# Cyber-Physical Attack Detection and Recovery Based on RNN in Automotive Brake Systems
## 2 Sensor Attack Detection
### States of Sensors and Attacks  
The states of the wheel speed sensors are classified into 15 classes except for a situation where attacks happen on all the sensors as presented in Table 1. Through the definition of states of sensors as classes, our detection and identification system knows whether each sensor is attacked or not. Also, this information is reflected in the process of the speed estimation later.  
False data are generated with the obtained data to make data belong to each class. Because the number of training datasets is the same as that of the classes, each dataset is used for each class. Additive attacks are considered, and a constant value is added to a sensor value as follows:  
\[x_{i}=s_{i}+a_{i}, \tag{1}\]  
where \(x_{i}\) (\(i\) = 1, 2, 3, 4) is the value that a wheel speed sensor reads, \(s_{i}\) is the attack-free value including noise in the sensor and \(a_{i}\) is the highest error value between wheel speed data and vehicle speed data among training data. 7.875, 8.625, 7.75, and 7.75 km/h are injected to \(a_{1}\), \(a_{2}\), \(a_{3}\), and \(a_{4}\) as the false data of FL(Front Left wheel speed sensor), FR(Front Right wheel speed sensor), RL(Rear Left wheel speed sensor), and RR(Rear Right wheel speed sensor), respectively. The attack duration is set to 0.73 seconds. In [12], it spend 0.73 seconds to let up on the accelerator after subjects perceive a surprising event. Attacks are injected until people cannot aware of the situation. The attack frequency is 20 times per a dataset, which means that about half of the dataset is false data. Figure 1 shows a training dataset to correspond Class 7 that indicates that FL and FR are attacked.  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c} \hline \hline
**Class** & **0** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **10** & **11** & **12** & **13** & **14** \\ \hline FL 1 & - & X 5 & - & - & - & X & X & X & - & - & - & X & X & X & - \\ FR 2 & - & - & X & - & - & X & - & - & X & X & - & X & X & - & X \\ RL 3 & - & - & - & X & - & X & - & X & - & X & X & - & X & X & - & X \\ RR 4 & - & - & - & - & X & - & - & X & - & X & - & X & - & X & X \\ \hline \hline \end{tabular} 1 Front left wheel speed sensor; 2 Front right wheel speed sensor; 3 Rear left wheel speed sensor; 4 Rear right wheel speed sensor; 5 Attack.  
\end{table}
Table 1: Defined classes.  
In the case of validation data, we make attacks happen on four wheel speed sensors randomly at every moment and reduce the frequency of occurrence of attacks to 10 times since there exist only 5 sets. Figure 2 presents attacks in a validation dataset. The attack injection of test data is explained in Section 4.  
Figure 1: Class 7 training dataset: (**a**) Vehicle speed; (**b**) Front left wheel speed; (**c**) Front right wheel speed; (**d**) Rear left wheel speed; (**e**) Rear right wheel speed.  
Figure 2: Validation dataset: (**a**) Vehicle speed; (**b**) Front left wheel speed; (**c**) Front right wheel speed; (**d**) Rear left wheel speed; (**e**) Rear right wheel speed.