Observer-based Detection Research Articles

Novel cyber-physical collaborative detection and localization method against dynamic load altering attacks in smart energy grids

Owing to the integration of energy digitization and artificial intelligence technology, smart energy grids can realize the stable, efficient and clean operation of power systems. However, the emergence of cyber-physical attacks, such as dynamic load-altering attacks (DLAAs) has introduced great challenges to the security of smart energy grids. Thus, this study developed a novel cyber-physical collaborative security framework for DLAAs in smart energy grids. The proposed framework integrates attack prediction in the cyber layer with the detection and localization of attacks in the physical layer. First, a data-driven method was proposed to predict the DLAA sequence in the cyber layer. By designing a double radial basis function network, the influence of disturbances on attack prediction can be eliminated. Based on the prediction results, an unknown input observer-based detection and localization method was further developed for the physical layer. In addition, an adaptive threshold was designed to replace the traditional precomputed threshold and improve the detection performance of the DLAAs. Consequently, through the collaborative work of the cyber-physics layer, injected DLAAs were effectively detected and located. Compared with existing methodologies, the simulation results on IEEE 14-bus and 118- bus power systems verified the superiority of the proposed cyber-physical collaborative detection and localization against DLAAs.

Adaptive unknown input observer-based detection and identification method for intelligent transportation under malicious attack

This paper aims at developing a novel detection and identification method against malicious attacks in intelligent transportation. Due to the development and applications of communication and advanced sensor technologies, intelligent transportation has faced new safety risks. In particular, the emerging malicious attacks, such as false data injection attack, can mask the destruction of physical dynamic by tampering with information in layer to fool the current detection methods. Because of this reason, an adaptive unknown input observer-based detection and identification method is developed. Firstly, a physical dynamics model of vehicle networking system is established by considering the actual physical state. Considering the spoofing characteristics of false data injection attack, an unknown input observer-based detection method is proposed. Through the design of adaptive unknown input observer parameters, the detection performance, can be improved by cutting down the state estimation error. Compared with the UIO-based detection method, simulations demonstrate that the false positive rate can be reduced 0.1%. Based on the feature of state residuals that is not sensitive to the attacked ith residual, but sensitive to other residuals, a novel identification criterion is developed. At last, simulation experiments on the Matlab verify the performance of the proposed detection and identification algorithm in intelligent transportation system.

Detection-based active defense of biased injection attack based on robust adaptive controller

As the promising technology, the cooperative cyber-physical system can enhance the operating efficiency and reliability of smart grids. Meanwhile, the characteristics that deep integration of cyber-physical system can make smart grid face new security problems caused by false data injection attack. To maintain a safe and stable operation of smart grids, timely detection and defense of the emerging false data injection attacks, such as biased injection attack, is crucial. For this reason, this paper aims at developing a detection-based active defense mechanisms against biased injection attacks via robust adaptive controller. Through the established physical dynamic power model, an improved adaptive observer-based detection algorithm is proposed. Through the design of observer parameters, the proposed adaptive observer can enhance the accuracy of estimation state. In contrast to well-known attack detection methods for smart grids, the performance of attack detection under the developed detection algorithm can be effectively improved, such as the accuracy of state estimation and false positive rate. Through the above results provided by the attack detection, a robust adaptive controller-based active defense method is further developed. The proposed method can offset the impact of biased injection attack to maintain the stable running of power system. Simulation studies demonstrate the reliable response of the developed active defense method against biased injection attacks.

Dynamic Reduced-Order Observer-Based Detection of False Data Injection Attacks With Application to Smart Grid Systems

This article investigates the problem of attack detection of false data injection attacks for a class of large-scale smart grid systems in the context of cyber–physical systems. First, by exploiting the graph theory to decompose the considered system into multiple interconnected subsystems, a bank of dynamic reduced-order observers are delicately constructed to generate residual signals for the attack detection task. Then, a novel decentralized attack detection scheme is proposed based on the adaptive detection thresholds with prescribed performance. Compared with the existing results, the proposed detection scheme has less conservative thresholds and enhanced robustness against process disturbance and measurement noise, such that the detectability is improved. Finally, the effectiveness and availability of the proposed scheme are verified by two simulation examples and the experimental results from IEEE 30-bus system built in the OPAL-RT real-time simulator.

A Dynamic-State-Estimator-Based Tolerance Control Method Against Cyberattack and Erroneous Measured Data for Power Systems

Cyberattacks against measured variables and faulty metering devices are among the most important threats to modern systems that should be detected and isolated, and the control actions based on the measured variables should be appropriate in order to keep the power system security. This article proposes a dynamic-state-estimation-based cyberattack-tolerant control method for modern power systems. The proposed method involves two new schemes: one is for dynamically detecting the cyberattack and the other isolates the location of the attack. These schemes are based on dynamic observer designs that can eliminate the effects of unknown inputs. This article also proposes a fault-tolerant control technique using these observer-based detection and isolation schemes. The proposed method can accurately track dynamic states, detecting both cyberattack against measured variables and faulty measuring devices, and isolating the cyberattack and fault locations. The results verify its superiority in comparison with other techniques.

Detection and Isolation of False Data Injection Attack in Intelligent Transportation System via Robust State Observer

As the future of transportation systems, the intelligent transportation system is a promising technology to improve the increasingly serious traffic problems. However, the integration of cyber-physical systems makes them vulnerable to new cyber–physical attacks. To ensure the security of intelligent transportation systems, a novel robust state observer-based detection and isolation method against false data injection attacks is developed. Based on the constructed dynamic model of intelligent vehicle networking, the covert characteristic of a false data injection attack is analyzed. Then, a novel state residuals-based detection criterion is developed by using a real-time observed state. To shorten the detection time, an adaptive detection threshold is designed to replace the existing computed threshold. In addition, robust state observer banks are established to isolate multiple injected attacks. Finally, simulation results on the vehicle networking system demonstrate the effectiveness of the developed detection and isolation method against false data injection attacks.

A zonotopic set-invariance analysis of replay attacks affecting the supervisory layer

This paper presents a zonotopic set-invariance analysis of replay attacks affecting the communication network that serves the supervisory layer of complex control systems using an observer-based detection scheme. Depending on the attacker’s access to the system’s resources, two scenarios are considered: (I) Sensors and controller data are counterfeited; (II) Only sensor measurements are counterfeited. The effect of a physical attack against the plant during the data replay is also taken into consideration. The representation of invariant sets as zonotopes allows to derive analytical expressions for attack detectability under the presence of bounded uncertainties. The validity of the analysis is demonstrated through simulations using a quadruple-tank process.

A novel secure observer-based controller and attack detection scheme for Networked Control Systems

This paper proposes security techniques for detecting and counteracting attacks in Networked Control Systems (NCSs). A partially homomorphic based encryption technique, namely the Paillier scheme, is used to protect the confidentiality of the transmitted data over the network against eavesdropping attacks. An integrated secure and private observer-based controller with guaranteed stability together with a secure and private observer-based detection system has been developed. We start with an encrypted observer. Then, an observer-based encrypted controller is added to stabilize the system. Besides, an encrypted observer-based detection algorithm has been used to detect false data injection attacks. Moreover, in our design, the computations on the observer, the controller, and the decision-maker operate on encrypted data while protecting against eavesdropping attacks. Using digital processors in cyber systems leads to quantized transmitted signals through the network and also to design the observer and controller operations in such a way that they work on quantized data efficiently. Limitations on the parameters of the quantizations and the encryption scheme are given to ensure the stability of the closed-loop system and guarantee reliable bounds on the closed-loop performance. Simulation results using Tennessee Eastman Process demonstrate the effectiveness of the proposed scheme.

Observer-based detection and reconstruction of dynamic load altering attack in smart grid

This paper mainly focuses on the problems of attack detection and reconstruction of cyber physical systems (CPS) under dynamic load altering attacks (D-LAA). Taking the smart grid as an example, firstly, the power system subjected to the attack is modeled as a power CPS through system characteristics to provide conditions for attack detection. On this basis, we assume that two vulnerable loads are attacked simultaneously to investigate the impact of the attack on the system. Secondly, a robust sliding mode observer is designed to implement attack reconstruction with the residual signal generated by the observer. After that, an attack detection logic is applied to complete the attack detection by comparing the threshold with the residual. Finally, a three generators and six buses power system is given as an example to verify the feasibility of attack detection and reconstruction by using the real-time simulation platform built by StarSim and MT respectively. The simulation results are given in this paper.

Observer-based detection and identification of sensor attacks in networked CPSs

This paper presents several observer-based detection and identification strategies to characterize sensor attacks for descriptor type cyber–physical systems (CPSs). In contrast to recent works we do not consider state estimators relying on centralized paradigms, but propose distributed and decentralized state estimators to characterize sensor attacks. We also show a set of sufficient conditions to ensure exponential convergence of the estimation errors in the absence of malicious attacks, along with a bound on the convergence rates. We then design algorithms to solve the attack detection and identification problem for a large-scale CPS. Finally, a series of numerical experiments are performed on the IEEE-6 and 118 bus power systems.

Detection and Isolation of False Data Injection Attacks in Smart Grid via Unknown Input Interval Observer

This article investigates the detection and isolation of false data injection (FDI) attacks in a smart grid based on the unknown input (UI) interval observer. Recent studies have shown that the FDI attacks can bypass the traditional bad data detection methods by using the vulnerability of state estimation. For this reason, the emergency of FDI attacks brings enormous risk to the security of smart grid. To solve this crucial problem, an UI interval observer-based detection and the isolation scheme against FDI attacks are proposed. We first design the UI interval observers to obtain interval state estimation accurately, based on the constructed physical dynamics grid model. Through the capabilities of the designed UI interval observers, the accurate interval estimation state can be decoupled from unknown disturbances. Based on the characteristics of the interval residuals, a UI interval observer-based global detection algorithm was proposed. Particularly, the interval residual-based detection criteria can address the limitation of the precomputed threshold in traditional bad data detection methods. On this basis, we further consider the detection and isolation of FDI attacks under structure vulnerability. Namely, there exist undetectable FDI attacks in the grid system. Taking the attack undetectability problem into account, a logic judgment matrix-based local detection and isolation algorithm against FDI attacks are developed. Based on the combinations of observable sensor cases, local control centers can further detect and isolate the attack set under structure vulnerability. Finally, the effectiveness of the developed detection and isolation algorithms against FDI attacks is demonstrated on the IEEE 8-bus and IEEE 118-bus smart grid system, respectively.

Detection and Location of Bias Load Injection Attack in Smart Grid via Robust Adaptive Observer

This article studies the detection and location of the bias load injection attack (BLIA) in smart grid. As one of typical false data injection attacks (FDIAs), the BLIA aims at destroying the vulnerable generator load. In particularly, the BLIA can bypass the traditional bad data detection techniques, by compromising the measurable sensor-data estimation. Because of this reason, the emergency of BLIA brings enormous threat to the security of smart grid. To address this problem, a detection and location framework against BLIA consisting of three steps is proposed. In the first step, we propose a topology structure-based subregion division algorithm to reduce the complexity of attack detection in the large-scale grid system. In the second step, taking the stealthy characteristics of the BLIA into account, a robust adaptive observer-based detection algorithm is proposed. Through of capabilities of observers, we can estimate the physical dynamics accurately. To detect the BLIA quickly and avoid missed alarm, we compute the adaptive threshold as a substitute for the precomputed threshold, by taking the model linearization error and external disturbance into account. In the third step, we propose a logical judgment matrix to address the sensor attack undetectability problem under structure vulnerability, based on the combinations of all observable sensors. Finally, the effectiveness of the proposed detection and location framework is illustrated, by using detailed case studies on the IEEE 55-bus smart grid system.

Detection and Isolation of False Data Injection Attacks in Smart Grids via Nonlinear Interval Observer

This article investigates the detection and isolation of false data injection (FDI) attacks in a smart grid based on the unknown input (UI) interval observer. Recent studies have shown that the FDI attacks can bypass the traditional bad data detection methods by using the vulnerability of state estimation. For this reason, the emergency of FDI attacks brings enormous risk to the security of smart grid. To solve this crucial problem, an UI interval observer-based detection and the isolation scheme against FDI attacks are proposed. We first design the UI interval observers to obtain interval state estimation accurately, based on the constructed physical dynamics grid model. Through the capabilities of the designed UI interval observers, the accurate interval estimation state can be decoupled from unknown disturbances. Based on the characteristics of the interval residuals, a UI interval observer-based global detection algorithm was proposed. Particularly, the interval residual-based detection criteria can address the limitation of the precomputed threshold in traditional bad data detection methods. On this basis, we further consider the detection and isolation of FDI attacks under structure vulnerability. Namely, there exist undetectable FDI attacks in the grid system. Taking the attack undetectability problem into account, a logic judgment matrix-based local detection and isolation algorithm against FDI attacks are developed. Based on the combinations of observable sensor cases, local control centers can further detect and isolate the attack set under structure vulnerability. Finally, the effectiveness of the developed detection and isolation algorithms against FDI attacks is demonstrated on the IEEE 8-bus and IEEE 118-bus smart grid system, respectively.

Pseudo-automatic characterization of the morphological and kinematical properties of coronal mass ejections using a texture-based technique

The white light coronagraphs onboard SOHO (LASCO-C2 and -C3) and most recently STEREO (SECCHI -COR1 and -COR2) have detected a myriad of coronal mass ejections (CME). They are a key component of space weather and under certain conditions they can become geo-effective, hence the importance of their kinematic characterization to help predict their effects. However, there is still a lot of debate on how to define the event boundaries for space weather purposes, which in turn makes it difficult to agree on their kinematic properties. That lack of agreement is reflected in both the manual and automated CME catalogs in existence. To contribute to a more objective definition and characterization of white-light coronagraph events, Goussies et al. (2010) introduced recently the concept of “texture of the event”. Based on that property, they developed a supervised segmentation algorithm to allow the automatic tracking of dynamic events observed in the coronagraphs field of view, which is called CORonal SEgmentation Technique (CORSET). In this work, we have enhanced the capabilities of the algorithm by adding several new functionalities, namely the automatic computation of different morphological and kinematic parameters. We tested its performance on 57 well-studied limb CME events observed with the LASCO coronagraphs between 1997 and 2001, and compared the parameters obtained with those from three existent CME lists: two of them obtained from an observer-based detection and tracking method (i.e., two manual catalogs), and the other one based on the automated detection and characterization of the CME events (i.e., a fully automated catalog). We found that 51 events could be tracked and quantified in agreement with the CME definition. In general terms, the position angle, and the radial and expansion speeds are in agreement with the manual catalogs used for comparison. On the other hand, some discrepancies between CORSET and the automated catalog were found, which can be explained by the different delimitation of the CME angular extent.

Modeling Time Varying System Perturbations: Application to Robust Change Detection and Identification

This paper discusses the problem of modeling time varying system perturbations and its application to observer-based detection filter design in uncertain linear systems. Robustness issues with respect to structured time varying system perturbations are considered. Our basic contribution is that applying differential algebraic methods and matrix lie-algebra in describing the effect of them varying system perturbation, it is possible to construct an extended linear time invariant(LTI) system and associated observer such that the solution of the design problem can be performed using algebraic methods and geometric concepts similar to the case of time invariant situations. At the same time the filter can be made robust with respect to these perturbations.