Detecting Attacks Against Robotic Vehicles: A Control Invariant Approach

ABSTRACT

Robotic vehicles (RVs), such as drones and ground rovers, are a type of cyber-physical systems that operate in the physical world under the control of computing components in the cyber world. Despite RVs' robustness against natural disturbances, cyber or physical attacks against RVs may lead to physical malfunction and subsequently disruption or failure of the vehicles' missions. To avoid or mitigate such consequences, it is essential to develop attack detection techniques for RVs. In this paper, we present a novel attack detection framework to identify external, physical attacks against RVs on the fly by deriving and monitoring Control Invariants (CI). More specifically, we propose a method to extract such invariants by jointly modeling a vehicle's physical properties, its control algorithm and the laws of physics. These invariants are represented in a state-space form, which can then be implemented and inserted into the vehicle's control program binary for runtime invariant check. We apply our CI framework to eleven RVs, including quadrotor, hexarotor, and ground rover, and show that the invariant check can detect three common types of physical attacks -- including sensor attack, actuation signal attack, and parameter attack -- with very low runtime overhead.

References

1. Martín Abadi, Mihai Budiu, Úlfar Erlingsson, and Jay Ligatti. 2005. Control-flow integrity. In the 12th ACM conference. ACM Press, New York, New York, USA, 340--353.
2. Alireza Abbaspour, Kang K Yen, Shirin Noei, and Arman Sargolzaei. 2016. Detection of fault data injection attack on uav using adaptive neural network. Procedia computer science 95 (2016), 193--200.
3. Amazon Prime Air Delivery 2016. Amazon Prime Air. https://www.amazon. com/Amazon-Prime-Air/b?node=8037720011.
4. ArduPilot 2017. ArduPilot :: Home. http://ardupilot.org/.
5. ArduPilot Dev Team 2016. SITL Simulator (Software in the Loop). http://ardupilot. org/dev/docs/sitl-simulator-software-in-the-loop.html.
6. Stanley Bak, Karthik Manamcheri, Sayan Mitra, and Marco Caccamo. 2011. Sandboxing controllers for cyber-physical systems. In Proceedings of the 2011 IEEE/ACM Second International Conference on Cyber-Physical Systems. IEEE Computer Society, 3--12.
7. Jason Bau and John C Mitchell. 2011. Security modeling and analysis. IEEE Security & Privacy 9, 3 (2011), 18--25.
8. George A Bekey. 1970. System identification-an introduction and a survey.
9. Samir Bouabdallah, Pierpaolo Murrieri, and Roland Siegwart. 2004. Design and control of an indoor micro quadrotor. In Robotics and Automation, 2004. Proceedings. ICRA'04. 2004 IEEE International Conference on, Vol. 5. IEEE, 4393-- 4398.
10. Bryan Buck and Jeffrey K Hollingsworth. 2000. An API for runtime code patching. The International Journal of High Performance Computing Applications 14, 4 (2000), 317--329.
11. Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, Stefan Savage, Karl Koscher, Alexei Czeskis, Franziska Roesner, Tadayoshi Kohno, et al. 2011. Comprehensive Experimental Analyses of Automotive Attack Surfaces.. In USENIX Security Symposium. San Francisco.
12. Feng Chen and Grigore Rosu. 2007. Mop: an efficient and generic runtime verification framework. In Acm Sigplan Notices, Vol. 42. ACM, 569--588.
13. Yuqi Chen, Christopher M Poskitt, and Jun Sun. 2018. Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System. arXiv preprint arXiv:1801.00903 (2018).
14. Abraham A Clements, Naif Saleh Almakhdhub, Khaled S Saab, Prashast Srivastava, Jinkyu Koo, Saurabh Bagchi, and Mathias Payer. 2017. Protecting Bare-metal Embedded Systems With Privilege Overlays. In Security and Privacy (SP), 2017 IEEE Symposium on. IEEE, 289--303.
15. CNN 2012. Self-driving cars now legal in California. http://www.cnn.com/2012/ 09/25/tech/innovation/self-driving-car-california/index.html.
16. Frederick B Cohen. 1993. Operating system protection through program evolution. Computers & Security 12, 6 (1993), 565--584.
17. comma.ai 2018. commaai/openpilot: open source driving agent. https://github. com/commaai/openpilot.
18. Crispan Cowan, Calton Pu, Dave Maier, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, Qian Zhang, and Heather Hinton. 1998. Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks.. In USENIX Security Symposium, Vol. 98. San Antonio, TX, 63--78.
19. Ang Cui, Michael Costello, and Salvatore J Stolfo. 2013. When Firmware Modifications Attack: A Case Study of Embedded Exploitation. (2013).
20. Ang Cui and Salvatore J Stolfo. 2011. Defending embedded systems with software symbiotes. In International Workshop on Recent Advances in Intrusion Detection. Springer, 358--377.
21. Drew Davidson, Hao Wu, Robert Jellinek, Vikas Singh, and Thomas Ristenpart. 2016. Controlling UAVs with Sensor Input Spoofing Attacks.. In WOOT.
22. Onur Demir, Wenjie Xiong, Faisal Zaghloul, and Jakub Szefer. 2016. Survey of Approaches for Security Verification of Hardware/Software Systems. IACR Cryptology ePrint Archive 2016 (2016), 846.
23. Demo Video 2018. Attack Case 1: Sensor Spoofing Attack on IRIS+. https: //bit.ly/2Kb6TcK.
24. Demo Video 2018. Attack Case 2: Control Signal Attack on IRIS+. https: //bit.ly/2Ka5PpG.
25. Demo Video 2018. Attack Case 3: Control Parameter Corruption Attack on IRIS+. https://bit.ly/2LQTTOo.
26. Demo Video 2018. Attack Case 4: Control Parameter Corruption Attack on Erle-Rover. https://bit.ly/2LBpK6l.
27. Demo Video 2018. Attack Case 5: Motor Input Spoofing Attack on Erle-Rover. https://bit.ly/2LFPKOk.
28. Demo Video 2018. Attack Case 6: Sensor Manipulation Attack on Erle-Rover. https://bit.ly/2NXJDRQ.
29. Michael D Ernst, Jake Cockrell, William G Griswold, and David Notkin. 2001. Dynamically discovering likely program invariants to support program evolution. IEEE Transactions on Software Engineering 27, 2 (2001), 99--123.
30. Fan Fei, Zhan Tu, Ruikun Yu, Taegyu Kim, Xiangyu Zhang, Dongyan Xu, and Xinyan Deng. 2018. Cross-Layer Retrofitting of UAVs Against Cyber-Physical Attacks. In Proceedings of the IEEE International Conference on Robotics and Automation (ICRA 2018).
31. Paul M Frank. 1990. Fault diagnosis in dynamic systems using analytical and knowledge-based redundancy: A survey and some new results. automatica 26, 3 (1990), 459--474.
32. Wei Gao and Thomas H Morris. 2014. On cyber attacks and signature based intrusion detection for modbus based industrial control systems. The Journal of Digital Forensics, Security and Law: JDFSL 9, 1 (2014), 37.
33. Guoxiang Gu and Pramod P Khargonekar. 1992. A class of algorithms for identification in H?. Automatica 28, 2 (1992), 299--312.
34. Kate Highnam, Kevin Angstadt, Kevin Leach,WestleyWeimer, Aaron Paulos, and Patrick Hurley. 2016. An uncrewed aerial vehicle attack scenario and trustworthy repair architecture. In Dependable Systems and Networks Workshop, 2016 46th Annual IEEE/IFIP International Conference on. IEEE, 222--225.
35. Todd E Humphreys, Brent M Ledvina, Mark L Psiaki, Brady W O'Hanlon, and PaulMKintner Jr. 2008. Assessing the spoofing threat: Development of a portable GPS civilian spoofer. In Proceedings of the ION GNSS international technical meeting of the satellite division, Vol. 55. 56.
36. Galen Hunt and Doug Brubacher. 1999. Detours: Binary Interception of Win32 Functions. In 3rd usenix windows nt symposium.
37. IEEE 2014. Cyber-attack detection based on controlled invariant sets. IEEE.
38. Rob Millerb Ishtiaq Roufa, Hossen Mustafaa, Sangho Ohb Travis Taylora, Wenyuan Xua, Marco Gruteserb,Wade Trappeb, and Ivan Seskarb. 2010. Security and privacy vulnerabilities of in-car wireless networks: A tire pressure monitoring system case study. In 19th USENIX Security Symposium, Washington DC. 11--13.
39. JSBSim 2009. JSBSim Open Source Flight Dynamics Model. http://jsbsim. sourceforge.net/.
40. Khurum Nazir Junejo and Jonathan Goh. 2016. Behaviour-based attack detection and classification in cyber physical systems using machine learning. In Proceedings of the 2nd ACM International Workshop on Cyber-Physical System Security. ACM, 34--43.
41. Sanmeet Kaur and Maninder Singh. 2013. Automatic attack signature generation systems: A review. IEEE Security & Privacy 11, 6 (2013), 54--61.
42. Ahmed Khurshid,Wenxuan Zhou, MatthewCaesar, and P Godfrey. 2012. Veriflow: Verifying network-wide invariants in real time. In Proceedings of the first workshop on Hot topics in software defined networks. ACM, 49--54.
43. Chung Hwan Kim, Taegyu Kim, Hongjun Choi, Zhongshu Gu, Byoungyoung Lee, Xiangyu Zhang, and Dongyan Xu. 2018. Securing Real-Time Microcontroller Systems through Customized Memory View Switching. In Proceedings of the 25th Annual Network and Distributed System Security Symposium (NDSS '18). The Internet Society.
44. Fanxin Kong, Meng Xu, James Weimer, Oleg Sokolsky, and Insup Lee. 2018. Cyber-physical system checkpointing and recovery. In Proceedings of the 9th ACM/IEEE International Conference on Cyber-Physical Systems. IEEE Press, 22--31.
45. Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak Patel, Tadayoshi Kohno, Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, et al. 2010. Experimental security analysis of a modern automobile. In Security and Privacy (SP), 2010 IEEE Symposium on. IEEE, 447--462.
46. Denis Foo Kune, John Backes, Shane S Clark, Daniel Kramer, Matthew Reynolds, Kevin Fu, Yongdae Kim, and Wenyuan Xu. 2013. Ghost talk: Mitigating EMI signal injection attacks against analog sensors. (2013), 145--159.
47. Michael A Laurenzano, Mustafa M Tikir, Laura Carrington, and Allan Snavely. 2010. Pebil: Efficient static binary instrumentation for linux. In Performance Analysis of Systems & Software (ISPASS), 2010 IEEE International Symposium on. IEEE, 175--183.
48. Lennart Ljung. 1991. Issues in system identification. IEEE Control systems 11, 1 (1991), 25--29.
49. MATLAB 2017. System Identification Toolbox - MATLAB. https://www. mathworks.com/products/sysid.html.
50. Mario Milanese and Gustavo Belforte. 1982. Estimation theory and uncertainty intervals evaluation in presence of unknown but bounded errors: Linear families of models and estimators. IEEE Transactions on automatic control 27, 2 (1982), 408--414.
51. Military.com 2018. Drones | Military.com. http://www.military.com/equipment/ drones.
52. Robert Mitchell and Ray Chen. 2014. Adaptive intrusion detection of malicious unmanned air vehicles using behavior rule specifications. IEEE Transactions on Systems, Man, and Cybernetics: Systems 44, 5 (2014), 593--604.
53. Robert Mitchell and Ray Chen. 2015. Behavior rule specification-based intrusion detection for safety critical medical cyber physical systems. IEEE Transactions on Dependable and Secure Computing 12, 1 (2015), 16--30.
54. Yilin Mo and Bruno Sinopoli. 2010. False data injection attacks in control systems. (01 2010).
55. Nicholas Nethercote and Julian Seward. 2007. Valgrind: a framework for heavyweight dynamic binary instrumentation. ACM Sigplan notices 42, 6 (2007), 89.
56. Katsuhiko Ogata and Yanjuan Yang. 2002. Modern control engineering. Vol. 4. Prentice hall India.
57. Open Source Robotics Foundation 2014. Gazebo. http://gazebosim.org/.
58. Young-Seok Park, Yunmok Son, Hocheol Shin, Dohyun Kim, and Yongdae Kim. 2016. This Ain't Your Dose: Sensor Spoofing Attack on Medical Infusion Pump.. In WOOT.
59. Jonathan Petit, Bas Stottelaar, Michael Feiri, and Frank Kargl. 2015. Remote attacks on automated vehicles sensors: Experiments on camera and lidar. Black Hat Europe 11 (2015), 2015.
60. Lee Pike, Pat Hickey, Trevor Elliott, Eric Mertens, and Aaron Tomb. 2016. Trackos: A security-aware real-time operating system. In International Conference on Runtime Verification. Springer, 302--317.
61. Ales Prochazka, NG Kingsbury, PJW Payner, and J Uhlir. 2013. Signal analysis and prediction. Springer Science & Business Media.
62. PX4 Dev Team 2017. Open Source for Drones - PX4 Pro Open Source Autopilot. http://px4.io/.
63. Lawrence R Rabiner and Biing-Hwang Juang. 1993. Fundamentals of speech recognition. Vol. 14. PTR Prentice Hall Englewood Cliffs.
64. ROS 2017. ROS.org | Powering the world's robots. http://www.ros.org/.
65. Grigore Roşu, Wolfram Schulte, and Traian Florin Serbanuta. 2009. Runtime verification of C memory safety. In InternationalWorkshop on Runtime Verification. Springer, 132--151.
66. Hiroaki Sakoe and Seibi Chiba. 1978. Dynamic programming algorithm optimization for spoken word recognition. IEEE transactions on acoustics, speech, and signal processing 26, 1 (1978), 43--49.
67. Hovav Shacham, Matthew Page, Ben Pfaff, Eu-Jin Goh, Nagendra Modadugu, and Dan Boneh. 2004. On the effectiveness of address-space randomization. In Proceedings of the 11th ACM conference on Computer and communications security. ACM, 298--307.
68. Qikun Shen, Bin Jiang, Peng Shi, and Cheng-Chew Lim. 2014. Novel neural networks-based fault tolerant control scheme with fault alarm. IEEE transactions on cybernetics 44, 11 (2014), 2190--2201.
69. Yasser Shoukry, Paul Martin, Paulo Tabuada, and Mani Srivastava. 2013. Noninvasive spoofing attacks for anti-lock braking systems. In InternationalWorkshop on Cryptographic Hardware and Embedded Systems. Springer, 55--72.
70. Sergei Skorobogatov. 2009. Local heating attacks on Flash memory devices. In Hardware-Oriented Security and Trust, 2009. HOST'09. IEEE InternationalWorkshop on. IEEE, 1--6.
71. Sooel Son, Seungwon Shin, Vinod Yegneswaran, Phillip Porras, and Guofei Gu. 2013. Model checking invariant security properties in OpenFlow. In Communications (ICC), 2013 IEEE International Conference on. IEEE, 1974--1979.
72. Yunmok Son, Hocheol Shin, Dongkwan Kim, Young-Seok Park, Juhwan Noh, Kibum Choi, Jungwoo Choi, Yongdae Kim, et al. 2015. Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors.. In USENIX Security Symposium. 881--896.
73. Storm Prediction Center, NOAA / NationalWeather Service 2017. Beaufort Wind Scale. http://www.spc.noaa.gov/faq/tornado/beaufort.html.
74. The Guardian 2016. First passenger drone makes its debut at CES. https://www.theguardian.com/technology/2016/jan/07/ first-passenger-drone-makes-world-debut.
75. Nils Ole Tippenhauer, Christina Pöpper, Kasper Bonne Rasmussen, and Srdjan Capkun. 2011. On the requirements for successful GPS spoofing attacks. In Proceedings of the 18th ACM conference on Computer and communications security. ACM, 75--86.
76. Timothy Trippel, Ofir Weisse, Wenyuan Xu, Peter Honeyman, and Kevin Fu. 2017. WALNUT: Waging doubt on the integrity of mems accelerometers with acoustic injection attacks. In Security and Privacy (EuroS&P), 2017 IEEE European Symposium on. IEEE, 3--18.
77. ZhengboWang, KangWang, Bo Yang, Shangyuan Li, and Aimin Pan. 2017. SONIC GUN TO SMART DEVICES. Black Hat USA.
78. Jon S Warner and Roger G Johnston. 2002. A simple demonstration that the global positioning system (GPS) is vulnerable to spoofing. Journal of Security Administration 25, 2 (2002), 19--27.
79. Waymo 2017. Waymo (formerly the Google self-driving car project). https: //waymo.com.
80. Chen-Wei Xu and Yong-Zai Lu. 1987. Fuzzy model identification and self-learning for dynamic systems. IEEE Transactions on Systems, Man, and Cybernetics 17, 4 (1987), 683--689.
81. Man-Ki Yoon, Bo Liu, Naira Hovakimyan, and Lui Sha. 2017. VirtualDrone: virtual sensing, actuation, and communication for attack-resilient unmanned aerial systems. In Proceedings of the 8th International Conference on Cyber-Physical Systems. ACM, 143--154.
82. Man-Ki Yoon, Sibin Mohan, Jaesik Choi, Jung-Eun Kim, and Lui Sha. 2013. SecureCore: A multicore-based intrusion detection architecture for real-time embedded systems. In Real-Time and Embedded Technology and Applications Symposium (RTAS), 2013 IEEE 19th. IEEE, 21--32.
83. Feng Zhu and Jinpeng Wei. 2014. Static analysis based invariant detection for commodity operating systems. Computers & Security 43 (2014), 49--63.
84. Christopher Zimmer, Balasubramanya Bhat, Frank Mueller, and Sibin Mohan. 2010. Time-based intrusion detection in cyber-physical systems. In Proceedings of the 1st ACM/IEEE International Conference on Cyber-Physical Systems. ACM, 109--118.

Index Terms

• Computer systems organization

  • Embedded and cyber-physical systems

    • Robotics

      • Robotic control

        • Evolutionary robotics

• Security and privacy

  • Security in hardware

    • Embedded systems security