Cyber-physical system defense

• US 9,942,262 B1
• Filed: 03/17/2015
• Issued: 04/10/2018
• Est. Priority Date: 03/19/2014
• Status: Active Grant

• Current Assignee: University of Virginia Patent Foundation (University of Virginia)
• Original Assignee: University of Virginia Patent Foundation (University of Virginia)
• Inventors: Horowitz, Barry, Pulido, Joseph Vince, Jones, Rick A., Suhler, Edward C., Williams, Ronald Dean
• Primary Examiner(s): ZHAO, DON GORDON
• Application Number:
  US14/660,278
• Time in Patent Office: 1,120 Days
• CPC Class Codes: G01S 19/13 Receivers
• CPC Class Codes: G01S 19/49 whereby the further system is an inertial position system, e.g. loosely-coupled
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 4/38 for collecting sensor information
• CPC Class Codes: H04W 4/48 for in-vehicle communication
• CPC Class Codes: Y04S 40/18 Network protocols supporting networked applications, e.g. including control of end-device applications over a network

Abstract

System and techniques for cyber-physical system defense are described herein. Sensor disagreements between a plurality of sensors over time can be sampled. Cluster analysis on the sampled sensor disagreements can be performed. A deviation indication can be provided in response to the cluster analysis resulting in disagreement density beyond a threshold.

Claims

1. A system for cyber-physical system defense, the system comprising:

a sensor interface to receive sensor data from a plurality of sensors;

a sampling circuit set to sample sensor disagreements between the plurality of sensors over time;

a cluster circuit set to perform cluster analysis on the sampled sensor disagreements including the cluster circuit set to perform a cluster analysis algorithm to calculate a time period and determine whether a predetermined number of the sampled sensor disagreements occurred within the calculated time period, wherein the calculated time period is calculated via an inverse Gamma function with a probability parameter, a sample-size parameter, and a time-of-arrival parameter, the time-of-arrival parameter determined via measurement of a sensor system during normative testing; and

an alert circuit set to provide a deviation indication in response to the cluster analysis resulting in disagreement density beyond a threshold, the deviation indication including an alarm.

2. The system of claim 1, wherein to sample sensor disagreements between the plurality of sensors over time includes the sampling circuit set to:

obtain a first data set for a first sensor set;

obtain a second data set for a second sensor set; and

determine a disagreement between the first data set and the second data set.

3. The system of claim 2, wherein to determine the disagreement between the first data set and the second data set includes the sampling circuit set to:

combine the first data set with the second data set to create a measurement data set;

calculate a set of residuals for the measurement data set; and

determine that a mean for the residuals is beyond a threshold in relation to an expected mean for the residuals.

4. The system of claim 3, wherein the first sensor set and the second sensor set consist of members of a single type of sensor.

5. The system of claim 4, wherein the single type of sensor is a satellite navigation system.

6. The system of claim 5, wherein the set of residuals are differences between respective first satellite navigation system measurements in the first data set and second satellite navigation measurements in the second data set correlated in time.

7. The system of claim 4, wherein the single type of sensor is an inertial navigation system.

8. The system of claim 7, wherein the set of residuals are differences between respective first acceleration measurement in the first data set and second acceleration measurements in the second data set correlated in time.

9. The system of claim 3, wherein the first sensor set consist of members that are inertial navigation systems and the second sensor set consists of members that are satellite navigation systems.

10. The system of claim 9, wherein the set of residuals are differences between respective first position measurements in the first data set and second position measurements in the second data set correlated in time.

11. The system of claim 1, wherein to provide the deviation indication includes the alert circuit set to indicate a sensor from the plurality of sensors that is a source of the deviation.

12. The system of claim 11, wherein to indicate the sensor for the plurality of sensors that is the source of the deviation includes the alert circuit set to apply a decision tree to pairs of sensors in the plurality of sensors using disagreements in a dataset used in providing the deviation indication.

13. A non-transitory machine readable medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:

sampling sensor disagreements between a plurality of sensors over time;

performing cluster analysis on sampled sensor disagreements including;

performing a cluster analysis algorithm to calculate a time period; and

determining whether a predetermined number of the sampled sensor disagreements occurred within the calculated time period, wherein the calculated time period is calculated via an inverse Gamma function with a probability parameter, a sample-size parameter, and a time-of-arrival parameter, the time-of-arrival parameter determined via measurement of a sensor system during normative testing; and

providing a deviation indication in response to the cluster analysis resulting in disagreement density beyond a threshold, the deviation indication including an alarm.

14. The machine readable medium of claim 13, wherein sampling sensor disagreements between the plurality of sensors over time includes:

obtaining a first data set for a first sensor set;

obtaining a second data set for a second sensor set; and

determining a disagreement between the first data set and the second data set.

15. The machine readable medium of claim 14, wherein determining the disagreement between the first data set and the second data set includes:

combining the first data set with the second data set to create a measurement data set;

calculating a set of residuals for the measurement data set; and

determining that a mean for the residuals is beyond a threshold in relation to an expected mean for the residuals.

16. The machine readable medium of claim 15, wherein the first sensor set and the second sensor set consist of members of a single type of sensor.

17. The machine readable medium of claim 16, wherein the single type of sensor is a satellite navigation system.

18. The machine readable medium of claim 17, wherein the set of residuals are differences between respective first satellite navigation system measurements in the first data set and second satellite navigation measurements in the second data set correlated in time.

19. The machine readable medium of claim 16, wherein the single type of sensor is an inertial navigation system.

20. The machine readable medium of claim 19, wherein the set of residuals are differences between respective first acceleration measurement in the first data set and second acceleration measurements in the second data set correlated in time.

21. The machine readable medium of claim 15, wherein the first sensor set consist of members that are inertial navigation systems and the second sensor set consists of members that are satellite navigation systems.

22. The machine readable medium of claim 21, wherein the set of residuals are differences between respective first position measurements in the first data set and second position measurements in the second data set correlated in time.

23. The machine readable medium of claim 13, wherein providing the deviation indication includes indicating a sensor from the plurality of sensors that is a source of the deviation.

24. The machine readable medium of claim 23, wherein indicating the sensor for the plurality of sensors that is the source of the deviation includes applying a decision tree to pairs of sensors in the plurality of sensors using disagreements in a dataset used in providing the deviation indication.

25. A method for cyber-physical system defense, the method comprising:

sampling sensor disagreements between a plurality of sensors over time;

performing cluster analysis on sampled sensor disagreements including;

performing a cluster analysis algorithm to calculate a time period; and

determining whether a predetermined number of the sampled sensor disagreements occurred within the calculated time period, wherein the calculated time period is calculated via an inverse Gamma function with a probability parameter, a sample-size parameter, and a time-of-arrival parameter, the time-of-arrival parameter determined via measurement of a sensor system during normative testing; and

providing a deviation indication in response to the cluster analysis resulting in disagreement density beyond a threshold, the deviation indication including an alarm.

26. The method of claim 25, wherein sampling sensor disagreements between the plurality of sensors over time includes:

obtaining a first data set for a first sensor set;

obtaining a second data set for a second sensor set; and

determining a disagreement between the first data set and the second data set.

27. The method of claim 26, wherein determining the disagreement between the first data set and the second data set includes:

combining the first data set with the second data set to create a measurement data set;

calculating a set of residuals for the measurement data set; and

determining that a mean for the residuals is beyond a threshold in relation to an expected mean for the residuals.

28. The method of claim 27, wherein the first sensor set and the second sensor set consist of members of a single type of sensor.

29. The method of claim 28, wherein the single type of sensor is a satellite navigation system.

30. The method of claim 29, wherein the set of residuals are differences between respective first satellite navigation system measurements in the first data set and second satellite navigation measurements in the second data set correlated in time.

31. The method of claim 28, wherein the single type of sensor is an inertial navigation system.

32. The method of claim 31, wherein the set of residuals are differences between respective first acceleration measurement in the first data set and second acceleration measurements in the second data set correlated in time.

33. The method of claim 27, wherein the first sensor set consist of members that are inertial navigation systems and the second sensor set consists of members that are satellite navigation systems.

34. The method of claim 33, wherein the set of residuals are differences between respective first position measurements in the first data set and second position measurements in the second data set correlated in time.

35. The method of claim 25, wherein providing the deviation indication includes indicating a sensor from the plurality of sensors that is a source of the deviation.

36. The method of claim 35, wherein indicating the sensor for the plurality of sensors that is the source of the deviation includes applying a decision tree to pairs of sensors in the plurality of sensors using disagreements in a dataset used in providing the deviation indication.