Characterization of Model-Based Detectors for CPS Sensor Faults/Attacks

TL;DR

This paper introduces a model-based CUSUM detector for identifying sensor faults and attacks in CPS, compares it with chi-squared detection, and characterizes undetectable attack impacts through theoretical analysis and simulations.

Contribution

It develops a tunable CUSUM detection method for CPS sensor faults/attacks and analyzes its advantages over static detectors like chi-squared, including bounds on undetectable attack impacts.

Findings

CUSUM outperforms chi-squared in detection delay

Upper bound on undetectable attack-induced state degradation

Simulation confirms effectiveness in chemical reactor scenario

Abstract

A vector-valued model-based cumulative sum (CUSUM) procedure is proposed for identifying faulty/falsified sensor measurements. First, given the system dynamics, we derive tools for tuning the CUSUM procedure in the fault/attack free case to fulfill a desired detection performance (in terms of false alarm rate). We use the widely-used chi-squared fault/attack detection procedure as a benchmark to compare the performance of the CUSUM. In particular, we characterize the state degradation that a class of attacks can induce to the system while enforcing that the detectors (CUSUM and chi-squared) do not raise alarms. In doing so, we find the upper bound of state degradation that is possible by an undetected attacker. We quantify the advantage of using a dynamic detector (CUSUM), which leverages the history of the state, over a static detector (chi-squared) which uses a single measurement at a time. Simulations of a chemical reactor with heat exchanger are presented to illustrate the performance of our tools.