Intrusion Detection for CPS Real-Time Controllers ∗

Security in CPS-based real-time embedded systems controlling the power grid has been an afterthought, but it is becoming a critical issue as CPS systems are net-worked and inter-dependent. This work presents a set of mechanisms for time-based intrusion detection, i.e., the execution of unauthorized instructions in real-time CPS environments. The novelty is the utilization of information obtained by static timing analysis for intrusion detection. Real-time CPS systems are unique in that timing bounds on code sections are readily available since they are required for schedu-lability analysis. We demonstrate how micro-timings can be exploited for multiple granularity levels of application code to track execution progress. Through bounds checking of these micro-timings, we develop techniques to detect intrusions (1) in a self-checkingmanner by the application and (2) through the operating system sched-uler, which are novel contributions to the real-time/embedded systems domain to the best of our knowledge.