Abstract:Transactions of the Institute of Measurement and Control, Ahead of Print. Cyber-physical systems face cyberattacks that hinder performance, increase cost, or even collapse the system. Thus, rapid and accurate attack detection is crucial for quick activation of defense mechanisms. Model-based attack detection approaches are known for their precision; however, the unavailability of the exact system model poses a challenge. In response, model-free approaches have gained increased attention as a practical alternative. In this paper, an online model-free algorithm for detecting false data injection and jamming attacks on CPSs is proposed. The method leverages principal component analysis to reconstruct the expected observations in a reduced dimension space, emphasizing the most effective principal components. Then, deciding on attacked or normal operation relies on analyzing either the Euclidean distance or the cosine similarity of the discrepancy between the expected and actual observations. The proposed metrics effectively expose subtle deviations from expected behavior, as any alteration in these components augments the distance between the observed and reconstructed values. The proposed method was compared with the conventional cumulative sum discriminator and Kalman-based algorithm, using an IEEE-14, IEEE-30, and IEEE-118 bus systems. The results demonstrate the superiority of the proposed algorithm in terms of various evaluation metrics, including F-score, precision, recall, and miss detection ratio.

Deceptive attack detection of control system using multi-scale principal component analysis

Square Wave Attack Detection Based on PCA with Cosine Similarity and SVM

An Improved Support Vector Machine Attack Detection Algorithm for Industry Controls System

Filter-based Detection and Location of Dynamic Load Altering Attack in Power Cyber-Physical Systems

Anomoly Detection for PLC Based on Magnetic Side Channel

Quantifying Cyber Attacks on Industrial MMC-HVDC Control System Using Structured Pseudospectrum

Fault diagnosis in industrial processes using principal component analysis and hidden Markov model

Intrusion Detection Model of SCADA Using Graphical Features

Dynamic PCA-based Fault Detection and Diagnosis Analysis

Industrial control network security situation awareness based on improved C-SVC

Hidden Markov Model-Based Attack Detection for Networked Control Systems Subject to Random Packet Dropouts

A Dynamic Event-Triggered Secure Monitoring and Control for a Class of Discrete-Time Markovian Jump Systems: A Plug-and-Play Architecture

Online Parallel Attack Detection Method for Industrial Control based on Multi-bandpass Filter

Fault detection method based on kernel principal angle

A PCA-based algorithm for online false data injection and jamming attacks detection in cyber-physical systems

Fault detection approach based on linear dynamical system in principal component space

Fast Sequence Component Analysis for Attack Detection in Synchrophasor Networks

Mode division-based anomaly detection against integrity and availability attacks in industrial cyber-physical systems

An Intrusion Detection Method for Industrial Control System against Stealthy Attack

Attack signal estimation for intrusion detection in industrial control system

Coordinated Cyber-Attack Detection Model of Cyber-Physical Power System Based on the Operating State Data Link