Abstract:This article considers the design and analysis of multiple moving target defenses for recognizing and isolating attacks on cyber-physical systems. We consider attackers who perform integrity attacks on some set of sensors and actuators in a control system. In such cases, it has been shown that a model aware adversary can carefully design attack vectors to bypass bad data detection and identification filters while causing damage to the control system. To counter such an attacker, we propose the moving target defense which introduces stochastic, time-varying parameters in the control system. The underlying random dynamics of the system limit an attacker's knowledge of the model and inhibit his or her ability to construct stealthy attack sequences. Moreover, the time-varying nature of the dynamics thwarts adaptive adversaries. We explore three main designs. First, we consider a hybrid system where parameters within the existing plant are switched among multiple modes. We demonstrate how such an approach can enable both the detection and identification of malicious nodes. Next, we investigate the addition of an extended system with dynamics that are coupled to the original plant but do not affect the system performance. Here, an attack on the original system will affect the authenticating subsystem and in turn be revealed by a set of sensors measuring the extended plant. Finally, we propose the use of sensor nonlinearities to enhance the effectiveness of the moving target defense. The nonlinear dynamics act to conceal normal operational behavior from an attacker who has tampered with the system state, further hindering an attacker's ability to glean information about the time-varying dynamics. In all cases mechanisms for analysis and design are proposed. Finally, we analyze attack detectability for each moving target defense by investigating expected lower bounds on the detection statistic. Our contributions are also tested via simulation.

Moving Target Defense Approach to Detecting Stuxnet-Like Attacks

Hidden Markov Model-Based Attack Detection for Networked Control Systems Subject to Random Packet Dropouts

Analysis of Malware-Induced Cyber Attacks in Cyber-Physical Power Systems

Filter-based Detection and Location of Dynamic Load Altering Attack in Power Cyber-Physical Systems

Moving-Target Defense for Detecting Coordinated Cyber-Physical Attacks in Power Grids

Attacks on Data-Driven Process Monitoring Systems: Subspace Transfer Networks

A Moving Target Defense for Securing Cyber-Physical Systems

Cybersecurity Analysis of Data-Driven Power System Stability Assessment

Stealth Attacks Against Moving Target Defense for Smart Grid

Detecting Stealthy Attacks in Power Systems based on Switching and Zonotopes

CPMTD: Cyber-physical moving target defense for hardening the security of power system against false data injected attack

Constrained-Differential-Evolution-Based Stealthy Sparse Cyber-Attack and Countermeasure in an AC Smart Grid

Survey of Moving Target Defense in Power Grids: Design Principles, Tradeoffs, and Future Directions

A Double-Benefit Moving Target Defense Against Cyber–Physical Attacks in Smart Grid

Moving-Target Defense Against Cyber-Physical Attacks in Power Grids via Game Theory

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Topology switching-based moving target defense against false data injection attacks on a power system

PDDL: Proactive Distributed Detection and Localization Against Stealthy Deception Attacks in DC Microgrids

Robust Moving Target Defence Against False Data Injection Attacks in Power Grids

Strategic Protection against FDI Attacks with Moving Target Defense in Power Grids

Enhanced Hidden Moving Target Defense in Smart Grids