Stochastic game approach for replay attack detection

Abstract

Abstract-The existing tradeoff between control system performance and the detection rate for replay attacks highlights the need to provide an optimal control policy that balances the security overhead with control cost. We employ a finite horizon, zero-sum, nonstationary stochastic game approach to minimize the worst-case control and detection cost, and obtain an optimal control policy for switching between controlcost optimal (but nonsecure) and secure (but cost-suboptimal) controllers in presence of replay attacks. To formulate the game, we quantify game parameters using knowledge of the system dynamics, controller design and utilized statistical detector. We show that the optimal strategy for the system exists, and present a suboptimal algorithm used to calculate the system's strategy by combining robust game techniques and a finite horizon stationary stochastic game algorithm. Our approach can be generalized for any system with multiple finite cost, time-invariant linear controllers/estimators/intrusion detectors.

Cyber-Resilience Evaluation of Cyber-Physical Systems

“…Hence, resilience is based on a general acceptance that it is virtually impossible to prevent or remediate all categories of risk simultaneously, and before they occur [173]. [65], [34], [66], [67], [68], [69], [70],…”

“…For example, Mo et al [33] propose the use of Kalman filters to detect cyber-physical replay attacks by adapting traditional failure detection mechanisms via watermarking. Miao et al [65] improve the performance of the aforementioned detection mechanism using a stochastic game approach. The work has also been improved by Rubio-Hernan et al [34] to incorporate more advanced adversaries capable of learning the physical model.…”

Detection of Man-in-the-Middle Attacks in Model-Free Reinforcement Learning

“…Two special cases of the MITM attack have been studied extensively. The first case is the replay attack, in which the adversary observes and records the true system behavior for a given time period and then replays this recording periodically at the agent's input Zhu and Martínez, 2014;Miao et al, 2013). The second case is the statistical-duplicate attack, here the adversary is assumed to have perfect knowledge of the system dynamics therefore allowing the adversary to construct arbitrarily long trajectories that are statistically identical to the true system (Smith, 2011;Satchidanandan and Kumar, 2017;Hespanhol et al, 2018).…”

Security analysis and fault detection against stealthy replay attacks

“…Some studies have been done about obtaining suitable conditions and countermeasure of replay attacks by Mo and Sinopoli (2009) and Mo et al (2014) for linear Gaussian systems. To analyse the interchange between control efficiency and system security, some studies were done under a random game frame (Miao et al, 2013). In the case of electric power grids, work was done to inject false data into the system versus state estimation at the remote estimation centre by Liu et al (2009).…”