Detection of replay attacks in cyber-physical systems

Hoehn, Andreas; Zhang, Ping

doi:10.1109/acc.2016.7524930

Cited by 76 publications

(36 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In replay attack, the attacker (usually a Man‐In‐The‐Middle) collects real information in the network to retransmit it later. This gives the opportunity to the attacker to disrupt the communication between 2 devices without triggering alerts . In flooding attack, a stream of packets is sent to fill the memory of the target (end device).…”

Section: Experiments and Resultsmentioning

confidence: 99%

“…This gives the opportunity to the attacker to disrupt the communication between 2 devices without triggering alerts. 33 In flooding attack, a stream of packets is sent to fill the memory of the target (end device). An attacker can reduce the delivery success from 80% to 90% to less than 40% if the attacker targets the shared medium with 10 times more than the normal traffic intensity.…”

Section: Online Testing Phasementioning

confidence: 99%

See 1 more Smart Citation

Anomaly behavior analysis for IoT sensors

Pacheco

Hariri

2017

Trans Emerging Tel Tech

View full text Add to dashboard Cite

The Internet of Things (IoT) will not only connect computers and mobile devices but also interconnect smart buildings, homes, and cities, as well as electrical grids, gas, and water networks, automobiles, airplanes, etc. IoT will lead to the development of a wide range of advanced information services that need to be processed in real time and require large storage and computational power. The integration of IoT with fog and cloud computing not only brings the computational requirements but also enables IoT services to be pervasive, cost‐effective, and accessible from anywhere and at anytime. In any IoT application, sensors are indispensable to bring the physical world into the digital world that can be implemented by leveraging fog computing. However, IoT sensors will introduce major security challenges as they contribute to a significant increase in the IoT attack surface. In this paper, we present a methodology to develop an intrusion detection system on the basis of anomaly behavior analysis to detect when a sensor has been compromised and used to provide misinformation. Our preliminary experimental results show that our approach can accurately authenticate sensors on the basis of their behavior and can detect known and unknown sensor attacks with high detection rate and low false alarms.

show abstract

Section: Experiments and Resultsmentioning

confidence: 99%

Section: Online Testing Phasementioning

confidence: 99%

Anomaly behavior analysis for IoT sensors

Pacheco

Hariri

2017

Trans Emerging Tel Tech

View full text Add to dashboard Cite

show abstract

“…The optimal value γ of the robust reformulation (18) is indeed an indication whether the attack still remains stealthy in the dynamic setting, i.e., if γ > 0 then the optimal solutionN yields a diagnosis filter in the form of (14) which detects all the admissible attacks introduced in Definition 2.5. However, if γ = 0, then it implies that for any possible detectors (static or dynamic) there exists a stationary disruptive attack that remains stealthy.…”

Section: Robust Diagnosis Filter: Transient Behaviormentioning

confidence: 99%

“…Numerical results confirm that the proposed filter can successfully detect the DoS attacks. In regard with the replay attack, the articles [22,14] offer sufficient conditions under which plausible attacks may remain stealthy irrespective of the detection mechanism providing that the attacker has access all the necessary data channels and excite attack of stage 2 at a suitable time.…”

Section: 3b Other Types Of Attacksmentioning

confidence: 99%

From Static to Dynamic Anomaly Detection With Application to Power System Cyber Security

Pan

Pálenský

Esfahani

2020

IEEE Trans. Power Syst.

View full text Add to dashboard Cite

Developing advanced diagnosis tools to detect cyber attacks is the key to security of power systems. It has been shown that multivariate data injection attacks can bypass bad data detection schemes typically built on static behavior of the systems, which misleads operators to disruptive decisions. In this article, we depart from the existing static viewpoint to develop a diagnosis filter that captures the dynamics signatures of such a multivariate intrusion. To this end, we introduce a dynamic residual generator approach formulated as robust optimization programs in order to detect a class of disruptive multivariate attacks that potentially remain stealthy in view of a static bad data detector. We investigate two possible desired features: (i) a non-zero transient and (ii) a non-zero steady-state behavior of the residual generator in the presence of an attack. In case (i), the problem is reformulated as a finite, but possibly non-convex, optimization program.We further develop a linear programming relaxation that improves the scalability, and as such practicality, of the diagnosis filter design. In case (ii), it turns out that the resulting robust program admits an exact convex reformulation, yielding a Nash equilibrium between the attacker and the residual generator. This assertion has an interesting implication: the proposed approach is not conservative in the sense that the additional knowledge of the worst-case attack does not improve the diagnosis performance. To illustrate our theoretical results, we implement the proposed diagnosis filter to detect multivariate attacks on the system measurements deployed to generate the so-called Automatic Generation Control signals in a three-area IEEE 39-bus system. P.MohajerinEsfahani}@tudelft.nl).

show abstract

“…Applying some techniques of non-cooperative stochastic games, Miao et al [23] designed a suboptimal switching control policy that balances control performance and the intrusion detection rate for replay attacks. Hoehn and Zhang [24] provided a novel technique via exciting the system in non-regular time intervals and signal processing to detect the replay attack. Other replay attack detection mechanisms have also been proposed in the literature [25].…”

Section: Literature Reviewmentioning

confidence: 99%

An Online Approach to Physical Watermark Design

Liu

Yan

et al. 2020

IEEE Trans. Automat. Contr.

View full text Add to dashboard Cite

This paper considers the problem of designing physical watermark signals in order to optimally detect possible replay attack in a linear time-invariant system, under the assumption that the system parameters are unknown and need to be identified online. We first provide a replay attack model, where an adversary replays the previous sensor data in order to fool the system. A physical watermarking scheme, which leverages a random control input as a watermark to detect the replay attack, is then introduced. The optimal watermark signal design problem is cast as an optimization problem, which aims to achieve the optimal trade-off between control performance and intrusion detection. An online watermarking design and system identification algorithm is provided to deal with systems with unknown parameters. We prove that the proposed algorithm converges to the optimal one and characterize the almost sure convergence rate. A numerical example and an industrial process example are provided to illustrate the effectiveness of the proposed strategy.

show abstract

Detection of replay attacks in cyber-physical systems

Cited by 76 publications

References 9 publications

Anomaly behavior analysis for IoT sensors

Anomaly behavior analysis for IoT sensors

From Static to Dynamic Anomaly Detection With Application to Power System Cyber Security

An Online Approach to Physical Watermark Design

Contact Info

Product

Resources

About