Can Replay Attacks Designed to Steal Water from Water Distribution Systems Remain Undetected?

Abstract

Industrial Control Systems (ICS) monitor and control physical processes. ICS are found in, among others, critical infrastructures such as water treatment plants, water distribution systems, and the electric power grid. While the existence of cyber-components in an ICS leads to ease of operations and maintenance, it renders the system under control vulnerable to cyber and physical attacks. An experimental study was conducted with replay attacks launched on an operational water distribution (WADI) plant to understand under what conditions an attacker/attack can remain undetected while stealing water. A detection method, based on an input-output Linear Time-invariant system model of the physical process, was developed and implemented in WADI to detect such attacks. The experiments reveal the strengths and limitations of the detection method and challenges faced by an attacker while attempting to steal water from a water distribution system.

A practical physical watermarking approach to detect replay attacks in a CPS

“…Stealthy and replay attacks on critical water cyber physical systems have gone undetected for long [10,8]. Physical watermarking [7] has been proposed to detect the replay attacks, however, it is challenging to come up with a practical design.…”

“…Replay attacks tend to hide the real state of the process from the SCADA system by recording and replaying normal measurements. An experimental study is carried out in [10] to show how an attacker can hide an intentional leak in water distribution system by launching replay attacks on sensor and actuator measurements simultaneously. The experiments were performed on a real operated water distribution testbed, named as WADI.…”

“…The earlier studies have assessed the performance of the CUSUM model-based fault detection procedure for a variety of attacks [10]. The residual random sequence r k , k ∈ N is defined as the difference between sensor measurements (ȳ k ) with attack value(δ k ), and the estimate of the sensor measurement.…”

“…The control valves for consumer tanks (MCVs) are also chosen to perform the replay attack on. As shown in [10], when the attacker uses the complete knowledge of the system and perform replay attack on all the actuators and sensors used by the detector, attack detection is not possible. For example, in [10], the authors showed that the powerful attack in which the attacker compromises all sensor and actuators was not detected and the attacker was successful in hiding the attack.…”

“…As shown in [10], when the attacker uses the complete knowledge of the system and perform replay attack on all the actuators and sensors used by the detector, attack detection is not possible. For example, in [10], the authors showed that the powerful attack in which the attacker compromises all sensor and actuators was not detected and the attacker was successful in hiding the attack. As shown in Figure 6 the residual signal for two pressure sensor measurements namely, 2_PIT_001 and 2_PIT_002, stays within the upper and lower threshold of a CUSUM detector.…”