No abstract

No abstract

No abstract

Anomaly detection is critical in thwarting malicious attacks on Cyber-Physical Systems. This work presents a novel inference engine that integrates two heterogeneous anomaly detectors, working at different levels of the system architecture, in order to produce a crosslevel detector more effective than either one separately. The macro-or process-level detector uses a bank of observers of the physical plant that estimate the state of the process suspected to be under attack, specifically for its sensor to be compromised, from data gathered by available networked sensors. The estimates are then combined using a Weapons and Systems Engineering Department, U.S. Naval Academy, Annapolis, MD, USA consensus algorithm to determine if the suspect sensor is reporting false readings. The micro-level detector uses timesampled side-channel power measurements of an integrated circuit on the suspect sensor. By comparing power measurements against those from a known good state, differences indicate the code running inside has been altered. The crosslevel detector performs a two-dimensional Neyman-Pearson hypothesis test that declares the presence of an attack on the sensor node. The cross-level detector is shown to be more accurate and less latent than its constituent parts. Detection was tested against a range of False Data Injection attacks on a hardware prototype and the detector performance was measured experimentally. The cross-level detector on average achieved a 93% rate of correct detection, compared with 72 and 85% for the macro-and micro-level detectors, respectively; and a 50% reduction in latency compared to the macro-level detector.

Sensing systems onboard unmanned vehicles operate in an environment of constrained computational resources. A cyber-attack may primarily aim to degrade these computing devices and, ultimately, incapacitate the sensing system itself. To prepare a prototype tracking system for degradation, this paper proposes distributed hardware implementation of a Multiple Model estimator on two FPGA units and, after an attack, adaptation of the estimator by leveraging Dynamic Partial Reconfiguration of the single surviving FPGA. The method ensures that the most likely models of the estimator are loaded on to the fabric of the surviving FPGA with minimal interruption.