Stealthy False Data Injection Research Articles

Two‐channel stealthy false data injection attacks design without estimator knowledge

AbstractThis paper primarily focuses on designing stealthy false data injection attacks targeting two communication channels in cyber‐physical systems equipped with state estimators and attack detectors. It introduces the concept of perfect attacks, rendering the attack detector unable to detect the designed attack signals, thereby enabling attackers to further destabilize the system. Through the error model designed by the attacker, the designed attack does not require knowledge of the state estimator. By injecting a carefully designed perfect attack into the communication channel, it is possible to extend the state estimation error of a residual detector system based on the Kalman filter to infinity. Moreover, this designed attack can bypass the residual‐based detector, thus achieving a completely stealthy attack. Finally, the results of theoretical derivations are validated by a numerical example and a practical case.

Improved Stealthy False Data Injection Attacks in Networked Control Systems

Improved Stealthy False Data Injection Attacks in Networked Control Systems

Joint Meter Coding and Moving Target Defense for Detecting Stealthy False Data Injection Attacks in Power System State Estimation

Joint Meter Coding and Moving Target Defense for Detecting Stealthy False Data Injection Attacks in Power System State Estimation

Stealthy FDI attacks on modified Kalman filtering in complex networks with non-Gaussian-Lévy noise

This paper investigates the problem of network security for stealthy false data injection (FDI) attacks under modified Kalman filtering (MKF) over complex networks with non-Gaussian-Lévy noise (NGLN). Initially, a modified Kalman filter (MKFR) is proposed to estimate system states, where the estimation function is related to the probabilistic characteristics of Lévy noise, and the saturation threshold is designed in relation to Lévy noise parameters. The upper bound of error covariance is obtained, and the boundedness of the upper bound is proven through the use of mathematical induction and iterative methods. Second, based on the MKF, this paper proposes a two-channel stealthy FDI attacks (TSFAs) strategy that is related only to the system model, which is injected into the sensor-to-controller (S-C) and controller-to-actuator (C-A) transmission channels at the same time. In addition, the attacker sets two MKFRs as observers to estimate the states of the target system, which are used to adjust the attack signal. Third, a sufficient condition is obtained that demonstrates the stability of the system. Meanwhile, TSFAs can avoid being detected by the residual-based detector to guarantee stealthiness. Finally, the effectiveness of the MKF is verified by the numerical simulation, and the stealthiness of the TSFAs and the impact on the system stability are also demonstrated.

Stealthy False Data Injection Attacks Detection and Classification in Cyber-Physical Systems Using Deep Reinforcement Learning

Stealthy False Data Injection Attacks Detection and Classification in Cyber-Physical Systems Using Deep Reinforcement Learning

Chance-constrained vulnerability assessment of smart water distribution systems against stealthy false data injection attacks

Smart water distribution systems (SWDSs) have not only enhanced the monitoring and control of the entire water infrastructure but have also jeopardized its security and resilience. The state-of-the-art examined the uncertainties in the water supply network to obtain optimal design parameters to ensure hydraulic integrity. However, the investigations of uncertainties in SWDSs from the cybersecurity perspective remain unexplored. To address this limitation, this paper utilizes a robust chance-constrained optimization strategy to scrutinize the vulnerable location of SWDSs against False Data Injection (FDI) attacks. This is achieved by factoring in the probabilistic behavior of water demand at junctions that can potentially facilitate stealthy FDI attacks on the hourly measurements of the pump’s flow rate. The proposed nonlinear model is validated with several case studies reflecting the real-world cyberattack consequences including cutoff water supply of the network, enhanced power consumption of the pump, and the undesirable pressure surge in the system at strategic locations of SWDSs. As a result of the studied cases, the cyberattack consequences on the entire water supply network are obtained while highlighting the threat-prone regions of the network. This paper contributes to embedding additional security layers to the existing water infrastructure at the vulnerable links and junctions.

Assess: anomaly sensitive state estimation with streaming systems

Information and communication technology (ICT) is an increasing part of modern power systems, which are, therefore, recognised as cyber-physical energy system (CPESs). The increase of ICT affects the situational awareness in CPESs, which is traditionally solely based on information about the power system but not about the ICT system. However, CPESs are facing various challenges regarding the integrity, correctness, and availability of process data due to the interconnection with ICT. Examples are stealthy false data injection attack (FDIAs). This paper pursues a holistic approach to describe the quality of process data, which brings together aspects like integrity, correctness, and availability in multivariate trust values. The arising research question this paper deals with is, how multivariate trust in physical measurements in a CPES can be modelled, estimated, and integrated into situational awareness. A proposed framework implements a context-sensitive and multivariate trust model as well as a trust sensitive state estimation. While these two artefacts are already published, the focus of this paper is on the implementation of the framework and the fulfilment of the requirements for timeliness, interoperability, flexibility, and scalability. It is evaluated in three different scenarios with CIGRE and IEEE benchmark grids.

The sensor‐actuators stealthy cyber‐attacks framework on networked control systems: A data‐driven approach

AbstractIn this study, we address two fundamental questions that are crucial for designing stealthy cyber‐attacks similar to false data injection. The first question involves obtaining an accurate dynamic model of the target to ensure stealthy performance under a detector. The second question pertains to understanding the opponent's ongoing detection tactics, such as dynamic watermarking, and developing a counter‐strategy. To answer the first question, we propose a data‐driven framework that calculates the accurate dynamic model used in stealthy false data injection cyber‐attacks, including zero dynamics attacks, covert attacks, and replay attacks. To address the second question, we present a scheme against the dynamic watermarking defense strategy, which typically detects replay attacks. We validate the methods introduced in this study through an experimental setup of a cyber‐physical system, which includes an omnidirectional mobile robot, a wireless network router, and a remote control center.

Prevention and Detection of Coordinated False Data Injection Attacks on Integrated Power and Gas Systems

The growing reliance of integrated power and gas systems (IPGSs) on information and communication technology has left them prone to cyber-attacks. To protect IPGSs against such attacks, having comprehensive knowledge about possible attack strategies and their potential impacts is essential. On this basis, this paper (i) presents a new family of coordinated stealthy false data injection attacks (FDIAs) whose aims are to disconnect gas-fired power plants (GFPPs) by targeting IPGS measurements, (ii) develops a preventive defense strategy against the introduced family of attacks by improving the security of high-risk measurements, and (iii) proposes an online learning-based detection scheme using secured measurements. Initially, from an adversary point of view, a two-stage attack model is developed to construct the FDIA vector. In the first stage, power system measurements are manipulated to maximize the grid reliance on the targeted GFPPs, while bypassing bad data detection schemes. In the second stage, the measurements of gas networks (GNs) are falsified to portray a fake leakage, so forcing the operator to disconnect under-attack pipelines and interrupting the supply of fuel to targeted GFPPs. Each stage is formulated as an attacker-operator bi-level optimization problem, which is solved as mixed-integer linear programming (MILP) by converting the operator level to its corresponding Karush–Kuhn–Tucker (KKT) conditions. Afterwards, based on possible attack scenarios, high-risk measurements are identified to be secured as a preventive defense strategy. Finally, a multilayer perceptron (MLP) model is trained to detect cyber-attacks against IPGS. The performance of the proposed method is corroborated through simulations on IEEE 24-Bus 20-Node IPGS and IEEE 118-bus 135-node IPGS.

Detection of Stealthy False Data Injection Attacks in Modular Multilevel Converters

A modular multilevel converter (MMC) in a high-voltage direct-current (HVDC) transmission system consists of an electric-coupled physical system and a communication-coupled cyber system, leading to a cyber-physical system (CPS). Such a CPS is vulnerable to false data injection attacks (FDIA), which are the main category of cyberattacks. FDIAs can be launched by injecting false data into the control or communication system of the MMC to change the submodule (SM) capacitor voltage seen by the central controller. Consequently, the capacitor voltage of the attacked SM will deviate from its normal value and thus threaten the safe operation of the converter. Stealthy FDIAs characterized by elaborated attack sequences are more dangerous because they can deceive and bypass the attack detector presented in the existing literature for the MMC. To address this issue, this paper proposes a stealthy FDIA detection method to obtain the real SM capacitor voltages. Thus, the attacked SM can be located by comparing its real capacitor voltage with prespecified thresholds. Simulation results validate the effectiveness of the proposed detection and protection strategies.

An Intrusion Detection Method Based on Self-Generated Coding Technology for Stealthy False Data Injection Attacks in Train-Ground Communication Systems

This paper investigates the problem of intrusion detection of stealthy false data injection (FDI) attacks in train-ground communication systems. An intrusion detection method is proposed based on the self-generated coding technology. Different from the existing pseudo-random coding generators-based detection methods, the proposed method designs a self-generated multiplicative coding scheme by employing the authentication mechanism, where the coding sequences to encrypt and decrypt the original measurement data of trains are dynamically updated by parsing the latest timestamp online such that the attacker is not able to obtain the prior knowledge of the coding sequences, which improves the security of the data transmission in the train-ground communication network. Under stealthy FDI attacks, the proposed method increases the output residuals of the remote state estimator, which ensures that the residual-based detector continuously outputs alarm. Furthermore, in order to mitigate the impact of the attack on the system, a dead reckoning algorithm-based defence model is established to reconstruct the position information of trains compromised by the attacker. Finally, the effectiveness and superiority of the proposed method are verified through semi-physical simulation experiments.

Deep Latent Space Clustering for Detection of Stealthy False Data Injection Attacks Against AC State Estimation in Power Systems

This paper proposes a self-supervised latent space clustering algorithm, called the Deep Latent Space Clustering, for the detection of stealthy false data injection attacks (FDIAs) in smart grids against state estimation algorithms. The stealthy FDI model considered is based on the accurate AC state estimation and is able to bypass conventional bad data detection (BDD) algorithms with ease. The key element of the detection model is a stacked autoencoder network that first undergoes a carefully designed two-step finetuning process, following which a trainable clustering head is stacked on top of the finetuned encoder and the final network is further trained to achieve a clean clustering of the data into benign and compromised samples without labelled supervision. To test the efficacy and scalability of the detection model, it is tested on the standard IEEE 14 bus, 118 bus and 300 bus test systems. The self-supervised clustering model is compared to several supervised, semi-supervised and unsupervised algorithms proposed in the literature for detection of FDI on the aforementioned test cases and has been found to perform at par with the state of the art among them.

Analysis of Stealthy False Data Injection Attacks Against Networked Control Systems: Three Case Studies

Analysis of Stealthy False Data Injection Attacks Against Networked Control Systems: Three Case Studies

Window-type detector for stealthy false data injection attack in cyber-physical systems

In recent years, the security issues of cyber-physical systems (CPSs) have attracted extensive attention from researchers. In this paper, a novel window-type detector (WTD) is designed for stealthy false data injection (FDI) attack targeted at CPSs. In the absence of attack, the evaluation value of a WTD is distributed because of the existence of Gaussian noise. In the presence of attack, the evaluation value of the WTD is the result of accumulating the residual data caused by attack signals, which is similar to the mechanism of a summation (SUM) detector. It is proved that when the duration of system operation is much larger than the attack duration squared, evaluation value of an SUM detector is distributed due to the huge number of tolerable historical data. And the structure of finite window size prevents the WTD from failure in such a situation, which equips it with better performance in the detection of attacks with medium duration. Furthermore, it is proved that the closer the window size is to the attack duration, the larger the evaluation value is, which means that the better detection performance could be achieved. Finally, numerical examples are given to verify the characteristics of the WTD.

Efficient Predictive Monitoring of Linear Time-Invariant Systems Under Stealthy Attacks

Attacks on industrial control systems (ICSs) can lead to significant physical damage. While off-line safety and security assessments can provide insight into vulnerable system components, they may not account for stealthy attacks designed to evade anomaly detectors during long operational transients. In this article, we propose a predictive online monitoring approach to check the safety of the system under potential stealthy false data injection attacks (FDIAs) on sensors. Specifically, we adapt previous results in reachability analysis for attack impact assessment to provide an efficient algorithm for online safety monitoring for linear time-invariant (LTI) systems. The proposed approach relies on an off-line computation of symbolic reachable sets in terms of the estimated physical state of the system. These sets are then instantiated online, and safety checks are performed by leveraging ideas from ellipsoidal calculus. We illustrate and evaluate our approach using the Tennessee–Eastman process. We also compare our approach with the baseline monitoring approaches proposed in previous work and assess its efficiency and scalability. Our evaluation results demonstrate that our approach can predict in a timely manner if an FDIA will be able to cause damage while remaining undetected. Thus, our approach can be used to provide operators with real-time early warnings about stealthy attacks.

Optimal stealthy false data injection attacks for networked linear quadratic Gaussian control systems with two channels

SummaryIn this paper, a security problem in networked control systems which are modeled as linear quadratic Gaussian control systems is investigated from the perspective of attackers. We consider the scenario that the attackers can inject false data into two channels: sensor‐to‐controller and controller‐to‐actuator channels. The goal of attackers is to design the optimal stealthy false data injection attacks to maximize the linear quadratic Gaussian control cost function, where Kullback‐Leiber divergence is used as a stealthiness metric. Firstly, the cost function is divided into a fixed part and a part which is related to a remote estimation error covariance. Then, when the two channels are attacked by attackers, the recursion of remote estimation error covariance is derived. In the presence of attacks, the optimization problem with multiple decision variables, which may not be a convex problem, is transformed into a convex optimization problem and the corresponding optimal solution is obtained. In addition, an upper bound of benefit loss when using the optimal solution of the convex optimization problem is presented. Finally, a simulation example is presented to show the effectiveness of the obtained results.

Stochastic Stealthy False Data Injection Attacks Against Cyber-Physical Systems

This article studies the impact of stochastic stealthy false data injection attacks on the security of cyber-physical systems. The Kullback–Leibler divergence is used as the metric of stealthiness to detect the system anomalies. The attacker is able to inject false data into measurement and actuation channels at the same time. The goal of an attacker is to destabilize the systems while maintaining the Kullback–Leibler divergence under a certain threshold. First, in order to keep the stealthiness of attacks, the relationship between the threshold of Kullback–Leibler divergence and the upper bounds on the norms of mathematical expectation and covariance of the compromised innovation is given. Then, the sufficient and necessary conditions for the insecurity of systems are derived when all the measurement channels are compromised by an attacker. Furthermore, some sufficient conditions for the security of systems are presented in the cases that part of or no measurement channels are compromised. Finally, simulations are provided to illustrate the effectiveness of the obtained results.

Attention-aware deep reinforcement learning for detecting false data injection attacks in smart grids

Cyber-attacks have long undermined the security and stable operation of the smart grid. The increasing share of intermittent energy aggravates the uncertainty of the grid environment and makes it easier for attacks to be stealthy. In recent research, attackers can construct highly stealthy false data injection attacks (FDIAs) with as little-known information as possible. Faced with a volatile grid environment and severe cyber threats, we propose a deep reinforcement learning FDIAs detection method. It focuses on state attention to address the problems of state feature extraction in existing reinforcement learning detection methods. The proposed approach adds an attention mechanism to the model-free deep reinforcement learning detection algorithm to extract state features. Selective attention helps us focus on the important parts instead of distracting from irrelevant details, making the states more representative and distinguishable, thus improving the reinforcement learning framework to detect attacks faster and more accurately. The proposed method has experimented on IEEE-14, and IEEE-118 bus systems provided by the Institute of Electrical and Electronics Engineers (IEEE) and demonstrates the method’s satisfaction in terms of detection accuracy and efficiency compared with similar methods.© 2017 Elsevier Inc. All rights reserved.

A Resilient Cyber-Physical Demand Forecasting System for Critical Infrastructures against Stealthy False Data Injection Attacks

The safe and efficient function of critical national infrastructure (CNI) relies on the accurate demand forecast. Cyber-physical system-based demand forecasting systems (CDFS), typically found in CNI (such as energy, water, and transport), are highly vulnerable to being compromised under false data injection attacks (FDIAs). The problem is that the majority of existing CDFS employ anomaly-based intrusion detection systems (AIDS) to combat FDIAs. Since the distribution of demand time series keeps changing naturally with time, AIDS treat a major change in the distribution as an attack, but this approach is not effective against colluding FDIAs. To overcome this problem, we propose a novel resilient CDFS called PRDFS (Proposed Resilient Demand Forecasting System). The primary novelty of PRDFS is that it uses signature-based intrusion detection systems (SIDS) that automatically generate attack signatures through the game-theoretic approach for the early detection of malicious nodes. We simulate the performance of PRDFS under colluding FDIA on High Performance Computing (HPC). The simulation results show that the demand forecasting resilience of PRDFS never goes below 80%, regardless of the percentage of malicious nodes. In contrast, the resilience of the benchmark system decreases sharply from about 99% to less than 30%, over the simulation period as the percentage of malicious nodes increases.

Experience-Driven Attack Design and Federated-Learning-Based Intrusion Detection in Industry 4.0

The advent of Industry 4.0 facilitates the Int- ernet-of-Things-based-transactive energy system (IoTES), which enables innovative services with numerous independent distributed systems. These systems generate heterogeneous data in bulk, which become susceptible to cyber-attacks, particularly the stealthy false data injection attacks (FDIAs). The existing centralized FDIA detection algorithms often breach data privacy and fail to perform effectively in highly dynamic and distributed environments, such as IoTES. To resolve the issue, initially, a recurrent deep deterministic policy gradient is utilized to invent an experience-driven FDIA in a complex IoTES. The attacker intends to intelligently exploit the data integrity of smart energy meters with insufficient knowledge of the system. Subsequently, to countermove the stealth and enable independent clients to train a centralized model while keeping each client’s data privacy intact, a deep-federated-learning-based decentralized FDIA detection method using an attentive aggregation is exploited in this article. The proposed approach is capable of parallel computing and can reliably identify the stealthy FDIA on all the nodes simultaneously. Simulation results validate that the proposed scheme outperforms the state-of-the-art methods under a distributed environment with a significantly higher detection accuracy and lower computational complexity while keeping the data privacy intact.