Stealthy Attacks Research Articles

Stealthy attacks and attack-resilient interval observers

Industrial control systems have been frequent targets of cyber attacks during the last decade. Adversaries can hinder the safe operation of these systems by tampering with their sensors and actuators, while ensuring that the monitoring systems are not able to detect such attacks in time. This paper presents methods to design and overcome stealthy attacks on linear time-invariant control systems that estimate their state using an interval observer, in the presence of unknown but bounded noise and perturbations. We analyze scenarios in which a malicious agent compromises the sensors and/or the actuators of the system with additive attack signals to steer the state estimate outside of the bounds provided by the interval observer. We first show that maximally disruptive attack sequences that remain undetected by a linear monitor can be computed recursively via linear programming. We then design an attack-resilient interval observer for the system’s state, identifying sufficient conditions on the sensor data for such an observer to be realizable. We propose a computational method to determine optimal observer gains using semi-definite programming and compute bounds for the unknown attack signal as well. In numerical simulations, we illustrate and compare the ability of such interval observers to still provide accurate estimates when under attack.

Decentralized Moving Target Defense for Microgrid Protection Against False-Data Injection Attacks

This paper proposes the Decentralized Moving Target Defense via Data Replication (DMTDR) framework, which increases the security of microgrids by adding two layers of uncertainty that limit the success of false-data injection attacks. The DMTDR framework exploits the scalability and low cost of IoT devices to replicate relevant sensory and control signals, which are randomly transmitted through independent communication channels. Then, one of the transmitted replicas is randomly selected to reach its intended destinations. As opposed to most moving target defense (MTD) approaches found in the literature, the proposed DMTDR does not require central coordination but instead it can be applied to any monitoring or control device that utilizes a communication channel. Furthermore, the proposed approach does not deteriorate the system performance in normal operation. The theoretical foundations for the optimal allocation of replicas per signal are developed, and fundamental limits of uncertainties introduced by the framework are calculated. Moreover, taking advantage of the replicated information, a decentralized attack detection strategy is introduced, which is able to detect the presence of malicious data by only using local information without requiring the computation of any estimation model. The proposed framework is demonstrated on a test microgrid, where the data replication and random transmission are implemented on a WiFi network with IoT devices. The results show that the proposed framework considerably improves: i) security by limiting the impact of false-data injection attacks; ii) detectability by enabling the detection of stealthy attacks.

Optimal encryption strategy for cyber-physical systems against stealthy attacks with energy constraints: A Stackelberg game approach

This paper investigates the problem of encryption strategy for cyber-physical systems based on the Stackelberg game theoretic model with a stealthy attacker and a defender. In order to defend against the attacker who can inject false data without being detected by the detector, an encryption mechanism is proposed. Different from the existing results, the energy constraints are introduced to limit the attack times of attacker and encryption rank of defender, respectively. Under the framework of Stackelberg game, the optimal encryption strategies against worst-case stealthy attacks are designed for accumulative and terminal estimation performance, which increase the difficulty of launching stealthy attacks and diminish the impact of attacks on system performance simultaneously. Finally, simulation examples are provided to demonstrate effectiveness of the proposed strategy.

Stealthy attack detection method based on Multi-feature long short-term memory prediction model

Industrial control systems (ICS) face severe threats due to the inherent vulnerability of shared networks. Among the attacks against ICS, stealthy attack is an attack behavior in which an attacker injects false sensor measurements or drives signals into the control loop, evading detection by the intrusion detection system (IDS). They are highly destructive and difficult to detect because of concealment. In related studies, data-driven methods have the shortcomings of a large computation burden. Physics-based methods are usually difficult and expensive to change the system structure. Moreover, most of the current methods against stealthy attacks take up a considerable amount of system resources due to training or the pursuit of robustness. In this paper, using the importance and correlation of neglected feature data, an stealthy attack detection method based on the Multi-feature LSTM (MFLSTM) model is innovatively developed to predict and recover data attacked. Random Forest (RF) scores and heatmap are used to judge the importance and correlation of the feature data. Then the forget gates of the LSTM model are improved to construct an MFLSTM model that can learn predictive information from other feature data and decouples the attack conditions that stealthy attack relies on. The testing results indicated that MFLSTM has significant advantages in prediction accuracy, stability, and resource-saving. MFLSTM model saved 52.3% of the resources required for the same type of prediction. The single-point prediction mean square error (MSE) for the STEP 7 (S7) protocol attack signature prediction and secure water treatment (SWaT) dataset were 0.0471 and 0.0035, respectively, which also demonstrates the feasibility of our proposed method.

Secret inference and attacktability analysis of discrete event systems

In the discrete event systems literature, the studies addressing opacity usually assume a passive intruder, who has full knowledge of the structure of a system but with only a partial observation ability. This work touches upon the opacity problem in discrete event systems modeled with labeled Petri nets, by assuming the existence of an active intruder. Herein, an active intruder, whose abilities exceed passive observations, is assumed to be able to manipulate the behavior of a system through sensor attacks in a practical manner, i.e., in an embedded way, in order to compromise the opacity of a system. In this setting, a framework for opacity verification is first proposed from the intruder’s viewpoint, where opacity is referred to as “language-based opacity”. A verification algorithm is then derived to identify opaque secret words. Two stealthy attack models named sensor-failure-making strategy and sensor-injection-making strategy are introduced, allowing the intruder to implant/damage some sensors, i.e., add/delete some events, in line with the original behavior of a system, in order to infer the secret information. An algorithmic procedure for attractability analysis is provided for each attack strategy. Once a system is proved to be attackable, a stealthy attack structure that synthesizes different sensor-failure-making (resp. sensor-injection-making) attacks is constructed. Furthermore, we demonstrate the validity and efficiency of the proposed approaches by implementing the presented algorithms and running experiments on a manufacturing system example.

Interval observer‐based consensus control of discrete‐time multi‐agent systems under stealthy attacks

AbstractIn this paper, interval observer‐based consensus control is developed for multi‐agent systems with unknown input signals, sensor noises, and stealthy attack signals. Compared with the conventional robust observer, the interval observer has more relaxed preconditions for the systems, so the interval observer is more extensive. First, design an interval observer for each subsystem and linearly transform into a form that is easy to obtain the coefficient matrices of the interval observer. Then, based on the upper bound estimation of the observer, design a consensus control protocol, and the technique is used to suppress the unknown input signals. Finally, a numerical simulation example is presented to illustrate the feasibility and correctness of the developed method.

Sparse Data Injection Attacks on Smart Grid: An Information-Theoretic Approach

Sparse data injection attacks are data injection attacks that target a limited number of sensors in the smart grid paradigm. In this paper, sparse attack construction strategy is proposed for the information-theoretic stealth attacks, in which the attacker minimizes the amount of information acquired by the operator about the power system from the observations and the probability of being detected simultaneously. For Gaussian distributed state variables, closed-form expression is proposed for the optimal Gaussian sparse attacks when the attacker targets deterministic observations and gets access to the full system information. Based on that, two target observation selection strategies are introduced to find the vulnerable observations in the system, in which the algorithms take different tradeoff strategies between performance and computational time. Furthermore, a locally perfect stealthy attack construction strategy is proposed for the case in which the attacker only has partial system information but gets access to real-time realizations of the local state variables. The optimality of Gaussian sparse attacks and the performance of the selection strategies are validated on the IEEE 30 Bus and 118 Bus test systems.

Detection of false data injection attacks leading to line congestions using Neural networks

The connection between smart grids and buildings in smart cities can align energy supply and demand more efficiently with real-time communication. Because of the deep interactions between the cyber and physical systems, the detection of cyberattacks targeting the smart grid has become a challenge in recent years. False data injection (FDI) attacks can bypass the bad data detection algorithm to overflow multiple transmission lines and eventually cause cascading failures or blackouts. In this paper, a simplified neural network is developed to detect FDI attacks targeting transmission line overflows. Compared with the state-of-the-art that mainly focused on stealthy attacks bypassing state-estimation, the novelty of the proposed approach is detecting stealthy attacks that not only bypass the state-estimation, but also result in congestion of transmission lines in smart grids. A bad dataset, created by an attack model, is mixed with a set of clean data to train the proposed detection framework. The numerical results demonstrate high accuracy of this method in detecting cyber–physical attacks. Also, several case studies are included to test the resilience of the proposed method in various scenarios.

A GAN-Based Data Injection Attack Method on Data-Driven Strategies in Power Systems

With the expansion of system scale and data size in power systems, data-driven methods are gradually becoming widely used. However, compared with traditional methods, data-driven methods face more threats in data security and algorithm security. This paper proposes a black box data injection attack method against data-driven strategies in power systems. To obtain a stealthy attack scheme with the greatest impact, an attack vector generator based on deep convolutional neural networks (DCNN) is designed. The generator includes a node selector, a filter, an encoder, and a decoder. The node selector is used to select the most likely successful attack scheme for the filter, the encoder is used to extract sample features, and the decoder is used to generate disturbances based on the features. The proposed generator is trained with an improved generative adversarial network (GAN) and can generate minimal disturbances in real time based on measurement data from the power grid. The effectiveness of the proposed method is demonstrated with an attack experiment on an online transient stability application.

Vulnerability Identification and Remediation of FDI Attacks in Islanded DC Microgrids Using Multiagent Reinforcement Learning

This article proposes a novel approach to uncover deficiencies of the existing cyber-attack detection schemes and thereby to serve as a foundation for establishing more reliable cybersecure solutions, with particular application in dc microgrids. For this purpose, a multiagent deep reinforcement learning (RL)-based algorithm is proposed to automatically discover the vulnerable spots in the conventional index-based cyberattack detection schemes and automatically generate coordinated stealthy destabilizing false data injection (FDI) attacks on cyber-protected islanded dc microgrids. To enable a continuous action space for the trained RL agents and enhance the algorithm’s precision and convergence rate, deep deterministic policy gradient is incorporated. Using this approach, susceptibility of a state-of-the-art detection scheme to several different coordinated FDI attacks on the distributed communication links is identified. The proposed algorithm is also enhanced with a sniffing feature to enable maintaining the stealthy attacks even under the sudden disconnection of any of the compromised links. To address the discovered deficiencies within the index-based detection scheme, a complementary multiagent RL detection algorithm using deep <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$Q$</tex-math></inline-formula> -network algorithm is integrated, which provides a more reliable overall identification performance. Taking into account the communication delays and load changes, the effectiveness of the proposed algorithm is verified by the experimental tests.

How to Secure Distributed Filters Under Sensor Attacks

In this article, we study how to secure distributed filters for linear time-invariant systems with bounded noise under false-data injection attacks. A malicious attacker is able to arbitrarily manipulate the observations for a time-varying and unknown subset of the sensors. We first propose a recursive distributed filter consisting of two steps at each update. The first step employs a saturation-like scheme, which gives a small gain if the innovation is large corresponding to a potential attack. The second step is a consensus operation of state estimates among neighboring sensors. We prove the estimation error is upper bounded if the filter parameters satisfy a condition. We further analyze the feasibility of the condition and connect it to sparse observability in the centralized case. When the attacked sensor set is known to be time-invariant, the secured filter is modified by adding an online local attack detector. The detector is able to identify the attacked sensors whose observation innovations are larger than the detection thresholds. Also, with more attacked sensors being detected, the thresholds will adaptively adjust to reduce the space of the stealthy attack signals. The resilience of the secured filter with detection is verified by an explicit relationship between the upper bound of the estimation error and the number of detected attacked sensors. Moreover, for the noise-free case, we prove that the state estimate of each sensor asymptotically converges to the system state under certain conditions. Numerical simulations are provided to illustrate the developed results.

On the Animal Trail

On the Animal Trail

An Enhanced Intrusion Detection System for IoT Networks Based on Deep Learning and Knowledge Graph

Nowadays, the intrusion detection system (IDS) plays a crucial role in the Internet of Things (IoT) networks, which could effectively protect sensitive data from various attacks. However, the existing works have not considered multiview features fusion and failed to capture the semantic relationships among the anomalous requests. They are not robust and cannot detect the attack types in real-time. This paper proposes a lightweight intrusion detection system based on deep learning and knowledge graph. First, our system extracts semantic relationships and key features by knowledge graph and statistical analysis. Then, IoT network requests are converted into word vectors through multiview feature fusion and feature alignment. Finally, an attention-based CNN-BiLSTM model is designed to identify malicious request attacks, which can capture long-distance dependence and contextual semantic information. Experiment results show that the proposed model significantly outperforms the existing solution in the robustness of the model. Moreover, it can select more critical features for IDS to achieve better accuracy and lower the false alarm rate. Compared with the state-of-the-art systems, the proposed IDS achieves a higher detection accuracy of 90.01%. In addition, our system can detect various stealthy attack types (including DoS, Probe, R2L, and U2L) and extract semantic relationships among features.

Experimental evaluation of sensor attacks and defense mechanisms in feedback systems

We evaluate theoretical results, developed under linearity assumptions, on the feasibility of, the worst-case impact of, and defense mechanisms against a stealthy sensor attack in an experimental setup. The goal is to determine if this sensor attack poses a threat to real systems as well. We demonstrate that for a controller with stable dynamics the stealthy sensor attack is possible to conduct and the theoretical worst-case impact is close to the achieved practical one. However, although the attack should theoretically be possible when the controller has integral action, we show that the integral action slows the attacker down and the attacker is not able to remain stealthy if it has not perfect knowledge of the controller state. In addition to that, we investigate the effect of different anomaly detectors on the attack impact and our experiments indicate that the impact under detectors with internal dynamics is smaller for the considered attack objective. Finally, we demonstrate how noise injection into the controller dynamics can unveil the otherwise stealthy attacks.

Applied methods to detect and prevent vulnerabilities within PLC alarms code

Adversaries may target alerting alarms raised by PLCs (Programmable Logic Controllers) to prevent notifying operators of critical conditions, to hide faults, to disrupt operations, to cause damages to ICS (Industrial Control Systems) and surrounding environment, or to lead to financial loss. The paper focuses on exposing vulnerabilities of the ladder logic code that handles the alerting alarm messages and how to mitigate them. A real-time test bed of a PLC alarms code was developed and used to conduct several stealthy attack techniques to suppress or hinder alarms by exploiting code vulnerabilities. A novel ladder logic solution that consists of countermeasures against the introduced attacks was proposed, demonstrated, and tested. The countermeasure techniques, such as scan time and heartbeat techniques, were able to detect and prevent the code vulnerabilities and other abnormalities. The provided countermeasure techniques in this experiment could be applied to any PLC to enhance the validity and security of its PLC alarms code.Article HighlightsFour stealthy attack models were introduced to exploit PLC alarms code. They were embedded to skip, delete, fake out, or delay alerting alarms.Real-time countermeasure solutions with different techniques were introduced: scan time code, heartbeat code, and physical plausibility check. They effectively detected and prevented the introduced attack models.PLC alarms Code general abnormalities was validated and detected using scan time techniques.A list of general best code practices for PLC alarms code was introduced to mitigate code vulnerabilities.

Re] Process Aware Stealthy Attack Detection in Industrial Control Systems

Re] Process Aware Stealthy Attack Detection in Industrial Control Systems

Secure interval estimations for time‐varying delay interconnected systems using novel distributed functional observers

SummaryIn this article, we consider the problem of designing distributed functional observers for time‐varying delay interconnected systems under stealthy attacks. Distributed reduced‐order observers are first designed to construct bounds for the attack signals. Then, the obtained bounds of the attack signals are utilized to design novel distributed functional observers, which provide interval estimations for linear functions of the state vectors of subsystems when the time‐varying delay interconnected system is under stealthy attacks. Existence conditions of the distributed reduced‐order observers as well as distributed functional state observers are established, and an effective algorithm for computing unknown observer matrices is provided. A numerical example is used to confirm the effectiveness and advantages of the obtained results.

A zonotopic characterization of cyber‐physical system vulnerabilities

AbstractThis article is concerned with the security of a cyber‐physical system (CPS) against stealthy attacks. Stealthy attacks are malicious injections into sensor measurements without triggering detectors. We quantify the potential impact of stealthy attacks on system states using zonotopic reachable set. Then, a zonotopic framework is established to characterize the CPS vulnerabilities. Conditions for the existence of vulnerabilities are provided. Moreover, the level of such vulnerabilities is measured via one‐sided Hausdorff distance. Finally, numerical simulations are conducted to demonstrate the effectiveness of the proposed method.

Stealthy false data injection attacks with resource constraints against multi-sensor estimation systems

This paper mainly investigates how to maximally degrade estimation performance of a cyber–physical system under limited resource. A stealthy false data injection (FDI) attack scheme is proposed to only attack partial sensor channels of a multi-sensor estimation system. The attack stealthiness condition and the compromised estimation error covariance are respectively derived, and then the stealthy attack problem is formed as a constrained optimization problem. An explicit solution of the optimal attack strategy is given and proven. Furthermore, the relationship between the compromised estimation error covariance and the attacked sensor is analyzed, and then the sensor selection principle is derived to decide which sensor channel should be attacked. Finally, two numerical simulation examples are provided to confirm the theoretical analysis results.

Unified Detection of Attacks Involving Injection of False Control Commands and Measurements in Transmission Systems of Smart Grids

Transmission system operation and monitoring, in the context of smart grids, are heavily dependent on the correctness or aptness of supervisory control commands. These command channels are a part of the SCADA system, which is vulnerable to cyber-attacks. Maliciously injected commands can cause a wide range of issues including blackouts. However, the literature addressing this problem is limited. In order to fill this gap, a generalized framework is proposed to achieve simultaneous detection of attacks against various types of control devices/equipments used in transmission systems, even if they are carried out stealthily. First, generalized mathematical models of such stealthy attacks are presented. Then, based on these attack models, changes in the measurement covariance matrix that occur during an attack are exploited to formulate the proposed approach. We first mathematically characterize these changes using the eigenvectors and trace of the covariance matrix and then use them to develop a detection metric. It is observed that when the model of a false data injection (FDI) attack is considered, the developed detection metric is also capable of detecting such attacks. The algorithm that results from the detection metric is a generalized framework for detection of attacks against all types of transmission system controls and measurements. Moreover, the algorithm is non-iterative, computationally inexpensive, and independent of both the type of state estimation and communication technology used. The proposed algorithm is found to be effective, when tested on the IEEE 118-bus system.