Data-Injection Attacks in Stochastic Control Systems: Detectability and Performance Tradeoffs

TL;DR

This paper investigates the fundamental limits and tradeoffs involved in detecting data-injection attacks in stochastic control systems, focusing on how stealthy attacks can degrade system performance while remaining undetected.

Contribution

It characterizes the detectability limits and quantifies the performance tradeoffs for stealthy data-injection attacks in stochastic control systems.

Findings

Identifies conditions under which attacks are detectable

Quantifies the performance degradation caused by stealthy attacks

Provides theoretical bounds on attack detectability

Abstract

Consider a stochastic process being controlled across a communication channel. The control signal that is transmitted across the control channel can be replaced by a malicious attacker. The controller is allowed to implement any arbitrary detection algorithm to detect if an attacker is present. This work characterizes some fundamental limitations of when such an attack can be detected, and quantifies the performance degradation that an attacker that seeks to be undetected or stealthy can introduce.

Equations

$$h(x_i^j)\triangleq {\int }_{-\infty }^{\infty }-f_{{\tilde{x}}_i^j}(t_i^j)\log f_{{\tilde{x}}_i^j}(t_i^j)d{t}_i^j.$$

$$D\big{(}x_{1}^{k}\big{\|}y_{1}^{k}\big{)}\triangleq\int_{-\infty}^{\infty}\log\frac{f_{x_{1}^{k}}(t_{1}^{k})}{f_{y_{1}^{k}}(t_{1}^{k})}f_{x_{1}^{k}}(t_{1}^{k})dt_{1}^{k}.$$

$$x_{k+1}$$

$$y_k$$

$${\hat{x}}_{k+1}=A{\hat{x}}_k+K_k(y_k-C{\hat{x}}_k)+B{u}_k,$$

$$K_k$$

$$P_{k+1}$$

$${\Sigma }_z=CP{C}^T+{\Sigma }_v\in {\mathbb{S}}_{++}^{N_y}.$$

$${\tilde{x}}_{k+1}$$

$${\tilde{y}}_k$$

$$H_0:$$

$$H_1:$$

$$\underset{k\to \infty }{\mathrm{limsup}}-\frac{1}{k}\log p_k^F\le ϵ.$$

$${\hat{\tilde{x}}}_{k+1}=A{\hat{\tilde{x}}}_k+K{\tilde{z}}_k+B{u}_k,$$

$$\mathbb{E}\left[{\left({\hat{\tilde{y}}}_k-y_k\right)}^T{\Sigma }_z^{-1}\left({\hat{\tilde{y}}}_k-y_k\right)\right]=\text{Tr}({\tilde{P}}_{k}W),$$

$${\tilde{P}}_W$$

$$\lim_{k\to\infty}\frac{1}{k}D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)}\leq\epsilon.$$

$$\frac{1}{k}D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)}=\frac{1}{k}\sum_{n=1}^{k}\Big{(}I\big{(}{\tilde{z}}_{1}^{n-1};{\tilde{z}}_{n}\big{)}+D\big{(}{\tilde{z}}_{n}\big{\|}z_{n}\big{)}\Big{)},$$

$$\displaystyle D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)}=D\big{(}{\tilde{z}}_{1}^{k}\big{\|}z_{1}^{k}\big{)},$$

$$\displaystyle\frac{1}{k}D\big{(}{\tilde{z}}_{1}^{k}\big{\|}z_{1}^{k}\big{)}$$

$$\displaystyle\stackrel{{\scriptstyle(b)}}{{=}}\frac{1}{k}\sum_{n=1}^{k}\Big{(}-h\big{(}{\tilde{z}}_{n}\big{|}{\tilde{z}}_{1}^{n-1}\big{)}+h({\tilde{z}}_{n})$$

$$\displaystyle\qquad\qquad-h({\tilde{z}}_{n})-{\mathbb{E}}\big{[}\log f_{z_{n}}(z_{n})\big{]}\Big{)}$$

$$\displaystyle=\frac{1}{k}\sum_{n=1}^{k}\Big{(}I\big{(}{\tilde{z}}_{1}^{n-1};{\tilde{z}}_{n}\big{)}+D\big{(}{\tilde{z}}_{n}\big{\|}z_{n}\big{)}\Big{)},$$

$$\bar{\delta }(x)=2x+1+\log \bar{\delta }(x).$$

$$\bar{\delta }(\gamma )=$$

$$\text{subject to }\frac{1}{2}x-\gamma -\frac{1}{2}\le \frac{1}{2}\log x.$$

$$\frac{1}{2k}\sum_{n=1}^{k}{\text{tr}}\big{(}{\mathbb{E}}\big{[}{\tilde{z}}_{n}{\tilde{z}}_{n}^{T}\big{]}\Sigma_{z}^{-1}\big{)}\leq\frac{N_{y}}{2}+\frac{1}{k}D\big{(}{\tilde{z}}_{1}^{k}\big{\|}z_{1}^{k}\big{)}+\\ \frac{N_{y}}{2}\log\Bigg{(}\frac{1}{N_{y}k}\sum_{n=1}^{k}{\text{tr}}\big{(}{\mathbb{E}}[{\tilde{z}}_{n}{\tilde{z}}_{n}^{T}]\Sigma_{z}^{-1}\big{)}\Bigg{)}.$$

$$\frac{1}{N_{y}k}\sum_{n=1}^{k}{\text{tr}}\big{(}{\mathbb{E}}\big{[}{\tilde{z}}_{n}{\tilde{z}}_{n}^{T}\big{]}\Sigma_{z}^{-1}\big{)}\leq\bar{\delta}\Big{(}\frac{1}{N_{y}k}D\big{(}{\tilde{z}}_{1}^{k}\big{\|}z_{1}^{k}\big{)}\Big{)},$$

$$x$$

$$\gamma$$

$$C{P}_k{C}^T$$

$$C{\tilde{P}}_k{C}^T$$

$$z_k=y_k-C{\hat{x}}_k=C(x_k-{\hat{x}}_k)+v_k,$$

$${\tilde{z}}_k=C({\tilde{x}}_k-{\hat{\tilde{x}}}_k)+v_k.$$

$$C{P}_k{C}^T+{\Sigma }_v$$

Full text

††thanks: Work supported in part by awards NSF ECCS-1405330 and ONR N00014-14-1-0816. Corresponding author: V. Gupta. Tel. +1 574 631 2294. A preliminary version of this work appeared in Bai et al. (2015). With respect to Bai et al. (2015), this paper (i) considers more general systems with multiple inputs and outputs, (ii) completes and extends technical proofs, and (iii) provides further insight into the design of optimal stealthy attacks in stochastic cyber-physical systems.

, ,

1 Introduction

Using communication channels to inject malicious data that degrades the performance of a cyber-physical system has now been demonstrated both theoretically and practically Farwell & Rohozinski (2011), Kuvshinkova (2003), Mo et al. (2014), Pasqualetti et al. (2013), Richards (2008), Slay & Miller (2007). Intuitively, there is a tradeoff between the performance degradation an attacker can induce and how easy it is to detect the attack Teixeira et al. (2012). Quantifying this tradeoff is of great interest to operate and design secure cyber-physical systems (CPS).

As explained in more detail later, for noiseless systems, zero dynamics provide a fundamental notion of stealthiness of an attacker, which characterizes the ability of an attacker to stay undetected even if the controller can perform arbitrary tests on the data it receives. However, similar notions for stochastic systems have been lacking. In this work, we consider stochastic cyber-physical systems, propose a graded stealthiness notion, and characterize the performance degradation that an attacker with a given level of stealthiness can induce. The proposed notion is fundamental in the sense that we do not constraint the detection test that the controller can employ to detect the presence of an attack.

Related work Security of cyber-physical systems is a growing research area. Classic works in this area focus on the detection of sensor and actuator failures in control systems Patton et al. (1989), whereas more recent approaches consider the possibility of intentional attacks at different system layers; e.g., see Pasqualetti et al. (2015). Both simple attacks, such as jamming of communication channels Foroush & Martínez (2013), and more sophisticated attacks, such as replay and data injection attacks, have been considered Mo & Sinopoli (2010), Smith (2011).

One way to organize the literature in this area is based on the properties of the considered cyber-physical systems. While initial studies focused on static systems Dan & Sandberg (2010), Giani et al. (2011), Liu et al. (2009), Mohsenian-Rad & Leon-Garcia (2011), Teixeira et al. (2010), later works exploited the dynamics of the system either to design attacks or to improve the performance of the detector that a controller can employ to detect if an attack is present Bhattacharya & Başar (2013), Hamza et al. (2011), Maharjan et al. (2013), Manshaei et al. (2011), Zhu & Martínez (2011), Zhu et al. (2013). For noiseless cyber-physical systems, the concept of stealthiness of an attack is closely related to the control-theoretic notion of zero dynamics (Basile & Marro 1991, Section 4). In particular, an attack is undetectable in noiseless systems if and only if it excites only the zero dynamics of an appropriately defined input-output system describing the system dynamics, the measurements available to the security monitor, and the variables compromised by the attacker Fawzi et al. (2014), Pasqualetti et al. (2013). For cyber-physical systems driven by noise, instead, the presence of process and measurements noise offers the attacker an additional possibility to tamper with sensor measurements and control inputs within acceptable uncertainty levels, thereby making the detection task more difficult.

Detectability of attacks in stochastic systems remains an open problem. Most works in this area consider detectability of attacks with respect to specific detection schemes employed by the controller, such as the classic bad data detection algorithm Cui et al. (2012), Mo & Sinopoli (2010). The trade-off between stealthiness and performance degradation induced by an attacker has also been characterized only for specific systems and detection mechanisms Kosut et al. (2011), Kwon et al. (2013), Liu et al. (2011), Mo et al. (2014), and a thorough analysis of resilience of stochastic control systems to arbitrary attacks is still missing. While convenient for analysis, the restriction to a specific class of detectors prevents the characterization of fundamental detection limitations. In our previous work Bai & Gupta (2014), we proposed the notion of $\epsilon$-marginal stealthiness to quantify the stealthiness level in an estimation problem with respect to the class of ergodic detectors. In this work, we remove the assumption of ergodicity and introduce a notion of stealthiness for stochastic control systems that is independent of the attack detection algorithm, and thus provides a fundamental measure of the stealthiness of attacks in stochastic control systems. Further, we also characterize the performance degradation that such a stealthy attack can induce.

We limit our analysis to linear, time-invariant plants with a controller based on the output of an asymptotic Kalman filter, and to injection attacks against the actuation channel only. Our choice of using controllers based on Kalman filters is not restrictive. In fact, while this is typically the case in practice, our results and analysis are valid for arbitrary control schemes. Our choice of focusing on attacks against the actuation channel only, instead, is motivated by two main reasons. First, actuation and measurements channels are equally likely to be compromised, especially in networked control systems where communication between sensors, actuators, plant, and controller takes place over wireless channels. Second, this case has received considerably less attention in the literature – perhaps due to its enhanced difficulty – where most works focus on attacks against the measurement channel only; e.g., see Fawzi et al. (2014), Teixeira et al. (2010). We remark also that our framework can be extended to the case of attacks against the measurement channel, as we show in Bai & Gupta (2014) for scalar systems and a different notion of stealthiness.

Finally, we remark that since the submission of this work, some recent literature has appeared that builds on it and uses a notion of attack detectability that is similar to what we propose in Bai & Gupta (2014), Bai et al. (2015) and in this paper. For instance, Kung et al. (2016) extends the notion of $\epsilon$-stealthiness of Bai et al. (2015) to higher order systems, and shows how the performance of the attacker may differ in the scalar and vector cases (in this paper we further extend the setup in Kung et al. (2016) by leveraging the notion of right-invertibility of a system to consider input and output matrices of arbitrary dimensions). In Zhang & Venkitasubramaniam (2016), the authors extend the setup in Bai et al. (2015) to vector and not necessarily stationary systems, but consider a finite horizon problem. In Guo et al. (2016), the degradation of remote state estimation is studied, for the case of an attacker that compromises the system measurements based on a linear strategy. Two other relevant recent works are Weerakkody et al. (2016) that uses the notion of Kullback-Liebler divergence as a causal measure of information flow to quantify the effect of attacks on the system output, while Chen et al. (2016) characterizes optimal attack strategies with respect to a linear quadratic cost that combines attackers control and undetectability goals.

Contributions The main contributions of this paper are threefold. First, we propose a notion of $\epsilon$-stealthiness to quantify detectability of attacks in stochastic cyber-physical systems. Our metric is motivated by the Chernoff-Stein Lemma in detection and information theories and is universal because it is independent of any specific detection mechanism employed by the controller. Second, we provide an information theoretic bound for the degradation of the minimum-mean-square estimation error caused by an $\epsilon$-stealthy attack as a function of the system parameters, noise statistics, and information available to the attacker. Third, we characterize optimal stealthy attacks, which achieve the maximal degradation of the estimation error covariance for a stealthy attack. For right-invertible systems (Basile & Marro 1991, Section 4.3.2), we provide a closed-form expression of optimal $\epsilon$-stealthy attacks. The case of single-input single-output systems considered in our conference paper Bai et al. (2015) is a special case of this analysis. For systems that are not right-invertible, we propose a sub-optimal $\epsilon$-stealthy attack with an analytical expression for the induced degradation of the system performance. We include a numerical study showing the effectiveness of our bounds. Our results provide a quantitative analysis of the trade-off between performance degradation that an attacker can induce versus a fundamental limit of the detectability of the attack.

Paper organization Section 2 contains the mathematical formulation of the problems considered in this paper. In Section 3, we propose a metric to quantify the stealthiness level of an attacker, and we characterize how this metric relates to the information theoretic notion of Kullback-Leibler Divergence. Section 4 contains the main results of this paper, including a characterization of the largest performance degradation caused by an $\epsilon$-stealthy attack, a closed-form expression of optimal $\epsilon$-stealthy attacks for right invertible systems, and a suboptimal class of attacks for not right-invertible systems. Section 5 presents illustrative examples and numerical results. Finally, Section 6 concludes the paper.

2 Problem Formulation

Notation: The sequence $\{x_{n}\}_{n=i}^{j}$ is denoted by $x_{i}^{j}$ (when clear from the context, the notation $x_{i}^{j}$ may also denote the corresponding vector obtained by stacking the appropriate entries in the sequence). This notation allows us to denote the probability density function of a stochastic sequence $x_{i}^{j}$ $f_{x_{i}^{j}}$, and to define its differential entropy $h(x_{i}^{j})$ as (Cover & Thomas 2006, Section 8.1)

[TABLE]

Let $x_{1}^{k}$ and $y_{1}^{k}$ be two random sequences with probability density functions (pdf) $f_{x_{1}^{k}}$ and $f_{y_{1}^{k}}$, respectively. The Kullback-Leibler Divergence (KLD) (Cover & Thomas 2006, Section 8.5) between $x_{1}^{k}$ and $y_{1}^{k}$ is defined as

[TABLE]

The KLD is a non-negative quantity that gauges the dissimilarity between two probability density functions with D\big{(}x_{1}^{k}\big{\|}y_{1}^{k}\big{)}=0 if $f_{x_{1}^{k}}=f_{y_{1}^{k}}$. Also, the KLD is generally not symmetric, that is, D\big{(}x_{1}^{k}\big{\|}y_{1}^{k}\big{)}\neq D\big{(}y_{1}^{k}\big{\|}x_{1}^{k}\big{)}. A Gaussian random vector $x$ with mean $\mu_{x}$ and covariance matrix $\Sigma_{x}$ is denoted by $x\sim{\mathcal{N}}(\mu_{x},\Sigma_{x})$. We let $I$ and $O$ be the identity and zero matrices, respectively, with their dimensions clear from the context. We also let $\mathbb{S}^{n}_{+}$ and $\mathbb{S}^{n}_{++}$ denote the sets of $n\times n$ positive semidefinite and positive definite matrices, respectively. For a square matrix $M$, ${\text{tr}}(M)$ and ${\text{det}}(M)$ denote the trace and the determinant of $M,$ respectively.

We consider the setup shown in Figure 1 with the following assumptions:

Process: The process is described by the following linear time-invariant (LTI) state-space representation:

[TABLE]

where $x_{k}\in{\mathbb{R}}^{N_{x}}$ is the process state, $u_{k}\in{\mathbb{R}}^{N_{u}}$ is the control input, $y_{k}\in{\mathbb{R}}^{N_{y}}$ is the output measured by the sensor, and the sequences $w_{1}^{\infty}$ and $v_{1}^{\infty}$ represent process and measurement noises, respectively.

Assumption 1**.**

The noise random processes are independent and identically distributed (i.i.d.) sequences of Gaussian random vectors with $w_{k}\sim{\mathcal{N}}(0,\Sigma_{w})$, $v_{k}\sim{\mathcal{N}}(0,\Sigma_{v})$, $\Sigma_{w}\in\mathbb{S}^{N_{x}}_{++}$, and $\Sigma_{v}\in\mathbb{S}^{N_{y}}_{++}$.

Assumption 2**.**

The state-space realization $(A,B,C)$ has no invariant zeros (Basile & Marro 1991, Section 4.4). In particular, this assumption implies that the system $(A,B,C)$ is both controllable and observable.

Assumption 3**.**

The controller uses a Kalman filter to estimate and monitor the process state. Note that the control input itself may be calculated using an arbitrary control law. The Kalman filter, which calculates the Minimum-Mean-Squared-Error (MMSE) estimate $\hat{x}_{k}$ of $x_{k}$ from the measurements $y_{1}^{k-1}$, is described as

[TABLE]

where the Kalman gain $K_{k}$ and the error covariance matrix P_{k+1}\triangleq{\mathbb{E}}\big{[}(\hat{x}_{k+1}-x_{k+1})(\hat{x}_{k+1}-x_{k+1})^{T}\big{]} are calculated through the recursions

[TABLE]

with initial conditions $\hat{x}_{1}={\mathbb{E}}[x_{1}]=0$ and $P_{1}={\mathbb{E}}[x_{1}x_{1}^{T}]$.

Assumption 4**.**

Given Assumption 2, $\lim_{k\to\infty}P_{k}=P$, where $P$ is the unique solution of a discrete-time algebraic Riccati equation. For ease of presentation, we assume that $P_{1}=P$, although the results can be generalized to the general case at the expense of more involved notation. Accordingly, we drop the time index and let $K_{k}=K$ and $P_{k}=P$ at every time step $k$. Notice that this assumption also implies that the innovation sequence $z_{1}^{\infty}$ calculated as $z_{k}\triangleq y_{k}-C\hat{x}_{k}$ is an i.i.d. Gaussian process with $z_{k}\sim{\mathcal{N}}(0,\Sigma_{z})$, where

[TABLE]

Let $G(\mathcal{Z})$ denote the $N_{y}\times N_{u}$ matrix transfer function of the system $(A,B,C)$. We say that the system $(A,B,C)$ is right invertible if there exists an $N_{u}\times N_{y}$ matrix transfer function $G_{RI}(\mathcal{Z})$ such that $G(\mathcal{Z})G_{RI}(\mathcal{Z})=I_{N_{y}}$.

Attack model: An attacker can replace the input sequence $u_{1}^{\infty}$ with an arbitrary sequence ${\tilde{u}}_{1}^{\infty}$. Thus, in the presence of an attack, the system dynamics are given by

[TABLE]

Notice that the sequence of measurements ${\tilde{y}}_{1}^{\infty}$ generated by the sensor in the presence of an attack ${\tilde{u}}_{1}^{\infty}$ is different from the nominal measurement sequence $y_{1}^{\infty}$. We assume that the attacker knows the system parameters, including the matrices $A$, $B$, $C$, $\Sigma_{w}$, and $\Sigma_{v}$. The attack input ${\tilde{u}}_{1}^{\infty}$ is constructed based on the system parameters and the information pattern ${\mathcal{I}}_{k}$ of the attacker. We make the following assumptions on the attacker’s information pattern:

Assumption 5**.**

The attacker knows the control input $u_{k}$; thus $u_{k}\in{\mathcal{I}}_{k}$ at all times $k$. Additionally, the attacker does not know the noise vectors for any time.

Assumption 6**.**

The attacker has perfect memory; thus, ${\mathcal{I}}_{k}\subseteq{\mathcal{I}}_{k+1}$ at all times $k$.

Assumption 7**.**

The attacker has causal information; in particular, ${\mathcal{I}}_{k}$ is independent of $w_{k}^{\infty}$ and $v_{k+1}^{\infty}$ for all $k$.

Example** 1****.**

(Attack scenarios)* Attack scenarios satisfying Assumptions 5-7 include the cases when:*

1. (i)

the attacker knows the control input exactly, that is, ${\mathcal{I}}_{k}=\{u_{1}^{k}\}$. 2. (ii)

the attacker knows the control input and the state, that is, ${\mathcal{I}}_{k}=\{u_{1}^{k},x_{1}^{k}\}$. 3. (iii)

*the attacker knows the control input and delayed measurements from the sensor, that is, ${\mathcal{I}}_{k}=\{u_{1}^{k},{\tilde{y}}_{1}^{k-d}\}$ for some $d\geq 1$. *

Stealthiness of an attacker: The attacker is constrained in the input $\tilde{u}_{1}^{\infty}$ it replaces since it seeks to be stealthy or undetected by the controller. If the controller is aware that an attacker has replaced the correct control sequence $u_{1}^{\infty}$ by a different sequence ${\tilde{u}}_{1}^{\infty}$, it can presumably switch to a safer mode of operation. Notions of stealthiness have been proposed in the literature before. As an example, for noiseless systems, Pasqualetti et al. (2013) showed that stealthiness of an attacker is equivalent to the existence of zero dynamics for the system driven by the attack. Similar to Pasqualetti et al. (2013), we seek to define the notion of stealthiness without placing any restrictions on the attacker or the controller behavior. However, we need to define a similar notion for stochastic systems when zero dynamics may not exist. To this end, we pose the problem of detecting an attacker by the controller as a (sequential) hypothesis testing problem. Specifically, the controller relies on the received measurements to decide the following binary hypothesis testing problem:

[TABLE]

For a given detector employed at the controller to select one of the two hypotheses, denote the probability of false alarm (i.e., the probability of deciding $H_{1}$ when $H_{0}$ is true) at time $k$ by $p^{F}_{k}$, and the probability of correct detection (i.e., the probability of deciding $H_{1}$ when $H_{1}$ is true) at time $k+1$ by $p^{D}_{k}$.

One may envisage that stealthiness of an attacker implies $p^{D}_{k}=0$. However, as is standard in detection theory, we need to consider both the quantities $p^{F}_{k}$ and $p^{D}_{k}$ simultaneously.111For instance, a detector that always declares $H_{1}$ to be true will achieve $p_{k}^{D}=1$. However, it will not be a good detector because $p_{k}^{F}=1$. In fact, intuitively, an attack is harder to detect if the performance of any detector is independent of the received measurements. In other words, we define an attacker to be stealthy if there exists no detector that can perform better (in the sense of simultaneously achieving higher $p_{k}^{D}$ and lower $p_{k}^{F}$) than a detector that makes a decision by ignoring all the measurements and making a random guess to decide between the hypotheses. We formalize this intuition in the following definition.

Definition** 1****.**

(Stealthy attacks)* Consider the problem formulation stated in Section 2. An attack ${\tilde{u}}_{1}^{\infty}$ is*

1. (i)

*strictly stealthy, if there exists no detector such that $p^{F}_{k}<p^{D}_{k}$ for any $k>0$. * 2. (ii)

$\epsilon$-stealthy, if, given $\epsilon>0$ and $0<\delta<1$, for any detector for which $0<1-p^{D}_{k}\leq\delta$ for all times $k$, it holds that

[TABLE]

Intuitively, an attack is strictly stealthy if no detector can perform better than a random guess in deciding whether an attack is in progress. Further, an attack is $\epsilon$-stealthy if there exists no detector such that $0<1-p^{D}_{k}\leq\delta$ for all time $k$ and $p^{F}_{k}$ converges to zero exponentially fast with rate greater than $\epsilon$ as $k\to\infty$.

Performance metric: The requirement to stay stealthy clearly curtails the performance degradation that an attacker can cause. The central problem that we consider is to characterize the worst performance degradation that an attacker can achieve for a specified level of stealthiness. In the presence of an attack (and if the controller is unaware of the attack), it uses the corrupted measurements ${\tilde{y}}_{1}^{\infty}$ in the Kalman filter. Let $\hat{\tilde{x}}_{1}^{\infty}$ be the estimate of the Kalman filter (3) in the presence of the attack ${\tilde{u}}_{1}^{\infty}$, which is obtained from the recursion

[TABLE]

where the innovation is $\tilde{z}_{k}\triangleq\tilde{y}_{k}-C\hat{\tilde{x}}_{k}$. Note that the estimate $\hat{{\tilde{x}}}_{k+1}$ is a sub-optimal MMSE estimate of the state $x_{k}$ since it is obtained by assuming the nominal control input $u_{k}$, whereas the system is driven by the attack input ${\tilde{u}}_{k}$. Also, note that the random sequence ${\tilde{z}}_{1}^{\infty}$ need neither be zero mean, nor white or Gaussian.

Since the Kalman filter estimate depends on the measurement sequence received, as a performance metric, we consider the covariance of the error in the predicted measurement $\hat{\tilde{y}}_{k}$ as compared to true value $y_{k}$. Further, to normalize the relative impact of the degradation induced by the attacker among different components of this error vector, we weight each component of the error vector by an amount corresponding to how accurate the estimate of this component was without attacks. Thus, we consider the performance index

[TABLE]

where $\tilde{P}_{k}$ is the error covariance matrix in the presence of an attack, \tilde{P}_{k}=\mathbb{E}\big{[}(\hat{{\tilde{x}}}_{k}-x_{k})(\hat{{\tilde{x}}}_{k}-x_{k})^{T}\big{]}, and $W=C^{T}\Sigma_{z}^{-1}C$. To obtain a metric independent of the time and focus on the long term effect of the attack, we consider the limit superior of the arithmetic mean of the sequence $\{{\text{tr}}({\tilde{P}}_{k}W)\}_{k=1}^{\infty}$ and define

[TABLE]

Notice that if the sequence $\{{\text{tr}}(\tilde{P}_{k}W)\}_{k=1}^{\infty}$ is convergent, then $\lim_{k\to\infty}{\text{tr}}(\tilde{P}_{k}W)=\tilde{P}_{W}$, which equals the Cesàro mean of $\tilde{P}_{k}W$.

Problems considered in the paper: We assume that the attacker is interested in staying stealthy or undetected for as long as possible while maximizing the error covariance $\tilde{P}_{W}$. We consider two problems:

1. (i)

What is a suitable metric for stealthiness of an attacker in stochastic systems where Assumption 2 holds? We consider this problem in Section 3. 2. (ii)

For a specified level of stealthiness, what is the worst performance degradation that an attacker can achieve? We consider this problem in Section 4.

3 Stealthiness in Stochastic systems

Our first result provides conditions that can be used to verify if an attack is stealthy or not.

Theorem 1**.**

(KLD and stealthy attacks)* Consider the problem formulation stated in Section 2. An attack ${\tilde{u}}_{1}^{\infty}$ is*

1. (i)

strictly stealthy if and only if D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)}=0 for all $k>0.$ 2. (ii)

$\epsilon$-stealthy if the corresponding observation sequence ${\tilde{y}}_{1}^{\infty}$ is ergodic and satisfies

[TABLE] 3. (iii)

$\epsilon$*-stealthy only if the corresponding observation sequence ${\tilde{y}}_{1}^{\infty}$ satisfies (8). *

{pf}

Presented in Appendix A. ∎

The following result provides a characterization of D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)} that contains additional insight into the meaning of stealthiness of an attacker.

Proposition 2**.**

(KLD and differential entropy)* The quantity D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)} can be calculated as*

[TABLE]

where I\big{(}{\tilde{z}}_{1}^{n-1};{\tilde{z}}_{n}\big{)} denotes the mutual information between ${\tilde{z}}_{1}^{n-1}$ and ${\tilde{z}}_{n}$ (Cover & Thomas 2006, Section 8.5).

{pf}

Due to the invariance property of the Kullback-Leibler divergence Kullback (1997), we have

[TABLE]

for every $k>0$. Further, note that $z_{1}^{\infty}$ is an i.i.d. sequence of Gaussian random vectors with $z_{k}\sim{\mathcal{N}}(0,\Sigma_{z})$. From (1), we obtain

[TABLE]

where h\big{(}{\tilde{z}}_{1}^{k}\big{)} is the differential entropy of ${\tilde{z}}_{1}^{k}$, I\big{(}{\tilde{z}}_{1}^{n-1};{\tilde{z}}_{n}\big{)} denotes the mutual information between ${\tilde{z}}_{1}^{n-1}$ and ${\tilde{z}}_{n}$. Equality (a) holds because $z_{1}^{\infty}$ is an independent random sequence, while equality (b) follows by applying the chain rule of differential entropy (Cover & Thomas 2006, Theorem 8.6.2) on the term $-\frac{1}{k}h\left(\tilde{z}_{1}^{k}\right)$ to obtain $\frac{1}{k}\sum_{n=1}^{k}-h\left(\tilde{z}_{n}|\tilde{z}_{1}^{n-1}\right)$, and adding and subtracting $h(\tilde{z}_{n})$. ∎ Intuitively, the mutual information I\big{(}{\tilde{z}}_{1}^{n-1};{\tilde{z}}_{n}\big{)} measures how much information about ${\tilde{z}}_{n}$ can be obtained from ${\tilde{z}}_{1}^{n-1}$, that is, it characterizes the memory of the sequence ${\tilde{z}}_{1}^{\infty}$. Similarly, the Kullback-Leibler divergence $D({\tilde{z}}_{n}\|z_{n})$ measures the dissimilarity between the marginal distributions of ${\tilde{z}}_{n}$ and $z_{n}$. Proposition 2 thus states that the stealthiness level of an ergodic attacker can be degraded in two ways: (i) if the sequence ${\tilde{z}}_{1}^{\infty}$ becomes autocorrelated, and (ii) if the marginal distributions of the random variables ${\tilde{z}}(k)$ in the sequence ${\tilde{z}}_{1}^{\infty}$ deviate from ${\mathcal{N}}(0,\Sigma_{z})$.

4 Fundamental Performance

Limitations

We are interested in the maximal performance degradation ${\tilde{P}}_{W}$ that an $\epsilon$-stealthy attacker may induce. We begin by proving a converse statement that gives an upper bound for ${\tilde{P}}_{W}$ induced by an $\epsilon$-stealthy attacker in Section 4.2. In Section 4.3 we prove a tight achievability result that provides an attack that achieves the upper bound when the system $(A,B,C)$ is right-invertible. In Section 4.4 we prove a looser achievability result that gives a lower bound on the performance degradation for non right-invertible systems.

4.1 Preliminary results

We will use a series of preliminary technical results, which will be used in the following sections to present the main results of the paper.

Lemma 3**.**

Define the function $\bar{\delta}:[0,\infty)\to[1,\infty)$ as

[TABLE]

Then, for any $\gamma>0$,

[TABLE]

{pf}

Since a logarithm function is concave, the feasible region of $x$ in (11) is a closed interval upper bounded by $\bar{\delta}(\gamma)$ as defined in (10). Thus, the result follows. ∎ The following result is proved in the appendix.

Lemma 4**.**

Consider the problem setup above. We have

[TABLE]

Further, if the sequence ${\tilde{z}}_{1}^{\infty}$ is a sequence of independent and identically distributed (i.i.d.) Gaussian random variables, ${\tilde{z}}_{k}$, each with mean zero and covariance matrix {\mathbb{E}}\big{[}{\tilde{z}}_{k}{\tilde{z}}_{k}^{T}\big{]}=\alpha\Sigma_{z}, for some scalar $\alpha$, then (12) is satisfied with equality.

{pf}

See Appendix B. ∎ Combining Lemmas 3 and 4 leads to the following result.

Lemma 5**.**

Consider the problem setup above. We have

[TABLE]

where $\bar{\delta}(.)$ is as defined in (10).

{pf}

Proof follows from Lemma 3 by using (12) and substituting

[TABLE]

∎ The following result relates the covariance of the innovation and the observation sequence.

Lemma 6**.**

Consider the problem setup above. We have

[TABLE]

{pf}

By definition,

[TABLE]

and similarly

[TABLE]

Now both $(x_{k}-\hat{x}_{k})$ and $(\tilde{x}_{k}-\hat{{\tilde{x}}}_{k})$ are independent of the measurement noise $v_{k}$ due to Assumptions 1 and 7. Thus, we have

[TABLE]

and the result follows. ∎

4.2 Converse

We now present an upper bound of the weighted MSE induced by an $\epsilon$-stealthy attack.

Theorem 7** (Converse).**

Consider the problem setup above. For any $\epsilon$-stealthy attack ${\tilde{u}}_{1}^{\infty}$ generated by an information pattern ${\mathcal{I}}_{1}^{\infty}$ that satisfies Assumptions 5-7, we have

[TABLE]

where $N_{y}$ is the number of outputs of the system, the function $\bar{\delta}$ is defined in (10), and ${\text{tr}}(PW)$ is the weighted MSE in the absence of the attacker.

{pf}

We begin by writing

[TABLE]

where we have used the invariance of trace operator under cyclic permutations and the relation in (15), respectively. The right hand side has two terms. The first term can be upper bounded using Lemma 5, so that we obtain

[TABLE]

Since the function $\bar{\delta}$ is continuous and monotonic, we can rewrite the above bound as

[TABLE]

Since the attack is $\epsilon$-stealthy, we use Theorem 1 to bound the Kullback-Leibler divergence D\big{(}{\tilde{z}}_{1}^{k}\big{\|}z_{1}^{k}\big{)} to obtain

[TABLE]

Finally, substituting for $\Sigma_{v}$ from (14) on the right hand side and using $W=C^{T}\Sigma_{z}^{-1}C$ completes the proof. ∎

Remark 8**.**

(Stealthiness vs induced error)* Theorem 7 provides an upper bound for the performance degradation ${\tilde{P}}_{W}$ for $\epsilon$-stealthy attacks. Since $\bar{\delta}\!\left(\frac{\epsilon}{N_{y}}\right)$ is a monotonically increasing function of $\epsilon$, the upper bound (18) characterizes a trade-off between the induced error and the stealthiness level of an attack.*

To further understand this result, we consider two extreme cases, namely, $\epsilon=0$, which implies strictly stealthiness, and $\epsilon\to\infty$, that is, no stealthiness level.

Corollary 9**.**

A strictly stealthy attacker cannot induce any performance degradation.

{pf}

A strictly stealthy attacker corresponds to $\epsilon=0$. Using the fact that $\bar{\delta}(0)=1$ in Theorem 7 yields that ${\text{tr}}({\tilde{P}}W)\leq{\text{tr}}(PW)$. ∎

Corollary 10**.**

Let the attacker be $\epsilon$-stealthy. The upper bound in (18) increases linearly with $\epsilon$ as $\epsilon\to\infty$.

{pf}

The proof follows from Theorem 7 by noting that the first order derivative of the function $\bar{\delta}(x)$ is given by

[TABLE]

from the right as $x$ tends to infinity. ∎

4.3 Achievability for Right Invertible Systems

In this section, we show that the bound presented in Theorem 7 is achievable if the system $(A,B,C)$ is right invertible. We begin with the following preliminary result.

Lemma 11**.**

Let the system $(A,B,C)$ be right invertible. Then, the system $(A-KC,B,C)$ is also right invertible.

{pf}

From Assumption 2, the system $(A,B,C)$ has no invariant zero. Since $(A,B,C)$ is also right invertible, the dimension $N_{u}$ of the control vector $u_{k}$ is no less the dimension $N_{y}$ of the output vector $y_{k}$. Now $(A-KC,B,C)$ is generated from $(A,B,C)$ using output feedback, and hence the system $(A-KC,B,C)$ does not have invariant zeros either. Since the dimension of the input and output vectors of this new system remains $N_{u}$ and $N_{y}$ with $N_{u}\geq N_{y}$, the system $(A-KC,B,C)$ is right invertible. ∎

Let $G_{RI}^{\prime}$ be the right inverse of the system $(A-KC,B,C)$. Specifically, we will consider the following attack.

Attack $\mathcal{A}_{1}$: The attack sequence is generated in three steps. In the first step, a sequence $\zeta_{1}^{\infty}$ is generated, such that each vector $\zeta_{k}$ is independent and identically distributed and independent of the information pattern ${\mathcal{I}}_{k}$ of the attacker, with probability density function \zeta_{k}\sim{\mathcal{N}}\big{(}0,\big{(}\bar{\delta}(\frac{\epsilon}{N_{y}})-1\big{)}\Sigma_{z}\big{)}. In the second step, the sequence $\phi_{1}^{\infty}$ is generated as the output of the system $G_{RI}^{\prime}$ with $\zeta_{1}^{\infty}$ as the input sequence. Finally, the attack sequence ${\tilde{u}}_{1}^{\infty}$ is generated as

[TABLE]

Remark 12**.**

(Information pattern of attack $\mathcal{A}_{1}$)* Notice that the attack $\mathcal{A}_{1}$ can be generated by an attacker with any information pattern satisfying Assumptions 5–7.*

We note the following property of the attack $\mathcal{A}_{1}$.

Lemma 13**.**

Consider the attack $\mathcal{A}_{1}$. With this attack, the innovation sequence ${\tilde{z}}_{1}^{\infty}$ as calculated at the controller, is a sequence of independent and identically distributed Gaussian random vectors with mean zero and covariance matrix

[TABLE]

{pf}

Consider an auxiliary Kalman filter that is implemented as the recursion

[TABLE]

with the initial condition $\hat{x}_{1}^{a}=0$ and the innovation $z_{k}^{a}={\tilde{y}}_{k}-C\hat{x}_{k}^{a}$. The innovation sequence is independent and identically distributed with each $z_{k}^{a}\sim{\mathcal{N}}(0,\Sigma_{z})$. Now, we express ${\tilde{z}}_{k}$ as

[TABLE]

where ${\tilde{e}}_{k}\triangleq\hat{{\tilde{x}}}_{k}-\hat{x}_{k}^{a}$. Further, ${\tilde{e}}_{k}$ evolves according to the recursion

[TABLE]

with the initial condition ${\tilde{e}}_{1}=0$. Together, (24) and (25) define a system of the form

[TABLE]

We now note that (i) the above system is $(A-KC,B,C)$, (ii) $\phi_{1}^{\infty}$ is the output of the right inverse system of $(A-KC,B,C)$ with input $\zeta_{1}^{\infty}$, and (iii) the system in equation (26) is linear. These three facts together imply that the output of (26), i.e., $\{z_{k}^{a}-{\tilde{z}}_{k}\}_{k=1}^{\infty}$ is a sequence of independent and identically distributed random variables with each random variable distributed as {\mathcal{N}}\big{(}0,\big{(}\bar{\delta}(\frac{\epsilon}{N_{y}})-1\big{)}\Sigma_{z}\big{)}. Now since $z_{k}^{a}$ is independent of ${\tilde{e}}_{1}^{k}$, we obtain that ${\tilde{z}}_{1}^{\infty}$ is an independent and identically distributed sequence with each random variable ${\tilde{z}}_{k}$ as Gaussian with mean zero and covariance matrix

[TABLE]

∎ We now show that the attack $\mathcal{A}_{1}$ achieves the converse result in Theorem 7.

Theorem 14**.**

(Achievability for right invertible systems)* Suppose that the LTI system $(A,B,C)$ is right invertible. The attack $\mathcal{A}_{1}$ is $\epsilon$-stealthy and, with this attack,*

[TABLE]

where $W=C^{T}\Sigma_{z}^{-1}C$.

{pf}

For the attack $\mathcal{A}_{1}$, Lemma 13 states that ${\tilde{z}}_{1}^{\infty}$ is a sequence of independent and identically distributed (i.i.d.) Gaussian random variables ${\tilde{z}}_{k}$ each with mean zero and covariance matrix {\mathbb{E}}\big{[}{\tilde{z}}_{k}{\tilde{z}}_{k}^{T}\big{]}=\alpha\Sigma_{z}, with $\alpha=\bar{\delta}(\frac{\epsilon}{N_{y}}).$ Lemma 4, thus, implies that (12) holds with equality. Further, following the proof of Theorem 7, if (12) holds with equality, then (18) also holds with equality. Thus, the attack $\mathcal{A}_{1}$ achieves the converse in terms of performance degradation.

Next we show that the attack is $\epsilon$-stealthy. Once again, from Lemma 4 and (22), we have for every $k>0$,

[TABLE]

Now with this attack, ${\tilde{z}}_{1}^{\infty}$ is an independent and identically distributed sequence and the measurement sequence ${\tilde{y}}_{1}^{\infty}$ is ergodic. Thus, from Theorem 1, the attack $\mathcal{A}_{1}$ is $\epsilon$-stealthy. ∎

Remark 15**.**

(Attacker information pattern)* Intuitively, we may expect that the more information about the state variables that an attacker has, larger the performance degradation it can induce. However, Theorem 7 and Theorem 14 imply that the only critical piece of information for the attacker to launch an optimal attack is the nominal control input $u_{1}^{\infty}$.*

4.4 Achievability for System that are not

Right Invertible

If the system is not right invertible, the converse result in Theorem 7 may not be achieved. We now construct a heuristic attack $\mathcal{A}_{2}$ that allows us to derive a lower bound for the performance degradation ${\tilde{P}}_{W}$ induced by $\epsilon$-stealthy attacks against systems that are not right invertible.

Attack $\mathcal{A}_{2}$: The attack sequence is generated as

[TABLE]

where ${\tilde{e}}_{k}=\hat{{\tilde{x}}}_{k}-\hat{x}_{k}^{a}$ as in (26), and the sequence $\zeta_{1}^{\infty}$ is generated such that each vector $\zeta_{k}$ is independent and identically distributed with probability density function \zeta_{k}\sim{\mathcal{N}}\big{(}0,\Sigma_{\zeta}\big{)} and independent of the information pattern ${\mathcal{I}}_{k}$ of the attacker. The feedback matrix $L$ and the covariance matrix $\Sigma_{\zeta}$ are determined in three steps, which are detailed next.

Step 1 (Limiting the memory of the innovation sequence ${\tilde{z}}_{1}^{\infty}$): Notice that, with the attack $\mathcal{A}_{2}$ and the notation in (23), the dynamics of ${\tilde{e}}_{k}$ and ${\tilde{z}}_{k}$ are given by

[TABLE]

The feedback matrix $L$ should be selected to eliminate the memory of the innovation sequence computed at the controller. One way to achieve this aim is to set $A-KC-BL=0$. In other words, if $A-KC-BL=0$, then ${\tilde{z}}_{1}^{\infty}$ is independent and identically distributed. It may not be possible to select $L$ to achieve this aim exactly. Thus, we propose the following heuristic. Note that if $A-KC-BL=0$, then the cost function

[TABLE]

is minimized, with $W=C^{T}\Sigma_{z}^{-1}C$. Since

[TABLE]

selecting $L$ to satisfy the constraint $A-KC-BL=0$ is equivalent to selecting $L$ to solve a cheap Linear Quadratic Gaussian (LQG) problem (Hespanha 2009, Section VI). Thus, heuristically, we select the attack matrix $L$ as the solution to this cheap LQG problem and, specifically, as

[TABLE]

where $T_{\eta}$ is the solution to the discrete algebraic Riccati equation

[TABLE]

Step 2 (Selection of the covariance matrix $\Sigma_{\zeta}$): Notice that the selection of the feedback matrix $L$ in Step 1 is independent of the covariance matrix $\Sigma_{\zeta}$. As the second step, we select the covariance matrix $\Sigma_{\zeta}$ such that $C\Sigma_{\tilde{e}}C^{T}$ is close to a scalar multiplication of $\Sigma_{z}$, say $\alpha^{2}\Sigma_{z}$. From (28), notice that

[TABLE]

where $\Sigma_{{\tilde{e}}}\in\mathbb{S}_{+}^{N_{x}}$ is the positive semi-definite solution to the equation

[TABLE]

We derive an expression for $\Sigma_{\zeta}$ from (31) by using the pseudoinverse matrices of $B$ and $C$, i.e.,

[TABLE]

where † denotes the pseudoinverse operation. It should be noted that the right-hand side of (32) may not be positive semidefinite. Many choices are possible to construct a positive semi-definite $\Sigma_{\zeta}$. We propose that if the the right-hand side is indefinite, we set its negative eigenvalues to zero without altering its eigenvectors. Note that, if $B$ and $C$ are both invertible, then we could directly set $C\Sigma_{\tilde{e}}C^{T}=\alpha^{2}\Sigma_{z}$.

Step 3 (Enforcing the stealthiness level): The covariance matrix $\Sigma_{\zeta}$ obtained in Step 2 depends on the parameter $\alpha$. In this last step, we select $\alpha$ so as to make the attack $\mathcal{A}_{2}$ $\epsilon$-stealthy. To this aim, we first compute an explicit expression for the stealthiness level and the error induced by $\mathcal{A}_{2}$.

For the entropy rate of ${\tilde{z}}_{1}^{\infty}$, since ${\tilde{z}}_{1}^{\infty}$ is Gaussian, we obtain

[TABLE]

where $g_{k}({\tilde{z}}_{1}^{k})$ is the minimum mean square estimate of ${\tilde{e}}_{k+1}$ from ${\tilde{z}}_{1}^{k}$, which can be obtained from Kalman filtering, and $S\in\mathbb{S}_{+}^{N_{y}}$ is the positive semidefinite solution to the following discrete algebraic Riccati equation

[TABLE]

Note that the equality (33) is due to (Cover & Thomas 2006, Theorem 4.2.1); equality (34) is a consequence of the maximum differential entropy lemma (Gamal & Kim 2011, Section 2.2); the positive semidefinite matrix $S$ that solves (36) represents the steady-state error covariance matrix of the Kalman filter that estimates ${\tilde{z}}_{k+1}$ from ${\tilde{z}}_{1}^{k}$. Thus, the level of stealthiness for the attack $\mathcal{A}_{2}$ is

[TABLE]

where $W=C^{T}\Sigma_{z}^{-1}C$. To conclude our design of the attack $\mathcal{A}_{2}$, we use (4.4) to solve for the desired value of $\alpha$, and compute the error induced by the $\epsilon$-stealthy attack $\mathcal{A}_{2}$ as

[TABLE]

where $\Sigma_{\tilde{e}}$ is the solution to the Lyapunov equation (31).

5 Numerical Results

Example 1 Consider a right invertible system $(A,B,C)$ where

[TABLE]

and let $\Sigma_{w}=0.5I$ and $\Sigma_{v}=I$. Figure 2 plots the upper bound (18) of performance degradation achievable for an attacker versus the attacker’s stealthiness level $\epsilon$. From Theorem 14, the upper bound can be achieved by a suitably designed $\epsilon$-stealthy attack. Thus, Fig. 2 represents a fundamental limitation for the performance degradation that can be induced by any $\epsilon$-stealthy attack. Observe that plot is approximately linear as $\epsilon$ becomes large, as predicted by Corollary 10.

Example 2 Consider the system $(A,B,C)$ with

[TABLE]

which fails to be right invertible. Let $\Sigma_{w}=0.5I$ and $\Sigma_{v}=I$. In Fig. 3, we plot the upper bound for the value of ${\tilde{P}}_{W}$ that an $\epsilon$-stealthy attacker can induce, as calculated using Theorem 7. The value of ${\tilde{P}}_{W}$ achieved by the heuristic attack $\mathcal{A}_{2}$ as presented in Section 4.4 is also plotted. Although the bound is fairly tight as compared to the performance degradation achieved by the heuristic attack; nonetheless, there remains a gap between the two plots.

6 Conclusion

This work characterizes fundamental limitations and achievability results for performance degradation induced by an attacker in a stochastic control system. The attacker is assumed to know the system parameters and noise statistics, and is able to hijack and replace the nominal control input. We propose a notion of $\epsilon$-stealthiness to quantify the difficulty of detecting an attack from the measurements, and we characterize the largest degradation of Kalman filtering induced by an $\epsilon$-stealthy attack. For right invertible systems, our study reveals that the nominal control input is the only critical piece of information to induce the largest performance degradation. For systems that are not right invertible, we provide an achievability result that lower bounds the performance degradation that an optimal $\epsilon$-stealthy attack can achieve.

Appendix A Proof of Theorem 1

The first statement follows directly from the Neyman-Pearson Lemma Poor (1998).

For the second statement, we apply the Chernoff-Stein Lemma for ergodic measurements (see Polyanskiy & Wu (2012–2013)) that states that for any given attack sequence ${\tilde{u}}_{1}^{\infty}$, for a given $0<1-p^{D}_{k}\leq\delta$ where $0<\delta<1$, the best achievable decay exponent of $p_{k}^{F}$ is given by \lim_{k\to\infty}\frac{1}{k}D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)}. For this attack sequence and with any detector, we obtain

[TABLE]

Thus, by Definition 1, the attack is $\epsilon$-stealthy.

Finally, the proof for the third statement follows by contradiction. Assume that (8) does not hold and there exists an $\epsilon$-stealthy attack ${\tilde{u}}_{1}^{\infty}$ such that \limsup_{k\to\infty}\frac{1}{k}D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)}>\epsilon. Suppose that the detector employs the standard log-likelihood ratio test with threshold $\lambda_{k}$ at every time $k+1$. Thus, the test is given by

[TABLE]

is the log-likelihood ratio and $\eta_{1}^{k}=y_{1}^{k}$ (resp. $\eta_{1}^{k}={\tilde{y}}_{1}^{k}$) if $H_{0}$ (resp. $H_{1}$) is true. Define the conditional cumulant generating function for the log-likelihood ratio to be g_{k|0}(s)=\log{\mathbb{E}}\big{[}e^{sL_{k}}\big{|}H_{0}\big{]} and g_{k|1}(s)=\log{\mathbb{E}}\big{[}e^{sL_{k}}\big{|}H_{1}\big{]}. Note that $g_{k|0}(s)=g_{k|1}(s-1)$. Let $\lambda_{k}$ be chosen to ensure that $0<1-p^{D}_{k}\leq\delta$ for every $k>0$ (notice that such $\lambda_{k}$ always exists, because $p^{D}_{k}$ increases to one as $\lambda_{k}$ decreases to zero). Then, for any $s_{k}>0$, Chernoff’s inequality yields

[TABLE]

or

[TABLE]

Further manipulation yields

[TABLE]

Now, by applying Jensen’s inequality twice we obtain

[TABLE]

Finally, using {\mathbb{E}}[L_{k}|H_{1}]=D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)} implies

[TABLE]

Now, for any time index $k$ such that \frac{1}{k}D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)}>\epsilon, let

[TABLE]

Using (40), (41) and {\limsup_{k\to\infty}}\frac{1}{k}D\big{(}{\tilde{y}}_{1}^{k}\big{\|}y_{1}^{k}\big{)}>\epsilon, we obtain

[TABLE]

which contradicts (6). Hence, the attack cannot be stealthy, and the condition stated in (8) must be true.

Appendix B Proof of Lemma 4

By definition, we can write the Kullback-Leibler divergence can be written as

[TABLE]

Now, $z_{1}^{k}$ is the innovation sequence without any attack and is thus an independent and identically distributed sequence of Gaussian random variables with mean 0 and covariance $\Sigma_{z}$. Plugging into the above equation yields

[TABLE]

which we can rewrite as

[TABLE]

We can upper-bound the right hand side by first using the sub-additivity property of differential entropy (Cover & Thomas 2006, Corollary 8.6.1), and then further bounding the entropy $h({\tilde{z}}_{n})$ using the maximum differential entropy lemma (Gamal & Kim 2011, Section 2.2) for multivariate random variables. Thus, we obtain

[TABLE]

with equality if the sequence ${\tilde{z}}_{1}^{k}$ is an independent sequence of random variables with each random variable ${\tilde{z}}_{n}$ as Gaussian distributed with mean zero for all $n$. Straight-forward algebraic manipulation on the last two terms yields

[TABLE]

We can further bound

[TABLE]

so that

[TABLE]

with equality if the matrix ${\mathbb{E}}[{\tilde{z}}_{n}{\tilde{z}}_{n}^{T}]$ is a scalar multiplication of $\Sigma_{z}$ for all $n$ Finally, using the Arithmetic Mean and Geometric Mean (AM-GM) inequality yields the desired result (12). For the AM-GM inequality to hold with equality we need that ${\text{tr}}({\mathbb{E}}[{\tilde{z}}_{n}{\tilde{z}}_{n}^{T}]\Sigma_{z}^{-1})$ is constant for every $n$. Collecting all the above conditions for equality at various steps, (12) holds with equality if {\mathbb{E}}\big{[}{\tilde{z}}_{k}{\tilde{z}}_{k}^{T}\big{]}=\alpha\Sigma_{z} for some scalar $\alpha$.