Distributed detection of covert attacks for linear large-scale interconnected systems is addressed in this paper. Existing results consider the problem in centralized settings. This work focuses on large-scale systems subject to bounded process and measurement disturbances, where a single subsystem is under a covert attack. A detection methodology is proposed, where each subsystem can detect the presence of covert attacks in neighboring subsystems in a distributed manner. The detection strategy is based on the design of two model-based observers for each subsystem using only local information. An extensive detectability analysis is provided and simulation results on a power network benchmark are given, showing the effectiveness of the proposed methodology for the detection of covert cyberattacks. I. INTRODUCTION C RITICAL infrastructures such as, for example, electric power systems, water distribution networks, telecommunication networks, transportation systems, and industrial processes are nowadays large-scale systems that are interconnected not only on the physical layer but through a communication infrastructure thus increasing the vulnerability to external cyber-attacks. Security concerns related to these systems include both physical security and cyber-security, as well as combined cyber-physical threats. Indeed, in recent years, the security challenge has become a vital technological issue, especially after the occurrence of incidents involving industrial plants and critical infrastructures (see [1], [2]). Due to the complexity of these systems and the computational and communication constraints, the development of distributed methodologies for monitoring and detection of malicious cyber-attacks has become a necessity. Recently developed comprehensive techniques for distributed fault diagnosis (see, for instance the recent works [3], [4] and the references cited therein) may not be fully effective in detecting

The problem of covert attacks detection in a network of interconnected subsystems is addressed in this paper. Existing approaches in the area of covert attacks detection have been devoted to centralized systems and are mainly based on mismatch between the attacker's model and the actual plant. Instead, in this paper, we consider a large-scale system where the attacker has full knowledge on the subsystems models. By using the information received from neighboring subsystems and by exploiting the mismatch between a distributed Luenberger observer and a decentralized unknown input observer, we propose a local detection strategy allowing each subsystem to detect anomalies in its neighborhood. The effectiveness of the proposed strategy is shown in a numerical example.

Monitoring systems are essential to understand and control the behaviour of systems and networks. Cyber-physical systems (CPS) are particularly delicate under that perspective since they involve real-time constraints and physical phenomena that are not usually considered in common IT solutions. Therefore, there is a need for publicly available monitoring tools able to contemplate these aspects. In this poster/demo, we present our initiative, called CPS-MT, towards a versatile, real-time CPS monitoring tool, with a particular focus on security research. We first present its architecture and main components, followed by a MiniCPS-based case study. We also describe a performance analysis and preliminary results. During the demo, we will discuss CPS-MT's capabilities and limitations for security applications.

No abstract

The design of a distributed architecture for the detection of covert attacks in interconnected Cyber-Physical Systems is addressed in this paper, in the presence of stochastic uncertainties. By exploiting communication between neighbors, the proposed scheme allows for the detection of covert attacks that are locally stealthy. The proposed methodology adopts a decentralized filter, jointly estimating the local state and the aggregate effect of the physical interconnections, and uses the communicated estimates to obtain an attack-sensitive residual. We derive some theoretical detection properties for the proposed architecture, and present numerical simulations.