On DoS Attacks Exploiting Input Representativeness in Mixed-Criticality Systems

Measurement-Based Probabilistic Timing Analysis (MBPTA) techniques were designed to overcome the WCET problem, i.e., the difficulties in estimating the WCET with static methods. The process of obtaining a probabilistic Worst-Case Execution Time (pWCET) through MBPTA begins with collecting representative execution time measurements, and each recorded observation becomes part of an execution time trace $𝒯$.

Before any statistical analysis can proceed, the trace must satisfy certain mathematical prerequisites that enable the application of Extreme Value Theory (EVT), which is the statical theory behind pWCET estimation. Specifically, the Generalised EVT formulation [55] requires three properties to hold. The first is stationarity, meaning the statistical characteristics of the trace remain consistent throughout its duration; this is verified using the Kwiatowski-Philips-Schmidt-Shin (KPSS) test [36]. The second and third requirements concern independence: observations must be free from both short-range correlations (assessed via the Brock-Dechert-Scheinkman-LeBaron test) and long-range dependencies (evaluated through the Hurst Exponent).

Once these conditions are satisfied, EVT can be applied to model the probability of observing extreme execution times. The Block-Maxima (BM) approach divides the trace $𝒯$ into fixed-size blocks, extracts the maximum value from each, and fits these maxima to a Generalized Extreme Value (GEV) distribution $G_{\xi }(z)$ [47], which is the probability of not observing execution times greater than $z$ (by the Fisher-Tippett-Gnedenko theorem). The resulting shape parameter $\xi$ is particularly important, as it determines the GEV type:

• $\mathrm{■}$

  Gumbel family (or Type I) if $\xi =0$, $\forall z\in ℝ$

• $\mathrm{■}$

  Fréchet family (or Type II) if $\xi >0$, $\forall z\in [\mu -\frac{\sigma }{\xi },\mathrm{\infty })$

• $\mathrm{■}$

  Weibull family (or Type III) if , $\forall z\in (-\mathrm{\infty },\mu +\frac{\sigma }{|\xi |}]$

While all three GEV types (Gumbel, Fréchet, and Weibull) are valid results [40, 54], the Fréchet type ($\xi >0$) can produce notably pessimistic estimates due to its heavy tail.

Finally, the WCET value is extracted as the $(1-p)$-quantile of the fitted distribution $G_{\xi }(z)$ at the desired exceedance probability $p$, formally expressed as $WCET=G_{\xi }^{-1}(1-p)$. The resulting tuple $(WCET,p)$ constitutes the pWCET which must be read as “we expect that any observation will be less that WCET with $(1-p)$ probability”.

The Internet of Things (IoT) brought a massive increase in connectivity between physical devices throughout the recent years [4]. This has introduced novel threat scenarios for CPSs [61] that simply had not been thought of before. In this work we focus on two prominent attack vectors: data oriented attacks and sensory input manipulation (sensor spoofing).

From an offensive standpoint, previous efforts have primarily focused on crafting DoS attacks that exploit various architectural and operating-systems’ related sources of jitter which might compromise assumptions on temporal-isolation; since these are well systematized in [37] we report in this section the most relevant works.

Considering kernel-level attacks, Mahfouzi et al. [42] presented the butterfly attack, a scheduler-level attack against MCSs, which shows that delaying incoming data to a low-criticality task can increase the response time of dependent high-criticality tasks, bringing the system to physical instability. This attack is similar to ours in that it affects any MCS regardless of hardware or OS properties; however, the underlying attack vector differs, and their evaluation focuses on control-system stability rather than real-time impact.

Mergendahl et al. [45] presented the thundering-herd attack, which disrupts temporal isolation on mixed-criticality microkernels¹¹1In microkernels, OS services run as user-space servers communicating via IPC with client tasks, and time budgeting mechanisms enforce temporal isolation. by causing contention on shared OS services. The attack exploits priority-sorted IPC endpoint queues and budget replenishment queues [58]; by exhausting these resources through numerous low-priority tasks performing IPC calls, delays are introduced in higher priority tasks. Evaluation on seL4-MCS shows significant impact, though the required ${10}^2$–${10}^3$ attacker-controlled threads may limit applicability. Shared I/O or network queues have also been identified as another impactful interference channel. In particular, virtualised environments – key enablers of consolidation in mixed-criticality computing – have been shown to be vulnerable to a plethora of attacks that cause interference across co-resident VMs [33]. Additionally, scheduler side-channel attacks [18, 35] can provide an attacker with knowledge of the system’s task schedule, enabling precisely timed interference, such as the sensor spoofing and data-oriented attacks we consider, at the exact activation of victim tasks.

At the microarchitectural level, attacks primarily target multicore architectures. Despite long-known representativeness issues [41], the first CPS-targeted attack appeared in 2019 when Bechtel and Yun [10] demonstrated that the Miss-Status Holding Register (MSHR) of shared caches, if maliciously clogged, can cause execution time increases of up to $300$x, bypassing cache partitioning systems.

Most closely related to our work, Duncan et al. [25] introduced the Mad Monk attack, in which a compromised low-criticality task exploits shared microarchitectural resources (e.g., caches) to delay a higher-criticality mark task beyond its execution budget, thereby forcing arbitrary criticality mode switches without violating any MCS scheduling principle. While Mad Monk and our approach share the high-level goal of demonstrating that low-criticality tasks can undermine the temporal guarantees of higher-criticality ones, the two works differ in both attack vector and scope. Mad Monk operates at the hardware level, relying on resource contention (e.g., cache flushing) to inflate the execution time of a specific mark task; our work instead operates at the application level, showing that data-oriented and sensor spoofing attacks can exploit insufficient input representativeness in MBPTA to trigger WCET overruns along execution paths that were never exercised at design time. The Mad Monk attack can in principle be mitigated through resource partitioning, whereas the class of attacks we consider persists even on temporally isolated platforms, since the root cause lies in the gap between the inputs observed during timing analysis and those encountered at runtime by higher criticality tasks. Furthermore, our work complements the offensive analysis with a runtime detection mechanism, an aspect not addressed in [25].

Esposito et al. [56] presented the bank & row conflict bomb attack on shared DDR4 DIMM DRAM modules, where an attacker delays victim task execution by exhausting the DRAM row buffer through massive memory accesses, thereby increasing memory latency and exceeding the estimated worst-case execution time.

Building on these primitives, Li et al. [39] demonstrated real-world impact by hijacking an autonomous vehicle’s trajectory via cache contention against the localisation subsystem. In 2022, the same authors presented Polyrhythm [37], which combines multiple interference channels tuned via reinforcement learning, effectively inducing deadline misses in autonomous vehicles. Later work [38] showed that fail-safe mechanisms can limit multicore interference effects, requiring fine-tuned attack intensity and timeliness. We must note that these approaches address logical timing errors rather than WCET overruns; however, evaluations are specific to autonomous systems and lack mixed-criticality considerations and real-time impact quantification. Besides, contrary to our work, such approaches resort to generic stressor workloads rather than realistic attacks. We believe that evaluating the interference-generating capability of realistic attacks is needed for a better characterization of temporal threats to CPSs.

Existing approaches to anomaly detection in CPS can be broadly distinguished as follows: (i) time-based defences against attacks that cause task execution delays, and (ii) detection of malware that leaves traces in the system’s temporal profile. In the following, we include time-based fault detection, as faults represent temporal anomalies; however, approaches that detect only DOAs [22, 60] or only SSAs [49] are not considered, nor are program-behavior-based approaches that examine system call distributions [65] or model execution as regular languages [22].

In this context, our main competitor approach is BoostIID [64], which detects runtime pWCET distribution variations via ensemble learning; more specifically, their approach builds a detector by composing three well-known iid tests (KPSS, RS, Ljung-Box) via the boosting²²2Boosting is a sequential ensemble method that combines many weak learners (typically shallow decision trees) by iteratively training each new model to focus on the errors made by the previous ones, producing a strong overall predictor. technique [20]. Here, a history buffer feeds the tests online, signalling anomalies when the boosting output rejects the i.i.d. hypothesis. Evaluation uses synthetic scenarios with modified GEV parameters, measuring detection latency, safety margin, and $F_1$ score. However, performance drops ($\approx 18\%$ $F_1$ loss) as soon as the GEV scale parameter $\sigma$ increases, suggesting poor robustness to statistical variations. Practical considerations regarding the implementation of this runtime detector are also missing.

On the other hand, more traditional techniques primarily deal with setting temporal thresholds that, if exceeded, trigger user-supplied recovery policies. Hamad et al. [31] devised a two-threshold detector with spare time for recovery; tasks are monitored at the first threshold and terminated at the second. The main drawback is a strong dependence on the representativeness of timing analysis. Esposito et al. [27] applied two-threshold detection to performance counters in MCSs, translating thresholds into confidence levels on program-counter derived data distributions. While counter heterogeneity enables holistic monitoring, applicability depends on the available performance counters.

Another cluster of solutions [66, 11, 44] measures the WCET of program basic blocks by inserting timing annotations at compile time and enforcing them at runtime. Zimmer et al. [66] presented three time-based CFI techniques: T-Rex for detecting anomalous timing along return paths (suited for ROP attacks), T-ProT for buffer overflow protection via checkpoints, and T-AxT , which ensures the program counter stays within safe ranges through scheduler-level checks without instrumentation. Bellec et al. [11] extended this with hardware-based monitoring, while McDonald and Mueller [44] further extended T-ProT to protect kernel code and user-kernel transitions.

These WCET-based approaches still depend heavily on the representativeness of timing analysis. Furthermore, except for T-AxT, all require instrumentation, which can alter memory layout and harm predictability [46].

We consider the following environment in the context of a timing DoS attack:

• $\mathrm{■}$

  Computing Model – A computing platform consisting of:

  • –

    A uniprocessor $P$ running a mixed-criticality task set $\mathrm{\Gamma }$ according to the traditional two-criticality Vestal model [59].

  • –

    $n$ tasks $\mathrm{\Gamma }=\{{\tau }_1,\mathrm{\dots },{\tau }_n\}$ with ${\tau }_i=(T_i,D_i,{\chi }_i,{𝑪}_{𝒊})$, where $T_i$ is the period, $D_i$ the relative deadline, ${\chi }_i\in \{C_i^{LO},C_i^{HI}\}$ the task criticality level, and ${𝑪}_{𝒊}=\{C_i^{LO},C_i^{HI}\}$ the LO- and HI-criticality WCET. In particular, $C_i^{LO}$ is estimated via MBPTA and $C_i^{HI}$ via static analysis.

  • –

    A Real-Time Operating System (RTOS) offering IPC primitives (e.g., shared buffers).

  • –

    A dynamic-priority, preemptive mixed-criticality scheduler, under an implicit deadline system, i.e., $D_i=T_i$. The MCS scheduler follows the usual mode switch concept: the system is in one criticality mode (LO-mode or HI-mode) at any given time. When the system is in LO-mode, all tasks are guaranteed to run. If, however, any HI-criticality job ${\tau }_{i,j}$ executes for more than $C_i^{LO}$ time units, the system transitions from LO-mode to HI-mode, where only HI-criticality tasks are guaranteed to run while LO-criticality tasks are dropped.

• $\mathrm{■}$

  Deployed Mitigations – The system is assumed to be vulnerable to DOAs and SSAs. We do not specifically require mitigations against these attack vectors to be absent, since they are not perfect and some intrusions would go undetected anyway.

To better contextualize our approach, we define the following threat model:

• $\mathrm{■}$

  Intrusion Model – The attacker can only interfere with HI-criticality tasks (referred to as victim tasks) through LO-criticality tasks (referred to as violated tasks).

• $\mathrm{■}$

  Trusted Code Base (TCB) – The RTOS kernel and underlying firmware code are considered to be trusted.

• $\mathrm{■}$

  Attacker Capabilities – The attacker is able to exploit memory corruption vulnerabilities in LO-criticality tasks by forging arbitrary frames, packets or sensory inputs; such data is then delivered to a HI-criticality task through some IPC mechanism. Possible attack vectors can be vulnerabilities in the Bluetooth stack, remote keyless-entry systems, etc. [17]. Moreover, the attacker has also access to the source code of tasks (i.e., no security through obscurity).

Finally, we can state the attacker’s goal, which is to trigger temporal anomalies in order to bring the system into degraded mode. Malicious behaviour of different nature (e.g., stealing secrets via side-channel attacks, breaking authentication of inter-device communication protocols, etc.) is out of the scope of this work.

Given the threat model defined above, we describe the general strategies through which DOAs and SSAs can induce temporal anomalies. For each attack class we introduce two parameters that will be used to quantify attack effort throughout the evaluation: intensity, which measures the magnitude of the perturbation applied to a single job, and frequency, which measures the fraction of jobs that carry a malicious payload.

To thoroughly capture DOA and SSA impact on temporal correctness, we define four complementary metrics addressing both static design-time assumptions and dynamic runtime behaviour:

1. (1)

   WCET overrun ($\mathrm{\Delta }C$, static analysis). Quantifies by how much observed execution times exceed the design-time LO-criticality WCET estimate. Given a timing trace, defined as a finite sequence of execution time observations ${\{{𝒳}_i\}}_{i=1}^n$, we compute:

   $\mathrm{\Delta }C={\displaystyle \frac{{\max }_{1\le i\le n}\{{𝒳}_i\}}{C^{LO}}}-1$

   (1)

   where $C^{LO}$ is the estimated pWCET. A value $\mathrm{\Delta }C>0$ indicates WCET pessimism was insufficient.

2. (2)

   Schedulability ($S$, static analysis). Determines whether timing assumptions remain satisfied under attack by evaluating the schedulability condition for the chosen preemptive scheduler. Losing schedulability places the system in an inconsistent state where even HI-criticality WCETs may be exceeded.

3. (3)

   Deadline miss ratio ($R_{miss}$, dynamic simulation). Measures the fraction of jobs that miss their deadline over a fixed observation period ($0\le R_{miss}\le 1$). Directly quantifies the fraction of timing constraint violations.

4. (4)

   Degraded-mode ratio ($K_{HI}$, dynamic simulation). Captures the fraction of execution time spent in HI-criticality (degraded) mode ($0\le K_{HI}\le 1$). Indicates how frequently the system must activate stricter resource management in response to detected deadline threats.

As discussed in Section 1, our second research question ($ℛ{𝒬}_2$) asks whether anomaly detection based on execution-time distributions can be effective given the heterogeneous temporal behaviour of tasks in MCSs. Existing approaches such as BoostIID [64] rely on testing whether execution times remain independent and identically distributed (iid) when the system is running; however, as noted in Section 3.2, their accuracy degrades (up to $18\%$ $F_1$ loss) when the GEV scale parameter $\sigma$ increases – a common situation in mixed-criticality workloads where tasks exhibit diverse timing profiles.

We propose an alternative strategy: instead of testing for iid properties to hold, we directly compare the pWCET distribution of a task $G_{\xi }$ – estimated at design time via MBPTA (see Section 2.1) – with the empirical, discrete Block-Maxima distribution of execution times $E(z)$, computed by frequency-counting the observed samples ${𝒳}_i$ at runtime. From an MBPTA perspective, our solution is orthogonal to [64] in that it performs online testing of EVT postconditions instead of preconditions.

The key insight of this approach is that, as long as a statistical test confirms Goodness-of-Fit (GoF) between these distributions, i.e., $E(z)\approx G_{\xi }(z)$, we can be reasonably confident that the task behaves as expected at design time.

In this section, we (i) detail the hardware and software platform on which we run the attack scenarios (Section 5.1.1), (ii) explain which attack strategies can be used in such scenarios (Section 5.1.2), and (iii) report how each phase in the impact measurement pipeline is configured (Section 5.1.3).

To address $ℛ{𝒬}_2$, we compare our pWCET-based detector against the BoostIID approach by Yi and Dutt [64] using synthetic evaluation. This preliminary assessment focuses on algorithm behaviour under controlled conditions rather than claiming real-world applicability; Section 6 will discuss the implications of this synthetic setting. Since BoostIID source code and complete configuration parameters were unavailable, Appendix A details our implementation based on the published method. This reconstruction introduces inherent uncertainty in the comparison; performance differences may reflect implementation choices rather than fundamental algorithmic properties. However, we still find our results to confirm the BoostIID accuracy limitations pointed out by the original authors [64].