Intrusion Detection in Medical Cyber Physical System (MCPS) Based On Behavior Rule Specification Method

Abstract

Medical cyber physical systems (MCPS) are getting popular now a days. Every advanced healthcare hospitals use the help of MCPS to ease otherwise complicated tasks. These systems analyze the patient status using physical sensors and employ corresponding reaction using actuators. An array of sensor devices is attached to the patient which reads real time data and analyses it. Actuators provide corresponding action with respect to the values sensed. Nowadays these cyber physical systems (CPS) are used as tool for cyber-attacks. This can relatively harm the patient or may even cause a direct or indirect threat to life. Since the CPS work based on sophisticated and more complex algorithms, intrusion detection in such system can be really complicated task. Behavior-rule specification-based technique is analyzed for intrusion detection of medical devices embedded in a medical cyber physical system (MCPS) where patient’s safety is of the utmost importance. Medical cyber physical systems (MCPS) are used as tool for cyber attacks. This can relatively harm the patient or may even cause a direct or indirect threat to life. Intrusion detection technique helps to detect secret attackers to support safe and secure MCPS applications. In this dissertation research we aim to design and validate intrusion detection system (IDS) protocols for a medical cyber physical system (MCPS) comprising sensors, actuators, control units, and physical objects for controlling and protecting physical infrastructures. The design part includes host IDS, system IDS and IDS response designs.

The validation part includes a novel model-based analysis methodology with simulation validation. Our objective is to maximize the MCPS reliability or lifetime in the presence of malicious nodes performing attacks which can cause security failures. Our host IDS design results in a lightweight, accurate, autonomous and adaptive protocol that runs on every node in the CPS to detect misbehavior of neighbor nodes based on state-based behavior specifications. Our system IDS design results in a robust and resilient protocol that can cope with malicious, erroneous, partly trusted, uncertain and incomplete information in a MCPS. Our IDS response design results in a highly adaptive and dynamic control protocol that can adjust detection strength in response to environment changes in attacker strength and behavior. The end result is an energy-aware and adaptive IDS that can maximize the MCPS lifetime in the presence of malicious attacks, as well as malicious, erroneous, partly trusted, uncertain and incomplete information. We develop a probability model based on stochastic Petri nets to describe the behavior of a MCPS incorporating our proposed intrusion detection and response designs, subject to attacks by malicious nodes exhibiting a range of attacker behaviors, including reckless, random, insidious and opportunistic attacker models. We identify optimal intrusion detection settings under which the MCPS reliability or lifetime is maximized for each attacker model.