On Reachable Sets of Hidden CPS Sensor Attacks

TL;DR

This paper introduces mathematical tools using LMIs to compute bounds on the estimation errors caused by stealthy sensor attacks in cyber-physical systems, aiding in understanding and minimizing potential attack impacts.

Contribution

It provides a novel LMI-based method to compute and minimize outer ellipsoidal bounds on hidden reachable sets of attacks, enhancing detection and resilience strategies.

Findings

Ellipsoidal bounds effectively quantify attack impact.

Redesigning observer gains reduces the size of hidden reachable sets.

Simulation validates the proposed approach.

Abstract

For given system dynamics, observer structure, and observer-based fault/attack detection procedure, we provide mathematical tools -- in terms of Linear Matrix Inequalities (LMIs) -- for computing outer ellipsoidal bounds on the set of estimation errors that attacks can induce while maintaining the alarm rate of the detector equal to its attack-free false alarm rate. We refer to these sets to as hidden reachable sets. The obtained ellipsoidal bounds on hidden reachable sets quantify the attacker's potential impact when it is constrained to stay hidden from the detector. We provide tools for minimizing the volume of these ellipsoidal bounds (minimizing thus the reachable sets) by redesigning the observer gains. Simulation results are presented to illustrate the performance of our tools.