A survey on attack detection, estimation and control of industrial cyber-physical systems

A remaining useful life prediction algorithm incorporating real-time and integrated model for hidden actuator degradation

This paper proposed a prediction algorithm for the degraded actuator taking into account the impact of estimation error of hidden index in the closed-loop system. To this end, a unified prediction framework is established to evaluate the hidden degradation information and recursively update the degradation model parameters simultaneously. The advantage is that the prediction framework can comprehensively compensate the estimation error of hidden degradation index caused by system uncertainty. To jointly estimate the degradation information in avoidance of the impact of system uncertainty, a modified adaptive Kalman filter is designed, and the proof of stability is provided. With the priori estimate from the filter, the degradation model parameters are updated by the inverse filtering probability based on Bayes' theorem. It is followed by the computation of the remaining useful life (RUL) prediction utilizing aforementioned hidden degradation information and the latest degradation model. The effectiveness of the proposed RUL prediction algorithm is demonstrated by the degraded actuator in the continuous casting process.

Dynamic event-triggered control for CPSs under QoS-based variable sampling approach

In this article, a quality of service (QoS) dependent variable sampling dynamic event-triggered control method is designed for a cyber-physical system (CPS) with delays and packets dropout to cope with non-ideal network environments, maintain the desired control performance and improve the communication efficiency. To achieve the variable period sampling, a sampler is designed based on the QoS of the wireless network by using the delta operator discretization method. Then, a variable period sampling scheme for the delta operator system converted from the CPS is designed. Furthermore, a dynamic event-triggered mechanism (DETM) is proposed using the variable period sampling signal, which can reduce event triggered data calculations and increase event triggered intervals. By utilizing the average dwell time (ADT) approach, sufficient conditions contains the explicit variable sampling period are derived for the derived switched CPS. Finally, the effectiveness of the designed method is verified by numerical examples.

Induced attack with prescribed consensus trajectory against multiagent systems

This paper proposes a new induced attack strategy against multiagent systems from the perspective of the attacker. It is noted that the induced attack can drive multiagent systems as a whole to follow a specific trajectory prescribed by the attacker, which cannot be achieved by denial-of-service attacks or deception attacks. Firstly, the induced attack signal is produced by establishing an attack generation exosystem, whose dynamics can be regulated to generate the prescribed consensus trajectory. Then, by the local state information and the induced attack signal among partial agents, a new induced attack protocol is proposed, which consists of the nominal consensus term and the induced attack term. By constructing the projection of the induced attack signal onto the consensus subspace, an explicit expression of the prescribed consensus trajectory is determined, which describes the movement trajectory of the entire multiagent system under the induced attack. Meanwhile, the induced attack design criterion is proposed to determine the dynamics matrix of the attack generation exosystem via the robust H∞ scheme. Finally, the simulation example is performed to illustrate the effectiveness of theoretical results.

Fully distributed secure observation and consensus for multi-agent systems with uncertain communication topology

This article investigates the fully distributed secure observation and consensus problem for networked multi-agent systems (MASs) with uncertain communication topology. The complexities of dual-channel false data injection (FDI) attacks and fuzzy communication among agents are considered, bringing direct challenges to the acquisition of system states and the design of consensus protocols. To address these difficulties, on the one hand, adaptive coupling weights that vary with observation and consensus errors are neatly designed to avoid the use of global topology information in the whole mechanism. On the other hand, an auxiliary observation system is constructed based on intermediate variables to realize the simultaneous estimation of system states and dual-channel FDI attacks. After that, a distributed attack compensation controller that can guarantee secure consensus among agents is proposed. Finally, a simulation example and an experiment compared with existing results are given to examine the feasibility and advantages of the developed strategy.

Attack estimation and state reconstruction for cyber-physical systems with state delay via reduced-order observer

This paper investigates the attack estimation and state reconstruction problem for linear cyber-physical systems with state delay and simultaneous sensor and actuator attacks. Reduced-order observer is designed for the augmented system to simultaneously estimate the actuator attack, sensor attack and the state of system. By adopting the double integral term into the Lyapunov-Krasovskii functional and decomposing the cross term, the delay-dependent results are obtained. The method proposed in this paper can accurately estimate the state, actuator and sensor attacks simultaneously without additional design. Compared with the previous method, the time delay information is fully utilized and the conservation is greatly reduced. Finally, the correctness of the results is verified by simulation.

Distributed H∞ filtering of replay attacks over sensor networks

A distributed H∞ filtering issue is addressed in this paper for discrete-time nonlinear systems in the face of replay attacks over sensor networks, where an indicator variable is introduced to describe whether a replay attack is launched by the adversaries. First, an interesting pattern dependent on three parameters including a time-varying one is established to account for the temporal behavior of malicious attacks. Then, taking advantage of such a model, the resulting filter dynamic is transformed into a switching system with a subsystem with time-varying delays. By means of the famous switching system theory, a sufficient condition guaranteeing the H∞ performance is derived to disclose the tolerant attack condition, that is, the attack-active duration and proportion. In addition, the applicable filter gains are achieved with the aid of the solutions of matrix inequalities. Finally, an example is purposively given to adequately illustrate the availability of the developed secure filtering strategy.

Event-triggered robust distributed output feedback model predictive control for nonlinear MASs against false data injection attacks

In this paper, an event-triggered distributed output feedback model predictive control scheme for the nonlinear disturbed multiagent systems with sensor-controller channel false data injection attacks is proposed. To provide valid system states to the controller in the event of cyber attacks, a robust multivariate observer is designed to realize the estimation and separation of uncompromised system states, false data injection attacks, and measurement disturbances, simultaneously. Based on these reconstructed signals and a newly-designed linear robustness constraint, the distributed predictive controller is established to achieve smooth cooperative stabilization among agents. Meanwhile, an event-triggered mechanism is applied to save computing resources, and it restricts the error of predictive states and estimated states to guarantee the feasibility of the optimization control problem. Theoretical analyses on robustness and security for the nonlinear multiagent systems under event-triggered distributed output feedback model predictive control are presented. Finally, a simulation on two pairs of one-link flexible joint manipulator systems verifies the theoretical results.

Optimal energy constrained deception attacks in cyber-physical systems with multiple channels: A fusion attack approach

This paper studies the issue of developing the optimal deception attacks on the multiple channels in cyber-physical systems, where the attackers are limited by energy constraints. To fully utilize the eavesdropped data, by linearly combining the innovations from the different channels, a fusion attack model is proposed under the stealthiness condition. According to the statistical characteristics of the correlated stochastic variables and the orthogonality principle, the state estimation error is quantified and analyzed by deriving the iteration of the error covariance matrices of the remote estimators under the proposed attack framework. Moreover, by analyzing the correlations of the decision variables in the objective function, it is shown that the attack parameters and energy allocation strategy can be derived by two steps without loss of optimality, such that the optimal attack scheme is acquired by solving a multivariate semi-definite programming (SDP) problem and a linear 0-1 programming problem respectively. Finally, simulation examples are provided to illustrate the effectiveness of the proposed method.

Quantized H∞ filtering for networked persistent dwell-time switched piecewise-affine systems

In this study, the problem of quantized H_∞ filtering is addressed for networked switched piecewise-affine systems, in which the switching mechanism obeys the persistent dwell-time constraint. To process the measurement output and schedule the transmission sequence for alleviating the burden of the limited communication channel, a logarithmic quantizer is employed, which can further improve the bandwidth utilization in networked switched systems. On the basis of state-space division, the objective is to design a mode-dependent and region-dependent filter that ensuresthe filtering error system is globally uniformly exponentially stable and meets an H_∞ performance. By using the mode-dependent Lyapunov function approach and employing appropriate decoupling methods, sufficient conditions for obtaining desired filter gains are deduced. Eventually, two illustrated examples are given to demonstrate the effectiveness of our proposed method.

Multiplicative Attacks with Essential Stealthiness in Sensor and Actuator Loops against Cyber-Physical Systems

Stealthy attacks in sensor and actuator loops are the research priorities in the security of cyber-physical systems. Existing attacks define the stealthiness conditions against the Chi-square or Kullback-Leibler divergence detectors and parameterize the attack model based on additive signals. Such conditions ignore the potential anomalies of the vulnerable outputs in the control layer, and the attack sequences need to be generated online, increasing the hardware and software costs. This paper investigates a type of multiplicative attack with essential stealthiness where the employed model is a novel form. The advantage is that the parameters can be designed in a constant form without having to be generated online. An essential stealthiness condition is proposed for the first time and complements the existing ones. Two sufficient conditions for the existence of constant attack matrices are given in the form of theorems, where two methods for decoupling the unknown variables are particularly considered. A quadruple-tank process, an experimental platform for attack and defense, is developed to verify the theoretical results. The experiments indicate that the proposed attack strategy can fulfill both the attack performance and stealthiness conditions.

Recoil attenuation for deepwater drilling riser systems via delayed H∞ control

This paper deals with the recoil suppression problem of a deepwater drilling riser system via active H_∞ control using both current and delayed states. First, based on the three degrees of freedom spring-mass-damping model of the riser system, an incremental dynamic equation of the system subject to the platform heave motion and the friction force induced by drilling discharge mud and seawater is established. Then, to reject recoil movements of the riser, a delayed state feedback H_∞ controller with delayed states as well as current states is designed. The existence conditions and the design method of the delayed H_∞ recoil controllers are presented. Third, the effects of the introduced time-delays on the recoil control of the riser are analyzed, and the design of optimal artificial time-delays is formulated as the minimum value problem of a series of quintic algebraic polynomials, which are related to the weights of average response amplitudes, steady-state errors, and the control force. Lastly, simulation results are provided to demonstrate the effectiveness of delay-free and delayed H_∞ recoil control schemes for the riser. It is shown that (i) under the delayed H_∞ controllers, the recoil responses of the riser can be controlled significantly; (ii) the decay rate of the recoil response under the delay-free H_∞ controller is slightly faster than the one under the delayed H_∞ controllers. However, the former requires more control cost than the latter; (iii) compared with the delayed H_∞ controller with the existing linear quadratic optimal controller, the control cost by the former is larger than that by the latter. However, the steady-state errors of the riser under the latter are slightly smaller than that under the former; (iv) the introduced time-delays with proper size play positive role of suppressing recoil response of the system, and the corresponding delayed H_∞ controller series provide more options for recoil control of the riser.

Intelligent Event-Based Fuzzy Dynamic Positioning Control of Nonlinear Unmanned Marine Vehicles Under DoS Attack

This article addresses the dynamic positioning control problem of a nonlinear unmanned marine vehicle (UMV) system subject to network communication constraints and deny-of-service (DoS) attack, where the dynamics of UMV are described by a Takagi-Sugeno (T-S) fuzzy system (TSFS). In order to save limited communication resource, a new intelligent event-triggering mechanism is proposed, in which the event triggering threshold is optimized by a Q -learning algorithm. Then, a switched system approach is proposed to deal with the aperiodic DoS attack occurring in the communication channels. With a proper piecewise Lyapunov function, some sufficient conditions for global exponential stability (GES) of the closed-loop nonlinear UMV system are derived, and the corresponding observer and controller gains are designed via solving a set of matrix inequalities. A benchmark nonlinear UMV system is adopted as an example in simulation, and the simulation results validate the effectiveness of the proposed control method.

A resource-aware control approach to vehicle platoons under false data injection attacks

Wireless vehicle-to-vehicle communication brings inevitable imperfections. This work simultaneously addresses the resource utilization and security issues for a vehicle platoon. Inspired by the modeling of denial of service attacks, a novel queuing model is constructed to depict false data injection attacks. A switched event-triggered mechanism is proposed to optimize network resources. The transmission rate can be actively reduced when the system is under malicious attacks. Then, a unified error system is established, where string stability is interpreted as global exponential stability. By using a proper Lyapunov function, a co-design approach is developed for closed-loop controllers and event-triggering parameters, with which the vehicle platoon can maintain a small safety distance and resist the negative impacts of cyber attacks. Finally, the proposed methods are verified by a virtual vehicle platoon.

Security Perspective Analysis of Industrial Cyber Physical Systems (I-CPS): A Decade-wide Survey

Considering the exceptional growth of Cyber Physical Systems (CPSs), multiple and potentially grave security challenges have emerged in this field. Different vulnerabilities and attacks are present in front of new generation CPSs, such as Industrial CPS (I-CPS). The underlying non-uniform standards, device heterogeneity, network complexity, etc., make it difficult to offer a systematized coverage on CPS security in an industrial environment. This work considers the security perspective of I-CPSs, and offers a decade-wide survey including different vulnerabilities, attacks, CPS components, and various other aspects. The comparative year-wise analysis of the existing works w.r.t objective, approach referred, testbed used and derived inference, is also presented over a decade. Additionally, the work details different security issues and research challenges present in I-CPS. This work attempts to offer a concise and precise literature study focused on the state-of-the-art I-CPS security. This work also encourages the young researchers to explore the wide possibilities present in this emerging field.

Machine learning in industrial control system (ICS) security: current landscape, opportunities and challenges

The advent of Industry 4.0 has led to a rapid increase in cyber attacks on industrial systems and processes, particularly on Industrial Control Systems (ICS). These systems are increasingly becoming prime targets for cyber criminals and nation-states looking to extort large ransoms or cause disruptions due to their ability to cause devastating impact whenever they cease working or malfunction. Although myriads of cyber attack detection systems have been proposed and developed, these detection systems still face many challenges that are typically not found in traditional detection systems. Motivated by the need to better understand these challenges to improve current approaches, this paper aims to (1) understand the current vulnerability landscape in ICS, (2) survey current advancements of Machine Learning (ML) based methods with respect to the usage of ML base classifiers (3) provide insights to benefits and limitations of recent advancement with respect to two performance vectors; detection accuracy and attack variety. Based on our findings, we present key open challenges which will represent exciting research opportunities for the research community.

Practical fixed-time trajectory tracking control of constrained wheeled mobile robots with kinematic disturbances

This paper addresses the problem of practical fixed-time trajectory tracking for wheeled mobile robots (WMRs) subject to kinematic disturbances and input saturation. Firstly, considering the under-actuated characteristics of the WMR systems, the WMR model under kinematic disturbances is transformed into a two-input two-output interference system by using a set of output equations. Then, the tracking error state equation with lumped disturbances in the acceleration-level pseudo-dynamic control (ALPDC) structure is established. The lumped disturbances are estimated by a designed fixed-time extended state observer (FESO) without requiring the differentiability of the first-time derivatives of the kinematic disturbances. Meanwhile, a practical fixed-time output feedback control law is developed for trajectory tracking. By resorting to the Lyapunov stability theorem, the fixed-time stability analysis of the closed-loop WMR system in the presence of input saturation is conducted. Finally, simulation results are presented to show the effectiveness of the proposed approach.

Injection attack estimation of networked control systems subject to hidden DoS attack

This paper is concerned with the injection attack estimation for a class of networked control systems with Deny-of-Service (DoS) attack, where unknown signals are injected into the sensor reading and actuator. The main goal is to design an estimator to estimate the injected signals subject to stochastic hidden DoS attack. By introducing a semi-Markov chain, the complex aperiodic sampling behavior caused by DoS attack is first modeled as a stochastic switching system. By using the Lyapunov stability theory and stochastic system analysis method, the σ-error mean square stability (σ-EMSS) conditions of estimation error system are then derived and the state of the attack estimation error system is shown to be uniformly ultimately bounded. Some linear matrix inequalities are proposed to determine the estimation gain matrices. Finally, both simulation and experimental studies on the motor system are conducted, and the effectiveness of the main results are demonstrated.

Event-triggered H∞/passive synchronization for Markov jumping reaction-diffusion neural networks under deception attacks

The issue of H_∞/passive master-slave synchronization for Markov jumping neural networks with reaction-diffusion terms is investigated in this paper via an event-triggered control scheme under deception attacks. To lighten the burden of limited communication bandwidth as well as ensure the control performance, an event-triggered transmission scheme is developed. Meanwhile, the randomly occurring deception attacks, which received from the event generator are assumed to modify the sign of the control signal, are taken into account. Furthermore, sufficient conditions ensuring the prescribed H_∞/passive performance level of the neural networks, are deduced beyond Lyapunov stability theory, and the controller gains are derived dealing with the matrix convex optimization problem. At last, the availability of the approach proposed is demonstrated via a numerical example.

Consensus-based distributed receding horizon estimation

This paper studies the distributed state estimation over sensor networks based on receding horizon estimation (RHE). Firstly, a new scheme of centralized RHE is introduced, which gathers the decomposition terms instead of collecting the measurements of each node. Then, we present a distributed estimate algorithm based on the centralized RHE. To avoid the quadratic programming (QP) problem, the proposed algorithm takes advantage of the analytical solution of the centralized RHE and performs consensus steps to generalize the distributed estimation for each node, which greatly reduces each node's computation. Under the assumption of collective observability over networks, the proposed algorithm can guarantee the stability of estimation error in the case of enough consensus steps. Finally, the simulation results verify the effectiveness of the proposed method.

Event-based fuzzy resilient control of nonlinear DC Microgrids under denial-of-service attacks

This paper focuses on designing an event-triggered fuzzy resilient controller for networked nonlinear DC microgrid (MG) with constant power loads (CPLs) in the presence of denial-of-service (DoS) attacks. First, an attack-resilient event-triggered communication scheme is introduced to reduce the communication overhead of the DC MG while achieving the desired performance despite the presence of the DoS attacks. Second, the nonlinear event-triggered DC MG system with CPLs is modeled as a T-S fuzzy system with artificial delay through the sector nonlinearity approach combined with time-delay system modeling method. Then, by employing the noncontinuous piecewise Lyapunov-Krasovskii functional (NPLKF) approach, the asymptotic stability criterion of the built event-triggered T-S fuzzy DC MG is obtained in the form of linear matrix inequalities (LMIs), and a design method of fuzzy controller is proposed. Finally, case studies are presented to validate the efficiency of our proposed method.

Distributed interval state estimation with l∞-gain optimization for cyber-physical systems subject to bounded disturbance and random stealthy attacks

This paper studies the distributed interval state estimation problem for cyber-physical systems with bounded disturbance and random stealthy attacks. Since conventional interval observers cannot complete the task of real-time monitoring system under random attacks, an attack-resistant distributed interval observer is designed by using attack frequency and interval attack estimation. Using the designed observer, upper- and lower-bounding estimation error systems are modeled by positive interconnected systems with hybrid deterministic and random bounded inputs. To explicitly attenuate the effect of disturbance and attacks, the resulting deterministic positive error system between upper- and lower-bounding estimates is formulated. By linear programming, the results of interval observer design and l_∞-gain optimization are proposed. The remote monitoring of vehicle lateral dynamic is given for numerical verification of the results.

Security tracking control for discrete-time stochastic systems subject to cyber attacks

This paper is concerned with the security tracking problem under the quadratic cost criterion for a class of discrete-time stochastic linear networked control systems (NCSs) exposed to cyber attacks, covering false data injection attacks as well as a class of DoS attacks. Taking into account factors such as network congestion and the defensive role of intrusion detection systems, successful attack events are modeled as a Bernoulli random sequence. To describe the transient trajectory of an NCS under the impact of a random attack, a probabilistic definition of secure trackability is taken. Therefore, an observer-based dynamic output feedback controller is designed in order to achieve the specified probabilistic secure trackability. Specifically, the probabilistic safety output tracking problem is transformed into an input-to-state stability problem in the probabilistic sense for closed-loop systems with some new sufficient conditions, provided that an augmented incremental model is utilized Then, the controller parameters and the upper bound of the quadratic cost function are determined by solving matrix inequalities, while easy-solution forms of the matrix inequalities to be solved are presented by the Schur complementary lemma. Both simulation studies and practical experiments demonstrate the effectiveness of the proposed control scheme.

Key Concepts of Systemological Approach to CPS Adaptive Information Security Monitoring

Modern cyber-physical systems (CPS) use digital control of physical processes. This allows attackers to conduct various cyberattacks on these systems. According to the current trends, an information security monitoring system (ISMS) becomes part of a security management system of CPS. It provides information to make a decision and generate a response. A large number of new methods are aimed at CPS security, including security assessment, intrusion detection, and ensuring sustainability. However, as a cyber-physical system operates over time, its structure and requirements may change. The datasets available for the protection object (CPS) and the security requirements have become dynamic. This dynamic effect causes asymmetry between the monitoring data collection and processing subsystem and the presented security tasks. The problem herein is the choice of the most appropriate set of methods in order to solve the security problems of a particular CPS configuration from a particular bank of the available methods. To solve this problem, the authors present a method for the management of an adaptive information security monitoring system. The method consists of solving a multicriteria discrete optimization problem under Pareto-optimality conditions when the available data, methods or external requirements change. The experimental study was performed on an example of smart home intrusion detection. In the study, the introduction of a constraint (a change in requirements) led to the revision of the monitoring scheme and a different recommendation of the monitoring method. As a result, the information security monitoring system gains the property of adaptability to changes in tasks and the available data. An important result from the study is the fact that the monitoring scheme obtained using the proposed management method has a proven optimality under the given conditions. Therefore, the asymmetry between the information security monitoring data collection and processing subsystem and the set of security requirements in cyber-physical systems can be overcome.