An Algebraic Detection Approach for Control Systems under Multiple Stochastic Cyber-attacks

Transcription

1 258 IEEE/CAA JOURNAL OF AUTOMATICA SINICA VOL 2 NO 3 JULY 25 An Algebraic Detection Approach for Control Systems under Multiple Stochastic Cyber-attacks Yumei Li Holger Voos Mohamed Darouach Changchun Hua Abstract In order to compromise a target control system successfully hackers possibly attempt to launch multiple cyberattacks aiming at multiple communication channels of the control system However the problem of detecting multiple cyber-attacks has been hardly investigated so far Therefore this paper deals with the detection of multiple stochastic cyber-attacks aiming at multiple communication channels of a control system Our goal is to design a detector for the control system under multiple cyberattacks Based on frequency-domain transformation technique auxiliary detection tools an algebraic detection approach is proposed By applying the presented approach residual information caused by different attacks is obtained respectively anomalies in the control system are detected Sufficient necessary conditions guaranteeing the detectability of the multiple stochastic cyber-attacks are obtained The presented detection approach is simple straightforward Finally two simulation examples are provided the simulation results show that the detection approach is effective feasible Index Terms Cyber-attack detection control system multiple stochastic cyber-attacks I INTRODUCTION AS networks become ubiquitous more more industrial control systems are connected to open public networks control systems are increased the risk of exposure to cyber-attacks Control systems are vulnerable to cyber-threats successful attacks on them can cause serious consequences [ 3 Therefore the security safety issues in controlled systems have been recently realized they are currently attracting considerable attention [4 2 Some researchers focused on the cyber security of water systems [3 6 7 Further works considered cyber-attacks on smart grid systems [4 8 2 In order to detect as well as identify isolate these cyber-attacks as early as possible different detection approaches were presented For example [3 investigated the problem of false data injection attacks against state estimation in electric power grids [4 proposed a model predictive approach for cyber-attack detection [5 presented a stochastic cyber-attack detection scheme based on frequency-domain transformation technique [6 considered robust H cyber-attacks estimation for control systems [7 Manuscript received September 3 24; accepted January This work was supported by the Fonds National de la Recherche Luxembourg (CO/IS/265 (SeSaNet)) National Natural Science Foundation of China ( ) Recommended by Associate Editor Xinping Guan Citation: Yumei Li Holger Voos Mohamed Darouach Changchun Hua An algebraic detection approach for control systems under multiple stochastic cyber-attacks IEEE/CAA Journal of Automatica Sinica 25 2(3): Yumei Li Holger Voos are with the Interdisciplinary Centre for Security Reliability Trust (SnT) University of Luxembourg Luxembourg L-272 Luxembourg ( yumeili@unilu; holgervoos@unilu) Mohamed Darouach is with the Centre de la Recherche en Automatique de Nancy (CRAN) Universite de Lorraine Longwy 544 France ( modar@ptlu) Changchun Hua is with the Institute of Electrical Engineering Yanshan University Qinhuangdao 664 China ( cch@ysueducn) proposed a detection algorithm by investigating the frequency spectrum distribution of the network traffic References [8 2 used consensus dynamics in networked multi-agent systems including malicious agents As far as we know no existing literatures deal with the problem of multiple cyberattacks In practice however hackers might attempt to launch multiple attacks aiming at multiple communication channels of a control system in order to create attacks that are more stealthy thus more likely to succeed When a hacker launches two or more cyber-attacks against a control process usually it is claimed that the control system suffers from multiple cyber-attacks The fact that no research currently deals with the detection of multiple cyber-attacks on a control process motivates our research in detection of multiple cyberattacks This paper deals with the problem to detect multiple stochastic cyber-attacks aiming at multiple communication channels of a control system We present an algebraic detection approach based on the frequency-domain transformation The basic idea is to use appropriate observers to generate residual information related to cyber-attacks An anomaly detector for the control system under multiple stochastic cyber-attacks stochastic disturbances is derived The main contributions in the paper are as follows We first propose a control system with multiple stochastic cyber-attacks that satisfy a Markovian stochastic process In addition we also introduce the stochastic attack models that are aiming at a specific controller comm input channel or sensor measurement output channel Second based on the frequency-domain transformation technique auxiliary detection tools the error dynamics of the control system is transformed into algebraic equations We consider possible cyber-attacks as non-zero solutions of the algebraic equations the residuals as their constant vectors By analyzing the ranks of the stochastic system matrix the auxiliary stochastic system matrices the residual information caused by attacks from different communication channel is obtained respectively Furthermore based on the obtained residual information we are able to determine the detectability of these cyber-attacks The sufficient necessary conditions guaranteeing that these attacks are detectable or undetectable are obtained Finally we provide two simulation examples to illustrate the effectiveness of our results In Example we consider a control system with stochastic noises We detect possible stochastic cyber-attacks which are aiming at three different controller comm input channels on the actuator In Example 2 we use the quadruple-tank process (QTP) as described in [2 We also detect two possible cyber-attacks on the QTP These simulation results show that the proposed attack detection approach is effective feasible For convenience we adopt the following notations: E{ } is the mathematical expectation operator; dim( ) denotes the di-

2 LI et al: AN ALGEBRAIC DETECTION APPROACH FOR CONTROL SYSTEMS UNDER MULTIPLE STOCHASTIC CYBER-ATTACKS 259 mension of given vector; L 2 Ϝ([ ); R n ) is the space of nonanticipative stochastic processes II PROBLEM STATEMENT Consider the following control system with multiple stochastic cyber-attacks aiming at specific controller comm input channels sensor measurement output channels ( ) n ẋ(t) = Ax(t) + B u(t) + α i (t)f i a a i (t) + E w(t) x() = x n 2 y(t) = C x(t) + β j (t)h j a s j(t) + E 2 v(t) () j= where x(t) R r is the state vector u(t) R m is the control input y(t) R p is the measurement output a a i (t) R i = n a s j (t) R j = n 2 denote the actuator cyber-attack aiming at the i-th controller comm input channel the sensor cyber-attack aiming at the j-th sensor measurement output channel respectively A B C E E 2 are known constant matrices w(t) v(t) are stochastic noises (w(t) v(t) L 2 Ϝ([ ); R n )) f i h j are the attacked coefficients α i (t) β i (t) are Markovian stochastic processes with the binary state ( or ) which satisfy the following probability E{α i (t)} = Prob {α i (t) = } = ρ i E{β j (t)} = Prob {β j (t) = } = σ j i = n m j = n 2 r (2) Herein the event α i (t) = (or β j (t) = ) shows that the i-th controller comm input channel on the actuator (or the j-th sensor measurement output channel on the sensor) is subject to an actuator cyber-attack a a i (t) (or a sensor cyberattack a s j (t)); α i(t) = (or β j (t) = ) means no attack on the i-th (or the j-th)channel ρ i [ (or σ j [ ) reflects the occurrence probability of the event that the actuator (or the sensor) of the system is subject to a cyber-attack a a i (t) (or a s j (t)) α i(t) β j (t) are independent from each other they are also independent from the stochastic noises w(t) v(t) the initial state x The control input matrix B the output state matrix C are expressed as the following column vector groups respectively B = [ b b i b m C = [ c c j c r (3) where b i is the i-th column vector of matrix B c j is the j-th column vector of matrix C And the control input u(t) the system state x(t) are written as u(t) = u (t) u 2 (t) u m (t) x(t) = x (t) x 2 (t) x r (t) (4) A Modeling a Stochastic Cyber-attacks on a Specified Communication Channel In order to increase the success chance of an attack to intrude more stealthily hackers may attempt to launch stochastic cyber-attacks aiming at one or several special communication channels of a control system In a stochastic data denial-of-service (DoS) attack the objective of hackers is to prevent the actuator from receiving control comms or the controller from receiving sensor measurements Therefore by compromising devices preventing them from sending data attacking the routing protocols jamming the communication channels flooding the communication network with rom data so on hackers can launch a stochastic data DoS attack that satisfies Markovian stochastic processes In a stochastic data deception attack hackers attempt to prevent the actuator or the sensor from receiving an integrity data by sending false information ũ(t) u(t) or ỹ(t) y(t) from controllers or sensors The false information includes: injection of a bias data that cannot be detected in the system or an incorrect time of observing a measurement; a wrong sender identity an incorrect control input or an incorrect sensor measurement The hacker can launch these attacks by compromising some controllers or sensors or by obtaining the secret keys In this work we model stochastic data DoS attacks stochastic data deception attacks which hackers possibly launch on a control system aiming at a specific controller comm input channel or sensor measurement output channel ) A stochastic DoS attack preventing the actuators from receiving control comm of the i-th control channel can be modelled as α i (t) { } t t i = n m f i = (5) m a a i (t) = u i (t) 2) A stochastic DoS attack preventing the sensors from receiving sensor measure of the j-th output channel can be modelled as β j (t) { } t t j = n 2 r h j = (6) a s j(t) = x j r Moreover if the following conditions are satisfied: m α i (t)f i a a i (t) = u(t) (7) r β j (t)h j a s j(t) = x(t) (8) j=

3 26 IEEE/CAA JOURNAL OF AUTOMATICA SINICA VOL 2 NO 3 JULY 25 these stochastic attacks mentioned above completely deny the services on the actuator on the sensors respectively 3) A stochastic data deception attack preventing the actuator from a correct control input of the i-th control channel can be modelled as α i (t) { } t t i = n m f i = (9) m a a i (t) = u i (t) + d a i (t) or a a i (t) = d a i (t) 4) A stochastic data deception attack preventing the sensor from a correct sensor measurement of the j-th output channel can be modelled as β j (t) { } t t j = n 2 r h j = () r a s j(t) = x j + d s j(t) or a s j(t) = d s j(t) where d a i (t) ds j (t) are deceptive data that hackers attempt to launch on the actuator the sensor respectively Now let T d a i y(s) = C(sI A) b i which is the transfer function from the attack d a i (t) to output measure y(t) When hackers launch a data deception attack a a i (t) = da i (t) on the actuator to make T d a i y(s) = a zero dynamic attack occurs on the actuator Obviously a zero dynamic attack is undetectable In addition it is not possible for a hacker to launch a zero dynamic attack on the sensor since the transfer function from the attack d s j (t) to output y(t) is T d s j y (s) = c j Remark In the stochastic attack models (5) () the attacked coefficients f i h j are column vectors Herein only the element in the i-th row is the rest elements are in f i which implies that only the i-th control channel of a control system is attacked Similarly only the element in the j-th row is the rest elements are in h j which implies that only the j-th output channel of a control system is attacked Remark 2 To attack a target hackers may launch multiple attacks aiming at multiple communication channels so that the aggression opportunities are increased the attack target is compromised more stealthily successfully For example in order to effectively disturb the formation control of multivehicle systems a hacker could launch multiple stochastic cyber-attacks which are respectively aiming at different communication links among these vehicles or aiming at multiple controller comm input channels of a single vehicle Obviously the detection isolation of multiple cyber-attacks are very important in the formation control of multi-vehicle systems Therefore the research on multiple cyber-attacks is significant requires further research III MAIN RESULTS In this section we present the approach to the anomaly detection We assume that the following conditions are satisfied: ) the pair (A B) is controllable; 2) (A C) is observable For simplification of the discussion we ignore the influence of control inputs in the remainder of this paper because they do not affect the residual when there are no modeling errors in the system transfer matrix Therefore system () can be rewritten as follows: n ẋ(t) = Ax(t) + α i (t)bf i a a i (t) + E w(t) x() = x n 2 y(t) = Cx(t) + β j (t)ch j a s j(t) + E 2 v(t) () j= We set up the following anomaly detector: x(t) = A x(t) + Br(t) x() = r(t) = y(t) C x(t) (2) where B is the detector gain matrix r(t) represents the output residual Let e(t) = x(t) x(t) then we obtain the following error dynamics: ė(t) = Ae(t) + F i a i (t) + E d(t) with the matrices the vectors r(t) = Ce(t) + A = (A BC) H i a i (t) + E 2 d(t) (3) H i = [ β i (t)ch i F i = [ α i (t)bf i β i (t) BCh i E = [ E BE 2 E 2 = [ E 2 (4) a i (t) = [ [ a a i (t) w(t) a s i (t) d(t) = v(t) where cyber-attacks a a i (t) as i (t) i = n the vectors describing the attacked coefficients f i h i i = n satisfy the following conditions n max{n n 2 } { a a n +(t) = a a n +2(t) = = a a n(t) = n = n 2 > n a s n 2+(t) = a s n 2+2(t) = = a s n(t) = n = n > n 2 { f n+ = f n+2 = = f n = n = n 2 > n h n2+ = h n2+2 = = h n = n = n > n 2 Before presenting the main results we give the following definition lemma

4 LI et al: AN ALGEBRAIC DETECTION APPROACH FOR CONTROL SYSTEMS UNDER MULTIPLE STOCHASTIC CYBER-ATTACKS 26 Definition For anomaly detector error dynamics if a cyber-attack on a control system leads to zero output residual then the cyber-attack is undetectable If T dr (s) = C(sI A) E + E 2 denotes the transfer function from stochastic disturbance d(t) to output residual r(t) the robust stability condition of error dynamic (3) is given in term of the following lemma Lemma [6 When all stochastic events α i (t) = β i (t) = (i = n) there are the following conclusions: ) The error dynamics (3) without disturbances is asymptotically stable if there exists a symmetric positive definite matrix P > a matrix X such that the following linear matrix inequality (LMI) holds Ψ = A T P + P A C T X T XC + C T C < (5) 2) The error dynamics (3) with disturbances d(t) ( d(t) L 2 Ϝ([ ); R n )) is robustly stable if T dr (s) < if there exists a symmetric positive definite matrix P > a matrix X such that the following LMI holds Ψ P E XE 2 + C T E 2 I < (6) I + E2 T E 2 When the LMIs above are solvable the detector gain matrix is given by B = P X A Algebraic Detection Scheme for Multiple Stochastic Cyberattacks Aiming at Multiple Communication Channels In this section using the frequency-domain description of the system we transform the error dynamics (3) into the following equation: where X(s) = Q(s)X(s) = B(s) (7) [ A si F Q(s) = F n E C H H n E 2 e(s) a (s) a n (s) d(s) B(s) = ( r(s) ) Further in order to obtain effective results we introduce the mathematical expectation of the stochastic matrix Q(s) as follows: [ A si E(F E(Q(s)) = ) E(F n ) E (8) C E(H ) E(H n ) E 2 where E(F i ) = [ ρ i Bf i σ i BChi E(H i ) = [ σ i Ch i i = n Then the system (7) can be described as E(Q(s))X(s) = B(s) (9) the equation (9) can be rewritten as E(Q(s))X(s) = E( Q i (s))x i (s) = B i (s) where E( Q i (s)) = X i (s) = B i (s) = r(s) = e(s) a i (s) d(s) ( r i (s) r i (s) A si n C n ) E(F i ) E(H i ) E n E 2 n Consider the following stochastic matrix: [ A si E(F i ) E E(Q i (s)) = C E(H i ) E 2 Since ranke( Q i (s)) = ranke(q i (s)) we introduce the following auxiliary error dynamics ė(t) = Ae(t) + F i a i (t) + E d(t) r(t) = Ce(t) + H i a i (t) + E 2 d(t) i = n (2) the auxiliary stochastic equations E(Q i (s))x i = B i (s) i = n (2) Remark 3 Here since the matrices F i H i include the stochastic parameters α i (t) β i (t) the system matrix Q(s) correspondingly includes these stochastic parameters E(Q(s)) E(Q i (s)) include stochastic probabilities ρ i σ i as well which take values in [ Therefore they are stochastic matrices Remark 4 In this work we introduce the auxiliary mathematical tools (2) (2) The auxiliary error dynamics (2) represents the fact that the control system is only subjected to a stochastic cyber-attack a i (t) on the i-th communication channel Applying the auxiliary equation (2) we can obtain the information of residual r i (t) that is caused by the cyber-attack a i (t) In addition the detector gain matrix B can be determined according to Lemma Now applying the rank of the stochastic matrix we obtain the following theorem Theorem For system () we assume that all of these stochastic matrices E(Q(s)) E(Q i (s)) (i = n) have full column normal rank All of these cyber-attacks a i (s) (i = n ( a i (s) G)) when s = z are undetectable if only if there exists z such that ranke(q(z )) < dim(x(z )) (22) ranke(q i (z )) < dim(x i (z )) i = n (23) Herein G is a set of undetectable cyber-attacks Proof (If) Assume that there exists z C such that conditions (22) (23) hold for all a i (z ) G it becomes obvious that z is an invariant zero [22 of the detector error system (3)

5 262 IEEE/CAA JOURNAL OF AUTOMATICA SINICA VOL 2 NO 3 JULY 25 the auxiliary system (2) Then all of the equations in (9) (2) are homogeneous ie B(z ) = B i (z ) = Therefore the output residual r i (z ) = i = n r(z ) = n r i(z ) = as well By Definition all of these cyber-attacks a i (s) i n when s = z are undetectable (Only if) Assume that all of these cyber-attacks a i (s) i = n when s = z are undetectable then there must exist a z C such that the residual r i (z ) = r(z ) = n r i(z ) = Therefore all of the equations in (9) (2) are homogeneous If we assume that all of matrices E(Q(z )) E(Q i (z )) have full column rank then all of these homogeneous equations have only have one zero solution However this contradicts with the conditions that X s=z X i s=z i = n are solutions to (9) (2) respectively Therefore the assumptions are false only conditions (22) (23) are true Theorem 2 For system () we assume that all of stochastic matrices E(Q(s)) E(Q i (s)) (i = n) have full column normal rank All of these cyber-attacks a i (s) (i = n ( a i (s) G)) are detectable if only if the following conditions always hold for any z C: ranke(q(z )) = dim(x(z )) (24) ranke(q i (z )) = dim(x i (z )) i = n (25) Herein G is a set of detectable cyber-attacks Proof (If) Assuming that conditions (24) (25) always hold for any z C it is obvious that the stochastic matrices E(Q(z )) E(Q i (z )) (i = n) have full column rank Then the equation E(Q(z ))X(z ) = B(z ) (26) the auxiliary stochastic equations E(Q i (z ))X i = B i (z ) i = n (27) have one only one solution In the following we proof by contradiction Assume that residual r(z ) = r i (z ) = i = n then equations (26) (27) has one only one zero solution ie X s=z = X i s=z = i = n However this violates the given condition a i (z ) G ie X s=z X i s=z i = n Therefore r(z ) r i (z ) i = n these cyber-attacks a i (s) ( a i (s) G) i = n for any s = z are detectable (Only if) Assume that there exists a z C which satisfies conditions (22) (23) Since all of the stochastic matrices E(Q(s)) E(Q i (s)) (i = n) have full column ranks according to Theorem these cyber-attacks a i (s) i = n are undetectable as s = z However this is in contradiction with the given condition that all of these cyber-attacks a i (s) i = n are detectable for any s = z Therefore the assumption is false only ranke(q(z )) = dim(x(z )) ranke(q i (z )) = dim(x i (z )) i = n are true Furthermore we can obtain the following corollary according to Theorem Theorem 2 Corollary For system () assume that all of stochastic matrices E(Q(s)) E(Q i (s)) (i = n) have full column normal rank If there exists z C such that ranke(q(z )) < dim(x(z )) (28) then there are the following conclusions ) The cyber-attack a i (z ) ( a i (s) G) is detectable if only if ranke(q i (z )) = dim(x i (z )) (29) 2) The cyber-attack a j (z ) ( a j (s) G) is undetectable if only if ranke(q j (z )) < dim(x j (z )) (3) IV SIMULATION RESULTS In this section we provide two simulation examples to illustrate the effectiveness of our results In Example we consider a control system under three stochastic cyber-attacks a stochastic noise We detect two possible stochastic data DoS attacks a possible stochastic data deception attack which are aiming at three controller comm input channels on the actuator In Example 2 we use the laboratory process as presented in [2 which consists of four interconnected water tanks We will also detect possible cyber-attacks on QTP controlled through a wireless communication network Example Consider the following system with a stochastic noise w(t) ẋ(t) = Ax(t) + Bu(t) + E w(t) x() = x (3) y(t) = Cx(t) with the following parameters: 8 2 A = B = E = 4 7 C =

6 LI et al: AN ALGEBRAIC DETECTION APPROACH FOR CONTROL SYSTEMS UNDER MULTIPLE STOCHASTIC CYBER-ATTACKS 263 Assume that it is subjected to two stochastic data DoS attacks a stochastic data deception attack on the actuator aiming at three controller comm input channels ie α (t) { } t t f = a a (t) = u (t) (32) α 2 (t) { } t t f 2 = (33) a a 2(t) = u 2 (t) + b a 2(t) α 3 (t) { } t t Fig The time responses of the residual the system state under the noise f 3 = a a 3(t) = u 3 (t) (34) As mentioned before we ignore the control input since it does not affect the residual By applying Lemma the robust detector gain matrix can be obtained as follows: B = Set the initial conditions as x() = [ T x() = [ T When the stochastic events α (t) = α 2 (t) = α 3 (t) = occur the system is not under any cyber-attacks Fig displays the time responses of the residual the system state under stochastic noise w(t) only which shows that the system is robustly stable When the stochastic events α (t) = α 2 (t) = α 3 (t) = occur the system is under multiple cyber-attacks We take the attack probabilities ρ = ρ 2 = 8 ρ 3 = 5 the stochastic matrix rank(e(q(s))) = 9 rank(e(q(z ))) = 9 rank(e(q i (z ))) = 7 (i = 2 3) which shows that rank(e(q(z ))) rank(e(q i (z ))) (i = 2 3) have always full column rank for any z According to Theorem 2 the three attacks are detectable Fig 2 displays the noise signal the attack signals while Fig 3 shows the time responses of the residual the system state under three attacks noise Fig 4 Fig 5 Fig 6 give the time responses of the residual under the attack a a (t) a a 2(t) a a 3(t) respectively Simultaneously they show the corresponding attack signals The simulation results underline that these cyber-attacks can be effectively detected if the conditions in Theorem 2 are satisfied Example 2 Consider the model of the QTP in [2 ẋ = Ax + Bu (35) y = Cx Fig 2 The noise signal the attack signals with the following parameters: A = [ 5 C = B = Assume that it is subjected to two stochastic data deception attacks on the actuator ie α (t) { } t t [ f = (36) a a (t) = b a (t)

7 264 IEEE/CAA JOURNAL OF AUTOMATICA SINICA VOL 2 NO 3 JULY 25 Fig 3 The time responses of the residual the system state under three attacks noise Fig 6 The time responses of the residual under attack a a 3(t) the attack signal a a 3(t) Fig 4 The time responses of the residual under attack a a (t) the attack signal a a (t) Fig 7 The time responses of the residual the system state without attacks α 2 (t) { } t t [ f 2 = (37) Fig 5 The time responses of the residual under attack a a 2(t) the attack signal a a 2(t) a a 2(t) = b a 2(t) The detector gain matrix can be obtained as follows: B = We set the initial conditions as x() = [ T x() = [ 4 5 T When the stochastic events α (t) = α 2 (t) = occur Fig 7 visualizes that the system (35) is asymptotically stable When the stochastic events α (t) = α 2 (t) = occur the attack probabilities are ρ = 8 ρ 2 = 5 we have stochastic matrix rank(e(q(s))) = 6 however there exists a z = 27 such that rank(e(q(z ))) = 5 rank(e(q i (z ))) = 5 (i = 2) Aiming at two different con-

8 LI et al: AN ALGEBRAIC DETECTION APPROACH FOR CONTROL SYSTEMS UNDER MULTIPLE STOCHASTIC CYBER-ATTACKS 265 trol channels it is possible for the hacker to launch two stochastic data deception attacks as follows: b a (t) = 74e 27t b a 2(t) = e 27t such that the transfer function from attacks to residual is zero Therefore it is difficult to detect these stealthy attacks Fig 8 displays the time responses of the residual the system state under the two attacks a a (t) a a 2(t) which shows that these attacks when s = z = 27 could not be detected by original model However applying the auxiliary tools (2) (2) according to Corollary these attacks can also be detected Fig 9 displays the attack signal a a (t) the responses of the residual under this attack Fig shows the attack signal a a 2(t) the responses of residual under this attack Obviously applying Corollary the two stochastic data deception attacks can be detected effectively Fig The time responses of residual under the attack a a 2(t) the attack signal a a 2(t) because hackers might launch multiple attacks aiming at one target so that the aggression opportunities are increased the attack target can be compromised more stealthily successfully For example the hacker is able to simultaneously launch DoS attacks deception attacks replay attacks that are respectively aiming at different communication channels of a control system The main work here is focused on novel cyber-attack detection schemes that allow the detection of multiple stochastic attacks in order to protect control systems against a wide range of possible attack models We give two simulation examples the results of which demonstrate that the detection approaches proposed in this paper are feasible effective REFERENCES Fig 8 The time responses of the residual the system state under attacks a a (t) a a 2(t) [ Bier V Oliveros S Samuelson L Choosing what to protect: strategic defensive allocation against an unknown attacker Journal of Public Economic Theory 27 9(4): [2 Amin S Schwartz G A Sastry S S Security of interdependent identical networked control systems Automatica 23 49(): [3 Slay J Miller M Lessons learned from the Maroochy water breach Critical Infrastructure Protection : [4 Andersson G Esfahani P M Vrakopoulou M Margellos K Lygeros J Teixeira A Dan G Serg H Johansson K H Cyber-security of SCADA systems Session: Cyber-Physical System Security in a Smart Grid Environment 2 [5 Mo Y L Sinopoli B False data injection attacks in control systems In: Proceedings of the st Workshop on Secure Control Systems Stockholm Sweden 2 Fig 9 The time responses of residual under the attack a a (t) the attack signal a a (t) V CONCLUSION This paper presents a cyber-attack detection approach for control systems under multiple stochastic cyber-attacks disturbances The proposed problem is significant in practice [6 Amin S Litrico X Sastry S Bayen A M Cyber security of water SCADA systems: (I) analysis experimentation of stealthy deception attacks IEEE Transactions on Control Systems Technology 23 2(5): [7 Eliades D G Polycarpou M M A fault diagnosis security framework for water systems IEEE Transactions on Control Systems Technology 2 8(6): [8 Metke A R Ekl R L Security technology for smart grid networks IEEE Transactions on Smart Grid 2 (): 99 7

9 266 IEEE/CAA JOURNAL OF AUTOMATICA SINICA VOL 2 NO 3 JULY 25 [9 Sridhar S Hahn A Govindarasu M Cyber-physical system security for the electric power grid Proceedings of the IEEE 22 (): [ Mohsenian-Rad A H Leon-Garcia A Distributed internet-based load altering attacks against smart power grids IEEE Transactions on Smart Grid 2 2(4): [ Sardana A Joshi R C Dual-level attack detection characterization for networks under DDoS In: Proceedings of the 2 International Conference on Availability Reliability Security Krakow: IEEE [2 Weimer J Kar S Johansson K H Distributed detection isolation of topology attacks in power networks In: Proceedings of the 22 HiCoNS 2 Beijing China [3 Liu Y Reiter M K Ning P False data injection attacks against state estimation in electric power grids In: Proceedings of the 29 ACM Conference on Computer Communications Security Chicago IL USA: ACM [4 Rosich A Voos H Li Y M Darouach M A model predictive approach for cyber-attack detection mitigation in control systems In: Proceedings of the 52nd Annual Conference on Decision Control Firenze: IEEE [5 Li Y M Voos H Rosich A Darouach M A stochastic cyber-attack detection scheme for stochastic control systems based on frequencydomain transformation technique In: Proceedings of the 8th International Conference on Network System Security Xi an China: Springer [6 Li Y M Voos H Darouach M Robust H fault estimation for control systems under stochastic cyber-attacks In: Proceedings of the 33rd Chinese Control Conference Nanjing China: ORBilu [7 Hashim F Kibria M R Jamalipour A Detection of DoS DDoS attacks in NGMN using frequency domain analysis In: Proceedings of the 4th Asia-Pacific Conference on Communications Tokyo: IEEE 28 5 [8 Sundaram S Hadjicostis C N Distributed function calculation via linear iterative strategies in the presence of malicious agents IEEE Transactions on Automatic Control 2 56(7): [9 Teixeira A Sberg H Johansson K H Networked control systems under cyber attacks with applications to power networks In: Proceedings of the 2 American Control Conference Baltimore MD: IEEE [2 Pasqualetti F Bichi A Bullo F Consensus computation in unreliable networks: a system theoretic approach IEEE Transactions on Automatic Control 22 57(): 9 4 [2 Johansson K H The quadruple-tank process: a multivariable laboratory process with an adjustable zero IEEE Transactions on Control Systems Technology 2 8(3): Yumei Li received her Ph D degree in control theory control engineering from Yanshan University China in 29 She is currently a research associate at the Interdisciplinary Centre of Security Reliability Trust (SnT) at the University of Luxembourg Her research interests include intelligent control stochastic systems secure resilient automation control systems distributed control cooperative control of multiagent system Corresponding author of this paper Holger Voos studied electrical engineering at Saarl University Germany received his Ph D degree in automatic control from the Technical University of Kaiserslautern Germany in 22 He is currently a professor at the University of Luxembourg in the Faculty of Science Technology Communication Research Unit of Engineering Sciences He is the head of the Automatic Control Research Group of the Automation Robotics Research Group at the Interdisciplinary Centre of Security Reliability Trust (SnT) at the University of Luxembourg His research interests include distributed networked control model predictive control safe secure automation systems with applications in mobile space robotics energy systems biomedicine Mohamed Darouach graduated from Ecole Mohammadia d Ingnieurs Rabat Morocco in 978 received the Docteur Ingnieur Doctor of Sciences degrees from Nancy University France in respectively From 978 to 986 he was associate professor professor of automatic control at Ecole Hassania des Travaux Publics Casablanca Morocco Since 987 he is a professor at University de Lorraine He has been a vice director of the Research Center in Automatic Control of Nancy (CRAN UMR 739 Nancy-University CNRS) from 25 to 23 He obtained a degree Honoris Causa from the Technical University of IASI Since in 2 He is a member of the Scientific Council of Luxembourg University Since 23 he is a vice director of the University Institute of Technology of Longwy (University de Lorraine) He held invited positions at University of Alberta Edmonton His research interests include span theoretical control observers design control of large-scale uncertain systems with applications Changchun Hua received his Ph D degree from Yanshan University China in 25 He was a research fellow in National University of Singapore Carleton University Canada University of Duisburg-Essen Germany Now he is a professor at Yanshan University China His research interests include nonlinear control systems control systems design over network teleoperation systems intelligent control [22 Zhou K M Doyle J C Glover K Robust Optimal Control Upper Saddle River NJ USA: Prentice-Hall Inc 996