Cyber Security of Sensor Systems: Augmenting Anomaly Detection for Sequence Estimation

Sensor systems are extremely popular in both military and commercial systems. Due to possible devastating consequences, counteracting sensor data attacks is an extremely important topic, which has not seen sufficient study. Our focus is on providing a protective shell for sequence estimation algorithms that are designed for unattacked sensor data, called unprotected algorithms. The sequence estimation algorithms of interest include data driven approaches and the goal is to identify and eliminate the attacked sensor data, allowing the protected algorithm to perform nearly as well as possible. While anomaly detection approaches have some significant advantages, we show that they are not able to recognize certain attacks which can cause tremendous damage. We propose a method to augment anomaly detection and eliminate these problems by employing a data driven approach that only requires unattacked training data since obtaining training data that represents all possible attacks seems impossible in realistic sequence estimation problems. We employ an attack model that gives the attacker much more power than any we have seen in the literature. The attacker has complete control of the attacked data to generate any sensor data values after the attack. The attacked sensors and attacks can change each time sample. The protection system has no prior knowledge of which sensors are more likely attacked and the number of sensors attacked. We initially demonstrate a simple approach to identify attacks under the assumption these attacks are constructed without detailed knowledge of our protection approach. Then we demonstrate additional processing to protect against attacks constructed with detailed knowledge of our protection approach. Experiments demonstrate that our simple approach provides performance that is extremely close to the optimized performance of an approach that knows which sensors are attacked. Experiments demonstrate that the additional processing provides generally acceptable performance against all attacks.