Abstract:The continuing proliferation of Cyber Physical Systems (CPSs), those that integrate electronic control circuitry with a mechanical system allowing software commands to affect the physical world, while allowing for new efficiencies and convenience, also facilitates new security risks. While the cyber-domain components of a CPS control the behavior of the physical-domain components, attacks on either the physical-domain or cyber-domain can be used to control or subvert the CPS in ways that may cause serious harm or even loss of life. Unfortunately, most research in CPS attack detection has focused solely on monitoring the cyber domain for malicious software activity, and the few works that do monitor the physical domain neglect or independently monitor the cyber domain. With that in mind, this paper proposes a method of jointly monitoring both domains (cyber and physical) of a CPS, verifying not only that software commands are faithfully executed by the cyber-components of the CPS, but also that the physical-domain behavior of the CPS corresponds to those commands. We demonstrate the effectiveness of this approach through experiments using a medical CPS device subjected to both cyber and physical attacks. We show that different analog side channels (EM and acoustic in our experiments) are similarly effective for such monitoring and attack detection. We also show that, while some attacks can be detected through physical-domain monitoring alone or through cyber-domain monitoring alone, our joint monitoring of both domains allows for the detection of additional attacks that cannot be detected by monitoring only one of the domains, resulting in >99% attack detection accuracy measured over 1,000 instances of CPS activity.

Heterogeneous Runtime Verification of Safety Critical Cyber Physical Systems

STPA-driven Multilevel Runtime Monitoring for In-time Hazard Detection

Verified Runtime Validation for Partially Observable Hybrid Systems

Runtime Protection of Real-time Critical Control Applications against Known Threats

Scalable Security Enforcement for Cyber Physical Systems

You Can't Always Check What You Wanted: Selective Checking and Trusted Execution to Prevent False Actuations in Cyber-Physical Systems

Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System

Toward Online Hybrid Systems Model Checking of Cyber-Physical Systems' Time-Bounded Short-Run Behavior

Tracking Real-time Anomalies in Cyber-Physical Systems Through Dynamic Behavioral Analysis

Design and Implementation of Runtime Verification Framework for Cyber-Physical Production Systems

Unified Graphical Co-modelling, Analysis and Verification of Cyber-physical Systems by Combining AADL and Simulink/Stateflow

Model-based Runtime Verification Framework

Technical-Report: Automating Recoverability Proofs for Cyber-Physical Systems with Runtime Assurance Architectures

Resilient Cyberphysical Systems and their Application Drivers: A Technology Roadmap

Runtime Verification for Trustworthy Computing

SCOPE: Secure Compiling of PLCs in Cyber-Physical Systems

CPS Engineering: Gap Analysis and Perspectives

A Survey of Algorithms for Black-Box Safety Validation of Cyber-Physical Systems

Realizing a fault-tolerant embedded controller on distributed real-time systems

Securing CPS Through Simultaneous Analog Side-Channel Monitoring of Cyber and Physical Domains

Cyber-Physical Systems Security -- A Survey