Modern cyber-physical systems such as autonomous vehicles and aircraft have a large number of sensors, actuators and control devices. An Intrusion Detection System (IDS) for the cyber-physical system monitors the sensor measurements, control actions and other events to determine if the cyber-physical system is behaving abnormally. Our approach to intrusion and anomaly detection in the cyber-physical system is based on learning an interpretable model of the cyber-physical system. Deviation of the observations from the predictions based on the model point to anomalous behavior. The two primary techincal problems we address in this paper are: learning a sparse switched ARX model of the cyber-physical system from observed data (akin to system identification) and inference on the learnt model to detect anomalies. We present algorithms for system identification of switched ARX models and for inference on switched ARX models. We then evaluate the performance of our algorithms on experimental data.
展开▼
