Behavior Rule Based Intrusion Detection for Supporting Secure Medical Cyber Physical Systems

In this paper we propose a behavior-rule specification-based intrusion detection (BSID) technique of medical devices (sensors or actuators) embedded in a medical cyber physical system (MCPS) in which the patient's safety is of the utmost importance. We investigate the impact of attacker behaviors on the effectiveness of our malware detection technique. Using vital sign monitor medical devices as an example, we demonstrate that our intrusion detection technique can effectively trade false positives for a high detection probability to cope with more sophisticated and hidden attackers to support ultra safe and secure MCPS applications.