On Reachable Sets of Hidden CPS Sensor Attacks

Murguia, Carlos; Ruths, Justin

doi:10.23919/acc.2018.8431582

Cited by 31 publications

(62 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To illustrate the trade-off between the rate of false alarms and attack capability, we provide a comparison of each of the detection algorithms using a 2 dimensional model from [11]: with the addition of a watermark with covariance Σ e = 10 −2 I. Thresholds for the false alarm rates between 0.01 Fig. 2.…”

Section: A Simulation-based Comparison Of Attack Capabilitymentioning

confidence: 99%

Simulation and Real-World Evaluation of Attack Detection Schemes

Porter

Joshi

Hespanho

et al. 2019

2019 American Control Conference (ACC)

View full text Add to dashboard Cite

A variety of anomaly detection schemes have been proposed to detect malicious attacks to Cyber-Physical Systems. Among these schemes, Dynamic Watermarking methods have been proven highly effective at detecting a wide range of attacks. Unfortunately, in contrast to other anomaly detectors, no method has been presented to design a Dynamic Watermarking detector to achieve a user-specified false alarm rate, or subsequently evaluate the capabilities of an attacker under such a selection. This paper describes methods to measure the capability of an attacker, to numerically approximate this metric, and to design a Dynamic Watermarking detector that can achieve a user-specified rate of false alarms. The performance of the Dynamic Watermarking detector is compared to three classical anomaly detectors in simulation and on a real-world platform. These experiments illustrate that the attack capability under the Dynamic Watermarking detector is comparable to those of classic anomaly detectors. Importantly, these experiments also make clear that the Dynamic Watermarking detector is consistently able to detect attacks that the other class of detectors are unable to identify.

show abstract

Section: A Simulation-based Comparison Of Attack Capabilitymentioning

confidence: 99%

Simulation and Real-World Evaluation of Attack Detection Schemes

Porter

Joshi

Hespanho

et al. 2019

2019 American Control Conference (ACC)

View full text Add to dashboard Cite

show abstract

“…The first, based on Linear Matrix Inequalities (LMIs), constructs a convex optimization problem, the solution of which is the ellipsoid that bounds the states driven by attacks. This approach provides more conservative estimates of the reachable set, but allows for the opportunity to simultaneously design system components, such as estimator and controller gain matrices, to reduce the size of the reachable set (see, e.g., [10], [15]). The second approach provides extremely tight bounds for the reachable set through the use of geometric ellipsoidal methods.…”

Section: Reachable Set Boundsmentioning

confidence: 99%

“…Because the state equation depends on the estimation error, in general, we must first identify the reachable estimation error due to noise and due to attack. Interestingly, the noise equations (15) and (17) have a special symmetry due to the zero initial conditions, i.e., x v 1 = e v 1 = 0. By writing out e v k and x v k for each k = 1, 2, .…”

Section: Reachable Set Boundsmentioning

confidence: 99%

A Comparison of Stealthy Sensor Attacks on Control Systems

Hashemi

Murguia

Ruths

2018

2018 Annual American Control Conference (ACC)

Self Cite

View full text Add to dashboard Cite

As more attention is paid to security in the context of control systems and as attacks occur to real control systems throughout the world, it has become clear that some of the most nefarious attacks are those that evade detection. The term stealthy has come to encompass a variety of techniques that attackers can employ to avoid detection. Here we show how the states of the system (in particular, the reachable set corresponding to the attack) can be manipulated under two important types of stealthy attacks. We employ the chi-squared fault detection method and demonstrate how this imposes a constraint on the attack sequence either to generate no alarms (zero-alarm attack) or to generate alarms at a rate indistinguishable from normal operation (hidden attack).

show abstract

“…To assess feasibility of our framework, we study its applicability to Linear Time-Invariant (LTI) systems, a standard physical modelling framework commonly used in process control. We adapt existing reachability analysis tools [10] to compute the suspicion metric. We alleviate the computational cost of performing real-time reachability analysis by computing symbolic reachable sets of system states offline [11].…”

Section: Introductionmentioning

confidence: 99%

Grounds for Suspicion: Physics-Based Early Warnings for Stealthy Attacks on Industrial Control Systems

Azzam

Pasquale

Provan

et al. 2022

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Stealthy attacks on Industrial Control Systems can cause significant damage while evading detection. In this paper, instead of focusing on the detection of stealthy attacks, we aim to provide early warnings to operators, in order to avoid physical damage and preserve in advance data that may serve as an evidence during an investigation. We propose a framework to provide grounds for suspicion, i.e. preliminary indicators reflecting the likelihood of success of a stealthy attack. We propose two grounds for suspicion based on the behaviour of the physical process: (i) feasibility of a stealthy attack, and (ii) proximity to unsafe operating regions. We propose a metric to measure grounds for suspicion in real-time and provide soundness principles to ensure that such a metric is consistent with the grounds for suspicion. We apply our framework to Linear Time-Invariant (LTI) systems and formulate the suspicion metric computation as a real-time reachability problem. We validate our framework on a case study involving the benchmark Tennessee-Eastman process. We show through numerical simulation that we can provide early warnings well before a potential stealthy attack can cause damage, while incurring minimal load on the network. Finally, we apply our framework on a use case to illustrate its usefulness in supporting early evidence collection.

show abstract

On Reachable Sets of Hidden CPS Sensor Attacks

Cited by 31 publications

References 20 publications

Simulation and Real-World Evaluation of Attack Detection Schemes

Simulation and Real-World Evaluation of Attack Detection Schemes

A Comparison of Stealthy Sensor Attacks on Control Systems

Grounds for Suspicion: Physics-Based Early Warnings for Stealthy Attacks on Industrial Control Systems

Contact Info

Product

Resources

About