Security analysis of control system anomaly detectors

Abstract

Anomaly detectors in control systems are used to detect system faults and they are typically based on an analytical system model, which generates residual signals to find a fault. The detectors are designed to detect randomly occurring faults but not coordinated malicious attacks on the system. Therefore three different anomaly detectors, namely a detector solely based on the last residual, a multivariate exponentially weighted moving average filter and a cumulative sum, are investigated to determine which detector yields the smallest worst-case impact of a time-limited data injection attack. For this reason optimal control problems are formulated to characterize the worst-case attack under different anomaly detectors, which lead to non-convex optimization problems. Relaxations to convex problems are proposed and solved numerically and in special cases also analytically. The detectors are compared by solving the optimal control problems for a simple simulation example as well as a quadruple-tank process. Simulations and experiments show that the cumulative sum seems to be the detector to choose, if one wants to limit the worst-case attack impact. AbstractAnomalidetektorer i styrsystem används normalt för att detektera systemfel och deär oftast baserade på en analytisk systemmodell vilken genererar residualsignaler för att upptäcka felen. Detektorernaär oftast konstruerade för att upptäcka slumpmässigt förekommande fel och inte samordnade angrepp på systemet. Därför utvärderas här tre olika anomalidetektorer: en detektor som enbart grundar sig på den senaste residualen, en somär baserad på multivariat exponentiellt viktat glidande medelärde och en kumulativ summa. I utvärderingen undersöker vi vilken detektor som mest begränsar en attack i form av en datainjektion. Av denna anledning formuleras optimala styrproblem för att karakterisera den värsta attacken för de olika anomalidetektorerna, vilket leder till ickekonvexa optimeringsproblem. Relaxeringar till konvexa problem föreslås och löses numeriskt och i särskilda falläven analytiskt. Detektorerna jämförs genom att lösa de optimala styrproblem för ett simuleringsexempel såväl som för en riktig fyrtanksprocess. Både simuleringar och experiment visar att den kumulativa summanär den detektor som begränsar de studerade attackerna mest.

Estimating the Impact of Cyber-Attack Strategies for Stochastic Networked Control Systems

“…Theorem 1 represents an interesting extension of the work on deterministic systems [19], which used the infinity norm based metric (8).…”

“…In these studies, the reachable sets were predominantly used to characterize the impact, and algorithms for calculating upper and lower bounds of these sets were proposed in several works [8]- [10]. Other types of detectors have also been considered [14]- [19]. For example, Cárdenas et al considered a cumulative sum (CUSUM) detector, and investigated the impact of several attack strategies that remain undetected by this detector [14].…”

“…Exceptions do exist, however. For example, in [19], the authors introduced the infinity norm of critical states to quantify the impact under the CUSUM detector. They showed that the exact value of impact can be obtained by solving a set of convex problems.…”

“…Firstly, we propose a unified framework for quantifying the impact of cyber-attack strategies for stochastic control systems. The framework covers both advanced injection strategies such as false data injection (FDI) [8], [19] and bias injection [17], [22], but also simpler strategies such as denial of service (DoS) [6], [23], replay [24], rerouting [25], [26], and sign alternation attacks [12]. Additionally, Kullback-Leibler (KL) divergence [27] is used to define a stealthiness constraint, which makes the framework independent of the choice of anomaly detector.…”

Set-theoretic detection of data corruption attacks on cyber physical power systems

“…The design of stealthy adversaries was addressed in [10] and attack detectors in the form of network monitors were proposed in [11,12]. Residual-based state estimators are by far the most common way of detecting attacks on networked systems as it is shown in [13,14]. These detectors rely on the value of the estimation residue in order to decide whether or not the system is under attack.…”