SMT-Based Observer Design for Cyber-Physical Systems under Sensor Attacks

Abstract

Abstract-We introduce a scalable observer architecture to estimate the states of a discrete-time linear-time-invariant (LTI) system whose sensors can be manipulated by an attacker. Given the maximum number of attacked sensors, we build on previous results on necessary and sufficient conditions for state estimation, and propose a novel multi-modal Luenberger (MML) observer based on efficient Satisfiability Modulo Theory (SMT) solving. We present two techniques to reduce the complexity of the estimation problem. As a first strategy, instead of a bank of distinct observers, we use a family of filters sharing a single dynamical equation for the states, but different output equations, to generate estimates corresponding to different subsets of sensors. Such an architecture can reduce the memory usage of the observer from an exponential to a linear function of the number of sensors. We then develop an efficient SMT-based decision procedure that is able to reason about the estimates of the MML observer to detect at runtime which sets of sensors are attack-free, and use them to obtain a correct state estimate. We provide proofs of convergence for our algorithm and report simulation results to compare its runtime performance with alternative techniques. Our algorithm scales well for large systems (including up to 5000 sensors) for which many previously proposed algorithms are not implementable due to excessive memory and time requirements. Finally, we illustrate the effectiveness of our algorithm on the design of resilient power distribution systems.

Relaxing Integrity Requirements for Attack-Resilient Cyber-Physical Systems

“…While the interaction with the physical world introduces new attack surfaces, it also provides opportunities to improve system resilience agains attacks. The use of control techniques that employ a physical model of the system's dynamics for attack detection and attack-resilient state estimation has drawn significant attention in recent years (e.g., [35], [36], [27], [4], [34], [24], [1], [26], [25], [30], and a recent survey [17]). One line of work is based on the use of unknown input observers (e.g., [34], [27]) and non-convex optimization for resilient estimation (e.g., [4], [25]), while another focuses on attackdetection and estimation guarantees in systems with standard Kalman filter-based state estimators (e.g., [22], [21], [11], [12], [24], [23], [10]).…”

Linear system security—Detection and correction of adversarial sensor attacks in the noise-free case

“…As this is the type of representation that is considered in e.g. [4], [23], [22], [7], we are now in a position to compare our results with the literature in this area. In contrast to our representation-free definition of "security index", much of the literature implicitly defines a similar notion in terms of the matrices A and C of the state space representation.…”

“…For example [4] defines M -attack observability of a state space representation (A, C) in terms of the matrices A and C. In terms of our notion of security index δ(Σ), any observable state space representation (A, C) is δ(Σ)/2 -attack observable. Alternatively, in the terminology of [23], [22], this is phrased as (δ(Σ) − 1)-sparse attack observability.…”

On Redundant Observability: From Security Index to Attack Detection and Resilient State Estimation

“…Compared with the existing resilient estimation algorithms in [9]- [15], the advantages of our scheme are as follows. First, it does not require any additional restrictive conditions other than the redundant observability (compared with [9], [11], [13], [15]). Second, an observer-based algorithm makes it possible to estimate the current state, not the initial state or delay information (compared with [9], [10], [12]).…”