Intrusion Detection for CPS Real-Time Controllers

Abstract

Security in CPS-based real-time embedded systems controlling the power grid has been an afterthought, but it is becoming a critical issue as CPS systems are networked and inter-dependent. This work presents a set of mechanisms for time-based intrusion detection, i.e., the execution of unauthorized instructions in real-time CPS environments. The novelty is the utilization of information obtained by static timing analysis for intrusion detection. Real-time CPS systems are unique in that timing bounds on code sections are readily available since they are required for schedulability analysis. We demonstrate how micro-timings can be exploited for multiple granularity levels of application code to track execution progress. Through bounds checking of these micro-timings, we develop techniques to detect intrusions (1) in a self-checking manner by the application and (2) through the operating system scheduler, which are novel contributions to the real-time/embedded systems domain to the best of our knowledge.

Temporal-based intrusion detection for IoV

“…However, as mentioned previously, this extreme solution may not be suitable for hard-real-time systems, as it may cause the system to enter an unstable state. Zimmer et al [24] use the WCET timing bound to detect code injection attacks by comparing the WCET value with the elapsed time along the return path. Petal et al [14] proposed an approach to monitor the execution time of the running tasks.…”

Evaluation of the architecture alternatives for real-time intrusion detection systems for connected vehicles

“…Zimmer et al [22] proposed time-based IDS using timing metrics and comparing the worst-case bounds to detect code injection on CPS system. The three approaches in the study are to obtain timing bound during static analysis, synchronous scheduler calls, asynchronous scheduler calls.…”