372 research outputs found
Tuning Windowed Chi-Squared Detectors for Sensor Attacks
A model-based windowed chi-squared procedure is proposed for identifying
falsified sensor measurements. We employ the widely-used static chi-squared and
the dynamic cumulative sum (CUSUM) fault/attack detection procedures as
benchmarks to compare the performance of the windowed chi-squared detector. In
particular, we characterize the state degradation that a class of attacks can
induce to the system while enforcing that the detectors do not raise alarms
(zero-alarm attacks). We quantify the advantage of using dynamic detectors
(windowed chi-squared and CUSUM detectors), which leverages the history of the
state, over a static detector (chi-squared) which uses a single measurement at
a time. Simulations using a chemical reactor are presented to illustrate the
performance of our tools
State of the art of cyber-physical systems security: An automatic control perspective
Cyber-physical systems are integrations of computation, networking, and physical processes. Due to the tight cyber-physical coupling and to the potentially disrupting consequences of failures, security here is one of the primary concerns. Our systematic mapping study sheds light on how security is actually addressed when dealing with cyber-physical systems from an automatic control perspective. The provided map of 138 selected studies is defined empirically and is based on, for instance, application fields, various system components, related algorithms and models, attacks characteristics and defense strategies. It presents a powerful comparison framework for existing and future research on this hot topic, important for both industry and academia
Characterization of Model-Based Detectors for CPS Sensor Faults/Attacks
A vector-valued model-based cumulative sum (CUSUM) procedure is proposed for
identifying faulty/falsified sensor measurements. First, given the system
dynamics, we derive tools for tuning the CUSUM procedure in the fault/attack
free case to fulfill a desired detection performance (in terms of false alarm
rate). We use the widely-used chi-squared fault/attack detection procedure as a
benchmark to compare the performance of the CUSUM. In particular, we
characterize the state degradation that a class of attacks can induce to the
system while enforcing that the detectors (CUSUM and chi-squared) do not raise
alarms. In doing so, we find the upper bound of state degradation that is
possible by an undetected attacker. We quantify the advantage of using a
dynamic detector (CUSUM), which leverages the history of the state, over a
static detector (chi-squared) which uses a single measurement at a time.
Simulations of a chemical reactor with heat exchanger are presented to
illustrate the performance of our tools.Comment: Submitted to IEEE Transactions on Control Systems Technolog
Design of false data injection attack on distributed process estimation
Herein, design of false data injection attack on a distributed cyber-physical system is considered. A stochastic process with linear dynamics and Gaussian noise is measured by multiple agent nodes, each equipped with multiple sensors. The agent nodes form a multi-hop network among themselves. Each agent node computes an estimate of the process by using its sensor observation and messages obtained from neighboring nodes, via Kalman-consensus filtering. An external attacker, capable of arbitrarily manipulating the sensor observations of some or all agent nodes, injects errors into those sensor observations. The goal of the attacker is to steer the estimates at the agent nodes as close as possible to a pre-specified value, while respecting a constraint on the attack detection probability. To this end, a constrained optimization problem is formulated to find the optimal parameter values of a certain class of linear attacks. The parameters of linear attack are learnt on-line via a combination of stochastic approximation based update of a Lagrange multiplier, and an optimization technique involving either the Karush-Kuhn-Tucker (KKT) conditions or online stochastic gradient descent. The problem turns out to be convex for some special cases. Desired convergence of the proposed algorithms are proved by exploiting the convexity and properties of stochastic approximation algorithms. Finally, numerical results demonstrate the efficacy of the attack
Quickest Detection of False Data Injection Attack in Distributed Process Tracking
This paper addresses the problem of detecting false data injection (FDI)
attacks in a distributed network without a fusion center, represented by a
connected graph among multiple agent nodes. Each agent node is equipped with a
sensor, and uses a Kalman consensus information filter (KCIF) to track a
discrete time global process with linear dynamics and additive Gaussian noise.
The state estimate of the global process at any sensor is computed from the
local observation history and the information received by that agent node from
its neighbors. At an unknown time, an attacker starts altering the local
observation of one agent node. In the Bayesian setting where there is a known
prior distribution of the attack beginning instant, we formulate a Bayesian
quickest change detection (QCD) problem for FDI detection in order to minimize
the mean detection delay subject to a false alarm probability constraint. While
it is well-known that the optimal Bayesian QCD rule involves checking the
Shriyaev's statistic against a threshold, we demonstrate how to compute the
Shriyaev's statistic at each node in a recursive fashion given our non-i.i.d.
observations. Next, we consider non-Bayesian QCD where the attack begins at an
arbitrary and unknown time, and the detector seeks to minimize the worst case
detection delay subject to a constraint on the mean time to false alarm and
probability of misidentification. We use the multiple hypothesis sequential
probability ratio test for attack detection and identification at each sensor.
For unknown attack strategy, we use the window-limited generalized likelihood
ratio (WL-GLR) algorithm to solve the QCD problem. Numerical results
demonstrate the performances and trade-offs of the proposed algorithms
On Reachable Sets of Hidden CPS Sensor Attacks
For given system dynamics, observer structure, and observer-based
fault/attack detection procedure, we provide mathematical tools -- in terms of
Linear Matrix Inequalities (LMIs) -- for computing outer ellipsoidal bounds on
the set of estimation errors that attacks can induce while maintaining the
alarm rate of the detector equal to its attack-free false alarm rate. We refer
to these sets to as hidden reachable sets. The obtained ellipsoidal bounds on
hidden reachable sets quantify the attacker's potential impact when it is
constrained to stay hidden from the detector. We provide tools for minimizing
the volume of these ellipsoidal bounds (minimizing thus the reachable sets) by
redesigning the observer gains. Simulation results are presented to illustrate
the performance of our tools
On the Control of Microgrids Against Cyber-Attacks: A Review of Methods and Applications
Nowadays, the use of renewable generations, energy storage systems (ESSs) and microgrids (MGs) has been developed due to better controllability of distributed energy resources (DERs) as well as their cost-effective and emission-aware operation. The development of MGs as well as the use of hierarchical control has led to data transmission in the communication platform. As a result, the expansion of communication infrastructure has made MGs as cyber-physical systems (CPSs) vulnerable to cyber-attacks (CAs). Accordingly, prevention, detection and isolation of CAs during proper control of MGs is essential. In this paper, a comprehensive review on the control strategies of microgrids against CAs and its defense mechanisms has been done. The general structure of the paper is as follows: firstly, MGs operational conditions, i.e., the secure or insecure mode of the physical and cyber layers are investigated and the appropriate control to return to a safer mode are presented. Then, the common MGs communication system is described which is generally used for multi-agent systems (MASs). Also, classification of CAs in MGs has been reviewed. Afterwards, a comprehensive survey of available researches in the field of prevention, detection and isolation of CA and MG control against CA are summarized. Finally, future trends in this context are clarified
- …