Vehicle platooning has emerged as a prominent Intelligent Transportation Systems (ITS) application due to its promise toward enabling high-speed movement of Connected Autonomous Vehicle (CAV) fleets in a close formation. This close formation is usually associated with stringent constraints such as a short and strictly bounded safety gaps between consecutive platoon vehicles. In order to meet these stringent specifications, CAV fleets critically depend on the underlying platoon communication protocols, which are vulnerable to various types of attacks that may be launched by an attacker. For instance, a common attack, namely False Data Injection (FDI) attack, can potentially disrupt and destabilize a platoon’s close formation by causing collisions among platoon vehicles, or causing potential traffic disruption due to platoon slowdown, thus making the platoon unsafe . One mechanism for mitigating an FDI attack can be the placement of uniformly separated Road-Side Units (RSUs) along the path of a vehicle platoon. The RSUs can act as the root of trust to detect and mitigate attack attempts. However, frequent RSU placements over a path can lead to prohibitive deployment costs. In this work, we first formulate a constraint optimization problem which aims to minimize RSU deployments along a path (by maximizing the inter-RSU distance), while ensuring that the safety of a platoon under a given FDI attack scenario is guaranteed. Our methodology outputs an RSU placement solution such that the worst-case attack (which spans the entire inter-RSU blind spot) is unable to violate the safety guarantee of the platoon. A platoon’s robustness, in the presence of state-of-the-art attack detectors and trusted RSUs, is defined by its resilience against possible stealthy FDI attacks in the inter-RSU blind spots. We leverage this concept and propose a novel SMT-based hierarchical solution strategy. Our method iteratively hypothesizes an inter-RSU distance and formally checks the safety of the resulting platooning solution against possible attack scenarios. The process terminates when the RSU deployment spacings can no longer be relaxed without violating safety constraints. We motivate this work through simulations in PLEXE. Our experimental results demonstrate that the method is able to minimize RSU deployments while preserving safety, under diverse real-world highway platooning scenarios.

Increasing interconnectivity in modern safety-critical cyber-physical systems (CPSs) renders them susceptible to attacks like false data injection (FDI). Due to computation and communication resource constraints, it is infeasible to encrypt all data exchanges in such systems. As the other alternative, the lightweight statistical detectors are system-agnostic in nature; attackers can launch stealthy FDI attacks with a high degree of sophistication. This research introduces an adaptive parameterisation method for stateful anomaly detectors to fill this security gap. The study includes a theoretical analysis for statistical evidence of stealthy data falsifications. The proposed adaptive detection framework has the capability to continuously observe the system’s behaviour in real time, with the goal of rapidly detecting FDI incidents using this statistical evidence. We propose a novel parameter tuning strategy to guarantee early detection of FDI attacks, keeping the false alarms to a minimum. Its efficacy is evaluated in CPS case studies from different domains and in an automotive Hardware-in-the-Loop (HIL) setup.

Modern cyber-physical systems (CPSs) employ an increasingly large number of software control loops to enhance their autonomous capabilities. Such large task sets and their dependencies may lead to deadline misses caused by platform-level timing uncertainties, resource contention, etc. To ensure the schedulability of the task set in the embedded platform in the presence of these uncertainties, there exist co-design techniques that assign task periodicities such that control costs are minimized. Another line of work exists that addresses the same platform schedulability issue by skipping a bounded number of control executions within a fixed number of control instances. Considering that control tasks are designed to perform robustly against delayed actuation (due to deadline misses, network packet drops etc.) a bounded number of control skips can be applied while ensuring certain performance margin. Our work combines these two control scheduling co-design disciplines and develops a strategy to adaptively employ control skips or update periodicities of the control tasks depending on their current performance requirements. For this we leverage a novel theory of automata-based control skip sequence generation while ensuring periodicity, safety and stability constraints. We demonstrate the effectiveness of this dynamic resource sharing approach in an automotive Hardware-in-loop setup with realistic control task set implementations.

Modern smart grids utilize advanced sensors and digital communication to manage the flow of electricity from generation source to consumption points. They also employ anomaly detection units and phasor measurement units (PMUs) for security and monitoring of grid behavior. However, as smart grids are distributed, vulnerability analysis is necessary to identify and mitigate potential security threats targeting the sensors and communication links. We propose a novel algorithm that uses measurement parameters, such as power flow or load flow, to identify the smart grid's most vulnerable operating intervals. Our methodology incorporates a Monte Carlo simulation approach to identify these intervals and deploys a deep reinforcement learning agent to generate attack vectors during the identified intervals that can compromise the grid's safety and stability in the minimum possible time, while remaining undetected by local anomaly detection units and PMUs. Our approach provides a structured methodology for effective smart grid vulnerability analysis, enabling system operators to analyze the impact of attack parameters on grid safety and stability and facilitating suitable design changes in grid topology and operational parameters.

Modern cyber-physical systems (CPSs) consist of numerous control units interconnected by communication networks. Each control unit is responsible for executing possibly multiple safety-critical and non-critical tasks in real time. Adversaries can exploit the deterministic behaviour maintained in such realtime systems to launch schedule-based attacks on safety-critical tasks. This paper aims to prevent the possibility of such timing inference-based side-channel attacks by executing safety-critical control tasks using a multi-rate schedule without hampering performance. With this strategy, we propose a novel attack-aware dynamic priority schedule randomization policy with the goal of success rate minimization of schedule-based attacks on safetycritical tasks.

Modern vehicles contain a multitude of electronic control units that implement software features controlling most of the operational, entertainment, connectivity, and safety aspects of the vehicle. However, with security requirements often being an afterthought in automotive software development, incorporation of such software features with intra- and inter-vehicular connectivity requirements often opens up new attack surfaces. Demonstrations of such security vulnerabilities in past reports and literature bring in the necessity to formally analyze how secure automotive control systems really are against adversarial attacks. Modern vehicles often incorporate onboard monitoring systems that test the sanctity of data samples communicated among controllers and detect possible attack/noise insertion scenarios. The performance of such monitors against security threats also needs to be verified. In this work, we outline a rigorous methodology for estimating the vulnerability of automotive CPSs. We provide a computer-aided design framework that considers the model-based representation of safety-critical automotive controllers and monitoring systems working in a closed loop with vehicle dynamics and verifies their safety and robustness w.r.t. false data injection attacks. Symbolically exploring all possible combinations of attack points of the input automotive CPS, the proposed framework tries to find out which sensor and/or actuation signal is vulnerable by generating stealthy and successful attacks using a formal method-based counter-example guided abstract refinement process. We also validate the efficacy of the proposed framework using a case study performed in an industry-scale simulator.

Recent developments in the smart mobility domain have transformed automobiles into networked transportation agents helping realize new age, large-scale intelligent transportation systems (ITS). The motivation behind such networked transportation is to improve road safety as well as traffic efficiency. In this setup, vehicles can share information about their speed and/or acceleration values among themselves and infrastructures can share traffic signal data with them. This enables the connected vehicles (CVs) to stay informed about their surroundings while moving. However, the inter-vehicle communication channels significantly broaden the attack surface. The inter-vehicle network enables an attacker to remotely launch attacks. An attacker can create collision as well as hamper performance by reducing the traffic efficiency. Thus, security vulnerabilities must be taken into consideration in the early phase of CVs' development cycle. To the best of our knowledge, there exists no such automated simulation tool using which engineers can verify the performance of CV prototypes in the presence of an attacker. In this work, we present an automated tool flow that facilitates false data injection attack synthesis and simulation on customizable platoon structure and vehicle dynamics. This tool can be used to simulate as well as design and verify control- theoretic light-weight attack detection and mitigation algorithms for CVs.

We present an ongoing work on countermeasure design against timing attacks specific to real-time safety-critical Cyber Physical Systems (CPS). Such attacks use timing side channels exposed due to worst-case response time based deterministic scheduling decisions. We propose a methodology to partially nullify this determinism by skipping certain control task executions and related data transmissions. As a proof of concept, we demonstrate how such strategic randomization makes it difficult to launch stealthy timing attacks on controller area network (CAN) based systems.

Increased dependence on networked, software-based control has escalated the vulnerabilities of Cyber-Physical Systems (CPSs). Detection and monitoring components developed leveraging dynamical systems theory are often employed as lightweight security measures for protecting such safety-critical CPSs against false data injection attacks. However, existing approaches do not correlate attack scenarios with parameters of detection systems. In this work, we propose real-time attack detection and mitigation strategies for safety-critical CPSs. A Reinforcement Learning (RL) based framework is presented which adaptively sets the parameters of such detectors based on experience learned from attack scenarios. The detection system is provided with a suitable training environment to learn how to maximize the detection rate while minimizing false alarms. Along with the objective of attack detection, our framework also attempts to preserve system performance by judiciously choosing control actions based on the operating region. Our proposed method i) mathematically establishes a detection strategy for fast and accurate FDI attack detection, ii) correlates the key parameters of the detection system by learning from attack scenarios, and iii) incorporates a real-time attack mitigation strategy that uses formally synthesized fast controllers, thus creating an end-to-end defense against FDI attacks for safety-critical CPSs. We evaluate our proposed method using wellknown safety-critical CPS examples.

We consider the problem of securing a given control loop implementation of a cyber-physical system (CPS) in the presence of Man-in-the-Middle attacks on data exchange between plant and controller over a compromised network. To this end, there exists various detection schemes which provide mathemat¬ical guarantees against such attacks for the theoretical control model. However, such guarantees may not hold for the actual control software implementation. In this article, we propose a formal approach towards synthesizing attack detectors with varying thresholds which can prevent performance degrading stealthy attacks while minimizing false alarms.