## 4 Results
### Effectiveness of Defense Mechanisms  
Our proposed defense mechanisms aim to mitigate the impact of cyberattacks on the sensors of autonomous vehicles. We evaluated their effectiveness by comparing vehicle performance with and without defenses under identical attack conditions. Figure 11 illustrates the impact of our defense mechanisms on sensor data quality during attacks with defense mechanisms in Episode 7.  
Figures 12 and 13 provide a visual comparison of sensor outputs during attacks, demonstrating the effectiveness and limitations of our defense mechanisms. These comparisons show the sensor data quality with and without defenses enabled during identical attack scenarios.  
The defense mechanisms demonstrated varying degrees of effectiveness depending on the attack type and intensity:  
* **RGB Camera Attacks**: Our anomaly detection model for RGB cameras successfully identified attacks on the camera feed, but the subsequent filtering techniques showed limited effectiveness against sophisticated attacks. While some noise reduction was achieved, the filtered images often remained significantly compromised, resulting in continued trajectory deviations even with defenses active.
* **Depth Sensor Attacks**: The depth sensor anomaly detection system effectively detected anomalies in depth data, but defense mechanisms for depth sensor attacks demonstrated limited effectiveness against targeted attacks, with filtered depth maps still containing significant distortions that affected the vehicle's perception capabilities.
* **GPS Spoofing**: Our GPS defense mechanism successfully detected and mitigated GPS spoofing attacks by implementing plausibility checks based on route deviation and velocity consistency. The defense mechanism checks if the reported GPS position deviates more than 5.0 m from the planned route or if the calculated speed exceeds 20.0 m/s, reverting to the true transform when these thresholds are exceeded. This was our most effective defense, as it clearly identified spoofed GPS coordinates and prevented the vehicle from making unwarranted course corrections based on falsified location data.
* **Steering Bias**: The steering defense mechanism uses statistical anomaly detection with z-score analysis on a rolling window of the last 50 steering commands. When a steering command's z-score exceeds 3 (indicating a statistical outlier), the system  
Figure 11: Sensor outputs with defense mechanisms during attacks in Episode 7.  
reverts to the mean steering value from the recent history. This approach showed partial effectiveness in identifying malicious steering commands, but sophisticated attacks could still influence vehicle control in certain scenarios.  
Our experiments revealed significant limitations in our current defense mechanisms for most sensor types except GPS. In Episode 27, Figure 9, the vehicle crashed during an attack even with defenses active, and across multiple episodes, the defenses for RGB and depth sensors failed to adequately protect the vehicle's perception system. These findings highlight a critical vulnerability in current autonomous vehicle security approaches.  
To address these limitations, we propose an enhanced anomaly detection system that can serve as a fallback mechanism when primary defenses fail. This system would  
* Continuously monitor all sensor inputs for anomalies using our trained detection models;
* If anomalies were detected, reduce reliance on AI models for driving decisions;
* Transfer driving control to human operators for a safer experience when sensor integrity is compromised; and
* Alternatively, selectively shut down compromised sensors and cross-check with remaining functional sensors to maintain autonomous operation.  
This approach acknowledges the reality that perfect defense against all attack vectors may not be achievable and instead focuses on rapid detection and appropriate fallback mechanisms to ensure safety. The implementation of such a system would be a promising direction for future research.