A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> Geared primarily to an audience consisting of mathematically advanced undergraduate or beginning graduate students, this text may additionally be used by engineering students interested in a rigorous, proof-oriented systems course that goes beyond the classical frequency-domain material and more applied courses. The minimal mathematical background required is a working knowledge of linear algebra and differential equations. The book covers what constitutes the common core of control theory and is unique in its emphasis on foundational aspects. While covering a wide range of topics written in a standard theorem/proof style, it also develops the necessary techniques from scratch. In this second edition, new chapters and sections have been added, dealing with time optimal control of linear systems, variational and numerical approaches to nonlinear control, nonlinear controllability via Lie-algebraic methods, and controllability of recurrent nets and of linear systems with bounded controls. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> Abstract The use of communication networks for the transmission of control system signals (measurements and actuation) is becoming more widespread. If the communication (or the sensors and actuators themselves) can be modified by a malicious agent then the control of the physical plant can be covertly appropriated. A parameterised decoupling structure is introduced which allows the covert agent a wide range of control actions on the physical plant while remaining undetectable from the point of view of the original networked controller. The designer of the covert agent need only have a model of the physical plant; knowledge of the networked controller is not required. A MIMO process control example (based on the control of irrigation canals) is used to illustrate the concepts. <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> Cyber-secure networked control is modeled, analyzed, and experimentally illustrated in this paper. An attack space defined by the adversary's system knowledge, disclosure, and disruption resources is introduced. Adversaries constrained by these resources are modeled for a networked control system architecture. It is shown that attack scenarios corresponding to replay, zero dynamics, and bias injection attacks can be analyzed using this framework. An experimental setup based on a quadruple-tank process controlled over a wireless network is used to illustrate the attack scenarios, their consequences, and potential counter-measures. <s> BIB003 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> In this paper the problem of revealing stealthy data-injection attacks on control systems is addressed. In particular we consider the scenario where the attacker performs zero-dynamics attacks on the system. First, we characterize and analyze the stealthiness properties of these attacks for linear time-invariant systems. Then we tackle the problem of detecting such attacks by modifying the system's structure. Our results provide necessary and sufficient conditions that the modifications should satisfy in order to detect the zero-dynamics attacks. The results and proposed detection methods are illustrated through numerical examples. <s> BIB004 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> Cyber-physical systems integrate computation, communication, and physical capabilities to interact with the physical world and humans. Besides failures of components, cyber-physical systems are prone to malignant attacks, and specific analysis tools as well as monitoring mechanisms need to be developed to enforce system security and reliability. This paper proposes a unified framework to analyze the resilience of cyber-physical systems against attacks cast by an omniscient adversary. We model cyber-physical systems as linear descriptor systems, and attacks as exogenous unknown inputs. Despite its simplicity, our model captures various real-world cyber-physical systems, and it includes and generalizes many prototypical attacks, including stealth, (dynamic) false-data injection and replay attacks. First, we characterize fundamental limitations of static, dynamic, and active monitors for attack detection and identification. Second, we provide constructive algebraic conditions to cast undetectable and unidentifiable attacks. Third, by using the system interconnection structure, we describe graph-theoretic conditions for the existence of undetectable and unidentifiable attacks. Finally, we validate our findings through some illustrative examples with different cyber-physical systems, such as a municipal water supply network and two electrical power grids. <s> BIB005 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> This brief aims to perform security threat assessment of networked control systems with regulatory and supervisory control layers. We analyze the performance of a proportional-integral controller (regulatory layer) and a model-based diagnostic scheme (supervisory layer) under a class of deception attacks. We adopt a conservative approach by assuming that the attacker has knowledge of: 1) the system dynamics; 2) the parameters of the diagnostic scheme; and 3) the sensor-control signals. The deception attack presented here can enable remote water pilfering from automated canal systems. We also report a field-operational test attack on the Gignac canal system located in Southern France. <s> BIB006 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> This paper investigates the problem of detection and isolation of attacks on a water distribution network comprised of cascaded canal pools. The proposed approach employs a bank of delay-differential observer systems. The observers are based on an analytically approximate model of canal hydrodynamics. Each observer is insensitive to one fault/attack mode and sensitive to other modes. The design of the observers is achieved by using a delay-dependent linear matrix inequality method. The performance of our model-based diagnostic scheme is tested on a class of adversarial scenarios based on a generalized fault/attack model. This model represents both classical sensor-actuator faults and communication network-induced deception attacks. Our particular focus is on stealthy deception attacks in which the attacker's goal is to pilfer water through canal offtakes. Our analysis reveals the benefits of accurate hydrodynamic models in detecting physical faults and cyber attacks to automated canal systems. We also comment on the criticality of sensor measurements for the purpose of detection. Finally, we discuss the knowledge and effort required for a successful deception attack. <s> BIB007 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> We address the problem of state estimation for multi-output continuous-time linear systems, for which an attacker may have control over some of the sensors and inject (potentially unbounded) additive noise into some of the measured outputs. To characterize the resilience of a system against such sensor attacks, we introduce a new notion of observability — termed “observability under attacks” — that addresses the question of whether or not it is possible to uniquely reconstruct the state of the system by observing its inputs and outputs over a period of time, with the understanding that some of the available system's outputs may have been corrupted by the opponent. We provide computationally efficient tests for observability under attacks that amount to testing the (standard) observability for an appropriate finite set of systems. In addition, we propose two state estimation algorithms that permit the state reconstruction in spite of the attacks. One of these algorithms uses observability Gramians and a finite window of measurements to reconstruct the initial state. The second algorithm takes the form of a switched observer that asymptotically converges to the correct state estimate in the absence of additive noise and disturbances, or to a neighborhood of the correct state estimate in the presence of bounded noise and disturbances. <s> BIB008 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> We consider the problem of estimating the state of a noisy linear dynamical system when an unknown subset of sensors is arbitrarily corrupted by an adversary. We propose a secure state estimation algorithm, and derive (optimal) bounds on the achievable state estimation error given an upper bound on the number of attacked sensors. The proposed state estimator involves Kalman filters operating over subsets of sensors to search for a sensor subset which is reliable for state estimation. To further improve the subset search time, we propose Satisfiability Modulo Theory-based techniques to exploit the combinatorial nature of searching over sensor subsets. Finally, as a result of independent interest, we give a coding theoretic view of attack detection and state estimation against sensor attacks in a noiseless dynamical system. <s> BIB009 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> The increasing availability of Internet connectivity and networked actuation and sensing components has supported the growth in control systems operated over public networks. Controllers and plants no longer need to be physically colocated as measurements and actuation signals can be sent digitally. Supervisory systems can monitor and control geographically widespread components. However, such systems are now exposed to the risk of remote interference. A feedback structure that allows an attacker to take over control of the plant while remaining hidden from the control and supervisory system(s) is presented. The objective is not to facilitate such attacks but rather to make clear the degree to which the takeover of plant control can be hidden when a sophisticated attacker has some plant knowledge and signal intervention capabilities. <s> BIB010 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> The new culture of networked systems that offer everywhere accessible services has given rise to various types of security tradeoffs. In fact, with the evolution of physical systems that keep getting integrated with cyber frameworks, cyber threats have far more critical effects as they get reflected on the physical environment. As a result, the issue of security of cyber physical systems requires a special holistic treatment. In this paper, we study the tradeoff between security, safety, and availability in such systems and demonstrate these concepts on implantable medical devices as a case study. We discuss the challenges and constraints associated with securing such systems and focus on the tradeoff between security measures required for blocking unauthorized access to the device and the safety of the patient in emergency situations where such measures must be dropped to allow access. We analyze the up to date proposed solutions and discuss their strengths and limitations. <s> BIB011 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> In this paper, we propose a novel state estimation algorithm that is resilient to sparse data injection attacks and robust to additive and multiplicative modeling errors. By leveraging principles of robust optimization, we construct uncertainty sets that lead to tractable optimization solutions. As a corollary, we obtain a novel robust filtering algorithm when there are no attacks, which can be viewed as a “frequentist” robust estimator as no known priors are assumed. We also describe the use of cross-validation to determine the hyperparameters of our estimator. The effectiveness of our estimator is demonstrated in simulations of an IEEE 14-bus electric power system. <s> BIB012 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Secure State Estimation. <s> We introduce a scalable observer architecture, which can efficiently estimate the states of a discrete-time linear-time-invariant system whose sensors are manipulated by an attacker, and is robust to measurement noise. Given an upper bound on the number of attacked sensors, we build on previous results on necessary and sufficient conditions for state estimation, and propose a novel Multi-Modal Luenberger (MML) observer based on efficient Satisfiability Modulo Theory (SMT) solving. We present two techniques to reduce the complexity of the estimation problem. As a first strategy, instead of a bank of distinct observers, we use a family of filters sharing a single dynamical equation for the states, but different output equations, to generate estimates corresponding to different subsets of sensors. Such an architecture can reduce the memory usage of the observer from an exponential to a linear function of the number of sensors. We then develop an efficient SMT-based decision procedure that is able to reason about the estimates of the MML observer to detect at runtime which sets of sensors are attack-free, and use them to obtain a correct state estimate. Finally, we discuss two optimization-based algorithms that can efficiently select the observer parameters with the goal of minimizing the sensitivity of the estimates with respect to sensor noise. We provide proofs of convergence for our estimation algorithm and report simulation results to compare its runtime performance with alternative techniques. We show that our algorithm scales well for large systems (including up to 5,000 sensors) for which many previously proposed algorithms are not implementable due to excessive memory and time requirements. Finally, we illustrate the effectiveness of our approach, both in terms of resiliency to attacks and robustness to noise, on the design of large-scale power distribution networks. <s> BIB013
One of the main areas of research in the control theory community is to find efficiently the subset of sensors that are sending false information BIB008 BIB013 . Attack Detection: The system models satisfy Equation BIB011 . The main idea behind these papers consists on solving a combinatorial optimization problem to find a subset of sensors whose elements are not under attack, to generate adequate state estimations. When multiple sensors are under attack, this problem is shown to be NP-hard (combinatorial in the number of sensors), so the goal of research papers is to find efficient algorithms under a variety of assumptions. Recently, Shoukry et al. BIB013 proposed a search algorithm based on Satisfiability Modulo Theory (SMT) to speed up the search of possible sensors sets; this research has been extended for systems subject to random noise BIB009 . Attack Location: A subset of sensors can be compromised. In particular, it was found that the total number of sensors used to monitor the process has to be at least twice the number of sensors under attack. From this discussion, we can infer that the authors assumed controller and actuators to be trusted. Another paper considering secure state estimation where the attacks are located in the control signal is done by Yong et al. BIB012 . Validation: The theoretical results are tested using simulations where the accuracy of the estimation and searching times are compared for different searching methods to verify the effectiveness of SMT. These papers are also among the few that discuss the time-to-detect metric and offer solutions trying to minimize it. In our discussion section, we will return to the need to have more papers discussing the time to detect an attack. Zero-dynamics Attacks. These attacks are interesting, because they show that even without compromising sensors, attackers can mislead control systems into thinking they are at a different state. The attacks require the attacker to compromise the actuators, that the anomaly detection system monitors the legitimate control signal u k and the legitimate sensor signal y k , and a plant vulnerable to these attacks. One of the fundamental properties control engineers ask about Equation (2) is whether or not the system is Observable BIB001 . If it is observable, then we know that we can obtain a good state estimatê x k given the history of previous control inputs u k and sensor measurements y k . Most practical systems are observable or are designed to be observable. Now, if we assume an observable system, then we can hypothesize that the only way to fool a system into thinking it is at a false state, is by compromising the sensors and sending false sensor readings. Zero-dynamics attacks are an example that this hypothesis is false BIB005 BIB003 BIB004 . Zero-dynamics attacks require attackers that inject fake signals in sensors or actuators, and modify "hidden" (or unobservable) states. For instance, in Figure 2 the anomaly detector observes a validu k and a valid y k , but it does not observe the compromised v k . Not all systems are vulnerable to these attacks, but certain systems like the quadruple tank process  can be (depending on the specific parameters). Though zero-dynamics attacks are interesting from a theoretical point of view, most practical systems will not be vulnerable to these attacks (although it is always good to check these conditions). First, if the sensors monitor all variables of interest, we will not need to state estimation (although this might not be possible in a large-scale control system with thousands of states); second, even if the system is vulnerable to zero-dynamics attacks, the attacker has to follow a specific control action from which it cannot deviate (so the attacker will have problems achieving a particular goal-e.g., move the system to a particular state), and finally, if the system is minimum phase, the attacker might not be able to destabilize the system. In addition, there are several recommendations on how to design a control system to prevent zero-dynamic attacks BIB004 . Combined Use of Cyber-and Physical Attacks. Control theory papers have also considered the interplay between physical attacks and cyber-attacks. Attack location: In a set of papers by Amin et al. BIB006 BIB007 , the attacker launches physical attacks to the system (physically stealing water from water distribution systems), while at the same time it launches a cyber-attack (compromised sensors send false data masking the effects of the physical attack). We did not consider physical attacks originally, but we then realized that the actuation attacks of Figure 2 account for physical attack, as it is equivalent to the attacker inserting its own actuators, and therefore the real actuation signal v k will be different from the intended control command u k . Attack Detection: Authors focus on LDS models obtained from an exhaustive analysis of hydrodynamic properties. They propose the use of unknown input observers and stateless detection to identify the location of a possible attacks; however, the bottom line is that if the attackers control enough actuation and sensor measurements, there is nothing the detector can do as the compromised sensors can always send false data to make the detector believe the system is in the state the control wanted it to go. These covert attacks have been characterized for linear BIB002 and nonlinear systems BIB010 . Validation: The results are validated in a real water distribution network plant for different case studies.