On the Security of Networked Control Systems in Smart Vehicle and its Adaptive Cruise ControlThanks: Copyright (c) 2019 IEEE. Personal use of this material is permitted. However, permission to use this material for any other purposes must be obtained from the IEEE by sending a request to pubs-permissions@ieee.org.Thanks: F. Farivar is with the Department of Mechatronics and Computer Engineering, Science and Research Branch, Islamic Azad University, Tehran, Iran, Email: f.farivar@srbiau.ac.ir, farivar@ieee.org.Thanks: M. Sayad Haghighi is with the School of Electrical and Computer Engineering, College of Engineering, University of Tehran, Iran, Email: sayad@ut.ac.ir, sayad@ieee.org (corresponding author).Thanks: A. Jolfaei is with the Department of Computing, Macquarie University, Sydney, NSW 2109, Australia, Email: alireza.jolfaei@mq.edu.au.Thanks: Sheng Wen is with the Department of Computer Science and Software Engineering, Swinburne University of Technology, Australia, Email: swen@swin.edu.au.

Faezeh Farivar Mohammad Sayad Haghighi Affiliation: Alireza Jolfaei, , Sheng Wen, ,

Abstract

With the benefits of Internet of Vehicles (IoV) paradigm, come along unprecedented security challenges. Among many applications of inter-connected systems, vehicular networks and smart cars are examples that are already rolled out. Smart vehicles not only have networks connecting their internal components e.g. via Controller Area Network (CAN) bus, but also are connected to the outside world through road side units and other vehicles. In some cases, the internal and external network packets pass through the same hardware and are merely isolated by software defined rules. Any misconfiguration opens a window for the hackers to intrude into vehicles’ internal components e.g. central lock system, Engine Control Unit (ECU), Anti-lock Braking System (ABS) or Adaptive Cruise Control (ACC) system. Compromise of any of these can lead to disastrous outcomes. In this paper, we study the security of smart vehicles’ adaptive cruise control systems in the presence of covert attacks. We define two covert/stealth attacks in the context of cruise control and propose a novel intrusion detection and compensation method to disclose and respond to such attacks. More precisely, we focus on the covert cyber attacks that compromise the integrity of cruise controller and employ a neural network identifier in the IDS engine to estimate the system output dynamically and compare it against the ACC output. If any anomaly is detected, an embedded substitute controller kicks in and takes over the control. We conducted extensive experiments in MATLAB to evaluate the effectiveness of the proposed scheme in a simulated environment.

Index Terms:

Internet of Vehicles, Cyber Physical Systems, Software Defined Networks, Vehicular Ad hoc Networks, Car Cruise Control, Intrusion Detection, Covert Attack.

I Introduction

Intrusion Detection Systems (IDS), in their classic definition in the cyber world, are security systems that monitor the traffic coming in or going out of a network [1]. However, as the systems get more complex and interconnected, intrusions find more sophisticated instances and get out of the cyber-only world. Cyber Physical Systems (CPS) are where the cyber and physical worlds meet. They are usually mixtures of IT systems or networks and electro-mechanical entities. Examples of such systems are self-driving cars [2], remote surgical robots [3, 4] and smart power grids [5, 6].

Attacks launched on CPSs can cause damages in the real world and that will make their security a big concern in the coming years. With the realization of Industry 4.0, this threat becomes even bigger. A simple cyber attack on one CPS can create a cascade of failures in a complex interconnected system.

The previously-existing channels of intrusion, including computer networks [7], can open the vulnerability window to the CPS of network-controlled type. There are many instances of such systems around. For example, new vehicles, including smart vehicles, use Controller Area Network (CAN) bus to connect different micro-controllers governing the physical components of a vehicle. With the emergence of Internet of Vehicles (IoV) and Vehicular Ad hoc Networks (VANET) [8] and connection of smart vehicles to the outside world for e.g. Over The Air (OTA) software updates or information gathering, this threat has become even more serious [9]. In July 2015, Fiat Chrysler recalled 1.4 million cars after two hackers demonstrated how to penetrate and control a Jeep Cherokee remotely by using e.g. the car’s entertainment system which is supposedly connected to the mobile data network [10, 11]. Such incidents drew the attention of researchers to the security of vehicles’ CPSs [12].

The issue is that, more and more vehicles are relying on networked control systems whose collision domains or buses are shared with (or have a route to) the units connected to the Internet. The isolation is at best, enforced by some sort of software defined network (SDN) controller. This makes the attack surface larger and any misconfiguration can open a window to the internals of smart vehicle.

Classic Intrusion Detection Systems (IDS) were built to spot anomalies in the world of computer networks. However, in a CPS, analyzing the traffic alone without knowing the effect of each packet effect on the physical system, one cannot judge about its maliciousness.

Reference [13] has categorized CPS threats and defined a new family which is so called the “covert” attacks. Covert attacks are a subset of deception attacks in which an attacker takes control of some parts of the CPS, e.g. the control signal over the network channel, but tries to keep the attack effect small enough so that it is not detected by human observers. There are two types of covert attacks; one tries to create steady-state errors on the output of physical entity to e.g. exhaust or degrade the service performance over the time and the second type tries to create transient effects on the CPS output, perhaps repeatedly over a long period to achieve the same goal.

Inspired by the definition of covert attacks, this paper proposes two covert attacks on Adaptive Cruise Control (ACC) systems. In the first one, the attacker waits for the reference e vehicle to lower its speed and at the right moment and by creating a spike in the acceleration or manipulation of the controller reference, tries to cause an accident or increase its chance. In the second one, the attacker takes over the cruise controller and manipulates the reference signal to lower the distance to the reference car so that the risk of accidental crash is increased.

We then propose an intrusion detection mechanism for such covert attacks. This IDS takes advantage of a reference model trained by an observer to mimic the system response as closely as possible. A significant deviation from the expected behavior will make the IDS trigger an alarm and switch to the fail-safe controller embedded in the IDS or compensation system.

In order to evaluate the efficacy of the proposed detection and compensation scheme, we conducted extensive simulations by using Matlab Simulink platform. The results show that the proposed detection method successfully discloses covert attacks on AAC systems and the compensator, which is a simple embedded P controller, also manages to substantially reduce the attack impact on the system compared to when no protection mechanism is employed.

The rest of this paper is organized as follows: In Section II the model of the ACC system is described and its control goals are presented. Section III presents novel covert attack strategies on the ACC system and their corresponding compensation plans. Moreover, the IDS system is designed in this section. Section IV tests the IDS as well as its compensator in a simulation setup and discusses the results. Related studies are reviewed in Section V. The paper is concluded in Section VI.

II The Adaptive Cruise Control

In this section, we look into the description of the ACC system and its control goals. An ACC model is depicted in Fig. 1 (a) and Fig. 1 (b). A vehicle, called ego, is assumed to be equipped with ACC system. The ego vehicle has a radar to measure the distance to the front vehicle, which is so called the lead vehicle. The lead vehicle is presumably driving in the same lane as the ego vehicle. In addition, the relative velocity is measured by the sensor/radar. The control objectives of the ACC system is to make the ego vehicle travel at a driver-specified speed as long as it maintains a safe distance with the lead vehicle.

There are two modes that the ACC system controls the ego vehicle with. In the first one, the speed (of the ego vehicle) is set to a driver-set speed as long as a minimum distance is maintained with the lead vehicle. In the second mode, the space between the two vehicles is controlled (by changing the ego vehicle’s speed) so that the two vehicles do not get closer than a safe distance. According to real-time measurements, either working mode can be enabled by the ACC system. For example, if the relative distance is considerably decreased, the ACC systems switches from mode 1 to mode 2. Likewise, if the distance goes beyond a threshold, the ACC system switches from mode 2 to mode1. To determine the ACC system operating mode, the following rules are considered:

•

If $D_{rel}\geqslant D_{Safe}$ , then the speed control mode is active. Track the driver-set velocity. $V_{set}$ is the goal.
•

If $D_{rel}<D_{Safe}$ , then the space control mode is active. Keep a safe distance with the lead vehicle. $D_{Safe}$ is the goal.

II-A ACC Mathematical Model

The model dynamics of the lead and ego vehicles are the same. Let $x$ , $v=\dot{x}$ , $a=\dot{v}=\ddot{x}$ denote the position, velocity, and acceleration of vehicles, respectively. A simple first order equation expressing the car cruise control operation is shown below:

	$\displaystyle\dot{x}_{ego}(t)$	$\displaystyle=F_{v}(D_{rel}(t))$		(1)
	$\displaystyle D_{rel}(t)$	$\displaystyle=x_{lead}(t)-x_{ego}(t)$		(2)

where $F_{v}$ is a velocity function that explains how the ego vehicle chooses to go, given that its distance to the lead vehicle is $D_{rel}$ . The function $F_{v}(D_{rel})$ can be learned from the sensor data taken along the road, or can be inferred from human driving behaviors. A key modeling weakness of the first order model is that it is not exactly possible for drivers to choose their velocity, because vehicles have inertia due to their mass. Therefore, different velocities can usually be achieved only via gradual acceleration or deceleration. The second order model describes this via Newton’s laws of motion:

\displaystyle\ddot{x}_{ego}=F_{a}(x_{lead}-x_{ego},\dot{x}_{lead}-\dot{x}_{ego},\dot{x}_{ego})

(3)

Here $F_{a}(D_{rel},v_{rel},v_{ego})$ models the acceleration of the ego vehicle as some nonlinear function of the distance to the lead vehicle, the relative velocity to the lead vehicle, and the the ego vehicle velocity. Two second order models are the following-the-leader and the optimal velocity models. The following-the-leader model is characterized by:

\displaystyle\ddot{x}_{ego}=\alpha\frac{\dot{x}_{lead}-\dot{x}_{ego}}{x_{lead}-x_{ego}}

(4)

where $\alpha$ is a constant parameter. The optimal velocity model is as follows:

\displaystyle\ddot{x}_{ego}=\beta(F_{v}({\dot{x}_{lead}}-{\dot{x}_{ego}})-{\dot{x}_{ego}})

(5)

in which $\beta$ is a constant parameter. In the the following-the-leader model, each vehicle has its own velocity related to its lead vehicle’s velocity. In the optimal velocity model, there is a velocity function $F_{v}(D_{rel})$ and the ego vehicle velocity relates to that optimal velocity that corresponds to the given spacing $x_{lead}-x_{ego}$ . The two models can also be combined as follows:

\displaystyle\ddot{x}_{ego}=\alpha\frac{\dot{x}_{lead}-\dot{x}_{ego}}{x_{lead}-x_{ego}}+\beta(F_{v}({\dot{x}_{lead}}-{\dot{x}_{ego}})-{\dot{x}_{ego}})

(6)

As mentioned before, the model dynamics of the lead and ego vehicles are the same. For both ego and lead vehicles, the dynamics between acceleration and velocity in Laplace domain are modeled as:

\displaystyle G(s)=\frac{1}{s(0.5s+1)}

(7)

which approximates the dynamics of the throttle body and vehicle inertia. The inputs of the ACC system are the driver-set velocity $V_{set}$ , time gap $T_{gap}$ which is the time gap between the vehicles, velocity of ego vehicle $V_{ego}$ , relative distance to the lead vehicle $D_{rel}$ , and the relative velocity to the lead vehicle $V_{rel}$ (which is given by the vehicle radar). The output of the ACC system is the acceleration of the ego vehicle.

The safe distance between the lead and ego vehicles is calculated as follows [14]:

\displaystyle D_{safe}=D_{default}+T_{gap}V_{ego}

(8)

where $D_{default}$ is the standstill default spacing and $T_{gap}$ is the time gap between the vehicles.

III Intrusion Detection and Compensation

In this section, we assume that the ACC system is prone to covert or stealth attacks which disrupt the control operation. First, we introduce two attack scenarios for the ACC system. Then, we design an intelligent intrusion detection system for ACC. Then, a novel idea is presented to compensate the effect of the detected intrusions in both scenarios.

III-A Covert Attack Scenarios

As mentioned in the previous section, the ACC system operates in two modes; the speed control mode and the space control mode. In this paper, two attack scenarios are studied which target these control objectives of the ACC system. Both attack scenarios are covert by definition. They intrude the ACC system and change its output. In other words, the attacker disrupts the acceleration of the ego vehicle to change the normal operation of the ego vehicle.

Attack Scenario #1: The first stealth or covert attack starts with compromising the ACC unit. The attacker remains dormant and monitors the measured distance to the front vehicle while letting the ACC do its job. At the times this distance is at its lowest (presumably near the minimum safe distance), it creates a spike in the control signal and makes the vehicle accelerate, hoping that by temporally lowering the distance to something less than the standard or increasing the speed to something above the limit, the chance of having accidents is increased. This could similarly happen when the front vehicle suddenly brakes and the compromised ACC refuses to reduce the speed.

Attack Scenario #2: The attacker compromises the ACC unit similar to the first attack, however, unlike the first scenario he/she does not ambush for the attack. The attacker trivially lowers the ACC’s reference distance i.e. $D_{Safe}$ in this scenario. Therefore, during the times ACC is in mode 2 and tries to maintain the safe distance, it is practically following a false reference which gets the ego car closer to the lead vehicle than it really should be. However, since this difference is trivial and not noticeable to the driver, this attack remains covert or stealth. The result is not trivial though. Statistically speaking, depending on the road condition (e.g. wet or dry), the braking power of the lead and ego vehicles, and the ego vehicle’s driver reaction time, the chance of having accidents considerably increases.

III-B Intelligent Intrusion Detection

Accuracy in detection and reaction times are important issues in CPS security. Reaction time is critical to prevent the process failures. Early detections increase the chance for compensator to maintain CPS performance.

We propose to use an Intrusion Detection System (IDS) to spot the covert attacks introduced. We assume that there is an initial safe interval during which an identifier learns the CPS/plant dynamics. This could be as simple as a transfer function identification for linear systems. The initial safe period assumption is not unreasonable since a vehicle is not hacked or infected by a worm as soon as it comes out of the factory.
Therefore, we assume that attacks, if there are any, are launched after $T_{attack}$ seconds. An intelligent identifier is used to construct a model of the CPS while it operates in the safe interval. The identifier we employ is an artificial neural network.
In this study, we suggest using adaptive hard thresholds to detect anomalies. The sum of modeling errors and quantization errors (as a result of digitizing the signals and passing them through the network) form a residual error $(Y_{out}-Y_{nn})$ based on which IDS determines the detection threshold. This error statistical data is collected from the plant during the safe operation interval. Hypothetically speaking, if the aggregated errors have a Gaussian distribution in the state $\psi_{i}$ , the alert threshold should be set to $\mu_{i}\pm k\sigma_{i}$ [1]. Here, $k$ is a constant coefficient and $\mu_{i}$ and $\sigma_{i}$ are the mean and std of the Gaussian error distribution in system state $\psi_{i}$ . According to [1], the probability of getting a false positive equals $2Q(k)=erfc(\frac{k}{\sqrt{2}})$ . Decreasing false positives usually results in an increase of false negatives. Therefore, $k$ should be selected in a way that significant deviations are captured and small perturbations are ignored. The proposed scheme for detection and compensation of the malicious attack in the ACC system is demonstrated in Fig. 2.

III-C Control Systems and Compensation Strategies

In this study, we take a model predictive control (MPC) system as the main ACC core. The MPC system controls the vehicle in the normal mode. If the IDS that monitors ACC behavior, detects an anomaly, it means that an attack has happened. Therefore, IDS switches from the main control system to the compensator in order to alleviate the effect of attack (on the the ego car).

As mentioned, the core of ACC is an MPC which applies the linear model of the system, disturbance and noise models to estimate the state of the control system and also anticipate the system future outputs. By using the anticipated outputs, the MPC solves a quadratic programming optimization problem to provide optimal adjustments for variables. The structure of an MPC system is shown in Fig. 3.

The compensator proposed in this study is a PID control system. The reason for this choice is the popularity of this family of controllers in industry and the low cost of embedding such a unit inside the intrusion detection and compensation system. In a case study, we design P controllers to compensate the effect of covert attacks in the scenarios introduced before.

IV Evaluation Results and Discussions

The proposed scheme for the ACC system described in Section II is illustrated in Fig. 2. As mentioned before, the ACC system is prone to malicious attacks. We introduced two types of covert attack scenarios in subsection III-A. In this section, the proposed strategies for detection and compensation are applied to the smart vehicle system. The parameter values used in the simulations are as follows: The initial positions for the lead vehicle and the ego vehicle are $x_{0,lead}=50~(m)$ and $x_{0,ego}=10~(m)$ . The initial velocities for the lead vehicle and the ego vehicle are $v_{0,lead}=25~(m/s)$ and $v_{0,ego}=20~(m/s)$ . Additionally, we assume that $Tgap=1.4~(s)$ , $D_{default}=10~(m)$ , $v_{set}=30~(m/s)$ , $a_{ego,~min}=-3~(m/s^{2})$ , and $a_{ego,~max}=2~(m/s^{2})$ .

IV-A Intelligent Intrusion Detection System

The results of applying the proposed intrusion detection system is shown in Fig. 4. The attack has been launched at $t=40~s$ in both scenarios. As observed, the IDS alert flag is raised almost immediately. Therefore, the compensating system, which is a duplicate but simple replacement for the ACC unit, is enabled after the detection of covert attacks.

IV-B Compensation of Covert Attacks - Attack Scenario #1

As mentioned before the first covert attack scenario is related to the speed control goal. The attacker tries to accelerate (the ego vehicle) when the lead decreases its speed and the distance between the two cars gets lower, right at $t=40s$ as shown in Fig. 4 (a) and Fig. 5 (a). As a result, the gap between the two cars gets smaller than the safe distance temporarily. This can be done repeatedly, however, only one attack instance has been shown in the figures. The indicators of the attack are visually hidden from the driver. The increase in acceleration and the reduction in car-to-car distance are not big enough to draw the attention of the ego diver, thus it remains stealth even after $t=40s$ . However, the probability of accidents has been increased, at least in the short time window(s). With the IDS employed, the ACC system is taken over by an embedded P controller upon attack detection. The attack is detected shortly, after around $200ms.$ One can verify from Fig. 5 (b) that the vehicle has managed to operate normally after $t=40.2s$ since IDS has taken the infected controller out of the loop and has put the embedded compensator in charge.

IV-C Compensation of Covert Attacks - Attack Scenario #2

As mentioned before, in the second covert attack scenario, the attacker tries to disrupt the reference of the ACC system, especially in mode 2, such that the gap between the two vehicles remains below the safe distance. The IDS reaction to this attack is shown in Fig. 4(b). Since this is a covert attack, the driver of the ego vehicle does not necessarily sense any fluctuations in acceleration, as observed in Fig. 6 (a). However, the relative distance gradually grows smaller and after around 60s, the effective gap between the two vehicles is reduced by almost 5m. This might not be noticeable (in 50m) by the driver but considerably increases the chance of accidents, especially when the lead car has good brakes and the ego car does not. Similar to the previous scenario, if the embedded P compensator is enabled upon IDS signal, it manages to overcome the side effects of the attack. As the plots in Fig. 6(b) show, the attack is again detected in less than 200ms and the control goal is fairly satisfied after a small transient disturbance.

As the simulation results show, the proposed intrusion detection and compensation strategy is quick and effective. It can ensure the relative distance between the ego and lead vehicles does not get smaller than the safe distance.

V Related Work

We discuss the related work in some issues of intrusion detection and compensation in CPS and intelligent transportation systems, especially Vehicular Ad Hoc Networks (VANETs).

The issue of CPS security has received considerable attention ever since Stuxnet [16] struck. Intrusion detection in CPS and IoT systems has been realized by applying many classic and intelligent methods. In [12], artificial neural networks were applied to detect intrusions which may happen in vehicular networks. In [17], an intrusion detection system (IDS) has been designed for Home Area Networks (HAN). The IDS is based on ZigBee technology, because ZigBee is dominant in HANs. Abnormal patterns of the network is detected using deviations from normal behavior.

Deception attacks are considered instances of the man-in-the middle (MITM) attack, e.g. false data injection. False data injection attacks in electric power grids and wireless sensor networks are studied in [18, 19, 20]. In these papers, the attackers are deemed to be aware of the system information as well as the controller. Therefore, they proposed covert attacks on physical systems. In [21] and [22], Packet delay and Denial of Service (DoS) attacks are modelled as stochastic processes in which the attacker launches zero-dynamic attacks on the system. Also, the stealth attacks for linear time invariant systems has been studied. Other viewpoints and algorithms for time-based IDS have been proposed in [23]. Bound checking of execution micro-timings has been proposed to be adopted by application(s) in order to detect intrusions during a self test procedure.

In [13], a covert attack has been studied for the purpose of service degradation. The goal was to study how covert attacks change the performance of networked control systems. In this paper, the attacker identifies the model of the plant and the controller. Then, the attacker determines what actions can damage the system, either in a short period or in the long run. Short-time attacks are designed to create overshoots on the system output and long-term service degradation attacks aim creating a noticeable steady state errors. In [1], an intrusion detection and compensation system is proposed for CPS to fight covert attacks. Errors of the output and its estimation are used for artificial neural network IDS. An intelligent controller is also designed to compensate the effect of attacks and it can replace the classic controller upon the attack detection. In [24], a hybrid strategy is applied to provide a tolerant control for compensation of cyber attacks launched on the inputs and outputs of a CPS of rotary gantry type. The malicious attacks studied in this paper is Denial of Service (DoS) attacks which cause packet loss in the control input and sensor output. In this paper, several classic and intelligent controllers have been studied in terms of robustness and effectiveness against cyber attacks. The authors in [25] took a different approach regarding the security of CPS. Instead of proposing an IDS, they showed how one can build an Intrusion Prevention System (IPS) for real-time cyber physical systems in general. Their approach results in a zero false-positive firewall whose rules are written automatically by an algorithm from dataset.

Intelligent transport systems are one of the major elements of smart cities [26]. Vehicular Ad hoc Networks (VANETs) have become a key component of the intelligent transport system. VANETs provide safety information for both drivers and passengers. There are many issues and limitations in VANETs in practice [27, 28, 29]. They include network volatility, delay-sensitive applications, network scale, heterogeneity, wireless link usage, multi-hop connection, anonymity, etc. Some types of attacks affect the operation performance of VANETs [27, 30]. Attacks are categorized into insider (launched by internal authorized malicious vehicles) and external (launched from outsiders). From another perspective, attacks are classified as passive and active. Reference [31] also classifies attacks into four main groups which pose (1) a risk to wireless interface, (2) a threat to hardware and software, (3) a hazard to sensors in-put in vehicle and (4) a danger behind wireless access (in the infrastructure). Malicious attacks in VANETs can be message spoofing, message replay attack, integrity attack, impersonation attack, Denial of service (DoS) attack, De-anonymization attack [32], movement tracking, etc.

In [33], data security and privacy issues in intelligent transportation systems have been studied. In this paper, it has been assumed that data streams are coming out of vehicles and go to road side units. A group formation in the vehicular layer is proposed in which the (group) leader can communicate with the members as well as the road side unit. A lightweight permutation mechanism is applied to preserve the confidentiality and privacy of sensory data.

In [34], an algorithm is presented that can detect jamming attacks of DoS type in VANETs. In the proposed detection algorithm, multiple malicious nodes and irrelevant nodes can be detected and isolated from the routing network. In [35], an IDS is proposed which can be used in the wireless and dynamic networks, like VANETs. A novel algorithm, which contains a feature extraction method as well as a hierarchical classifier, has been developed for intrusion detection in VANETs. The ”differences of traffic flow” and ”position” are the two main features that should be extracted. The classifier works based on relabeling and recalculating mechanisms.

VI Conclusion

In this paper, detection and compensation of covert intrusions into adaptive car cruise control system (ACC) were studied. Two scenarios for covert attacks on ACC were introduced such that the ACC system is not able to satisfy the speed and space control goals of the smart vehicle. An artificial neural network identifier was proposed to learn the ACC system and predict its outputs. The IDS system works based on comparison of the actual ACC outputs with those of the identifier that received the same inputs. Anomalies are captured by statistical measures and they raise a flag that switches the MPC system to an embedded PID controller. Simulation results confirmed that the proposed approach was effective in the sense that it both achieved detecting the covert attacks and mitigated their effects on the performance of tested vehicle.

Acknowledgement

Authors are thankful to the Advanced Networking and Security research Laboratory (ANSLab.org) for the supports provided during this study.

References

[1] F. Farivar, S. Barchinezhad, M. Sayad Haghighi, and A. Jolfaei, “Detection and compensation of covert service-degrading intrusions in cyber physical systems through intelligent adaptive control,” in The IEEE International Conference on Industrial Technology, 2019.
[2] K. M. A. Alheeti, A. Gruebler, and K. D. McDonald-Maier, “An intrusion detection system against black hole attacks on the communication network of self-driving cars,” in 6th international conference on emerging security technologies (EST), 2015, pp. 86–91.
[3] R. Mitchell and R. Chen, “Effect of intrusion detection and response on reliability of cyber physical systems,” IEEE Transactions on Reliability, vol. 62, no. 1, pp. 199–210, 2013.
[4] R. Mitchell and R. Chen, “Behavior rule specification-based intrusion detection for safety critical medical cyber physical systems,” IEEE Transactions on Dependable and Secure Computing, vol. 12, no. 1, pp. 16–30, 2014.
[5] S. Sridhar, A. Hahn, and M. Govindarasu, “Cyber–physical system security for the electric power grid,” Proceedings of the IEEE, vol. 100, no. 1, pp. 210–224, 2011.
[6] A. Mohammadali, M. S. Haghighi, M. H. Tadayon, and A. Mohammadi-Nodooshan, “A novel identity-based key establishment method for advanced metering infrastructure in smart grid,” IEEE Transactions on Smart Grid, vol. 9, no. 4, pp. 2834–2842, 2016.
[7] M. S. Haghighi and K. Mohamedpour, “Neighbor discovery: Security challenges in wireless ad hoc and sensor networks,” in Trends in Telecommunications Technologies. Intech, 2010.
[8] N. Toorchi, M. A. Attari, M. S. Haghighi, and Y. Xiang, “A markov model of safety message broadcasting for vehicular networks,” in IEEE Wireless Communications and Networking Conference (WCNC), 2013, pp. 1657–1662.
[9] M. Harris, “Researcher hacks self-driving car sensors,” IEEE Spectrum, vol. 9, p. , 2015.
[10] BBC News. (2015, accessed on 01.011.2019) Fiat chrysler recalls 1.4 million cars after jeep hack. [Online]. Available: https://www.bbc.com/news/technology-33650491
[11] E. Woollacott. (2017, accessed on 01.011.2019) Could a hacker hijack your connected car? [Online]. Available: https://www.bbc.com/news/technology-33650491
[12] M.-J. Kang and J.-W. Kang, “Intrusion detection system using deep neural network for in-vehicle network security,” PloS one, vol. 11, no. 6, p. e0155781, 2016.
[13] A. O. de Sá, L. F. R. da Costa Carmo, and R. C. Machado, “Covert attacks in cyber-physical control systems,” IEEE Transactions on Industrial Informatics, vol. 13, no. 4, pp. 1641–1651, 2017.
[14] P. Shakouri, A. Ordys, D. S. Laila, and M. Askari, “Adaptive cruise control system: comparing gain-scheduling pi and lq controllers,” IFAC Proceedings Volumes, vol. 44, no. 1, pp. 12 964–12 969, 2011.
[15] V. Tzovla and A. Mehta, “A simplified and integrated approach to model predictive control implementation,” Advances in Instrumentation and Control, p. , 2000.
[16] N. Falliere, L. O. Murchu, and E. Chien, “W32. stuxnet dossier,” White paper, Symantec Corp., Security Response, vol. 5, no. 6, p. 29, 2011.
[17] P. Jokar, H. Nicanfar, and V. C. Leung, “Specification-based intrusion detection for home area networks in smart grids,” in IEEE International Conference on Smart Grid Communications (SmartGridComm). IEEE, 2011, pp. 208–213.
[18] Y. Liu, P. Ning, and M. K. Reiter, “False data injection attacks against state estimation in electric power grids,” ACM Transactions on Information and System Security (TISSEC), vol. 14, no. 1, p. 13, 2011.
[19] R. Deng, P. Zhuang, and H. Liang, “False data injection attacks against state estimation in power distribution systems,” IEEE Transactions on Smart Grid, vol. 10, no. 3, pp. 2871–2881, 2018.
[20] Y. Mo, E. Garone, A. Casavola, and B. Sinopoli, “False data injection attacks against state estimation in wireless sensor networks,” in 49th IEEE Conference on Decision and Control (CDC). IEEE, 2010, pp. 5967–5972.
[21] M. Long, C.-H. Wu, and J. Y. Hung, “Denial of service attacks on network-based control systems: impact and mitigation,” IEEE Transactions on Industrial Informatics, vol. 1, no. 2, pp. 85–96, 2005.
[22] A. Teixeira, I. Shames, H. Sandberg, and K. H. Johansson, “Revealing stealthy attacks in control systems,” in 2012 50th Annual Allerton Conference on Communication, Control, and Computing (Allerton). IEEE, 2012, pp. 1806–1813.
[23] C. Zimmer, B. Bhat, F. Mueller, and S. Mohan, “Time-based intrusion detection in cyber-physical systems,” in Proceedings of the 1st ACM/IEEE International Conference on Cyber-Physical Systems. ACM, 2010, pp. 109–118.
[24] M. S. Haghighi, F. Farivar, A. Jolfaei, and M. H. Tadayon, “Intelligent robust control for cyber-physical systems of rotary gantry type under denial of service attack,” Journal of Supercomputing, 2019.
[25] M. Sayad Haghighi, F. Farivar, and A. Jolfaei, “Automatic configuration of firewalls in industrial control systems based on the novel concept of $\mathfrak{z}$ -classification,” under review, 2019.
[26] Z. Xiong, H. Sheng, W. Rong, and D. E. Cooper, “Intelligent transportation systems for smart cities: a progress review,” Science China Information Sciences, vol. 55, no. 12, pp. 2908–2914, 2012.
[27] B. Mokhtar and M. Azab, “Survey on security issues in vehicular ad hoc networks,” Alexandria engineering journal, vol. 54, no. 4, pp. 1115–1126, 2015.
[28] M. Raya, P. Papadimitratos, and J.-P. Hubaux, “Securing vehicular communications,” IEEE wireless communications, vol. 13, no. 5, pp. 8–15, 2006.
[29] P. N. Darisini and N. S. Kumari, “A survey of routing protocols for vanet in urban scenarios,” in International Conference on Pattern Recognition, Informatics and Mobile Engineering. IEEE, 2013, pp. 464–467.
[30] D. Djenouri, L. Khelladi, and N. Badache, “Security issues of mobile ad hoc and sensor networks,” in IEEE Communications Surveys Tutorials, vol. 7, no. 4. IEEE Communications Society, 2005, pp. 2–28.
[31] H. Hasrouny, A. E. Samhat, C. Bassil, and A. Laouiti, “Vanet security challenges and solutions: A survey,” Vehicular Communications, vol. 7, pp. 7–20, 2017.
[32] M. Sayad Haghighi and Z. Aziminejad, “Highly anonymous mobility-tolerant location-based onion routing for vanets,” IEEE Internet of Things Journal, in press, 2019.
[33] A. Jolfaei and K. Kant, “Privacy and security of connected vehicles in intelligent transportation system,” in Annual IEEE/IFIP International Conference on Dependable Systems and Networks–Supplemental Volume (DSN-S). IEEE, 2019, pp. 9–10.
[34] S. Kumar and K. S. Mann, “Detection of multiple malicious nodes using entropy for mitigating the effect of denial of service attack in vanets,” in 4th International Conference on Computing Sciences (ICCS). IEEE, 2018, pp. 72–79.
[35] J. Liang, J. Chen, Y. Zhu, and R. Yu, “A novel intrusion detection system for vehicular ad hoc networks (vanets) based on differences of traffic flow and position,” Applied Soft Computing, vol. 75, pp. 712–727, 2019.