Build a working security accelerator for ROS 2 fleets that can detect command-path threats, attribute DDS traffic to specific nodes, isolate compromised endpoints safely, and produce SIEM-ready evidence — without requiring a wholesale platform replacement.
ROS 2 / DDS Security Accelerator for Robot Fleets
OBJECTIVES/GOAL
CHALLENGES
ROS 2 graph observation must separate genuine attack signals from benign replanning behavior to avoid false positives. DDS discovery and traffic runs in cleartext, making attribution and policy enforcement difficult across dynamic node graphs. Hardening needs to span the ROS 2 app, DDS middleware, OS, and network layers simultaneously.
ACCOMPLISHMENTS
Benison built and demonstrated detection logic that correlates extra /cmd_vel publishers with plan divergence to identify command-path hijack attempts. The accelerator covers conflicting odometry sources, physically impossible pose jumps, and sensor flood/DoS behavior. Deliverables include detection rules, event schema, SROS 2 policy foundation, and a SIEM-ready integration path.
TECHNOLOGIES USED
Linux + ROS 2 Jazzy + Gazebo-compatible stack
rclpy graph sensor, Nav2 plan observation
SROS 2, AppArmor/SELinux, eBPF, nftables
Fast DDS / Cyclone DDS hardening
