1. Detecting Attacks Against Robotic Vehicles:
A Control Invariant Approach
Hongjun Choi, Wen-Chuan Lee, Yousra Aafer, Fan Fei, Zhan Tu, Xiangyu Zhang, Dongyan Xu, Xinyan Deng
Purdue University
CCS 2018

5. Motivation
Utilizing the control invariant to detect physical attacks against RV.

6. Motivation example

7. Control Invariant Approach

8. Framework Overview

9. Adversary model
1. Attackers corrupt or inject signals through external means.
2. Attackers have no access to the control program
3. Traditional cyber attacks are not the focus of this paper

10. Control Invariant Extraction

11. System Identification
Two key observations:
All vehicles of similar type/organization share the same dynamics template.
The basic PID controller can approximate complex control algorithms reasonably well for external attack detection
Determining quadrotor dynamics
Linear acceleration along x, y, z
Angular acceleration along xB, yB, zB

12. System Identification
Instantiating PID controller
Completing system identification

13. Monitoring Parameters Selection
Monitor window size
Dynamic time-warping: find the largest w in all the primitive operation
Threshold
Maximum observed model-induced errors within the window

14. Control Program Reverse Engineering and Instrumentation
Control loop identification: Callgrind tool

15. Control Program Reverse Engineering and Instrumentation
Identifying memory location for critical state variables
ARM binary rewriting

16. Runtime Control Invariant Monitoring

17. Evaluation
Subject vehicles
Vehicle simulation

18. Evaluation Attacks Sensor spoofing attacks
Compromising inertial sensors and GPS sensors
Control signal spoofing attacks
Targeting the motor pulse width modulation signals
Parameter corruption attacks
Adding attacking code to the control program that modifies control parameters

19. Evaluation
Experiments and results - efficiency

20. Evaluation Experiments and results - effectiveness
The extracted control invariants can properly predict normal vehicle behaviors and do not raise false alarms during normal operation.

21. Evaluation Experiments and results - effectiveness
The false negative rate of attack detection (0%)
The time of attack detection (0.2s)

22. Evaluation Experiments and results - effectiveness
Control invariants are vehicle specific

23. Evaluation Experiments and results – effectiveness
The the effectiveness of monitoring parameter setting techniques

24. Evaluation Experiments and results - effectiveness
Error changes under various environmental conditions

25. Evaluation
Case studies

26. Discussion
Mimicry attacks
More adaptive detection
Attack response

27. Contribution
By modeling the physical/control properties and normal dynamics of a subject vehicle, the control invariants directly expose any violation caused by physical, external attacks;
With monitoring window and threshold, our framework achieves high detection accuracy by filtering out false positive invariant violations.
Our framework enables software-based detection of physical attacks without hardware modification or addition.

28. Conclusion
The authors presented a new comprehensive framework Control Invariant for detecting external physical attacks against RVs, based on the definition, derivation, and monitoring of control invariants for the vehicles.

29. Thanks!