Risk-based Security Measure Allocation Against Injection Attacks on Actuators

TL;DR

This paper develops a risk-aware method for optimally allocating security measures to protect actuators from stealthy injection attacks, using CVaR to quantify risk and SDP for optimization.

Contribution

It introduces a novel risk-based security allocation framework for control systems under attack, employing CVaR and relaxation techniques to handle mixed-integer optimization.

Findings

The proposed method effectively minimizes attack risk under resource constraints.

Comparison of different risk measures shows trade-offs in security allocation.

Numerical examples demonstrate the approach's practical efficacy.

Abstract

This article considers the problem of risk-optimal allocation of security measures when the actuators of an uncertain control system are under attack. We consider an adversary injecting false data into the actuator channels. The attack impact is characterized by the maximum performance loss caused by a stealthy adversary with bounded energy. Since the impact is a random variable, due to system uncertainty, we use Conditional Value-at-Risk (CVaR) to characterize the risk associated with the attack. We then consider the problem of allocating the security measures which minimize the risk. We assume that there are only a limited number of security measures available. Under this constraint, we observe that the allocation problem is a mixed-integer optimization problem. Thus we use relaxation techniques to approximate the security allocation problem into a Semi-Definite Program (SDP). We also compare our allocation method $(i)$ across different risk measures: the worst-case measure, the average (nominal) measure, and $(ii)$ across different search algorithms: the exhaustive and the greedy search algorithms. We depict the efficacy of our approach through numerical examples.