In-silico pre-clinical trials for implantable cardioverter defibrillators

Jiang, Zhihao; Abbas, Houssam; Jang, Kuk Jin; Beccani, Marco; Liang, Jackson J.; Mangharam, Rahul

doi:10.1109/embc.2016.7590667

Cited by 13 publications

(17 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An attack is effective when it compromises the decision of the discrimination algorithm in such a way that the a required therapy is prevented (e.g., during VF), or an inappropriate therapy is introduced (e.g., during SVT). Our attack model is concerned with inducing at least one compromised decision, which suffices to cause adverse or even fatal effects: depriving a patient of treatment for VF can lead to sudden cardiac death, while inappropriate shocks can result in damaging heart-tissue remodeling and cause significant psychological distress [14]. Note that the unaltered parameters can themselves have a low rate of inappropriate or missed therapy [2], which is, however, negligible compared to that for malicious parameters.…”

Section: Attack Modelmentioning

confidence: 99%

“…(12) and (13) consider the opposite situation that the algorithm stays in the VF/VT duration mode, in which case the corresponding clock is updated. (14) and (15) express that the VF and VT duration clocks are set to zero when the algorithm is outside the corresponding duration mode, or the mode has just ended. Finally, we introduce the predicate Th k indicating whether or not therapy is administered at the k-th cycle, in this way providing a symbolic representation of the therapy signal, i.e., for signal s and parameters p, Th k corresponds to d(p)(s)[k].…”

Section: Omt Encodingmentioning

confidence: 99%

“…Other examples are spoofing attacks on ICDs [16], attacks on insulin pumps and glucose monitors [18], and on electrocardiogram-based biometrics [6]. The work of Jiang et al [14] offers a model-based approach to analyze the accuracy ICD algorithms by conducting in-silico trials on synthetic cardiac signals. Our work relies on [14] for the generation of synthetic EGMs and the reverse-engineering of the Boston Scientific algorithm, but tackles the fundamentally different problem of designing stealthy attacks on ICDs, introducing a novel formalization of attack synthesis as multi-objective optimization, and an SMT-based encoding for its solution.…”

Section: Related Workmentioning

confidence: 99%

“…We employ the method of [14] to generate synthetic EGMs with prescribed arrhythmia. This allows the attacker to synthesize malicious parameters tailored to the victim's cardiac condition.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Synthesizing stealthy reprogramming attacks on cardiac devices

Paoletti

Jiang

Islam

et al. 2019

Proceedings of the 10th ACM/IEEE International Conference on Cyber-Physical Systems

Self Cite

View full text Add to dashboard Cite

An Implantable Cardioverter Defibrillator (ICD) is a medical device used for the detection of potentially fatal cardiac arrhythmia and their treatment through the delivery of electrical shocks intended to restore normal heart rhythm. An ICD reprogramming attack seeks to alter the device's parameters to induce unnecessary shocks and, even more egregious, prevent required therapy. In this paper, we present a formal approach for the synthesis of ICD reprogramming attacks that are both effective, i.e., lead to fundamental changes in the required therapy, and stealthy, i.e., involve minimal changes to the nominal ICD parameters. We focus on the discrimination algorithm underlying Boston Scientific devices (one of the principal ICD manufacturers) and formulate the synthesis problem as one of multiobjective optimization. Our solution technique is based on an Optimization Modulo Theories encoding of the problem and allows us to derive device parameters that are optimal with respect to the effectiveness-stealthiness tradeoff (i.e., lie along the corresponding Pareto front). To the best of our knowledge, our work is the first to derive systematic ICD reprogramming attacks designed to maximize therapy disruption while minimizing detection. To evaluate our technique, we employ an extensive dataset of synthetic EGMs (cardiac signals), each generated with a prescribed arrhythmia, allowing us to synthesize attacks tailored to the victim's cardiac condition. Our approach readily generalizes to unseen signals, representing the unknown EGM of the victim patient.

show abstract

Section: Attack Modelmentioning

confidence: 99%

Section: Omt Encodingmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

“…We employ the method of [14] to generate synthetic EGMs with prescribed arrhythmia. This allows the attacker to synthesize malicious parameters tailored to the victim's cardiac condition.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Synthesizing stealthy reprogramming attacks on cardiac devices

Paoletti

Jiang

Islam

et al. 2019

Proceedings of the 10th ACM/IEEE International Conference on Cyber-Physical Systems

Self Cite

View full text Add to dashboard Cite

show abstract

“…The three versions were run on a database of 960 EGMs, equally divided into 480 SVTs and 480 VTs. The beat timing in the EGMs (in other words, the boolean stream s) was generated by the heart model of [36], [37]. Briefly, this model can simulate beat generation and propagation at different rates, from different locations in the heart.…”

Section: B Validation Of the Qre Implementationmentioning

confidence: 99%

Real-Time Decision Policies With Predictable Performance

et al. 2018

Self Cite

View full text Add to dashboard Cite

As methods and tools for Cyber-Physical Systems grow in capabilities and use, one-size-fits-all solutions start to show their limitations. In particular, tools and languages for programming an algorithm or modeling a CPS that are specific to the application domain are typically more usable, and yield better performance, than general-purpose languages and tools. In the domain of cardiac arrhythmia monitoring, a small, implantable medical device continuously monitors the patient's cardiac rhythm and delivers electrical therapy when needed. The algorithms executed by these devices are streaming algorithms, so they are best programmed in a streaming language that allows the programmer to reason about the incoming data stream as the basic object, rather than force her to think about lower-level details like state maintenance and minimization. Because these devices are resource-constrained, it is useful if the programming language allowed predictable performance in terms of processing runtime and energy consumption, or more general costs. StreamQRE is a declarative streaming programming language, with an efficient and portable implementation and strong theoretical guarantees. In particular, its evaluation algorithm guarantees constant cost (runtime, memory, energy) per data item, and also calculates upper bounds on the per-item cost. Such an estimate of the cost allows early exploration of the algorithmic possibilities, while maintaining a handle on worst-case performance, on the basis of which hardware can be designed and algorithms can be tuned. Abstract-As methods and tools for Cyber-Physical Systems grow in capabilities and use, one-size-fits-all solutions start to show their limitations. In particular, tools and languages for programming an algorithm or modeling a CPS that are specific to the application domain are typically more usable, and yield better performance, than general-purpose languages and tools. In the domain of cardiac arrhythmia monitoring, a small, implantable medical device continuously monitors the patient's cardiac rhythm and delivers electrical therapy when needed. The algorithms executed by these devices are streaming algorithms, so they are best programmed in a streaming language that allows the programmer to reason about the incoming data stream as the basic object, rather than force her to think about lower-level details like state maintenance and minimization. Because these devices are resource-constrained, it is useful if the programming language allowed predictable performance in terms of processing runtime and energy consumption, or more general costs. StreamQRE is a declarative streaming programming language, with an efficient and portable implementation and strong theoretical guarantees. In particular, its evaluation algorithm guarantees constant cost (runtime, memory, energy) per data item, and also calculates upper bounds on the per-item cost. Such an estimate of the cost allows early exploration of the algorithmic possibilities, while maintaining a handle on worst-case per...

show abstract