A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> State Estimation <s> Geared primarily to an audience consisting of mathematically advanced undergraduate or beginning graduate students, this text may additionally be used by engineering students interested in a rigorous, proof-oriented systems course that goes beyond the classical frequency-domain material and more applied courses. The minimal mathematical background required is a working knowledge of linear algebra and differential equations. The book covers what constitutes the common core of control theory and is unique in its emphasis on foundational aspects. While covering a wide range of topics written in a standard theorem/proof style, it also develops the necessary techniques from scratch. In this second edition, new chapters and sections have been added, dealing with time optimal control of linear systems, variational and numerical approaches to nonlinear control, nonlinear controllability via Lie-algebraic methods, and controllability of recurrent nets and of linear systems with bounded controls. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> State Estimation <s> In 1960, R.E. Kalman published his famous paper describing a recursive solution to the discrete-data linear filtering problem. Since that time, due in large part to advances in digital computing, the Kalman filter has been the subject of extensive research and application, particularly in the area of autonomous or assisted navigation. The Kalman filter is a set of mathematical equations that provides an efficient computational (recursive) means to estimate the state of a process, in a way that minimizes the mean of the squared error. The filter is very powerful in several aspects: it supports estimations of past, present, and even future states, and it can do so even when the precise nature of the modeled system is unknown. The purpose of this paper is to provide a practical introduction to the discrete Kalman filter. This introduction includes a description and some discussion of the basic discrete Kalman filter, a derivation, description and some discussion of the extended Kalman filter, and a relatively simple (tangible) example with real numbers & results. <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> State Estimation <s> A power grid is a complex system connecting electric power generators to consumers through power transmission and distribution networks across a large geographical area. System monitoring is necessary to ensure the reliable operation of power grids, and state estimation is used in system monitoring to best estimate the power grid state through analysis of meter measurements and power system models. Various techniques have been developed to detect and identify bad measurements, including interacting bad measurements introduced by arbitrary, nonrandom causes. At first glance, it seems that these techniques can also defeat malicious measurements injected by attackers. In this article, we expose an unknown vulnerability of existing bad measurement detection algorithms by presenting and analyzing a new class of attacks, called false data injection attacks, against state estimation in electric power grids. Under the assumption that the attacker can access the current power system configuration information and manipulate the measurements of meters at physically protected locations such as substations, such attacks can introduce arbitrary errors into certain state variables without being detected by existing algorithms. Moreover, we look at two scenarios, where the attacker is either constrained to specific meters or limited in the resources required to compromise meters. We show that the attacker can systematically and efficiently construct attack vectors in both scenarios to change the results of state estimation in arbitrary ways. We also extend these attacks to generalized false data injection attacks, which can further increase the impact by exploiting measurement errors typically tolerated in state estimation. We demonstrate the success of these attacks through simulation using IEEE test systems, and also discuss the practicality of these attacks and the real-world constraints that limit their effectiveness. <s> BIB003 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> State Estimation <s> The new culture of networked systems that offer everywhere accessible services has given rise to various types of security tradeoffs. In fact, with the evolution of physical systems that keep getting integrated with cyber frameworks, cyber threats have far more critical effects as they get reflected on the physical environment. As a result, the issue of security of cyber physical systems requires a special holistic treatment. In this paper, we study the tradeoff between security, safety, and availability in such systems and demonstrate these concepts on implantable medical devices as a case study. We discuss the challenges and constraints associated with securing such systems and focus on the tradeoff between security measures required for blocking unauthorized access to the device and the safety of the patient in emergency situations where such measures must be dropped to allow access. We analyze the up to date proposed solutions and discuss their strengths and limitations. <s> BIB004
Before we start our survey, we also need some preliminaries in what state estimation is. Whenever the sensor measurements y k do not observe all the variables of interest from the physical process, we can use state estimation to obtain an estimatex k of the real state of the system x k at time k (if we have a model of the system). Recall Equation BIB004 gives us the relationship between the observed sensor measurements y k and the hidden state x k . The naive approach would assume the noise e k is zero and then solve for x k : x k = C −1 (y k − Du k ); however, for most practical cases this is not possible as the matrix C is not invertible, and we need to account for the variance of the noise. The exact solution for this case goes beyond the scope of this article, but readers interested in finding out how to estimate the state of a dynamical system are encouraged to read about Luenberger observers BIB001 and the Kalman filter BIB002 , which are used to dynamically estimate the system's states without or with noise, respectively. State estimates can then be used for the control logic, for prediction (and therefore for bad data detection), and for safety checks, as in Figure 8 . Fig. 8 . Whenever the sensor measurements y k do not observe all the variables of interest from the physical process, we can use state estimation to obtain an estimatex k of the real state of the system x k at time k (if we have a model of the system). State estimates can then be used for the control logic, for prediction (and therefore for bad data detection), and for safety checks. In addition to the literature on state estimation in the power grid BIB003 , there has been work studying the role of state estimation for the security of other cyber-physical systems. For example, Chong et al. introduce secure state estimation for a generic control system described in Equation (2) where stateful detection strategies are used to search for a subset of sensors that are not under attack to generate accurate estimations. This approach started a novel line of research that helps to mitigate the impact of attacks for those cases where estimation is a fundamental part of the control and decision making (e.g., observer based control).