Real-Time Adaptive and Lightweight Anomaly Detection Based on a Chaotic System in Cyber–Physical Systems

When cyber–physical systems (CPSs) are connected to the Internet or other CPSs with connectivity, external adversaries can potentially gain access to the CPS and attempt to control the electronic control units (ECUs). In particular, the lack of confidentiality and integrity in the controller area networks (CANs) of CPSs makes it difficult to distinguish malicious data from legitimate data. The security vulnerabilities of CPSs, which are frequently exposed to adversaries, pose the risk of destabilizing the lives of humans. Therefore, we propose a real-time adaptive and lightweight anomaly detection (RALAD) mechanism that efficiently and securely detects anomalies within a given virtual group though verification of the data integrity and key management of stateless synchronization based on a chaotic system while driving. These characteristics prevent an adversary from authenticating maliciously modified messages even though it captures legitimate messages on the CAN bus. RALAD shows a clear difference from others in terms of (1) its unique secret key-sharing method and approach to secret key generation for each message, (2) safe controlling support after detecting anomalies, and (3) its software-based solution that eliminates the need for hardware secure modules. It leads to freedom from the issues of additional cost, weight, and wiring in CPSs. The proposed method achieves real-time anomaly detection, and the experiment results show a 100% detection rate for all attacks. This demonstrates that RALAD maintains high reliability and efficiency, even under various bus load conditions and attack rates.