Data-injection attacks in stochastic control systems: Detectability and performance tradeoffs

Bai, Cheng-Zong; Pasqualetti, Fabio; Gupta, Vijay

doi:10.1016/j.automatica.2017.04.047

Cited by 203 publications

(62 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [225], [226], Kullback-Leibler divergence is employed to develop a stealthiness and obtain worst-case attack policies as a trade-off between system performance degradation and attack stealthiness. In [227], [228], worst case deception attacks are analyzed in stochastic systems and the number of sensors to secure the system using a Kalman filter approach is proposed. Attacks on Kalman filters have been also analyzed in [229].…”

Section: A Threat Assessmentmentioning

confidence: 99%

A systems and control perspective of CPS security

Dibaji

Pirani

Flamholz

et al. 2019

Annual Reviews in Control

404

191

View full text Add to dashboard Cite

The comprehensive integration of instrumentation, communication, and control into physical systems has led to the study of Cyber-Physical Systems (CPS), a field that has recently garnered increased attention. A key concern that is ubiquitous in CPS is a need to ensure security in the face of cyber attacks. In this paper, we carry out a survey of systems and control methods that have been proposed for the security of CPS. We classify these methods into three categories based on the type of defense proposed against the cyberattacks: prevention, resilience, and detection & isolation. A unified threat assessment metric is proposed in order to evaluate how CPS security is achieved in each of these three cases. Also surveyed are risk assessment tools and the effect of network topology on CPS security. An emphasis has been placed on power and transportation applications in the overall survey. Index Terms-cyber-physical systems, resilient control I. INTRODUCTION Motivated by concerns about sustainability, efficiency, and resiliency, several sectors including energy, transportation, water, and healthcare systems have witnessed significant advances in instrumentation, monitoring, and automation over the past decade. The resulting integration of information, communication, and computation with physically engineered systems demands a detailed investigation into the analysis and synthesis of Cyber-Physical Systems (CPS) so as to realize the desired performance metrics of efficiency, sustainability, and safety. The extensive and intricate presence of cyber components also introduces a vulnerability of unwanted access to these systems. The available communication technologies, referred to as SCADA (Supervisory Control and Data Acquisition), are witnessing significant advances, triggering a shift from protected, closed, and wired networks to open and wireless networks which, as a side effect, are more vulnerable to outside interference.

show abstract

Section: A Threat Assessmentmentioning

confidence: 99%

A systems and control perspective of CPS security

Dibaji

Pirani

Flamholz

et al. 2019

Annual Reviews in Control

404

191

View full text Add to dashboard Cite

show abstract

“…is maintained at 0 by node i. 9 2) The valuesz (j) il [k] are sorted from largest to smallest; subsequently, the largest f and the smallest f of such values are discarded (i.e., 2f values are discarded in all) andẑ…”

Section: Secure State Estimation Over Time-varying Networkmentioning

confidence: 99%

Secure Distributed State Estimation of an LTI System Over Time-Varying Networks and Analog Erasure Channels

Mitra¹,

Sundaram²

2018

2018 Annual American Control Conference (ACC)

View full text Add to dashboard Cite

We study the problem of collaboratively estimating the state of an LTI system monitored by a network of sensors, subject to the following important practical considerations: (i) certain sensors might be arbitrarily compromised by an adversary and (ii) the underlying communication graph governing the flow of information across sensors might be time-varying. We first analyze a scenario involving intermittent communication losses that preserve certain information flow patterns over bounded intervals of time. By equipping the sensors with adequate memory, we show that one can obtain a fully distributed, provably correct state estimation algorithm that accounts for arbitrary adversarial behavior, provided certain conditions are met by the network topology. We then argue that our approach can handle bounded communication delays as well. Next, we explore a case where each communication link stochastically drops packets based on an analog erasure channel model. For this setup, we propose state estimate update and information exchange rules, along with conditions on the network topology and packet drop probabilities, that guarantee mean-square stability despite arbitrary adversarial attacks.

show abstract

“…Real-world instances of security breaches in CPS, that were discovered and made public, include the revenge sewage attack in Maroochy Shire, Australia; the Ukraine power grid cyber-attack; the German steel mill cyber-attack; the Davis-Besse nuclear power plant attack in Ohio, USA; and the Iranian uranium-enrichment facility attack via the Stuxnet malware [6]. Studying and preventing such security breaches via control-theoretic methods has received a great deal of attention in recent years [7]- [24].…”

Section: Introductionmentioning

confidence: 99%

Learning-Based Attacks in Cyber-Physical Systems

Khojasteh

Khina

Franceschetti

et al. 2021

IEEE Trans. Control Netw. Syst.

View full text Add to dashboard Cite

We introduce the problem of learning-based attacks in a simple abstraction of cyber-physical systems-the case of a discrete-time, linear, time-invariant plant that may be subject to an attack that overrides the sensor readings and the controller actions. The attacker attempts to learn the dynamics of the plant and subsequently overrides the controller's actuation signal, to destroy the plant without being detected. The attacker can feed fictitious sensor readings to the controller using its estimate of the plant dynamics and mimic the legitimate plant operation. The controller, on the other hand, is constantly on the lookout for an attack; once the controller detects an attack, it immediately shuts the plant off. In the case of scalar plants, we derive an upper bound on the attacker's deception probability for any measurable control policy when the attacker uses an arbitrary learning algorithm to estimate the system dynamics. We then derive lower bounds for the attacker's deception probability for both scalar and vector plants by assuming an authentication test that inspects the empirical variance of the system disturbance. We also show how the controller can improve the security of the system by superimposing a carefully crafted privacy-enhancing signal on top of the "nominal control policy." Finally, for nonlinear scalar dynamics that belong to the Reproducing Kernel Hilbert Space (RKHS), we investigate the performance of attacks based on nonlinear Gaussian-processes (GP) learning algorithms.

show abstract

Data-injection attacks in stochastic control systems: Detectability and performance tradeoffs

Cited by 203 publications

References 34 publications

A systems and control perspective of CPS security

A systems and control perspective of CPS security

Secure Distributed State Estimation of an LTI System Over Time-Varying Networks and Analog Erasure Channels

Learning-Based Attacks in Cyber-Physical Systems

Contact Info

Product

Resources

About