Modern and legacy cyber-physical systems produce logs of operational behavior from sensors to network trafic; analyzing these heterogeneous logs to consistently identify attack signals is a dificult problem. In this work, we propose a flexible temporal non-parametric Bayesian framework for identifying these attacks based on sticky Hierarchical Dirichlet Process Hidden Markov Model (sHDP-HMM). The advantage of this approach is that it does not require detailed information on the system architecture, and it works for systems with unknown multimodal behavior, yielding interpretable inference. We demonstrate the eficacy of this framework for accurate identification of attacks from cyber and physical attack vectors on two diferent CPS: an avionics testbed and a consumer robot.
Physical attacks form an important category of attacks on a cyber-physical system (CPS),
for which the controller software manages the operations of a physical process using
sensors and actuators [
Ruf et al. [
To address this dificulty, we propose a machine learning approach that will learn
this “concept of normalcy” from operational data. Because the methods and efects
of adversaries are constantly evolving, the approach is unsupervised and is not fit to
historical instances of attacks. Several unsupervised approaches to attack detection have
been proposed previously [
Most CPSs exhibit distinct operational behavior at diferent points in time that we
refer to as modes. Whether an event is anomalous may depend entirely on the context
provided by the mode of the system. For example, an aircraft may have the modes of
take-of, cruising, and landing, and an action such as lowering the landing gear may
be an anomaly while cruising but not while landing. The unknown of the system’s
mode and the dependency of the detection to these modes have motivated the approach
proposed in this work. This work addresses the central challenge for attack detection
where the system’s current mode, number of total modes, and number of attacks are all
unknown. In comparison, frameworks, such as finite state space filters, that presuppose
this knowledge produce inaccurate results when these inputs are misspecified, see [
Another motivating problem for this work is the need for flexible solutions that
assimilate many heterogeneous forms of data streams. The time-series data recorded by
CPSs may contain variables that are interval, e.g., location; ratio, e.g., altitude; ordinal,
e.g., floor numbers; or nominal, e.g., commands [
The primary goal of the attack detection algorithm is to segment the periods of attack
from periods of normal behavior, by accurately determining the beginning and the end
of each attack present [
Our contributions through this work are the following. First, we present a novel sticky Hierarchical Dirichlet Process Hidden Markov Model (sHDP-HMM) based framework and the associated inference algorithm for attack detection that is capable of detecting attacks reflected in multimodal and multivariate operational data of mixed continuous and categorical type.
Second, we evaluate this framework over experimental physical and cyber attacks
conducted on two operational systems using a novel set of metrics. First, we analyzed
MIL-STD-1553 bus logs from an avionics testbed subject to a variety of attacks [
The rest of the sections are as follows. The next section discusses related work. Section 3 contains our sHDP-HMM framework for attack detection, followed by Section 4 which defines how temporal attack detection sequences are evaluated. Section 5 discusses the experiments with the avionics testbed, and Section 6 discusses the experiments with a consumer robot. Finally, Section 7 concludes this paper and discusses future work.
The problem of anomaly detection in CPS under adversarial conditions has seen prolific
research contributions as recent surveys indicate [
Teh et al. introduced the Hierarchical Dirichlet Process Hidden Markov Model (HDPHMM) in [22]. Linderman et al. applied the HDP-HMM approach to study neural activity in rodents [23]. Blei et al. applied the HDP-HMM to application of topic modeling [24]. Fox et. al. observed that the original HDP-HMM formulation lacked stability for the latent state and introduced spurious transitions. The authors proposed remedying this problem through the introduction of an explicit self-transition parameter , formulating the sticky HDP-HMM (sHDP-HMM) model [25]. The sHDP-HMM was applied by Wu et al. to the application of monitoring in robotics [26].
More recently, the sHDP-HMM model has been applied to attack detection in avionics safety by Li et al. [27]. In their application, the authors analyze Automatic Dependent Surveillance - Broadcast (ADS-B) data with features such as longitude, latitude, altitude, and velocity and contrast latent state sequences against historical normal sequences to identify attacks. Our analysis also uses the sHDP-HMM approach, though we also incorporate continuous variable values and symbolic values from the captured system logs. Further, in contrast to their work, wherein the authors demonstrate the eficacy of attack detection using directly inserted anomalies into the operational logs, anomalies used to evaluate the methods in this work are captured by sensors in physical and communications layers.
Feedback control modeling of the physical dynamics of CPS has previously been
considered in [
In this work, the notation | is used to describe the distribution of the quantity conditioned on or given a parameter ; if is the data, | describes how the data is being generated given a set of parameters describing the observation process. In Bayesian hiearchical modeling, itself is considered a random quantity and in a hierarchical fashion there maybe a model describing its realization from a population | governed by the parameter . Wherein the quantity P( | ) is referenced, it is the density function of the distribution | .
For a random time series, refers to the random series at the point in time , whereas : refers to the entire collection between and including the points and and − refers to the entire collection (from times 1 to ) excluding the point at time . The superscript in ( ) refers to diferent realizations or replications of , identical in distribution.
In this work, the notion of a state is referenced, which is typically indexed over . , refers to the transition probability from to and , · refers to the array of transition probabilities from state (summing to one) and ·, refers to the array of transition probabilities from state (not necessarily summing to one). In this work, refers to the random state at time and denotes the specific state, for instance { = } is the event that the system at time is in state .
The operational behavior of a CPS may exhibit time varying modes. Our framework described in this section models operational behavior as latent states in a Hidden Markov model (HMM). The interest of this analysis is the identification of abnormal transitions between these latent states and potential identification of emergent anomalous behavior or new latent states during attack events. The latent states in normal operations may correspond to physical operational modes, but further research is needed to understand the nature of such correspondence. We hypothesize that under attack, the system may visit a non-finite number of novel latent states indicating anomalies. Figure 1 shows the transformation of a transition matrix of latent states under attacks in the avionics testbed described in Section 5.
We utilize the first order HMM model to identify these transitions between latent states. Because of the lack of identifiability of the number of latent states, we adopt the ∞ ∞ (a) State transition probability matrix(b) State transition probability matrix for normal operation under attack latent state of the system at time , which we label as and consequently assume that the data is generated according to a member of a collection Θ - , we perform Bayesian inference to partition or cluster the data and estimate parameters.
We briefly review now the sHDP-HMM formulation by Fox et al. [ 25]. The HDP-HMM contains a global Dirichlet process (DP) ( ) where is a concentration parameter and
is a base measure. With , the GEM (Grifiths, Engen, and McCloskey) model may be described by the following stick-breaking procedure [33], ′ ′ | ∼ Beta(1, ) = ′ ∏︁ (1 − ′ ) < (1) (2)
= { }, may be drawn according to a base measure over Θ and this global DP prior may be defined as = ∑︀ . The individual rows of the transition matrix between the latent states Π = [ , ] have local DP priors (, ) where allows for shared pooling of information.
The prior distribution for the transition probability to the next latent state given that the system is in the current state −1 is:
Process Prior: Transition Matrix Prior: Latent State Transition: Configuration Transition Prior: |
, · | −1 | −1, −1, −1 ∼ GEM( ) ∼ ∼ ∼ −1,·
−1 ∼ −1,
= 1, . . . ( · + · ) = 1, . . .
= 1, . . . , = 1, . . . ,
We propose a novel two-layer Markov chain model for the sequences of configuration emissions, where the transition probabilities [ , ] varies depending on the latent state labeling of the system, allowing the pattern of sequences to vary as demonstrated in Figure 1. A graphical model representation of the proposed two-layer model is depicted in Figure 2.
Figure 3 summarizes our framework. The operational logs are pre-processed to identify unique combination of attribute values in each operational log to feed into the sHDPHMM based inference algorithm (see Section 3.3). A detection heuristic is applied to the latent state transition matrix generated by the algorithm to output discrete temporal sequences of operation logs that correspond to attacks. The detection heuristic can vary based on the validation method used for detection, discussed in Section 3.4.
In the case where a known normal history of the system exists and is known to span the modes present in the system’s behavior, the set of suficient statistics estimated from this series ^0 is a subset of the suficient statistics estimated from the series containing the potential alternatives ^1. Identifying the matching subset of ^0 of ^1 is a problem of matching the overlap of two high dimensional point clouds.
In Algorithm 1, the inference implementation of the model uses the direct assignment Gibbs sample by Teh et al. [22]. The matrix records the number of transitions between latent states, [, ] = ∑︀ 1< ≤ 1{ −1 = , = }. At each time instant, the new latent state labeling must be inferred by conditioning out the influence of its present labeling as shown in Line 8. The new labeling is sampled using the Chinese Restaurant Franchise analogy [25] and subsequently if a new state is realized the transition matrix is expanded (Line 6) and the associated summary statistics are updated (Line 8). Conversely, if a pre-existing latent state is found redundant, it is removed in Line 3, allowing the number of latent states identified to decrease. Having fixed the latent state assignments, the remainder of the parameters in the model are conditionally updated. Algorithm 1 outputs the latent states and transition probability matrix among the latent states discovered in the operational data.
Algorithm 1: Direct Assignment Gibbs Sampler for sHDP-HMM for = 1, . . . , do
Decrement [ ( )
−1, Sample the state labeling if ( ) = ( ) + 1 then
( ) ( −1)], [ ( −1)
, (+−11)] Introduce state ( ) + 1 into array ( ) and matrix
Increment ( ) Increment [ ( ) −1, ( )], [ ( )
, (+−11)] for = 1, . . . , ( ) do if ·
= 0 and · = 0 then
Delete row and column from Update the count of unique states ( ) = | : Sample the CRF auxiliary variable matrix ( ) Sample the self-transition parameter(s) Sample the global weights ( ) Sample the hyper-parameters ( ) = for = 1, . . . , | 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
If ( ) is the number of latent states at iteration , the number of operations required ( )) where is the length of the data trace. Because each iteration for iteration is ( requires a pass through the time series, Algorithm 1 may be expensive for massive data streams. In practice, we determine the convergence of the chain by examining the sequence of latent state labels {
( )} for stability.
Detection heuristics (see Figure 3) may be derived using the model output to contruct alarms. To determine whether an attack has occurred, there are a few possible approaches. If historical data from the system’s normal operation is available, Algorithm 1 can be run on that data to identify the latent states and transition probabilities in normal behavior. This information may be contrasted against latent states and transition probabilities discovered from the attack data, as in Section 6. Alternately, if subject matter expertise is available, then specific rules-based alarms may be derived using the algorithm’s output, as in Section 5. In the absence of historical data and domain knowledge, anomalies may be identified on the basis on the latent state frequency relative to the entire recording. However, the specific correspondence between these statistical anomalies and attacks and the points of diferentiation between attacks and malfunctions and rare events are subjects that require further exploration.
One of the important ways of evaluating the detection framework is understanding the
classification quality of detecting transitions from the “concept of normalcy” [
However, the temporal nature of the observations is problematic for point-to-point evaluation of the classification quality. Slight delays in the time of detection should be diferentiated from complete misses and the point-to-point measure for false positives may be multiplicative and overly punitive. These discrepancies and others issues relevant to other applications have been noted in [34, 16].
We present a set of metrics for evaluating detection of anomalous temporal discrete sequences. These metrics involve introducing two additional parameters ℎ and , whose purpose is to partition the time series into periods of true positives and true negatives. We recommend these be selected to balance the labels present in the data set. is the length of time used to divide periods of non-detection into true negatives. Additionally, ℎ serves to introduce tolerance for slight delays in detection. For detecting the beginning of attacks (similar analogues may be made towards detecting the end of attacks): 1. For a latent state transition at time , if within the interval [ , + ℎ ], there are no transitions detected then the period [ , + ℎ ] is categoried as a False Negative (FP). 2. For a latent state transition at time , if within the interval [ , + ℎ ], there is a transition detected at ^ ∈ [ , + ℎ ] then the period [ , + ℎ ] is categoried as a True Positive (TP). 3. For a latent state non-transition at time , if within the interval [, + ℎ ], there ^ are one or more estimated transitions { } ∈ [ , + ℎ ], then the period [, + ℎ ] is categorized as False Positive (FP). 4. For a latent state non-transition at time , if there are no estimated transitions, categorize the period [, + ℎ ] as True Negative (TN).
In a system with a bus architecture, the system components interact with each other
only through a shared communication bus that employs a communication protocol. The
MIL-STD-1553 standard, also referred to as 1553, is a serial bus communication protocol
standard used primarily in avionics systems [
Attacks are conducted using virtualized flight components interacting with the 1553 bus through the Alta eNet interface. Our BC cycles through lists of messages to transact, producing a deterministic and periodic pattern. The 1553 protocol allows any device connected to the bus masquerade as a BC, allowing a bad actor to hijack the bus. We conducted 17 attacks on the system with difering complexity, ranging from noise attacks to denial-of-service. See Table 2 for details of the attacks.
The operational data is collected from the 1553 bus using the Alta eNet-1553 interface device. In the pre-processing step, to represent the state of the bus, we used the symbolic message attributes as outlined in Table 1.
Field Value Ranges Message Type BC to RT, RT to BC, RT to RT, mode command, mode command with transmit data, and mode command with receive data Remote Terminal Address 0 - 31 Transmit/Receive 0, 1 Subaddress/Mode 0 - 31 Data Word Count/Mode Code 0 - 31 Variable Type tgrcl aeoia C
Algorithm 1 is used to detect latent state transitions on the collected data. To derive the detection heuristic, we observe that the system exhibited only a single latent state, as shown in Figure 4, and confirmed by the experimenter on the timing of attacks. The operational data is collected only on 16 attacks, since Attack 13 is not reflected in the operational logs. Therefore, our detection heuristic in this case is simple; any latent state transition to a new latent state and return to the single stable latent state is an attack. The results are in Table 2.
In order to evaluate the detection quality of the inference for the experiment, we use the procedure described in Section 4 with = 350. Selecting = 350 and ℎ = 1 divides the time series into 32 intervals, half of which are true positives and the other Attack Attack 0 Attack 1 Attack 2 Attack 3 Attack 4 Attack 5 Attack 6 Attack 7 Attack 8 Attack 9 Attack 10 Attack 11 Attack 12 Attack 13 Attack 14 Attack 15 Attack 16 of the system contains only one mode - any departure from this single mode of behavior is considered to be an attack.
Attack Occurrence
Detected Occurrence
Detection
Description Detection of attacks on the avionics testbed based on metrics in Section 4. TP is short for true positive; FN - false negative; TN - true negative; FP - false positive. half true negatives. We conclude that there are 15 true positives, 0 false positives, 16 true negatives, and 2 false negatives. A human expert analysis of sample trafic collected during the DDoS Attack 9 revealed multiple periods of normal trafic interlacing the anomalous measurements, which may explain the fragmentation.
In this section, we describe detection of attacks on a consumer robot. This system is
a Roomba Create2 [
As summarized in Table 4, in the sensor attack, an obstruction is introduced in front of the left optical sensor, causing the Roomba to prematurely halt traveling towards its destination. Outside intervention removes this obstruction, allowing the Roomba to continue its course. In the actuator attack, the robot is physically held in place on a slippery surface. The wheels continue to spin; however, the robot does not make any forward movement. Outside intervention removes the restraint on the robot, and it is allowed to move forwards.
Field Value Ranges Voltage 0 - 65535 Current -32768 - 32767 Velocity Left -500 - 500 Velocity Right -500 - 500 Light Bumper Front Left 0 - 4095 Light Bumper Front Right 0 - 4095
Experiment Attack Vector Data Attack Occurrence 1 wall sensors light bumpers, (58, 59) - (74, 75)
velocity 2 actuators current, volt- (171, 172) - (212, 217) 172 - 192 age
Detected Occurrence Start Attack End Attack 62 - 73 TP TP
TP
FN
In contrast to the avionics testbed that has only a single latent state, or mode, detectable by Algorithm 1, the Roomba Create2 shows multiple modes, as shown in Figure 5. The diferent colors indicate diferent latent states, and the solid black line is the wall sensor output that measures distance to an obstruction, see Table 4.
In both attack experiments, comparison between the number of latent states in recordings of normal trafic and attack trafic identified more latent states in the later. Because each latent state has associated suficient statistics for the sensors, it is straightforward to draw correspondences between the latent states in each set of recordings and identify which latent states are novel with respect to normal behavior. Having identified the novel latent states in the attack recordings, we analyze the mode of the start of the transition to these states and compare it against expert annotation to determine the accuracy of the start/end of attack detection. (a) Wall sensors and states for the Roomba under normal operation. (b) Current readings and states for the
Roomba under normal operation. (c) Wall sensors and states for the Roomba under sensor attack. (d) Current readings and states for the
Roomba under actuator attack.
We presented in this paper an unsupervised learning framework based on the sHDP-HMM model and detection heuristic to detect attacks on two types of systems using diferent attack approaches. In both cases, no domain knowledge of the system architecture was used to infer the location and number of attacks in the time series. This unsupervised approach for attack detection is applicable for many systems for which the only available information consists of the operations logs. We demonstrated the ability of this framework to assimilate heterogeneous data consisting of continuous sensors and categorical configurations. While these preliminary results are encouraging, more testing on a wider variety of systems is needed to better understand the limitations and wider applicability of this approach.
We surmise that the algorithm’s detection is most accurate if the entire attack is contained within the data recording. It is unresolved how partial capture of the attack will impact the detection accuracy. Further, the exploration of the detection of cyberattacks on the avionics testbed has identified instances of known cyberattacks, whose efects are absent from the system bus logs.
A key challenge for machine learning approaches for attack detection in CPSs is the explainability of the results to non-experts and was a key motivator for this approach [37]. Although the model presented here as a switching process between an ensemble of simple models is more transparent in comparison to alternatives, there is potential to better integrate these outputs with other sources of data and physical laws to provide greater clarity into the causality of anomalies. Additionally, although we considered the many common types of tabular data in this work, the framework presented here may also assimilate many forms of higher fidelity data such audio and video. Lastly, because Algorithm 1 performs multiple passes through the data, it poses an interesting challenge to scaling up the approach to the massive streams of data encountered in real-time monitoring systems[38]. Addressing this challenge of scalability is an area of research we are actively investigating. [14] D. Ding, Q.-L. Han, Y. Xiang, X. Ge, X.-M. Zhang, A survey on security control and attack detection for industrial cyber-physical systems, Neurocomputing 275 (2018) 1674–1683. [15] Y. Wang, M. Perry, D. Whitlock, J. W. Sutherland, Detecting anomalies in time series data from a manufacturing system using recurrent neural networks, Journal of Manufacturing Systems (2020). [16] N. Singh, C. Olinsky, Demystifying numenta anomaly benchmark, in: 2017 International Joint Conference on Neural Networks (IJCNN), 2017, pp. 1570–1577. [17] S. Bulusu, B. Kailkhura, B. Li, P. K. Varshney, D. Song, Anomalous example detection in deep learning: A survey, IEEE Access 8 (2020) 132330–132347. [18] B. Gao, H.-Y. Ma, Y.-H. Yang, Hmms (hidden markov models) based on anomaly intrusion detection method, in: Proceedings. International Conference on Machine Learning and Cybernetics, volume 1, IEEE, 2002, pp. 381–385. [19] D. Altan, S. Sariel, What went wrong? Identification of everyday object manipulation anomalies, Intelligent Service Robotics 14 (2021) 215–234. [20] P. Smyth, Model selection for probalistic clustering using cross-validation likelihood,
Statistics and Computing 10 (2000) 63–72. [21] G. Celeux, J.-B. Durand, Selecting the hidden markov model state number with cross-validated likelihood, Computational Statistics 23 (2008) 541–564. [22] Y. W. Teh, M. I. Jordan, M. J. Beal, D. M. Blei, Hierarchical dirichlet processes,
Journal of the American Statistical Association 101 (2006) 1566–1581. [23] S. W. Linderman, M. J. Johnson, M. A. Wilson, Z. Chen, A bayesian nonparametric approach for uncovering rat hippocampal population codes during spatial navigation, Journal of Neuoscience Methods 263 (2016) 36–47. [24] D. M. Blei, T. L. Grifiths, M. I. Jordan, The nested chinese restaurant process and bayesian nonparametric inference of topic hierarchies, Journal of the ACM 57 (2010). [25] E. B. Fox, E. B. Sudderth, M. I. Jordan, A. S. Willsky, A sticky HDP-HMM with application to speak diarization, The Annals of Applied Statistics 101 (2011) 1020–1056. [26] H. Wu, Y. Guan, J. Rojas, A latent state-based multimodal execution monitor with anomaly detection and classification for robot introspection, Applied Sciences 9 (2019). [27] T. Li, B. Wang, F. Shang, J. Tian, K. Cao, Dynamic temporal ADS-B data attack detection based on shdp-hmm, Computers & Security 93 (2020) 101789. [28] A. A. Cárdenas, S. Amin, Z.-S. Lin, Y.-L. Huang, C.-Y. Huang, S. Sastry, Attacks against process control systems: Risk assessment, detection, and response, in: Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, 2011, pp. 355–366. [29] T. Kaliath, H. V. Poor, Detection of stochastic processes, IEEE Transactions on
Information Theory 44 (1998) 2230—-2258. [30] H. Fawzi, P. Tabuada, S. Diggavi, Secure estimation and control for cyber-physical systems under adversarial attacks, IEEE Transactions on Automatic Control 59 (2014) 1454–1467. [31] D. Hadžiosmanović, L. Simionato, D. Bolzoni, E. Zambon, S. Etalle, N-gram against the machine: On the feasibility of the n-gram network analysis for binary protocols, in: D. Balzarotti, S. J. Stolfo, M. Cova (Eds.), Research in Attacks, Intrusions, and Defenses, 2012, pp. 354–373. [32] O. Stan, Y. Elovici, A. Shabtai, G. Shugol, R. Tikochinski, S. Kur, Protecting military avionics platforms from attacks on MIL-STD-1553 communication bus, CoRR abs/1707.05032 (2017). URL: http://arxiv.org/abs/1707.05032. arXiv:1707.05032. [33] J. Pitman, Poisson–dirichlet and gem invariant distributions for split-and-merge transformations of an interval partition, Combinatorics, Probability, and Computing 11 (2002) 501—-514. [34] X. Zhou, A. Del Valle, Range based confusion matrix for imbalanced time series classification, in: 2020 6th Conference on Data Science and Machine Learning Applications (CDMA), 2020, pp. 1–6. doi:10.1109/CDMA47397.2020.00006. [35] Alta-dt, ENET-1553: MIL-STD-1553 REAL-TIME ETHERNET CONVERTER, ???? URL: https://www.altadt.com/product/enet-1553/, accessed July 20, 2022. [36] A. Roque, M. Lin, S. Damodaran, Cybersafety analysis of a natural language user interface for a consumer robotic system, in: European Symposium on Research in Computer Security, Springer, 2021, pp. 107–121. [37] A. Roque, S. K. Damodaran, Explainable ai for security of human-interactive robots,
International Journal of Human–Computer Interaction (2022) 1–19. [38] A. Bifet, R. Gavalda, G. Holmes, B. Pfahringer, Machine learning for data streams: with practical examples in MOA, MIT press, 2018.