Cyber-physical intrusion detection for robotic vehicles

Intrusion detection systems (IDS) designed for conventional computer systems and networks are not necessarily suitable for mobile cyber-physical systems (CPS), such as robots, drones and automobiles. They tend to be geared towards attacks of different nature and do not take into account mobility, energy consumption and other physical aspects that are vital to a mobile cyber-physical system. This work provides two different approaches for addressing the problem of detecting attacks against vehicles, using a small-scale robotic vehicle as a testbed. The first approach is based on decision trees and the second on deep learning. Both use a combination of cyber and physical features that can be measured by its onboard systems and processes. Experimental evaluation on a variety of scenarios involving denial of service, command injection and two different types of malware infections demonstrated the feasibility of the approaches. Decision tree algorithm is one of the most lightweight machine learning techniques, yet sufficiently powerful in many areas of applications, because it can naturally account for non-linearities in the data. Decision trees produce sets of simple rules, which can be easily checked onboard even the most resource-constrained of robotic vehicles. In the case of our vehicle, this approach was able to achieve high accuracy rate for denial of service attacks, but less so for the other attacks tested. Due to their processing resource constraints, cyber-physical systems, such as robotic vehicles, tend to be limited to lightweight mechanisms, such as decision trees and other statistical machine learning techniques. We show that considerably higher accuracy rates can be achieved if one utilises techniques from the field of deep learning. In particular, we use a recurrent neural network architecture, benefiting from a long short-term memory layer, which is highly appropriate for real-time data. To address the processing limitations, we turn to computational offloading, which is a technique particularly common for mobile devices, for largely the same reasons: to save energy and to have access to greater processing resources. We show both experimentally and mathematically in which cases offloading the periodic task of deep learning based intrusion detection to a remote server can be practical, especially in relation to the time the whole process takes.