Detection and mitigation of classes of attacks in supervisory control systems

Abstract

The deployment of control systems with network-connected components has made feedback control systems vulnerable to attacks over the network. This paper considers the problem of intrusion detection and mitigation in supervisory control systems, where the attacker has the ability to enable or disable vulnerable actuator commands and erase or insert vulnerable sensor readings. We present a mathematical model for the system under certain classes of actuator enablement attacks, sensor erasure attacks, or sensor insertion attacks. We then propose a defense strategy that aims to detect such attacks online and disables all controllable events after an attack is detected. We develop an algorithmic procedure for verifying whether the system can prevent damage from the attacks considered with the proposed defense strategy, where damage is modeled as the reachability of a pre-defined set of unsafe system states. The technical condition of interest that is necessary and sufficient in this context, termed "GF-safe controllability", is characterized. We show that the verification of GF-safe controllability can be performed using diagnoser or verifier automata. Finally, we illustrate the methodology with a traffic control system example. (Yi-Chin Wu), kwong@control.utoronto.ca (Raymond Kwong), Plant Supervisor Actuators Sensors Fig. 1. The closed-loop control system architectureWe consider event-driven supervisory control systems where the plant is abstracted as a discrete event system. The supervisor monitors the plant behavior through the events generated by the sensors and it dynamically issues enable/disable actuator commands in order to enforce a given specification.We study the problem of intrusion detection and mitigation for control systems under four classes of attacks: Actuator Enablement attacks (AE-attacks), Actuator Disablement attacks (AD-attacks), Sensor Erasure attacks (SE-attacks) and Sensor Insertion attacks (SI-attacks). Specifically, in an at-stephane@umich.edu (Stéphane Lafortune).

Towards Bounded Synthesis of Resilient Supervisors

“…Intuitively, the attacker determines at state y the set of enabled compromised controllable events to be η(y). For each σ ∈ Σ a , we write σ = (σ [1], σ [2]).…”

“…We write δ (q,σ )! to mean δ (q,σ ) is defined 2. For example, if σ ∈ Σ 1 \Σ 2 and δ 1 (q 1 ,σ ) is undefined, we treat δ (q,σ ) as undefined.…”

Towards resilient supervisors against sensor deception attacks

“…We study the problem of synthesis of a supervisor that guarantees a safe controlled behavior even in the presence of an attacker with the previously described deceptive capabilities. In other words, the goal is to synthesize a supervisor that In this work, we use an approach similar to that in [2], [7]. The conceptual diagram of sensor deception attacks, as shown in Figure 2, is transformed into an attacked controlled system, which is constructed based on the original controlled system and attacker assumptions.…”

“…Inspired by the technique used in [2], the model G a defined in Section III becomes the system at the center of our study. Since the attacked plant G a captures the behavior of plant G under a sensor deception attack over Σ a , our solution technique poses a supervisory control problem directly at the attacked plant G a .…”

“…Prior work on sensor deception attacks in the field of Discrete Event Systems (DES) mainly focuses on designing attack strategies for fixed supervisors [9], [13], [10], [11] or focuses on designing intrusion detection modules for fixed supervisors [2], [7]. Exceptions to that are the works in [16], [13].…”