PaperlayerView exact revision on arXiv

Source-linked AI summary

Survey on Misbehavior Detection in Cooperative Intelligent Transportation Systems

Rens W. van der Heijden, Stefan Dietzel, Tim Leinmüller, Frank Kargl

arXiv:1610.06810v2cs.CR

TL;DR

cITS require security beyond PKI because validly credentialed insiders can still transmit erroneous data. This survey classifies misbehavior detection mechanisms, reviews the field, and identifies open issues and future research directions, concluding that the overview supports further work in cITS and broader CPS security.

  • Problem

    PKI can exclude attackers without key material but cannot address insider nodes that possess valid credentials and transmit erroneous data.

  • Method

    The survey defines misbehavior, classifies detection mechanisms and attacker models, reviews seminal approaches, and synthesizes their challenges and open issues.

  • Results

    The survey provides a wide-ranging overview and introduction to cITS misbehavior detection approaches for industry, developers, standardization agencies, and researchers.

  • Takeaways & Limitations

    Future work should exploit the orthogonal classes of cITS misbehavior detection and generalize their mechanisms to other cyber-physical systems.

  • Takeaways & Limitations

    Many detection mechanisms are difficult to compare because they use different attacker models, so shared scenarios and attacks are needed for meaningful comparison.

Abstract

from arXiv · show

Cooperative Intelligent Transportation Systems (cITS) are a promising technology to enhance driving safety and efficiency. Vehicles communicate wirelessly with other vehicles and infrastructure, thereby creating a highly dynamic and heterogeneously managed ad-hoc network. It is these network properties that make it a challenging task to protect integrity of the data and guarantee its correctness. A major component is the problem that traditional security mechanisms like PKI-based asymmetric cryptography only exclude outsider attackers that do not possess key material. However, because attackers can be insiders within the network (i.e., possess valid key material), this approach cannot detect all possible attacks. In this survey, we present misbehavior detection mechanisms that can detect such insider attacks based on attacker behavior and information analysis. In contrast to well-known intrusion detection for classical IT systems, these misbehavior detection mechanisms analyze information semantics to detect attacks, which aligns better with highly application-tailored communication protocols foreseen for cITS. In our survey, we provide an extensive introduction to the cITS ecosystem and discuss shortcomings of PKI-based security. We derive and discuss a classification for misbehavior detection mechanisms, provide an in-depth overview of seminal papers on the topic, and highlight open issues and possible future research trends.

I. INTRODUCTION

cITS connect vehicles, infrastructure, and back-end systems through dynamic wireless networks to improve transportation, but their application-specific and physical-world interactions create serious security challenges. Because valid credentials do not prevent insiders from manipulating messages, misbehavior detection provides a reactive complement to proactive security.

  • cITS and security challenges: cITS use networked vehicles, roadside units, and back-end systems to support safer, greener, more autonomous, and better-informed travel.Sensors measure real-world conditions and communicate them through a ubiquitous wireless network.
  • cITS and security challenges: The integrity and correctness of information exchanged between cITS vehicles is a central security challenge, especially as systems support cooperative and autonomous driving.The challenge concerns transmitted information used by applications interacting with the physical world.
  • Proactive and reactive security: PKI excludes unauthorized entities by validating credentials, but compromised keys or manipulated messages can still enable successful attacks by authorized insiders.Proactive security therefore creates a trusted perimeter without eliminating all attack vectors.
  • Proactive and reactive security: Misbehavior detection is the detection step of reactive security, identifying attacks that proactive mechanisms fail to prevent in cITS.Reactive security also includes a subsequent reaction step intended to stop detected attacks.
  • Example misbehavior: Jamming disrupts wireless message transfer, whereas semantic data injection can fabricate a nonexistent traffic jam and influence routing and vehicle behavior.The two examples illustrate attacks against communication availability and information correctness.
  • Example misbehavior: False safety messages in applications such as platooning could contribute to accidents, making detection of false information essential.The paper connects such risks to attacks that manipulate cyber messages and physical processes.

II. RELATED SURVEYS & CONTRIBUTION

The survey narrows cITS security research to misbehavior detection, distinguishing it from broader routing- and attack-oriented surveys. It contributes a taxonomy, detailed classification, state-of-the-art overview, and discussion of open challenges across cITS communication and applications.

  • Scope and positioning: Unlike broad cITS security surveys, this work focuses specifically on misbehavior detection and categorizes mechanisms in relation to real-world processes.The survey places prior works in a common cITS context to expose vulnerabilities caused by differing attack assumptions.
  • Scope and positioning: Compared with tutorial-style surveys, it provides deeper analysis of detection methods, including scheme properties, privacy, and generalizability.The authors identify recurring patterns in how the literature addresses detection.
  • Scope and positioning: Compared with routing-oriented detection surveys, it examines safety-critical attacks such as data injection in greater detail and qualitatively discusses mechanism weaknesses.Its shared-characteristics classification helps identify comparable schemes, parallels, and research gaps.
  • Contributions: The survey covers cITS security state of the art and current standardization efforts.This overview appears alongside its focused treatment of misbehavior detection.
  • Contributions: It defines misbehavior, an attacker model, and a novel taxonomy for cITS misbehavior detection.These definitions establish the framework used to organize the surveyed mechanisms.
  • Contributions: A fine-grained classification by detection method helps readers identify mechanisms with orthogonal functionality and compare relevant classes.The survey also uses the taxonomy to organize its overview of seminal works.
  • Contributions: The survey discusses solved and open challenges and compares cITS misbehavior detection with detection in other domains.It considers implications for broader cyber-physical systems.
  • cITS overview: The cITS communication context includes V2V and V2I links, broadcast and multicast patterns, and standardized CAM, DENM, and BSM message types.These patterns support applications ranging from safety warnings to cooperative adaptive cruise control and traffic optimization.

B. cITS Security

cITS security standards provide message integrity and authenticity, but signatures do not guarantee message correctness. Trusted hardware and revocation reduce some risks while leaving software, sensors, and key-abuse challenges.

  • Certificate-based security: ETSI TS 103 097 and IEEE 1609.2 specify certificate-based signatures for broadcast authentication and integrity.Each outgoing message carries a signature and certificate so receivers can verify authenticity without further exchanges.
  • Limits of PKI: Signatures and certificates thwart attacks lacking key material but provide no guarantee that signed messages are correct.Attackers with extracted keys or compromised authorized units can sign arbitrary messages.
  • Limits of PKI: Revocation can mitigate key-material abuse, but detecting abuse in existing vehicles remains an open question.
  • Residual attack surface: Trusted key storage does not protect against manipulated application software or altered sensor readings that generate validly signed false messages.The paper notes that attackers may modify software, inject false CAN-bus readings, or directly modify sensor hardware.

C. Certificate Management & Privacy

Pseudonyms improve vehicle privacy but complicate credential management and can enable Sybil attacks. The survey focuses on attacks that remain possible within deployed security mechanisms, especially those affecting communicated information and network operation.

  • Certificate Management & Privacy: Short-term pseudonyms reduce the ability to build vehicle location traces while preserving authenticity guarantees.
  • Certificate Management & Privacy: Pseudonym issuance, distribution, management, and revocation create privacy, performance, and Sybil-resistance trade-offs.Bulk issuance can waste pseudonyms, while limiting validity can improve protection against Sybil attacks.
  • Certificate Management & Privacy: Credential-management design affects detection mechanisms because it determines how easily attackers can execute Sybil attacks.The worldwide deployment model and use of disparate systems remained unsettled in the survey.
  • Attack scope: The survey primarily examines cyber attacks that existing security mechanisms do not easily prevent, including jamming, injection, replay, routing, and Sybil attacks.
  • Attack scope: Jamming disrupts selected communications, while replay and routing attacks can affect throughput or network performance.Routing attacks are considered limited in importance because they do not directly affect safety.
  • Attack scope: Data injection falsifies real-world information to disrupt traffic or trigger collisions, and Sybil attacks use multiple identities for application-level deception.

2) Physical attacks:

Physical access expands the cITS attack surface beyond cyber communication, including vehicle buses and sensors. The survey focuses on cyber attacks but emphasizes that physical components are not necessarily immune.

  • Physical attacks:: Attackers may exploit vehicle CAN buses, which are vulnerable to attacks and can be reached through physical access.
  • Physical attacks:: Sensor-targeted attacks can disrupt vehicle perception, such as using a laser pointer against a nearby vehicle’s cameras.
  • Physical attacks:: The survey primarily focuses on the cyber component while retaining physical sensor attacks as a relevant consideration.
  • Defining Misbehavior: Misbehavior detection covers both faulty and malicious nodes that transmit erroneous data, rather than only malicious packets.

2) Attacker Model:

The survey models active cITS attackers across credential status, motivation, activity, and attack scope, then classifies detection mechanisms by scope, perspective, and collaboration. These choices expose trade-offs between independence, information richness, and assumptions about honest participants.

  • Attacker Model: The attacker model distinguishes insider versus outsider, rational versus malicious, active versus passive, and local versus extended attackers.The survey targets active attackers because eavesdropping alone is not misbehavior detectable through message or signal analysis.
  • Attacker Model: Insider attackers that follow protocols while sending false information are not covered by the standard Dolev-Yao model, and Sybil attacks can evade reputation mechanisms.
  • Attacker Model: Many detection schemes restrict attackers to a small set of valid pseudonyms, typically one to three per controlled vehicle, with privacy implications.
  • Attacker Model: Assuming fully trusted roadside units is questionable because their physical deployment exposes them to tampering and side-channel attacks.
  • Attacker Model: Realistic attackers are constrained by wireless physics and limited physical presence rather than arbitrary packet reordering across receivers.
  • Detection scope: Detection mechanisms operate locally, cooperatively, or globally, with behavioral and plausibility methods often using local information.Local methods resist Sybil attacks but may struggle to identify attacks because they have less information.
  • Detection taxonomy: The taxonomy crosses node-centric versus data-centric analysis with autonomous versus collaborative detection.Node-centric methods assess participants, whereas data-centric methods assess message validity independently of the sender.
  • Detection taxonomy: Autonomous detection avoids dependence on attackers or an honest majority, while collaborative detection can provide richer comparisons but relies on honest-majority assumptions.Autonomous plausibility checks may remain imprecise against intelligent attacks that choose values near acceptance limits.

1) Node-centric Misbehavior Detection:

Node-centric detection focuses on identifying misbehaving participants through their protocol behavior or trust relationships, while related data-centric and pseudonym-linkability dimensions expose trade-offs in detection, privacy, and resilience.

  • Node-centric mechanisms: Behavioral mechanisms inspect node-level protocol patterns such as message frequency and formatting rather than message semantics.Watchdogs monitor whether neighboring nodes forward messages as required.
  • Node-centric mechanisms: Trust-based mechanisms use reputations, voting, and infrastructure to assess node behavior and simplify revocation.Their effectiveness is challenged by ephemeral participation, privacy requirements, and delayed detection of newly misbehaving honest nodes.
  • Data-centric mechanisms: Consistency-based detection compares messages or aggregate states across participants, but reliable conclusions often require an honest local majority.Colluding attackers can cause legitimate information to be excluded.
  • Data-centric mechanisms: Plausibility-based detection tests individual messages against an underlying data model, enabling fast checks and probabilistic outputs for downstream detection.Models range from physical laws to broader driver-behavior predictions.
  • Pseudonym impact: The taxonomy distinguishes full, explicit, implicit, and no linkability, reflecting how pseudonym handling affects detection capabilities and privacy.Full linkability supports all detection mechanisms but provides essentially no privacy; no linkability maximizes privacy while limiting functionality and security.
  • Pseudonym impact: Explicit linkability permits direct identity access, whereas implicit linkability infers links from certificates, message content, or signal properties without guaranteed vehicle identification.Implicit links can form message-based pseudo-identities, making information exchange, misbehavior verification, and revocation more difficult.
  • Pseudonym impact: Back-end pseudonym-to-identity mapping is practical but requires full trust in the back end, which can revoke user privacy.Encrypted identity certificates may support conditional disclosure, but local application to misbehavior detection remains unclear.

V. STATE OF THE ART

The survey organizes state-of-the-art misbehavior detection around node-centric approaches and examines behavioral mechanisms, including adaptations from MANET routing and flooding detection for cITS settings.

  • Node-centric mechanisms: Node-centric mechanisms use knowledge about message senders to correlate their messages and analyze sender behavior after authentication.The survey classifies these mechanisms as behavioral or trust-based.
  • Behavioral mechanisms: Behavioral cITS schemes target excessive message transmission and protocol-nonconforming content, but relatively few are designed specifically for cITS.Many approaches originated in or were adapted from MANETs, where routing attacks and fairness are central concerns.
  • Behavioral mechanisms: The Watchdog and Pathrater were introduced for detecting misbehavior in DSR multi-hop routing, with each node monitoring its next hop after forwarding packets.The Watchdog concept is independent of transported content but applies only where multi-hop communication occurs.
  • Behavioral mechanisms: Watchdog-based evaluations report difficulty finding a global detection threshold, while privacy, Sybil resistance, and other vulnerabilities remain unresolved.Dynamic thresholding may improve accuracy, but the cited analysis leaves cITS suitability unclear.
  • Flooding detection: Flooding detection is treated separately from routing Watchdogs and includes mechanisms for jamming and MAC attacks.Hamieh et al. describe jamming detection based on attack-pattern analysis.

2) Trust-based mechanisms:

Trust-based mechanisms aggregate behavioral or data-centric evidence to assess vehicle trustworthiness, but cITS mobility, privacy, conflicting reports, and Sybil attacks complicate trust management and revocation.

  • 2) Trust-based mechanisms:: Trust-based mechanisms aggregate detection results to distinguish legitimate from malicious behavior and support filtering or revoking misbehaving nodes.Their core challenges include Sybil attacks, high mobility, brief connectivity, and multiple privacy-preserving identities.
  • 2) Trust-based mechanisms:: RSU-supported schemes detect Sybil identities by grouping vehicles according to infrastructure interactions or comparing their signed trajectories.These approaches assume identities from one vehicle exhibit similar interaction paths or trajectories.
  • 2) Trust-based mechanisms:: Voting-based revocation can fail when attackers create local majorities with parallel pseudonyms, enabling false accusations against honest vehicles.The survey identifies preventing parallel pseudonym use as a general requirement for voting-based schemes.
  • 2) Trust-based mechanisms:: Cao et al. use growth codes to disseminate witness signatures efficiently, accepting events only after many valid signatures are decoded.The threshold improves confidence but introduces delay and can cause false negatives; the scheme assumes one key pair per attacker.
  • 2) Trust-based mechanisms:: Cooperative trust can combine data-centric movement checks with transitive trust to defend against static roadside attackers.This approach combines minimum-distance-moved mechanisms with trust developed between vehicles.
  • 2) Trust-based mechanisms:: Consensus schemes collect supporting reports and may adapt acceptance thresholds to event distance and neighborhood density, while retaining Sybil vulnerabilities.A maximum waiting time supports safety-relevant decisions, but choosing an appropriate initial threshold remains open.

B. Data-centric Mechanisms

Data-centric misbehavior detection distinguishes consistency checks across senders from plausibility checks applied to messages from the same sender.

  • B. Data-centric Mechanisms: Consistency analyzes messages from different senders, whereas plausibility verifies messages from the same sender.The distinction organizes the survey’s treatment of data-centric misbehavior detection.

1) Plausibility:

Plausibility mechanisms test whether transmitted information is physically, temporally, or semantically credible, using signals, vehicle models, sensors, and communication data.

  • 1) Plausibility:: Signal-based plausibility checks use source direction, time-of-flight, received signal strength, or Doppler information to verify reported positions and movement.Measurement errors, GPS inaccuracies, synchronization limits, and deployment costs constrain these approaches.
  • 1) Plausibility:: RSSI time-series analysis can identify Sybil attacks despite unreliable individual RSSI values, but fails when an attacker uses more than one radio.The method applies dynamic time wrapping and Z-score normalization to RSSI series.
  • 1) Plausibility:: Multi-rule plausibility combines vehicle sensors and communication-layer information into a world model for checking newly received data.Examples include rule databases, acceptance-range, mobility-grade, and maximum-density thresholds.
  • 1) Plausibility:: VEBAS combines behavioral, plausibility, and trust-based mechanisms for local detection of unusual vehicle behavior.Each vehicle analyzes messages from neighboring vehicles through multiple content-analysis modules.
  • 1) Plausibility:: Vehicle-dynamics models construct bounding polygons for positions that remain valid given prior messages and the vehicle’s physical dynamics.This extends approaches that use a static vehicle model shared across vehicles.

2) Consistency:

Consistency-based mechanisms compare information from distinct vehicles to detect conflicts and improve representations of real-world situations. The surveyed approaches include direct message comparison, abstract world models, traffic-flow comparisons, neighbor-table analysis, and other collaborative checks.

  • Consistency: Consistency mechanisms compare sequences of packets from distinct vehicles to detect conflicting information and improve the representation of real-world scenarios.They are often used in secure aggregation to combine information and address inaccuracies.
  • Consistency: Direct comparison checks message contents for conflicts, while world modeling evaluates whether an abstract world state or hypothesis is consistent.World-modeling approaches can identify subsets of assertions that explain an invalid state.
  • Consistency: Traffic-flow detection compares each vehicle’s reported flow, average speed, and density with surrounding vehicles’ aggregate behavior.Hypothesis testing can reject a vehicle’s data, but slowly increasing falsified values are outside the authors’ attacker model and detection is road-specific.
  • Consistency: Sybil detection compares neighbor tables over time because attacker-controlled identities must repeatedly appear together near the attacker.Legitimate vehicles are not expected to form the same persistent group pattern.
  • Consistency: Other approaches verify positions through signal-strength measurements, additional sensors, or comparisons among neighboring vehicles.Some neighbor-query mechanisms tolerate noisy honest sensor data and network loss but rely on an honest majority.
  • Consistency: Several surveyed mechanisms remain bounded by attacker models, including targeted Sybil attacks and aggregation-specific compromises.False-witness attacks and lower-layer or Sybil attacks may remain possible when excluded from the model.

C. Overview

The survey compares mechanisms using a structured overview of detection scope, resource requirements, generalizability, security, and privacy. The tables summarize advantages and disadvantages across these dimensions.

  • C. Overview: Tables III–V qualitatively compare mechanisms by detection scope, required resources, generalizability, security, and privacy impact.Detection scope distinguishes local, cooperative, and back-end detection; resources include bandwidth, computation, and memory.

VI. SOLVED AND OPEN CHALLENGES

The survey reviews the cITS ecosystem and standardization efforts, categorizes misbehavior detection mechanisms, and discusses solved and open security challenges. It also considers transferring these mechanisms to other fields.

  • VI. SOLVED AND OPEN CHALLENGES: The survey provides an extensive categorization of cITS misbehavior detection mechanisms and discusses solved and open security challenges.It also discusses how security mechanisms might transfer to other fields.

A. Reoccurring patterns

The survey identifies recurring detection patterns and open issues spanning physical models, signal properties, machine learning, centralized processing, thresholds, identification, privacy, cooperation, and reproducibility. These mechanisms are often complementary, but their effectiveness and comparability depend on assumptions, reporting choices, and privacy constraints.

  • A. Reoccurring patterns: Physical models use driving-process knowledge, from simple speed or occupancy rules to complex motion and map-based predictions.They often operate locally, but simultaneous manipulation of sensors and messages remains an open concern.
  • A. Reoccurring patterns: Signal properties such as reception range, received-signal strength, and time of flight provide additional observations for detecting spurious messages.These measurements exploit physical properties of the wireless channel.
  • A. Reoccurring patterns: Machine-learning techniques help interpret locally collected data and combine outputs from multiple misbehavior detectors.Examples include decision trees, Bayesian inference, and Dempster-Shafer theory.
  • A. Reoccurring patterns: Centralized detection can identify larger clusters of dishonest behavior, but may require reporting mildly suspicious data to the back-end.Greater reporting can provide the data basis needed for attacks that local detection cannot identify.
  • B. Open Issues: Detection thresholds must balance false positives and false negatives, while decisions about when to merge information can directly affect performance.The distinction between erroneous and explicitly malicious messages may also be difficult to establish.
  • B. Open Issues: Data-centric mechanisms can identify conflicting or malicious data without directly identifying attackers, whereas node-centric mechanisms support attacker identification and revocation.This creates a practical distinction between obtaining accurate data and locating nodes for mitigation.
  • B. Open Issues: Voting with pseudonyms must preserve privacy while resisting Sybil attacks, and proof-of-work proposals impose processing burdens.Majority voting commonly assumes that most vehicles are honest.
  • B. Open Issues: Movement correlation can support misbehavior detection while potentially harming location privacy, whose exact impact remains an open challenge.The survey also notes that mechanisms are difficult to compare when they use different attacker models or datasets.

C. Applications beyond cITS

The survey examines how cITS misbehavior-detection ideas may apply to other CPS domains, focusing on WSNs and ICS. It argues that existing approaches reveal both transferable mechanisms and the need for more systematic detection research.

  • Applications beyond cITS: The survey selects WSNs and ICS as two domains for applying cITS misbehavior-detection ideas.WSNs are chosen for their ephemeral, ad-hoc nature, while ICS offer opportunities for plausibility-based mechanisms.
  • Wireless Sensor Networks: WSNs resemble cITS through geographically distributed wireless nodes but differ because their sensors are relatively stationary and resource-constrained.Their typical purpose is cost-effective information collection using inexpensive battery-powered devices.
  • Wireless Sensor Networks: Existing WSN attack and defense surveys are not directly generalizable to CPS, whereas the reviewed cITS mechanisms show potential for transfer to WSNs.The survey therefore compares domain assumptions rather than treating WSN security results as universally applicable.
  • Wireless Sensor Networks: WSN security research identifies node compromise, exposed wireless protocols, limited physical surveillance, and extreme resource constraints as major challenges.Node compromise is especially relevant because compromised nodes can transmit validly signed messages and thereby exhibit misbehavior.
  • Future research: The survey identifies systematic detection as a primary future goal for the broader CPS research community.It also includes combinations of existing schemes rather than focusing exclusively on individual attacks.

2) Unmanned Areal Vehicles:

The survey places cITS alongside other CPS domains and concludes that misbehavior detection addresses security challenges created by physical-world interaction, constrained environments, and insider access. It organizes the cITS literature into mechanism classes and identifies transfer to broader CPS as a future direction.

  • 2) Unmanned Areal Vehicles:: Networked UAVs resemble VANETs as mobile-node ad-hoc networks with decentralized infrastructure.Unlike cITS, UAVs require more strictly decentralized communication because they lack periodic back-end availability and use lower-power devices.
  • Industrial Control Systems: ICS historically prioritize safety and must prevent random individual failures from escalating into cascading failures.This safety-centered history distinguishes ICS from cITS and motivates attention to attacks against control infrastructure.
  • VII. CONCLUSION: cITS connect vehicles, roadside units, and back-end systems to support safer, more efficient, and more comfortable travel.They are CPS in which interaction between cyber and physical worlds is central.
  • VII. CONCLUSION: PKI excludes attackers without key material but cannot address insiders who obtain legitimate credentials and send arbitrary messages.Misbehavior detection therefore provides a necessary reactive layer alongside proactive PKI security in cITS.
  • VII. CONCLUSION: The survey classifies cITS mechanisms as node-centric or data-centric according to whether they analyze sender properties or message semantics.The classification organizes a large body of literature summarized in Tables III, IV, and V.
  • VII. CONCLUSION: Future work should exploit the orthogonality of four detection classes and generalize cITS mechanisms to other CPS.The survey presents this scope as a foundation for industry, developers, standardization agencies, and researchers.
Loading 1610.06810v2…