A control‐switching approach for cyberattack detection in process systems with minimal false alarms

Abstract

The frequency of cyberattacks against process control systems has increased in recent years. This work considers multiplicative false‐data injection attacks involving the multiplication of the data communicated over the sensor‐controller communication link by a factor. An active detection method utilizing switching between two control modes is developed to balance the trade‐off between closed‐loop performance and attack detectability. Under the first mode, the control parameters are selected using traditional control design criteria. Under the second mode, the control parameters are selected to enhance the attack detection capability. A switching condition is imposed to prevent false alarms that could be triggered by the transient response induced by control mode switching. This condition is incorporated into the active detection method to minimize false alarms. The active detection method is applied to illustrative process examples to demonstrate its ability to detect attacks and minimize false alarms.

Detection of Multiplicative False Data Injection Cyberattacks on Process Control Systems via Randomized Control Mode Switching

“…For example, detection of some attacks may be possible when the detection scheme uses the residual to monitor the process; however, these attacks may go undetected when the detection scheme uses the measured output. This realization motivated the formulation of a generalized monitoring variable in [13,14] which may be expressed in terms of the measured and estimated outputs as:…”

“…As a result, the detectability of such attacks may be influenced by the stability of the closed-loop process under an attack. In prior works [13,15], we presented a control mode switching-enabled attack detection method for the detection of multiplicative sensor-controller link FDI attacks. We considered processes under steady-state operation, when the augmented state and the monitoring variable are bounded within the minimum invariant set and the terminal set, respectively.…”

“…Due to the interconnected nature of a cyber-physical system like a PCS, a comprehensive solution to enhancing the cybersecurity of PCSs may involve adopting a multi-faceted approach that involves both information technology-based and operational technologybased approaches. The approaches proposed in the literature broadly include those that reinforce information technology-based infrastructure (e.g., firewalls [3] and network design-based approaches [4,5]), approaches that involve cybersecure architecture design (e.g., [6]), approaches for process equipment design to mitigate adverse impacts of a cyberattack (e.g., [7,8]), and the design of operational technology (OT)-based approaches for detecting, identifying, and successfully recovering from an ongoing cyberattack [6,[9][10][11][12][13][14][15][16][17][18][19][20].…”

“…Multiplicative FDI attacks alter the value of process variables over the PCS network using a multiplicative factor. These attacks can be designed to evade detection without requiring extensive process knowledge, and the design of approaches for their detection has received some attention in the literature [13,15,16,[23][24][25].…”

Encrypted model predictive control design for security to cyberattacks

“…To balance the above trade‐off, in reference 23, a framework for active attack detection using the controller parameter switching of reference 22 was developed, where one set of controller parameters corresponds to conventional controller design criteria, while the other set of controller parameters maximizes cyberattack detectability. Due to the possibility of controller parameter switching leading to excitement of the process, leading to false alarms, reference 24 proposed a switching condition to reduce the triggering of false alarms. Based on our review of the literature on encrypted MPC, to the best of our knowledge, the use of encryption in nonlinear MPC has not been addressed in the systems engineering literature, which warrants the construction of such a framework.…”