Title
ARTINALI: dynamic invariant detection for cyber-physical system security
Abstract
Cyber-Physical Systems (CPSes) are being widely deployed in security critical scenarios such as smart homes and medical devices. Unfortunately, the connectedness of these systems and their relative lack of security measures makes them ripe targets for attacks. Specification-based Intrusion Detection Systems (IDS) have been shown to be effective for securing CPSs. Unfortunately, deriving invariants for capturing the specifications of CPS systems is a tedious and error-prone process. Therefore, it is important to dynamically monitor the CPS system to learn its common behaviors and formulate invariants for detecting security attacks. Existing techniques for invariant mining only incorporate data and events, but not time. However, time is central to most CPS systems, and hence incorporating time in addition to data and events, is essential for achieving low false positives and false negatives. This paper proposes ARTINALI, which mines dynamic system properties by incorporating time as a first-class property of the system. We build ARTINALI-based Intrusion Detection Systems (IDSes) for two CPSes, namely smart meters and smart medical devices, and measure their efficacy. We find that the ARTINALI-based IDSes significantly reduce the ratio of false positives and false negatives by 16 to 48% (average 30.75%) and 89 to 95% (average 93.4%) respectively over other dynamic invariant detection tools.
Year
DOI
Venue
2017
10.1145/3106237.3106282
ESEC/SIGSOFT FSE
Keywords
Field
DocType
Multi-dimensional model,Security,Cyber Physical System,CPS,Software Engineering
Social connectedness,Computer security,Computer science,Real-time computing,Cyber physical system security,Cyber-physical system,Invariant (mathematics),False positives and false negatives,Intrusion detection system
Conference
ISBN
Citations 
PageRank 
978-1-4503-5105-8
1
0.35
References 
Authors
25
4