Open Collections

CORGIDS : a correlation-based generic intrusion detection system

University of British Columbia

Cyber-Physical Systems (CPS) consist of software and physical components which collaborate and interact with each other continuously. CPS deployed in security critical scenarios such as medical devices, autonomous cars, and smart homes have been targets of security attacks due to their safety-critical nature and relative lack of protection. Anomaly-based Intrusion Detection System (IDS) using data, temporal, and logical correlations have been proposed in the past. But none of the approaches except the ones using logical correlations take into account the main ingredient in the operation of CPS, namely the use of physical properties. On the other hand, IDS that use physical properties either require the developer to define invariants manually or have designed their IDS for a specific CPS. This study proposes a Correlation-based Generic Intrusion Detection System (CORGIDS), a generic IDS capable of detecting security attacks by inferring the logical correlations of the physical properties of a CPS, and checking if they adhere to the predefined framework. A CORGIDS-based prototype is built and used for detecting attacks on two example CPSs - Unmanned Aerial Vehicle (UAV) and Smart Artificial Pancreas (SAP). It is found that CORGIDS achieves a precision of 95.70%, and a recall of 87.90%, while detecting attacks with modest memory and performance overheads.

Text

2019-04-17

Attribution-NonCommercial-NoDerivatives 4.0 International

http://hdl.handle.net/2429/69740

Electrical and Computer Engineering

University of British Columbia

UBCV

http://creativecommons.org/licenses/by-nc-nd/4.0/