Model-based Randomness Monitor for Stealthy Sensor Attacks

TL;DR

This paper introduces a statistical monitoring framework that detects stealthy sensor attacks in cyber-physical systems by identifying non-random patterns in sensor data using formal statistical tests.

Contribution

It presents a novel run-time detection method combining Wilcoxon and Serial Independence tests with formal guarantees, validated on a UGV under attack.

Findings

Effective detection of stealthy sensor attacks demonstrated in simulations and experiments.

Formal bounds and guarantees provided for attack detection performance.

Outperforms existing anomaly detection methods in the tested scenarios.

Abstract

Malicious attacks on modern autonomous cyber-physical systems (CPSs) can leverage information about the system dynamics and noise characteristics to hide while hijacking the system toward undesired states. Given attacks attempting to hide within the system noise profile to remain undetected, an attacker with the intent to hijack a system will alter sensor measurements, contradicting with what is expected by the system's model. To deal with this problem, in this paper we present a framework to detect non-randomness in sensor measurements on CPSs under the effect of sensor attacks. Specifically, we propose a run-time monitor that leverages two statistical tests, the Wilcoxon Signed-Rank test and Serial Independence Runs test to detect inconsistent patterns in the measurement data. For the proposed statistical tests we provide formal guarantees and bounds for attack detection. We validate our approach through simulations and experiments on an unmanned ground vehicle (UGV) under stealthy attacks and compare our framework with other anomaly detectors.