Page 234 - Cyber Defense eMagazine June 2024

The lifecycle of an autonomous vehicle is in three stages: Pre-Mission, Mission Operation, and Post-
Mission. As one might expect, pre-mission routines are focused on defining the assets and mission
objective. The vehicle will need to pass a pre-mission checklist for it to be authorized for operation. From
a cybersecurity perspective, we need to ensure that each boot-up process is from an expected state to
mitigate the potential for unauthorized software or malware usage.

Another example is to ensure that all OS and software is patched and up to date before the mission
begins. Post-mission routines are focused primarily on reporting notable events and maintenance. All
cybersecurity anomalies, events, and responses will be reported via an analytics dashboard within Neya’s
Mission Planning and Management System (MPMS). Additionally, bulk forensic data is captured and
made available for authorized personnel. Securely updating the OS and software is also a crucial step in
the post-mission routine, as the time to perform this task may cause significant delays when performed
during the pre-mission routine.

Mission operation is the most complex stage of the autonomous vehicle lifecycle. Consider how an
autonomous vehicle operates using perception and sensing to determine a path of least resistance. The
perception and planning systems work to identify anomalous objects that serve as obstacles that cause
the vehicle to change direction or operation for optimal traversal. Conceptually, cyber anomaly detection
is remarkably similar. Sensors are placed within the vehicle network and its endpoints to detect digital
signals of anomalous activity, instead of detecting a physical anomaly using RADAR or LiDAR as
sensors.

Relevant data is an absolute necessity for anomaly detection to be successful. It needs to be structured,
categorized, and labeled for effective aggregation and consistency to ensure data integrity for the
subsystem responsible for processing it. An analytic baseline to determine what is normal or expected is
required once the data is understood and organized. A simple example is measuring the network flow
volume (i.e., could be bytes, packets, transactions) between two nodes within a vehicle. An anomaly will
be reported if the network flow volume increases or decreases an order of magnitude away from what is
recorded as normal in the established baseline for that analytic. After extensive testing to determine
specific analytics to measure and to improve baseline accuracy, it is ready to begin field operations. The
confidence threshold for positively identifying a cyber threat should also improve as more data and
telemetry is collected and processed with each mission.

Furthermore, just as the vehicle autonomy system determines a response to physical anomalies, the
autonomous system also will need to respond accordingly to a perceived cyber threat. For example, a
threat actor attempts to establish unauthorized command and control of an autonomous vehicle using a
rogue Operator Control Unit (OCU). There are several methods of protection, including defensive
hardening to mitigate this attack vector, but in the case of a breach of defense, a standard operating
procedure needs to exist to respond to this detected threat. In enterprise environments, this is handled
by a person or group of people. An autonomous vehicle, on the other hand, is not expected to have
trained personnel to respond.

Cyber Defense eMagazine – June 2024 Edition 234
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.