Masking attack for sampled‐data systems via input redundancy

Abstract

In this paper, we introduce a new vulnerability of cyber-physical systems to malicious attack. It arises when the physical plant, that is modeled as a continuous-time LTI system, is controlled by a digital controller. In the sampled-data framework, most anomaly detectors monitor the plant's output only at discrete time instants, and thus, nothing abnormal can be detected as long as the sampled output behaves normal. This implies that if an actuator attack drives the plant's state to pass through the kernel of the output matrix at each sensing time, then the attack compromises the system while remaining stealthy. We show that this type of attack always exists when the sampleddata system has an input redundancy, i.e., the number of inputs being larger than that of the outputs or the sampling rate of the actuators being higher than that of the sensors. Simulation results for the X-38 vehicle and for the other numerical examples illustrate this new attack strategy possibly brings disastrous consequences.

Zero-dynamics Attack, Variations, and Countermeasures

“…It should be noted that ( 14) holds if the number of inputs, p, is large and/or the sampling period for actuation, T a , is small. Based on ( 14), a disruptive stealthy attack is proposed in [12], and the attack is termed as 'masking attack.' In order to introduce the idea of the masking attack (we call it 'enforced-zerodynamics attack' in this chapter), let us simplify the situation as…”

On the Pitfalls and Vulnerabilities of Schedule Randomization Against Schedule-Based Attacks

“…In control security, a large number of attacks have focused on manipulating the outputs of a control task before it is applied to the physical plant [6]. These include biasinjection attacks [6], zero-dynamics attack 2 [6]- [11], replay attacks [12], etc. For example, a zero-dynamics attack happens when the attacker generates outputs that maliciously disguise as the unstable zero dynamics of the plant [8].…”

“…Similarly, in the domain of cyber-physical systems (CPS) security, the success of a large number of attacks that focus on compromising data integrity (e.g., to deceive the control task, degrade the performance of the system, or damage the environment) depends on the execution window of the attacker and the time at which the system interacts with its physical environment. For example, bias-injection attacks [6], zero-dynamics attack, [6]- [11], and replay attacks [12] affect the output of the controller and hence must be performed after the targeted task completes, while false-data injection attacks [13]- [17] must execute before the targeted task accesses its input data.…”

Analysis, prevention, and feasibility assessment of stealthy ageing attacks on dynamical systems

“…Denial of Service) [7][8][9]; and (iii) deception which is the corruption of signals (e.g. spoofing, false-data injection) [10][11][12][13][14][15][16][17][18].…”

“…outputs error, stability) [10][11][12][13][14]18]. In (b), the cyberattacks control directly the physical system at the attacker's convenience, with the aim to degrade the control performances [15][16][17]. In the literature, the degradation of the control performances have been investigated by providing analysis methods to compute the effect of such cyberattacks on the control.…”