Robustness of attack-resilient state estimators

Abstract

The interaction between information technology and physical world makes Cyber-Physical Systems (CPS) vulnerable to malicious attacks beyond the standard cyber attacks. This has motivated the need for attack-resilient state estimation. Yet, the existing state-estimators are based on the non-realistic assumption that the exact system model is known. Consequently, in this work we present a method for state estimation in presence of attacks, for systems with noise and modeling errors. When the the estimated states are used by a state-based feedback controller, we show that the attacker cannot destabilize the system by exploiting the difference between the model used for the state estimation and the real physical dynamics of the system. Furthermore, we describe how implementation issues such as jitter, latency and synchronization errors can be mapped into parameters of the state estimation procedure that describe modeling errors, and provide a bound on the state-estimation error caused by modeling errors. This enables mapping control performance requirements into real-time (i.e., timing related) specifications imposed on * This material is based on research sponsored by DARPA under agreement number FA8750-12-2-0247. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation thereon. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of DARPA or the U.S. Government.

Attack-resilient state estimation in the presence of noise

“…Therefore, for the general form of LTI systems (2), the state-estimation problem can be mapped into the state estimation for systems from (1), where control inputs are discarded. In addition, as shown in [15], the bounds on the size of measurement noise in (2) can be related to the bounds on the size of process and measurement noise vectors, v p and v m .…”

“…For instance, in this case the point (x 0 ,ẽ * ) might not even be feasible. Thus, as we showed in [15], attack-resilient state estimation can be performed by solving the following problem that allows for the noise allowance…”

“…For noiseless systems, the state can be obtained as the minimization argument of the following optimization problem [9], [15] …”

“…To the best of our knowledge, the first work on this topic was [15] where we introduced an l 0 -based attack-resilient state estimator for systems with bounded noise, which can be formulated as a Mixed-Integer Linear Program (MILP). We also showed its robustness to noise and modeling errors, and provided a complex designtime procedure to bound the worst-case state estimation error in the presence of sensor attacks.…”

Design methodologies for securing cyber-physical systems

“…For instance, in [37], we introduced a method for attack-resilient state estimation for systems with modeling errors and illustrated its use on a real-world case study -design of attack-resilient cruise control on an unmanned ground robot ( Figure 5(a)). To obtain the state of a controlled physical process when the attacker compromises system sensors and actuators, we introduced an Integer Programming (IP) based procedure that utilizes a window of previous sensor measurement vectors and (limited) knowledge of the system's dynamics.…”