Attack Detection and Defense System Using an Unknown Input Observer for Cooperative Adaptive Cruise Control Systems

Cooperative adaptive cruise control (CACC) is a technology for the automated control of platoons of vehicles. CACC controls the behavior of vehicles based on information that is shared among the vehicles through vehicle-to-vehicle (V2V) communication. However, cyberattacks on V2V communication can degrade the control performance and may cause serious accidents such as vehicle collisions; therefore, it is important to improve the resilience against such attacks. In this paper, we propose a novel attack detection and defense mechanism for CACC. Our approach is based on an unknown input observer (UIO), which estimates vehicle states by treating the unreliable information obtained through V2V communication as unknown inputs. Attacks on V2V communication are detected from the estimated states. When an attack is detected, the control method is switched to a secure method. Through simulation experiments, we show that the proposed mechanism can detect attacks immediately and accurately, allowing the stability of the platoon to be maintained.


I. INTRODUCTION
A DVANCES in information and control technologies have led to the development of intelligent transportation systems (ITSs). In particular, focus has been placed on automated vehicle control for improving the effectiveness and safety of transportation systems. Cooperative adaptive cruise control (CACC) [1] (Fig. 1) is one of the most promising technologies for the automated control of vehicle platoons (referred to simply as platoons in this paper). CACC controls the behavior of the vehicles in a platoon in an autonomous and cooperative manner based on information shared through vehicle-to-vehicle (V2V) communication to realize safe and effective cruising. In a platoon with CACC, each vehicle is equipped with a controller, a V2V communication device, and a sensor. The controller calculates the control inputs to the vehicle based on data obtained via V2V communication and the sensor. There have been many studies on CACC [1]- [7]. For example, in [2], the authors proposed a method for the longitudinal and lateral control of platoons. In [3], a control method was proposed for platoons with uncertain dynamics. In [4], [5], the authors proposed an ecological adaptive cruise control (Eco-CACC) strategy for improving the fuel economy of a heterogeneous platoon. In [6], the authors proposed a cooperative optimal power split (COPS) method for decreasing the energy consumption of a group of intelligent electric vehicles. In [7], the authors proposed a novel switched control strategy for a heterogeneous vehicle platoon based on multiple objectives (SCSHPM) and showed its effectiveness.
When designing a controller, one must consider the relevant resource limitations [8]. In [8], the capacities of memory and processors were discussed. Considering the limited nature of such resources, it is important to establish an attack detection and defense mechanism that takes the available computational resources into account.
For platoons using CACC, string stability [9] is a fundamental and important property. A platoon is string stable if range errors do not propagate from one vehicle to the VOLUME 4, 2016 following vehicle. In a platoon using CACC, the controller in each vehicle needs to be designed to enhance the string stability even when the platoon is attacked [10]. In [10], the authors designed a decentralized controller for CACC considering string stability.
Moreover, transmission delays exist in V2V communications, which may cause a loss of string stability. In [11], the string stability in the presence of delay was analyzed using the magnitude of the string stability transfer function in both the continuous-time and discrete-time domains.
Cyberattacks on V2V communications, in which attackers maliciously eavesdrop on, interfere with and/or tamper with V2V communication data, have become a serious problem [12], [13] in recent years. In platoons using CACC, such attacks can cause a loss of string stability [14]- [16]. In [14], the various types of attacks on platoons with CACC were discussed, and the author showed that attacks on V2V communications could cause a significant loss of string stability. More specifically, the range errors among the vehicles increase, which results in traffic congestion and, in the worst case, may cause vehicle collisions. The effects on string stability of attacks on V2V communications have been investigated in previous works [15], [16]. Improving the resilience against such attacks on V2V communications is an essential and challenging task.
The two main requirements for mitigating attacks are attack detection and defense. When a platoon with CACC is attacked, the attack needs to be detected quickly and with high accuracy, and many attack detection mechanisms have been proposed for CACC [17]- [21]. In [17], the authors focused on replay attacks on connected vehicles and proposed a replay attack detection mechanism based on a noisy control signal methodology. In [18], the authors used a partial differential equation model for detecting attacks. In [19], [20], an anomaly detection mechanism that utilizes the physical laws of kinematics and a data fusion technique was proposed. In [21], the authors introduced a sliding mode observer to detect and estimate cyberattacks.
Once an attack is detected, the vehicles need to defend against the damage caused by the attack [22]- [25]. Defense mechanisms against jamming attacks were proposed in [22], [23], and an attack-resilient controller was designed in [24]. One technology for attack defense is called fallback control [25]. In fallback control, the system is normally observed and controlled by a networked controller, but when an attack is detected, the controller is switched from the networked controller to a local controller to reduce the effect of the attack. However, these conventional defense approaches require the design and implementation of at least two controllers, one for normal situations and another for attack defense, which increases the overall complexity of the system. To reduce the system complexity, we utilize an unknown input observer (UIO). UIOs are used to estimate the state of a system in the presence of unknown inputs. There are many studies on fault diagnosis using UIOs [26], [27]. In [26], [27], mechanisms were proposed for diagnosing faults accurately even when the information available from actuators or sensors is unreliable due to the faults. In these mechanisms, the UIO estimates the system state by treating the unreliable inputs from the actuators or sensors as unknown inputs. In recent years, UIOs have attracted attention as a promising approach for cyberattack detection [28], [29].
In this paper, we propose an attack detection and defense mechanism using a UIO to improve the resilience of platoons with CACC against attacks on V2V communications. The architecture of the proposed mechanism is shown in Fig. 2. In this mechanism, each vehicle is equipped with a sensor (e.g., a radar unit or camera), a V2V communication device (a Wi-Fi device), an input estimator, an attack detector, an input switcher, and a controller. The input estimator estimates the control input of the preceding vehicle based on information obtained by the sensor. When V2V communications are attacked, the information obtained from the Wi-Fi device is not reliable, so the input estimator uses a UIO to estimate the state of the preceding vehicle by treating the unreliable information as unknown inputs. Based on the estimated input, the attack detector then decides whether the system is under attack. Accordingly, the input switcher selects and sends inputs to the controller in accordance with the attack detection results. When no attack is detected, the input switcher sends inputs calculated based on the information obtained through V2V communication. However, when an attack is detected, the input switcher sends inputs calculated based on state estimation. Note that in the proposed mechanism, the same controller is used regardless of whether an attack is detected, and it is only the inputs to this controller that are switched. This approach enables a simple control system design that contributes to reducing the management cost of the system. Moreover, such simplicity is important for vehicles with limited energy and computational power. We also present simulation experiments conducted to elucidate the advantages and properties of the proposed mechanism. The simulations consider jamming and replay attacks on V2V communications, allowing the performance of the attack detection and defense mechanism under such attacks to be evaluated.
The contributions of this paper are as follows.
• To protect platoons from attacks on V2V communications, we propose an attack detection and defense mechanism using UIOs for platoons with CACC. The input estimator on each vehicle uses a UIO to estimate the state of the preceding vehicle without relying on unreliable communication data, which results in immediate and accurate attack detection. • In the proposed attack defense mechanism, when an attack is detected, the input switcher sends inputs calculated based on the state estimation results of the input estimator, which protects the vehicle against the attack. Since only one controller is implemented regardless of whether an attack is detected, the control system is simple, and therefore, the management cost of the system is low. • It is demonstrated through simulation experiments that the proposed mechanism can detect attacks with a 1step delay and enhance the stability of the system, thereby reducing the loss in safety due to attacks. In the simulations, we consider jamming and replay attacks as typical attacks on V2V communications and show that the proposed mechanism is effective for both types of attacks.
The remainder of this paper is organized as follows. We review CACC in Section II. Section III then describes the proposed attack detection and defense mechanism. We evaluate the proposed mechanism on the basis of simulation experiments in Section IV. Finally, we conclude our study in Section V. Fig. 1 shows an overview of a cyberattack on V2V communications in a platoon with CACC. This paper uses the vehicle dynamics model proposed in [30].

II. COOPERATIVE ADAPTIVE CRUISE CONTROL (CACC) SYSTEMS
Consider a platoon of M vehicles. The state of vehicle i is denoted by Controller i then calculates and sends the control input u i to vehicle i. In this paper, we focus on attacks targeting V2V communications such as jamming and replay attacks. In a platoon with CACC, there is a virtual vehicle called the reference vehicle, which has the role of leading the platoon. The state and control input of the reference vehicle are denoted by x 0 and u r , respectively. The dynamics of the reference vehicle are described by (1).
x 0 and u r can always be observed by vehicle 1 without V2V communication. In this paper, we assume that x 0 and u r cannot be attacked, meaning that x 0 and u r are reliable.
The dynamics of vehicle i (1 ≤ i ≤ M ) are given bẏ where and u i is the control input of vehicle i. Vehicle i calculates u i using sensor data q i−1 and v i−1 combined with the control inputũ i−1 (t) of vehicle i − 1 as obtained through V2V communication. The output y i of vehicle i is given by In CACC control, vehicle i receives control input from the preceding vehicle i − 1 through V2V communication, and this control input is then provided as input to controller i. The control input received at time t is denoted byũ i−1 (t). In general, there is a transmission delay in V2V communication, denoted by θ, which leads tõ The control input u i (t) is then calculated aṡ where e i (t) is given by Here, L is the vehicle length, r is the ideal intervehicle distance when the vehicles are stopped, and k p and k d are design parameters. Note that when i = 1,ũ 0 (t) = u r (t).  A block diagram of the closed-loop system for vehicle i is shown in Fig. 3, where , String stability [9] is an important concept for the stability of CACC. In this paper, we consider strong frequencydomain string stability (SFSS). A platoon exhibits SFSS if the transfer function Γ i−1,i between the outputs of vehicle i and its preceding vehicle i − 1 satisfies In this paper, we focus on the transfer function Γ i−1,i for velocity, as given in (8).
where V i (s) and Q i (s) are the Laplace transforms of v i (t) and q i (t), respectively.

III. PROPOSED MECHANISM
For simplicity, the communication delay θ is set to 0 in this paper. In CACC platoons, the control inputsũ i sent via V2V communication are not always reliable becauseũ i can be tampered with by attackers. We therefore introduce a UIO into each vehicle to detect attacks and maintain vehicle stability. An overview of the proposed mechanism is shown in Fig. 4. In this mechanism, an input estimator first estimates the state of the preceding vehicle, and an attack detector then uses the estimated state to decide whether V2V communications are under attack. When an attack is detected, an input switcher switches the controller input to secure input.
To implement the attack detection and defense mechanism, we discretize the dynamics model described in Section II. The discrete-time model for vehicle i, which is the discretization of (2) and (3), is with where T is the sampling period, and u i [k] = u i (kT ) (5) can also be rewritten as where e i,1 [k] and e i,2 [k] are given by In practice, the controller is implemented in discrete time as described in (10) because the position q i−1 , the velocity v i−1 , and the inputsũ i−1 are obtained in discrete time.

A. UNKNOWN INPUT OBSERVER (UIO)
We design a UIO i for each vehicle i. 1 UIO i estimates u i−1 by treatingũ i−1 as an unknown input. The UIO is described as follows: where A d , B d , C d , G 1 , G 2 , and J are design parameters. J affects the convergence speed of the state estimation process. Note that A + denotes the pseudoinverse of matrix A, i.e., Then, the estimated valueũ i of the control input is given bŷ The model of the system must satisfy certain restrictions in terms of observability and detectability. If the system is observable, we can create a UIO with an arbitrary convergence rate. If the system is not observable but is detectable, the convergence rate cannot be set, but a UIO can be created such that the error converges to zero. Because this system is observable, the convergence rate can be adjusted by setting the pole configuration and J.

B. ATTACK DETECTION MECHANISM
We now propose a mechanism for detecting attacks using the UIO. In the attack detection mechanism, vehicle i detects attacks by comparing the estimated valueû i of the control input against the valueũ i obtained through V2V communication.
The process of attack detection at vehicle i is shown in Fig. 5. Vehicle i observes the distance d i and the velocity  Fig. 6 presents a block diagram of the estimation process performed by UIO i. UIO i uses q i−1 and v i−1 to calculate the estimated statex i−1 of vehicle i − 1. The difference between the estimation result and the value one step earlier multiplied by A is then calculated to obtain Bû i−1 , which is an estimate of the state change due to the input. By multiplying this by the pseudoinverse matrix B + , we obtain an estimate of the inputû i−1 . In the proposed mechanism, not only the current estimated value but also previous estimated values are used to reduce the occurrence of false positives and false negatives in attack detection due to noise. In particular, we use the vectors T . The detection result is expressed as where N is the vector length, and h atk is a threshold for attack detection. Note that ||·|| 2 denotes the L 2 norm of a vector. A detection result of 1 means that the attack detector decides that the input signal is under attack, and 0 means that the attack detector decides that the input signal is not under attack.

C. DEFENSE MECHANISM
We next propose a defense mechanism by which the stability of the system can be maintained even if the system is under attack. When an attack is detected by vehicle i, vehicle i switches to a secure mode. In the secure mode, vehicle i uses the estimated valueû i−1 instead ofũ i−1 when calculating the control input u i according to (10). This allows vehicle i to mitigate the effects of attacks on V2V communications. Fig. 7 shows a block diagram of the defense process at vehicle i. The input switcher receivesũ i−1 andû i−1 and outputs If vehicle i decides thatũ i−1 is not under attack (i.e.,ũ i−1 is reliable), then the input switcher outputsũ i−1 asū i−1 . Otherwise, it outputsû i−1 asū i−1 . Since the system useŝ u i−1 whileũ i−1 is under attack, no compromised data are used, thus making the system resilient against attacks on V2V communications. A flowchart of the defense process at vehicle i is shown in Fig. 5. Note that the estimation process conducted by the UIO causes a one-step delay. In step k, the UIO estimates the control input in step k − 1. Therefore, in the fallback mode, the input switcher outputsû

IV. SIMULATION AND DISCUSSION
We next report simulation experiments conducted to clarify the advantages and properties of the proposed mechanism. The simulations consider two typical V2V communication attack scenarios, namely, jamming and replay attacks. We first evaluate the proposed attack detection mechanism in Section IV-A and then evaluate the proposed attack defense mechanism in Section IV-B.
The simulations consider a platoon of 10 vehicles (M = 10). Each vehicle follows the preceding vehicle based on the CACC model described in Section II. Note that vehicle 1, that is, the lead vehicle, follows a virtual reference vehicle. We conducted simulation experiments using MATLAB 2018b [31], with a sampling period T of 0.01 s. We summarize the parameter settings of our simulations in Table 1. The parameters were determined experimentally.
If there is no time delay, i.e., θ = 0 in Eq. (8), then the Bode diagram of Γ i−1,i is as shown in Fig. 8. This figure shows that the platoon exhibits SFSS.
The Bode diagram of Γ i−1,i with a 0.01 s delay, i.e., the one-step delay caused by switching the system from the normal operation mode to the defense mode, is shown in Fig. 9. As seen from this figure, even if there is a 0.01 s delay, the platoon still exhibits SFSS. This means that the proposed attack defense mechanism enhances the string stability of the platoon when the V2V communications of the platoon are attacked.
In our evaluation, the parameters of the discrete-time model for each vehicle were set as shown in the following The parameters of the UIOs were set as shown in the following equations.
The poles of the UIOs were set to 0.5, 0.2, and 0.1 based on these parameter matrices.

A. EVALUATION OF THE ATTACK DETECTION MECHANISM
We begin by evaluating the proposed attack detection mechanism. At the beginning of the simulation period, the 10 vehicles are stationary at 1.5 m intervals. In the first 0-100 s from the beginning of the simulation, the reference vehicle accelerates at 0.3 m/s 2 . After 100 s, the reference vehicle continues moving at 30 m/s. The 10 vehicles follow their preceding vehicles based on the CACC model given in Section II. On this basis, we conducted simulation experiments of jamming and replay attack scenarios. First, we evaluate the proposed attack detection mechanism in the case of a jamming attack. We consider attackers launching jamming attacks on the input signalsũ 1 ,ũ 3 , andũ 7 during the period of 90-150 s. When an input signalũ i is attacked, noise appears in that input signal; that is, vehicle i+1 receives u i + s noise instead of u i . Here, s noise is Gaussian noise that follows a standard normal distribution with mean 0 and variance 1.
To determine the detection threshold h atk and the vector length N , we evaluated the detection performance, i.e., the detection delay and accuracy, of the proposed mechanism while varying h atk and N .  First, we focus on the detection delay of the proposed mechanism. Fig. 10 shows the delay in attack detection plotted versus h atk and N . Regardless of the value of N , the detection delay is lower with a lower h atk . In particular, when h atk ≤ 0.2, the detection delay is only 1 step. Fig. 11 shows the delay in detecting that an attack has stopped plotted versus h atk and N . Regardless of the value of h atk , the detection delay is lower with a lower N . As seen from these results, h atk and N both need to be lower to decrease the delay in detecting that an attack has either started or stopped.
However, when h atk is too small, the attack detection results are vulnerable to disturbance and noise. Therefore, we set h atk to 0.1. Second, we focus on the detection accuracy. Fig. 12 shows the number of false negatives plotted versus h atk and N . When h atk = 0.1, the number of false negatives is large when N ≤ 3. As an example, the detection results with h atk = 0.1 and N = 1 are shown in Fig. 13. As shown in this figure, when N ≤ 3, attacks cannot always be detected. This is because when N is low, the proposed mechanism is vulnerable to temporal noise. When N ≥ 4, the proposed detection mechanism detects attacks correctly. Thus, we set h atk = 0.1 and N = 4 in the following evaluations.
The attack detection results at vehicles 2, 4, and 8 in the period of 80-200 s are shown in Figs. 14, 15, and 16, respectively. In these figures, a value of 1 means that the attack detector decides that the input signal is under attack, and 0 means that the attack detector decides that the input signal is not under attack, as defined in (15). The results show that attacks are detected immediately and accurately. Thus, the input estimator of each vehicle accurately estimates the state of the preceding vehicle even when information obtained through V2V communication is not reliable due to an attack. The attack detection time for each vehicle is only 1 step (i.e., 0.01 s). Moreover, when the attack ends, the attack detector in each vehicle decides that the input signal is no longer under attack within at most 0.04 s. This is because the proposed attack detection mechanism detects attacks based on the last 4 steps of information according to (15). Therefore, the proposed attack detection mechanism can detect jamming attacks immediately and accurately by virtue of the introduction of a UIO.       the attack ends, the attack detector of each vehicle decides that the input signal is no longer under attack within at most 0.04 s. The reason is that the attack and end-of-attack detection times are the same as for jamming attacks. Therefore, this evaluation shows the proposed attack detection mechanism can also detect replay attacks immediately and accurately by virtue of the introduction of the UIO.

B. EVALUATION OF THE ATTACK DEFENSE MECHANISM
We next evaluate the effectiveness of the proposed attack defense mechanism based on simulations of jamming and replay attack scenarios. First, we evaluate the proposed attack defense mechanism in the case of a jamming attack. The settings for the 10 vehicles are the same as in Section IV-A. The attackers conduct a jamming attack on the input signalsũ 1 ,ũ 3 , andũ 7 during the period of 90-150 s. When an input signalũ i is attacked, noise appears in that input signal; that is, vehicle i+1 receives u i + s noise instead of u i . Here, s noise is Gaussian noise following a standard normal distribution with mean 0 and variance 1.
The intervehicle distances under this jamming attack without and with the proposed defense mechanism from 80 s to   Fig. 20 for comparison. As seen from Fig. 21, when the input signals are attacked (i.e., during the period of 90-150 s), the intervehicle distances are disturbed, which could lead to vehicle collisions. In contrast, in Fig. 22, the intervehicle distances are not disturbed and remain the same as in the case of no attack (Fig. 20) even when the input signals are attacked. The proposed mechanism immediately detects when the input signals are under attack and switches the inputs to the inputs calculated without using the attacked input signals. Even when the inputs are switched, the string stability of the platoon is enhanced, as shown in Fig. 9, and as a result, the intervehicle distance is not disturbed by the attack. Moreover, as shown in Section IV-A, the inputs are switched with a delay 0.01 s after the beginning of the attack. However, the impact of the attacked signals on the system is small enough that it affects only 1 step (i.e., 0.01 s). Moreover, the input delay caused by the input estimation process is 0.01 s, which is small enough that the platoon is controlled in almost the same way as in the normal mode. Thus, the proposed mechanism protects the platoon from jamming attacks.
Next, we evaluate the proposed attack defense mechanism in the case of a replay attack. The settings for the 10 vehicles are the same as in Section IV-A. The attackers conduct a replay attack on the input signalsũ 1 ,ũ 3 , andũ 7 during the period of 110-170 s. More specifically, vehicle i + 1 receives the input signal u i (t − 90), which is the input signal from 90 s in the past, instead of u i (t) at time t. In this scenario, the attackers intend to accelerate vehicles 2, 4, and 8 while the other vehicles continue to move at a constant velocity, which could lead to vehicle collisions.  The intervehicle distances under this replay attack without and with the proposed defense mechanism from 80 s to 200 s are shown in Figs. 23 and 24, respectively. Under the replay attack, the intervehicle distances are greatly disturbed without the defense mechanism, as shown in Fig. 23. However, Fig. 24 shows that even when the effect of the attack is large, the intervehicle distances are not disturbed under the proposed defense mechanism.
To further investigate the effect of attacks, we conducted simulations of another situation, again considering the case of a replay attack. At the beginning of the simulation period, the velocities of the 10 vehicles are equal to 30 m/s, and the intervehicle distances are equal to 40.5 m. During the period of 50-150 s, the reference vehicle decelerates with an acceleration of −0.1 m/s 2 . Accordingly, u r is given by (23). The attackers conduct a replay attack on the input signalsũ 1 , u 3 , andũ 7 during the period of 110 ≤ t ≤ 170 s. The attacked signals are given by (24).
u i (t) = 0.4, if 110 ≤ t ≤ 170, i ∈ {1, 3, 7}, u i (t), otherwise. (24) This means that the attackers intend to accelerate vehicles 2, 4, and 8 while the other vehicles are decelerating, which is an extremely dangerous situation.   The intervehicle distances under this replay attack without and with the proposed defense mechanism from 80 s to 200 s are shown in Figs. 26 and 27, respectively. We also show the intervehicle distances under no attack in Fig. 25 for comparison. Although the effect of the attack is extremely large, as shown in Fig. 26, the intervehicle distances are not disturbed when the proposed defense mechanism is used, as shown in Fig. 27. Therefore, the proposed attack defense mechanism can protect the platoon from attacks even when the attack effect is large.

C. DISCUSSION
Many attack detection mechanisms have been proposed for CACC [17], [18]. However, these previous studies have only focused on single types of attacks or have not considered attack defense. The authors of [17] proposed a replay attack detection mechanism, and those of [18] proposed a realtime false injection attack detection mechanism. The authors of [19]- [21] focused on several kinds of attacks, but their proposals alone cannot defend vehicles from attacks. Our proposal can detect several kinds of attacks while also defending vehicles against attacks, making it advantageous compared to conventional mechanisms.

V. CONCLUSION
To improve the resilience of platoons using CACC against cyberattacks on V2V communications, we propose an attack detection and defense mechanism. By using a UIO, the state of the preceding vehicle can be estimated without using unreliable inputs obtained through V2V communication. Simulation experiments show that the proposed detection and defense mechanism can detect attacks with a 1-step delay and enhance the string stability of a platoon, reducing the loss in safety caused by attacks.
In this paper, we assume that there are no failures in the on-board sensors and no delays in communication over the network and that the controller itself is operating normally based on the control signals. In future research, to more closely replicate real-world situations, it will be necessary to consider situations in which network delays occur at nondefinite times and in which the controller itself is hijacked.