Detecting Intrusion Faults in Remotely Controlled Systems

Transcription

1 2009 Aerican Control Conference Hyatt Regency Riverfront, St. Louis, MO, USA June 10-12, 2009 FrB11.3 Detecting Intrusion Faults in Reotely Controlled Systes Salvatore Candido and Seth Hutchinson Abstract In this paper, we propose a ethod to detect an unauthorized control signal being sent to a reote-controlled syste (deeed an intrusion fault or intrusion ) despite attepts to conceal the intrusion. We propose adding a rando perturbation to the control signal and using signal detection techniques to deterine the presence of that signal in observations of the syste. Detection of these perturbations indicates that an authorized or trusted operator is in control of the syste. We analyze a worst case scenario (in ters of detection of the intrusion), discuss construction of signal detectors, and deonstrate our ethod through a siple exaple of a point robot with dynaics. I. INTRODUCTION Recently, there has been increased interest in networked control systes. While the possibility of controlling systes over established wireless, shared, or public networks has any benefits, it also requires that security join established perforance characteristics such as perforance, reliability, and efficiency during the design process. With this in ind, researchers have begun to address security issues specific to control systes, e.g. [1], [2], and have continued to develop control schees to identify alfunctioning or alicious systes coponents, e.g. [3], [4], [5]. Typically protection of counication between an operator and a reote control syste involves cryptography. Whether using encryption, essage signing, or authentication, protection fro a unauthorized user, an intruder, relies on a secret key unknown to intruders [6], [7]. If an intruder finds away to disrupt the counication channel and route an alternate control signal to replace the operator s signal, it is possible that the loss of control ay go undetected for soe length of tie. If the intruder s goal is to conceal the intrusion and the operator s noinal control input is known or can be deduced in advance, the intruder can iic that control input and the operator will be oblivious to intrusion. This could be desirable because the intruder ay want to take control of the syste as soon as possible, to ensure that the intrusion will be successful, but not utilize that control until a tie when the operator has no recourse to stop the intruder s alicious actions. If alerted quickly enough, the operator could possibly take action to preept the alicious action of the intruder. However, typically no echanis is in place to detect loss of control if the intruder is content to wait patiently for S. Candido is in the Departent of Electrical and Coputer Engineering, University of Illinois, Urbana, IL 61801, USA candido@illinois.edu S. Hutchinson is a Professor in the Departent of Electrical and Coputer Engineering, University of Illinois, Urbana, IL 61801, USA seth@illinois.edu the opportune oent to act. Our goal is to autoate the detection of such an intrusion. To this end, we propose an augentation to typical security systes that uses the constant observations of the syste which are already present in any control applications. We propose to send a randoized secret signal through the control syste, which will allow the operator to authenticate that his signal is reaching and controlling the syste. Chosen properly, sall perturbations in the syste s input should produce subtle, yet detectable fluctuations in observations of the syste. Since this signal is randoized, the intruder cannot replicate it fro a priori knowledge. Thus, if it is detected during observation of the syste, it provides good evidence that the operator s control signal is, in fact, driving the reote syste. If these fluctuations cannot be found in the output, the operator is ade aware that the syste ay be coproised and can begin taking easures to assure or regain control. It is iportant to ephasize that our proposed ethod is intended to add an additional failsafe to an already secured syste, not stand alone as a security schee. It is eant for cases where the intruder is able to prevent the operator s control signal fro reaching the plant and replace it with another signal. It is not eant for situations where the intruder is able to gain control of the the coputer on board the reote syste. The type of attacks we consider, while not coprehensive, are increasingly iportant because of the escalating aount of control counication being relayed over networks with interediate routing points that ay vulnerable to or owned by an intruder. Our approach to this proble is, to the knowledge of the authors, novel but the atheatical tools used to ipleent the solution are siilar to those used in a filtering based approach to active fault detection [8]. In active fault detection [9], [10], [11], [12], [13] and active paraeter detection approaches [14], [15], a control signal is designed for the purpose of driving the syste in such a way as to allow the operator to decide, based on output, which of a set of possible odels best describes the syste. In our case, the control input is chosen to be rando so the intruder cannot reproduce it. We, therefore, design an optial decision rule that decides if the sequence of observations is best explained by the rando signal being present or not. There is a significant conceptual reseblance between our approach and digital waterarking (e.g. [16]). We wish to ebed a hidden signal in a sequence of observations of our syste and detect its presence to verify the control signal being sent to the syste is legitiate. However, there are a nuber of significant differences between this and the /09/$ AACC 4968

2 Fig. 1. Reote control syste block diagra. canonical waterarking proble. For exaple, the output of the syste, the signal to be waterarked, is not known when the auxiliary signal is applied and there are no concerns about an intruder intentionally reoving the waterark. While enhancing the security of the syste, this ethod has the downside of adding additional rando noise to the syste dynaics. However, in soe cases, sall perturbations in soe syste coponents can be negligible in the perforance of the overall syste. For exaple, a convoy of trucks oving hazardous aterials could slightly vary their noinal speed or position within a lane of a road. Both of these quantities can easily be onitored externally fro an observer watching the convoy fro above. Candidate systes to eploy this ethod should have stable basins of attraction around their noinal trajectory, be observed in a anner that cannot easily be coproised, and not attenuate high frequency signal coponents beyond detection. The contribution of this paper is to propose a new ethod for verifying control signals sent over a link between an operator and control syste by detecting when that link is coproised. We consider different types of systes and give conditions under which we can use an efficient, recursive decision rule. In cases where we can not, we discuss the theoretical difficulties and where nuerical algoriths ay be sufficient. We then present an exaple of our ethod on a siple hypothetical syste. Finally, we discuss soe shortcoings of our ethod and a nuber of questions that will need to be answered beyond our exploratory analysis. II. GENERAL SYSTEMS Consider the block diagra in Figure 1. We odel reote systes using stochastic, nonlinear differential equations of the for ẋ(t) = f (x(t), u(t)) + w(t) (1) y(t) = h (x(t), u(t)) + v(t) (2) where w(t) and v(t) are rando vectors corresponding to noise in the state and output odels, respectively. The vector x(t) is the state of the syste, f( ) is the syste equation which encodes syste dynaics, and h( ) is the output equation. The control u(t) is the input to the reote syste and y(t) is the observation. This reote syste is controlled over a counication channel and the desired control signal is r(t). A signal s(t) is randoly generated and added to r(t) by the trusted operator and then sent to the reote syste. This signal is the ain addition to the standard reote-controlled syste odel and the core idea is to detect intrusions by noting the absence of its effects in the observation of the syste s dynaics. Since s(t) is generated as needed, it is unknown to all parties except the trusted operator who records it as it is sent. This eans that detection of this signal in observations of the syste provides good evidence that the control signal sent over the channel has not been coproised by an intruder. We odel the signal received by the reote syste as u(t) = r(t) + s(t) + (t) where (t) is a rando vector corresponding to channel noise. We use the notation s(t) to indicate the part of the signal received by the reote syste. This signal will be different depending on whether the control signal originates fro the trusted operator or an intruder. The signal s(t) can either equal s(t), if the trusted operator s signal reaches the control syste, or soe other value, if an intruder has connected to the control syste. In our analysis, we consider the case where the intruder sends s(t) = 0 to iniize the difference between the u(t) with and without s(t). The operator observes z(t) = y(t) + n(t) where n(t) is also a rando vector and again corresponds to noise inherent in retrieving an observation over a counication channel. Several conditions, consistent with the goals of this ethod, ust be et for this schee to be practical. First, the operator s observations of the syste should be taken externally to the syste. This is iportant because if the observations are sent over the sae counication channel that is controlled by the intruder, the operator s inforation state could be anipulated. Secondly, we assue the intruder cannot siply switch control between the operator and hiself instantaneously. This assuption is reasonable as this ethod should be used in conjunction with other security easures that will be nontrivial for the intruder to break. If an intruder can break the security instantly and at will, then the otivation to conceal an intrusion is reoved. Finally, the intruder ust not be able to read the control signal being sent in real tie, and consequently learn s(t) in real tie. Although the intruder ay have prior knowledge of r(t), if he can siply detect s(t) as it is being transitted he ay be able to use that inforation to deceive the trusted operator. This condition can often be guaranteed by use of a provably secure encryption protocol [6] for securing the operator s control signal before transission over the channel. In this case, even if the intruder was able to obtain the encrypted version of the control signal, he could not extract the contents in real tie. Soe protocols coonly used to encrypt data for transission over an insecure network are RSA [17] and AES [18]. In this proble, we propose a strategy to detect an intruder attepting to conceal an intrusion by iicking the control strategy of the operator. Thus, the worst-case scenario will be an intruder who knows the operator s noinal reference control signal (without s(t)) exactly and also the probability distribution fro which s(t) is drawn. We consider the case where the intruder sends s(t) = 0 because it is the MMSE estiator for an intruder trying to predict s(t). By coparing 4969

3 predicted observations with and without rando perturbation to actual observations of the syste, the trusted operator can deterine if the rando perturbations added to the signal are influencing the control syste. Unfortunately, due to the stochastic nature of the syste, this deterination cannot be ade with coplete certainty in the general case. This is then a signal detection proble [19] with the signal being sent over an unorthodox transission channel. In this paper, we consider the discrete proble in which observations of the syste are given by the sequence {z(t)}. We will also treat {u t }, {r t }, and {s t } as discrete sequences.we will use the notation z i:j to denote a history of the signal z t between (and including) saples i and j, i.e. z i:j denotes {z i, z i+1,, z j }. The deterination of whether s t is present in u t is ade based the observations of z t by the trusted operator. We frae our decision as a hypothesis testing proble. After observing a sequence of N saples of the output, the proble is to decide between two possible hypotheses of the transitted signal: 1) H 0 : s 1:N = s 1:N, i.e. the trusted operator s control signal is received 2) H 1 : s 1:N = 0, i.e. an intruder s signal is received The decision is based on our observed output saples over that interval z 1:N. If we can say with certainty that s t is affecting the syste dynaics over a long enough tie span, this provides good evidence that the trusted operator is controlling the syste as no other party has a priori knowledge of s t, and the likelihood of an intruder replicating it fro only knowledge of the distribution of s t goes to zero as the nuber of saples increase. There are two ain issues to be overcoe to ipleent this fraework. First, we ust choose a decision rule that, given s 1:N, decides the hypothesis in a way that iniizes the probability of error. Secondly, in order to decide between these two hypotheses, we will need to copute the distributions P 1:N H 0 (z 1:N H 0 ) and P 1:N H 1 (z 1:N H 1 ), the probability density functions of 1:N under both hypotheses. Thus, we ust build a data representation that paraetrizes or coputes the pdf s. In cases where one cannot easily copute the distributions, an approxiation ay be sufficient. The decision rule will separate all saple histories z 1:N into two classes, R N and C = R N \. Based on the boundary of the decision set, a decision rule can be defined, δ : R N {0, 1}. We accept hypothesis H δ based on z 1:N. The decision rule and have the following relationship δ(z 1:N ) = { 1 z1:n 0 z 1:N C (3) In Sections II-A and II-B we show decision rules assuing we have an a priori distribution on the probability of intrusion and, for the case where we do not have this inforation, assuing the worst case. A. A Priori Knowledge of Probability of Intrusion In soe cases, it is feasible to estiate the frequency of attack on the syste. Assuing that we can estiate the probability of intrusion, we design a decision rule that iniizes p e, the probability of erroneous decision. Let π denote the probability that s t = s t, i.e. the trusted operator is in control of the syste. With probability 1 π, an intruder will control the syste. To deterine the optial with respect to p e, we iniize [ in p e(, π) = in (1 π) p 1:N H 1 (x H 1 )dx (4) C ] + π p 1:N H 0 (x H 0 )dx ( =(1 π) + in πp1:n H 0 (x H 0 ) (5) (1 π)p 1:N H 1 (x H 1 ) ) dx Since π, p 1:N H i (x H i ) 0, p e is iniized by choosing to be the set of locations where the integrand in (5) is negative. Thus, = { x R N : πp 1:N H 0 (x H 0 ) (1 π)p 1:N H 1 (x H 1 ) } and the optial decision rule is to accept H 1 if p 1:N H 0 (z 1:N H 0 ) p 1:N H 1 (z 1:N H 1 ) 1 π π is satisfied. The probability of error p e under this decision rule can be expressed as p e = in { πp 1:N H 0 (x H 0 ), (1 π)p 1:N H 1 (x H 1 ) } dx R N (7) although, in general, this quantity ay be expensive or ipossible to copute exactly. If z t is independent of z s for all t s, then the likelihood of any sequence z 1:N is just the product of the likelihoods of the eleents of the sequence. In this case, we can factor the likelihood ratio and the decision rule will be to accept H 1 if N [ ] pi H 0 (z i H 0 ) 1 π (8) p i H 1 (z i H 1 ) π i=1 This expression is, in general, coputationally feasible, while (6) ay be difficult or ipossible to copute. If the likelihood ratio can be factored then the likelihood ratio for t = N +1 can be coputed by ultiplying the single saple likelihood at t = N +1 by the likelihood ratio for t = N. The optiality condition in (4) can also be odified to weight the cost of the total probability of a false positive and false negative with respect to one another. However, the quantity iniized would no longer be the probability of error. B. No Prior Knowledge of Probability of Intrusion In cases where it is not feasible to estiate a probability of attack, the ethod of the previous section ay not be a practical solution. If we cannot deterine π a priori and prefer not to treat it as an arbitrary scaling of the decision (6) 4970

4 Fig. 2. Reote controlled stochastic, linear syste rule, we ay choose to ipleent the iniax decision rule. The cost function is in ax π p e (, π). [ ( ) p e (, π) = π p 1:N H 0 (x)dx p 1:N H 1 (x)dx ] C + p 1:N H 1 (x)dx (9) C Let (π) be the optial (iniizes p e ) given in the previous section for a fixed π. The function ax p e( (π), π) π over π [0, 1] is continuous and concave [19]. Fro (9) we can see that p e (, π) is linear in π given so, unless is chosen so that p e (, π) is independent of the choice π, the π that axiizes p e (, π) will be either zero or one. At the boundaries of the interval, p e ( (0), 0) = p e ( (1), 1) = 0 so the iniu average error ust be strictly zero or on the interior of the interval. Using Prop. II.C.1 fro [19], is a iniax rule if π (0, 1) and p 1:N H 0 (x H 0 )dx = p 1:N H 1 (x H 1 )dx (10) C For an arbitrary distribution, finding the set that satisfies (10) analytically ay not be possible. To find an approxiate nuerically, one can search [0, 1] for the optial π. This is done by choosing π i, the value to check at step i of the algorith and approxiating (π i ). Once the optial decision set for π i has been chosen by the criteria of Section II-A, copute p e ( (π i ), π i ) by perforing a nuerical integration. Based on the history of the π i s chosen and the probabilities of error coputed at those saples, one can choose π i+1 to reduce the interval in which π ay lie. If we reach arbitrarily close to π, check to ensure it is a iniax solution by testing to see if (10) is satisfied or if π is zero or one. If these conditions are not et, a non-randoized iniax decision rule ay not exist. In general, the perforance of this decision rule will not be as good as the one of the previous section but reoves the requireent for an estiate of the probability of intrusion. III. LINEAR SYSTEMS WITH GAUSSIAN NOISE As shown in the previous section, if the likelihood ratio can be factored, we can easily copute recursive decision rules. In this section, we discuss the special case of linear systes with Gaussian noise. A wide range of physical systes can be odeled or approxiated in this class of systes. We first briefly consider the special case of a eoryless syste, where no state estiator is required for the decision rule, and then the ore general case. Consider the special case of a eoryless channel with Gaussian, white noise. Since estiates of t do not depend on previous values of z t, the history of the output does not need to be paraetrized to copute the pdf of t. Let the syste equation be z t = D t u t + v t and, without loss of generality, consider v t to be both the noise fro the channel and within the reote controlled syste. The channel noise is v t N (0, Σ vt ) and {v t } is independent and identically distributed (iid). Since t has a Gaussian distribution, we can specify its distribution with the paraeters E t = D t (s t +r t ) and Var ( t ) = Σ vt. The rando variable t will be drawn fro the probability distribution P t H 0 (z t H 0 ) = N (D t (s t + r t ), Σ vt ) if s t = s t. If s t = 0 then t will be drawn fro P t H 0 (z t H 0 ) = N (D t r t, Σ vt ). Since the noise between saples is independent, the likelihood of any sequence z 1:N is just the product of the likelihoods of the eleents of the sequence between so the optial decision rule is to use the criterion of (8). In the ore general case, we consider a discrete stochastic, linear syste with additive, zero-ean Gaussian noise is odeled by the standard equations x t+1 = A t x t + B t u t + w t (11) z t = C t x t + D t u t + v t (12) where w t N (0, Σ wt ) and v t N (0, Σ vt ) as shown in Figure 2. Again, the rando variables w t and v t are due to both noise within the syste and on the counication channel. Once a state is added to the syste, two difficulties arise. First, Prob{ t = c} = Prob{ t = c z 1:t 1 } which eans we lose inforation by coputing the distribution of t without taking into account previous observations. Second, since t+1 depends on the noise at t as well as t + 1, t and s are no longer independent for t s. This eans the likelihood of z 1:N cannot necessarily be factored into the products of the likelihoods of the individual observations. Without this property, the pdf of 1:N could be a coplicated function that is possibly infeasible to copute or represent. We deal with the first proble by using a Kalan filter [20] to recursively copute an estiate of X t, the syste s state vector, conditioned on z 1:t 1. The second proble we will bypass by testing the innovation error between the observation and prediction of t. This quantity is Gaussian and uncorrelated with, thus independent of, previous innovation errors. We will copute the pdf s of sequences of innovation errors under H 0 and H 1 and use the likelihoods of the observed z 1:t 1 to decide intrusion. Define z t := t (C t E[X t z 1:t 1 ] + D t u t ) to be the innovation error of the observation process. It is a linear cobination of the rando variables t and E[X t z 1:t 1 ] and the output of the syste is a linear cobination of the rando variables X 0, {W t }, and V t. The syste odel requires these rando variables to be independent so they are jointly Gaussian (jg). Since t and E[X t z 1:t 1 ] are both linear cobinations of these jg rando variables, they theselves are jg and, since z t is a linear cobination of t and E[X t z 1:t 1 ], the innovation error is jg. 4971

5 The paraeters of the distribution z t conditioned on 1:t 1 are E[ z t 1:t 1 ] = 0 and Cov( z t 1:t 1 ) = C t Cov(X t ˆx t z 1:t 1 )Ct T + Σ vt. Since z t is jg, this copletely specifies the distribution z t N (0, C t Cov(X t ˆx t 1:t 1 )Ct T + Σ vt ). Now that we have deterined the distribution of z t, in order to use it at every stage of detection we will use the Kalan filter to store and propagate the paraeters of the distribution as new observations fro the syste becoe available [20]. Define ˆx t := E [X t 1:t 1 ] and Σˆxt := Var (X t ˆx t 1:t 1 ). The Kalan filter updates these two quantities recursively fro initial conditions ˆx 0 and Σˆx0 based on the uncertainty the initial state. We will only ention that the Kalan filter is the optial MMSE estiate for linear systes with Gaussian noise. For ore inforation on the Kalan filter, see [20], [21]. Our strategy is to use two Kalan filters to estiate the state of the syste. Both are given {z s } t 1 s=0 and one uses u t = r t +s t as the input, the other uses u t = r t as the input. As described above, we use these estiators to construct the paraetrization of the pdf of z t, the innovation error between the next observation and our prediction of that observation. We will test the likelihood of z t using both hypotheses and we will denote the ean and covariance of z t working under hypothesis H i as z t Hi and Σ zt Hi. We know fro the orthogonality principle [22] that E [ z t z s ] = 0 for all t s because the innovation error of the MMSE estiator is orthogonal to any function of the eleents of 1:t 1, which includes z s (assuing without loss of generality that t > s). Since z t and z s are uncorrelated and jg, they are independent. As the distribution of each z t is jg, the distribution of z 1:N will also be Gaussian. Since all the innovations are zero ean and independent of one another, the ean of z 1:N will be the zero vector of length N and the covariance atrix will be block diagonal with the i th block equaling C t Σˆxt Ct T + Σ vt. We will use the decision rules of Section II to decide intrusion using the likelihoods fro the two pdf s corresponding to H 0 and H 1. The optial decision rule when there is an a priori estiate of intrusion is analogous to (8), only using innovation errors. N ( ) p zi H 0 ( z i H 0 ) 1 π (13) p zi H 1 ( z i H 1 ) π i=1 In the case of no estiate of π, the decision boundary can be found analytically in the case of the pdf s being Gaussian. By varying π i and using nuerical approxiations to the Gaussian cdf, one can find the decision boundary that approxiately satisfies (10), the condition for a iniax solution. IV. EXAMPLE We now present an exaple of our fraework. Consider a point robot with ass and second order dynaics, oving on the real nuber line. The operator s control input is a scalar specifying the desired position of the robot to a PD controller. A specific trajectory for the robot r t is planned in Fig. 3. Exaple syste block diagra. advance by the trusted operator. At t = 0, an intruder ay have taken over the syste. If an intrusion has occurred, the goal of the intruder will be to avoid detection for as long as possible. The intruder has full knowledge of r t, the syste odel, and the distribution of s t. The trusted operator s goal is to detect an intrusion without deviating (ore than an additive rando Gaussian signal) away fro the preplanned r t. We will assue the noise in the process odel is Gaussian having zero ean and a diagonal covariance atrix with σ i, σ j, and σ k as the diagonal ters. The observation shows robot s position with additive Gaussian noise distributed according to N (0, σ o ). There is also channel noise with distributions N (0, σ ) and N (0, σ n ). This eans our full syste odel is x t+1 = z t = 1 t t x t + kp [ kp k d 0 k d u t + w t (14) ] x t + v t (15) where both w t and v t are ean zero and Gaussian.The atrix Σ w is diagonal with diagonal entries σ i, σ j, and σ + σ k and σ v = σ o + σ n. We have the option of choosing s t, so let it be another iid, Gaussian rando variable with zero ean and variance of σ s. This is the rando perturbation of which only the operator has knowledge, as it is generated online. We will track the state trajectory of the syste with two Kalan filters. We use the non-identity atrix coefficients of (14)-(15) along with the variances of v t and w t in the Kalan filters to estiate state. The two Kalan filters differ only in the signal u t given to the. The first, siulating H 0, will receive u t = r t + s t. The other, siulating H 1, will receive u t = r t. Then the likelihood of an innovation error of z = z t (C ˆx t Hi + Du t ) under hypothesis H i for the saple at tie t is [ L { z t H i } = (CΣˆxt Hi C T + σ v )] 1 2 2π { [ zt (C ˆx t Hi + Du t ) ] } 2 exp 2CΣˆxt Hi C T. (16) + σ v Since this is a linear syste and x 0, {w t }, and {v t } are jg, we know the likelihood ratio fro (8) is our optial decision rule. Thus, we can copute the likelihood ratio recursively for every t using L { z 1:t H 0 } L { z 1:t H 1 } = t s=1 L { z s H 0 } L { z s H 1 } = L { z 1:t 1 H 0 } L { z 1:t 1 H 1 } L { z t H 0 } L { z t H 1 } 4972

6 starting fro the initial condition where the likelihood ratio is one. If we have an a priori belief in the probability of intrusion, π, our decision rule will be L { z 1:t H 0 } L { z 1:t H 1 } 1 π π (17) If this inequality is satisfied, it signals the trusted operator that an intrusion is likely to have occurred. V. DISCUSSION The work presented in this paper is a proposed ethod, and significant exploration reains before a syste utilizing the principles discussed in this paper is deployed. This fraework is not designed to provide foolproof, coplete security for reotely controlled systes. Instead, we seek to augent current security easures by verifying the control signals sent to reote syste in environents where an intrusion ay go undetected due to a clever choice of control signals by the intruder. One cause for concern with this fraework is that if the reotely controlled syste is, for exaple, a low-pass filter, a high frequency s t ay not cause any significant effects in z t. Work will have to be done to quantify how large the agnitude of the rando signal will need to be in order to be detected in sufficiently few saples. Conversely, an s t with ore pronounced effects on the output will be easier to detect in the syste output. However, it will also, by definition, perturb the reote syste further away fro the noinal trajectory. As the reote syste oves along it s trajectory, it ay be possible to deterine criteria by which the distribution of s t could be adjusted autoatically based on the stability argin of the syste. For exaple, perhaps s t could be chosen to have a large effect in certain very stable configurations of the syste but when the syste is in a configuration where it could be easily pushed to instability, s t could be attenuated or set to zero teporarily. It ay also be possible to isolate the effects of s t on the overall trajectory of the syste if it is redundant. We ainly discussed the decision rule that used an a priori estiate of the probability of intrusion π. However, in practice, this will typically not be feasible to estiate, and using a iniax decision rule ay not be desirable. However, since π siply deterines the scaling factor of the likelihood ratio, it ay be chosen experientally. Another possible scenario if the operator is controlling any reote systes is to copute the likelihood ratios for each of the systes and attept to deterine if there is an outlier ratio, which would signal a possible intrusion. For the purpose of this paper, we assued that the intruder will sent u t = r t and not introduce an additional perturbation. Any additional perturbation would increase the expected ean square error between the operator s and intruder s control signals and it sees would ake intrusion easier for the operator to detect. However, it is possible that there is a perturbation that would be advantageous to the intruder. While ore exploration ust be done to deterine whether sending the MMSE of s t is an optial intruder strategy, we feel that the preliinary analysis perfored in this paper deonstrates the utility and the need for further exploration of this intrusion detection strategy. VI. CONCLUSIONS In suary, we have proposed a ethod to detect intrusions in reote-controlled systes. We have discussed the theory and ipleentation of this ethod and have shown a theoretical exaple of it on a siple robot syste. More exploration ust be done before this syste is ready for deployent but we are optiistic about the possibilities of intrusion detection using this ethod. REFERENCES [1] G. Baliga, S. Graha, C. Gunter, and P. Kuar, Reducing risk by anaging software related failures in networked control systes, in IEEE Conference on Decision and Control, 2006, pp [2] A. Saboori and C. Hadjicostis, Notions of security and opacity in discrete event systes, in CDC, 2007, pp [3] M. Franceschelli, M. Egerstedt, and A. Giua, Motion probes for fault detection and recovery in networked control systes, in Aerican Control Conference, 2008, pp [4] W. Chen and M. Saif, Output estiator based fault detection for a class of nonlinear systes with unknown inputs, in Aerican Control Conference, 2008, pp [5] R. Iserann, Fault-Diagnosis Systes: An Introduction Fro Fault Detection To Fault Tolerance. Springer, [6] O. Goldreich, Foundations of Cryptography. Cabridge University Press, [7] M. Benantar, Access Control Systes: Security, Identity Manageent and Trust Models. Springer, [8] X. hang, Auxiliary signal design in fault detection and diagnosis. Springer Verlag, [9] M. Siandl and I. Puncochar, Unified solution of optial active fault detection and optial control, in Aerican Control Conference, 2007, pp [10] F. Kerestecioglu and M. arrop, Input design for detection of abrupt changes in dynaical systes, International Journal of Control, vol. 59, no. 4, pp , [11] R. Nikoukhah, Guaranteed active failure detection and isolation for linear dynaical systes, Autoatica, vol. 34, no. 11, pp , [12] E. Courses and T. Surveys, Stochastic change detection based on an active fault diagnosis approach, in IEEE Conference on Decision and Control, 2007, pp [13] I. Andjelkovic, K. Sweetingha, and S. Capbell, Active fault detection in nonlinear systes using auxiliary signals, in Aerican Control Conference, 2008, pp [14] R. Mehra, Optial input signals for paraeter estiation in dynaic systes survey and new results, IEEE Transactions on Autoatic Control, vol. 19, no. 6, pp , [15] M. arrop, Optial experient design for dynaic syste identification. Springer Verlag, [16] I. Cox, M. Miller, J. Bloo, J. Fridrich, and T. Kalker, Digital Waterarking and Steganography. Morgan Kaufann, [17] R. Rivest, A. Shair, and L. Adlean, A ethod for obtaining digital signatures and public-key cryptosystes, Counications of the ACM, vol. 21, no. 2, pp , [18] J. Daeen and V. Rijen, The Design of Rijndael. Springer-Verlag, [19] H. V. Poor, An Introduction to Signal Detection and Estiation. Springer-Verlag, [20] R. Stengel, Optial Control and Estiation. Courier Dover Publications, [21] I. Rhodes, A tutorial introduction to estiation and filtering, IEEE Transactions on Autoatic Control, vol. 16, no. 6, pp , [22] H. Stark and J. Woods, Probability, Rando Processes, and Estiation Theory for Engineers. Prentice-Hall,