Abstract:This article considers the design and analysis of multiple moving target defenses for recognizing and isolating attacks on cyber-physical systems. We consider attackers who perform integrity attacks on some set of sensors and actuators in a control system. In such cases, it has been shown that a model aware adversary can carefully design attack vectors to bypass bad data detection and identification filters while causing damage to the control system. To counter such an attacker, we propose the moving target defense which introduces stochastic, time-varying parameters in the control system. The underlying random dynamics of the system limit an attacker's knowledge of the model and inhibit his or her ability to construct stealthy attack sequences. Moreover, the time-varying nature of the dynamics thwarts adaptive adversaries. We explore three main designs. First, we consider a hybrid system where parameters within the existing plant are switched among multiple modes. We demonstrate how such an approach can enable both the detection and identification of malicious nodes. Next, we investigate the addition of an extended system with dynamics that are coupled to the original plant but do not affect the system performance. Here, an attack on the original system will affect the authenticating subsystem and in turn be revealed by a set of sensors measuring the extended plant. Finally, we propose the use of sensor nonlinearities to enhance the effectiveness of the moving target defense. The nonlinear dynamics act to conceal normal operational behavior from an attacker who has tampered with the system state, further hindering an attacker's ability to glean information about the time-varying dynamics. In all cases mechanisms for analysis and design are proposed. Finally, we analyze attack detectability for each moving target defense by investigating expected lower bounds on the detection statistic. Our contributions are also tested via simulation.

Attack Detection for Cyber-Physical Systems: A Zonotopic Approach

Multiple Attacks Detection in Cyber-Physical Systems Using Random Finite Set Theory.

Observer‐Based Sensor Attack Diagnosis for Cyber‐Physical Systems via Zonotope Theory

Filter-based Detection and Location of Dynamic Load Altering Attack in Power Cyber-Physical Systems

Data-Driven Attack Detection and Identification for Cyber-Physical Systems under Sparse Sensor Attacks

Sparse Undetectable Sensor Attacks Against Cyber-Physical Systems: A Subspace Approach

Replay Attack Detection for Cyber-Physical Systems with Sensitive States

Attack Detection and Secure State Estimation of Collectively Observable Cyber-Physical Systems Under False Data Injection Attacks

Sensor attack detection based on active excitation response with uncertain delays

Attack Detection In Cyber-Physical Systems Using Particle Filter:An Illustration On Three-Tank System

Secure Estimation, Attack Isolation and Reconstruction Based on Zonotopic Unknown Input Observer

Proactive attack detection scheme based on watermarking and moving target defense

An Active Detection Strategy Based on Dimensionality Reduction for False Data Injection Attacks in Cyber-Physical Systems

Detection and Identification of Sparse Sensor Attacks in Cyber-Physical Systems With Side Information

Security Analysis for Cyber‐physical Systems under Undetectable Attacks: A Geometric Approach

Detecting Stealthy Attacks in Power Systems based on Switching and Zonotopes

Optimal Attack Strategies Subject to Detection Constraints Against Cyber-Physical Systems

Optimal Strictly Stealthy Attack Design on Cyber-Physical Systems: A Data-Driven Approach.

A PCA-based algorithm for online false data injection and jamming attacks detection in cyber-physical systems

A Moving Target Defense for Securing Cyber-Physical Systems

Attacks Detection and Security Control for Cyber-Physical Systems under False Data Injection Attacks