Exploiting Physical Dynamics to Detect Actuator and Sensor Attacks in Mobile Robots

Mobile robots are cyber-physical systems where the cyberspace and the physical world are strongly coupled. Attacks against mobile robots can transcend cyber defenses and escalate into disastrous consequences in the physical world. In this paper, we focus on the detection of active attacks that are capable of directly influencing robot mission operation. Through leveraging physical dynamics of mobile robots, we develop RIDS, a novel robot intrusion detection system that can detect actuator attacks as well as sensor attacks for nonlinear mobile robots subject to stochastic noises. We implement and evaluate a RIDS on Khepera mobile robot against concrete attack scenarios via various attack channels including signal interference, sensor spoofing, logic bomb, and physical damage. Evaluation of 20 experiments shows that the averages of false positive rates and false negative rates are both below 1%. Average detection delay for each attack remains within 0.40s.

[1]  Chen Yan.  Can You Trust Autonomous Vehicles : Contactless Attacks against Sensors of Self-driving Vehicle , 2016 .

[2]  Miguel Oom Temudo de Castro,et al.  Practical Byzantine fault tolerance , 1999, OSDI '99.

[3]  J. A. Roecker,et al.  Comparison of two-sensor tracking methods based on state vector fusion and measurement fusion , 1988 .

[4]  S. Sitharama Iyengar,et al.  Distributed Bayesian algorithms for fault-tolerant event region detection in wireless sensor networks , 2004, IEEE Transactions on Computers.

[5]  Insup Lee,et al.  Attack resilient state estimation for autonomous robotic systems , 2014, 2014 IEEE/RSJ International Conference on Intelligent Robots and Systems.

[6]  Mohamed Darouach,et al.  Unbiased minimum variance estimation for systems with unknown exogenous inputs , 1997, Autom..

[7]  Emilio Frazzoli,et al.  Resilient state estimation against switching attacks on stochastic cyber-physical systems , 2015, 2015 54th IEEE Conference on Decision and Control (CDC).

[8]  Paulo Tabuada,et al.  Secure Estimation and Control for Cyber-Physical Systems Under Adversarial Attacks , 2012, IEEE Transactions on Automatic Control.

[9]  N. Aouf,et al.  Robust INS/GPS Sensor Fusion for UAV Localization Using SDRE Nonlinear Filtering , 2010, IEEE Sensors Journal.

[10]  Florian Dörfler,et al.  Attack Detection and Identification in Cyber-Physical Systems -- Part II: Centralized and Distributed Monitor Design , 2012, ArXiv.

[11]  Anita M. Flynn,et al.  Redundant Sensors for Mobile Robot Navigation , 1985 .

[12]  Mani Srivastava,et al.  PyCRA: Physical Challenge-Response Authentication For Active Sensors Under Spoofing Attacks , 2015, CCS.

[13]  R. Patton,et al.  Optimal filtering for systems with unknown inputs , 1998, IEEE Trans. Autom. Control..

[14]  Luke Fletcher,et al.  A perception-driven autonomous urban vehicle , 2008 .

[15]  Vijay Kumar,et al.  Opportunities and challenges with autonomous micro aerial vehicles , 2012, Int. J. Robotics Res..

[16]  Donghua Zhou,et al.  Unbiased minimum-variance state estimation for linear systems with unknown input , 2009, Autom..

[17]  Todd Litman,et al.  Autonomous Vehicle Implementation Predictions: Implications for Transport Planning , 2015 .

[18]  Yongdae Kim,et al.  Rocking Drones with Intentional Sound Noise on Gyroscopic Sensors , 2015, USENIX Security Symposium.

[19]  William Whittaker,et al.  Tartan Racing: A multi-modal approach to the DARPA Urban Challenge , 2007 .

[20]  Marco Di Natale,et al.  Understanding and using the Controller Area Network , 2008 .

[21]  Barak A. Pearlmutter,et al.  Detecting intrusions using system calls: alternative data models , 1999, Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344).

[22]  Emilio Frazzoli,et al.  A unified filter for simultaneous input and state estimation of linear discrete-time stochastic systems , 2013, Autom..

[23]  Insup Lee,et al.  Sensor attack detection in the presence of transient faults , 2015, ICCPS.

[24]  Giuseppe De Nicolao,et al.  Nonparametric input estimation in physiological systems: Problems, methods, and case studies , 1997, Autom..

[25]  A. Willsky,et al.  Analytical redundancy and the design of robust failure detection systems , 1984 .

[26]  Sauro Longhi,et al.  Development and experimental validation of an adaptive extended Kalman filter for the localization of mobile robots , 1999, IEEE Trans. Robotics Autom..

[27]  Emanuele Garone,et al.  False data injection attacks against state estimation in wireless sensor networks , 2010, 49th IEEE Conference on Decision and Control (CDC).

[28]  Peng Liu,et al.  Attack-resilient estimation of switched nonlinear cyber-physical systems , 2016, 2017 American Control Conference (ACC).

[29]  Jie Wu,et al.  PVFS: A Probabilistic Voting-based Filtering Scheme in Wireless Sensor Networks , 2008, Int. J. Secur. Networks.

[30]  Inseok Hwang,et al.  Robust estimation and fault detection and isolation algorithms for stochastic linear hybrid systems with unknown fault input , 2011 .

[31]  Emilio Frazzoli,et al.  Simultaneous mode, input and state estimation for switched linear stochastic systems , 2016, International Journal of Robust and Nonlinear Control.

[32]  Hugh F. Durrant-Whyte,et al.  Simultaneous localization and mapping: part I , 2006, IEEE Robotics & Automation Magazine.

[33]  Paulo Tabuada,et al.  Attack-resilient state estimation in the presence of noise , 2015, 2015 54th IEEE Conference on Decision and Control (CDC).

[34]  Emilio Frazzoli,et al.  Sampling-based algorithms for optimal motion planning , 2011, Int. J. Robotics Res..

[35]  Petar M. Djuric,et al.  Gaussian particle filtering , 2003, IEEE Trans. Signal Process..

[36]  M. Morari,et al.  Internal model control: PID controller design , 1986 .

[37]  Vinay A. Bavdekar,et al.  Identification of process and measurement noise covariance for state and parameter estimation using extended Kalman filter , 2011 .

[38]  Yuxin Ding,et al.  Host-based intrusion detection using dynamic and static behavioral models , 2003, Pattern Recognit..

[39]  Jonathan Petit,et al.  Remote Attacks on Automated Vehicles Sensors : Experiments on Camera and LiDAR , 2015 .

[40]  Todd E. Humphreys,et al.  Civilian GPS Spoofing Detection based on Dual- Receiver Correlation of Military Signals , 2011 .

[41]  Kai Goebel,et al.  A knowledge-based system approach for sensor fault modeling, detection and mitigation , 2012, Expert Syst. Appl..

[42]  Ali H. Sayed,et al.  Linear Estimation (Information and System Sciences Series) , 2000 .

[43]  T. Humphreys,et al.  Assessing the Spoofing Threat: Development of a Portable GPS Civilian Spoofer , 2008 .

[44]  Rodrigo Maximiano Antunes de Almeida,et al.  Microkernel Development for Embedded Systems , 2013 .

[45]  Peter K. Kitanidis,et al.  Unbiased minimum-variance linear state estimation , 1987, Autom..

[46]  Martin Roesch,et al.  Snort - Lightweight Intrusion Detection for Networks , 1999 .

[47]  Srdjan Capkun,et al.  On the requirements for successful GPS spoofing attacks , 2011, CCS '11.

[48]  Hovav Shacham,et al.  Comprehensive Experimental Analyses of Automotive Attack Surfaces , 2011, USENIX Security Symposium.

[49]  Gernot Heiser,et al.  High-performance microkernels and virtualisation on ARM and segmented architectures , 2007 .

[50]  Vern Paxson,et al.  Bro: a system for detecting network intruders in real-time , 1998, Comput. Networks.

[51]  Berk Sunar,et al.  An Emerging Threat: Eve Meets a Robot - (Work-in-Progress) , 2010, INTRUST.

[52]  Jie Chen,et al.  Design of unknown input observers and robust fault detection filters , 1996 .

[53]  Matti Valovirta,et al.  Experimental Security Analysis of a Modern Automobile , 2011 .

[54]  A. Jazwinski.  Stochastic Processes and Filtering Theory , 1970 .

[55]  Todd E. Humphreys,et al.  Receiver-Autonomous Spoofing Detection: Experimental Results of a Multi-Antenna Receiver Defense against a Portable Civil GPS Spoofer , 2009 .