆和个人安全以及能源效率。该奖项将有助于未被充分代表的本科生和研究生在建模、人工智能和通信方面的智力发展，以解决联网自动驾驶汽车中的网络安全问题。这项研究的主要目标是创造一种防御技术，使联网的自动驾驶车辆能够更好地抵御对手攻击，从而能够满足更严格的安全和性能要求。另一个重点是让本科生和研究生团队参与基于动手演示平台的创造性调查和设计项目。这项研究特别侧重于增强联网自动驾驶车辆对旨在影响感知模块性能的对抗性攻击的可能性的复原力，从而提高车辆的可靠性和功能安全性，超越目前采用的做法。此外，该奖项在安全、机器学习、过滤和优化领域具有更大的理论意义，最终加快了互联自动驾驶汽车的部署。互联和自动驾驶汽车的最新进展表明，几家公司正在大力投资开发基于机器学习算法的感知模块。然而，这些机器学习算法容易受到对抗性攻击，这些攻击旨在误导深度神经网络的输入以导致错误分类，这可能会破坏车辆决策，从而破坏功能安全性。通过无线以太网连接，攻击者可以危害车载计算机平台并访问存储在内存中的传感器数据。在感知模块之前，可能会引入对抗性输入，以取代原来的正常输入并破坏车辆运行的稳定性。总体框架包括对影响感知和融合进程的潜在对抗性威胁进行建模，并为系统的安全和可靠运作设计被动和主动的对策。这项技术是模块化的，可以部署到深度神经网络的一系列应用中，如机器人、生物识别和语音识别。在训练阶段加入稳健性措施将产生更具弹性的深度神经网络。此外，在感知器过程的几个阶段进行过滤可以用来开发一种天生可以容忍更大范围的攻击的系统。该项目的任务旨在对一项计划进行基础研究，该计划包括对单一和融合传感器数据的对抗性攻击建模，用于检测各种白盒和黑盒攻击的新型数据过滤算法，基于优化模型中稳健性/敏感度权衡的修订的深度神经网络训练，传感器融合的影响评估，以及在F1/10赛车和自动高尔夫球车上测试框架。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This research is motivated by the need to boost U.S. competitiveness and increase the number of young people with an in-depth understanding of the safety, security, and dependability of intelligent systems by accelerating the adoption of threat identification and attack-resistant control countermeasures. Future cyberattacks on connected and automated vehicles will necessitate the study and development of novel countermeasures to increase market acceptance of these vehicle technologies, which could improve traffic conditions, vehicle and personal safety, and energy efficiency. This award will contribute to the intellectual development of underrepresented undergraduate and graduate students in modeling, Artificial Intelligence, and communication to address cybersecurity issues in connected autonomous vehicles. The prime objective of this research is to create a defense technique that will enable Connected Autonomous Vehicles to be more resistant to adversarial attacks and hence capable of meeting more stringent safety and performance requirements. Another key focus is to involve teams of undergraduate and graduate students in creative inquiry and design projects based on hands-on demo platforms. This research focuses especially on enhancing the resilience of Connected Autonomous Vehicles against the possibility of adversarial attacks aimed at affecting the performance of the perception module, thereby improving vehicle reliability and functional safety beyond currently adopted practices. In addition, the award has larger theoretical implications in the fields of security, Machine Learning, filtering, and optimization, ultimately expediting the deployment of connected autonomous vehicles.Recent advancements in connected and autonomous vehicles reveal that several companies are investing substantially in the development of perception modules based on machine learning algorithms. However, these machine learning algorithms are vulnerable to adversarial attacks designed to mislead the input of the deep neural network to induce a misclassification, which may undermine vehicle decision-making and, therefore, functional safety. Through wireless Ethernet connectivity, attackers may compromise the in-vehicle computer platform and obtain access to the sensor data stored in memory. Before the perception module, adversarial inputs may be introduced to supplant the original normal inputs and destabilize vehicle operations. The overall framework comprises modeling potential adversarial threats impacting the perception and fusion process and designing both reactive and proactive countermeasures for the secure and reliable functioning of the system. This technique is modular and can be deployed to a range of Deep Neural Network applications such as robotics, biometric identification, and speech recognition. Incorporating robustness measures during the training phase will yield a more resilient Deep Neural Network. Moreover, filtering at several stages of the perceptron process can be used to develop a system that can innately tolerate a greater spectrum of attacks. The project tasks aim at conducting fundamental research on a plan that includes adversarial attack modeling for single and fused sensor data, novel data filtering algorithms for detecting various white-box and black-box attacks, revised Deep Neural Network training based on robustness/sensitivity tradeoff in optimization models, evaluation of the impact of sensor fusion, and testing the framework on F1/10 cars and autonomous golf cars.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.