Search papers, labs, and topics across Lattice.
This paper introduces SentryBus, a novel observability model designed to detect sensor-interface manipulation in I2C-based systems by analyzing transaction timing and data transfer characteristics. The research highlights that adversarial manipulation leaves distinct observable evidence that varies based on the attacker's position, enabling passive monitoring to identify when manipulation becomes indistinguishable from legitimate data acquisition. Key findings include a high fidelity of detection within a bounded service time and sustained stability of clean acquisitions, although controlled attack trials are yet to be conducted to establish detection rates.
Adversarial manipulation of sensor data can be detected with surprising accuracy by leveraging transaction timing and behavior, even in the presence of plausible telemetry.
Sensor-driven systems in medical Internet of Things devices, drones, and cyber-physical systems commonly trust a measurement once it reaches the embedded processor. An adversary on the digital interface between sensor and processor can supply a plausible value that correct firmware accepts and reports as ordinary telemetry. The hypothesis is that sensor interface manipulation leaves observable evidence on the acquisition path, that the evidence appears at different vantages depending on attacker position, and that a passive host-side monitor therefore has a measurable boundary beyond which manipulation becomes indistinguishable from legitimate acquisition. SentryBus models acquisition behavior on the I2C sensor bus using transaction timing, read and write sequences, transfer lengths, address behavior, register and FIFO state access, and raw data transitions. The adversary is modeled as an inline interposer, parallel controller, sensor replacement, or compromised host, because a commodity target-only sensor cannot initiate transfers or stretch, reorder, or delay bus transactions. A dual sided testbed captures both busses, host memory, and telemetry, and the detector consumes the host facing bus alone while the remaining vantages serve as ground truth. A physiological instantiation reports three measured results: an inline interposer bounded at 0.842 percent of acquisition service time while preserving acquisition schedule and payload content, clean acquisition stability sustained over 6304 seconds at the telemetry vantage with no clock regression, and a negative result establishing that data-transition features encode session specific signal statistics and do not transfer across capture sessions. Instrument characterization shows that a low-cost analyzer can truncate captures without kernel visible error. Controlled attack trials are still outstanding, so no detection rate is claimed.
