A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Control Theory <s> Security of Cyber-Physical Systems (CPS) against cyber attacks is an important yet challenging problem. Since most cyber attacks happen in erratic ways, it is difficult to describe them systematically. In this paper, instead of identifying a specific cyber attack model, we are focused on analyzing the system's response during cyber attacks. Deception attacks (or false data injection attacks), which are performed by tampering with system components or data, are not of particular concern if they can be easily detected by the system's monitoring system. However, intelligent cyber attackers can avoid being detected by the monitoring system by carefully design cyber attacks. Our main objective is to investigate the performance of such stealthy deception attacks from the system's perspective. We investigate three kinds of stealthy deception attacks according to the attacker's ability to compromise the system. Based on the information about the dynamics of the system and existing hypothesis testing algorithms, we derive the necessary and sufficient conditions under which the attacker could perform each kind of attack without being detected. In the end, we illustrate the threat of these cyber attacks using an Unmanned Aerial Vehicle (UAV) navigation example. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Control Theory <s> Consider a scalar linear time-invariant system whose state is being estimated by an estimator using measurements from a single sensor. The sensor may be compromised by an attacker. The attacker is allowed to replace the measurement sequence by an arbitrary sequence. When the estimator uses this sequence, its estimate is degraded in the sense that the mean square error of this estimate is higher. The estimator monitors the received data to detect if an attack is in progress. The aim of the attacker is to degrade the estimate to the maximal possible amount while remaining undetected. By defining a suitable notion of stealthiness of the attacker, we characterize the trade-off between the fundamental limits of performance degradation that an attacker can induce versus its level of stealthiness. For various information patterns that characterize the information available at every time step to the attacker, we provide information theoretic bounds on the worst mean squared error of the state estimate that is possible and provide attacks that can achieve these bounds while allowing the attacker to remain stealthy even if the estimator uses arbitrary statistical ergodicity based tests on the received data. <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Control Theory <s> This paper considers a method of coding the sensor outputs in order to detect stealthy false data injection attacks. An intelligent attacker can design a sequence of data injection to sensors that pass the state estimator and statistical fault detector, based on knowledge of the system parameters. To stay undetected, the injected data should increase the state estimation errors while keep the estimation residues in a small range.We employ a coding matrix to the original sensor outputs to increase the estimation residues, such that the alarm will be triggered by the detector even under intelligent data injection attacks. This is a low cost method compared with encryption over sensor communication networks. We prove the conditions the coding matrix should satisfy under the assumption that the attacker does not know the coding matrix yet. An iterative optimization algorithm is developed to compute a feasible coding matrix, and, we show that in general, multiple feasible coding matrices exist. <s> BIB003 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Control Theory <s> Ensuring security of systems based on supervisory control and data acquisition is a major challenge. The goal of this paper is to develop the model-based techniques capable of detecting integrity attacks on the sensors of a control system. In this paper, the effect of integrity attacks on the control systems is analyzed and countermeasures capable of exposing such attacks are proposed. The main contributions of this paper, beyond the novelty of the problem formulation, lies in enumerating the conditions of the feasibility of the replay attack, and suggesting countermeasures that optimize the probability of detection by conceding control performance. The methodologies are shown and the theoretical results are validated using several sets of simulations. <s> BIB004 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Control Theory <s> This work proposes a novel metric to characterize the resilience of stochastic cyber-physical systems to attacks and faults. We consider a single-input single-output plant regulated by a control law based on the estimate of a Kalman filter. We allow for the presence of an attacker able to hijack and replace the control signal. The objective of the attacker is to maximize the estimation error of the Kalman filter - which in turn quantifies the degradation of the control performance - by tampering with the control input, while remaining undetected. We introduce a notion of e-stealthiness to quantify the difficulty to detect an attack when an arbitrary detection algorithm is implemented by the controller. For a desired value of e-stealthiness, we quantify the largest estimation error that an attacker can induce, and we analytically characterize an optimal attack strategy. Because our bounds are independent of the detection mechanism implemented by the controller, our information-theoretic analysis characterizes fundamental security limitations of stochastic cyber-physical systems. <s> BIB005 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Control Theory <s> With the development of cyber-physical systems (CPSs), the security becomes an important and challenging problem. Attackers can launch various attacks to destroy the control system performance. In this paper, a class of linear discrete-time time-invariant control systems is considered, which is open-loop critically stable and only has one critical eigenvalue. By including the output tracking error as an additional state, a Kalman filter-based augmented state feedback control strategy is designed to solve its output tracking problem. Then a stealthy false data attack is injected into the measurement output, which can completely destroy the output tracking control systems without being detected. Simulation results on a numerical example show that the proposed false data injection attack is effective. <s> BIB006 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Control Theory <s> We consider the problem of estimating the state of a noisy linear dynamical system when an unknown subset of sensors is arbitrarily corrupted by an adversary. We propose a secure state estimation algorithm, and derive (optimal) bounds on the achievable state estimation error given an upper bound on the number of attacked sensors. The proposed state estimator involves Kalman filters operating over subsets of sensors to search for a sensor subset which is reliable for state estimation. To further improve the subset search time, we propose Satisfiability Modulo Theory-based techniques to exploit the combinatorial nature of searching over sensor subsets. Finally, as a result of independent interest, we give a coding theoretic view of attack detection and state estimation against sensor attacks in a noiseless dynamical system. <s> BIB007 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Control Theory <s> In the context of sensor attacks on linear time-invariant cyber-physical systems, we propose a model-based cumulative sum (CUSUM) procedure for identifying falsified sensor measurements. To fulfill a desired detection performance-given the system dynamics, control and estimation schemes, and noise statistics-we derive tools for designing and tuning the CUSUM procedure. We characterize the state degradation that a stealthy attacker can induce to the system while remaining undetected by the detection procedure. Moreover, we quantify the advantage of using a dynamic detector (CUSUM), which leverages the history of the state, over a static detector (Bad-Data) which uses a single measurement at a time. Simulation experiments are presented to illustrate the performance of the detection scheme. <s> BIB008
There is a significant body of work in attack detection from the control theory community BIB002 BIB005 BIB006 BIB001 BIB003 , which does not focus on a specific domain. While the treatment of the topic is highly mathematical (a recent special issue of the IEEE Control Systems Magazine provides an accessible introduction to the topic  ), we attempt to extract the intuition behind key approaches to see if they can be useful for the computer security community. Most control theory papers we reviewed look at models of the physical system satisfying Equation (2), because that model has proven to be very powerful for most practical purposes. In addition, several of these papers assumed a stateless detection. We think this bias towards the stateless test by the control theory community stems from the fact that the stateless test allows researchers to prove theorems and derive clean mathematical results. In contrast, providing such thorough theoretical analysis for stateful tests (e.g., CUSUM) can become intractable for realistic systems. We believe that this focus on strong analytical results prevents the use of stateful tests that effectively perform better in many practical cases. Most of the stateful approaches that can be found in control theory papers focus on windowed χ 2 BIB004 , and combinatorial optimization approaches BIB007 . For instance, Murguia et al. BIB008 have proposed an extensive analysis of the non-parametric CUSUM to guarantee an adequate tuning that depends on the system dynamics and its stochastic properties. In addition to these trends, we identified several novel ideas from the control theory community; we summarize them below as (1) secure state estimation, (2) zero-dynamics attacks, (3) combined cyber and physical attacks, (4) active monitoring, and (5) energy-based methods.