Explaining RADAR features for detecting spoofing attacks
in Connected Autonomous Vehicles

Machine learning (ML) applications are driving  (?) innovation in connected and autonomous vehicles (CAVs) (?). To enable ”self-awareness,” CAVs are fitted with a range of perception sensors (lidar, radar, ultrasonic, camera), control sensors, communication systems (cellular, wifi, Bluetooth), control systems (velocity, steering, and braking), and ML-trained semi- and full-autonomy services. Controller area network (CAN) buses share critical sensory information with the onboard intelligent processing units  (?), or other networks, forming the backbone of self-driving car perception. These components require a continuous assessment of potential threats to safety to allow the CAVs to navigate the road. ML models used for perception, anomaly detection, and emergency maneuvers in CAVs, rely heavily upon sensor data. Research has demonstrated how these models are vulnerable to spoofing and adversarial examples resulting from small-magnitude perturbations in the input data (?). Therefore, understanding inputs (e.g., sensor data) is a critical step toward creating resilient infrastructure within which smart agents like CAVs and human actors can co-exist, thereby reducing risks to life and property (?; ?; ?).

Challenges. A unique challenge from using ML-based attack detection models results from their black-box processing characteristics. ML models generate decisions that are challenging to understand or opaque, even to those of the experts who designed them. For example, experts cannot directly correlate weights assigned to sensor signals and the actual decisions. Understanding these correlations is vital to creating effective cyber threat detection and response systems since experts need to generate models in which the training (known attack and non-attack) and test (unknown attack) data may vary considerably from each other.

Motivation. Experts need to understand when a poor decision on the part of a CAV is the result of an action by an adversary (an attack), a fault in the system (programming, design, implementation, or quality control error), or the impact of some other problem. Unfortunately, ML model opacity prevents experts from explaining these decisions swiftly. The challenge increases in a CAV since it is subject to frequent environmental changes, potential sensor performance degradation, and behavioral modification resulting from cyber attacks. Our goal is to help experts understand and improve security-related CAV ML decisions.

While some decisions require certain data, other decisions require integrating uncertain with certain data to justify potential actions. The integration of uncertain data allows decision-makers to legitimize their choices in particular circumstances. When uncertain, additional knowledge can help decision-makers increase their confidence level and decrease their margin of error, to the extent that would not be possible using only data that could be confirmed with certainty. In this paper, we define explainability as a mechanism for reasoning about partial knowledge of uncertain information and describing that reasoning to specific stakeholders.

Proposed Work. Explanation combines artifacts such as models, sensors, and contextual information to describe security “events.” We present an empirical evaluation and generation of explanations that allow CAVs better perceive attacks in the face of uncertain information. We use the Dempster-Shafer Theory (DST) of evidential reasoning (?) to capture the uncertainty in sensor data, such as delay in the validity of measured environmental data. DST is a generalization of probability theory and has previously been employed in map building for CAVs  (?), and in CAV sensor fusion  (?).

Contributions. In this paper, we make the following contributions:

1. 1.

   We propose an explanation methodology that captures the fidelity of input sensor data using the Dempster-Shafer Theory (DST) of belief functions. Using this evidence, we hypothesize that security experts can reliably train attack detection models for an autonomous vehicle, a platform enabled by a network of sensors to determine a safe and secure vehicle trajectory.

2. 2.

   Explanations describe data reliability in determining the presence of an obstacle as well as a spoofing attack by an adversary. We experimentally demonstrate a proof-of-concept implementation of the proposed explanation methodology on Radio Detection And Ranging (RADAR) sensor data. Specifically, we demonstrate through experimental evaluation that quantifying the uncertainty in detecting an obstacle and considering this evidence to train ML-based attack models can produce more reliable attack predictions.

3. 3.

   We identify a set of challenges for providing explanations for CAV security, ranging from CAV-specific physical limitations to the vulnerability of explanations to limitations in the ability to provide meaningful explanations.

Sensor spoofing attacks in CAVs. Sensor spoofing consists of manipulating a sensor’s perception of the environment or its output data to generate or simulate erroneous measurements. These attacks are dangerous because they can cause unexpected changes in CAV automated driving operations, resulting in loss of steering control or sudden brake activation (?; ?; ?), or other problems. Sensor manipulation can also compromise detection of obstacles, road lanes, traffic lights, and signs, resulting in severe consequences for the safety of drivers, other vehicles, and pedestrians (?; ?; ?; ?). Literature describes two main types of sensor spoofing attacks.

In the first, the attacker accesses the vehicle Controller Area Network (CAN) bus to manipulate messages sent from the sensors to the car Engine Control Units (ECUs) (?; ?). In the second category, the attacker injects external signals (e.g., sound, light, electromagnetic interference) to alter signals captured by the sensors to remotely manipulate vehicle behavior (?; ?; ?).

Our stakeholders need explanations that address sensor uncertainty to help them improve security and decision-making models. However, beyond this, CAVs present a unique set of challenges for explanation generation that relate to security, hard and soft timing constraints, explanation efficacy, and data availability. Note that many of these challenges generalize beyond explanations for CAVs. We elaborate these challenges below:

1. 1.

   Providing Meaningful Feedback to ML and stakeholders: How does the ML model know that it is making a wrong decision? Is there a way of providing feedback to the stakeholder regarding the ML model’s decision? What kind of meaningful information do various types of stakeholders need in order to be able to react to bad ML model decisions effectively?

2. 2.

   Negative effect of erroneous explanations: Incorrect, confusing, or misleading explanations may lead to poor future actions or reduce ML models’ efficacy that incorporate the explanation data as input. An explanation need not be intentionally incorrect or deceptive to cause problems. It may simply be wrong but still trusted by the stakeholders that rely upon it.

3. 3.

   Attacks on Explanations: Explanations can be attacked by adding, deleting, or altering parts of the explanation. Similarly, attacks on model generating the explanation can lead to wrong and potentially confusing explanations. These attacks potentially put stakeholders who depend upon these explanations at risk. They can also put other connected entities at risk by stealthily incorporating attacks into ML model training datasets.

4. 4.

   Misleading explanations: Explanations may cause intentional misinterpretation. An explanation can mislead, deceive, hide potentially malicious activities, obfuscate, delay actions, prevent analysis, impact legal outcomes, using information that, while correct, is likely to be misinterpreted by stakeholders in a manner of an attacker’s choice.

5. 5.

   Missing validations for edge case explanations: Excessive trust placed on explanations not validated earlier against edge cases. When an expert in a field provides a seemingly accurate explanation most or all of the time, others are likely to trust their explanations based on their reputations. If the expert provides an incorrect or incomprehensible explanation, their reputation can be damaged, diminishing the trust stakeholders place in the expert’s future explanations. An ML model that provides correct explanations for the vast majority of scenarios is likely to earn the trust of its stakeholders. However, this does not mean that the model can explain every edge case correctly. These edge cases could result in explanations that are wrong, misleading or conceal attacks.

6. 6.

   Real-time processing requirements: Explanation generation in real-time for automated driving decisions has high processing requirements. CAV prediction models cannot postpone feedback concerning numerous decisions. For example, if a vehicle witnesses an obstacle, it must make decisions within milliseconds to guarantee collision avoidance. A fraction of explanations may take longer to generate than permitted time scales. Likewise, the explanation generation requirements for stakeholders may function on time scales with different orders of magnitude. Thus, generating explanations could cause some decisions to violate real-time processing requirements.

7. 7.

   Varying temporal requirements: The time requirements for security events in progress, or forensic analysis, may be violated by the time required to generate explanations. Explanations that take a long time to generate or analyze could violate the soft time requirements of attack detection and post-attack analysis. The longer the delay between an event and its analysis, the more the value of that analysis may diminish. Likewise, the detection of a security event may become less valuable if that detection takes place after an attack has already been completed, rather than while the attack is at a stage where a defender could stop or mitigate the attack.

8. 8.

   Insufficient Data: There may be insufficient data to provide a meaningful explanation. Without sufficient information, it may not be possible to generate an unambiguous explanation or a high probability of correctness.

We propose a novel approach for modeling attacks on connected autonomous vehicle sensors. Our approach encompasses the certainty and reliability of various sensor signals prior to their use in attack models. Following DST of belief functions, our approach combines both detected sensor signals and the degree of belief in the sensors. The resultant belief considers the available evidence of belief from all sensors. Following DST, we allocate probability mass to sets or intervals.

In this paper, we demonstrate a proof-of-concept for our approach, as applied to radar sensor spoofing attacks, using the DST classification algorithm (?). DST is relevant in situations where non-random uncertainty is present, and only a subset of sensor data contains the states that are present with certainty. It also has a distinct advantage of not requiring prior knowledge, making it particularly suitable for classifying previously unseen information. Therefore, DST can be used to classify CAV sensor signals, which areuncertainand without precedent. Combining evidence using Dempster’s Rule of Combination (DRC) achieves each sensor data item classification. In other words, DRC combines probabilities of independent items of evidence from sensor data (?). The output label is a class with normalized probabilities according to some underlying Dempster-Shafer mass function. Each feature from sensor data computes individual mass functions. The “hidden” mass function provides a more informative description of the classifier output than class probabilities and uses it for decision-making.

We postulate that the quality of evidence (signals) collected by radar is generated randomly from a Gaussian distribution with mean and variance calculated for the specific feature (see Eq. 3). We assign a “mass” value to each element of the power set, P($\Theta$). Also, “mass” is associated with certainty in evidence collection and is derived from radar signals.

This likelihood can be modeled using normal distribution for every feature in the radar dataset as follows:

For individual classes (stationary or moving), we have the following function, which is the summation of all features:

with S $\in$ P($\Theta$). An example of S = {s, m} regarding the radar signals is:

In the formalism of the DST, a “mass value” is a value between 0 and 1. It is assigned to each element of the power set P($\Theta$). DST does not regulate the method of creating these values. In our approach, these values correlate to the characteristics of the data.

The mass values for the universal set, P($\Theta$), are computed for each element. Dempster’s combination rule reduces the resulting mass values for each feature to one set. The lower and upper bounds of probability are computed based on the remaining set of mass values. These values, computed for each element of P($\Theta$), represent the final result. In DST’s formalism, these bounds are called “belief” and “plausibility.”

DST requires no prior knowledge of previously unseen information to detect anomalies. It can also express the value of ignorance (neither stationary nor moving). We utilize the mass assigned to different features to determine if an attacker has spoofed a data packet. Emulating an attacker in the experiment, we inject eleven spoofed packets into the dataset and flip the class membership – for a stationary object, we assign the class as “moving”. The DST method can detect all the spoofed packets as stationary, where the mass of velocity feature is higher for moving than stationary. See results in Table 4.

Machine Learning has become a fundamental tool for securing automated systems. However, this technology remains a black box that takes inputs and generates prediction or classification without explaining why. Explanations are crucial for humans to decide whether an ML model decision can be trustworthy. These decisions become paramount, particularly when considering systems with high stakes that attackers can compromise. This paper investigates how explainability is essential for critical automated systems security, such as CAV. We discuss the principles, unique challenges of model explainability for security, and concrete use case described in the context of sensor spoofing attacks for autonomous vehicles. In our future work, we will develop our explainable framework to assist in complex real-time constraints such as obstacle avoidance in CAVs.

The authors would like to thank the anonymous reviewers and Praveen Chandrasekaran (RIT) for reviewing this paper and providing their invaluable feedback.