Radoslav Ivanov

Sensor attack detection in the presence of transient faults

This paper addresses the problem of detection and identification of sensor attacks in the presence of transient faults. We consider a system with multiple sensors measuring the same physical variable, where some sensors might be under attack and provide malicious values. We consider a setup, in which each sensor provides the controller with an interval of possible values for the true value. While approaches exist for detecting malicious sensor attacks, they are conservative in that they treat attacks and faults in the same way, thus neglecting the fact that sensors may provide faulty measurements at times due to temporary disturbances (e.g., a tunnel for GPS). To address this problem, we propose a transient fault model for each sensor and an algorithm designed to detect and identify attacks in the presence of transient faults. The fault model consists of three aspects: the size of the sensors interval (1) and an upper bound on the number of errors (2) allowed in a given window size (3). Given such a model for each sensor, the algorithm uses pairwise inconsistencies between sensors to detect and identify attacks. In addition to the algorithm, we provide a framework for selecting a fault model for each sensor based on training data. Finally, we validate the algorithms performance on real measurement data obtained from an unmanned ground vehicle.

Attack-Resilient Sensor Fusion for Safety-Critical Cyber-Physical Systems

This article focuses on the design of safe and attack-resilient Cyber-Physical Systems (CPS) equipped with multiple sensors measuring the same physical variable. A malicious attacker may be able to disrupt system performance through compromising a subset of these sensors. Consequently, we develop a precise and resilient sensor fusion algorithm that combines the data received from all sensors by taking into account their specified precisions. In particular, we note that in the presence of a shared bus, in which messages are broadcast to all nodes in the network, the attacker’s impact depends on what sensors he has seen before sending the corrupted measurements. Therefore, we explore the effects of communication schedules on the performance of sensor fusion and provide theoretical and experimental results advocating for the use of the Ascending schedule, which orders sensor transmissions according to their precision starting from the most precise. In addition, to improve the accuracy of the sensor fusion algorithm, we consider the dynamics of the system in order to incorporate past measurements at the current time. Possible ways of mapping sensor measurement history are investigated in the article and are compared in terms of the confidence in the final output of the sensor fusion. We show that the precision of the algorithm using history is never worse than the no-history one, while the benefits may be significant. Furthermore, we utilize the complementary properties of the two methods and show that their combination results in a more precise and resilient algorithm. Finally, we validate our approach in simulation and experiments on a real unmanned ground robot.

Early detection of critical pulmonary shunts in infants

This paper aims to improve the design of modern Medical Cyber Physical Systems through the addition of supplemental noninvasive monitors. Specifically, we focus on monitoring the arterial blood oxygen content (CaO2), one of the most closely observed vital signs in operating rooms, currently measured by a proxy -- peripheral hemoglobin oxygen saturation (SpO2). While SpO2 is a good estimate of O2 content in the finger where it is measured, it is a delayed measure of its content in the arteries. In addition, it does not incorporate system dynamics and is a poor predictor of future CaO2 values. Therefore, as a first step towards supplementing the usage of SpO2, this work introduces a predictive monitor designed to provide early detection of critical drops in CaO2 caused by a pulmonary shunt in infants. To this end, we develop a formal model of the circulation of oxygen and carbon dioxide in the body, characterized by unknown patient-unique parameters. Employing the model, we design a matched subspace detector to provide a near constant false alarm rate invariant to these parameters and modeling uncertainties. Finally, we validate our approach on real-patient data from lung lobectomy surgeries performed at the Childrens Hospital of Philadelphia. Given 198 infants, the detector predicted 81% of the critical drops in CaO2 at an average of about 65 seconds earlier than the SpO2-based monitor, while achieving a 0.9% false alarm rate (representing about 2 false alarms per hour).

Parameter-Invariant Design of Medical Alarms

In this tutorial, we present a design methodology for medical parameter-invariant monitors. We begin by providing a motivational review of currently employed medical alarm techniques, followed by the introduction of the parameter-invariant design approach. Finally, we present a case study example to demonstrate the design of a parameter-invariant alarm for critical shunt detection in infants during surgical procedures.

Resilient multidimensional sensor fusion using measurement history

This work considers the problem of performing resilient sensor fusion using past sensor measurements. In particular, we consider a system with n sensors measuring the same physical variable where some sensors might be attacked or faulty. We consider a setup in which each sensor provides the controller with a set of possible values for the true value. Here, more precise sensors provide smaller sets. Since a lot of modern sensors provide multidimensional measurements (e.g. position in three dimensions), the sets considered in this work are multidimensional polyhedra. Given the assumption that some sensors can be attacked or faulty, the paper provides a sensor fusion algorithm that obtains a fusion polyhedron which is guaranteed to contain the true value and is minimal in size. A bound on the volume of the fusion polyhedron is also proved based on the number of faulty or attacked sensors. In addition, we incorporate system dynamics in order to utilize past measurements and further reduce the size of the fusion polyhedron. We describe several ways of mapping previous measurements to current time and compare them, under different assumptions, using the volume of the fusion polyhedron. Finally, we illustrate the implementation of the best of these methods and show its effectiveness using a case study with sensor values from a real robot.

Demo Abstract: ROSLab --- A Modular Programming Environment for Robotic Applications

We propose a simplified high-level programming language based on blocks and links dragged on a workspace which generates the skeleton code for robotic applications involving different types of robots. In order to develop such a high-level programming language that still can guarantee flexibility in term of implementation, our approach takes advantage of the robot operating system (ROS). ROS is a open source meta-operating system that provides a message passing structure between different processes (or nodes) across a network (inter-process communication). In our framework, we consider a hierarchical approach in which at the base there is ROS that allows inter-process communication between nodes in a robot and on the top we create a high-level language that interacts with ROS and thus with the real robot. The high-level language can be viewed as an extra layer added to simplify lower level code generation.

Contract-based blame assignment by trace analysis

Fault diagnosis in networked systems has been an extensively studied field in systems engineering. Fault diagnosis generally includes the tasks of fault detection and isolation, and optionally recovery (FDIR). In this paper we further consider the blame assignment problem: given a system trace on which a system failure occurred and an identified set of faulty components, determine which subsets of faulty components are the culprits for the system failure. We provide formal definitions of the notion culprits and the blame assignment problem, under the assumptions that only one system trace is given and the system cannot be rerun. We show that the problem is equivalent to deciding the unsatisfiability of a set of logical constraints on component behaviors, and present the transformation from a blame assignment instance into an instance of unsatisfiability checking. We also apply the approach to a case study in the medical device interoperability scenario that has motivated our work.

Cloud-Based Secure Logger for Medical Devices

A logger in the cloud capable of keeping a secure, time-synchronized and tamper-evident log of medical device and patient information allows efficient forensic analysis in cases of adverse events or attacks on interoperable medical devices. A secure logger as such must meet requirements of confidentiality and integrity of message logs and provide tamper-detection and tamper-evidence. In this paper, we propose a design for such a cloud-based secure logger using the Intel Software Guard Extensions (SGX) and the Trusted Platform Module (TPM). The proposed logger receives medical device information from a dongle attached to a medical device. The logger relies on SGX, TPM and standard encryption to maintain a secure communication channel even on an untrusted network and operating system. We also show that the logger is resilient against different kinds of attacks such as Replay attacks, Injection attacks and Eavesdropping attacks.

Prediction of Critical Pulmonary Shunts in Infants

As a first step toward the development of closed-loop medical cyber-physical systems, this paper presents a monitor for blood oxygen concentration that predicts critical drops in oxygen levels caused by pulmonary shunts in infants. Although blood oxygen concentration is one of the most closely monitored vital signs in modern operating rooms, it cannot be measured noninvasively and is currently monitored by a time-delayed proxy-the hemoglobin oxygen saturation. To predict sharp drops in blood oxygen concentration, we employ available noninvasive respiratory measurements and build a parameterized physiological model of the circulation of these gases through the cardiopulmonary system. Since the model parameters (e.g., metabolic rate) are unknown and vary greatly across patients, we utilize a parameter-invariant detector designed to provide a constant false alarm rate for different patients regardless of the values of the parameters and robust to missing measurements. Finally, we evaluate the performance of the detector on real patient data collected during surgeries performed at the Childrens Hospital of Philadelphia. As evaluated on 61 patients experiencing a drop in blood oxygen concentration, the detector achieves a detection rate of about 85% with a potentially life-saving early warning of 90 s on average. In addition, it achieves a false alarm rate of 0.95 false alarms per hour (about 0.5% of the tests) across 314 patients who did not experience a pulmonary shunt.

Adaptive Transient Fault Model for Sensor Attack Detection

This paper considers the problem of sensor attack detection for multiple operating mode systems, building upon an existing attack detection method that uses a transient fault model with fixed parameters. For a multiple operating mode system, the existing method would have to use the most conservative model parameters to preserve the soundness in attack detection, thus not being effective in attack detection for some operating modes. To address this problem, we propose an adaptive transient fault model to use the appropriate parameter values in accordance with the change of the operating mode of the system. The benefit of our proposed system is demonstrated using real measurement data obtained from an unmanned ground vehicle.