SentryBus: A Multi-Vantage Observability Model and Validated Instrument for I2C Sensor-Interface Manipulation

• URL: http://arxiv.org/abs/2608.17082v1
• Date: Mon, 17 Aug 2026 19:38:51 GMT
• Title: SentryBus: A Multi-Vantage Observability Model and Validated Instrument for I2C Sensor-Interface Manipulation
• Abstract summary: An adversary on the digital interface between sensor and processor can supply a plausible value that correct firmware accepts and reports as ordinary telemetry.<n>SentryBus models acquisition behavior on the I2C sensor bus using transaction timing, read and write sequences, transfer lengths, address behavior, register and FIFO state access, and raw data transitions.<n>A dual sided testbed captures both busses, host memory, and telemetry, and the detector consumes the host facing bus alone while the remaining vantages serve as ground truth.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Sensor-driven systems in medical Internet of Things devices, drones, and cyber-physical systems commonly trust a measurement once it reaches the embedded processor. An adversary on the digital interface between sensor and processor can supply a plausible value that correct firmware accepts and reports as ordinary telemetry. The hypothesis is that sensor interface manipulation leaves observable evidence on the acquisition path, that the evidence appears at different vantages depending on attacker position, and that a passive host-side monitor therefore has a measurable boundary beyond which manipulation becomes indistinguishable from legitimate acquisition. SentryBus models acquisition behavior on the I2C sensor bus using transaction timing, read and write sequences, transfer lengths, address behavior, register and FIFO state access, and raw data transitions. The adversary is modeled as an inline interposer, parallel controller, sensor replacement, or compromised host, because a commodity target-only sensor cannot initiate transfers or stretch, reorder, or delay bus transactions. A dual sided testbed captures both busses, host memory, and telemetry, and the detector consumes the host facing bus alone while the remaining vantages serve as ground truth. A physiological instantiation reports three measured results: an inline interposer bounded at 0.842 percent of acquisition service time while preserving acquisition schedule and payload content, clean acquisition stability sustained over 6304 seconds at the telemetry vantage with no clock regression, and a negative result establishing that data-transition features encode session specific signal statistics and do not transfer across capture sessions. Instrument characterization shows that a low-cost analyzer can truncate captures without kernel visible error. Controlled attack trials are still outstanding, so no detection rate is claimed.

Related papers

• Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning [78.29352305480285]
  In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds.<n>This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement.
  arXiv  Detail & Related papers  (2026-08-22T18:38:39Z)
• Detecting Adversarial Evasion Attacks Against Autoencoder-Based Network Intrusion Detection Systems [0.0]
  Evasion attacks deliberately manipulate input to an ML-based system to produce an incorrect prediction while the manipulated input still appears benign.<n>In this paper, we propose two complementary detectors: the Residual Localisation Detector (RLD) and the Feature-Space Perturbation Consistency (FPC) Detector.<n>We evaluate both detectors on benign, malicious, and adversarial traffic from multiple IoT devices in the UQ-IoT dataset.
  arXiv  Detail & Related papers  (2026-07-01T17:26:24Z)
• CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs [100.38986535324284]
  We introduce textbfCIAware-Bench, a benchmark for measuring textbfcontrol textbfintervention (CI) awareness across frontier models.<n>CIAware-Bench tests whether models can distinguish their own trajectories from those modified by a control intervention.
  arXiv  Detail & Related papers  (2026-06-09T16:24:16Z)
• DSTAN-Med: Dual-Channel Spatiotemporal Attention with Physiological Plausibility Filtering for False Data Injection Attack Detection in IoT-Based Medical Devices [1.1459450491541954]
  False data injection (FDI) attacks on Internet of Medical Things (IoMT) sensor streams falsify vital signs in transit.<n>Existing deep learning detectors conflate inter-sensor spatial correlations with temporal dependencies in a shared latent space.<n>We propose DSTAN-Med, a supervised framework that routes multivariate sensor windows through independent sensor-wise (SWA) and time-wise (TWA) self-attention pathways.
  arXiv  Detail & Related papers  (2026-05-13T22:39:47Z)
• WISV: Wireless-Informed Semantic Verification for Distributed Speculative Decoding in Device-Edge LLM Inference [56.297697169678095]
  WISV (Wireless-Informed Semantic Verification) is a novel distributed speculative decoding framework.<n>We show that WISV achieves up to a 60.8% increase in accepted length, a 37.3% reduction in interaction rounds, and a 31.4% improvement in end-to-end latency.<n>We validate WISV on a hardware testbed comprising an NVIDIA Jetson AGX Orin and an A40-equipped server.
  arXiv  Detail & Related papers  (2026-04-20T01:29:56Z)
• Attractor-Keyed Memory [0.0]
  Physical selectors produce high-dimensional signatures at the moment of decision.<n>We show that when the signatures are repeatable across trials (stereotyped) and linearly independent across routes, a single linear decoder maps them to arbitrary payloads.<n>We derive the full error decomposition, give Ising-machine selector constructions, and validate the predicted scalings on synthetic speckle-signature simulations.
  arXiv  Detail & Related papers  (2026-03-17T18:31:40Z)
• Detecting Object Tracking Failure via Sequential Hypothesis Testing [80.7891291021747]
  Real-time online object tracking in videos constitutes a core task in computer vision.<n>We propose interpreting object tracking as a sequential hypothesis test, wherein evidence for or against tracking failures is gradually accumulated over time.<n>We propose both supervised and unsupervised variants by leveraging either ground-truth or solely internal tracking information.
  arXiv  Detail & Related papers  (2026-02-13T14:57:15Z)
• A Sensing Dataset Protocol for Benchmarking and Multi-Task Wireless Sensing [45.99328292838584]
  We propose the Sensing dataset Protocol (SDP), a protocol-level specification and benchmark framework for large-scale wireless sensing.<n>SDP defines how heterogeneous wireless signals are mapped into a unified perception data-block schema.<n>A unified benchmark is established for detection, recognition, and vital-sign estimation with consistent preprocessing, training, and evaluation.
  arXiv  Detail & Related papers  (2025-12-13T05:01:30Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• Mobile Behavioral Biometrics for Passive Authentication [65.94403066225384]
  This work carries out a comparative analysis of unimodal and multimodal behavioral biometric traits. Experiments are performed over HuMIdb, one of the largest and most comprehensive freely available mobile user interaction databases. In our experiments, the most discriminative background sensor is the magnetometer, whereas among touch tasks the best results are achieved with keystroke.
  arXiv  Detail & Related papers  (2022-03-14T17:05:59Z)
• "Is not the truth the truth?": Analyzing the Impact of User Validations for Bus In/Out Detection in Smartphone-based Surveys [5.449283796175882]
  This paper describes the Human-Computer interaction experimental setting in a semi-controlled environment. It involves: two autonomous vehicles operating on two routes, serving three bus stops and eighteen users, as well as a proprietary smartphone- Bluetooth sensing platform. We performed a Monte-Carlo simulation of labels-flip to emulate human errors in the labeling process, as is known to happen in smartphone surveys.
  arXiv  Detail & Related papers  (2022-02-24T08:48:40Z)
• Sensor Fusion-based GNSS Spoofing Attack Detection Framework for Autonomous Vehicles [4.947150829838588]
  A sensor fusion-based attack detection framework is presented that consists of three concurrent strategies for an autonomous vehicle. Data from multiple low-cost in-vehicle sensors are fused and fed into a recurrent neural network model. We have combined k-Nearest Neighbors (k-NN) and Dynamic Time Warping (DTW) algorithms to detect turns using data from the steering angle sensor. Our analysis reveals that the sensor fusion-based detection framework successfully detects all three types of spoofing attacks within the required computational latency threshold.
  arXiv  Detail & Related papers  (2021-06-05T23:02:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.