Intrusion Detection System for the MIL-STD-1553 Communication Bus

Stan, Orly; Cohen, Adi; Elovici, Yuval; Shabtai, Asaf

doi:10.1109/taes.2019.2961824

Cited by 22 publications

(16 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The context-based anomaly detection mechanism demonstrated perfect results (all anomalous messages were detected with zero false alarms) for both normal and abnormal scenarios when evaluated using datasets collected from our two testbeds and the dataset used by Stan et al [31]. In addition, we demonstrated the ability of the anomaly explanation engine to accurately explain the anomalies.…”

Section: Introductionmentioning

confidence: 63%

“…Onodueze et al [28] obtained poor results when evaluating different classification methods, since the dataset used for training was highly imbalanced (this is known to cause most classification algorithms to fail or produce poor results); this dataset was collected from a realistic 1553 simulator. In contrast, Stan et al [31], who suggested using an unsupervised method, obtained better results by using Markov chains. For evaluation, they set up a real 1553 hardware-based testbed containing one BC and two RTs.…”

Section: Related Workmentioning

confidence: 92%

“…Stan et al and Onodueze et al [28], [31] presented anomaly detection algorithms that analyze each message individually, utilizing both timing and command features. Onodueze et al [28] obtained poor results when evaluating different classification methods, since the dataset used for training was highly imbalanced (this is known to cause most classification algorithms to fail or produce poor results); this dataset was collected from a realistic 1553 simulator.…”

Section: Related Workmentioning

confidence: 99%

“…posed [11], [21], [28], [31]. However, none of the studies focused on prevention or providing an explanation for the anomalies detected.…”

Section: Introductionmentioning

confidence: 99%

“…• A real-time anomaly explanation engine that automatically generates practical/actionable explanations for the anomalies detected. • An evaluation conducted on two real 1553 hardwarebased testbeds, as well as on a dataset that was used in prior work [31].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

AnoMili: Spoofing Prevention and Explainable Anomaly Detection for the 1553 Military Avionic Bus

Levy¹,

Maman²,

Shabtai³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

MIL-STD-1553, a standard that defines a communication bus for interconnected devices, is widely used in military and aerospace avionic platforms. Due to its lack of security mechanisms, MIL-STD-1553 is exposed to cyber threats. The methods previously proposed to address these threats are very limited, resulting in the need for more advanced techniques. Inspired by the defense in depth principle, we propose AnoMili, a novel protection system for the MIL-STD-1553 bus, which consists of: (i) a physical intrusion detection mechanism that detects unauthorized devices connected to the 1553 bus, even if they are passive (sniffing), (ii) a device fingerprinting mechanism that protects against spoofing attacks (two approaches are proposed: prevention and detection), (iii) a context-based anomaly detection mechanism, and (iv) an anomaly explanation engine responsible for explaining the detected anomalies in real time. We evaluate AnoMili's effectiveness and practicability in two real 1553 hardware-based testbeds. The effectiveness of the anomaly explanation engine is also demonstrated. All of the detection and prevention mechanisms employed had high detection rates (over 99.45%) with low false positive rates. The context-based anomaly detection mechanism obtained perfect results when evaluated on a dataset used in prior work.

show abstract

Section: Introductionmentioning

confidence: 63%

Section: Related Workmentioning

confidence: 92%

Section: Related Workmentioning

confidence: 99%

“…posed [11], [21], [28], [31]. However, none of the studies focused on prevention or providing an explanation for the anomalies detected.…”

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

AnoMili: Spoofing Prevention and Explainable Anomaly Detection for the 1553 Military Avionic Bus

Levy¹,

Maman²,

Shabtai³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

Anomaly detection of aviation data bus based on SAE and IMD

Li,

Sang,

et al. 2024

Computers & Security

View full text Add to dashboard Cite

Proposal and Investigation of a Lite Time Sensitive Networking Solution for the Support of Real Time Services in Space Launcher Networks

Fiori,

Lavacca,

Valente

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Most launcher networks are based on proprietary buses such as MIL-STD-1553B whose low bandwidth limits the introduction of new services of suitable characteristics. Ethernet technology, because of its low cost and high performance, has been considered an excellent candidate for its use in launcher networks. The real time Ethernet solutions based on the Time Sensitive Networking (TSN) standards seem the most suitable because of its multi-vendor product characteristics. In this paper we propose a real time Ethernet solution for aerospace applications in which negligible jitter services has to be guaranteed. The proposed solution is based on the following TSN standards: IEEE 802.1AS/ASrev as synchronization protocol and 802.1Qbv-2015 for deterministic traffic scheduling. To improve both the bandwidth effective and the frame delay the solution is also based on a change in the management of the Priority Code Point field in IEEE 802.1Q standard. The optimal scheduling problem is formulated so as to minimize the makespan, defined as the time needed to deliver all of the messages of an elementary cycle. The problem has been resolved with the CPLEX solver and the proposed solution has been evaluated in terms of both delay and bandwidth effective by comparing its performance with the TTEthernet, FTTEthernet benchmark solutions. The obtained results in a real traffic scenario characterized by the set of messages of the VEGA launcher show how the proposed solution allows for the same performance of TTEthernet, i.e., the solution of proprietary and real-time Ethernet with better performance.

show abstract

Intrusion Detection System for the MIL-STD-1553 Communication Bus

Cited by 22 publications

References 19 publications

AnoMili: Spoofing Prevention and Explainable Anomaly Detection for the 1553 Military Avionic Bus

AnoMili: Spoofing Prevention and Explainable Anomaly Detection for the 1553 Military Avionic Bus

Anomaly detection of aviation data bus based on SAE and IMD

Proposal and Investigation of a Lite Time Sensitive Networking Solution for the Support of Real Time Services in Space Launcher Networks

Contact Info

Product

Resources

About