Sound and complete state estimation for linear dynamical systems under sensor attacks using Satisfiability Modulo Theory solving

Abstract

We address the problem of detecting and mitigating the effect of malicious attacks on the sensors of a linear dynamical system. We develop a novel, efficient algorithm that uses a Satisfiability Modulo Theory approach to isolate the compromised sensors and estimate the system state despite the presence of the attack, thus harnessing the intrinsic combinatorial complexity of the problem. Simulation results show that our algorithm compares favorably with alternative techniques, with respect to both runtime and estimation error.

SMT-Based Observer Design for Cyber-Physical Systems under Sensor Attacks

“…However, φ triv-cert does not provide much information, since it only excludes the current assignment from the search space, and can still lead to exponential execution time [10], [16]. In fact, the generated certificates heavily affect the overall execution time of an SMT solver.…”

“…In fact, a major concern in secure state estimation is the ability of an intruder to use the uncertainty in the model and the noise in sensors to mount its attack [7]. We compare the estimation performance of the proposed observer against the performance of the previously proposed IMHOTEP-SMT solver [10], [16], which uses sensor data collected over a finite window length. As shown in Table I, the proposed observer performs better in terms of estimation error, which is to be expected as the observer averages out the noise over time.…”

“…At the heart of our approach is a Satisfiability Modulo Theory based algorithm which further improves on the scalability of our previous solutions [10], [16] while addressing both memory and runtime efficiency. In particular, the work in [10], [16] focuses mainly on the case where the state of the system is estimated from data collected within a finite window length. However, when bounded noise exists in the system, estimating the state using finite amount of data leads to poor performance in terms of the state estimation error [10].…”

Attack-resilient state estimation in the presence of noise

“…Therefore, from (14) and (15), there exists an at most 2q max -sparse block vectorz ∈ R pN -defined asz = −∆ẽ l0 , with at most 2q max nonzero N -size blocks -such that…”

“…For noiseless linear time-invariant (LTI) systems for which the exact plant model is known, the attackresilient state estimation problem has been formulated as an l 0 optimization problem [8], [9]. In addition, in [14], the authors present an SMT-based state estimation technique.…”