Intrusion Detection of Medical Devices Embedded In a Medical Cyber Physical System: A Behavior-Rule Specification-Based Technique for Intrusion Detection in Medical Cyber Physical Systems

Abstract

This paper proposes andanalyzes a behavior-rule specification-based technique for intrusion detectionof medical devices embedded in a medical cyber physical system (MCPS) in whichthe patient’s safety is of the utmost importance. A methodology is proposed totransform behavior rules to a state machine, so that a device that is beingmonitored for its behavior can easily be checked against the transformed statemachine for deviation from its behavior specification. Using vital sign monitormedical devices as an example; to demonstrate the intrusion detection techniquethat can effectively trade false positives off for a high detection probabilityto cope with more sophisticated and hidden attackers to support ultra-safe andsecure MCPS applications. Moreover, through a comparative analysis, it isdemonstrated that the proposed behavior-rule specification-based IDS techniqueoutperforms two existing anomaly-based techniques for detecting abnormalpatient behaviors in pervasive healthcare applications.