Structural Resilience of Cyberphysical Systems Under Attack

Transcription

1 Structural Resilience of Cyberphysical Systems Under Attack Bhaskar Ramasubramanian 1, M.A. Rajan 2, M. Girish Chandra 2 1 Department of Electrical and Computer Engineering, and Institute for Systems Research, University of Maryland, College Park, MD 20742, USA. 2 Innovation Labs, Tata Consultancy Services, Bangalore India. 1 / 13

2 Cyberphysical Systems Working of physical system intimately linked to functioning of computers that influence interactions among subsystems. Often controlled over a network computational resources and bandwidth affect their working. Consequence: system can be remotely attacked. (a) (b) (c) Figure: Examples of CPSs 2 / 13

3 Structural Resilience: Motivation Structural Approach: Motivation Large scale CPS: many states, variables values fluctuate computational analysis costly. Structural approach: knowledge of only positions of zero/ nonzero entries of system matrices. Properties will hold for almost all valid numerical realizations. 3 / 13

4 Structural Resilience: Motivation Structural Approach: Motivation Large scale CPS: many states, variables values fluctuate computational analysis costly. Structural approach: knowledge of only positions of zero/ nonzero entries of system matrices. Properties will hold for almost all valid numerical realizations. Prior Work Attacks on LTI systems in terms of controllability of a modified system [Barreto(2013)]. Structural design of large scale systems [Pequito(2015)]. Minimal structural controllability, minimal cost constrained structural controllability [Pequito(2014), Pequito(2015)]. 3 / 13

5 Structured Linear Systems Consider the linear structured system: ẋ(t) = [A]x(t) + [B]u(t) Structural framework: every entry in [A] and [B] is either a fixed zero or a free parameter. Structural Controllability ([A], [B]) is structurally controllable if there exists an admissible numerical realization (A, B) that is controllable. If ([A], [B]) is structurally controllable, then almost every admissible numerical realization will be controllable. The structured system is then said to be generically controllable. 4 / 13

6 Structured Systems and Graph Theory Directed Graph Representation D = (V, E), where V = U X and E = E A E B, where E A = {(x j, x i ) [A] ij 0}, E B = {(u j, x i ) [B] ij 0}. Bipartite Graph Representation For any V 1, V 2, a bipartite graph B(V 1, V 2, E V1,V 2 ) is a digraph with vertex set V 1 V 2 and edge set E V1,V 2 {(v 1, v 2 ) v 1 V 1, v 2 V 2 }. Matching: an independent edge set. Maximum Matching: matching with largest number of edges. B(V, V, E): bipartite graph associated with D(V, E). 5 / 13

7 Preliminaries Strongly Connected Component (SCC) : maximal strongly connected subgraph. Non Top-Linked SCC : SCC with no incoming edge. Top Assignable SCC : non top-linked SCC containing at least one right unmatched vertex in a maximum matching. 6 / 13

8 Preliminaries Strongly Connected Component (SCC) : maximal strongly connected subgraph. Non Top-Linked SCC : SCC with no incoming edge. Top Assignable SCC : non top-linked SCC containing at least one right unmatched vertex in a maximum matching. Assume m : # right unmatched vertices in a maximum matching. α : maximum top assignability index. β : # non top-linked SCCs. Theorem [Liu(2011), Pequito(2015)] The minimum number of inputs required to make the system structurally controllable is one, if m = 0, and m, otherwise. The minimum number of links between input and state needed to achieve structural controllability is p = m + β α. 6 / 13

9 Structural Resilience ) T Let u = ( u T def u T att CPS modeled as a linear structured system: ẋ(t) = [A]x(t) + [B def ]u def (t) + [B att ]u att (t) ASSUME: set of attacked nodes remains unchanged with time. Structural Resilience Given the structured system with ([A], [B]) structurally controllable before an attack, characterize the system s structural resilience to denial of service (DoS) attacks and integrity attacks. 7 / 13

10 DoS Attack Resilience DoS attack u att = 0, u def arbitrary; [B att ] = 0. X def, X att : (disjoint) sets of state vertices accessible to the defender and attacker inputs. ASSUME: number of right unmatched vertices, m, in a maximum matching of B([A]) is nonzero. m def, m att : number of right unmatched vertices in B([A]) corresponding to X def and X att (thus, m def + m att = m). l(p Q): set of links from P to Q. The system model is: ẋ(t) = [A]x(t) + [B def ]u def (t) 8 / 13

11 DoS Attack Resilience Lemma: DoS Attack Success A DoS attack is structurally successful if U def < m def, and: 1 U def U att m + β α. OR 2 U def U att m and l((u def U att ) X ) m + β α. 9 / 13

12 DoS Attack Resilience Lemma: DoS Attack Success A DoS attack is structurally successful if U def < m def, and: 1 U def U att m + β α. OR 2 U def U att m and l((u def U att ) X ) m + β α. Lemma If U def m def, a DoS attack is structurally successful if: 1 There exists an unreachable state from the vertices of U def. OR 2 There does not exist a disjoint union of U def rooted path families and cycle families covering all the states. OR 3 l(u def X ) < m def + β α. OR 4 Every maximum matching of B([A]) has a right unmatched vertex in X att. OR 5 There is a non top linked SCC in D([A]) comprising exclusively vertices from X att. 9 / 13

13 Examples Let states x 1,..., x 6 be accessible to U def and x 7,..., x 10 to U att. x 1 x 1 x 1 x 3 x2 x 3 x2 x 3 x2 x 8 x 7 x 4 x 8 x 7 x 4 x 8 x 7 x 4 x 5 x 5 x 5 x 6 x 6 x 6 x 9 (a) x 10 x 9 (b) x 10 x 9 (c) x 10 Figure: Structural Resilience to DoS Attack 10 / 13

14 State Feedback Integrity Attack Resilience Only control signals corresponding to attacker maintain their integrity; defender controls are arbitrary. Here, u att (t) = K att x(t); u def is arbitrary. m A, m Aatt : number of right unmatched vertices in a maximum matching of B([A)] and B([A att ]) respectively. The system model is: ẋ(t) = ([A] + [B att ][K att ])x(t) + [B def ]u def (t) = [A att ]x(t) + [B def ]u def (t) Theorem If the system is structurally resilient to a DoS attack for some [B def ] with zero structure Z(B def ), then there exists a [B def ] with Z(B def ) Z(B def ) for which it will also be structurally resilient to a state feedback integrity attack. Further, if m Aatt + β Aatt α Aatt m A + β A α A for some choice of [B def ] corresponding to the DoS case, then the same [B def ] will ensure structural resilience to a state feedback integrity attack. 11 / 13

15 Conclusion Formulated a structural approach to study resilience of CPSs to attacks. Attack success interpreted in terms of digraph and bipartite graph representations of system structure. Results independent of numerical realizations of system parameters. Future Directions: Cost of controllability. Robustness to worst attack with least cost. Extension to distributed systems. 12 / 13

16 Thank You. Questions? 13 / 13