Cyber Security of Water SCADA Systems—Part II: Attack Detection Using Enhanced Hydrodynamic Models

Abstract

This paper investigates the problem of detection and isolation of attacks on a water distribution network comprised of cascaded canal pools. The proposed approach employs a bank of delay-differential observer systems. The observers are based on an analytically approximate model of canal hydrodynamics. Each observer is insensitive to one fault/attack mode and sensitive to other modes. The design of the observers is achieved by using a delay-dependent linear matrix inequality method. The performance of our model-based diagnostic scheme is tested on a class of adversarial scenarios based on a generalized fault/attack model. This model represents both classical sensor-actuator faults and communication network-induced deception attacks. Our particular focus is on stealthy deception attacks in which the attacker's goal is to pilfer water through canal offtakes. Our analysis reveals the benefits of accurate hydrodynamic models in detecting physical faults and cyber attacks to automated canal systems. We also comment on the criticality of sensor measurements for the purpose of detection. Finally, we discuss the knowledge and effort required for a successful deception attack.Index Terms-Delay systems, fault diagnosis, intrusion detection, supervisory control and data acquisition (SCADA) systems, supervisory control.

Cyberattack Detection Using Deep Generative Models with Variational Inference

“…While the conversation about the cybersecurity of water resources systems has been going on for long (Water Sector Coordinating Council 2008;Cardenas et al 2009), its reception and recognition by the water research community is relatively new. Two pioneering studies by Amin et al (2013a;2013b) performed simulation-based assessment and detection of stealthy deception attacks launched against cascaded canal systems. Perelman et al (2014) formulated the network vulnerability as an attacker-defender problem to identify the most critical links in a network.…”

“…Manual detection of anomalies is extremely laborious and difficult, if not impossible, given the extreme intricacy of the modern distributed systems (Chandola et al 2009). Simulation-based and conventional machinelearning approaches also have limited versatility due to their inherent dependency on substantial domain knowledge (Amin et al 2013a;2013b) and inability to process data in their raw form (LeCun et al 2015). In this article, we design a variational autoencoder (VAE) (Kingma and Welling 2014), which is a deep generative model with variational inference, for detection of cyberattacks.…”

Modeling and Estimation of the Humans' Effect on the CO₂ Dynamics Inside a Conference Room

“…In [35], this methodology is applied for the estimation of the state-of-charge of batteries. Observer designs for time-delay systems with unknown inputs are presented in [2], [5], [23]. Swapping identifiers, originally developed for parameter estimation of ODE systems [21], [24], are constructed for parabolic PDEs in [43], [45], [46], [47].…”

Resilient plant monitoring systems: Techniques, analysis, design, and performance evaluation

“…The first one is devoted to foundational issues, where the problems of resilient monitoring and control are motivated and formulated, [2][3][4][5][6]. The second group includes publications on control-theoretic methods for attack identification and alleviation, [7][8][9][10][11]. In these publications, the authors consider LTI systems with a given state space realization (A, B, C, D) and disturbances interpreted as attack vectors.…”