Abstract:The increasing autonomy and connectivity in cyber-physical systems (CPS) come with new security vulnerabilities that are easily exploitable by malicious attackers to spoof a system to perform dangerous actions. While the vast majority of existing works focus on attack prevention and detection, the key question is "what to do after detecting an attack?". This problem attracts fairly rare attention though its significance is emphasized by the need to mitigate or even eliminate attack impacts on a system. In this article, we study this attack response problem and propose novel real-time recovery for securing CPS. First, this work's core component is a recovery control calculator using a Linear-Quadratic Regulator (LQR) with timing and safety constraints. This component can smoothly steer back a physical system under control to a target state set before a safe deadline and maintain the system state in the set once it is driven to it. We further propose an Alternating Direction Method of Multipliers (ADMM) based algorithm that can fast solve the LQR-based recovery problem. Second, supporting components for the attack recovery computation include a checkpointer, a state reconstructor, and a deadline estimator. To realize these components respectively, we propose (i) a sliding-windowbased checkpointing protocol that governs sufficient trustworthy data, (ii) a state reconstruction approach that uses the checkpointed data to estimate the current system state, and (iii) a reachability-based approach to conservatively estimate a safe deadline. Finally, we implement our approach and demonstrate its effectiveness in dealing with totally 15 experimental scenarios which are designed based on 5 CPS simulators and 3 types of sensor attacks.

Dynamic State Recovery for Cyber-Physical Systems under Switching Location Attacks

Filter-based Detection and Location of Dynamic Load Altering Attack in Power Cyber-Physical Systems

A Dynamic and Static Combined State Recovery Method Against FDI Attacks in Power Grids

Switching and Data Injection Attacks on Stochastic Cyber-Physical Systems: Modeling, Resilient Estimation and Attack Mitigation

Fast Attack Recovery for Stochastic Cyber-Physical Systems

Real-Time Attack-Recovery for Cyber-Physical Systems Using Linear Approximations

Adaptive Event-Driven Control for Continuous Positive Stochastic Jump Models with Cyber Attacks

Adaptive Fuzzy Asynchronous Control for Nonhomogeneous Markov Jump Power Systems under Hybrid Attacks

Real-Time Data-Predictive Attack-Recovery for Complex Cyber-Physical Systems

An Ensemble Learning-Based Cyber-Attacks Detection Method of Cyber-Physical Power Systems

Cyber Recovery from Dynamic Load Altering Attacks: Linking Electricity, Transportation, and Cyber Networks

Data-Based Tampered-Data Recovery Strategy With Encoding Against Stealthy Attack for Unknown Discrete-Time Systems

Secure Mode Distinguishability for Switching Systems Subject to Sparse Attacks

Dynamic Data Injection Attack Detection of Cyber Physical Power Systems with Uncertainties

Stochastic Models to Mitigate Sparse Sensor Attacks in Continuous-Time Non-Linear Cyber-Physical Systems

A dynamic defense-attack game scheme with incomplete information for vulnerability analysis in a cyber-physical power infrastructure

A resilience-oriented restoration model against attacks on cyber-physical power systems

Recovery from Adversarial Attacks in Cyber-physical Systems: Shallow, Deep and Exploratory Works

State Estimation for Distributed Cyber-Physical Power Systems under Data Attacks

Secure state estimation for cyber physical systems with state delay and sparse sensor attacks