Cyber-Physical Security and Safety of Autonomous Connected Vehicles: Optimal Control Meets Multi-Armed Bandit Learning

TL;DR

This paper develops a comprehensive cyber-physical security framework for autonomous connected vehicles, combining optimal control and multi-armed bandit learning to enhance safety and attack resilience.

Contribution

It introduces a robust optimal safe controller and novel DIA detection methods, including a multi-armed bandit algorithm, to improve ACV security against cyber and physical attacks.

Findings

The proposed controller outperforms existing controllers in robustness.

DIA detection approaches improve sensor security over Kalman filtering.

Simulation results confirm enhanced physical robustness of ACVs.

Abstract

Autonomous connected vehicles (ACVs) rely on intra-vehicle sensors such as camera and radar as well as inter-vehicle communication to operate effectively. This reliance on cyber components exposes ACVs to cyber and physical attacks in which an adversary can manipulate sensor readings and physically take control of an ACV. In this paper, a comprehensive framework is proposed to thwart cyber and physical attacks on ACV networks. First, an optimal safe controller for ACVs is derived to maximize the street traffic flow while minimizing the risk of accidents by optimizing ACV speed and inter-ACV spacing. It is proven that the proposed controller is robust to physical attacks which aim at making ACV systems instable. To improve the cyber-physical security of ACV systems, next, data injection attack (DIA) detection approaches are proposed to address cyber attacks on sensors and their physical impact on the ACV system. To comprehensively design the DIA detection approaches, ACV sensors are characterized in two subsets based on the availability of a-priori information about their data. For sensors having a prior information, a DIA detection approach is proposed and an optimal threshold level is derived for the difference between the actual and estimated values of sensors data which enables ACV to stay robust against cyber attacks. For sensors having no prior information, a novel multi-armed bandit (MAB) algorithm is proposed to enable ACV to securely control its motion. Simulation results show that the proposed optimal safe controller outperforms current state of the art controllers by maximizing the robustness of ACVs to physical attacks. The results also show that the proposed DIA detection approaches, compared to Kalman filtering, can improve the security of ACV sensors against cyber attacks and ultimately improve the physical robustness of an ACV system.

Equations

$$v_f(t+1)=v_f(t)+T{u}_f(t),d(t+1)=d(t)+T{v}_l(t)-T{v}_f(t),$$

$$\mathbf{x}(t+1)=\mathbf{A}\mathbf{x}(t)+\mathbf{B}{u}_f(t)+\mathbf{F}{v}_l(t),$$

$$\displaystyle\scriptstyle\boldsymbol{x}(t)=\left[\begin{array}[]{c}v_{f}(t)\\ d(t)\end{array}\right],\,\,\boldsymbol{A}=\left[\begin{array}[]{c c}1&0\\ -T&1\end{array}\right],\,\,\boldsymbol{B}=\left[\begin{array}[]{c}T\\ 0\end{array}\right],\,\,\boldsymbol{F}=\left[\begin{array}[]{c}0\\ T\end{array}\right].$$

$$\displaystyle\scriptstyle\boldsymbol{C}=\left[\begin{array}[]{c c}\begin{array}[]{c}T\\ 0\end{array}&\left[\begin{array}[]{c c}1&0\\ -T&1\end{array}\right].\left[\begin{array}[]{c}T\\ 0\end{array}\right]\end{array}\right]=\left[\begin{array}[]{c c}T&T\\ 0&-T^{2}\end{array}\right].$$

$${\mathbf{z}}_f(t)={\mathbf{h}}_f{v}_f(t)+{\mathbf{e}}_f(t),{\mathbf{z}}_l(t)={\mathbf{h}}_l{v}_l(t)+{\mathbf{e}}_l(t),{\mathbf{z}}_d(t)={\mathbf{h}}_{d}d(t)+{\mathbf{e}}_d(t),$$

$$J_f({\hat{v}}_f(t))$$

$$J_l({\hat{v}}_d(t))$$

$$J_d(\hat{d}(t))$$

$${\hat{v}}_f(t)$$

$${\hat{v}}_l(t)$$

$$\hat{d}(t)$$

$$\displaystyle\boldsymbol{z}(t)=\boldsymbol{H}\boldsymbol{x}(t)+\boldsymbol{e}(t),\text{s.t. }\boldsymbol{H}=\left[\begin{array}[]{c c}\boldsymbol{h}_{f}&\boldsymbol{0}_{n_{f}\times 1}\\ \boldsymbol{0}_{n_{d}\times 1}&\boldsymbol{h}_{d}\end{array}\right],\boldsymbol{z}(t)=\left[\begin{array}[]{c}\boldsymbol{z}_{f}(t)\\ \boldsymbol{z}_{d}(t)\end{array}\right],\boldsymbol{e}(t)=\left[\begin{array}[]{c}\boldsymbol{e}_{f}(t)\\ \boldsymbol{e}_{d}(t)\end{array}\right].$$

$$\underset{\text{estimation}}{\underbrace{\hat{\mathbf{x}}(t)}}=\underset{\text{a priori estimation}}{\underbrace{{\hat{\mathbf{x}}}^{(-)}(t)}}+\underset{\text{correction}}{\underbrace{\mathbf{K}(t)\stackrel{\text{residual}}{\overbrace{\left[\mathbf{z}(t)-\mathbf{H}{\hat{\mathbf{x}}}^{(-)}(t)\right]}}}},$$

$${\hat{\mathbf{x}}}^{(-)}(t)$$

$${\mathbf{P}}^{(-)}(t)$$

$$\mathbf{K}(t)$$

$$\hat{\mathbf{x}}(t)$$

$$\mathbf{P}(t)$$

$$\underset{\text{Kinetic Energy}}{\underbrace{\frac{m_f}{2}(v_f^2(t)-0)}}=\underset{\text{Potential Energy}}{\underbrace{m_f{b}_{f}d(t)}}\Rightarrow o(v_f(t))=\frac{v_f^2(t)}{2b_f}.$$

$$R(t)$$

$$={\left(\frac{(v_f(t)+T{u}_f(t){)}^2}{2b_f}-d(t)-T{v}_l(t)+T{v}_f(t)\right)}^2$$

$$\hat{R}(t)$$

$$u_f^{\ast }(t)$$

$$u_f^{\text{min}}\le u_f(t)\le u_f^{\text{max}},$$

$$0\le v_f(t+1)\le \tilde{v},$$

$$|u_f(t)-u_f(t-1)|\le \Delta u,$$

$$\displaystyle u_{f}^{*}(t)=\min\left\{\max\left\{\underline{$u$}_{1}(t),\frac{1}{T}\left(\sqrt{2b_{f}\left(\hat{d}(t)+T\hat{v}_{l}(t)-T\hat{v}_{f}(t)\right)}-\hat{v}_{f}(t)\right)\right\},\overline{u}_{1}(t)\right\}$$

$$u_f^{\ast }(t)$$

$${\mathcal{R}}^{\prime }(t,N)$$

$$=\sum _{\tau =t}^{t+N-1}\left[{\gamma }^{\tau -t}\hat{R}(\tau )+{\mathbf{\lambda }}^T(\tau +1)\left[\mathbf{g}(\tau )-\hat{\mathbf{x}}(\tau +1)\right]\right],$$

$${\mathcal{R}}^{\prime }(t,N)$$

$$d{\mathcal{R}}^{\prime }(t,N)$$

$$+\sum _{\tau =t}^{t+N-1}{\left({\nabla }_{\mathbf{u}(\tau )}\mathcal{H}(\tau )\right)}^{T}d\mathbf{u}(\tau )+\sum _{\tau =t+1}^{t+N}{\left({\nabla }_{\mathbf{\lambda }(\tau )}\mathcal{H}(\tau -1)-\hat{\mathbf{x}}(\tau )\right)}^{T}d\mathbf{\lambda }(\tau ).$$

$$\mathbf{\lambda }(t+N)=0,$$

$${\nabla }_{\hat{\mathbf{x}}(t)}\mathcal{H}(t)=0,\Rightarrow \hat{\mathbf{x}}(t)={\left[{\hat{v}}_f(t),\hat{d}(t)\right]}^T,$$

$$\mathbf{\lambda }(\tau )={\nabla }_{\hat{\mathbf{x}}(\tau )}\mathcal{H}(\tau )={\nabla }_{\hat{\mathbf{x}}(\tau )}{\gamma }^{t-\tau }\hat{R}(\tau )+{\nabla }_{\hat{\mathbf{x}}(\tau )}\mathbf{g}(\tau )\mathbf{\lambda }(t+1),$$

$$0={\nabla }_{\mathbf{u}(\tau )}\mathcal{H}(\tau )={\nabla }_{\mathbf{u}(\tau )}{\gamma }^{t-\tau }\hat{R}(\tau )+{\nabla }_{\mathbf{u}(\tau )}\mathbf{g}(\tau )\mathbf{\lambda }(t+1),$$

$${\nabla }_{\mathbf{\lambda }(\tau +1)}\mathcal{H}(\tau )=\hat{\mathbf{x}}(\tau +1)\Rightarrow \hat{\mathbf{x}}(\tau +1)=\mathbf{g}(\tau ),$$

$$\displaystyle{\textstyle\boldsymbol{\lambda}(\tau)=\left[\begin{array}[]{c}\frac{\hat{v}_{f}(\tau)+Tu_{f}(\tau)}{b_{f}}+T\\ -1\end{array}\right]\gamma^{t-\tau}\left(\frac{(\hat{v}_{f}(\tau)+Tu_{f}(\tau))^{2}}{2b_{f}}-\hat{d}(\tau)-T\hat{v}_{l}(\tau)+T\hat{v}_{f}(\tau)\right)+\boldsymbol{A}^{T}\boldsymbol{\lambda}(\tau+1).}$$

Full text

I Introduction

Intelligent transportation systems (ITS) will encompass autonomous connected vehicles (ACVs), roadside smart sensors (RSSs), vehicular communications, and even drones [1, 2, 3, 4]. To operate autonomously in future ITS, ACVs must process a large volume of data collected via sensors and communication links. Maintaining reliability of this data is crucial for road safety and smooth traffic flow [5, 6, 7, 8]. However, this reliance on communications and data processing renders ACVs highly susceptible to cyber-physical attacks. In particular, an attacker can possibly interject the ACV data processing stage, inject faulty data, and ultimately induce accidents or compromise the road traffic flow[9]. As demonstrated in a real-world experiment on a Jeep Cherokee in [10], ACVs are largely vulnerable to cyber attacks that can control their critical systems, including braking and acceleration. Naturally, by taking control of ACVs, an adversary can not only impact the compromised ACV, but it can also reduce the flow of other vehicles and cause a non-optimal ITS operation. This, in turn, motivates a holistic study for joint cyber and physical impacts of attacks on ACV systems.

Recently, a number of security solutions have been proposed for addressing intra-vehicle network and vehicular communication cyber security problems [11, 12, 13, 14, 15, 16, 17, 18, 19]. In [11], the authors showed that long-range wireless attacks on the current security protocols of ACVs can disrupt their controller area network (CAN). Furthermore, the work in [12], proposed a data analytics approach for the intrusion detection problem by applying a hidden Markov model. In [13], the security vulnerabilities of current vehicular communication architectures are identified. The work in [14] proposed the use of multi-source filters to secure a vehicular network against data injection attacks (DIAs). Furthermore, the authors in [15] introduced a new framework to improve the trustworthiness of beacons by combining two physical measurements (angle of arrival and Doppler effect) from received wireless signals. In [16], the authors designed a multi-antenna technique for improving the physical layer security of vehicular millimeter-wave communications. Moreover, in [17], the authors proposed a collaborative control strategy for vehicular platooning to address spoofing and denial of service attacks. The work in [18] developed a deep learning algorithm for authenticating sensor signals. Finally, an overview of current research on advanced intra-vehicle networks and the smart components of ITS is presented in [19].

In addition to cyber security in ITSs, physical safety and optimal control of ACVs have been studied in [20, 21, 22, 23, 24, 25, 26]. In [20], the authors identified the key vulnerabilities of a vehicle’s controller and secured them using intrusion detection algorithms. The work in [21] analyzed the ACVs as cyber-physical systems and developed an optimal controller for their motion. The authors in [22] studied the safe operation of ACV networks in presence of an adversary that tries to estimate the dynamics of ACVs by its own observations. The authors in [23] proposed centralized and decentralized safe cruise control approaches for ACV platoons. A learning-based approach is proposed in [24] to control the velocity of ACVs. Furthermore, in [25], the authors have proposed a robust deep reinforcement learning (RL) algorithm which mitigates cyber attacks on ACV sensors and maintains the safety of ACV system. In [26], the authors studied the essence of secure and safe codesign for ACV systems.

However, despite their importance, the architecture and solutions in [11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26] do not take into account the interdependence between the cyber and physical layers of ACVs while designing their security solutions. Moreover, the prior art in [11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26], does not provide solutions that can enhance the robustness of ACV motion control to malicious attacks. Nevertheless, designing an optimal and safe ITS requires robustness to attacks on intra-vehicle sensors as well as inter-vehicle communication. In addition, these existing works do not properly model the attacker’s action space and goal (physical disruption in ITS) while providing their security solutions. In this context, the cyber-physical interdependence of the attacker’s actions and goals will help providing better security solutions. Finally, the existing literature lacks a fundamental analysis of physical attacks as in the Jeep hijacking scenario[10] in which the attacker aims at disrupting the ITS operation by causing non-optimality in a compromised ACV’s speed.

The main contribution of this paper is, thus, a comprehensive study of joint cyber-physical security challenges and solutions in ACV networks which can be summarized as follows:

• •

To address both safety and optimality of an ACV system, first an optimal safe controller is proposed so as to maximize the traffic flow and minimize the risk of accidents by optimizing the speed and spacing of ACVs. To the best of our knowledge, this work will be the first to analyze the physical attack on a ACV network and to prove that the proposed controller can maximize the stability and robustness of ACV systems against physical attacks such as in the Jeep hijacking scenario [10].

• •

To improve the cyber-physical security study of ACV systems, next, new DIA detection approaches are proposed to address cyber attacks on ACV sensors and to analyze the physical impact of DIAs on an ACV system. To efficiently design the DIA detection approaches, ACV sensors are characterized in two subsets based on the availability of a priori information about their readings.

• •

For the first subset of sensors which have a priori information, a DIA detection approach is proposed derive an optimal threshold level for sensor errors which enables ACV to detect DIAs. For the second subset of sensors that lack a priori information, a novel multi-armed bandit (MAB) algorithm is proposed to learn which sensors are attacked. The proposed MAB algorithm uses the so-called Mahalanobis distance between the sensor data and an a-posteriori prediction to calculate a regret value and optimize the ACV’s sensor fusion process by applying an upper confidence bound (UCB) algorithm. The proposed detection approaches maximize both the cyber security and physical robustness of ACV systems against DIAs.

Simulation results show that the proposed optimal safe controller has higher safety, optimality, and robustness against physical attacks compared to other state-of-the-art approaches. In addition, our results show that the proposed DIA detection approaches yield an improved performance compared to Kalman filtering in mitigating the cyber attacks. Therefore, the proposed solutions improve the stability of ACV networks against DIAs.

The rest of the paper is organized as follows. Section II introduces our system model while Section III derives the optimal safe controller. Section IV proves that the proposed optimal safe controller is robust against physical attacks. Section V proposes approaches to mitigate cyber attacks on ACV while reducing the risk of accidents. Finally, simulation results are shown in Section VI and conclusions are drawn in Section VII.

II System Model

II-A ACV Physical Model

Consider an ACV, $f$, that follows a leading ACV, $l$ and tries to maintain a spacing from ACV $l$ as shown in Fig. 1. Maintaining a spacing between ACVs is important to maximize the traffic flow and minimize the risk of accidents[9]. Let $v_{f}$ be ACV $f$’s speed in m/s. Then, ACV $f$’s speed deviation can be written as $\dot{v}_{f}(t)=\frac{F_{f}(t)}{m_{f}}\triangleq u_{f}(t),$ where $F_{f}(t)$ is $f$’s engine force in Newtons (N), $m_{f}$ is $f$’s mass in kilograms (kg), and $u_{f}(t)$ is $f$’s physical controller input in N/kg . Moreover, letting $v_{l}$ be $l$’s speed, the spacing $d(t)$ between $f$ and $l$ can be written as $\dot{d}(t)=v_{l}(t)-v_{f}(t).$ Note that this model can be easily generalized to multiple ACVs by repeating the same set of equations for every pair of ACVs to capture any ACV network as shown in Fig. 1.

Due to discrete time sensor readings in ACVs, we convert the aforementioned continuous system model to a discrete one using a linear transformation as follows[27]:

[TABLE]

where $T$ is the sampling period of the sensors in seconds. The model can be summarized as:

[TABLE]

where

[TABLE]

To validate the practicality of the proposed system model, we need to show that $u_{f}(t)$ can control the speed and spacing of $f$ , i.e., $u_{f}$ can take state vector $\boldsymbol{x}(t_{0})$ to any desired state $\boldsymbol{x}(t_{1})$. The following remark shows that $u_{f}$ can control system (2).

Remark 1**.**

If $T>0$, then the system in (2) is controllable. To illustrate the reason, we know that the system (2) is controllable if the rank of controllability matrix \boldsymbol{C}=\left[\begin{array}[]{c c}\boldsymbol{B}&\boldsymbol{A}\boldsymbol{B}\end{array}\right] is 2 (number of state variables)[27]. Thus, we have:

[TABLE]

Therefore, for any $T>0$ the columns of $\boldsymbol{C}$ are linearly independent which implies that the rank of $\boldsymbol{C}$ will be $2$.

II-B ACV cyber model

In order to navigate, as shown in Fig. 1, ACV $f$ relies on $n_{f}$, $n_{l}$, and $n_{d}$ sensors which measure $v_{f}(t)$, $d(t)$, and $v_{l}(t)$, respectively. For instance, multiple intra-vehicle inertial measurement units (IMUs) measure $v_{f}(t)$, multiple cameras, radars, and LiDAR can measure $d(t)$, and roadside sensors and ACV $l$ measure $v_{l}(t)$ and transmit the measurements to ACV $f$ using vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication links. Thus, we model the sensor readings as follows:

[TABLE]

where $\boldsymbol{z}_{f}(t)$, $\boldsymbol{z}_{l}(t)$, and $\boldsymbol{z}_{d}(t)$ are sensor vectors with $n_{f}$, $n_{l}$, and $n_{d}$ elements which measure $v_{f}(t)$, $v_{l}(t)$, and $d(t)$, respectively. Also, $\boldsymbol{h}_{f}$, $\boldsymbol{h}_{l}$, and $\boldsymbol{h}_{d}$ are vectors with $n_{f}$, $n_{l}$, and $n_{d}$ elements equal to $1$. Moreover as assumed in [27] and [28], $\boldsymbol{e}_{f}(t)$, $\boldsymbol{e}_{l}(t)$, and $\boldsymbol{e}_{d}(t)$ are noise vectors that follow a white Gaussian distribution with zero mean and variance vectors $\boldsymbol{\sigma}_{f}^{2}=\left[\sigma^{2}_{f_{1}},\dots,\sigma^{2}_{f_{n_{f}}}\right]^{T}$, $\boldsymbol{\sigma}_{l}^{2}=\left[\sigma^{2}_{l_{1}},\dots,\sigma^{2}_{l_{n_{l}}}\right]^{T}$, and $\boldsymbol{\sigma}_{d}^{2}=\left[\sigma^{2}_{d_{1}},\dots,\sigma^{2}_{d_{n_{d}}}\right]^{T}$. Since the sensor readings in (22) are noisy, we need to optimally estimate $v_{f}(t)$, $v_{l}(t)$ and $d(t)$ from $\boldsymbol{z}_{f}(t)$, $\boldsymbol{z}_{l}(t)$, and $\boldsymbol{z}_{d}(t)$ by minimizing the estimation error. To find the optimal estimations $\hat{v}_{f}(t)$, $\hat{v}_{l}(t)$, and $\hat{d}(t)$ (the estimations of $v_{f}(t)$, $v_{l}(t),$ and $d(t)$), we use two types of estimators. A static estimator to estimate the variables at the initial state, $t_{0}$, (the time step that $f$ starts following $l$) and a dynamic estimator to estimate $\hat{v}_{f}(t)$ and $\hat{d}(t)$ using the state equations in (1). We use a static estimator at the initial state because ACV $f$ does not follow the speed of ACV $l$ using (1) before $t_{0}$ and, hence, a dynamic estimator cannot be used due to lack of information about the dynamics of $f$ before $t_{0}$. Moreover, for $\hat{v}_{l}(t)$, we always use a static estimator since we do not have any information on the dynamics of $v_{l}(t)$.

For the static estimator, we define a least-square (LS) cost function for each variable as follows:

[TABLE]

where $\boldsymbol{R}_{f},\boldsymbol{R}_{l}$, and $\boldsymbol{R}_{d}$ are the measurement covariance matrices associated with sensors measure $v_{f}(t)$, $v_{l}(t)$, and $d(t)$, respectively. Moreover, since the sensors independently measuring the three variables, they will not have any noise covariance and $\boldsymbol{R}_{f},\boldsymbol{R}_{l}$, and $\boldsymbol{R}_{d}$ will be diagonal. Therefore, explicit solution for the optimal estimation can be derived as:

[TABLE]

For the dynamic estimator, we use a Kalman filter which uses the state equation in the estimation process. To this end, we define an output equation as follows:

[TABLE]

Note that we cannot apply the dynamic estimator on $\hat{v}_{l}(t)$ since we do not have a-priori information about the dynamics of $l$. To dynamically estimate $\hat{d}(t)$ and $\hat{v}_{f}(t)$, we use an a priori estimation derived from the state equations as well as a weighted residual of output error to correct the a priori estimation as follows[29]:

[TABLE]

where $\boldsymbol{K}(t)$ is the Kalman gain. By defining an a posteriori error covariance matrix $\boldsymbol{P}(t)=\operatorname*{\mathbb{E}}\left[\boldsymbol{r}(t)\boldsymbol{r}^{T}(t)\right]$, where $\boldsymbol{r}(t)=\boldsymbol{x}(t)-\hat{\boldsymbol{x}}(t)$, we can find a $\boldsymbol{K}(t)$ to minimize $\text{trace}\left[\boldsymbol{P}(t)\right]=\operatorname*{\mathbb{E}}\left[\boldsymbol{r}^{T}(t)\boldsymbol{r}(t)\right]$. The solution for such $\boldsymbol{K}(t)$ can be given by[29]:

[TABLE]

where \boldsymbol{R}=\left[\begin{array}[]{c c}\boldsymbol{R}_{f}&\boldsymbol{0}_{n_{f}\times n_{d}}\\ \boldsymbol{0}_{n_{d}\times n_{f}}&\boldsymbol{R}_{d}\end{array}\right]is a block diagonal matrix. As can be seen from (38), (39), and (41), the update processes for $\boldsymbol{P}(t)$ and $\boldsymbol{K}(t)$ are independent of the states and controller. Thus, $\boldsymbol{P}(t)$ and $\boldsymbol{K}(t)$ will converge to constant matrices, $\tilde{\boldsymbol{P}}$ and $\tilde{\boldsymbol{K}}$.

For the studied system, we now define the cyber-physical security problems for ACV systems that we will study next. We will address three main problems: 1) What is the optimal safe ACV controller for the system in (2) that minimizes the risk of accidents while maximizing the traffic flow on the roads? 2) Is the proposed optimal safe controller for ACV systems robust and stable against physical attacks? and 3) How to securely fuse the sensor readings to mitigate DIAs on ACVs and minimize the impact of such attacks on the control of ACVs? Addressing these problems is particularly important because the model in (2) identifies the microscopic characteristics of an ACV network and, thus, to achieve large-scale security and safety in ACV networks we must secure every ACV against cyber-physical attacks.

Addressing these three problem requires a comprehensive study of the interdependencies between the cyber and physical characteristics of ACV systems. Such interdependent cyber-physical study helps to find the vulnerabilities of the ACV systems against both cyber and physical attacks. Thus, we can derive an optimal controller that minimizes the risk of accidents and we can design cyber attack detection approaches that not only take into account the cyber characteristics of the ACV system, but also aims at minimizing the likelihood of collisions in ACV networks. Unlike the works in [11, 12, 13, 14, 15, 16, 17, 18, 19], we consider the physical characteristics of ACV systems while developing DIA detection approaches. Moreover, the combined optimal and safe ACV controller design has not been studied previously in [20, 21, 22, 23, 24, 25, 26].

III Optimal Safe ACV Controller

Our first task is thus to derive an optimal safe controller for ACV systems. To analyze ACV $f$’s optimal control input $u_{f}(t)$, we define an optimal safe spacing value as $o(v_{f}(t))\triangleq\frac{v_{f}^{2}(t)}{2b_{f}T}$, where $b_{f}$ is ACV $f$’s maximum braking deceleration. This value is defined so as to guarantee that if the leading ACV $l$ stops suddenly, the following ACV $f$ will stop completely before hitting ACV $l$ as long as $f$ starts braking immediately after observing $l$’s braking process. This can be captured by the following energy equivalence condition:

[TABLE]

Our goal here is to maintain an optimal safe spacing between ACVs $f$ and $l$. Thus, we define a physical regret $R(t)$ as the square of difference between the optimal safe spacing and the actual spacing. This regret quantifies the safety and optimality of ACV motion by preventing any collisions and minimizing the spacing between the ACVs and can be written as follows:

[TABLE]

In addition, each ACV only have access to estimation of $v_{f}(t)$, $v_{l}(t)$, and $d(t)$. Thus, ACV $f$ must design an input $u_{f}(t)$ to minimize an estimation of physical regret which is defined as follows:

[TABLE]

This problem is challenging to solve because $\hat{v}_{l}(t)$ is an independent parameter and ACV $f$ cannot be sure about the future values of $\hat{v}_{l}(t)$. To solve this problem, we consider two scenarios: a) ACV $f$ has no prediction about ACV $l$’s future speed values (One-step ahead controller) and b) ACV $f$ has a predictor which can predict ACV $l$’s future speed value for $N$ time steps ($N$-step ahead controller)(such predictors have attracted recent attention in the transportation literature, e.g., see [30] and [31]). Next, we propose an optimal controller for these two cases.

III-A One-step ahead controller

To solve the one-step ahead controller problem, we consider some physical limitations on the speed and the control input. We prohibit the speed from being greater than the free-flow speed of a road, $\tilde{v}$. Moreover, due to the physical capabilities of the vehicle and for maintaining passengers’ comfort, we must have a limitation on the control input and speed deviation. Thus, the optimization problem of the ACV $f$ can be written as follows:

[TABLE]

where $u_{f}^{\text{min}}<0$ and $u_{f}^{\text{max}}>0$ are the minimum and maximum allowable control input and $\Delta u$ is the maximum allowable change in the controller to yield a comfortable ride.

Theorem 1**.**

The one-step ahead optimal controller is:

[TABLE]

where \underline{u}_{1}(t)\triangleq\max\left\{\frac{-\hat{v}_{f}(t)}{T},u_{f}^{\text{min}},u_{f}(t-1)-\Delta u\right\} and \overline{u}_{1}(t)\triangleq\min\Big{\{}\frac{\tilde{v}-\hat{v}_{f}(t)}{T},u_{f}^{\text{max}},u_{f}(t-1)+\Delta u\Big{\}}.

Proof.

See Appendix -A. ∎

Theorem 1 derives the optimal controller for the ACV $f$ when it only optimizes its action for the next step without considering future actions. In the next subsection, we derive the ACV $f$’s optimal controller when it considers minimizing the regret for $N$ step ahead.

III-B $N$-step ahead controller

To find the $N$-step ahead controller, first we define a discount factor $0\leq\gamma\leq 1$ which specifies the level of future physical regret for the decision taken at each time step. Thus, by defining the $N$-step ahead total discounted physical regret $\mathcal{R}(t,N)\triangleq\sum_{\tau=t}^{t+N-1}\gamma^{\tau-t}\hat{R}(\tau),$ the controller optimization problem can be written as follows:

[TABLE]

where the conditions in (46), (47), and (48) hold true. Moreover $\boldsymbol{u}^{N}_{f}(t)=[u_{f}(t),\dots,u_{f}(t+N-1)]^{T}$, $N$ is the number of future steps which is taken into account in finding the optimal controller, and $u_{f}^{*}(t)$ is the optimal controller at time step $t$.

Theorem 2**.**

The solution of $N$-step ahead controller is equivalent to the one-step ahead controller.

Proof.

To solve the problem in (50), we use a so called indirect method. To this end, we start by defining an augmented physical regret using the following state equation:

[TABLE]

where $\boldsymbol{\lambda}(\tau)=\left[\lambda_{1}(\tau),\lambda_{2}(\tau)\right]^{T}$. Then, let Hamiltonian function defined as $\mathcal{H}(\tau)\triangleq\gamma^{\tau-t}\hat{R}(\tau)+\boldsymbol{\lambda}^{T}(\tau+1)\boldsymbol{g}(\tau)$. Thus, we can write (51) as follows:

[TABLE]

Thus, to find critical points (candidate minima) we must solve $\nabla\mathcal{R}^{\prime}(t,N)=0$. First, we start by finding the differential $d\mathcal{R}^{\prime}(t,N)$ and then we identify the derivatives as follows:

[TABLE]

Thus, to have $d\mathcal{R}^{\prime}(t)=0$ each of the terms in brackets must be equal to zero:

[TABLE]

Now, using (56) we will have:

[TABLE]

Moreover, from (57) we will have:

[TABLE]

Since $\boldsymbol{\lambda}(t+N)=0$, then from (62), we derive:

[TABLE]

By substituting $u_{f}(t+N-1)$ in (61), we obtain $\lambda(t+N-1)=0$. This process can continue until $\tau=t$ where we obtain $\boldsymbol{\lambda}(t+1)=0$ and u_{f}(t)=\frac{1}{T}\Bigg{[}\pm\sqrt{2b_{f}\left(\hat{d}(t)+T\hat{v}_{l}(t)-T\hat{v}_{f}(t)\right)}-\hat{v}_{f}(t)\Bigg{]}. Moreover, considering the constraints (46), (47), and (48), we will end up having the optimal controller as defined in Theorem 1. Thus, we prove that the $N$-step ahead optimal controller is equivalent to $1$-step ahead optimal controller. ∎

From Theorem 2, we can observe that, if the ACV $f$ minimizes its immediate physical regret, it will also minimize its long-term physical regret. This result shows that the proposed optimal safe controller does not require any information from future dynamics of ACV $l$ as done in [30] and [31].

IV Physical Attack on ACV systems

As derived in the previous section, the proposed optimal controller is a function of $\hat{{v}}_{l}(t)$. This makes ACV $f$ vulnerable against a physical attack on ACV $l$. Thus, we now analyze whether an attacker can cause instable dynamics at ACV $f$ by controlling $l$. Consider an adversary who takes the control of ACV $l$ and tries to cause instability in ACV $f$’s speed, $v_{f}(t)$, and spacing $d(t)$. Using our derived optimal controller, by ensuring $u_{f}(t)$ is not saturated (\underline{u}_{1}(t)\leq u_{f}(t)\leq\overline{u}_{1}(t)), and considering the estimated values to be close to the real values we will have:

[TABLE]

where $\boldsymbol{g}=\left[g_{1}(\boldsymbol{x}(t),v_{l}(t)),g_{2}(\boldsymbol{x}(t),v_{l}(t))\right]^{T}$. (64) is designed such that ACV $f$ will always maintain an optimal safe spacing with $l$. However, from (64) we can see that the behavior of the system is a function of $v_{l}$. Thus, next, we will analyze the physical attack scenario that is analogous to the Jeep hijacking case in[10].

IV-A Stability Analysis

To analyze the stability of (64), first, we define some useful concepts.

Definition 1**.**

[28]** $\bar{\boldsymbol{x}}(v_{l})$ is said to be an equilibrium point for the system in (64) and a constant input $v_{l}$, if $\boldsymbol{g}(\bar{\boldsymbol{x}}(v_{l}),v_{l})=\bar{\boldsymbol{x}}(v_{l})$.

An equilibrium indicates a point at which the states will not change. From Definition 1 we can derive the equilibrium point for (64) by considering a constant input $v_{l}$ and solving the following set of equations:

[TABLE]

which results in: $\bar{\boldsymbol{x}}(v_{l})=\left[v_{l},\frac{v_{l}}{2b_{f}}\right]^{T}.$ The derived value for $\bar{\boldsymbol{x}}(v_{l})$ shows that in order to reach an equilibrium, ACV $f$ must maintain the optimal safe spacing from ACV $l$ and its speed must equal to $v_{l}$. Thus, next, we show that our derived optimal controller is robust, i.e., under our controller if an adversary hijacks ACV $l$, it cannot cause instability in $v_{f}(t)$ and $d(t)$.

Definition 2**.**

A system is called asymptotically stable around its equilibrium point if it satisfies the following two conditions[28]: 1) Given any $v_{l}>0$ and $\varepsilon>0$, $\exists\delta_{1}>0$ such that if $|\boldsymbol{x}(t_{s})-\bar{\boldsymbol{x}}(v_{l})|$, then $|\boldsymbol{x}(t)-\bar{\boldsymbol{x}}(v_{l})|<\epsilon$, $\forall t>t_{s}$ and 2) $\exists\delta_{2}>0$ such that if $|x(t_{s})-\bar{\boldsymbol{x}}(v_{l})|<\delta_{2}$, then $\boldsymbol{x}(t)\rightarrow\bar{\boldsymbol{x}}(v_{l})$ as $t\rightarrow\infty$.

The first condition requires the state trajectory to be confined to an arbitrarily small “ball” centered at the equilibrium point and of radius $\varepsilon$, when released from an arbitrary initial condition in a ball of sufficiently small (but positive) radius $\delta_{1}$. This is called stability in the Lyapunov sense[28, 32]. It is possible to have Lyapunov stability without having asymptotic stability.

Next, we show how a Lyapunov function can help to analyze the stability of system (64)[28]. From [28], we know that if there exists a Lyapunov function for system (64), then $\boldsymbol{x}(t)=\bar{\boldsymbol{x}}(v_{l})$ is a stable equilibrium point in the sense of Lyapunov. In addition, if $L(\boldsymbol{g}(\boldsymbol{x}(t),v_{l}))-L(\boldsymbol{x}(t))<0$ then $\boldsymbol{x}(t)=\bar{\boldsymbol{x}}(v_{l})$ is an asymptotically stable equilibrium point. We can prove that the system in (64) is asymptotically stable for the equilibrium point $\bar{\boldsymbol{x}}(v_{l})$, as follows.

Proposition 1**.**

$\boldsymbol{x}(t)=\bar{\boldsymbol{x}}(v_{l})$* is a stable equilibrium point in the Lyapunov sense.*

Proof.

Let $L(\boldsymbol{x}(t))=\left(\frac{v_{f}^{2}(t)}{2b_{f}}-d(t)\right)^{2}$. Then we will have $L(\bar{\boldsymbol{x}}(v_{l}))=0$. Moreover, we can show that $L(\boldsymbol{x}(t))\geq 0,$ $\forall\boldsymbol{x}(t)$. Now, to check if $L$ is a Lyapunov function we have:

[TABLE]

Thus, $\boldsymbol{x}(t)=\bar{\boldsymbol{x}}(v_{l})$ is a stable equilibrium point in the sense of Lyapunov. ∎

From Proposition 1, we can see that, as long as $f$ follows $l$ using our proposed controller, its speed and spacing from $l$ will stay stable and will not be affected by the physical attack on $l$. This shows that, not only our proposed controller maximizes the safety and optimality in ITS roads, but also it is robust to physical attacks such as in the Jeep scenario [10].

However, as can be seen from Theorems 1 and 2, even though it is robust to physical attacks, the derived optimal controller is largely dependent on the estimated values $\hat{v}_{f}(t)$, $\hat{v}_{l}(t)$, and $\hat{d}$. Thus, an adversary can manipulate the sensor data to inject error in the estimation and ultimately increase the ACV $f$’s physical regret. Analyzing such attacks require a cyber-physical study of the ACV system to derive approaches that mitigate attacks on sensors and minimize the effect of such attacks on the physical regret. Thus, next, we analyze the cyber attack on the ACV system.

V Cyber Attack on ACV Systems

We now consider a cyber attacker that injects faulty data to sensor readings (cameras, LiDARs, radars, IMUs, and roadside sensors) such that the attacked sensor vector can be written as:

[TABLE]

where $\boldsymbol{a}_{f}(t)$, $\boldsymbol{a}_{d}(t)$, and $\boldsymbol{a}_{l}(t)$ are data injection vectors on sensors and $\bar{\boldsymbol{z}}_{f}(t)$, $\bar{\boldsymbol{z}}_{d}(t)$, and $\bar{\boldsymbol{z}}_{l}(t)$ are compromised sensor readings from $v_{f}(t)$, $d(t)$, and $v_{l}(t)$, respectively. As we discussed in the state estimation section, we have a-priory information about sensors which measure $v_{f}(t)$ or $d(t)$, but such information is lacking for sensors that collect data from $v_{l}(t)$. Thus, next, we consider cyber attacks on sensors a) with a-priori information and b) without a-priori information.

V-A Attack on sensors with a-priori information

As discussed in Subsection II-B, we use Kalman filtering to estimate $\hat{v}_{f}(t)$ and $\hat{d}(t)$. However, Kalman filtering is not robust to DIAs [33]. Thus, we propose a filtering mechanism that can limit the effect of the DIA on $\hat{v}_{f}(t)$ or $\hat{d}(t)$. To this end, we use the a priori estimation $\hat{\boldsymbol{x}}^{(-)}(t)$ at each time step to find an a priori sensor reading $\boldsymbol{z}^{(-)}(t)\triangleq\boldsymbol{H}\hat{\boldsymbol{x}}^{(-)}(t)$. Then, the attack detection filter checks the absolute value of the residual \left|\boldsymbol{\mu}(t)\right|\triangleq\Bigg{[}|\mu_{{f}_{1}}(t)|,\dots,|\mu_{{f}_{n_{f}}}(t)|,|\mu_{{d}_{1}}(t)|,\dots,|\mu_{{d}_{n_{d}}}(t)|\Bigg{]}^{T}\triangleq\left|{\boldsymbol{z}}(t)-\boldsymbol{z}^{(-)}(t)\right|<\boldsymbol{\eta}, where $\boldsymbol{\eta}$ is the threshold vector. Any sensor which violates this inequality will be considered as a compromised sensor and will not be involved in Kalman filter update procedure. To find an optimal value for the threshold $\boldsymbol{\eta}$, we next characterize the stochastic behavior of residual $\boldsymbol{\mu}(t)$ when the ACV is not under attack.

Theorem 3**.**

The residual $\boldsymbol{\mu}(t)$ follows a Gaussian distribution with zero mean and covariance matrix as follows:

[TABLE]

and $\boldsymbol{C}_{r}$ is the solution of following discrete Ricatti equation $\boldsymbol{C}_{r}=\boldsymbol{Q}\boldsymbol{A}\boldsymbol{C}_{r}\boldsymbol{A}^{T}\boldsymbol{Q}^{T}+\boldsymbol{C}_{\rho},$ where $\boldsymbol{C}_{\rho}=\boldsymbol{Q}\boldsymbol{F}\sigma^{2}_{l}\boldsymbol{F}^{T}\boldsymbol{Q}^{T}+\boldsymbol{Q}\tilde{\boldsymbol{K}}\boldsymbol{R}\tilde{\boldsymbol{K}}^{T}\boldsymbol{Q}^{T},$ and $\boldsymbol{Q}=\left[\boldsymbol{I}+\left[\boldsymbol{I}-\tilde{\boldsymbol{K}}\boldsymbol{H}\right]^{-1}\tilde{\boldsymbol{K}}\boldsymbol{H}\right]^{-1}.$

Proof.

See Appendix -B. ∎

Theorem 3 derives the distribution of $\boldsymbol{\mu}(t)$ which we will use next to find an optimal value for the threshold level $\boldsymbol{\eta}$. Fig. 2 and Fig. 3 show a comparison between simulation and analytical results derived for the mean and covariance matrix of $\boldsymbol{r}(t)$, $\rho(t)$, and $\mu(t)$. From Figs. 2 and 3 we can that the analytical results match the simulation results which validates Theorem 3.

We can now find the probability with which $\mu_{i}(t)$ (element $i$ of $\boldsymbol{\mu}(t)$) remains below the threshold value $\eta_{i}$ as $\text{Pr}\left(|\mu_{i}|\leq\eta_{i}\right)=\text{Pr}\left(-\eta_{i}\leq\mu_{i}\leq\eta_{i}\right)=\Phi_{\mu_{i}}(\eta_{i})-\Phi_{\mu_{i}}(-\eta_{i}),$ where $\Phi_{\mu_{i}}(.)$ is the cumulative density function of $\mu_{i}$ which follows a Gaussian distribution with zero mean and variance ${C}_{\mu}(i,i)$ (element in $i$-th row and $i$-th column of $\boldsymbol{C}_{\mu}$). Thus, we can derive the optimal value for $\boldsymbol{eta}$ by defining $\text{Pr}\left(|\mu_{i}|\leq\eta_{i}\right)$ for every sensor. For instance, choosing values $\eta_{i}={C}_{\mu}(i,i),2{C}_{\mu}(i,i),$ or $3{C}_{\mu}(i,i)$ will result in $\text{Pr}\left(|\mu_{i}|\leq\eta_{i}\right)=0.68,0.95,$ or $0.997$. Even by defining the threshold value, the attacker might stay stealthy in some cases if it controls the amount of injected data to the sensors. Next, we find a relationship between the maximum value of DIA and the probability of staying stealthy.

Proposition 2**.**

The probability with which an attack vector $\tilde{\boldsymbol{a}}\triangleq\left[\boldsymbol{a}_{f},\boldsymbol{a}_{d}\right]^{T}$ will not trigger the $i$-th element of attack detection filter, $\mu_{i}$, (stealthy attack) will be given by:

[TABLE]

where $\boldsymbol{\varPsi}_{i}$ is the $i$-th row of $\boldsymbol{\varPsi}=\left[\boldsymbol{I}-\boldsymbol{H}\left[\boldsymbol{I}-\boldsymbol{Q}\boldsymbol{A}\right]^{-1}\boldsymbol{Q}\tilde{\boldsymbol{K}}\right].$

Proof.

Suppose that the attacker initiates attack after the Kalman filter converges. Thus, from (37) and (40) we have:

[TABLE]

Thus, by simplifications analogous to the proof of Theorem 3, we can find $\boldsymbol{r}(t)=\boldsymbol{Q}\boldsymbol{A}\boldsymbol{r}(t-1)-\boldsymbol{Q}\tilde{\boldsymbol{K}}\tilde{\boldsymbol{a}}+\boldsymbol{\rho}(t)$. The expectation of $\boldsymbol{r}(t)$ will be $\operatorname*{\mathbb{E}}\left\{\boldsymbol{r}(t)\right\}=\boldsymbol{Q}\boldsymbol{A}\operatorname*{\mathbb{E}}\left\{\boldsymbol{r}(t-1)\right\}-\boldsymbol{Q}\tilde{\boldsymbol{K}}\operatorname*{\mathbb{E}}\left\{\tilde{\boldsymbol{a}}\right\}.$ Since the attack vector is constant, $\tilde{\boldsymbol{a}}$, and $\operatorname*{\mathbb{E}}\left\{\boldsymbol{r}(t)\right\}=\operatorname*{\mathbb{E}}\left\{\boldsymbol{r}(t-1)\right\}$ for $t\rightarrow\infty$ we will have the steady state expected estimation error as $\operatorname*{\mathbb{E}}\left\{\boldsymbol{r}(t)\right\}\triangleq\bar{\boldsymbol{r}}=-\left[\boldsymbol{I}-\boldsymbol{Q}\boldsymbol{A}\right]^{-1}\boldsymbol{Q}\tilde{\boldsymbol{K}}\tilde{\boldsymbol{a}}.$ Thus, considering such steady state expected estimation error, $\bar{\boldsymbol{r}}$, we can derive the mean of $\boldsymbol{\mu}(t)$:

[TABLE]

Since $\boldsymbol{a}_{d}$ is constant, then $\boldsymbol{\sigma}_{\mu}$ will not change. Therefore, we can find the probability of not triggering the attack detection filter for $\mu_{i}$ as in (79). ∎

Proposition 2 derives the probability of staying stealthy for any particular DIA vector. Next we will find how much our defined attack detection filter is robust against a particular DIA. To this end, first we define a stealthy attack probability vector as $\boldsymbol{p}({\tilde{\boldsymbol{a}}})=\left[p_{1}({\tilde{\boldsymbol{a}}}),\dots,p_{n_{f}+n_{d}}({\tilde{\boldsymbol{a}}})\right]^{T}$, which is a vector that shows the probability of staying stealthy by initiating $\tilde{\boldsymbol{a}}$ on all of the $v_{f}$ and $d$ type sensors. The attacker has to find the optimal value of $\tilde{\boldsymbol{a}}$ which maximizes the physical regret while staying stealthy with probability below a defined value, $\boldsymbol{p}$, i.e., attack vector must be chosen such that the physical regret is maximized and every sensor $i$ stays stealthy with the probability below the $i$-th element of $\boldsymbol{p}$.

Corollary 1**.**

The attacker’s optimal attack vector $\boldsymbol{a}^{*}$ which maximizes the steady state physical regret by attacking $v_{f}$ or $d$ type sensors is the solution of following optimization problem:

[TABLE]

where $\tilde{d}$ is the average spacing between the ACVs.

Proof.

From the definition of physical regret we have:

[TABLE]

Moreover, the steady state value of $\theta(t)$ can be derived by using the steady state expected value of $\bar{\boldsymbol{r}}$ as $\bar{\theta}=\bar{\boldsymbol{r}}^{T}\boldsymbol{\varTheta}\bar{\boldsymbol{r}}+\boldsymbol{c}^{T}\bar{\boldsymbol{r}}.$ Also, the attacker must choose $\boldsymbol{a}_{d}$ to satisfy (79). Thus, the attacker must solve the optimization problems in (84). ∎

Corollary 1 derives a robustness level for our proposed attack detection filter. It allows us to find the maximum regret which is caused by any stealthy attack vector. This allows us to design a secure cyber-physical ACV system since we take into account the physical regret of DIAs on sensors. However, the proposed attack detection filter works for sensors with a-priori information only. For ACV $f$’s other sensors which measure $v_{l}(t)$ we do not have a-priori information. Thus, we next address this case using MAB.

V-B Multi-armed bandit learning for attack detection in sensors without a-priori information

To detect the attack on $v_{l}$ type sensors, we cannot use any a priori estimation for $v_{l}(t)$ as done for $v_{f}$ and $d$ type sensors because ACV $f$ cannot have any information about evaluation of $v_{l}(t)$ since it does not know how ACV $l$ is being controlled. Such lack of a priori information makes the attack detection challenging. To overcome this challenge, we propose to use a MAB learning approach because such approach does not require a-priori information and finds the optimal action (detecting attacked sensors) only by interacting with the sensors and ACV’s dynamics. Before applying the MAB algorithm, we define an a posteriori estimation for $v_{l}(t)$:

[TABLE]

Here, we also define an a posteriori residual as \left|\boldsymbol{\mu}_{l}^{(+)}(t)\right|\triangleq\left[|\mu_{{l}_{1}}^{(+)}(t)|,\dots,|\mu_{{l}_{n_{l}}}^{(+)}(t)|\right]^{T}\triangleq\Big{|}\boldsymbol{h}_{l}v_{l}^{(+)}(t)-\boldsymbol{z}_{l}(t)\Big{|}. Next, we analyze the distribution of $\boldsymbol{\mu}_{l}^{(+)}(t)$ to use it to design an attack detection filter.

Theorem 4**.**

$\boldsymbol{\mu}_{l}^{(+)}(t)$* follows a Gaussian distribution with zero mean and covariance matrix $\boldsymbol{C}_{\mu_{l}}$:*

[TABLE]

where $\boldsymbol{\varUpsilon}=\left[-\frac{s_{1}}{T}\boldsymbol{h}_{l}\boldsymbol{w}_{l}^{T}-\boldsymbol{I}\right]$ and \boldsymbol{J}=\left[\begin{array}[]{c c}0&1\end{array}\right]\tilde{\boldsymbol{K}}.

Proof.

See Appendix -C. ∎

Theorem 4 derives the covariance matrix for $\boldsymbol{\mu}_{l}^{(+)}(t)$ which we will use to detect anomaly in the $v_{l}(t)$ type sensors. To this end, first, we define the squared Mahalanobis (SM) distance, a measure which quantifies the distance between the a posteriori residual of sensors in a subset $\mathcal{L}$ of $v_{l}$ type sensors, ${\boldsymbol{\mu}_{l}^{(+)}}(t,\mathcal{L})$, and the distribution of a posteriori residuals which is derived in Theorem 4. SM will help us find how much every subset $\mathcal{L}$ deviates from its distribution.

Definition 3**.**

The squared Mahalanobis distance between subset $\mathcal{L}$’s a posteriori residual at time $t$ and its distribution is defined as $D_{\mathcal{L}}(t)={\boldsymbol{\mu}_{l}^{(+)}}^{T}(t,\mathcal{L})\boldsymbol{C}^{-1}_{\mu_{l}}(\mathcal{L}){\boldsymbol{\mu}_{l}^{(+)}}(t,\mathcal{L}),$ where $D_{\mathcal{L}}(t)$ is the subset $\mathcal{L}$’s SM and $\boldsymbol{C}_{\mu_{l}}(\mathcal{L})$ is the covariance matrix associated with $\mathcal{L}$.

Next, we derive the expected value and variance of $D_{\mathcal{L}}(t)$. We know from [34, (378)] that $\operatorname*{\mathbb{E}}\left\{D_{\mathcal{L}}(t)\right\}=\operatorname*{\mathbb{E}}\left\{{\boldsymbol{\mu}_{l}^{(+)}}^{T}(t,\mathcal{L})\boldsymbol{C}^{-1}_{\mu_{l}}(\mathcal{L}){\boldsymbol{\mu}_{l}^{(+)}}(t,\mathcal{L})\right\}=\text{Tr}\left(\boldsymbol{C}^{-1}_{\mu_{l}}(\mathcal{L})\boldsymbol{C}_{\mu_{l}}(\mathcal{L})\right)=\text{Tr}\left(\boldsymbol{I}\right)=|\mathcal{L}|,$ where $|\mathcal{L}|$ is the number of sensors in $\mathcal{L}$. In addition, for a subset $\mathcal{L}$ of $v_{l}$ type sensors and an attack vector $\boldsymbol{a}_{l}(t)$, we will have:

[TABLE]

where $\boldsymbol{a}_{l}(t,\mathcal{L})$ consists of only elements of $\boldsymbol{a}_{l}(t)$ which are in $\mathcal{L}$. Since $\boldsymbol{C}_{\mu}(\mathcal{L})$ is positive semi definite then $\boldsymbol{C}^{-1}_{\mu}(\mathcal{L})$ is also positive semi definite. Thus, we will have \operatorname*{\mathbb{E}}\Big{\{}\boldsymbol{a}^{T}_{l}(t,\mathcal{L})\boldsymbol{C}^{-1}_{\mu_{l}}(\mathcal{L})\boldsymbol{a}_{l}(t,\allowbreak\mathcal{L})\Big{\}}\geq 0. Therefore, if there exists a subset $\mathcal{L}$ such that $\operatorname*{\mathbb{E}}\left\{D_{\mathcal{L}}(t)\right\}\geq|\mathcal{L}|$, then there is at least one sensor under attack in $\mathcal{L}$. Hence, at each time step, to estimate $\hat{v}_{l}(t)$, ACV $f$ must choose a subset $\mathcal{L}$ which has the least divergence from $|\mathcal{L}|$. To capture the security level of a subset, we define a security divergence (SD) metric for a subset $\mathcal{L}$ as $\varsigma_{\mathcal{L}}(t)\triangleq\frac{\operatorname*{\mathbb{E}}\left\{D_{\mathcal{L}}(t)\right\}}{|\mathcal{L}|}\geq 1$. Therefore, a subset $\mathcal{L}$ with a lower $\varsigma_{\mathcal{L}}(t)$ value has a higher security level.

Moreover, any subset $\mathcal{L}$ of $v_{l}$ type sensors have a cost based on the estimation error induced to $\hat{v}_{l}(t)$. Thus, we define the cost of $\mathcal{L}$, as $\nu_{\mathcal{L}}=\operatorname*{\mathbb{E}}\left\{\left(v_{l}(t)-\hat{v}_{l}(t,\mathcal{L})\right)^{2}\right\}$, where $\hat{v}_{l}(t,\mathcal{L})$ is the estimation of $v_{l}$ using the subset $\mathcal{L}$. Thus, to find $\nu_{\mathcal{L}}$ we have:

[TABLE]

Therefore, we have $\nu_{\mathcal{L}}=\frac{1}{\sum_{i\in\mathcal{L}}\frac{1}{\sigma_{l_{i}}^{2}}}$. Clearly, a subset $\mathcal{L}$ with a higher $\sum_{i\in\mathcal{L}}\frac{1}{\sigma_{l_{i}}^{2}}$ has a lower cost.

While $D_{\mathcal{L}}$ represents a security measure for a subset $\mathcal{L}$, $\nu_{\mathcal{L}}$ can be considered as an estimation performance metric. Thus, at each time step, ACV $f$ must choose a subset $\mathcal{L}$ which has the minimum SD as well as the minimum cost. Thus, we have to find the secure high performance subset $\mathcal{L}^{*}(t)$ which is a subset that is secure and has the lowest estimation cost. To this end, a minimization problem that finds the secure high performance subset can be defined as $\mathcal{L}^{*}(t)=\operatorname*{arg\,min}_{\mathcal{L}}\xi_{\mathcal{L}}(t),$ where, $\xi_{\mathcal{L}}(t)=\nu_{\mathcal{L}}\varsigma_{\mathcal{L}}(t)$. Although $\nu_{\mathcal{L}}$ is known for $f$, $\varsigma_{\mathcal{L}}(t)$ might change due to an attack on $v_{l}$ type sensors. Thus, we propose an MAB learning algorithm which learns the secure high performance subset $\mathcal{L}^{*}(t)$[35, 36]. Our goal here is to choose a safe subset of sensors out of all available sensors by efficiently exploring different subsets and effectively exploiting the optimal subset, thus, we can apply an MAB framework to solve our problem.

In an MAB problem, a decision maker (ACV $f$), pulls an arm from a set of available arms (selects a subset $\mathcal{L}$ from $v_{l}$ type sensors). Each arm generates a cost after being played, based on a distribution that is not known to the decision maker. The aim of ACV $f$ is to minimize a cumulative cyber regret. This regret is defined as the difference between the reward of the best possible arm at each step, and the generated reward of the arm that is played [35, 36, 37].

Let $\xi^{*}(t)=\xi_{\mathcal{L}^{*}(t)}(t)$ be the lowest cost that could be achieved at time $t$ from $v_{l}$ type sensors. Thus, the cyber regret from $t=t_{0}$ up to a time $t=t_{e}$ is defined as:

[TABLE]

where the expectation is taken over the random choices of the $\mathcal{L}$. Cyber regret implies choosing non-optimal and non-secure subset of sensors. Thus, having a high cyber regret implies choosing a subset of sensors with higher error and possibly higher injected data which can lead to an estimation error for $\hat{v}_{l}(t)$. Since our proposed optimal controller which minimizes the physical regret is a function of estimated value, $\hat{v}_{l}(t)$, thus, higher cyber regret results in a higher estimation error and can introduce physical regret to ACV $f$. This clearly shows the cyber-physical aspects of ACV security.

One of the most recognized methods for the MAB problem is to use the concept of UCB [35]. In this method, the MAB algorithm at each time $t$ chooses $\mathcal{L}$ such that:

[TABLE]

where $n_{\mathcal{L}}$ is the number of times that arm ${\mathcal{L}}$ was played before and $t_{\mathcal{L},i}$ is the time step when $\mathcal{L}$ is selected for $i$-th time. Also, note that $n_{\mathcal{L}}\rightarrow\infty$, $\frac{1}{n_{\mathcal{L}}}\sum_{i=1}^{n_{\mathcal{L}}}D_{\mathcal{L}}(t_{\mathcal{L},i})\rightarrow\operatorname*{\mathbb{E}}\left\{D_{\mathcal{L}}(t)\right\}$[35, 36]. The UCB algorithm has an expected cumulative regret of:

[TABLE]

We use UCB algorithm because it has a logarithmic cyber regret and has been shown that there exists no algorithm that can have a better cyber regret [36]. Thus, using the UCB algorithm and the defined cyber regret we can address the DIA detection problem for sensors which lack a priori information.

VI Simulation Results and Analysis

For our simulations, we assume that ACV $l$ has a sinusoidal speed pattern and ACV $f$’s initial speed and spacing from the ACV $l$ are $v_{f}(0)=90$ km/h and $d(0)=100$ m. We set $n_{f}=n_{d}=n_{l}=4$, $T=0.1$ s, $b_{f}=2.5$ m/$s^{2}$, and $u_{f}^{\text{max}}=-u_{f}^{\text{min}}=0.25$ N/kg, which are chosen based on practical ACV characteristics[13].

VI-A Optimal Safe Controller

Fig. 4(a) shows an ACV which uses the proposed optimal controller. From Fig. 4(a), we make three observations: 1) The physical regret converges to zero and the actual spacing converges to the optimal safe spacing after approximately 20 seconds which shows that the proposed controller works properly, 2) The speed of ACV $f$, $v_{f}(t)$, exhibits, approximately, a 5 seconds delay compared to the ACV $l$’s speed vehicle $v_{l}(t)$. This is because ACV $f$ should first observe ACV $l$ and then control its own speed, and 3) The estimated states match with the actual state values which shows that applied state estimation estimation processes have an error close to zero.

Fig. 4(b) shows a comparison between our proposed controller with Gipps [38] and the intelligent driver model (IDM) [39] controllers, two of the well-known controllers for ACV leading-following scenarios. From Fig. 4(b), we can observe three key points: 1) Our proposed controller can follow the speed of ACV $l$ better compared to IDM as we can see that IDM converges to an almost constant speed while our proposed controller can track $v_{l}(t)$, 2) The proposed controller converges to the optimal safe spacing. However, the IDM model has a positive offset from the optimal safe spacing and the Gipps controller always has a smaller spacing than the optimal safe spacing. This shows that the Gipps model does not take into consideration the safety as we can see from Fig. 4(b) that the spacing can admit small values close to 0 meters which increases the risk of collision. On the other hand, the IDM model does not consider the optimality of traffic flow as it always yields a higher spacing than the optimal spacing, and 3) The cumulative physical regret for our proposed optimal safe controller outperforms the other two models thus demonstrating that the proposed controller can jointly yield optimality and safety in ACV systems.

VI-B Robustness Against Physical Attacks

Next, we simulate an attacker which takes control of ACV $l$ and after 100 seconds suddenly drops the speed of ACV $l$ from 75 km/h to 5 km/h. Fig. 5 shows the effect of this attack on the ACV $f$’s speed, spacing and physical regret. Fig. 5 shows that our proposed controller always maintains the optimal safe spacing even in presence of an attack. In contrast, the Gipps and IDM controllers always have an offset from the optimal safe spacing. Hence, our proposed controller is more robust against physical attacks. Note that, although Gipps can track the speed faster than our proposed method, however, it does not optimize the spacing. In addition, we can see from Fig. 5 that the proposed controller has a physical regret closed to zero while the cumulative regret of IDM and Gipps grow linearly since they have a constant offset from the optimal safe spacing in this attack scenario.

VI-C Cyber Security of ACV Systems

To illustrate the effectiveness of our proposed attack detection approaches, in Fig. 6, we analyze the impact of DIA on physical regret and estimation errors. Fig. 6(a) shows the relationship between the stealthy attack probability and maximum DIA when we apply our proposed attack detection filter on the sensors with a priori information. Fig 6(a) shows that as the stealthy attack probability increases the domain of the attack reduces. Moreover the DIA has higher value for the sensors with higher noise variance. To stay stealthy with higher probability, the attacker must reduce the domain of its injected faulty data to the sensors. In addition, Figs. 6(b), 6(c), and 6(d) show how the physical regret and steady state errors are affected by the probability of staying stealthy. From these figures, we can see that as the stealthy attack probability increases the regret and the absolute value of steady state errors decrease because the attacker’s maximum DIA decreases.

Fig. 7 shows the estimation error after applying our proposed attack detection filter on sensors with apriori estimation. From Fig. 7, we can see that, while the attack on $v_{f}(t)$ type sensor does not affect significantly the estimation, an attack on a $d(t)$ type sensor can cause an estimation error on $\hat{d}(t)$. In addition, Fig. 7 shows that the designed attack detection mechanism for sensors with a priori information mitigates DIAs and keeps the estimation error close to zero.

Fig. 8 shows how the increase on the number of under attack $v_{l}$ type sensors affects the cyber regret. In this simulation, we use the same settings as for Fig. 4. From Fig. 8, we can first observe that irrespective of the number of under attack sensors, the attack can be detected in under 4 seconds as the cyber regret goes to zero after 4 second which is acceptable for this scenario as in 4 seconds ACV $f$ travels for 80 meters while the optimal safe spacing is also 80 meters, thus, there will be no collision even if ACV $l$ stops suddenly , while ACV $f$’s sensors are attacked. Moreover, the growth rate of cyber regret for the three attacks is approximately equal regardless of the number of attacked sensors. Furthermore, Fig. 8 shows that, as the number of attacked sensors increases, the cumulative cyber regret increases faster thus the attack can be detected earlier. This shows that having access to more sensors is not essentially beneficial for the attacker and thus, the attacker must also optimize its set of attacked sensors to stay stealthy for a longer time.

Fig. 9 shows how the domain of attack can affect the cyber regret. We can see from Fig. 9 that, as the domain of injected data to the $v_{l}$ type sensor increases, the MAB algorithm can chooses the optimal subset more efficiently. This means that injecting higher values to the sensor increases the chance of detectability and thus, reduces the impact of the attack on the sensors. In addition, we can see that the cumulative cyber regret for the highest DIA (2.5 m/s data injection) is greater than other cases, at the beginning of the simulation. However, after almost 350 seconds, the cumulative cyber regret of the highest DIA becomes the least compared to the other DIAs. This is due to the fact that a larger DIA leads to a higher cyber regret at the beginning of the attack which leads the MAB algorithm to detect it earlier than other DIA cases.

Fig. 10 shows a scenario in which the attacker attacks only the third sensor when $n_{l}=4$. Note that, $b_{4}b_{3}b_{2}b_{1}$ shows the state of the sensors such that for $i=1,\dots,4$ if $b_{i}=1$ then sensor $i$ is under attack and otherwise, it is not. Obviously, when the attacker attacks the third sensor, the ACV must only rely on the other sensors. The $b_{4}b_{3}b_{2}b_{1}$ on the x-axis indicates the chosen subset by the MAB algorithm to use for estimation. Fig. 10 shows that using the MAB algorithm, percentage of the times that subset $\{1011\}$ is chosen by MAB is higher than other cases, which means that the MAB algorithm can detect the attack on the $v_{l}$ type sensors.

Finally, to show that our proposed DIA detection approaches can reduce the physical regret significantly, in Fig. 11, we consider that the attacker attacks only one sensor of each type with the lowest noise error variance (most valuable sensor) after 1000 seconds (after ensuring that Kalman filter converged). Then, we compare the cumulative physical regret of the ACV system for a case in which the ACV only uses a Kalman filter for estimation and another case in which the ACV applies both of our proposed DIA detection filters. Moreover, in this attack, we consider that the attacker increases the sensor readings by a factor of $50\%$. As can be seen from Fig. 11, the proposed attack detection filter has lower physical regret compared to a simple Kalman filtering. We can see that while the physical regret increases linearly for Kalman filter, our proposed DIA detection approach keeps the physical regret close to zero. This shows that, our proposed DIA detection approach can successfully detect the attack, mitigate it, and keep the ACV system safe and secure, however the Kalman filter fails to stay robust against the DIA.

VII Conclusion

In this paper, we have comprehensively studied the cyber-physical security and safety of ACV systems. We have proposed an optimal safe controller that maximizes the traffic flow and minimizes the risk of accidents on the roads by optimizing the speed and spacing of ACVs. In addition, the proposed optimal safe controller maximizes the stability of ACV systems and improves their robustness against physical attacks. Moreover, we have improved cyber-physical security of ACV systems by proposing two novel DIA detection approaches. The first approach detects DIAs using a priori information about the sensors. In the second approach, we have proposed an MAB algorithm to learn secure subset of sensors when there exists no a priori information about sensors. Simulation results have shown that the proposed optimal safe controller yields better stability and robustness compared to current state of the art controllers. In addition, the DIA detection approaches improve the security of the sensors and robustness of the ACV system compared to Kalman filtering.

-A Proof of Theorem 1

First, using (1) and (47) we can find that:

[TABLE]

and since ACV $f$ only has an estimation of $v_{f}(t)$, then we can rewrite (99) as follows:

[TABLE]

Now, we can define Lagrangian multipliers and apply the Karush Kuhn Tucker (KKT) conditions to solve the optimization problem in (45). Then, we will have:

[TABLE]

with the first order necessary conditions given by: $\frac{\partial g}{\partial u_{f}}=0,\,\,\frac{\partial g}{\partial\lambda_{1}}=0,$ and $\frac{\partial g}{\partial\lambda_{2}}=0.$ When $\lambda_{1}$ and $\lambda_{2}$ are not active ($\lambda_{1}=0$ and $\lambda_{2}=0$), we will have:

[TABLE]

However, $\frac{1}{T}\left(-\sqrt{2b_{f}\left(\hat{d}(t)+T\hat{v}_{l}(t)-T\hat{v}_{f}(t)\right)}-\hat{v}_{f}(t)\right)$ and $-\frac{1}{T}\hat{v}_{f}(t)$ are not acceptable solutions since they result in $v_{f}(t+1)\leq 0$. The next step is to show that the third solution in (102) is the global minimum. Thus, we apply the second-order condition on $\hat{R}(t)$ as follows:

[TABLE]

Thus, $u_{f}^{*}(t)=\frac{1}{T}\left(\sqrt{2b_{f}\left(\hat{d}(t)+T\hat{v}_{l}(t)-T\hat{v}_{f}(t)\right)}-\hat{v}_{f}(t)\right)$ is a global maximizer of $\hat{R}(t)$. Now, to consider the constraints in (99), if we activate $\lambda_{1}$ or $\lambda_{2}$ the first order condition will result in having $u^{*}_{f}(t)=\overline{u}_{1}(t)$ or \underline{u}_{1}(t). Therefore, the optimal 1-step ahead controller can be given by (49).

-B Proof of Theorem 3

We know that the Kalman gain converges to $\tilde{\boldsymbol{K}}$. Thus, from (37) and (40) we can find the state estimation $\hat{\boldsymbol{x}}(t)$ as a process which depends on estimation error $\boldsymbol{r}(t)$ as follows:

[TABLE]

Now, by subtracting (104) from the system model defined in (2), we will have:

[TABLE]

Moreover, we can see that $\boldsymbol{\rho}(t)$ is a linear combination of independent white Gaussian process with zero mean. To find the covariance matrix $\boldsymbol{C}_{\rho}$ of $\boldsymbol{\rho}(t)$ we will have:

[TABLE]

Note that the fact that $\boldsymbol{e}(t)$ and $r_{l}(t)$ are independent leads to having $\boldsymbol{e}(t)r_{l}^{T}(t)=0$ . Next, we write the dynamic model for the estimation error as follows:

[TABLE]

where $t_{0}$ is the time step where the Kalman filter converges. Thus, for $t\gg t_{0}$ and if $\boldsymbol{Q}\boldsymbol{A}$ is asymptotically stable then we will have $\boldsymbol{r}(t)$ as a Gaussian process due to the central limit theorem. Now, to find the mean of $\boldsymbol{r}(t)$ we can write:

[TABLE]

Next, since the mean is zero, then the covariance matrix of $\boldsymbol{r}(t)$, $\boldsymbol{C}_{r}=\operatorname*{\mathbb{E}}\{\boldsymbol{r}(t)\boldsymbol{r}^{T}(t)\}$. To find $\boldsymbol{C}_{r}$, we have:

[TABLE]

Note that since $\boldsymbol{r}(t-1)$ and $\boldsymbol{\rho}(t)$ are independent $\boldsymbol{\rho}(t)\boldsymbol{r}^{T}(t-1)=0$. In addition, we know that after convergence we will have $\operatorname*{\mathbb{E}}\left\{\boldsymbol{r}(t)\boldsymbol{r}^{T}(t)\right\}=\operatorname*{\mathbb{E}}\left\{\boldsymbol{r}(t-1)\boldsymbol{r}^{T}(t-1)\right\}=\boldsymbol{C}_{r}$ then, we will need to solve the following discrete Ricatti equation $\boldsymbol{C}_{r}=\boldsymbol{Q}\boldsymbol{A}\boldsymbol{C}_{r}\boldsymbol{A}^{T}\boldsymbol{Q}^{T}+\boldsymbol{C}_{\rho}.$

Now, the final step is to find the covariance matrix of the residual $\boldsymbol{C}_{\mu}$. Since after Kalman filter convergence we will have $\hat{\boldsymbol{x}}^{(-)}(t)=\hat{\boldsymbol{x}}(t)$ then:

[TABLE]

Thus, we will have:

[TABLE]

Now, we have:

[TABLE]

Thus, the covariance matrix can be given by (78).

-C Proof of Theorem 4

From (40), after Kalman filter convergence we obtain:

[TABLE]

Due to the definition of\boldsymbol{F}=\left[\begin{array}[]{c c}0&T\end{array}\right]^{T}, $\left[\boldsymbol{I}-\tilde{\boldsymbol{K}}\boldsymbol{H}\right]\boldsymbol{F}$ and $\tilde{\boldsymbol{K}}\boldsymbol{H}\boldsymbol{F}$ are vectors with two elements where the first elements are zero. We define two parameters $s_{1}$ and $s_{2}$ as \left[\boldsymbol{I}-\tilde{\boldsymbol{K}}\boldsymbol{H}\right]\boldsymbol{F}=\left[\begin{array}[]{c}0\\ s_{1}\end{array}\right] and \tilde{\boldsymbol{K}}\boldsymbol{H}\boldsymbol{F}=\left[\begin{array}[]{c}0\\ s_{2}\end{array}\right], and we will have $s_{1}+s_{2}=T$. Then using (93) and (110) the a posteriori estimation will be v_{l}^{(+)}(t)=\frac{s_{1}}{T}\hat{v}_{l}(t)+\frac{s_{2}}{T}v_{l}(t)+\underbrace{\left[\begin{array}[]{c c}0&1\end{array}\right]\tilde{\boldsymbol{K}}}_{\boldsymbol{J}}\left[\boldsymbol{H}\boldsymbol{A}\boldsymbol{r}(t)+\boldsymbol{e}(t)\right].Thus, we will have:

[TABLE]

First, we derive the mean of a posteriori residual:

[TABLE]

Since the mean is zero the covariance matrix of $\boldsymbol{\mu}_{l}^{(+)}(t)$, $\boldsymbol{C}_{\mu_{l}}$, can be derived as follows:

[TABLE]