Detecting Generalized Replay Attacks via Time-Varying Dynamic Watermarking

Matthew Porter · Pedro Hespanhol · Anil Aswani · Matthew Johnson-Roberson · Ram Vasudevan

Fig. 1: Desired and attacked trajectory of an LTV car model showing attack start and detection (Left); Corresponding LTV Dynamic Watermarking test metric showing attack start and detection (right) — FIGURE FROM THE PAPER

TL;DR

Dynamic watermarking is extended from time-invariant to time-varying systems, detecting generalized replay attacks on a simulated vehicle model.

BRIEF

Many cyber-physical systems, such as autonomous vehicles, rely on external communication for sensing or supervisory control, which leaves them open to attacks like replay attacks, where recorded measurements are played back to hide what is really happening. Dynamic watermarking defends against this by adding a private random excitation to control inputs and checking that measurements reflect it, but it has only worked for linear time-invariant systems. This work extends the approach to linear time-varying systems using a matrix normalization factor, provides implementable tests, and shows detection of generalized replay attacks in theory and in simulation of a vehicle model.

Abstract

Cyber-physical systems (CPS) often rely on external communication for supervisory control or sensing. Unfortunately, these communications render the system vulnerable to cyber attacks. Attacks that alter messages, such as replay attacks that record measurement signals, and then play them back to the system can cause devastating effects. Dynamic Watermarking methods, which inject a private excitation into control inputs to secure resulting measurement signals, have begun addressing the challenges of detecting these attacks, but have been restricted to linear time-invariant (LTI) systems. Though LTI models are sufficient for some applications, other CPS, such as autonomous vehicles, require more complex models. This article develops a linear time-varying (LTV) extension to previous dynamic watermarking methods by designing a matrix normalization factor to accommodate the temporal changes in the system. Implementable tests are provided with considerations for real-world systems. The proposed method is then shown to be able to detect generalized replay attacks both in theory and in simulation using an LTV vehicle model.