U.S. patent application number 15/918787 was filed with the patent office on 2019-01-24 for cyber-physical system defense.
The applicant listed for this patent is University of Virginia Patent Foundation. Invention is credited to Barry Horowitz, Rick A. Jones, Joseph Vince Pulido, Edward C. Suhler, Ronald Dean Williams.
Application Number | 20190025435 15/918787 |
Document ID | / |
Family ID | 61801346 |
Filed Date | 2019-01-24 |
![](/patent/app/20190025435/US20190025435A1-20190124-D00000.png)
![](/patent/app/20190025435/US20190025435A1-20190124-D00001.png)
![](/patent/app/20190025435/US20190025435A1-20190124-D00002.png)
![](/patent/app/20190025435/US20190025435A1-20190124-D00003.png)
![](/patent/app/20190025435/US20190025435A1-20190124-D00004.png)
![](/patent/app/20190025435/US20190025435A1-20190124-D00005.png)
![](/patent/app/20190025435/US20190025435A1-20190124-M00001.png)
![](/patent/app/20190025435/US20190025435A1-20190124-M00002.png)
![](/patent/app/20190025435/US20190025435A1-20190124-M00003.png)
![](/patent/app/20190025435/US20190025435A1-20190124-M00004.png)
![](/patent/app/20190025435/US20190025435A1-20190124-M00005.png)
View All Diagrams
United States Patent
Application |
20190025435 |
Kind Code |
A1 |
Horowitz; Barry ; et
al. |
January 24, 2019 |
CYBER-PHYSICAL SYSTEM DEFENSE
Abstract
System and techniques for cyber-physical system defense are
described herein. Sensor disagreements between a plurality of
sensors over time can be sampled. Cluster analysis on the sampled
sensor disagreements can be performed. A deviation indication can
be provided in response to the cluster analysis resulting in
disagreement density beyond a threshold.
Inventors: |
Horowitz; Barry; (Crozet,
VA) ; Pulido; Joseph Vince; (Washington, DC) ;
Jones; Rick A.; (Charlottesville, VA) ; Suhler;
Edward C.; (Earlyville, VA) ; Williams; Ronald
Dean; (Charlottesville, VA) |
|
Applicant: |
Name |
City |
State |
Country |
Type |
University of Virginia Patent Foundation |
Charlottesville |
VA |
US |
|
|
Family ID: |
61801346 |
Appl. No.: |
15/918787 |
Filed: |
March 12, 2018 |
Related U.S. Patent Documents
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
|
|
14660278 |
Mar 17, 2015 |
9942262 |
|
|
15918787 |
|
|
|
|
61955669 |
Mar 19, 2014 |
|
|
|
62075179 |
Nov 4, 2014 |
|
|
|
Current U.S.
Class: |
1/1 |
Current CPC
Class: |
G01S 19/13 20130101;
H04L 67/12 20130101; G01S 19/49 20130101; H04W 12/1202 20190101;
H04W 4/38 20180201; H04W 4/48 20180201; H04L 63/1441 20130101; H04W
12/1208 20190101; Y04S 40/18 20180501 |
International
Class: |
G01S 19/13 20060101
G01S019/13; G01S 19/49 20060101 G01S019/49; H04W 4/48 20060101
H04W004/48; H04W 12/12 20060101 H04W012/12; H04L 29/08 20060101
H04L029/08; H04W 4/38 20060101 H04W004/38; H04L 29/06 20060101
H04L029/06 |
Claims
1. A system for cyber-physical system defense, the system
comprising: a sensor interface to receive sensor data from a
plurality of sensors; a sampling circuit set to sample sensor
disagreements between the plurality of sensors over time; a cluster
circuit set to perform cluster analysis on the sampled sensor
disagreements; and an alert circuit set to provide a deviation
indication in response to the cluster analysis resulting in
disagreement density beyond a threshold.
Description
CLAIM OF PRIORITY
[0001] This patent application is a continuation of, and claims the
benefit of priority, under 35 U.S.C. .sctn. 120, to U.S. patent
application Ser. No. 14/660,278, titled "CYBER-PHYSICAL SYSTEM
DEFENSE" and filed on Mar. 17, 2015, which claim the benefit of
priority, under 35 U.S.C. .sctn. 119, to U.S. Provisional
Application Ser. No. 61/955,669, titled "CLOUD BASED SYSTEM AWARE
CYBER SECURITY AND RELATED METHODS THEREOF" and filed on Mar. 19,
2014, and also claims priority to U.S. Provisional Application Ser.
No. 62/075,179, titled "SYSTEM AWARE CYBER SECURITY AND RELATED
METHODS THEREOF" and filed on Nov. 4, 2014, the entirety of all are
hereby incorporated by reference herein.
TECHNICAL FIELD
[0002] Embodiments described herein generally relate to system
security and more specifically to cyber-physical system
defense.
BACKGROUND
[0003] Cyber-physical systems combine computational, communication,
sensory and control capabilities to monitor and regulate physical
domain processes. Cyber-physical systems broadly focus on
monitoring and controlling a physical process, and may include
capabilities to: sense the physical world (e.g., the position of a
valve controlling a tank filling process); make decisions (e.g.,
whether it is necessary to open or close the valve); and perform
actions in physical world (e.g. open or close valve to maintain
tank fluid level). Cyber-physical systems are becoming increasingly
prevalent, filing roles in the civilian (e.g., power grid, public
utility services, financial infrastructure, etc.) and defense
(e.g., search and rescue missions and command, control, and conquer
(C3) systems) spaces.
[0004] Cyber-physical systems are becoming increasingly accessible
to attackers via increased network access to communication with
control rooms, command and control stations, other computer based
systems and networks such as the Internet. Examples of
cyber-physical systems include transportation networks, unmanned
aerial vehicles (UAV's), nuclear power generation, electric power
distribution networks, water and gas distribution networks, and
advanced communication systems. Current technology has often
introduced the capability of integrating information from numerous
instrumentation and control systems and transmitting the
information to operations personnel in a timely manner.
BRIEF DESCRIPTION OF THE DRAWINGS
[0005] In the drawings, which are not necessarily drawn to scale,
like numerals may describe similar components in different views.
Like numerals having different letter suffixes may represent
different instances of similar components. The drawings illustrate
generally, by way of example, but not by way of limitation, various
embodiments discussed in the present document.
[0006] FIG. 1 is a block diagram of an example of an environment
including a system for cyber-physical defense, according to an
embodiment.
[0007] FIGS. 2A and 2B illustrates an example of a disagreement
signal cluster analysis timeline, according to an embodiment.
[0008] FIG. 3 illustrates an example of a deviating sensor decision
tree, according to an embodiment.
[0009] FIG. 4 illustrates an example of a method for cyber-physical
defense, according to an embodiment.
[0010] FIG. 5 is a block diagram illustrating an example of a
machine upon which one or more embodiments may be implemented.
DETAILED DESCRIPTION
[0011] Due to the increased vulnerability of cyber-physical systems
given greater remote access as well as the reliance of these
automated systems on control systems without human input, security
is an important consideration. Traditionally, security is
implemented via perimeter defense--such as such as firewalls,
intrusion detection mechanisms, anti-viral signature software,
encryption, and advanced user authentication--designed to prevent
an attacker from gaining control of the cyber-physical system.
While the application of perimeter security technologies has been
used to address attacks, the rate of successful attacks against
critical infrastructures continues to be increasingly problematic.
Furthermore, the trend in adversarial attacks is moving toward
well-formed coordinated multi-vector attacks that compromise the
system in such a way that detection and identification is
challenging for perimeter security solutions. Furthermore, an
asymmetrical conflict arises where defending against attacks is
expensive while actually performing attacks is becomingly
increasingly inexpensive. That is, the attacker may take time to
probe a defense perimeter, identify a weak point, and exploit it
while the defender must spend inordinate resources to identify and
fixe weak points ahead of time while being giving very little time
to address an attack on an overlooked weak point.
[0012] To address the problem of cyber-physical system defense
given above, the behavior of multiple redundant (in both type and
number) sensors can be used to produce a robust platform for the
cyber-physical system control. Further, disagreements between the
sensors can be analyzed to identify periods in which an attack is
likely, such as when noted disagreements cluster together. Such a
cluster analysis addresses the practical reality that disparate
sensors may not agree at all times, however, are likely to reflect
a pattern of disagreement during normative (e.g., normal and not
under attack) operations. Further, to address whether or not a
single disagreement has occurred between two disparate sensors, the
data from these sensors can be statistically analyzed to determine
whether it deviates from a known probability distribution (e.g., a
random normal distribution). Moreover, individual sensor
disagreements can be analyzed via a logical pairing structure
(e.g., a decision tree) to identify the component suspected of
being compromised in an attack. By using these techniques, a
cyber-physical system includes robust and ongoing defense of
attacks that may have breached other defense mechanisms, such as
perimeter security mechanisms.
[0013] FIG. 1 is a block diagram of an example of an environment
100 including a system 145 for cyber-physical defense, according to
an embodiment. The following discussion generally uses the example
of a simplified UAV navigation control system. However, the
discussed techniques are applicable to other cyber-physical control
systems as long as a known probability distribution between sensor
readings can be established.
[0014] The environment 100 includes a UAV 105 with a control system
110. The control system 110 can include a navigation component 130,
a sensor array 115, and a system defense component 145. The
navigation component 103 can include a position estimate module 135
that takes an inertial navigation system output and feedback from a
Kalman filter 140 as inputs and produces a navigation signal that
is combined with a satellite navigation system (e.g., global
position system, GLONASS, Galileo, Beidou, etc.) output and used in
the Kalman filter 140 to produce navigation resolution for the UAV
105. The navigation resolution can be used to determined which
actuators of the UAV to manipulate and how they are to be
manipulated to pilot the IAV 105. The sensor array 115 can include
a plurality of sensors, such as inertial navigation sensors INS-1
120A and INS-2 120B and satellite navigation system sensors SNS-1
125A and SNS-2 125B. In example, the plurality of sensors in the
sensor array 115 can include a number of subsets, such as subsets
based on homogeneous type (e.g., inertial navigation system as a
first type and satellite navigation system as a second type).
[0015] The system defense component 145 can include a sensor
interface 150. The sensor interface 150 includes hardware to
communicatively receive or retrieve data from the sensors 120-125
in the sensor array 115. The sensor interface 150 also includes
hardware to provide the sensor data to other components of the
system defense component, such as the sampling circuit set 155, the
cluster circuit set 160, or the alert circuit set 165.
[0016] The sampling circuit set 155 can sample sensor disagreements
between the plurality of sensors over time. In an example, to
sample sensor disagreements between the plurality of sensors over
time can include obtaining a first data set for a first sensor set,
obtain a second data set for a second sensor set determine a
disagreement between the first data set and the second data set.
Such result comparisons for sensor disagreements can be performed
in a number of ways. For example, the result of a first sensor can
be directly compared with the result of a second sensor and when
the results do not match, either exactly or within a threshold, a
disagreement is registered. However, sensor diversity in sourcing
(e.g., who makes the sensor) and operation (e.g., what hardware is
used) can make it more difficult to attack. This diversity may
include diverse operating characteristics, making direct result
comparison a less reliable indication of actual sensor
disagreement. This issue may be compounded when disagreements
between different types of sensors are sought.
[0017] In an example, to address the direct comparison issues
mentioned above, determining the disagreement between the first
data set and the second data set can include combining the first
data set with the second data set to create a measurement data set,
calculating a set of residuals for the measurement data set, and
determining that a mean for the residuals is beyond a threshold in
relation to an expected mean for the residuals. Thus, a statistical
model is applied to the differences between the two data sets to
ascertain whether they are behaving as they should. Below is a
discussion of the ability to use the mean of the residuals to
ascertain undue influence in one or another sensor.
[0018] First, the state of the UAV 105 navigation can be modeled
for multiple satellite navigation system sensors 125 and inertial
navigation system sensors 125 as a linear time-invariant stochastic
system with Gaussian noise (which accounts for modeling errors,
uncertainties, or system external perturbations). Such as system
can be expressed in the manner illustrated below:
Let x be the state of the UAV 105, where:
[0019] x.sub.1:=x-axis coordinate position
[0020] x.sub.2:=x-axis component of velocity
[0021] x.sub.3:=.sub.y-axis coordinate position
[0022] x.sub.4:=.sub.y-axis component of velocity
Inertial Navigation System components (M units):
x a ( 1 ) ( k + 1 ) = Ax a ( k ) + Bu a ( k ) + B c a c ( k ) +
.differential. Tw ( 1 ) ( k ) x a ( 2 ) ( k + 1 ) = Ax a ( k ) + Bu
a ( k ) + B c a c ( k ) + .differential. Tw ( 2 ) ( k ) x a ( M ) (
k + 1 ) = Ax a ( k ) + Bu a ( k ) + B c a c ( k ) + .differential.
Tw ( M ) ( k ) ##EQU00001##
Satellite Navigation System components (N units):
z a ( 1 ) ( k ) = C 1 x a ( k ) + B o a o ( k ) + v ( 1 ) ( k ) z a
( 2 ) ( k ) = C 1 x a ( k ) + B o a o ( k ) + v ( 2 ) ( k ) z a ( N
) ( k ) = C 1 x a ( k ) + B o a o ( k ) + v ( N ) ( k )
##EQU00002##
where X.sub.a(k) .sup.l, u(k) .sup.p, z.sub.a(k) .sup.t are the
system state, inputs of the inertial navigations system units, and
the measurement of the satellite navigation units, and where
w.sup.j(k) .sup.q(k), v.sup.i(k) .sup.t Mare process and
measurement noise. The w(k) and v(k) components are Gaussian white
noise of the inertial navigation system and satellite navigation
system measurements respectively, with constant covariance matrices
Q and R. Further, let
A = [ 1 T S 0 0 0 1 0 0 0 0 1 T S 0 0 0 1 ] ##EQU00003## B = [ T S
2 2 0 T S 0 0 T S 2 2 0 T S ] ##EQU00003.2## C = [ 1 0 0 0 0 0 1 0
] ##EQU00003.3## .differential. T = [ T S 2 2 T S T S 2 2 T S ]
##EQU00003.4##
where B.sub.o, B.sub.c are the attack matrices and a.sub.o(k),
a.sub.c(k) are persistent, linear deception attacks against the
satellite navigation systems and inertial navigation systems at
time k respectively.
[0023] Given this model of the system, similarity analysis between
these components can be carried out as with the following component
specific similarity analyses.
[0024] Similarity between two inertial navigation system components
can look a velocity or acceleration residuals between the two
components. Selection of particular sensor outputs for comparison,
rather than all components, can alleviate identified senor issues,
such as compounding drift in inertial navigation sensors. The
residual of the acceleration measurement for the two inertial
navigation system components is:
r 1 ( k ) = ( Bu a ( 1 ) ( k ) + B c a c ( 1 ) + .differential. Tw
( 1 ) ( k ) ) - ( Bu a ( 2 ) ( k ) + B c a c ( 2 ) + .differential.
Tw ( 2 ) ( k ) ) = B ( u a ( 1 ) ( k ) - u a ( 2 ) ( k ) ) +
.differential. T ( w ( 1 ) ( k ) - w ( 2 ) ( k ) ) + .alpha. c ( k
) ##EQU00004##
where a.sub.c(k)=B(a.sub.c.sup.(1)(k)-a.sub.c.sup.(2)(k)). Given
this, because w.sup.(i)(k) is a zero-mean Gaussian, and because
u.sub.a.sup.(1)(k)=u.sub.a.sup.(2)(k), we have:
N(0,.differential.T'(Q.sup.(1)+Q.sup.(2)).differential.T).about..differe-
ntial.T(w.sup.(1)(k)-w.sup.(2)(k))
If .alpha..sub.c(k).noteq.0, then r.sub.1(k) loses its non-zero
Gaussian characteristic. Thus, a valid test for sensor deviation
(e.g., based on a security intrusion) is to test the non-zero mean
normality of the residuals, which can be performed with the
compound scalar test. Since r(k) is a bivariate standard normally
distributed random variable, let
.sub.1(k)=r.sub.1(k).sup.T((C.sup.T.differential.TC).SIGMA..sub.r.sub.1.-
sup.-1(C.sup.T.differential.TC))r.sub.1(k)
be the sum of squares of the residual with two degrees of freedom
between the two inertial navigation system acceleration
measurements with covariance matrix
.SIGMA..sub.r.sub.1=Q.sup.(1)+Q.sup.(2)
With the application of the compound scalar test to assess the
normality of the residuals, the hypothesis test becomes:
.sub.0: X(.sub.1(k))<threshold
.sub.1: X(.sub.1(k))>threshold
where .sub.1 signifies a disagreement at time k. In an example, the
threshold is 0.99.
[0025] As demonstrated above, the differences between the two
sensor readings, at a point in time--e.g., within a tolerance
threshold such that two readings are considered at the same point
in time, the tolerance threshold providing sufficient resolution to
produce a meaningful result given the application--can be tested
for conformance to a probability distribution to determine
disagreement between the sensors. Although the specifics of some
terms vary, the application of the above technique operates in the
same way for disagreement (e.g., similarity) testing of satellite
navigation system sensors and between inertial navigation system
sensors and satellite navigation system sensors because the
residuals are Gaussian distributed random variables.
[0026] In an example, between two satellite navigation systems, the
residuals of the satellite navigation system measurements
(represented above as z.sub.a.sup.(N)) can be used. For example,
for two satellite navigation sensors 1 and 2, the residual is
r 2 ( k ) = z a ( 1 ) ( k ) - z a ( 2 ) = ( Cx a ( k ) + B o a o (
1 ) ( k ) + v ( 1 ) ( k ) ) - ( Cx a ( k ) + B o a o ( 1 ) ( k ) +
v ( 1 ) ( k ) ) = ( v ( 1 ) ( k ) - v ( 2 ) ( k ) ) + .alpha. 0 ( k
) ##EQU00005##
where a.sub.0(k)=B.sub.0(a.sub.0.sup.(1)(k)-a.sub.0.sup.(2)(k)).
Because v.sup.(i) is a zero-mean Gaussian random variable, we
have:
N(0,R.sup.(1)+R.sup.(2)).about.(v.sup.(1)(k)-v.sup.(2)(k))
Again, if .alpha..sub.0(k).noteq.0, then r.sub.1 loses its non-zero
Gaussian characteristics. Thus, the scalar compound test can be
used to assess a deviation. Let X be the sum of squares of the
residual:
.sub.2(k)=r.sub.2(k).sup.T(.SIGMA..sub.r.sub.2.sup.-1)r.sub.2(k)
.SIGMA..sub.r.sub.2=R.sup.(1)+R.sup.(2)
and the compound scalar test hypothesis becomes:
.sub.0:X(.sub.2(k))<threshold
.sub.1: X(.sub.2(k))>threshold
where .sub.1 signifies a disagreement at time k. In an example, the
threshold is 0.99.
[0027] In an example, between a satellite navigation system sensor
and an inertial navigation system sensor, the position residuals
(respectively represented above as z.sub.a.sup.(N) and
x.sub.a.sup.(M)) can be used. For example, the residual of the
inertial navigation system sensor and the satellite navigation
sensor is:
r.sub.3(k)=x.sub.a.sup.(1)(k)-z.sub.a.sup.(1)(k)=CAx.sub.a.sup.(1)(k-1)+-
CBu(k-1)0Cx.sub.a(k)+[B.sub.0a.sub.0.sup.(1)(k)-B.sub.ca.sub.c.sup.(1)(k)]-
+[C.differential.Tw.sup.(1)(k-1)-v.sup.(1)(k)]
And has a non-zero mean Gaussian characteristic. Further, assume
that,
CAx.sub.a.sup.(1)(k-1)+CBu(k-1)=Cx.sub.a(k)
and, absent an attack,
B.sub.0a.sub.0.sup.(1)(k)+B.sub.ca.sub.c.sup.(1)(k)=0
then r.sub.3 (k) is a Gaussian distributed random variable, with
covariance
.SIGMA..sub.r.sub.3=c.differential.T.sup.TC.sup.TQ.sup.(1)C.sup.T.differ-
ential.TC+R.sup.(1)
and sum of squares is
.sub.3(k)=r.sub.3(k).sup.T.SIGMA..sub.r.sub.3.sup.-1r.sub.3(k)
then the compound scalar test hypothesis becomes:
.sub.0: X(.sub.3(k))<threshold
.sub.1:X(.sub.3(k))>threshold
where .sub.1 signifies a disagreement at time k. In an example, the
threshold is 0.99.
[0028] These principles or residual normality testing are similarly
applicable to disagreement testing of other sensors, such as
rotational sensors, altitude tensors, thermometers, etc. Thus truly
disparate sensors can be tested for agreement, providing a robust
and secure sensing platform for cyber-physical systems.
[0029] Returning to the more general case, in an example, the first
sensor set and the second sensor set can consist of members of a
first type of sensor. Thus, the same type of sensor is compared
against each other. Sensor types can classified based on how the
physical measurement taken (e.g., current generated in a piezo
electric device under mechanical stress). In an example, the sensor
type is classified based on the mechanism used to achieve the
measurement. In an example, the first sensor set can consist of a
first type of sensor and the second sensor set can consist of a
second type of sensor. Thus, in this example, the two sensor sets
represent different types of sensors that use a different mechanism
to arrive at some common measurement. For example, both satellite
navigation systems and inertial navigation systems can provide an
absolute position of the UAV 105, but each uses a different
mechanism to arrive at the position measurement.
[0030] The cluster circuit set 160 can perform cluster analysis on
the sampled sensor disagreements. As noted above, diversity in
sensor number (e.g., the more sensors used), manufacturer (e.g.,
multiple manufacturers are harder to infiltrate in order to
compromise a device), and type (e.g., an inertial navigation system
and a barometer to measure altitude have different attack vectors)
tend to lead to increased robustness of the system. However, such
variety can lead to reduced uniformity in measurement results at
any given moment. To address this issue, an analysis of the
disagreement signals produced by ascertaining sensor disagreements
over time can reduce false positive alerts and provide greater
confidence in identifying a malfunctioning sensor.
[0031] Normative testing can provide a profile of false
disagreements between sensors. For example, suppose the
disagreement signal is an exponential distribution with a fixed
arrival rate (false disagreement rate). Thus, the disagreement
signal will include disagreement indications between the two
sensors at fixed intervals. If X.sub.i is the time of the ith false
disagreement, then X.sub.i-N-X.sub.i is the time between ith false
disagreement and the i+N false disagreement. When a sensor
deviation occurs, the disagreement indications in the disagreement
signal cluster. Thus, the interim arrival rate of the disagreement
indications (i.e. X.sub.i-N-X.sub.i will tend to be short, or
getting shorter over time.
[0032] In an example, performing the cluster analysis can include
determining whether a predetermined number of disagreements
occurred within a calculated period of time. This is effective
because the shorter interim arrival times of the disagreement
indications increase the number of indications in fixed time
windows. In an example, the calculated time period can be
calculated via an inverse Gamma function with a probability
parameter, a sample-size parameter, and a time-of-arrival
parameter, the time-of-arrival parameter determined via measurement
of a sensor system during normative testing. For example, for a
given probability P, if X.sub.i-N-X.sub.i<T a cluster can
identified, where
T = InvGamma ( P , N , 1 R ) ##EQU00006##
and [0033] N=number of disagreement indications [0034] R=time of
arrival of each disagreement indication
[0035] Consider the values for the given parameters: P=0.05, N=10,
and R=rate of false alarms during normative testing, then T=542.
Thus, in this scenario, the calculated time period (e.g., time
window) in which 10 disagreements is concerning is 542 units.
[0036] The alert circuit set 165 can provide a deviation indication
in response to the cluster analysis resulting in disagreement
density beyond a threshold. As noted above, the cluster analysis
provides an indication when the threshold is met, such as a
predefined number of disagreement indications within the calculated
time period. The deviation indication can be a variety of
indications, such as an alarm, a disabling signal for the deviating
sensor, initiation of an investigation into the source of the
deviation (e.g., determining whether a false signal is manipulating
the sensor), a log entry, etc. In an example, the deviation
indication can indicate which sensor of the plurality of sensors is
the source of the deviation. In an example, a relationship
structure, such as a decision tree, can be applied to pairs (or
other combinations) of sensors in the plurality of sensors using
disagreements in the dataset that provided the deviation
indication. That is, time correlated disagreements that resulted in
the deviation indication can be compared to determine which sensor
disagrees with others while eliminating from consideration those
sensors that agree with the others. An example of such a decision
tree is described below with respect to FIG. 3.
[0037] By applying the components and techniques described herein,
the asynchronous nature of system attack and defense in perimeter
defense is addressed. Disparate sensors can be used to control a
cyber-physical system and misbehaving sensors can be reliably
detected and dealt with. Thus, cyber-physical system builders and
users can deploy critical systems with greater confidence in the
ability of these systems to withstand attacks from malicious
entities.
[0038] FIGS. 2A and 2B illustrates an example of a disagreement
signal cluster analysis timeline 200, according to an embodiment.
As described above, during a normative period (e.g., when the
system is operating normally and is not under attack) disagreements
between two sensors can still occur for a variety of reasons (e.g.,
differing calibration, error tolerances, measurement mechanism,
etc.). FIG. 2A illustrates a normative period of the timeline 200,
with disagreement indications S-1 through S-6. Although illustrated
having a fixed interim arrival times, varying intervals can also be
addressed because a cluster of such indications is not expected to
occur during normative operation.
[0039] FIG. 2B illustrates a later period in the disagreement
signal cluster analysis timeline 200, starting at S-N and moving
through S-(N+M). In this portion of the time line, region 205
indicates the calculated time period discussed above. The increased
density of the disagreements in the timeline 200 indicates that a
deviation is occurring. If the number of disagreements with the
time period 205 is greater than the number used to calculate the
time period 205 (e.g., 10 as described above), then an alert, or
other deviation indication can be produced.
[0040] FIG. 3 illustrates an example of a deviating sensor decision
tree 300, according to an embodiment. As described above, a
decision tree, or other mechanism can be used to determine which
sensor of a plurality of sensors is causing problems. In the
example of the decision tree 300 applies to a system with two
inertial navigation system sensors and two satellite navigation
system sensors. In an example, the disagreements discussed below
are determined after the cluster analysis results in a disagreement
indication.
[0041] At the decision 305, it is tested whether or not the two
inertial navigation system sensors agree with each other (i.e.,
that they did not disagree). If the two inertial navigation system
sensors do agree with each other, then decision 310 determines
whether the two satellite navigation system sensors agree with each
other. If decision 310 is also affirmative, it can be concluded
that the intra type checks indicate that no problem exists. However
to address a sensor type attack (e.g., an attack effective across
the entire sensor type, such as a global position system spoof
attack), the first satellite navigation system sensor is compared
to the first inertial navigation system sensor are decision 315. If
decision 315 indicates an agreement, then no alarm 320 is imitated.
However, if the decision 315 indicates a disagreement, the alarm
325 can be initiated and indicate a spoofing attack on the
satellite navigation system sensors.
[0042] Moving back to the decision 310, a disagreement between the
satellite navigation system sensors where the inertial navigation
sensors agree (at decision 305) indicates that one of the satellite
navigation sensors is deviating. To determine which of the two
satellite navigation sensors is the offending sensor, the first
satellite navigation sensor can be tested for agreement with a
trusted sensor (e.g., the first inertial navigation sensor) at
decision 330. If the first satellite navigation sensor does not
agree with the first inertial navigation system sensor, then the
alarm 340 can indicate that the first satellite navigation system
sensor is the offending sensor. Otherwise, the alarm 335 can
indicate that the second navigation system sensor is the offending
sensor.
[0043] Moving back to the decision 305, if the inertial navigation
sensors disagree, one of them is the offending sensor. At the
decision 345, the satellite navigation sensors can be tested for
agreement. It is noted that if these sensors do not agree, the
decision tree cannot make a determination because either of the
inertial navigation sensors is an offender and either of the
satellite navigation system sensors is an offender, and thus there
is no trusted sensor than can be used to determine which of each
type of sensor is an offender. However, if the two satellite
navigation sensors do agree with each other, each can be considered
a trusted sensor--assuming that an attacker could not
simultaneously perform a spoof attack and compromise an inertial
navigation system sensor--to test the first inertial navigation
sensor at decision 350. If the first inertial navigation sensor
disagrees with a satellite navigation system sensor, then the alarm
355 can indicate that the first inertial navigation sensor is the
offending sensor. Otherwise, alarm 360 can indicate that the second
inertial navigation sensor is the offending sensor.
[0044] The decision tree 300 performs a trust analyses on some
sensors that can then be used to test other sensors. Such
relationships can be exploited in other sensor arrangements.
Moreover, some sensors may be more impervious to attack, and thus
tested first to establish a trusted sensor set early in the
process, such as the initial testing of the inertial navigation
system sensors at decision 305. In an case, the number of sensors
tested can be increased, and the specific order of testing can be
varied as long as the final result is determinative of an offending
set of sensors.
[0045] FIG. 4 illustrates an example of a method 400 for
cyber-physical defense, according to an embodiment. The operations
of the method 400 are implemented in computing hardware or carried
out via computing hardware instructed by software. Example
components are described above with respect to FIG. 1 and below
with respect to FIG. 5.
[0046] At operation 405, sensor data for plurality of sensors can
be monitored. The plurality of sensors can include a first set of
sensors (e.g., consisting of a first single type such as satellite
navigation systems) with a cardinality greater than one and a
second set of sensors (e.g., consisting of a second single type
such as inertial navigation systems) also with a cardinality
greater than one.
[0047] At operation 410, a disagreement signal can be created
(e.g., generated) by calculating time correlated disagreements
between sensors in the first set of sensors, between sensors in the
second set of sensors, and between sensors in the first set of
sensors and the second set of sensors. Thus, intra-set
disagreements for both sets of sensors as well as inter-set
disagreements between the two sets are determined.
[0048] Sensor disagreements can be determined via a statistical
analysis of a common output by two sensors. In an example,
residuals between two sensors can be computed and subjected to the
statistical analysis. In an example, normality of the residuals
over time can be used to ascertain whether a disagreement exists.
In an example, the common output may be derived, such as a position
output by an inertial navigation system. In an example,
disagreements between sensors of the first set of sensors can be
calculated by measuring the normality of the residuals of satellite
measurements between two sensors. In an example, disagreements
between sensors of the second set of sensors can be calculated by
measuring the normality of the residuals of acceleration between
two sensors. In an example, disagreements between sensors of the
first set of sensors and the second set of sensors can be
calculated by measuring the normality of the residuals of position
between a sensor in the first set of sensors and a sensor in the
second set of sensors.
[0049] At operation 415, the disagreement signal can be sampled and
a determination that the sampled disagreement signal has an interim
arrival rate below a threshold can be made. As noted above,
disparate sensors may disagree at times by virtue of differing
operating parameters, quality, or other factors. However, when one
sensor is being manipulated, the frequency of disagreements rises,
resulting in a clustering of disagreements in time (e.g., as
illustrated in FIGS. 2A and 2B). In an example, the threshold is a
time period with magnitude determined via an inverse Gamma function
with a probability parameter, a sample-size parameter, and a
time-of-arrival parameter, the time-of-arrival parameter determined
via measurement of a sensor system during normative testing. Such a
threshold illustrates a period in which disagreement density is
beyond that of the system when it is not under attack.
[0050] At operation 420, an alarm can be provided in response to
determining that the sampled disagreement signal has an interim
arrival rate below a threshold. In an example, the alarm can
include identification of a sensor in the plurality of sensors
deemed to be compromised. As described above with respect to FIGS.
1 and 3, different sensor pairing structures can be used to make
this identification. In an example, the sensor is deemed to be
compromised when it disagrees with other sensors in the plurality
of sensors and the other sensors in the plurality of sensors agree
with each other. That is, an identification of a sensor that
disagrees with one or more other sensors where those other sensors
agree with each other.
[0051] FIG. 5 illustrates a block diagram of an example machine 500
upon which any one or more of the techniques (e.g., methodologies)
discussed herein may perform. In alternative embodiments, the
machine 500 may operate as a standalone device or may be connected
(e.g., networked) to other machines. In a networked deployment, the
machine 500 may operate in the capacity of a server machine, a
client machine, or both in server-client network environments. In
an example, the machine 500 may act as a peer machine in
peer-to-peer (P2P) (or other distributed) network environment. The
machine 500 may be a personal computer (PC), a tablet PC, a set-top
box (STB), a personal digital assistant (PDA), a mobile telephone,
a web appliance, a network router, switch or bridge, or any machine
capable of executing instructions (sequential or otherwise) that
specify actions to be taken by that machine. Further, while only a
single machine is illustrated, the term "machine" shall also be
taken to include any collection of machines that individually or
jointly execute a set (or multiple sets) of instructions to perform
any one or more of the methodologies discussed herein, such as
cloud computing, software as a service (SaaS), other computer
cluster configurations.
[0052] Examples, as described herein, may include, or may operate
by, logic or a number of components, or mechanisms. Circuit sets
are a collection of circuits implemented in tangible entities that
include hardware (e.g., simple circuits, gates, logic, etc.).
Circuit set membership may be flexible over time and underlying
hardware variability. Circuit sets include members that may, alone
or in combination, perform specified operations when operating. In
an example, hardware of the circuit set may be immutably designed
to carry out a specific operation (e.g., hardwired). In an example,
the hardware of the circuit set may include variably connected
physical components (e.g., execution units, transistors, simple
circuits, etc.) including a computer readable medium physically
modified (e.g., magnetically, electrically, moveable placement of
invariant massed particles, etc.) to encode instructions of the
specific operation. In connecting the physical components, the
underlying electrical properties of a hardware constituent are
changed, for example, from an insulator to a conductor or vice
versa. The instructions enable embedded hardware (e.g., the
execution units or a loading mechanism) to create members of the
circuit set in hardware via the variable connections to carry out
portions of the specific operation when in operation. Accordingly,
the computer readable medium is communicatively coupled to the
other components of the circuit set member when the device is
operating. In an example, any of the physical components may be
used in more than one member of more than one circuit set. For
example, under operation, execution units may be used in a first
circuit of a first circuit set at one point in time and reused by a
second circuit in the first circuit set, or by a third circuit in a
second circuit set at a different time.
[0053] Machine (e.g., computer system) 500 may include a hardware
processor 502 (e.g., a central processing unit (CPU), a graphics
processing unit (GPU), a hardware processor core, or any
combination thereof), a main memory 504 and a static memory 506,
some or all of which may communicate with each other via an
interlink (e.g., bus) 508. The machine 500 may further include a
display unit 510, an alphanumeric input device 512 (e.g., a
keyboard), and a user interface (UI) navigation device 514 (e.g., a
mouse). In an example, the display unit 510, input device 512 and
UI navigation device 514 may be a touch screen display. The machine
500 may additionally include a storage device (e.g., drive unit)
516, a signal generation device 518 (e.g., a speaker), a network
interface device 520, and one or more sensors 521, such as a global
positioning system (GPS) sensor, compass, accelerometer, or other
sensor. The machine 500 may include an output controller 528, such
as a serial (e.g., universal serial bus (USB), parallel, or other
wired or wireless (e.g., infrared (IR), near field communication
(NFC), etc.) connection to communicate or control one or more
peripheral devices (e.g., a printer, card reader, etc.).
[0054] The storage device 516 may include a machine readable medium
522 on which is stored one or more sets of data structures or
instructions 524 (e.g., software) embodying or utilized by any one
or more of the techniques or functions described herein. The
instructions 524 may also reside, completely or at least partially,
within the main memory 504, within static memory 506, or within the
hardware processor 502 during execution thereof by the machine 500.
In an example, one or any combination of the hardware processor
502, the main memory 504, the static memory 506, or the storage
device 516 may constitute machine readable media.
[0055] While the machine readable medium 522 is illustrated as a
single medium, the term "machine readable medium" may include a
single medium or multiple media (e.g., a centralized or distributed
database, and/or associated caches and servers) configured to store
the one or more instructions 524.
[0056] The term "machine readable medium" may include any medium
that is capable of storing, encoding, or carrying instructions for
execution by the machine 500 and that cause the machine 500 to
perform any one or more of the techniques of the present
disclosure, or that is capable of storing, encoding or carrying
data structures used by or associated with such instructions.
Non-limiting machine readable medium examples may include
solid-state memories, and optical and magnetic media. In an
example, a massed machine readable medium comprises a machine
readable medium with a plurality of particles having invariant
(e.g., rest) mass. Accordingly, massed machine-readable media are
not transitory propagating signals. Specific examples of massed
machine readable media may include: non-volatile memory, such as
semiconductor memory devices (e.g., Electrically Programmable
Read-Only Memory (EPROM), Electrically Erasable Programmable
Read-Only Memory (EEPROM)) and flash memory devices; magnetic
disks, such as internal hard disks and removable disks;
magneto-optical disks; and CD-ROM and DVD-ROM disks.
[0057] The instructions 524 may further be transmitted or received
over a communications network 526 using a transmission medium via
the network interface device 520 utilizing any one of a number of
transfer protocols (e.g., frame relay, internet protocol (IP),
transmission control protocol (TCP), user datagram protocol (UDP),
hypertext transfer protocol (HTTP), etc.). Example communication
networks may include a local area network (LAN), a wide area
network (WAN), a packet data network (e.g., the Internet), mobile
telephone networks (e.g., cellular networks), Plain Old Telephone
(POTS) networks, and wireless data networks (e.g., Institute of
Electrical and Electronics Engineers (IEEE) 802.11 family of
standards known as Wi-Fi.RTM., IEEE 802.16 family of standards
known as WiMax.RTM.), IEEE 802.15.4 family of standards,
peer-to-peer (P2P) networks, among others. In an example, the
network interface device 520 may include one or more physical jacks
(e.g., Ethernet, coaxial, or phone jacks) or one or more antennas
to connect to the communications network 526. In an example, the
network interface device 520 may include a plurality of antennas to
wirelessly communicate using at least one of single-input
multiple-output (SIMO), multiple-input multiple-output (MIMO), or
multiple-input single-output (MISO) techniques. The term
"transmission medium" shall be taken to include any intangible
medium that is capable of storing, encoding or carrying
instructions for execution by the machine 500, and includes digital
or analog communications signals or other intangible medium to
facilitate communication of such software.
Additional Notes
[0058] The above detailed description includes references to the
accompanying drawings, which form a part of the detailed
description. The drawings show, by way of illustration, specific
embodiments that may be practiced. These embodiments are also
referred to herein as "examples." Such examples may include
elements in addition to those shown or described. However, the
present inventors also contemplate examples in which only those
elements shown or described are provided. Moreover, the present
inventors also contemplate examples using any combination or
permutation of those elements shown or described (or one or more
aspects thereof), either with respect to a particular example (or
one or more aspects thereof), or with respect to other examples (or
one or more aspects thereof) shown or described herein.
[0059] All publications, patents, and patent documents referred to
in this document are incorporated by reference herein in their
entirety, as though individually incorporated by reference. In the
event of inconsistent usages between this document and those
documents so incorporated by reference, the usage in the
incorporated reference(s) should be considered supplementary to
that of this document; for irreconcilable inconsistencies, the
usage in this document controls.
[0060] In this document, the terms "a" or "an" are used, as is
common in patent documents, to include one or more than one,
independent of any other instances or usages of "at least one" or
"one or more." In this document, the term "or" is used to refer to
a nonexclusive or, such that "A or B" includes "A but not B," "B
but not A," and "A and B," unless otherwise indicated. In the
appended claims, the terms "including" and "in which" are used as
the plain-English equivalents of the respective terms "comprising"
and "wherein." Also, in the following claims, the terms "including"
and "comprising" are open-ended, that is, a system, device,
article, or process that includes elements in addition to those
listed after such a term in a claim are still deemed to fall within
the scope of that claim. Moreover, in the following claims, the
terms "first," "second," and "third," etc. are used merely as
labels, and are not intended to impose numerical requirements on
their objects.
[0061] The above description is intended to be illustrative, and
not restrictive. For example, the above-described examples (or one
or more aspects thereof) may be used in combination with each
other. Other embodiments may be used, such as by one of ordinary
skill in the art upon reviewing the above description. The Abstract
is to allow the reader to quickly ascertain the nature of the
technical disclosure and is submitted with the understanding that
it will not be used to interpret or limit the scope or meaning of
the claims. Also, in the above Detailed Description, various
features may be grouped together to streamline the disclosure. This
should not be interpreted as intending that an unclaimed disclosed
feature is essential to any claim. Rather, inventive subject matter
may lie in less than all features of a particular disclosed
embodiment. Thus, the following claims are hereby incorporated into
the Detailed Description, with each claim standing on its own as a
separate embodiment. The scope of the embodiments should be
determined with reference to the appended claims, along with the
full scope of equivalents to which such claims are entitled.
* * * * *