Abstract:The increasing autonomy and connectivity in cyber-physical systems (CPS) come with new security vulnerabilities that are easily exploitable by malicious attackers to spoof a system to perform dangerous actions. While the vast majority of existing works focus on attack prevention and detection, the key question is "what to do after detecting an attack?". This problem attracts fairly rare attention though its significance is emphasized by the need to mitigate or even eliminate attack impacts on a system. In this article, we study this attack response problem and propose novel real-time recovery for securing CPS. First, this work's core component is a recovery control calculator using a Linear-Quadratic Regulator (LQR) with timing and safety constraints. This component can smoothly steer back a physical system under control to a target state set before a safe deadline and maintain the system state in the set once it is driven to it. We further propose an Alternating Direction Method of Multipliers (ADMM) based algorithm that can fast solve the LQR-based recovery problem. Second, supporting components for the attack recovery computation include a checkpointer, a state reconstructor, and a deadline estimator. To realize these components respectively, we propose (i) a sliding-windowbased checkpointing protocol that governs sufficient trustworthy data, (ii) a state reconstruction approach that uses the checkpointed data to estimate the current system state, and (iii) a reachability-based approach to conservatively estimate a safe deadline. Finally, we implement our approach and demonstrate its effectiveness in dealing with totally 15 experimental scenarios which are designed based on 5 CPS simulators and 3 types of sensor attacks.

Filter-based Detection and Location of Dynamic Load Altering Attack in Power Cyber-Physical Systems

Multiple Attacks Detection in Cyber-Physical Systems Using Random Finite Set Theory.

Analysis of Malware-Induced Cyber Attacks in Cyber-Physical Power Systems

Dynamic load altering attack detection in smart grid based on multiple fading factor adaptive Kalman Filter

An Ensemble Learning-Based Cyber-Attacks Detection Method of Cyber-Physical Power Systems

Detection Scheme Against Cyber-Physical Attacks on Load Frequency Control Based on Dynamic Characteristics Analysis

Novel cyber-physical collaborative detection and localization method against dynamic load altering attacks in smart energy grids

Detecting Intelligent Load Redistribution Attack Based on Power Load Pattern Learning in Cyber-Physical Power Systems

Differential Evolution-Based Three Stage Dynamic Cyber-Attack of Cyber-Physical Power Systems

Dynamic load altering attack detection based on adaptive fading Kalman filter in smart grid

Constrained-Differential-Evolution-Based Stealthy Sparse Cyber-Attack and Countermeasure in an AC Smart Grid

Cyber attack estimation and detection for cyber-physical power systems

Coordinated Cyber-Attack Detection Model of Cyber-Physical Power System Based on the Operating State Data Link

Dynamic load altering attack detection for cyber physical power systems via sliding mode observer

Dynamic Data Injection Attack Detection of Cyber Physical Power Systems with Uncertainties

A Dynamic-Watermarking-Based Cyberattack Detection Framework on an LFC System with Uncertain Parameters

Real-Time Attack-Recovery for Cyber-Physical Systems Using Linear Approximations

Adaptive distributed Kalman-like filter for power system with cyber attacks

Attack Reconstruction for a Class of Cyber-physical Systems with Altering Load*

Optimal Linear Attack in Cyber-Physical Systems with Periodic Detection

A Cyber Risk Assessment and Detection Method for Power Systems Against Data Integrity Attack on Load Frequency Control