Limiting the Impact of Stealthy Attacks on Industrial Control Systems

Abstract

While attacks on information systems have for most practical purposes binary outcomes (information was manipulated/eavesdropped, or not), attacks manipulating the sensor or control signals of Industrial Control Systems (ICS) can be tuned by the attacker to cause a continuous spectrum in damages. Attackers that want to remain undetected can attempt to hide their manipulation of the system by following closely the expected behavior of the system, while injecting just enough false information at each time step to achieve their goals. In this work, we study if physics-based attack detection can limit the impact of such stealthy attacks. We start with a comprehensive review of related work on attack detection schemes in the security and control systems community. We then show that many of these works use detection schemes that are not limiting the impact of stealthy attacks. We propose a new metric to measure the impact of stealthy attacks and how they relate to our selection on an upper bound on false alarms. We finally show that the impact of such attacks can be mitigated in several cases by the proper combination and configuration of detection schemes. We demonstrate the e↵ectiveness of our algorithms through simulations and experiments using real ICS testbeds and real ICS systems.

Security analysis of control system anomaly detectors

“…We present and discuss some peculiarities in the attack and residual signals. Furthermore the results obtained in our work are related to the results in [1]. Lastly we conclude our work and suggest some topics for future work.…”

“…Note that the threshold does not depend on the actual threshold J D . Similar results are shown and used to design an attack in [1], when the detector is in steady state.…”

“…Moreover necessary and sufficient conditions for the output-to-output l 2 -gain to be bounded are given, which are closely related to the zero dynamics of the system. Urbina et al [1] present a comprehensive survey on the current literature about security of cyber-physical systems and put them in a unified taxonomy to compare the literature. The taxonomy is based on the system model, a trust model, that states which system components are trusted, the detector used and how the detector's performance is evaluated.…”

“…Hence we have to use a non-parametric CUSUM algorithm. Similar to [1], the non-parametric CUSUM algorithm used here is…”

Multistage Downstream Attack Detection in a Cyber Physical System

“…Majority of work on attack detection has considered a single stage for attack and detection (e.g., see [18]). Here, we evaluate the situation of using multiple detectors throughout the process while carrying out a spoofing attack on only one point.…”