A Certifiable Security Patch for Object Tracking in Self-Driving Systems via Historical Deviation Modeling

TL;DR

This paper investigates the security vulnerabilities of Kalman Filter-based object tracking in self-driving cars, demonstrating its susceptibility to hijacking attacks and proposing a certifiable security patch that effectively mitigates these threats with minimal performance impact.

Contribution

The paper provides the first systematic security analysis of object tracking in self-driving systems and introduces a novel adaptive defense mechanism for Kalman Filter-based trackers.

Findings

Kalman Filter-based trackers are vulnerable to hijacking attacks.

The proposed security patch effectively defends against hijacking with minimal overhead.

Evaluation confirms the patch's effectiveness across multiple implementations.

Abstract

Self-driving cars (SDC) commonly implement the perception pipeline to detect the surrounding obstacles and track their moving trajectories, which lays the ground for the subsequent driving decision making process. Although the security of obstacle detection in SDC is intensively studied, not until very recently the attackers start to exploit the vulnerability of the tracking module. Compared with solely attacking the object detectors, this new attack strategy influences the driving decision more effectively with less attack budgets. However, little is known on whether the revealed vulnerability remains effective in end-to-end self-driving systems and, if so, how to mitigate the threat. In this paper, we present the first systematic research on the security of object tracking in SDC. Through a comprehensive case study on the full perception pipeline of a popular open-sourced self-driving system, Baidu's Apollo, we prove the mainstream multi-object tracker (MOT) based on Kalman Filter (KF) is unsafe even with an enabled multi-sensor fusion mechanism. Our root cause analysis reveals, the vulnerability is innate to the design of KF-based MOT, which shall error-handle the prediction results from the object detectors yet the adopted KF algorithm is prone to trust the observation more when its deviation from the prediction is larger. To address this design flaw, we propose a simple yet effective security patch for KF-based MOT, the core of which is an adaptive strategy to balance the focus of KF on observations and predictions according to the anomaly index of the observation-prediction deviation, and has certified effectiveness against a generalized hijacking attack model. Extensive evaluation on $4$ KF-based existing MOT implementations (including 2D and 3D, academic and Apollo ones) validate the defense effectiveness and the trivial performance overhead of our approach.