Misbehavior detection in cooperative intelligent transport systems

Automobile accidents are one of the major causes of death in the Western world. In previous decades, automobile manufacturers and researchers have investigated a broad spectrum of solutions to this challenge. Within this solution space, communication between vehicles has long been a promising direction that enables highly advanced driver assistance systems. Current generation assistance systems operate through the use of automotive sensors, which have limited range; to provide the vehicle with a more complete picture of its surroundings, various standards have been proposed to enable information exchange between vehicles. Recent developments in this field, which integrate more components into this communication architecture, give rise to cooperative intelligent transport systems (C-ITS). Most C-ITS applications, in particular including safety applications, make decisions based on both information received from local sensors and messages received from others. One aspect of C-ITS that is essential for successful deployment is its security against invalid behavior and malicious attacks. Without such protection, the validity of the information received from other vehicles cannot be guaranteed, and thus the reliability of all C-ITS applications is affected. Research has invested significant effort in the development of basic security services, such as pseudonymization and sender authentication. One area that has received limited attention in standardization is that of misbehavior by authentic entities in the network. For example, a malicious vehicle may transmit false messages, triggering an emergency response and causing a collision between other vehicles. This cannot be prevented through standard security services, such as cryptographic signatures, because a malicious vehicle is an authentic sender. In general the detection of such invalid application data is termed misbehavior detection. Because different attacks are typically detected through different misbehavior detection mechanisms, the combination of these outputs (i.e., fusion) for decision making is an essential component. This thesis addresses this topic by designing Maat, a generic misbehavior detection framework that ensures the validity of received data. The contributions of this thesis include (a) a detailed survey of existing misbehavior detection mechanisms, (b) Maat, a proposal for a generic fusion framework for misbehavior detection in C-ITS, (c) multi-source fusion operations for subjective logic, which forms the mathematical foundation of our framework, (d) several novel detection mechanisms, (e) a detailed review of evaluation methodologies and proposals for novel metrics, (f) a new, public dataset that serves as a baseline for comparison of misbehavior detection mechanisms, (g) a detailed evaluation of the proposed mechanisms and fusion operations, and (h) an outlook discussing how these results can be applied to other cyber-physical systems. The survey in this thesis provides an overview and classification of existing misbehavior detection mechanisms along various axes, including the scope of detection, type of data used and susceptibility to attacks. Not only does this provide a solid foundation for the requirements on Maat, it also supports the development of attacks and misbehavior detection mechanisms in the wider field. Within this thesis, we build a framework, called Maat, to fuse misbehavior detection results through subjective logic. Subjective logic is a mathematical framework that enables the expression of uncertainty on data through objects called subjective opinions. Maat applies this logic to build a flexible data management and fusion system, which determines the trustworthiness of data whenever it is accessed by applications. To support this data management, Maat uses a directed graph to store the data and the associated detection results. By recording both the data and the associated detection results separately, a wide range of potential new detectors can be explored. In addition, it enables the verifiable exchange of detection results for revocation. Subjective logic provides a variety of fusion operators to fuse subjective opinions. However, for some of these operators, fusion of multiple opinions (multi-source fusion) is not well-defined due to noncommutativity. In order to implement Maat, these operators were generalized to the multi-source fusion