Sequential Detection of Deception Attacks in Networked Control Systems with Watermarking

TL;DR

This paper proposes a sequential detection method using watermarking signals in control systems to quickly identify deception attacks, balancing detection speed and control cost.

Contribution

It introduces a watermarking-based sequential detection approach that improves attack detection speed by analyzing joint distributions, with a tradeoff in control performance.

Findings

Higher watermarking variance increases detection accuracy.

Joint distribution analysis yields higher KLD and faster detection.

Tradeoff exists between detection speed and control cost.

Abstract

In this paper, we investigate the role of a physical watermarking signal in quickest detection of a deception attack in a scalar linear control system where the sensor measurements can be replaced by an arbitrary stationary signal generated by an attacker. By adding a random watermarking signal to the control action, the controller designs a sequential test based on a Cumulative Sum (CUSUM) method that accumulates the log-likelihood ratio of the joint distribution of the residue and the watermarking signal (under attack) and the joint distribution of the innovations and the watermarking signal under no attack. As the average detection delay in such tests is asymptotically (as the false alarm rate goes to zero) upper bounded by a quantity inversely proportional to the Kullback-Leibler divergence(KLD) measure between the two joint distributions mentioned above, we analyze the effect of the watermarking signal variance on the above KLD. We also analyze the increase in the LQG control cost due to the watermarking signal, and show that there is a tradeoff between quick detection of attacks and the penalty in the control cost. It is shown that by considering a sequential detection test based on the joint distributions of residue/innovations and the watermarking signal, as opposed to the distributions of the residue/innovations only, we can achieve a higher KLD, thus resulting in a reduced average detection delay. Numerical results are provided to support our claims.