154 research outputs found
Characterization of Model-Based Detectors for CPS Sensor Faults/Attacks
A vector-valued model-based cumulative sum (CUSUM) procedure is proposed for
identifying faulty/falsified sensor measurements. First, given the system
dynamics, we derive tools for tuning the CUSUM procedure in the fault/attack
free case to fulfill a desired detection performance (in terms of false alarm
rate). We use the widely-used chi-squared fault/attack detection procedure as a
benchmark to compare the performance of the CUSUM. In particular, we
characterize the state degradation that a class of attacks can induce to the
system while enforcing that the detectors (CUSUM and chi-squared) do not raise
alarms. In doing so, we find the upper bound of state degradation that is
possible by an undetected attacker. We quantify the advantage of using a
dynamic detector (CUSUM), which leverages the history of the state, over a
static detector (chi-squared) which uses a single measurement at a time.
Simulations of a chemical reactor with heat exchanger are presented to
illustrate the performance of our tools.Comment: Submitted to IEEE Transactions on Control Systems Technolog
Tuning Windowed Chi-Squared Detectors for Sensor Attacks
A model-based windowed chi-squared procedure is proposed for identifying
falsified sensor measurements. We employ the widely-used static chi-squared and
the dynamic cumulative sum (CUSUM) fault/attack detection procedures as
benchmarks to compare the performance of the windowed chi-squared detector. In
particular, we characterize the state degradation that a class of attacks can
induce to the system while enforcing that the detectors do not raise alarms
(zero-alarm attacks). We quantify the advantage of using dynamic detectors
(windowed chi-squared and CUSUM detectors), which leverages the history of the
state, over a static detector (chi-squared) which uses a single measurement at
a time. Simulations using a chemical reactor are presented to illustrate the
performance of our tools
On Reachable Sets of Hidden CPS Sensor Attacks
For given system dynamics, observer structure, and observer-based
fault/attack detection procedure, we provide mathematical tools -- in terms of
Linear Matrix Inequalities (LMIs) -- for computing outer ellipsoidal bounds on
the set of estimation errors that attacks can induce while maintaining the
alarm rate of the detector equal to its attack-free false alarm rate. We refer
to these sets to as hidden reachable sets. The obtained ellipsoidal bounds on
hidden reachable sets quantify the attacker's potential impact when it is
constrained to stay hidden from the detector. We provide tools for minimizing
the volume of these ellipsoidal bounds (minimizing thus the reachable sets) by
redesigning the observer gains. Simulation results are presented to illustrate
the performance of our tools
A Comparison of Stealthy Sensor Attacks on Control Systems
As more attention is paid to security in the context of control systems and
as attacks occur to real control systems throughout the world, it has become
clear that some of the most nefarious attacks are those that evade detection.
The term stealthy has come to encompass a variety of techniques that attackers
can employ to avoid detection. Here we show how the states of the system (in
particular, the reachable set corresponding to the attack) can be manipulated
under two important types of stealthy attacks. We employ the chi-squared fault
detection method and demonstrate how this imposes a constraint on the attack
sequence either to generate no alarms (zero-alarm attack) or to generate alarms
at a rate indistinguishable from normal operation (hidden attack)
No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems
In recent years, a number of process-based anomaly detection schemes for
Industrial Control Systems were proposed. In this work, we provide the first
systematic analysis of such schemes, and introduce a taxonomy of properties
that are verified by those detection systems. We then present a novel general
framework to generate adversarial spoofing signals that violate physical
properties of the system, and use the framework to analyze four anomaly
detectors published at top security conferences. We find that three of those
detectors are susceptible to a number of adversarial manipulations (e.g.,
spoofing with precomputed patterns), which we call Synthetic Sensor Spoofing
and one is resilient against our attacks. We investigate the root of its
resilience and demonstrate that it comes from the properties that we
introduced. Our attacks reduce the Recall (True Positive Rate) of the attacked
schemes making them not able to correctly detect anomalies. Thus, the
vulnerabilities we discovered in the anomaly detectors show that (despite an
original good detection performance), those detectors are not able to reliably
learn physical properties of the system. Even attacks that prior work was
expected to be resilient against (based on verified properties) were found to
be successful. We argue that our findings demonstrate the need for both more
complete attacks in datasets, and more critical analysis of process-based
anomaly detectors. We plan to release our implementation as open-source,
together with an extension of two public datasets with a set of Synthetic
Sensor Spoofing attacks as generated by our framework
Design-Time Quantification of Integrity in Cyber-Physical-Systems
In a software system it is possible to quantify the amount of information
that is leaked or corrupted by analysing the flows of information present in
the source code. In a cyber-physical system, information flows are not only
present at the digital level, but also at a physical level, and to and fro the
two levels. In this work, we provide a methodology to formally analyse a
Cyber-Physical System composite model (combining physics and control) using an
information flow-theoretic approach. We use this approach to quantify the level
of vulnerability of a system with respect to attackers with different
capabilities. We illustrate our approach by means of a water distribution case
study
- …