Time-based intrusion detection in cyber-physical systems

Abstract

Abstract-Embedded systems, particularly real-time systems with temporal constraints, are increasingly deployed in every day life. Such systems that interact with the physical world are also referred to as cyber-physical systems (CPS). These systems commonly find use in critical infrastructure from transportation to health care. While security in CPS-based real-time embedded systems has been an afterthought, it is becoming a critical issue as these systems are increasingly networked and inter-dependent. The advancement in their functionality has resulted in more conspicuous interfaces that may be exploited to attack them.In this paper, we present three mechanisms for time-based intrusion detection. More specifically, we detect the execution of unauthorized instructions in real-time CPS environments. Such intrusion detection utilizes information obtained by static timing analysis. For real-time CPS systems, timing bounds on code sections are readily available as they are already determined prior to the schedulability analysis. We demonstrate how to provide micro-timings for multiple granularity levels of application code. Through bounds checking of these micro-timings, we develop techniques to detect intrusions (1) in a self-checking manner by the application and (2) through the operating system scheduler, which are novel contributions to the real-time/embedded systems domain to the best of our knowledge.

Effect of Intrusion Detection and Response on Reliability of Cyber Physical Systems

“…Carcano, et al [6] propose a specification based IDS that extends [15]; it distinguishes faults from attacks, describes a language to express a CPS specification, and establishes a critical state distance metric. Zimmer, et al [29] study a specification based IDS that instruments a target application, and uses a scheduler to confirm timing analysis results. Our work is also specification based.…”

A survey of intrusion detection techniques for cyber-physical systems

“…Host-Based Audit. Many IDSs Mitchell and Chen 2011, 2013d, 2013cLauf et al 2010;He and Blum 2011;Zhang et al 2011bZhang et al , 2011aAsfaw et al 2010;Carcano et al 2011;Zimmer et al 2010;Mitchell and Chen 2012b, 2012a, 2013b, 2013a that use host-based auditing analyze logs maintained by a node or other audit data, such as file system details, to determine if it is compromised. One major advantage of using host-based auditing is distributed control; this is attractive for high-volume configurations like smart grids.…”

“…This paper addresses three of the unique aspects of CPS. Zimmer et al [2010] propose a behavior-specification-based approach to intrusion detection for smart utility (power) applications called T-Rex. T-Rex uses host-based auditing.…”

Towards a Framework for Assuring Cyber Physical System Security

“…Christopher Zimmer, et al, in [71] present three mechanisms for time-based intrusion detection to detect the execution of unauthorized instructions in real-time CPS environments and develop techniques to detect intrusions in a self-checking manner by application and through the operating system scheduler.…”