# Cyber-Physical Attack Detection and Recovery Based on RNN in Automotive Brake Systems
## 4 Experimental Results
### Classification Accuracy
Note that other types of sensor attacks are considered to know what the results show when unlearned data of sensor attacks are input. Random attacks and drift attacks are generated  
Figure 6: Another test dataset: (**a**) Test dataset before attack detection; (**b**) The estimated speed after attack detection and speed estimation and the reference speed; (**c**) A part of the test dataset before attack detection; (**d**) A part of the test dataset after attack detection and speed estimation. with the same test data used for additional attacks. A random value is added to a sensor value for generating a random attack. The equation of random attacks is written as below:  
\[x_{i}=s_{i}+r_{i},\;\;i=\{1,2,3,4\}, \tag{5}\]  
where \(x_{i}\) and \(s_{i}\) is equal to the notations of an additive attack. \(r_{i}\) is a random value to follow uniform distribution from 0 to \(a_{i}\) defined in the additive attack. Drift attacks linearly increase a value added to a sensor value. The drift attacks are calculated as follows:  
\[x_{i}=\left\{ \begin{array}{c}0,t<t_{f}\\ a_{i}\Big{(}t-t_{f}\Big{)}/T_{R},t_{f}\leq t<t_{f}+T_{R}\;\;,\;i=\{1,2,3,4\}, \\ a_{i},t\geq t_{f}+T_{R}\end{array} \right. \tag{6}\]  
where \(x_{i},s_{i}\) and \(a_{i}\) are same as the notations of an additive attack. \(t_{f}\) is the time when a drift attack is introduced, \(T_{R}\) is the duration of the ramp (0.73 second). We made 15 test datasets that three types of attacks are injected into with the same test datasets. As presented in Figure 7a,c,e, the range and time of the attack occurrence of three types are identical in the three datasets. Table 10 displays test accuracies about each attack. As mentioned before, the accuracy about the total test data of additional attacks is 99.4978%. Test accuracies about those of random attacks and drift attacks are 86.1985% and 86.5594%, respectively. The results show about 23% lower probability than the test accuracy of additional attacks. Figure 7b,d,f shows how correctly WA estimates the vehicle speed by classifying each attacked and normal sensors in the test datasets. While WA estimates the relatively the correct vehicle speed after attack detection with the data of Figure 7a as presented in Figure 7b, the false data to have small magnitude are not processed after attack detection and speed estimation with each data of Figure 7c,e as shown in Figure 7d,f. The RNN classifier detects and identifies only false data to have large magnitude like additional attacks as it learned data of additional attacks. It is needed to process the pattern of unlearned data to increase the accuracies about random attacks and drift attacks over 90% as future work. Figure 7: _Cont._  
Figure 7: Datasets inject false data: (**a**) Four wheel speed data to consider additive attacks; (**b**) Estimated speed against additive attacks and reference speed data; (**c**) Four wheel speed data to consider random attacks (**d**) Estimated speed against random attacks and reference speed data; (**e**) Four wheel speed data to consider drift attacks; (**f**) Estimated speed against drift attacks and reference speed data. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Attack** & **Additive Attack** & **Random Attack** & **Drift Attack** \\ \hline Accuracy (\%) & 99.4978 & 86.1985 & 86.5594 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Test accuracies.