In recent years, the security of automotive Cyber-Physical Systems (CPSs) is facing urgent threats due to the widespread use of legacy in-vehicle communication systems. As a representative legacy bus system, the Controller Area Network (CAN) hosts Electronic Control Units (ECUs) that are crucial for the vehicles functioning. In this scenario, malicious actors can exploit the CAN vulnerabilities, such as the lack of built-in authentication and encryption schemes, to launch CAN bus attacks (e.g., suspension, injection, and masquerade attacks) with life-threatening consequences (e.g., disabling brakes). In this article, we present TACAN (Transmitter Authentication in CAN), which provides secure authentication of ECUs on the legacy CAN bus by exploiting thecovert channels, without introducing CAN protocol modifications or traffic overheads (no extra bits or CAN messages are used). TACAN turns upside-down the originally malicious concept of covert channels and exploits it to build an effective defensive technique that facilitates transmitter authentication via a centralized, trusted Monitor Node. TACAN consists of three different covert channels for ECU authentication: 1) the Inter-Arrival Time (IAT)-based, leveraging the IATs of CAN messages; 2) the Least Significant Bit (LSB)-based, concealing authentication messages into the LSBs of normal CAN data; and 3) a hybrid covert channel, exploiting the combination of the first two. In order to validate TACAN, we implement the covert channels on the University of Washington (UW) EcoCAR (Chevrolet Camaro 2016) testbed. We further evaluate the bit error, throughput, and detection performance of TACAN through extensive experiments using the EcoCAR testbed and a publicly available dataset collected from Toyota Camry 2010. We demonstrate the feasibility of TACAN and the effectiveness of detecting CAN bus attacks, highlighting no traffic overheads and attesting the regular functionality of ECUs.

This paper presents a new masquerade attack called the cloaking attack and provides formal analyses for clock skew-based intrusion detection systems (IDSs) that detect masquerade attacks in the controller area network (CAN) in automobiles. In the cloaking attack, the adversary manipulates the message inter-transmission times of spoofed messages by adding delays so as to emulate a desired clock skew and avoid detection. In order to predict and characterize the impact of the cloaking attack in terms of the attack success probability on a given CAN bus and IDS, we develop formal models for two clock skew-based IDSs, i.e., the state-of-the-art (SOTA) IDS and its adaptation to the widely used network time protocol (NTP), using parameters of the attacker, the detector, and the hardware platform. To the best of our knowledge, this is the first paper that provides formal analyses of clock skew-based IDSs in automotive CAN. We implement the cloaking attack on two hardware testbeds, a prototype and a real vehicle (the University of Washington EcoCAR), and demonstrate its effectiveness against both the SOTA and NTP-based IDSs. By comparing each predicted attack success probability curve against its experimental curve, we find that the average prediction error is within 3.0% for the SOTA IDS and 5.7% for the NTP-based IDS.

Submodular maximization enables efficient approximation of machine learning, networking, and language processing problems. Typically, these problems have been shown to have matroid constraints, which generalize matching and partition conditions. Developing scalable, distributed submodular optimization algorithms that guarantee the same performance as centralized techniques has been an active area of research. In this paper, we address the problem of developing scalable distributed algorithms for submodular maximization with a matroid constraint. Our key step is to construct an auxiliary function from the submodular objective function, and develop distributed exchange-based algorithms for optimizing the auxiliary function. We first introduce a distributed algorithm for maximizing a submodular function with a matroid constraint. We then develop an algorithm for maximizing time-varying submodular functions under partition matroid constraints, which arises in sensor placement and data caching. We prove that both algorithms provide (1-1/e) optimality bounds, and hence achieve the same guarantees as the best centralized algorithms.

Maximization of submodular set functions arises in wireless applications such as scheduling, caching, and leader selection. For a centralized entity with oracle access to the submodular function, submodular maximization can be approximated up to a constant factor using polynomial-time algorithms; such an entity, however, may be unavailable in decentralized wireless networks. In this paper, we consider maximization of a time-varying submodular function by distributed, resource-constrained nodes. We present algorithms for unconstrained distributed submodular maximization, as well as monotone submodular maximization subject to cardinality constraints. For the unconstrained submodular maximization problem, our algorithm achieves an expected optimality gap of 1/3. For cardinality-constrained submodular maximization, our algorithm achieves an expected optimality gap of 1/2, while reducing the storage and communication overhead, as well as the computation requirements of the nodes, compared to existing techniques. We evaluate our approach through an experimental study using sensor scheduling data, and find that our approach is within ten percent of the best achievable utility in the unconstrained case and within five percent in the constrained case.

In this paper, we study distributed algorithms for detecting cloned nodes in wireless sensor networks. We consider the impact of leaving undetected cloned nodes in the network, as well as the communication cost and the storage cost incurred by each algorithm. We develop an optimization framework for choosing clone detection parameters based on these costs and analyze existing detection schemes using the developed framework. Simulations are provided to validate the methodology.

The main contribution of this letter is the derivation of a steepest gradient descent learning rule for a multilayer network of theta neurons, a one-dimensional nonlinear neuron model. Central to our model is the assumption that the intrinsic neuron dynamics are sufficient to achieve consistent time coding, with no need to involve the precise shape of postsynaptic currents; this assumption departs from other related models such as SpikeProp and Tempotron learning. Our results clearly show that it is possible to perform complex computations by applying supervised learning techniques to the spike times and time response properties of nonlinear integrate and fire neurons. Networks trained with our multilayer training rule are shown to have similar generalization abilities for spike latency pattern classification as Tempotron learning. The rule is also able to train networks to perform complex regression tasks that neither SpikeProp or Tempotron learning appears to be capable of.

Commercial aviation is at the threshold of the era of the e-enabled airplane, brought about by the convergence of rapidly expanding worldwide data communication infrastructures, network-centric information processing, and commoditized lightweight computational hardware. With advanced avionics, processing, and wireless communication capabilities, the e-enabled airplane can revolutionize the current air transportation system. However, the use of unregulated information technology and wireless technologies introduces vulnerabilities that can be exploited to provide unauthorized access to the onboard aviation information systems and impede their operation. The emerging security threats are not covered by current aviation guidance, and regulations, hence, remain to be addressed. This paper presents a comprehensive survey of security of the e-enabled airplane with applications such as electronic distribution of loadable software and data, as well as future directions such as wireless health monitoring, networked control, and airborne ad hoc networks.

In this paper, we train a one-layer Theta Neuron Network (TNN) to perform a Braitenberg obstacle avoidance algorithm on a Khepera robot. The Theta neuron model is more biologically plausible than the leaky integrate and fire model typically used in Spiking Neural Networks. Our motivation is to determine if the dynamical properties of the theta neuron model can be leveraged to increase the noise robustness in an embedded application. We compare Khepera obstacle avoidance results with traditional Artificial Neural Network and TNN implementations under different levels of sensor noise. As the noise increases, the performance of the TNN is the least affected. At high noise levels, the ANN and Braitenberg implementations calculate the incorrect turn direction 42% more often than the TNN and deviate from a straight path trajectory over 10 times as far. The results demonstrate that TNNs warrants further development for engineering applications.

In this paper we develop and analyze Spiking Neural Network (SNN) versions of Resilient Propagation (RProp) and QuickProp, both training methods used to speed up training in Artificial Neural Networks (ANNs) by making certain assumptions about the data and the error surface. Modifications are made to both algorithms to adapt them to SNNs. Results generated on standard XOR and Fisher Iris data sets using the QuickProp and RProp versions of SpikeProp are shown to converge to a final error of 0.5 - an average of 80% faster than using SpikeProp on its own.

This research effort is an investigation into communication activity in a distributed set of software agents. Agents exist in a predator-prey environment. Movements of prey agents are evolved upon a Mamdani type fuzzy inference system. Probabilistic predation and starvation forces, along with simulated communication activity act upon agents, causing them to cluster. Examined here is the correlation between mean cluster size after the population has sufficiently evolved, versus the average agent communication activity. Communication activity creates a loyalty to remain in a cluster for security rather than to change cluster membership. A mean r/sup 2/ correlation of 0.87 was observed with this system, thus lending credence to our hypothesis.

This paper examines the kinematic model of an autonomous mobile robot system consisting of a chain of steerable cars and passive trailers, linked together with rigid bars. The state space and kinematic equations of the system are defined, and it is shown how these kinematic equations may be converted into a multiinput chained form. The advantages of the chained form are that many methods are available for the open-loop steering of such systems as well as for point-stabilization; some of these methods are discussed here. Dynamic state feedback is used to convert the system to this multiinput chained form. It is shown how the dynamic state feedback that is used in this paper corresponds to adding, in front of the steerable cars, a chain of virtual axles which diverges from the original chain of trailers. Two different example systems are also presented, along with simulation results for a parallel-parking maneuver.