A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> GPS Spoofing. <s> This paper analyzes the effect of replay attacks on a control system. We assume an attacker wishes to disrupt the operation of a control system in steady state. In order to inject an exogenous control input without being detected the attacker will hijack the sensors, observe and record their readings for a certain amount of time and repeat them afterwards while carrying out his attack. This is a very common and natural attack (we have seen numerous times intruders recording and replaying security videos while performing their attack undisturbed) for an attacker who does not know the dynamics of the system but is aware of the fact that the system itself is expected to be in steady state for the duration of the attack. We assume the control system to be a discrete time linear time invariant gaussian system applying an infinite horizon Linear Quadratic Gaussian (LQG) controller. We also assume that the system is equipped with a χ2 failure detector. The main contributions of the paper, beyond the novelty of the problem formulation, consist in 1) providing conditions on the feasibility of the replay attack on the aforementioned system and 2) proposing a countermeasure that guarantees a desired probability of detection (with a fixed false alarm rate) by trading off either detection delay or LQG performance, either by decreasing control accuracy or increasing control effort. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> GPS Spoofing. <s> The theory and practice of unmanned aerial vehicle UAV capture and control via Global Positioning System GPS signal spoofing are analyzed and demonstrated. The goal of this work is to explore UAV vulnerability to deceptive GPS signals. Specifically, this paper 1 establishes the necessary conditions for UAV capture via GPS spoofing, and 2 explores the spoofer's range of possible post-capture control over the UAV. A UAV is considered captured when a spoofer gains the ability to eventually specify the UAV's position and velocity estimates. During post-capture control, the spoofer manipulates the true state of the UAV, potentially resulting in the UAV flying far from its flight plan without raising alarms. Both overt and covert spoofing strategies are considered, as distinguished by the spoofer's attempts to evade detection by the target GPS receiver and by the target navigation system's state estimator, which is presumed to have access to non-GPS navigation sensor data. GPS receiver tracking loops are analyzed and tested to assess the spoofer's capability for covert capture of a mobile target. The coupled dynamics of a UAV and spoofer are analyzed and simulated to explore practical post-capture control scenarios. A field test demonstrates capture and rudimentary control of a rotorcraft UAV, which results in unrecoverable navigation errors that cause the UAV to crash. <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> GPS Spoofing. <s> Ensuring security of systems based on supervisory control and data acquisition is a major challenge. The goal of this paper is to develop the model-based techniques capable of detecting integrity attacks on the sensors of a control system. In this paper, the effect of integrity attacks on the control systems is analyzed and countermeasures capable of exposing such attacks are proposed. The main contributions of this paper, beyond the novelty of the problem formulation, lies in enumerating the conditions of the feasibility of the replay attack, and suggesting countermeasures that optimize the probability of detection by conceding control performance. The methodologies are shown and the theoretical results are validated using several sets of simulations. <s> BIB003 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> GPS Spoofing. <s> The increased prevalence of attacks on Cyber-Physical Systems(CPS) as well as the safety-critical nature of these systems, has resulted in increased concerns regarding the security of CPS. In an effort towards the security of CPS, we consider the detection of attacks based on the fundamental notion of a system's energy. We propose a discrete-time Energy-Based Attack Detection mechanism for networked cyber-physical systems that are dissipative or passive in nature. We present analytical results to show that the detection mechanism is effective in detecting a class of attack models in networked control systems (NCS). Finally, using simulations we illustrate the effectiveness of the proposed approach in detecting attacks. <s> BIB004 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> GPS Spoofing. <s> Cyberphysical systems (CPSs) refer to the embedding of widespread sensing, networking, computation, and control into physical spaces with the goal of making them safer, more efficient, and reliable. Driven by the miniaturization and integration of sensing, communication, and computation in cost-efficient devices, CPSs are bound to transform industries such as aerospace, transportation, built environments, energy, health care, and manufacturing, to name a few. This great opportunity, unfortunately, is matched by even greater challenges. Taming the complexity of design and analysis of these systems poses a fundamental problem as a new paradigm is needed to bridge various scientific domains, which, through the years, have developed significantly different formalisms and methodologies. In addition, while the use of dedicated communication networks has so far sheltered systems from the outside world, use of off-the-shelf networking and computing, combined with the unattended operation of a plethora of devices, provides several opportunities for malicious entities to inject attacks on CPSs. A wide variety of motivations exists for launching an attack on CPSs, ranging from economic reasons, such as obtaining a financial gain, all the way to terrorism, for instance, threatening an entire population by manipulating life-critical resources. Any attack on safety-critical CPSs may significantly hamper the economy and lead to the loss of human lives. While the threat of attacks on CPSs tends to be underplayed at times, the Stuxnet worm provided a clear example of the possible future to come. This malware, targeting a uranium enriching facility in Iran, managed to reach the supervisory control and data acquisition (SCADA) system controlling the centrifuges used in the enrichment process. Stuxnet modified the control system, increasing pressure in the centrifuges in a first version of the worm and spinning centrifuges in an erratic fashion in a second version. As a result, Stuxnet caused significant damage to the plant [1]. For details, see "The Stuxnet Attack." <s> BIB005 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> GPS Spoofing. <s> Embedded sensing systems are pervasively used in life- and security-critical systems such as those found in airplanes, automobiles, and healthcare. Traditional security mechanisms for these sensors focus on data encryption and other post-processing techniques, but the sensors themselves often remain vulnerable to attacks in the physical/analog domain. If an adversary manipulates a physical/analog signal prior to digitization, no amount of digital security mechanisms after the fact can help. Fortunately, nature imposes fundamental constraints on how these analog signals can behave. This work presents PyCRA, a physical challenge-response authentication scheme designed to protect active sensing systems against physical attacks occurring in the analog domain. PyCRA provides secure active sensing by continually challenging the surrounding environment via random but deliberate physical probes. By analyzing the responses to these probes, the system is able to ensure that the underlying physics involved are not violated, providing an authentication mechanism that not only detects malicious attacks but provides resilience against them. We demonstrate the effectiveness of PyCRA in detecting and mitigating attacks through several case studies using two sensing systems: (1) magnetic sensors like those found on gear and wheel speed sensors in robotics and automotive, and (2) commercial Radio Frequency Identification (RFID) tags used in many security-critical applications. In doing so, we evaluate both the robustness and the limitations of the PyCRA security scheme, concluding by outlining practical considerations as well as further applications for the proposed authentication mechanism. <s> BIB006 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> GPS Spoofing. <s> We propose a new way to verify the integrity and freshness of footage from security cameras by sending visual challenges to the area being monitored by the camera. We study the effectiveness of periodically updating plain text and QR code visual challenges, propose attack detection statistics for each of them, and study their performance under normal conditions (without attack) and against a variety of adversaries. Our implementation results show that visual challenges are an effective method to add defense-in-depth mechanisms to improve the trustworthiness of security cameras. <s> BIB007 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> GPS Spoofing. <s> We propose the use of trusted and verified social media feeds as visual challenges to increase our confidence that video footage from public spaces is fresh and authentic. Our work is related to recent advances in a growing area dealing with ways to prove physical statements to a digital (or even human) verifier, where a verifier sends a physical (real-world) challenge to the prover and the prover (usually a sensor) takes measurements of the physical property and submits the response to the verifier. Our proposal can be used to automatically verify the video feed from a (possibly untrusted) camera monitoring a public space. <s> BIB008
Kerns et al. BIB002 consider how Global Positioning System (GPS) spoofing attacks can take control over unmanned aircrafts. Attack Location: The spoofer is able to generate a counterfeit GPS signal and sends it to the GPS antenna of the aircraft. The fake signal is designed to replace the real GPS reading with a fake position. Attack Detection: They use an LDS as a model of the physical system, and then use a stateless residual (also referred to as innovations) test to detect attacks. Validation: They test different attacks through simulation and also by using an aircraft Hornet Mini UAV, which is a mini helicopter of 4.5Kg. They show two attacks, one where the attacker is detected, and another one where the attacker manages to keep all the residuals below the threshold while still changing the position of the aircraft. Active Monitoring. Most physics-based anomaly detection algorithms are passive; i.e., they do not affect the system they are observing. In contrast, active monitoring changes the physical system by sending unpredictable control commands and then verifying that the sensor responds as expected. Attack Detection: The work of Mo et al. BIB001 BIB005 BIB003 considers embedding a watermark in the control signal, by injecting random noise from a known distribution. This is useful for systems that remain constant for long periods of time (if they are in a steady state) and to see if the control action has any effect, the operator needs to send a random signal to the system. They use a timewindow stateful anomaly detection statistic. Attack Location: This approach can detect sensor or actuator attacks. Validation: results are evaluated using simulations and TPR,FPR. The idea of active monitoring has also been proposed in other domains BIB005 BIB006 BIB007 BIB008 , as we will discuss later in the article. Energy-based Attack Detection. Finally, another detection mechanism using control theoretic components was proposed by Eyisi and Koutsoukos BIB004 . Attack detection: The main idea is that the energy properties of a physical system can be used to detect errors or attacks. Unlike observerbased detection (used by the majority of control papers), their work uses concepts of energy or passivity, which is a property of systems that consume but do not produce net energy. In other words, the system is passive if it dissipates more energy than it generates. To use this idea for detecting attacks, the monitor function estimates the supplied energy (by control commands) and compares it to the energy dissipated and the energy stored in the system (which depend on the dynamics of the system). While the idea is novel and unique, it is not clear why this approach might be better than traditional residual-based approaches, in particular given that any attack impersonating a passive device would be undetected, and in addition, the designer needs more information. To construct an energy model, a designer needs access to inputs and outputs, the model of the system in state space (as in Equation (2)), and functions that describe the energy dissipation of a system in function of the stored energy (energy function) and the power supply (supply function). Attack location: It is assumed that sensors are under attack and that the controller and actuator are trusted, but their results can be easily extended to other attack scenarios. Validation: The validation is conducted using simulation results that illustrate the impact of the attack in the system states and how the energy changes can help to indicate whether or not an attack is present.