A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> CONCLUSIONS <s> While attacks on information systems have for most practical purposes binary outcomes (information was manipulated/eavesdropped, or not), attacks manipulating the sensor or control signals of Industrial Control Systems (ICS) can be tuned by the attacker to cause a continuous spectrum in damages. Attackers that want to remain undetected can attempt to hide their manipulation of the system by following closely the expected behavior of the system, while injecting just enough false information at each time step to achieve their goals. In this work, we study if attack-detection can limit the impact of such stealthy attacks. We start with a comprehensive review of related work on attack detection schemes in the security and control systems community. We then show that many of those works use detection schemes that are not limiting the impact of stealthy attacks. We propose a new metric to measure the impact of stealthy attacks and how they relate to our selection on an upper bound on false alarms. We finally show that the impact of such attacks can be mitigated in several cases by the proper combination and configuration of detection schemes. We demonstrate the effectiveness of our algorithms through simulations and experiments using real ICS testbeds and real ICS systems. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> CONCLUSIONS <s> Real-time crowdsourced maps such as Waze provide timely updates on traffic, congestion, accidents and points of interest. In this paper, we demonstrate how lack of strong location authentication allows creation of software-based Sybil devices that expose crowdsourced map systems to a variety of security and privacy attacks. Our experiments show that a single Sybil device with limited resources can cause havoc on Waze, reporting false congestion and accidents and automatically rerouting user traffic. More importantly, we describe techniques to generate Sybil devices at scale, creating armies of virtual vehicles capable of remotely tracking precise movements for large user populations while avoiding detection. We propose a new approach to defend against Sybil devices based on co-location edges, authenticated records that attest to the one-time physical co-location of a pair of devices. Over time, co-location edges combine to form large proximity graphs that attest to physical interactions between devices, allowing scalable detection of virtual vehicles. We demonstrate the efficacy of this approach using large-scale simulations, and discuss how they can be used to dramatically reduce the impact of attacks against crowdsourced mapping services. <s> BIB002
In this work, we introduced theoretical and practical contributions to the growing literature of physics-based attack detection in control systems. In particular, we provide a comprehensive taxonomy of related work and discuss general shortcomings we identified. We hope that by presenting multiple research papers in a unified way, we can motivate further discussion in this space and help other researchers develop the theoretical foundations, the language, and the tools to propose new attack models, or new metrics to address any limitations that our work may have. We also showed that in the literature there is a not a unified methodology to evaluate and compare different detection mechanisms. In particular, we argued that using true positive rates assumes that attacks will be detected, but a sophisticated attacker can spoof deviations that follow relatively close to the "physics" of the system (launch undetected attacks) while still driving the system to a different state. We introduced the evaluation metric proposed in Reference BIB001 that can be used to compare different attack detection strategies by quantifying the maximum impact an attack can cause while remaining undetected. This is fundamentally different than any metric that uses true positives. Had we used ROC curves for our attacks, we would have obtained a flat line along the x-axis, because we have 0% detection rate. We believe this metric is a fundamental change to the way intrusion detection systems can be evaluated in the control systems space and we encourage the research community to use this metric or propose new metrics that allow the comparison of previous and current detection mechanisms even in the presence of stealthy attacks. In all the systems we surveyed, the defender always assumed a fixed number of authenticated sensors and controllers, but an area that has been relatively unexplored in CPS is the concept of Sybil attacks, where attackers can create new sensors (and potentially controllers as well) to compete with honest sensor data. Sybil attacks can be particularly problematic in crowdsourced sensor data such as routing services like Waze BIB002 . As crowdsourcing becomes more prevalent in emerging CPS applications, Sybil attacks are a new type of attack that researchers will need to consider more in the future. Future Work. There are many challenges for future research. For example, closing the gap between IT and control systems to design better time-series models while taking into account communications networks limitations and extending physics-based anomaly detection in other domains, such as manufacturing and transportation. Most of our experiments considered an attacker that wants to remain undetected, but in practice an attacker might sacrifice detection for achieving a desired malicious objective. An additional area of future research is how to respond to alerts.