CISE-MSI: DP: CPS: Statistical and Artificial Intelligence-based Cyberattack Detection Models for Connected Vehicles

该奖项全部或部分根据2021年美国救援计划法案（公法117-2）资助。该项目还由CISE MSI研究扩展计划和刺激竞争研究的既定计划（EPSCoR）共同资助。这项研究的动机是为了提高美国的竞争力，培养有才华和技能的年轻专业人员，他们拥有深入的网络安全知识，专注于互联和自动驾驶汽车，并使用先进的计算技术实施这些方法。解决未来对联网车辆的网络攻击需要今天的学生在多学科团队中学习不断发展的网络威胁，并广泛思考如何检测此类攻击，这些攻击每天都会发生变化。该项目的愿景是使用综合和可扩展的方法来改造本尼迪克特学院的课程，以培养能够在非传统的跨学科团队中进行创新的学生，以解决独特的网络安全问题。它开发和评估检测模型，重点关注车载系统和连接车辆与其他车辆，基础设施和服务的无线网络中的网络攻击。运输网络物理系统由移动的边缘（例如，互联车辆）、固定边缘设备、后端服务器和车载系统，它们运行不同的安全性、移动性和环境应用。由于应用程序的要求，边缘设备通过不同的通信选项相互交换实时的异构数据，并与后端服务器交换数据。对互联汽车应用的攻击可能会对公共安全产生重大影响。例如，一旦恶意软件被注入，关键的安全应用程序（如碰撞警告）可能会发生故障并导致灾难性后果。实时检测网络安全威胁具有挑战性，因为此类攻击的动态行为，特别是在车辆和行人处于运动状态的联网车辆环境中。为了解决这些问题，变点模型可以实时检测异常。此外，基于数据驱动的人工智能模型可以检测这些攻击，因为这些模型适用于具有已知和未知模式的不同攻击类型。该项目的任务包括开发和比较基于变点和人工智能模型的实时网络攻击检测策略的有效性。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This award is funded in whole or in part under the American Rescue Plan Act of 2021 (Public Law 117-2). This project is also jointly funded by the CISE MSI Research Expansion Program and the Established Program to Stimulate Competitive Research (EPSCoR). This research is motivated by the necessity to promote U.S. competitiveness and develop talented and skilled young professionals who have in-depth cybersecurity knowledge, focusing on connected and automated vehicles and implementing these methods using advanced computational techniques. Solving tomorrow’s cyberattacks on connected vehicles requires today’s students to learn in multidisciplinary teams about the evolving cyber threats and think broadly about detecting such attacks, which will change daily. This project’s vision is to transform programs at Benedict College using an integrated and scalable approach to produce students capable of innovating in non-traditional, interdisciplinary teams to solve the unique cybersecurity problems. It develops and evaluates detection models, focusing on cyberattacks in the in-vehicle systems and the wireless network connecting the vehicles with other vehicles, infrastructure, and services. The transportation cyber-physical systems consist of mobile edges (e.g., connected vehicles), fixed edge devices, backend servers, and in-vehicle systems, which run different safety, mobility, and environmental applications. Due to the application requirements, the edge devices exchange real-time, heterogeneous data with each other and with the backend servers through different communication options. Attacks on connected vehicles applications can have a significant impact on public safety. For example, once the malware is injected, a critical safety application, such as the collision warning, can malfunction and result in catastrophic consequences. Detecting cybersecurity threats in real-time is challenging because of the dynamic behavior of such attacks, especially in a connected vehicle environment where the vehicles and pedestrians are in motion. To address these, change-point models can potentially detect anomalies in real-time. Also, data-driven artificial intelligence-based models can detect these attacks as these models are adaptable to different attack types with known and unknown patterns. The project tasks include the development and comparison of efficacies of the real-time cyberattack detection strategies, which are based on change-point and artificial intelligence models.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.