Hybrid attack monitor design to detect recurrent attacks in a class of cyber-physical systems

Abstract

In this paper, we study a security problem for attack detection in a class of cyber-physical systems consisting of discrete computerized components interacting with continuous agents. We consider an attacker that may inject recurring signals on both the physical dynamics of the agents and the discrete interactions. We model these attacks as additive unknown inputs with appropriate input signatures and timing characteristics. Using hybrid systems modeling tools, we design a novel hybrid attack monitor and, under reasonable assumptions, show that it is able to detect the considered class of recurrent attacks. Finally, we illustrate the general hybrid attack monitor using a specific finite time convergent observer and show its effectiveness on a simplified model of a cloudconnected network of autonomous vehicles.

A Moving Target Defense to Detect Stealthy Attacks in Cyber-Physical Systems

“…In practice the MTD strategy can be activated when we notice indicators of attacks, or if we notice that the system is deviating from the desired space without explanation; if the MTD is activated then, it will be able to mitigate the attack while at the same time revealing a previously undetected attack. Future work includes extending the results to the case of recurring attacks using the hybrid systems techniques used in [11]…”