Delay attack versus clock synchronization — A time chase

Clock synchronization is one of the most essential assets for distributed real-time systems, as sensing, control and actuation require synchronized communication to meet real-time deadlines. We propose a distributed monitoring method to detect if an adversary is interfering with the clock synchronization protocol. The monitor uses certain network indicators and a set of rules to decide about switching between Normal, Quarantine or Attack Detected states. Further, we propose a way to define thresholds for decision-making based on theoretical analysis of the indicator values influenced by an attack. In addition, we formulate the problem of adversary influence detection in the network as a detection theory problem and use it to derive an additional indicator for the network monitor. Finally, we analyze the time chase between the monitor and an adversary to investigate which factors influence the final outcome.