A journal of IEEE and CAA , publishes high-quality papers in English on original theoretical/experimental research and development in all areas of automation
Volume 10 Issue 4
Apr.  2023

IEEE/CAA Journal of Automatica Sinica

  • JCR Impact Factor: 11.8, Top 4% (SCI Q1)
    CiteScore: 17.6, Top 3% (Q1)
    Google Scholar h5-index: 77, TOP 5
Turn off MathJax
Article Contents
K. K. Zhang, C. Keliris, T. Parisini, B. Jiang, and M. M. Polycarpou, “Passive attack detection for a class of stealthy intermittent integrity attacks,” IEEE/CAA J. Autom. Sinica, vol. 10, no. 4, pp. 898–915, Apr. 2023. doi: 10.1109/JAS.2023.123177
Citation: K. K. Zhang, C. Keliris, T. Parisini, B. Jiang, and M. M. Polycarpou, “Passive attack detection for a class of stealthy intermittent integrity attacks,” IEEE/CAA J. Autom. Sinica, vol. 10, no. 4, pp. 898–915, Apr. 2023. doi: 10.1109/JAS.2023.123177

Passive Attack Detection for a Class of Stealthy Intermittent Integrity Attacks

doi: 10.1109/JAS.2023.123177
Funds:  This work was supported by the European Union’s Horizon 2020 Research and Innovation Programme under the Marie Skodowska-Curie (101027980 (CSP-CPS-A-ICA), 739551 (KIOS CoE-TEAMING)), the Italian Ministry for Research in the Framework of the 2017 Program for Research Projects of National Interest (PRIN) (2017YKXYXJ), the National Natural Science Foundation of China (61903188, 62073165, 62020106003), the Natural Science Foundation of Jiangsu Province (BK20190403), the 111 Project (B20007), and the Priority Academic Program Development of Jiangsu Higher Education Institutions
More Information
  • This paper proposes a passive methodology for detecting a class of stealthy intermittent integrity attacks in cyber-physical systems subject to process disturbances and measurement noise. A stealthy intermittent integrity attack strategy is first proposed by modifying a zero-dynamics attack model. The stealthiness of the generated attacks is rigorously investigated under the condition that the adversary does not know precisely the system state values. In order to help detect such attacks, a backward-in-time detection residual is proposed based on an equivalent quantity of the system state change, due to the attack, at a time prior to the attack occurrence time. A key characteristic of this residual is that its magnitude increases every time a new attack occurs. To estimate this unknown residual, an optimal fixed-point smoother is proposed by minimizing a piece-wise linear quadratic cost function with a set of specifically designed weighting matrices. The smoother design guarantees robustness with respect to process disturbances and measurement noise, and is also able to maintain sensitivity as time progresses to intermittent integrity attack by resetting the covariance matrix based on the weighting matrices. The adaptive threshold is designed based on the estimated backward-in-time residual, and the attack detectability analysis is rigorously investigated to characterize quantitatively the class of attacks that can be detected by the proposed methodology. Finally, a simulation example is used to demonstrate the effectiveness of the developed methodology.

     

  • loading
  • 1 Covariance matrix and mean value are concepts used in Kalman filtering. Since LQ optimal filters have similar form with the Kalman filter, we also use the terminologies “covariance matrix” and “mean value” for the LQ optimal filters.2 Regarding adjoint system of a linear system, the definition can be found in [44].
    2 Regarding adjoint system of a linear system, the definition can be found in [44].
  • [1]
    A. A. Cardenas, S. Amin, and S. Sastry, “Secure control: Towards survivable cyber-physical systems,” in Proc. 28th Int. Conf. Distributed Computing Systems Workshops, Beijing, China, 2008, pp. 495–500.
    [2]
    S. M. Dibaji, M. Pirani, D. B. Flamholz, A. M. Annaswamy, K. H. Johansson, and A. Chakrabortty, “A systems and control perspective of CPS security,” Annu. Rev. Control, vol. 47, pp. 394–411, Jan. 2019. doi: 10.1016/j.arcontrol.2019.04.011
    [3]
    V. L. Do, L. Fillatre, I. Nikiforov, and P. Willett, “Security of SCADA systems against cyber-physical attacks,” IEEE Aerosp. Electron. Syst. Mag., vol. 32, no. 5, pp. 28–45, May 2017. doi: 10.1109/MAES.2017.160047
    [4]
    A. Hobbs, “The colonial pipeline hack: Exposing vulnerabilities in U.S. cybersecurity,” 2021. [Online]. Available: https://sk.sagepub.com/cases/colonial-pipeline-hack-exposing-vulnerabilities-us-cybersecurity.
    [5]
    W. L. Duo, M. C. Zhou, and A. Abusorrah, “A survey of cyber attacks on cyber physical systems: Recent advances and challenges,” IEEE/CAA J. Autom. Sinica, vol. 9, no. 5, pp. 784–800, May 2022. doi: 10.1109/JAS.2022.105548
    [6]
    Y. L. Mo and B. Sinopoli, “Secure control against replay attacks,” in Proc. 47th Annu. Allerton Conf. Communication, Control, and Computing, Monticello, USA, 2009, pp. 911–918.
    [7]
    R. S. Smith, “Covert misappropriation of networked control systems: Presenting a feedback structure,” IEEE Control Syst. Mag., vol. 35, no. 1, pp. 82–92, Feb. 2015. doi: 10.1109/MCS.2014.2364723
    [8]
    A. Barboni, H. Rezaee, F. Boem, and T. Parisini, “Detection of covert cyber-attacks in interconnected systems: A distributed model-based approach,” IEEE Trans. Autom. Control, vol. 65, no. 9, pp. 3728–3741, Sept. 2020. doi: 10.1109/TAC.2020.2998765
    [9]
    A. Teixeira, I. Shames, H. Sandberg, and K. H. Johansson, “A secure control framework for resource-limited adversaries,” Automatica, vol. 51, pp. 135–148, Jan. 2015. doi: 10.1016/j.automatica.2014.10.067
    [10]
    Q. R. Zhang, K. Liu, D. Y. Han, G. Z. Su, and Y. Q. Xia, “Design of stealthy deception attacks with partial system knowledge,” IEEE Trans. Autom. Control, vol. 68, no. 2, pp. 1069–1076, Feb. 2023. doi: 10.1109/TAC.2022.3146079
    [11]
    A. Teixeira, K. C. Sou, H. Sandberg, and K. H. Johansson, “Secure control systems: A quantitative risk management approach,” IEEE Control Syst. Mag., vol. 35, no. 1, pp. 24–45, Feb. 2015. doi: 10.1109/MCS.2014.2364709
    [12]
    H. S. Sánchez, D. Rotondo, T. Escobet, V. Puig, and J. Quevedo, “Bibliographical review on cyber attacks from a control oriented perspective,” Annu. Rev. Control, vol. 48, pp. 103–128, Sept. 2019. doi: 10.1016/j.arcontrol.2019.08.002
    [13]
    T. Y. Zhang and D. Ye, “False data injection attacks with complete stealthiness in cyber-physical systems: A self-generated approach,” Automatica, vol. 120, p. 109117, Oct. 2020. doi: 10.1016/j.automatica.2020.109117
    [14]
    K. K. Zhang, C. Keliris, T. Parisini, and M. M. Polycarpou, “Stealthy integrity attacks for a class of nonlinear cyber-physical systems,” IEEE Trans. Autom. Control, vol. 67, no. 12, pp. 6723–6730, Dec. 2022. doi: 10.1109/TAC.2021.3131656
    [15]
    A. Y. Lu and G. H. Yang, “Input-to-state stabilizing control for cyber-physical systems with multiple transmission channels under denial of service,” IEEE Trans. Autom. Control, vol. 63, no. 6, pp. 1813–1820, 2018. doi: 10.1109/TAC.2017.2751999
    [16]
    H. Zhang, P. Cheng, L. Shi, and J. M. Chen, “Optimal denial-of-service attack scheduling with energy constraint,” IEEE Trans. Autom. Control, vol. 60, no. 11, pp. 3023–3028, Nov. 2015. doi: 10.1109/TAC.2015.2409905
    [17]
    H. Zhang, Y. F. Qi, J. F. Wu, L. K. Fu, and L. D. He, “DoS attack energy management against remote state estimation,” IEEE Trans. Control Netw. Syst., vol. 5, no. 1, pp. 383–394, Mar. 2018. doi: 10.1109/TCNS.2016.2614099
    [18]
    S. Amin, A. A. Cárdenas, and S. S. Sastry, “Safe and secure networked control systems under denial-of-service attacks,” in Proc. 12th Int. Workshop on Hybrid Systems: Computation and Control, San Francisco, USA, 2009, pp. 31–45.
    [19]
    A. Teixeira, I. Shames, H. Sandberg, and K. H. Johansson, “Revealing stealthy attacks in control systems,” in Proc. 50th Annu. Allerton Conf. Communication, Control, and Computing, Monticello, USA, 2012, pp. 1806–1813.
    [20]
    F. Pasqualetti, F. Dörfler, and F. Bullo, “Attack detection and identification in cyber-physical systems,” IEEE Trans. Autom. Control, vol. 58, no. 11, pp. 2715–2729, Nov. 2013. doi: 10.1109/TAC.2013.2266831
    [21]
    R. S. Smith, “A decoupled feedback structure for covertly appropriating networked control systems,” IFAC Proc. Vol., vol. 44, no. 1, pp. 90–95, Jan. 2011. doi: 10.3182/20110828-6-IT-1002.01721
    [22]
    Y. B. Mao, H. Jafarnejadsani, P. Zhao, E. Akyol, and N. Hovakimyan, “Novel stealthy attack and defense strategies for networked control systems,” IEEE Trans. Autom. Control, vol. 65, no. 9, pp. 3847–3862, Sept. 2020. doi: 10.1109/TAC.2020.2997363
    [23]
    Y. L. Mo, R. Chabukswar, and B. Sinopoli, “Detecting integrity attacks on SCADA systems,” IEEE Trans. Control Syst. Technol., vol. 22, no. 4, pp. 1396–1407, Jul. 2014. doi: 10.1109/TCST.2013.2280899
    [24]
    R. M. G. Ferrari and A. M. H. Teixeira, “A switching multiplicative watermarking scheme for detection of stealthy cyber-attacks,” IEEE Trans. Autom. Control, vol. 66, no. 6, pp. 2558–2573, Jun. 2021. doi: 10.1109/TAC.2020.3013850
    [25]
    A. Hoehn and P. Zhang, “Detection of covert attacks and zero dynamics attacks in cyber-physical systems,” in Proc. American Control Conf., Boston, USA, 2016, pp. 302–307.
    [26]
    S. Weerakkody and B. Sinopoli, “Detecting integrity attacks on control systems using a moving target approach,” in Proc. 54th IEEE Conf. Decision and Control, Osaka, Japan, 2015, pp. 5820–5826.
    [27]
    P. Griffioen, S. Weerakkody, and B. Sinopoli, “A moving target defense for securing cyber-physical systems,” IEEE Trans. Autom. Control, vol. 66, no. 5, pp. 2016–2031, May 2021. doi: 10.1109/TAC.2020.3005686
    [28]
    M. M. Polycarpou and A. J. Helmicki, “Automated fault detection and accommodation: A learning systems approach,” IEEE Trans. Syst. Man Cybern., vol. 25, no. 11, pp. 1447–1458, Nov. 1995. doi: 10.1109/21.467710
    [29]
    S. X. Ding, Model-Based Fault Diagnosis Techniques: Design Schemes, Algorithms, and Tools. 2nd ed. London, UK: Springer, 2013.
    [30]
    M. Blanke, M. Kinnaert, J. Lunze, and M. Staroswiecki, Diagnosis and Fault-Tolerant Control. 2nd ed. Berlin, Germany: Springer, 2006.
    [31]
    Y. K. Wu, B. Jiang, and N. Y. Lu, “A descriptor system approach for estimation of incipient faults with application to high-speed railway traction devices,” IEEE Trans. Syst. Man Cybern. Syst., vol. 49, no. 10, pp. 2108–2118, Oct. 2019. doi: 10.1109/TSMC.2017.2757264
    [32]
    K. K. Zhang, B. Jiang, X. G. Yan, and Z. H. Mao, “Incipient fault detection for traction motors of high-speed railways using an interval sliding mode observer,” IEEE Trans. Intell. Transport. Syst., vol. 20, no. 7, pp. 2703–2714, Jul. 2019. doi: 10.1109/TITS.2018.2878909
    [33]
    C. Keliris, M. M. Polycarpou, and T. Parisini, “An integrated learning and filtering approach for fault diagnosis of a class of nonlinear dynamical systems,” IEEE Trans. Neural Netw. Learning Syst., vol. 28, no. 4, pp. 988–1004, Apr. 2017. doi: 10.1109/TNNLS.2015.2504418
    [34]
    M. Taheri, K. Khorasani, I. Shames, and N. Meskin, Cyber Attack and machine induced fault detection and isolation methodologies for cyber-physical systems, 2020. [Online]. Available: https://arxiv.org/abs/2009.06196.
    [35]
    K. K. Zhang, M. M. Polycarpou, and T. Parisini, “Enhanced anomaly detector for nonlinear cyber-physical systems against stealthy integrity attacks,” IFAC-PapersOnLine, vol. 53, no. 2, pp. 13682–13687, Jan. 2020. doi: 10.1016/j.ifacol.2020.12.870
    [36]
    K. K. Zhang, C. Keliris, M. M. Polycarpou, and T. Parisini, “Detecting stealthy integrity attacks in a class of nonlinear cyber-physical systems: A backward-in-time approach,” Automatica, vol. 141, p. 110262, Jul. 2022. doi: 10.1016/j.automatica.2022.110262
    [37]
    E. Kontouras, A. Tzes, and L. Dritsas, “Hybrid detection of intermittent cyber-attacks in networked power systems,” Energies, vol. 12, no. 24, p. 4625, Dec. 2019. doi: 10.3390/en12244625
    [38]
    S. Gao, H. Zhang, Z. P. Wang, C. Huang, and H. C. Yan, “Optimal injection attack strategy for cyber-physical systems under resource constraint: A game approach,” IEEE Trans. Control Netw. Syst., to be published.
    [39]
    J. Chen and R. J. Patton, Robust Model-Based Fault Diagnosis for Dynamic Systems. Springer, 2012.
    [40]
    X. D. Zhang, M. M. Polycarpou, and T. Parisini, “Fault diagnosis of a class of nonlinear uncertain systems with Lipschitz nonlinearities using adaptive estimation,” Automatica, vol. 46, no. 2, pp. 290–299, 2010. doi: 10.1016/j.automatica.2009.11.014
    [41]
    K. K. Zhang, B. Jiang, X. G. Yan, and J. Shen, “Interval sliding mode observer based incipient sensor fault detection with application to a traction device in China railway high-speed,” IEEE Trans. Veh. Technol., vol. 68, no. 3, pp. 2585–2597, 2019. doi: 10.1109/TVT.2019.2894670
    [42]
    M. Basseville and I. V. Nikiforov, Detection of Abrupt Changes: Theory and Application. Englewood Cliffs: Prentice-Hall, 1993.
    [43]
    B. D. Anderson and J. B. Moore, Optimal Filtering. North Chelmsford, USA: Courier Corporation, 2012.
    [44]
    M. Green and D. J. N. Limebeer, Linear Robust Control. New York, USA: Dover Publications, 2012.
    [45]
    D. Simon, Optimal State Estimation: Kalman, H, and Nonlinear Approaches. Hoboken, USA: John Wiley & Sons, 2006.
    [46]
    G. A. Einicke, Smoothing, Filtering and Prediction: Estimating the Past, Present and Future. Rijeka: IntechOpen, 2012.
    [47]
    X. B. Li and K. M. Zhou, “A time domain approach to robust fault detection of linear time-varying systems,” Automatica, vol. 45, no. 1, pp. 94–102, Jan. 2009. doi: 10.1016/j.automatica.2008.07.017
    [48]
    R. N. Banavar and J. L. Speyer, “A linear-quadratic game approach to estimation and smoothing,” in Proc. American Control Conf., Boston, USA, 1991, pp. 2818–2822.
    [49]
    H. Abou-Kandil, G. Freiling, V. Ionescu, and G. Jank, Matrix Riccati Equations in Control and Systems Theory. Birkhäuser Verlag, Basel, 2012.
    [50]
    G. Basile and G. Marro, Controlled and Conditioned Invariants in Linear System Theory. Englewood Cliffs: Prentice Hall, 1992.
    [51]
    Q. J. Xia, M. Rao, Y. Q. Ying, and X. M. Shen, “Adaptive fading Kalman filter with an application,” Automatica, vol. 30, no. 8, pp. 1333–1338, Aug. 1994. doi: 10.1016/0005-1098(94)90112-0
    [52]
    Y. J. Zhang, J. F. Zhang, X. K. Liu, and Z. Liu, “Quantized-output feedback model reference control of discrete-time linear systems,” Automatica, vol. 137, p. 110027, Mar. 2022. doi: 10.1016/j.automatica.2021.110027
    [53]
    J. Guo, Y. J. Zhang, J. F. Zhang, and X. K. Liu, “Finite quantized-output feedback tracking control of possibly non-minimum phase linear systems,” IEEE Control Syst. Lett., vol. 6, pp. 2407–2412, Mar. 2022. doi: 10.1109/LCSYS.2022.3159130
    [54]
    M. L. Lv, W. W. Yu, J. D. Cao, and S. Baldi, “A separation-based methodology to consensus tracking of switched high-order nonlinear multiagent systems,” IEEE Trans. Neural Netw. Learn. Syst., vol. 33, no. 10, pp. 5467–5479, Oct. 2022. doi: 10.1109/TNNLS.2021.3070824
    [55]
    M. L. Lv, B. De Schutter, C. Shi, and S. Baldi, “Logic-based distributed switching control for agents in power-chained form with multiple unknown control directions,” Automatica, vol. 137, p. 110143, Mar. 2022. doi: 10.1016/j.automatica.2021.110143
    [56]
    Y. Liu, D. Y. Yao, L. J. Wang, and S. J. Lu, “Distributed adaptive fixed-time robust platoon control for fully heterogeneous vehicles,” IEEE Trans. Syst. Man Cybern. Syst., vol. 53, no. 1, pp. 264–274, Jan. 2023. doi: 10.1109/TSMC.2022.3179444

Catalog

    通讯作者: 陈斌, bchen63@163.com
    • 1. 

      沈阳化工大学材料科学与工程学院 沈阳 110142

    1. 本站搜索
    2. 百度学术搜索
    3. 万方数据库搜索
    4. CNKI搜索

    Figures(8)

    Article Metrics

    Article views (485) PDF downloads(100) Cited by()

    Highlights

    • A stealthy intermittent integrity attack generation strategy is formulated, which does not require that the adversary has precise knowledge of the system states. A backward-in-time detection residual is formulated, which increases in magnitude each time a new attack occurs
    • An optimal fixed-point smoother with covariance matrix resetting is proposed to implement the aforementioned backward-in-time residual. Such a smoother guarantees robustness to both disturbances and noise, and can also reset the covariance matrix to maintain sensitivity to intermittent integrity attacks
    • The corresponding adaptive threshold is designed, and an attack detectability analysis is carried out to characterize quantitatively the class of detectable stealthy intermittent integrity attacks

    /

    DownLoad:  Full-Size Img  PowerPoint
    Return
    Return