Zero-dynamics Attack Research Articles

Quantized Zero Dynamics Attacks Against Sampled-Data Control Systems

Quantized Zero Dynamics Attacks Against Sampled-Data Control Systems

Modeling and Detection Scheme for Zero-Dynamics Attack on Wind Power System

In a wind farm, wind power system is key to maintaining continuous generation of point energy. Since Zero-Dynamics attack poses a major risk to future wind farms, investigation on the effect of Zero-Dynamics attack against wind power systems has both theoretical and practical importance. In this paper, we consider a scenario in which a wind power system is subject to Zero-Dynamics attack in power generation chain. Firstly, we transform a semi-direct D-PMSG into an equivalent circuit to establish mathematical model of wind power system under Zero-Dynamics attack. Then, we analyze and prove the advantages and limitations of Zero-Dynamics attack by divide the equation of state into a stable part and an unstable part with the help of system relative degree ρ. In addition, to better achieve desired attack effect, adjustments are made for Zero-Dynamics attack based on its limitations. Finally, we combine an Multiple Linear Regression (MRL) predictive control model with Byrnes-Isidori normal form to protect wind power system. The theoretical results were verified on designed small wind power system.

Secure Nonlinear Sampled-Data Control System Against Stealthy Attack: Multirate Approach

In this paper, we provide a novel defence strategy for a nonlinear sampled-data control system under zero-dynamics attacks. In a sampled data structure, sampling zeros induced by discretization make a system vulnerable to deception attacks. we analyze the dissipativity in the zero-dynamics part of the system equipped with a multi-rate setup and find conditions on sampling rates to neutralize the attacker's target plan. We show that, under some mild conditions, using multi-rate sampling in the nonlinear sampled-data system not only preserves the dissipativity property of the intrinsic zero-dynamics but also stabilizes the extrinsic zero-dynamics induced by the sample and hold process, and as a result attenuate the effects of attacks on the system stability. Finally, a numerical example is used to illustrate the effectiveness of the proposed approach.

Research on Secure State Estimation and Recovery Control for CPS under Stealthy Attacks

As the application of cyber-physical systems (CPSs) becomes more and more widespread, its security is becoming a focus of attention. Currently, there has been much research on the security defense of the physical layer of the CPS. However, most of the research only focuses on one of the aspects, for example, attack detection, security state estimation, or recovery control. Obviously, the effectiveness of security defense targeting only one aspect is limited. Therefore, in this paper, a set of security defense processes is proposed for the case that a CPS containing multiple sensors is subject to three kinds of stealthy attacks (i.e., zero-dynamics attack, covert attack, and replay attack). Firstly, the existing attack detection method based on improved residuals is used to detect stealthy attacks. Secondly, based on the detection results, an optimal state estimation method based on improved Kalman filtering is proposed to estimate the actual state of the system. Then, based on the optimal state, internal model control (IMC) is introduced to complete the recovery control of the system. Finally, the proposed methods are integrated to give a complete security defense process, and the simulation is verified for three kinds of stealthy attacks. The simulation results show that the proposed methods are effective.

Passive Attack Detection for a Class of Stealthy Intermittent Integrity Attacks

This paper proposes a passive methodology for detecting a class of stealthy intermittent integrity attacks in cyber-physical systems subject to process disturbances and measurement noise. A stealthy intermittent integrity attack strategy is first proposed by modifying a zero-dynamics attack model. The stealthiness of the generated attacks is rigorously investigated under the condition that the adversary does not know precisely the system state values. In order to help detect such attacks, a backward-in-time detection residual is proposed based on an equivalent quantity of the system state change, due to the attack, at a time prior to the attack occurrence time. A key characteristic of this residual is that its magnitude increases every time a new attack occurs. To estimate this unknown residual, an optimal fixed-point smoother is proposed by minimizing a piece-wise linear quadratic cost function with a set of specifically designed weighting matrices. The smoother design guarantees robustness with respect to process disturbances and measurement noise, and is also able to maintain sensitivity as time progresses to intermittent integrity attack by resetting the covariance matrix based on the weighting matrices. The adaptive threshold is designed based on the estimated backward-in-time residual, and the attack detectability analysis is rigorously investigated to characterize quantitatively the class of attacks that can be detected by the proposed methodology. Finally, a simulation example is used to demonstrate the effectiveness of the developed methodology.

Privacy and Security in Network Controlled Systems via Dynamic Masking

In this paper, we propose a new architecture to enhance the privacy and security of networked control systems against malicious adversaries. We consider an adversary which first learns the system using system identification techniques (privacy), and then performs a data injection attack (security). In particular, we consider an adversary conducting zero-dynamics attacks (ZDA) which maximizes the performance cost of the system whilst staying undetected. Using the proposed architecture, we show that it is possible to (i) introduce significant bias in the system estimates obtained by the adversary: thus providing privacy, and (ii) efficiently detect attacks when the adversary performs a ZDA using the identified system: thus providing security. Through numerical simulations, we illustrate the efficacy of the proposed architecture.

Stealthy Local Covert Attacks on Cyber-Physical Systems

In cyber-physical systems (CPS), the networked structure not only enhances the accessibility of data, but also introduces the risk of cyber attacks. The stealthy attacks that are undetected by the monitoring system, are the most dangerous type of cyber attacks. In this article, we introduce a new attack strategy to call attention to the problem of stealthy cyber attacks on CPS. The proposed attack scenario does not require access to all control input signals and sensor output signals, so it needs fewer disruption resources and is called a local covert attack. We show that the local covert attack can be made completely stealthy by applying the decoupling technique or by combining the basic idea of a covert attack and a zero-dynamics attack. Simulation results are provided to demonstrate the stealthiness of the proposed local covert attacks.

Geometrical Characterization of Sensor Placement for Cone-Invariant and Multi-Agent Systems against Undetectable Zero-Dynamics Attacks

Undetectable attacks are an important class of malicious attacks threatening the security of cyber-physical systems, which can modify a system's state but leave the system output measurements unaffected and hence cannot be detected from the output. This paper studies undetectable attacks on cone-invariant systems and multi-agent systems. We first provide a general characterization of zero-dynamics attacks, which characterizes fully undetectable attacks targeting the nonminimum phase zeros of a system. This geometrical characterization makes it possible to develop a defense strategy seeking to place a minimal number of sensors to detect and counter the zero-dynamics attacks on the system's actuators. The detect and defense scheme amounts to computing a set containing potentially vulnerable actuator locations and nodes and a defense union for feasible placement of sensors based on the geometrical properties of the cones under consideration.

Periodic zero‐dynamics attacks for discrete‐time second‐order multi‐agent systems

AbstractThis article studies the zero‐dynamics attacks (ZDAs) issue for discrete‐time second‐order multi‐agent systems (MASs) in a directed interacting setting. It is shown that the consensus among interacting agents fails if the considered system is attacked by infinite number of ZDAs. As for the scenario of finite number of periodic ZDAs, the consensus value, specified by the weight of the initial conditions, can only be destroyed whenever the rooted agents are attacked, apart from the attack signal satisfying certain constraints. Based on this observation, we further give conditions upon which the consensus of MASs subject to finite number of ZDAs cannot be achieved. Finally, simulation examples associated with power networks are presented to support the devised setup.

A Generalized Hold Based Countermeasure Against Zero-Dynamics Attack With Application to DC-DC Converter

Zero-dynamics attack (ZDA) is a model based cyber attack. It is stealthy in the sense that the existence of attack signal cannot be determined by monitoring the system output, and it is effective to systems that have unstable zero-dynamics. Several countermeasures against ZDA have been introduced, and the one employing the generalized hold (GH) is considered in this paper. The GH is a generalized version of zero-order hold that is commonly used in the digital control systems. In this paper, the lethality of ZDA and the effectiveness of GH as a countermeasure are demonstrated on a control system that involves a DC-DC converter. Through extensive simulations and experiments, the design of the proposed scheme is presented in detail and relevant practical issues are discussed.

Zero-dynamics attacks on networked control systems

The coupling of physical systems with information technologies infrastructure in a networked control system (NCS) has a number of advantages such as remote control, reduced system complexity, low maintenance cost and improved system efficiency. But these benefits come at the cost of making the NCS vulnerable to cyberphysical attacks on the communication layer. One such class of attacks is the zero-dynamics attack (ZDA) which targets the internal dynamics of an NCS with the potential to cause serious damage to the physical system while remaining stealthy. A better understanding of how ZDAs are constructed will enable more effective countermeasures. In this paper, we discuss two approaches for constructing a ZDA and demonstrate using three industrial processes studied in this context perhaps for the first time.

Zero-Dynamics Attack on Wind Turbines and Countermeasures Using Generalized Hold and Generalized Sampler

Most wind turbines are monitored and controlled by supervisory control and data acquisition systems that involve remote communication through networks. Despite the flexibility and efficiency that network-based monitoring and control systems bring, these systems are often threatened by cyberattacks. Among the various kinds of cyberattacks, some exploit the system dynamics so that the attack cannot be detected by monitoring system output, the zero-dynamics attack is one of them. This paper confirms that the zero-dynamics attack is fatal to wind turbines and the attack can cause system breakdown. In order to protect the system, we present two defense strategies using a generalized hold and a generalized sampler. These methods have the advantage that the zeros can be placed so that the zero dynamics of the system become stable; as a consequence, the zero-dynamics attack is neutralized. The effects of the countermeasures are validated through numerical simulations and the comparative discussion between two methods is provided.

Zero Assignment via Generalized Sampler: A Countermeasure Against Zero-Dynamics Attack

Networked control systems have advantages such as flexibility, efficiency, but at the same time they are exposed to cyberattacks. Among many lethal attacks, the zero-dynamics attack is a model based attack and it is very hard to detect. In this paper, a new strategy for intrusion detection and defense against zero-dynamics attack is proposed, and it is based on the generalized sampler that takes a weighted average of multiple samples obtained during one sampling interval. By using the generalized sampler instead of the simple sampler, the zeros of the sampled-data system can be placed at arbitrary locations, and if all zeros are placed inside the unit circle, the attack signal becomes no longer effective. This strategy still works even if all the information is exposed to hackers and it is considerably insensitive to the shift of intrinsic zeros. A design procedure for the generalized sampler is provided under mild assumptions. Furthermore, optimal designs for the selection of desired zeros are formulated considering practical issues. Theoretical findings are validated through numerical simulations.

Novel Stealthy Attack and Defense Strategies for Networked Control Systems

This paper studies novel attack and defense strategies, based on a class of stealthy attacks, namely the zero-dynamics attack (ZDA), for multi-agent control systems. ZDA poses a formidable security challenge since its attack signal is hidden in the null-space of the state-space representation of the control system and hence it can evade conventional detection methods. An intuitive defense strategy builds on changing the aforementioned representation via switching through a set of carefully crafted topologies. In this paper, we propose realistic ZDA variations where the attacker is aware of this topology-switching strategy, and hence employs the following policies to avoid detection: (i) pause, update and resume ZDA according to the knowledge of switching topologies; (ii) cooperate with a concurrent stealthy topology attack that alters network topology at switching times, such that the original ZDA is feasible under the corrupted topology. We first systematically study the proposed ZDA variations, and then develop defense strategies against them under the realistic assumption that the defender has no knowledge of attack starting, pausing, and resuming times and the number of misbehaving agents. Particularly, we characterize conditions for detectability of the proposed ZDA variations, in terms of the network topologies to be maintained, the set of agents to be monitored, and the measurements of the monitored agents that should be extracted, while simultaneously preserving the privacy of the states of the non-monitored agents. We then propose an attack detection algorithm based on the Luenberger observer, using the characterized detectability conditions. We provide numerical simulation results to demonstrate our theoretical findings.

Security Enhancement of Sampled-Data Systems: Zero Assignment via Generalized Sampler

Remote control systems have advantages in terms of flexibility and efficiency, but at the same time, they are exposed to cyber-attacks. Zero-dynamics attack is one of the most lethal model-based cyber attacks due to its stealthiness. In this paper, a new zero-dynamics attack neutralizing strategy is proposed, which is based on the generalized sampler. By using generalized sampler, the zeros of the discrete-time system can be placed at arbitrary locations, and if all zeros are placed inside the unit circle, the attack signal itself is neutralized. This strategy still works even if all the information is exposed to hackers. Furthermore, the proposed method is insensitive to shifting the intrinsic zeros comparing to the existing zero-assignment based methods. A design procedure of generalized sampler is provided, and theoretical findings are validated through the numerical simulations.

Neutralizing zero dynamics attack on sampled-data systems via generalized holds

Zero dynamics attacks can be lethal to cyber–physical systems because they can be harmful to physical plants and impossible to detect. Fortunately, if the given continuous-time physical system is minimum phase, the attack is not so effective even if it cannot be detected. However, the situation can become unfavorable if one uses digital control by sampling the sensor measurement and using a zero-order hold for actuation because of the ‘sampling zeros.’ When the continuous-time system has a relative degree greater than two and the sampling period is small, the sampled-data system must have unstable zeros (even if the continuous-time system is minimum phase), so that the cyber–physical system becomes vulnerable to ‘sampling zero dynamics attack.’ In this paper, we present an idea to neutralize the zero dynamics attack for single-input and single-output sampled-data systems by shifting the unstable discrete-time zeros into stable ones. This idea is realized by employing the so-called ‘generalized hold’ which replaces a standard zero-order hold. It is shown that, under mild assumptions, a generalized hold exists which places the discrete-time zeros at desired positions. Furthermore, we formulate the design problem as an optimization problem whose performance index is related to the inter-sample behavior of the physical plant, and propose an optimal gain which alleviates the performance degradation caused by generalized hold as much as possible.

Stealthy Adversaries Against Uncertain Cyber-Physical Systems: Threat of Robust Zero-Dynamics Attack

In this paper, we address the problem of constructing a robust stealthy attack that compromises uncertain cyber-physical systems having unstable zeros. We first interpret the (non-robust) conventional zero-dynamics attack based on Byrnes–Isidori normal form, and then present a new robust zero-dynamics attack for uncertain plants. Different from the conventional strategy, our key idea is to isolate the real zero-dynamics from the plant's input–output relation and to replace it with an auxiliary nominal zero-dynamics. As a result, this alternative attack does not require the exact model knowledge anymore. The price to pay for the robustness is to utilize the input and output signals of the system (i.e., disclosure resources). It is shown that a disturbance observer can be employed to realize the new attack philosophy when there is a lack of model knowledge. Simulation results with a hydro-turbine power system are presented to verify the attack performance and robustness.