A Tutorial on Detecting Security Attacks on Cyber-Physical Systems

Griffioen, Paul; Weerakkody, Sean; Sinopoli, Bruno; Özel, Ömur; Mo, Yilin

doi:10.23919/ecc.2019.8796117

Cited by 28 publications

(17 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…"Active" detection methods have been proposed to detect stealthy attacks. These methods involve the introduction of a probing signal (watermark) to reveal fake sensor measurement or actuation signals [21], [22]. Active methods can also be designed for attacks exploiting specific control-theoretic properties.…”

Section: Attack Detection In Icsmentioning

confidence: 99%

Grounds for Suspicion: Physics-Based Early Warnings for Stealthy Attacks on Industrial Control Systems

Azzam

Pasquale

Provan

et al. 2022

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Stealthy attacks on Industrial Control Systems can cause significant damage while evading detection. In this paper, instead of focusing on the detection of stealthy attacks, we aim to provide early warnings to operators, in order to avoid physical damage and preserve in advance data that may serve as an evidence during an investigation. We propose a framework to provide grounds for suspicion, i.e. preliminary indicators reflecting the likelihood of success of a stealthy attack. We propose two grounds for suspicion based on the behaviour of the physical process: (i) feasibility of a stealthy attack, and (ii) proximity to unsafe operating regions. We propose a metric to measure grounds for suspicion in real-time and provide soundness principles to ensure that such a metric is consistent with the grounds for suspicion. We apply our framework to Linear Time-Invariant (LTI) systems and formulate the suspicion metric computation as a real-time reachability problem. We validate our framework on a case study involving the benchmark Tennessee-Eastman process. We show through numerical simulation that we can provide early warnings well before a potential stealthy attack can cause damage, while incurring minimal load on the network. Finally, we apply our framework on a use case to illustrate its usefulness in supporting early evidence collection.

show abstract

Section: Attack Detection In Icsmentioning

confidence: 99%

Grounds for Suspicion: Physics-Based Early Warnings for Stealthy Attacks on Industrial Control Systems

Azzam

Pasquale

Provan

et al. 2022

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

show abstract

“…R. Romagnoli is with the Department of Electrical and Computer Engineering, Carnegie Mellon University, Pittsburgh, PA, USA 15213 (Email: rromagno@andrew.cmu.edu). systems, and its performance has been studied extensively in the literature [14]- [16].…”

Section: Introductionmentioning

confidence: 99%

Physical watermarking for replay attack detection in continuous-time systems

Yaghooti

Romagnoli

Sinopoli

2021

European Journal of Control

Self Cite

View full text Add to dashboard Cite

“…Among various types of cyber-attacks, integrity attacks are specially dedicated to automatic control systems (Dibaji et al, 2019;Griffioen et al, 2019). By injecting attack signals into system input and output channels, for instance, via I/O and network interfaces, integrity attacks can lead to remarkable system performance degradations and even catastrophic damages.…”

Section: Introductionmentioning

confidence: 99%

“…An early and reliable detection of integrity attacks is becoming a vitally important requirement on cyber-security of industrial CPSs, for instance, for power control systems (Mohan et al, 2020). Thanks to its intimate relations to control theory and theoretical framework well-established in the past three decades, observer-based fault detection technique (Ding, 2013) is widely accepted as an efficient method, among numerous ones, to deal with detection of integrity attacks on control systems (Dibaji et al, 2019;Griffioen et al, 2019;Tan et al, 2020). Unfortunately, different from technical faults, cyber-attacks are artificially created and can be designed and generated by an adversary.…”

Section: Introductionmentioning

confidence: 99%

“…This observation and some real examples with stealthy cyber-attacks have strongly motivated researchers to improve the existing detection schemes and develop alternative solutions. In this regard, a great number of results have been reported about detecting the so-called replay, zero dynamics and covert attacks, which are stealthy integrity attacks as the standard observer-based fault detection technique cannot detect them without modifications on the applied algorithms (Dibaji et al, 2019;Griffioen et al, 2019;Tan et al, 2020). Representative solutions are the watermark detection scheme (Mo et al, 2015), the moving target method (Weerakkody and Sinopoli, 2015) and auxiliary system aided detection scheme (Schellenberger and Zhang, 2017), just citing the initial works on these methods.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Application of the unified control and detection framework to detecting stealthy integrity cyber-attacks on feedback control systems

Ding¹,

Li²,

Zhang³

et al. 2021

Preprint

View full text Add to dashboard Cite

This draft addresses issues of detecting stealthy integrity cyber-attacks on automatic control systems in the unified control and detection framework. A general form of integrity cyber-attacks that cannot be detected using the well-established observer-based technique is first introduced as kernel attacks. The well-known replay, zero dynamics and covert attacks are special forms of kernel attacks. Furthermore, the existence conditions for kernel attacks are presented. It is demonstrated, in the unified framework of control and detection, that all kernel attacks can be structurally detected when not only the observerbased residual, but also the control signal based residual signals are generated and used for the detection purpose. Based on the analytical results, two schemes for detecting kernel attacks are then proposed, which allow reliable detection of kernel attacks without loss of control performance. While the first scheme is similar to the well-established moving target method and auxiliary system aided detection scheme, the second detector is realised with the encrypted transmissions of control and monitoring signals in the feedback control system that prevents adversary to gain system knowledge by means of eavesdropping attacks. Both schemes are illustrated by examples of detecting replay, zero dynamics and covert attacks and an experimental study on a three tank control system.

show abstract

A Tutorial on Detecting Security Attacks on Cyber-Physical Systems

Cited by 28 publications

References 41 publications

Grounds for Suspicion: Physics-Based Early Warnings for Stealthy Attacks on Industrial Control Systems

Grounds for Suspicion: Physics-Based Early Warnings for Stealthy Attacks on Industrial Control Systems

Physical watermarking for replay attack detection in continuous-time systems

Application of the unified control and detection framework to detecting stealthy integrity cyber-attacks on feedback control systems

Contact Info

Product

Resources

About