Securing CPS Through Simultaneous Analog Side-Channel Monitoring of Cyber and Physical Domains

The continuing proliferation of Cyber Physical Systems (CPSs), those that integrate electronic control circuitry with a mechanical system allowing software commands to affect the physical world, while allowing for new efficiencies and convenience, also facilitates new security risks. While the cyber-domain components of a CPS control the behavior of the physical-domain components, attacks on either the physical-domain or cyber-domain can be used to control or subvert the CPS in ways that may cause serious harm or even loss of life. Unfortunately, most research in CPS attack detection has focused solely on monitoring the cyber domain for malicious software activity, and the few works that do monitor the physical domain neglect or independently monitor the cyber domain. With that in mind, this paper proposes a method of jointly monitoring both domains (cyber and physical) of a CPS, verifying not only that software commands are faithfully executed by the cyber-components of the CPS, but also that the physical-domain behavior of the CPS corresponds to those commands. We demonstrate the effectiveness of this approach through experiments using a medical CPS device subjected to both cyber and physical attacks. We show that different analog side channels (EM and acoustic in our experiments) are similarly effective for such monitoring and attack detection. We also show that, while some attacks can be detected through physical-domain monitoring alone or through cyber-domain monitoring alone, our joint monitoring of both domains allows for the detection of additional attacks that cannot be detected by monitoring only one of the domains, resulting in >99% attack detection accuracy measured over 1,000 instances of CPS activity.