PaperlayerView exact revision on arXiv

Source-linked AI summary

Resilient Machine Learning for Networked Cyber Physical Systems: A Survey for Machine Learning Security to Securing Machine Learning for CPS

Felix Olowononi, Danda B. Rawat, Chunmei Liu

arXiv:2102.07244v1cs.CRcs.AIcs.LG

TL;DR

CPS security research increasingly uses machine learning to detect and withstand attacks, but adversarial machine learning shows that these protective algorithms must themselves be resilient. This survey examines resilient CPS using ML alongside resilient ML for CPS, synthesizing attack, defense, and research trends across DNN and RL.

  • Problem

    Traditional CPS security emphasizes access control and attack detection, while increasingly capable adversaries make it difficult to prevent attacks entirely and expose ML-based defenses to adversarial attacks.

  • Method

    The paper comprehensively surveys recent adversarial attacks and defenses for DNN and RL, focusing on their interactions with ML-enabled resilient CPS and resilient ML applied to CPS.

  • Results

    The survey organizes advances in CPS attack detection, resilient CPS recovery, and defenses against adversarial attacks in DNN and RL, while identifying continuing research trends.

  • Takeaways & Limitations

    Securing critical CPS requires attention not only to attacks on physical systems but also to the resilience of the ML algorithms used for defense.

Abstract

from arXiv · show

Cyber Physical Systems (CPS) are characterized by their ability to integrate the physical and information or cyber worlds. Their deployment in critical infrastructure have demonstrated a potential to transform the world. However, harnessing this potential is limited by their critical nature and the far reaching effects of cyber attacks on human, infrastructure and the environment. An attraction for cyber concerns in CPS rises from the process of sending information from sensors to actuators over the wireless communication medium, thereby widening the attack surface. Traditionally, CPS security has been investigated from the perspective of preventing intruders from gaining access to the system using cryptography and other access control techniques. Most research work have therefore focused on the detection of attacks in CPS. However, in a world of increasing adversaries, it is becoming more difficult to totally prevent CPS from adversarial attacks, hence the need to focus on making CPS resilient. Resilient CPS are designed to withstand disruptions and remain functional despite the operation of adversaries. One of the dominant methodologies explored for building resilient CPS is dependent on machine learning (ML) algorithms. However, rising from recent research in adversarial ML, we posit that ML algorithms for securing CPS must themselves be resilient. This paper is therefore aimed at comprehensively surveying the interactions between resilient CPS using ML and resilient ML when applied in CPS. The paper concludes with a number of research trends and promising future research directions. Furthermore, with this paper, readers can have a thorough understanding of recent advances on ML-based security and securing ML for CPS and countermeasures, as well as research trends in this active research area.

I. INTRODUCTION

CPS integrate computing, communication, sensing, and control to automate processes, but their critical applications face severe safety and security risks. This survey examines ML-based CPS security alongside the resilience of ML models themselves.

  • CPS use feedback from sensors to direct actuators, extending IoT with control and enabling greater automation.
  • Critical CPS deployments generate substantial data for decisions such as fault prediction, diagnosis, and predictive maintenance.
  • CPS deployment is constrained by real-time requirements, network delays, and failures that can cause greater harm to people and infrastructure than traditional IT failures.
  • ML-based cybersecurity introduces a new vulnerability because adversaries can tamper with sensor-derived inputs and force incorrect model outputs.
  • The survey addresses these gaps by reviewing resilient CPS using ML, resilient ML for CPS, adversarial attacks, defenses, GANs, research trends, and future directions.

II. OVERVIEW OF MACHINE LEARNING

The paper introduces supervised, unsupervised, and reinforcement learning as data-driven ML categories used for CPS tasks. It also outlines common model architectures and evaluation concepts relevant to CPS applications.

  • ML is data-driven and is applied in CPS partly because numerous sensors generate large amounts of data.
  • Supervised learning maps inputs to labeled outputs and commonly supports classification and regression using accuracy, precision, recall, and F1-score.
  • Artificial neural networks combine neuron-like units, while multilayer perceptrons improve on simple perceptrons through multiple connected layers.
  • Support vector machines identify decision boundaries in feature space and are used for classification, regression, and outlier detection.
  • k-nearest neighbors predicts a test point’s class from majority voting among its K nearest training examples and requires no distributional assumptions.

B. Unsupervised Learning

Unsupervised learning extracts structure from unlabeled data through tasks such as clustering and dimensionality reduction. The section introduces K-means, PCA, and reinforcement learning concepts that support sequential decision-making.

  • Unsupervised learning uses unlabeled data to discover hidden insights through clustering, dimensionality reduction, density estimation, anomaly detection, and visualization.
  • K-means partitions data points into K clusters by assigning each point to its nearest cluster centroid.
  • PCA projects data onto a nearby hyperplane through an orthogonal transformation, reducing features while retaining information needed for training.
  • Reinforcement learning trains an agent through trial-and-error interactions with an environment, using rewards and punishments to guide decisions.
  • RL balances exploitation of learned rewards with exploration of alternative actions, and includes policies, reward signals, value functions, and environment models.
  • Q-learning estimates discounted cumulative rewards for state-action pairs, while later RL algorithms include DQN, A3C, TRPO, DDPG, and PPO.

2) Deep Q Network (DQN):

The section situates deep learning and DQN within CPS applications, emphasizing their use for intelligent control, security, and vehicular systems. It also notes that CPS applications face adversarial and operational constraints.

  • Deep learning uses multiple hidden layers for high-level feature abstraction, generalization, and improved performance in CPS tasks.
  • ML in CPS supports malware detection, resource allocation, anomaly detection, fault prediction, preventive maintenance, and attack detection.
  • Vehicular CPS use cameras, sensor networks, and positioning systems in driver-assistance functions such as cooperative cruise control and collision avoidance.
  • Vehicular CPS face denial-of-service, man-in-the-middle, replay, and false-data-injection attacks that can alter measurements, inputs, or control laws.
  • Adversarial examples and GANs can craft inputs that cause autonomous vehicles to make incorrect decisions.

B. Industrial Cyber Physical Systems (ICPS)

Industrial, medical, and smart-grid CPS connect distributed devices, controllers, and actuators, but their wireless and networked interfaces expose them to serious attacks. Machine learning supports detection, adaptive protection, and resilience, while the surveyed systems still require resilient ML methods.

  • Industrial Cyber Physical Systems (ICPS): ICPS connect sensors, devices, actuators, and controllers across industrial communication networks to monitor and execute actions on plant data.The paper associates ICPS with industrial systems, IIoT, and Industry 4.0.
  • Industrial Cyber Physical Systems (ICPS): Stuxnet illustrates how malware can propagate through an industrial network, target specific control components, and compromise plant operations.The attack used a USB drive, propagated to target systems, and sought Siemens high-speed centrifuges.
  • Industrial Cyber Physical Systems (ICPS): ML-based firewalls and adaptive rules have been explored for industrial CPS security, including efforts to eliminate false positives and avoid false alarms.The cited firewall learns from labeled samples and self-configures preventive rules.
  • Medical Cyber Physical Systems: Medical CPS remotely monitor vital signs and automatically respond through body and wireless sensor networks, but their wireless links enable privacy, disruption, replay, and false-data attacks.Examples include wearable devices, pacemakers, and insulin pumps.
  • Smart Grids: Smart-grid communications face false-data-injection and denial-of-service attacks, while ML methods use operational sensor data for fault and attack response.A cited approach combines supervised SVM and unsupervised PCA for stealthy false-data-injection detection; adversarial retraining addresses ML resilience.

E. Reinforcement Learning Applications in CPS

Machine learning, especially reinforcement learning, is being applied across CPS for automation, attack detection, and resilient operation. The surveyed work shows promise, but practical deployment still requires attention to security, computational complexity, delay, and safety.

  • Applications: RL has been used for CPS quality assurance, including falsification approaches for heterogeneous and black-box systems.The cited work uses a trained RL agent to explore CPS behavior for quality assurance.
  • Applications: Reinforcement learning has been applied primarily to power systems and intelligent transportation systems, including energy management and autonomous-vehicle tasks.RL learns control policies in large state spaces and supports decision-making from sensor data.
  • Deployment limits: Most reported DRL applications remain theoretical, while real-world deployment still requires stronger safety and security validation.The survey also identifies computational complexity, delay, and test-bed evaluation as important practical concerns.
  • Attack detection: Machine learning has supported CPS attack detection by modeling physical behavior and analyzing statistical, spatial, and temporal relationships in system data.The surveyed methods include physical-domain monitoring, CNN autoencoders, ConvLSTM encoder-decoders, and classifiers for synchronization attacks.
  • Resilience: ML-based methods have also been used to improve CPS resilience, including recovery to learned states and online learning of defense and attack policies.One DRL-based game-theoretic method models cyber-state dynamics and learns policies in real time.

B. Generative Adversarial Networks (GAN) for resilient CPS

GANs generate data through a generator–discriminator game and have become relevant to cybersecurity because they can both create deceptive samples and support defensive training. Their defensive use targets robustness and resilience against adversarial behavior.

  • GAN fundamentals: GANs are generative models whose generator creates samples while a discriminator evaluates whether they resemble the training distribution.The two neural networks are trained in an adversarial game in which the generator seeks to deceive the discriminator.
  • Properties: GANs offer practical generative advantages, including parallel sample generation and no requirement for Markov chains.The passage also notes relatively flexible generator functions and comparatively better samples, while identifying Nash-equilibrium search as a drawback.
  • Cybersecurity use: GANs can support cybersecurity defenses by generating fake samples that expose adversarial behavior and improve training-data robustness.The surveyed work presents GANs as useful not only for compromising systems but also for defending them.

2) The role of GAN’s for resilient CPS:

GAN-based methods can improve CPS resilience by learning normal control-loop or sensor behavior, detecting anomalies, and supporting recovery from attacks. This extends ML and GAN use beyond attacking systems toward mitigating attacks in CPS.

  • Motivation: CPS control loops are vulnerable because ML-based learning and estimation can be fooled by adversarial samples, compromising system integrity.The cited work notes that existing controllers may fail to detect, prevent, or recover from anomalous control-loop behavior.
  • GAN-based resilience: Conditional GANs learn normal interactions between a physical system and its controller to identify anomalous behavior and predict the correct state for recovery.Tests reported detection and recovery from anomalous behaviors in vehicular CPS.
  • GAN-based resilience: GAN-based anomaly detection has also modeled normal multivariate sensor streams and identified attack-induced anomalies using SWaT data.The approach used separate GAN roles to model normal sensor distributions and detect anomalies.
  • Implication: The surveyed evidence presents ML and GANs as tools that can both threaten CPS security and mitigate attacks against CPS.The paper identifies GANs as a continuing area of development for CPS applications.

B. Classification of attacks on ML

Attacks on ML models are classified by attacker goals, attack stage, and available model knowledge, with adversarial examples using small perturbations to induce misclassification. These distinctions organize the threat surface relevant to ML-enabled CPS.

  • Attack goals: Attack goals include confidence reduction, random misclassification, and targeted misclassification.Confidence reduction introduces ambiguity, whereas the other goals alter the output classification randomly or toward a chosen class.
  • Attack stage: Attacks may occur during training through data or logic manipulation, or during testing to induce incorrect classifications after training.The survey notes that training-stage attacks have been common because of their relative simplicity.
  • Attacker knowledge: White-box attacks assume knowledge of model parameters and architecture, whereas black-box attacks infer input–output relationships with little or no internal knowledge.The survey also identifies grey-box attacks as a hybrid category but focuses on white- and black-box settings.
  • Adversarial examples: Adversarial examples seek minimal perturbations that preserve similarity to normal inputs while causing the target model to misclassify.The cited formulation expresses an adversarial input as x + η, where η is the perturbation.
  • CPS relevance: Understanding perturbation generation is particularly relevant to autonomous vehicles because image classification and pattern recognition support driving decisions.The survey links this understanding to the development of countermeasures for resilient vehicle systems.

1) Fast Gradient Sign Method (FGSM):

FGSM crafts adversarial examples by perturbing inputs in the loss-gradient direction, offering a fast and resource-efficient attack whose limitations motivate iterative and momentum-based variants.

  • FGSM: FGSM generates adversarial examples by adding perturbations based on the sign of the loss gradient with respect to input features.The method was developed from the observation that deep-learning models are susceptible to gradient-directed perturbations.
  • FGSM: The perturbation uses a magnitude parameter ϵ and can fool DNNs into making wrong classifications on MNIST and CIFAR-10.The cited formulation defines η as the perturbation and ϵ as its size parameter.
  • Limitations and variants: FGSM has low success rates against black-box models, motivating momentum-based iterative methods that improve transferability across white- and black-box settings.Momentum methods iteratively accumulate gradient directions to stabilize updates.
  • FGSM: FGSM is fast, simple, and computationally inexpensive, making it practical for testing adversarial-training defenses.Its practical value is linked to its low computational requirements and widespread use in resilience research.
  • Limitations and variants: BIM iteratively applies smaller perturbations, gives the adversary greater control, and can fool networks despite adversarial training designed against one-step FGSM attacks.The cited discussion states that iterative attacks require adaptive defenses.
  • Limitations and variants: Carlini–Wagner attacks use L2, L0, or L∞ norms and successfully fooled networks protected by defensive distillation.The three variants are presented as tests of defenses against adversarial examples.

5) DeepFool:

The supplied passages place DeepFool within a broader account of adversarial attacks on deep and reinforcement-learning systems, emphasizing minimal perturbations, targeted manipulation, and CPS actuator impacts.

  • DeepFool: DeepFool uses geometric reasoning and iterative classifier linearization to find the minimum perturbation that causes misclassification.It uses L2 minimization to search for adversarial examples.
  • Adversarial attacks in RL: The survey identifies adversarial attack research in deep reinforcement learning as an emerging concern for robotics and autonomous vehicles.It notes that attacks commonly target the environment state.
  • Adversarial attacks in RL: In reinforcement learning, attacks can target rewards, policies, environment states, or action spaces corresponding to CPS actuators.The survey distinguishes attacks on the agent’s state-related signals from attacks targeting actions.
  • Adversarial attacks in RL: Strategically timed attacks can achieve the effect of uniform-step attacks while attacking the agent four times less.The attacks use predicted future states and planned actions to lure the agent toward a target state.
  • Adversarial attacks in RL: Black-box RL attacks are more challenging than white-box attacks because the adversary lacks internal model architecture and parameter information.The survey notes that relatively few studies had reported black-box RL results.
  • Adversarial attacks in RL: Proxy models trained on similar tasks can generate adversarial samples that compromise reinforcement-learning agents.The cited threat model involves eavesdropping on subsets of reinforcement-learning signals over time.

E. Summary and lessons learnt

The paper highlights underexplored adversarial risks in unsupervised learning and argues that CPS security requires resilient ML models. It organizes defenses around input, network, and objective-function modifications.

  • Lessons learned: Adversarial-attack research has focused mainly on supervised models and transferability, while unsupervised learning remains less investigated because adversarial examples are harder to define without labels.The survey expects supervised and reinforcement learning to continue receiving more attention.
  • Lessons learned: ML improves CPS resilience, but the ML models themselves remain vulnerable to data poisoning, adversarial examples, and GAN-based attacks.The paper frames model resilience as necessary for the safety and security of deployed systems.
  • Defense strategies: The survey groups resilient-ML defenses into input modification, network-structure modification, and objective-function modification.Examples include adversarial training, input transformations, defensive distillation, detector subnetworks, stability terms, and stochastic activation pruning.
  • Defense strategies: Adversarial training hardens models with generated examples and aims to minimize worst-case error under adversarial input perturbations.The survey describes it as one of the strongest methods for improving ML resilience.
  • Defense strategies: Ensemble and cascade adversarial training separate example generation or address unknown iterative attacks to improve robustness, including against black-box attacks.These are presented as variants developed to address limitations of the initial adversarial-training approach.

2) Mitigation against adversarial examples through randomization:

The paper surveys randomization, defensive distillation, gradient masking, and detection-based defenses, while emphasizing that evolving attacks continue to expose weaknesses in existing protections.

  • Randomization: Inference-time random resizing and padding can improve robustness against adversarial images, including iterative white-box and black-box attacks.
  • Defensive distillation: Defensive distillation transfers knowledge through soft labels from one trained network to a second distilled network and was reported effective against FGSM and Jacobian-based iterative attacks.
  • Defensive distillation: Defensive distillation is more effective against white-box than black-box attacks, and combining it with adversarial training was proposed to improve efficiency.
  • Gradient masking: Gradient masking protects neural networks by preventing attackers from obtaining model gradients, but substitute-model attacks can weaken defenses based only on blocking gradient descent.
  • Detection: Feature squeezing, density and Bayesian uncertainty estimates, and SafetyNet detect adversarial examples by analyzing input statistics, uncertainty, or consistency between image and depth data.
  • Lessons learned: No defense method adequately withstands all attack mechanisms, so proposed defenses should be tested against many attacks and reevaluated for exploitable loopholes.

B. Defense against adversarial attacks in RL

Defense research for adversarial attacks in reinforcement learning includes detection, distillation, robust training, and robustness certification. The literature remains comparatively immature, with methods targeting both attack mitigation and verified control robustness.

  • Threats and motivation: Attacking one pixel, representing 0.01% of the state, or approximately 1% of frames totally fooled a DQN policy.
  • Defense categories: DRL defenses are commonly categorized as adversarial training, robust learning, adversarial detection, and defensive distillation, but many techniques originate from DNN research.
  • Detection and mitigation: The MLAH algorithm uses an advantage map to detect attacks and switches between nominal and adversarial subpolicies according to the attack scenario.
  • Detection and mitigation: Visual foresight detects adversarial examples by comparing the policy action on the current frame with the action generated from a predicted frame.
  • Robustness certification: Robustness certification has been extended to DRL feedback control under persistent adversarial attacks and performed better than conventional Lipschitz-based robust control when model dynamics were unknown.
  • Training-based defenses: Policy distillation with adversarial training can lose robustness against new attacks and increase computational cost, motivating alternative policy-distillation methods.
  • Research outlook: DRL adversarial defense remains in its infant stage, while intermittent attacks, adversarial rewards, and black-box attack construction remain concerns for safety-critical CPS.

VII. OPEN RESEARCH CHALLENGES AND FUTURE DIRECTIONS

The paper identifies future directions spanning computationally efficient adversarial training, context-aware and federated learning, and methods for distinguishing malicious behavior from CPS component failures. It also argues that security must be incorporated during system design.

  • Efficient resilient learning: Adaptive adversarial training selectively perturbs inputs to reduce the computational cost and poorer generalization associated with perturbing every training input.
  • Context awareness: Context-aware machine learning can gather environmental information and adapt behavior, supporting machine-to-machine, IoT, and vehicular communication settings.
  • Federated learning: Federated learning lets resource-constrained edge devices learn a shared prediction model while keeping training data local.
  • CPS diagnosis: CPS security must distinguish malicious attacks from faulty sensors and other component failures that produce incorrect readings and outputs.
Loading 2102.07244v1…