CPS approach to checking norm operation of a brake-by-wire system

Abstract

For better controllability and energy-efficiency, more vehicle functions are being implemented via electronic control systems in place of traditional mechanical control systems. However, such transitions are creating new, unprecedented risks such as software bugs or hardware glitches, all of which can lead to serious safety risks. Recent real-world examples and research literature have been covering them under the name of vehicle misbehavior. In this paper, we present a new way of checking norm operations, called BAD (Brake Anomaly Detection), which detects any vehicle misbehavior in the Brake-by-Wire system. We focus on the braking system since it is a prototypical safety-critical and cyber-physical system. We first propose a new method for constructing norm models of braking and then show how anomalies are detected by BAD using the constructed models. Finally, we discuss how to verify the results, especially in the context of false positives. Our evaluation results show that BAD can effectively detect various types of anomaly in the braking system.

Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems

“…Due to the diversity of CPS applications, existing anomaly detection solutions are proposed to detect specific attacks for [3], unmanned aerial vehicles [70], medical devices [71], automotive [72], [73], industrial control process [4], [34], [55]. The majority of research efforts in this area thus far have concentrated on behavior modelbased anomaly detection [55], and can be generally classified into two categories: 1) cyber model (e.g., program behavior model, network traffic analysis, or timing analysis); 2) physical model (e.g., range-based model or physical laws).…”

“…It captures internal relations among system variables and physical states. Cho et al [72] presented a brake anomaly detection system, which compares the brake data with the norm model to detect any vehicle misbehavior (e.g., due to software bugs or hardware glitches) in the Brake-by-Wire system. Other examples include utilizing fluid dynamics and electromagnetics as the basic laws to create prediction models for water system [56] and power grid [57], respectively.…”

Shape of the Cloak: Formal Analysis of Clock Skew-Based Intrusion Detection System in Controller Area Networks

“…Hence, there is an urgent need for securing CAN buses. Security solutions for CAN can be broadly classified into schemes that add cryptographic measures to the CAN bus [8]- [10], [18] and anomaly-based IDSs that 1) analyze the traffic on the CAN bus including message contents [19]- [21], timing/frequency [15], [22]- [25], entropy [26], and survival rates [27], 2) exploit the physical characteristics of ECUs extracted from in-vehicle sensing data [28]- [30] or measurements [11], [13], [14], [31], [32], and 3) exploit the characteristics of the CAN protocol, such as the remote frame [33]. Compared to the CAN traffic, it is more difficult for adversaries to imitate the physical characteristics of ECUs, such as the mean squared error of voltage measurements [11].…”

Exploiting Consistency Among Heterogeneous Sensors for Vehicle Anomaly Detection

“…Among these, proposals which compare and validate cross-sensory data are the most relevant to our approach. Cho et al [2] detect anomalies in the brake sub-system by modeling vehicle dynamics. They use the tire friction and current road condition to model the expected braking behavior.…”