Trustworthy machine learning for securing cyber-physical systems
Creators: name: Chan, Matthew
Publisher: name: No Publisher Supplied
Year: 2024

description: The safe operation of cyber-physical systems (CPS) is crucial in nearly all applications, from power-grid and chemical treatment systems to autonomous robots and traffic lights. Securing cyber-physical systems require addressing not only their physical components and controlling software, but also practical system constraints not present in conventional computer security. The increasing frequency and sophistication of attacks on these systems highlight the challenging nature of securing CPS and the need for better defense mechanisms. In this thesis, we investigate the both the application of machine learning (ML) techniques for securing CPS, as well as the security of the ML models themselves. In the context of industrial CPS, we study the use of out-of-band side-channels for verifying the integrity of cyber-physical processes, and security risks these side-channels may pose. In the case of robotic vehicles like drones, we investigate the use of ML for finding vulnerabilities. And in the context of emerging edge and embedded cyber-physical applications, we propose a method for creating more robust and compact ML models for these systems to aid in their practical deployment. First, we present a method for remote attestation of legacy industrial CPS which leverages physics-based fingerprinting as a makeshift root-of-trust resistant to replay spoofing attacks. Using an ML classifier to distinguish between correct and incorrect physical fingerprints, the verifier can ensure the integrity of software running on the controller during the attestation process. We demonstrate the feasibility of our framework by implementing it on a real CPS controlling a robotic arm. Next, we show that out-of-band physical channels can be used for covert data exfiltration on CPS, despite the presence of state estimation monitors. This highlights a vulnerability which could allow attackers to establish a foothold for reconnaissance, which is an essential component of sophisticated persistent attacks. We demonstrate the feasibility of this method in several use cases. Additionally, we conduct a security analysis of physical side-channel monitoring, an ML-based anomaly detection technique for industrial CPS. Unlike software-based methods for intrusion detection, monitoring hardware-based physical phenomena like power consumption or electromagnetic emanations is believed to increase security, as these signals are immutable and inaccessible to attackers. However, we find that despite the inherent challenges that physical side-channel monitoring poses, the technique remains vulnerable to attack in the form of maliciously-crafted adversarial examples which evade detection by the ML classifier. In our analysis, we demonstrate the process for creating these adversarial examples, evaluate the practicality of such an attack, and recommend additional mitigations. Next, we propose a vulnerability assessment framework to explore robotic autonomous vehicle (RAV) security from a combined cyber-physical perspective. We present a data-driven method to illustrate that, despite state-of-the-art memory isolation efforts, RAV systems are still vulnerable to physics-aware data manipulation attacks. Utilizing a reinforcement learning-based method, we show how an attacker can exploit memory bugs and parameter defects in a legitimate memory view to elaborately craft adversarial variable values and disrupt an RAV's safe operations. We demonstrate the feasibility of this approach on the widely-used ArduPilot RAV framework. Our empirical evaluation shows that the attacker can leverage these vulnerable state variables to achieve various RAV failures during real-time operation, and even evade existing defense solutions. Finally, we propose a framework for producing more robust and compact neural networks to improve practical deployment in embedded/edge CPS. Our approach uses model pruning to decrease model complexity while increasing robustness to attack. Specifically, we look to mitigate membership inference attacks (MIA), which violate privacy by determining a data point's membership in a model's training set. This work provides an entry point for addressing growing privacy concerns in new and emerging CPS applications.