Source-linked AI summary
A Secure Control Framework for Resource-Limited Adversaries
André Teixeira, Iman Shames, Henrik Sandberg, Karl H. Johansson
TL;DR
Networked control systems require security analysis that accounts for adversaries with different knowledge and resources. The paper introduces an attack-space framework, models replay, zero-dynamics, and bias injection scenarios, and experimentally illustrates their effects on a wireless quadruple-tank process. It also derives the maximum impact of stealthy bias injection attacks and shows that the corresponding policy does not require perfect model knowledge.
Problem
Recent control-system cybersecurity work largely considers adversaries with extensive resources and knowledge, leaving much of the attack space insufficiently addressed.
Method
The paper defines an attack space using system knowledge, disclosure resources, and disruption resources, then maps attack policies and scenarios onto this adversary model.
Results
The framework analyzes replay, zero-dynamics, and bias injection attacks, while experiments demonstrate unsafe-state consequences and undetected operation in the quadruple-tank process.
Takeaways & Limitations
Stealthy bias injection can have bounded maximum impact without requiring perfect model knowledge, and the attack scenarios can be illustrated over a wireless control network.
Takeaways & Limitations
The output-peak bounds are generally conservative, so the associated conditions are only sufficient.
Abstract
from arXiv · showhide
Cyber-secure networked control is modeled, analyzed, and experimentally illustrated in this paper. An attack space defined by the adversary's system knowledge, disclosure, and disruption resources is introduced. Adversaries constrained by these resources are modeled for a networked control system architecture. It is shown that attack scenarios corresponding to denial-of-service, replay, zero-dynamics, and bias injection attacks can be analyzed using this framework. Furthermore, the attack policy for each scenario is described and the attack's impact is characterized using the concept of safe sets. An experimental setup based on a quadruple-tank process controlled over a wireless network is used to illustrate the attack scenarios, their consequences, and potential counter-measures.
1 Introduction
The paper frames cyber attacks on networked control systems through an attack space defined by adversary knowledge and resources. It organizes several attack scenarios and proposes a framework for analyzing their policies, impact, and experimental consequences.
- Cyber attacks make networked control systems vulnerable because communication networks and heterogeneous IT components support critical monitoring and control functions.
- The attack space has three dimensions: a priori system model knowledge, disclosure resources, and disruption resources.
- Disclosure resources expose system information but cannot by themselves disrupt operation, whereas disruption resources affect system availability or integrity.
- 1.1 Related Work: Prior work has emphasized adversaries with extensive knowledge and resources, leaving much of the attack space and detectable attacks without conventional alarms insufficiently studied.
- 1.2 Contributions and Outline: The paper maps attack policies and capabilities to the attack-space dimensions, formalizes unsafe-state goals using safe regions, and analyzes multiple attack scenarios experimentally.
- 1.2 Contributions and Outline: Bias injection is presented as a detectable attack that can drive the system unsafe with limited model knowledge and no system-state information.
2 Networked Control System
The paper models a networked control system as a physical plant, communication network, feedback controller, and anomaly detector. It defines nominal behavior, attack-relevant signals, and residual-based anomaly detection.
- The networked control architecture contains a physical plant and communication network, a feedback controller, and an anomaly detector.
- The plant model includes state, applied control actions, sensor measurements, an unknown anomaly signal, and bounded process and measurement noise.
- Nominal behavior requires no fault signal and matching control and measurement data at the plant and controller ends.
- The anomaly detector uses controller-side measurements and control data to evaluate deviations from nominal system behavior.
- An observer-based fault detection filter produces state and output estimates plus a residue used to detect and locate anomalies.
- An alarm is triggered when the residue norm reaches the detection threshold δ_r + δ_α, with δ_α selected to limit the false alarm rate.
3 Adversary Models
The adversary model combines an attack policy with system knowledge, disclosure resources, and disruption resources. These resources determine what information the adversary can obtain and how the attack vector affects the control system.
- The adversary model consists of an attack policy and three resource classes: system model knowledge, disclosure resources, and disruption resources.
- The attack policy maps the adversary’s knowledge and gathered information to an attack vector that can affect system behavior.
- 3.2 System Knowledge: Replay attacks require no system-component knowledge, while covert attacks require full knowledge of the plant, controller, and detector.
- 3.3 Disclosure Resources: Disclosure resources specify accessible actuator and sensor channels and provide sequences of control actions and measurements gathered during an attack.
- 3.3 Disclosure Resources: Disclosure attacks gather intelligence without changing the physical dynamics, potentially enabling more complex attacks such as replay attacks.
- Disruption resources determine how the attack vector affects plant, controller, and detector dynamics, with effects depending on the attack’s physical or cyber nature.
4 Attack Scenarios
The paper analyzes stealthy attacks aimed at driving a networked control system outside a safe state under resource and knowledge constraints. Denial-of-service, replay, zero-dynamics, and bias injection scenarios are characterized through their policies, impacts, and required adversary capabilities.
- Framework: The adversary model captures system knowledge, disclosure resources, disruption resources, and attack intent under a stealthiness constraint.Attack policies are evaluated by their impact on system operation and detectability.
- Framework: A system is safe when its state belongs to the closed, compact set Sx; an attack succeeds when the state leaves that set.The analysis assumes the system begins in a safe state.
- Denial-of-Service Attack: Denial-of-service attacks are modeled by replacing unavailable data with the last received value, and Bernoulli DoS attacks preserve exponential stability for specified packet-loss probabilities when the unattacked closed loop is stable.The DoS mechanism can be interpreted as a disruptive deception attack affecting selected actuator and sensor channels.
- Replay Attack: Replay attacks gather data before the attack and replay it afterward; stealthiness with partial channel access may require plant-structure knowledge, while impact depends on the physical attack signal.The framework also permits replay combined with a physical open-loop attack.
- Zero-Dynamics Attack: Zero-dynamics attacks require perfect plant knowledge; stable zeros yield decaying attacks, whereas unstable zeros can drive the system unsafe when span(x0) is not contained in Sx.For |ν| > 1, the attack generates an unstable state trajectory moving away from the origin along span(x0).
- Bias Injection Attack: Bias injection attacks optimize a constant bias while using a slowly converging low-pass transient; their impact is evaluated through closed-loop gains, and steady-state bias alone does not establish α-stealthiness.The paper provides boundedness and sufficient conditions for the optimization and transient stealthiness analysis.
5 Experiments
Experiments on a wireless quadruple-tank process illustrate denial-of-service, replay, zero-dynamics, and bias-injection attacks under the proposed secure-control framework. The attacks produce distinct combinations of stealthiness, unsafe states, residual changes, and recovery behavior.
- 5.1 Quadruple-Tank Process: The testbed uses a Quadruple-Tank Process controlled through a multi-hop wireless network with centralized LQG control and Kalman-filter-based anomaly detection.The network includes an additional wireless relay, and alarm thresholds are selected for illustration.
- 5.2 Denial-of-Service Attack: Under DoS against both sensors, packet losses increased the residual after t ≈100 s, but it stayed below threshold without significant state changes.The attack used a Bernoulli packet-loss model with p = 0.9 and held the last received data when packets were lost.
- 5.3 Replay Attack: The replay attack on sensor 2 enabled tank 4 to be emptied while the residual stayed below the alarm threshold until the system recovered its original setpoint.Replay began at t ≈90 s, water removal ran from approximately 100 s to 180 s, and replay continued until approximately 280 s.
- 5.4 Zero-Dynamics Attack: The zero-dynamics attack emptied tank 3 at t ≈55 s before the residual crossed its threshold after actuator saturation.The residual was still below threshold when the unsafe state was reached; saturation changed the dynamics and exposed the attack.
- 5.5 Bias Injection Attack: The bias injection caused tank 4 to overflow at t ≈225 s while the residual remained within allowable bounds throughout the attack.The bias began at t ≈70 s, used a first-order low-pass filter with β = 0.95, and the system later recovered its original setpoint.
6 Conclusions
The paper proposes a resource-based framework for analyzing cyber attacks on networked control systems and illustrates it experimentally. It derives and demonstrates attack policies for several scenarios, including a stealthy bias-injection policy that does not require perfect model knowledge.
- 6 Conclusions: The paper proposes an attack space based on the adversary’s system knowledge, disclosure resources, and disruption resources.It also describes the corresponding adversary model for networked control systems.
- 6 Conclusions: Replay, zero-dynamics, and bias-injection attacks are analyzed within the proposed framework and illustrated using a wireless quadruple-tank process.The paper also discusses denial-of-service attacks in the broader framework.
- 6 Conclusions: The maximum impact of stealthy bias-injection attacks is derived, and the corresponding policy does not require perfect model knowledge.This conclusion concerns the bias-injection scenario analyzed in the paper.
A Proof of Lemma 11
The proof establishes spectral and definiteness properties of the generalized eigenvalues of (P, Q), culminating in the characterization of the null direction associated with the largest eigenvalue.
- A Proof of Lemma 11: A coordinate transformation separates ker(Q) from its complement and reduces the definiteness question for P − λQ to the transformed matrices ˜P and ˜Q.The transformation is induced by T = [V̄_N V_N], with V_N spanning ker(Q).
- A Proof of Lemma 11: All generalized eigenvalues of (P, Q) are non-negative, implying that λ∗ ≥ 0.The argument uses ˜Q ≻ 0 and ˜P ⪰ 0 after transformation.
- A Proof of Lemma 11: For every generalized eigenvalue λ in (0, λ∗), the matrix ˜P − λ˜Q is indefinite.Evaluating the quadratic form at an associated generalized eigenvector gives opposite signs across eigenvalues on either side of λ.
- A Proof of Lemma 11: At λ∗, ˜P − λ∗˜Q is negative semidefinite because λ∗ is the largest eigenvalue of the positive semidefinite matrix M˜PM.Here M = ˜Q^−1/2 and the transformed inequality is equivalent to M˜PM − λ∗I ⪯ 0.
- A Proof of Lemma 11: The equality xᵀ(P − λ∗Q)x = 0 with Qx ≠ 0 holds exactly when x lies in the span of the generalized eigenvector v∗.The proof transfers the characterization to the transformed matrices and uses the eigenspace associated with λ∗.