CUSUM and chi-squared attack detection of compromised sensors

Murguia, Carlos; Ruths, Justin

doi:10.1109/cca.2016.7587875

Cited by 73 publications

(70 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Indeed, because many design assumptions are no longer valid when perturbations to the system are caused by an adversarial attacker rather than random or structured failures, DDoS attacks toward CPS are a rising threat . Several CUSUM‐based algorithms have been proposed for detecting attacks toward CPS, in particular supervisory control and data acquisition (SCADA) systems, power system lines, and smart grids , …”

Section: Introductionmentioning

confidence: 99%

“…10 Indeed, because many design assumptions are no longer valid when perturbations to the system are caused by an adversarial attacker rather than random or structured failures, 11 DDoS attacks toward CPS are a rising threat. 12 Several CUSUM-based algorithms have been proposed for detecting attacks toward CPS, [13][14][15] in particular supervisory control and data acquisition (SCADA) systems, 16 power system lines, 17 and smart grids. 18,19 In this letter, we capitalize on recent results appeared in the statistics literature, [20][21][22] which we believe pave the way for more effective algorithms in the application contexts described earlier.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An alternative procedure to cumulative sum for cyber‐physical attack detection

Coluccia

Fascista

2017

Internet Technology Letters

View full text Add to dashboard Cite

Motivated by the importance of change detection in cyber‐physical systems security, an alternative procedure to the classical cumulative sum (CUSUM) algorithm is explored. By capitalizing on recent results appeared in the statistical literature, it is shown that superior performance can be obtained in terms of reaction time while being robust against parameter mismatches. In order to translate such quickest‐detection‐theoretic advances into practical system‐engineering tools, a simple pseudocode is provided that ensures approximately flat response with respect to the change time. We believe the latter is a very important property that is missing in CUSUM‐based detection approaches.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

An alternative procedure to cumulative sum for cyber‐physical attack detection

Coluccia

Fascista

2017

Internet Technology Letters

View full text Add to dashboard Cite

show abstract

“…The work in [22] demonstrated that replay attacks eluded conventional χ 2 tests and proposed a new Linear Quadratic Gaussian (LQG) controller to process the residuals which eventually led to detection. [23] investigated the statistical consistency of residuals using the CUSUM procedure. Other researchers [24,25] have proposed ways to estimate state parameters under cyberattacks.…”

Section: Related Workmentioning

confidence: 99%

Cross-Level Detection Framework for Attacks on Cyber-Physical Systems

et al. 2017

View full text Add to dashboard Cite

Anomaly detection is critical in thwarting malicious attacks on Cyber-Physical Systems. This work presents a novel inference engine that integrates two heterogeneous anomaly detectors, working at different levels of the system architecture, in order to produce a crosslevel detector more effective than either one separately. The macro-or process-level detector uses a bank of observers of the physical plant that estimate the state of the process suspected to be under attack, specifically for its sensor to be compromised, from data gathered by available networked sensors. The estimates are then combined using a Weapons and Systems Engineering Department, U.S. Naval Academy, Annapolis, MD, USA consensus algorithm to determine if the suspect sensor is reporting false readings. The micro-level detector uses timesampled side-channel power measurements of an integrated circuit on the suspect sensor. By comparing power measurements against those from a known good state, differences indicate the code running inside has been altered. The crosslevel detector performs a two-dimensional Neyman-Pearson hypothesis test that declares the presence of an attack on the sensor node. The cross-level detector is shown to be more accurate and less latent than its constituent parts. Detection was tested against a range of False Data Injection attacks on a hardware prototype and the detector performance was measured experimentally. The cross-level detector on average achieved a 93% rate of correct detection, compared with 72 and 85% for the macro-and micro-level detectors, respectively; and a 50% reduction in latency compared to the macro-level detector.

show abstract

“…Proposition 1. [Murguia and Ruths (2016b)]. Assume that there are no attacks on the system and consider the chisquared procedure (11) with residual r k ∼ N (0, Σ) and threshold α ∈ R >0 .…”

Section: False Alarmsmentioning

confidence: 99%

Reachable Sets of Hidden CPS Sensor Attacks: Analysis and Synthesis Tools

2017

Self Cite

View full text Add to dashboard Cite

For given system dynamics, control structure, and fault/attack detection procedure, we provide mathematical tools-in terms of Linear Matrix Inequalities (LMIs)-for characterizing and minimizing the set of states that sensor attacks can induce in the system while keeping the alarm rate of the fault detector sufficiently close to its false alarm rate in the attack-free case. This quantifies the attack's potential impact when it is constrained to stay hidden from the detector. Simulation results are presented to illustrate the performance of our tools.

show abstract

CUSUM and chi-squared attack detection of compromised sensors

Cited by 73 publications

References 18 publications

An alternative procedure to cumulative sum for cyber‐physical attack detection

An alternative procedure to cumulative sum for cyber‐physical attack detection

Cross-Level Detection Framework for Attacks on Cyber-Physical Systems

Reachable Sets of Hidden CPS Sensor Attacks: Analysis and Synthesis Tools

Contact Info

Product

Resources

About