Robust fault detection and network resilience

Abstract

This dissertation summarizes the results of my doctoral studies in robust fault detection and network resilience in distributed dynamic systems. In this endeavor, my main focus is to extend robust fault detection and isolation ideas to the distributed setting with an emphasis on cyber-security applications. Along the way, my co-authors and I also extend the theory of unknown input observers (UIOs) into the realm of positive linear dynamic systems (PLDS), and in order to address the problem of simultaneous faults and unknown disturbances in fault detection for positive linear systems, we proposed an observer structure that leverages the disturbance decoupling properties of the UIO along with the residual generation capabilities of the proportional-integral observer (PIO). With respect to networked systems, my first technical contribution develops distributed system models in order to capture the dynamic behavior of the agents in a cooperative setting under nominal and perturbed conditions. By exploring the structure and response of these distributed models, I am able to show that two popular consensus protocols lead to cooperative networks that are in fact positive linear dynamic systems, \ie their response remains in the positive orthant. For these networks, I propose two fault detection and isolation schemes that only utilize the observations of an agent's local neighbors for fault diagnosis. The first fault detection scheme extends the PUIO theory into the distributed case while the second fault detection scheme addresses the more general problem of fault detection in distributed systems using a distributed version of the PIO.% which I coined the D-PIO. In a related research thread, I propose a detection filter to address the problems reported in the literature that are associated with distributed UIO schemes commonly used in cyber-physical security applications. My contribution addresses the computational burdens of the distributed UIO schemes by formulating a residual generator that simultaneously identifies multiple intruders with only a single detection filter. Using this scheme, when an agent is attacked, a single detection filter in its neighborhood is triggered and a residual that is maximally correlated with the subspace that is associated with that malicious agent is produced. Isolation is achieved by carefully designing the detection subspaces so that they coincide with the direction of the attacks by the malicious agents. This is in contrast to the approach taken by distributed UIO based schemes where a generalized residual set is required. Finally, I address two problems that are exclusively related to the topology of networks. The first problem is that of proposing a network topology for the monitoring agents that is maximally resilient in the presence of external adversaries. Specifically, it is assumed that a network equipped with monitoring agents is under attack by an external adversary who intends to mount a catastrophic attack on it in order to degrade its intrusion detection capabilities. Under this setting, I obtain the algebraic and combinatorial conditions that lead to maximally resilient topologies for the monitoring agents to form within the network. In doing so, I am able to show that these topologies lead to graphs which have a connected component of size at least $(1 - \frac{\epsilon}{2\phi})$ and spectral expansion of at least $\frac{\lambda^2\delta^2}{32d log^2 \delta}$ where $\phi$ is the graph conductance, $\epsilon$ is the number of edges that are adversarially removed, $\lambda$ is the true graph expansion, $\delta$ is the number of desired nodes and $d$ is the maximum degree of the graph. To recover the hidden topology, I propose an algorithm with time complexity that is linear in the number of nodes in the graph. The second result pertaining purely to graph topology is a result that closes the gap between the algebraic connectivity of a graph and the third moment of the adjacency matrix. It is well known by the work of Cheeger that the algebraic connectivity of a graph is a measure of its cohesiveness. Relatedly, physicists have defined the clustering coefficient of a graph in terms of the number of triangles (\ie transitivity) in the graph. My final result is an upper bound on the algebraic connectivity by the number of triangles in $\cG$, which happens to be sharp if $\cG$ is highly connected.