Multi-dimensional state estimation in adversarial environment

Transcription

1 Submitted, 5 Chinese Control Conference (CCC) htt://wwwcdscaltechedu/~murray/aers/mm5-ccchtml Multi-dimensional state estimation in adversarial environment Yilin Mo, Richard M Murray California nstitute of Technology, E California Blvd, Pasadena, CA 95, United States yilinmo@caltechedu,murray@cdscaltechedu Abstract: We consider the estimation of a vector state based on m measurements that can be otentially maniulated by an adversary The attacker is assumed to have limited resources and can only maniulate u to l of the m measurements However, it can the comromise measurements arbitrarily The roblem is formulated as a mini otimization, where one seeks to construct an otimal estimator that minimizes the worst-case error against all ossible maniulations by the attacker and all ossible sensor noises We show that if the system is not observable after removing l sensors, then the worst-case error is infinite, regardless of the estimation strategy f the system remains observable after removing arbitrary set of l sensor, we rove that the otimal state estimation can be comuted by solving a semidefinite rogramming roblem A numerical examle is rovided to illustrate the effectiveness of the roosed state estimator Key Words: Security, Estimation ntroduction The increasing use of networked embedded sensors to monitor and control critical infrastructures rovides otential malicious agents with the oortunity to disrut their oerations by corruting sensor measurements Suervisory Control And Data Acquisition (SCADA) systems, for examle, run a wide range of safety critical lants and rocesses, including manufacturing, water and gas treatment and distribution, facility control, and ower grids A wide variety of motivations exists for launching an attack on the such systems, ranging from financial reasons, eg, reducing the electricity bill, all the way to terrorism, eg, threatening the life of ossibly an entire oulation by controlling electricity and other life-critical resources A successful attack to such kind of systems may significantly hamer the economy, the environment, and may even lead to the loss of human life The first-ever SCADA system malware (called Stuxnet) was found in July and rose significant concern about SCADA system security [, ] The research community has acknowledged the imortance of addressing the challenge of designing secure detection, estimation and control systems [] We consider a secure estimation roblem insired by security concerns that arise from the ossible maniulation of sensor data We focus our attention on the estimation of a vector state x R n from measurements collected by m sensors, with the caveat that the measurements are disturbed by an L bounded noise and some of them can be further maniulated by a malicious third arty Limitations in the resources available to the attacker enable it to only maniulate l of the m sensors However, the attacker has total control over the corruted sensors, as it can change the measurements of the comromised sensors arbitrarily To minimize the estimator s erformance degradation in the resence of such attacks, we construct mini estimator that minimize the worst-case exected cost against all ossible noise and attacker s maniulate We show that if the system becomes unobservable after removing l sensor measurements, then even the otimal state This work is suorted in art by BM and UTC through icyphy consortium estimator will have a worst-case unbounded error For the case where the system remains observable after removing an arbitrary set of l sensors, we rovide the exlicit form of the otimal estimation, which is given by the Chebyshev center of a union of ellisoids, which can be comuted via semidefinite rogramming Related Work Robust estimators such as M-estimator, L-estimator, R- estimator and etc have also been extensively studied in the literature [ ] However, such aroaches usually assume that the outliers of the data are generated indeendently by some other robability distribution different from the model assumtions Furthermore, the robustness is usually measured by breakdown oints [, 8] or influence functions [9] However, the indeendent assumtions do not hold in security settings As the attacker can take control over multile sensors, the comromised measurements from these sensors can be jointly selected by the adversary to imize the estimation error As a result, in this aer, we design our estimator to minimize the worst-case L error against all ossible attacks Therefore, the concets of robustness and security are different from each other n other words, a robust estimator may not necessarily be secure and thus the techniques develoed for robust estimation need to be re-examined before they can be alied in the context of security Furthermore, bad data detection and identification techniques, which are based on truncating the atyical data, have been widely used in large scale systems such as the ower grid [] While such aroaches are very successful in detecting and removing random failures, they are not effective against integrity attacks Liu et al [] illustrate how an adversary can inject a stealthy inut into the measurements to change the state estimate, without being detected by the bad data detector Sandberg et al [] consider how to find a sarse stealthy inut, which enables the adversary to launch an attack with a minimum number of comromised sensors Xie et al [] further illustrate that the stealthy integrity attacks on state estimation can lead to a financial gain in the electricity market for the adversary For dynamical systems, a widely used aroach is to construct failure-sensitive filters [] This detection scheme

2 has been investigated recently in the context of cyberhysical security [5 8] n these scenarios, the attacker can either arbitrarily erturb the system along certain directions without being detected by any filter or cannot induce any erturbation, without incurring detection However, in the majority of these contributions, the system model is assumed to be noiseless, which greatly favors the failure detector, since the evolution of the system is deterministic and any deviation from the redetermined trajectory can be detected A more realistic system model with bounded noise is considered by Pajic et al [9] They roose an estimator by solving an L norm minimization roblem and rovide erformance bound on the estimation error n [, ], the authors also consider a noisy system, roviding an algebraic condition under which an attacker can successfully destabilize the system and characterizing the erformance of state estimators in this scenario This aer generalizes our revious works on secure estimation [, ], which consider designing the otimal estimator for a scalar state and minimizes the worst-case mean squared error n this aer, we derive the otimal estimator for a vector state, with the caveat that the noise is L bounded The rest of aer is organized as follows: n Section we rovide some reliminary results on the radius and diameter of comact set in Euclidean sace n Section we formulate the roblem of secure estimation with l maniulated measurements from m total measurements n Section, we characterize the erformance of the otimal estimator and rovide an observability condition under which the estimator can have an unbounded error n Section 5, we rovide an algorithm to comute the otimal state estimate via semidefinite rogramming n Section we rovide a numerical examle to illustrate the roosed algorithm Finally, Section concludes the aer Notation Let x R n be a vector, then kxk is the -norm of x kxk is the zero norm of x, ie, the number of non-zero entries of x All comarisons between matrices are in the ositive semidefinite sense Preliminary A ball B(x, r) R n is defined as B(x, r), {x R n : kx xk r} Consider a set S R n A ball B(x, r) covers S if and only if S B(x, r) For any oint x R n, define (x, S), inf{r R + : S B(x, r)} We will assume that the infimum over an emty set is Hence, if S is unbounded, then (x, S) = for any x For a bounded set S, define the radius r(s) R + and Chebyshev center c(s) R n of S to be r(s), inf (x, S), xrn c(s), arg min xr n (x, S) n an essence, B(c(S),r(S)) is the smallest radius ball that covers S Notice that c(s) may not necessarily belong to S For an unbounded S, we define r(s) = We further define the diameter d(s) of the set S as d(s), su (x, S) xs Notice that in general d(s) = r(s) For examle, for a equilateral triangle with side length, we have d(s) =, while r(s) =/ n general, the following relation between r(s) and d(s) holds: Theorem Let S R n be a non-emty and bounded set, then the following inequalities hold on r(s) and d(s) r d(s) n r(s) d(s) d(s) n + Proof The first inequality is due to the fact that S B(c(S),r(S)), which imlies that d(s) d[b(c(s),r(s))] = r(s) The second inequality is from Jung s theorem [] The third inequality is trivial Problem Formulation The goal is to estimate the state x R n from a vector y, [y,,y m ] T R m consisting of m sensor measurements y i R, where the index i S, {,,,m} The measurements could otentially be comromised by an adversary Therefore, we assume that x and y satisfies the following equation: y = Hx + Gw + a, () where kwk is the sensor noise, which is assumed to be bounded, and G R m m is assumed to be full rank The vector a is the bias injected by the attacker The non-zero entries of a indicates the set of comromised sensors n this aer, we assume that the attacker can only maniulate u to l sensors As a result, kak l Remark The arameter l can also be interreted as a design arameter for the system oerator n general, increasing l will increase the resilience of the estimator under attack However, a large l could result in erformance degradation during normal oeration when no sensor is comromised Therefore, there exists a trade-off between resilience and efficiency (under normal oeration), which can be tuned by choosing a suitable arameter l Define H, h h m 5,w, w w m 5,a, a a m 5, and define the set Y as the set of all ossible maniulated measurements, ie, Y, {y R m : 9 x, w, a, such that kwk, kak l and y = Hx + Gw + a}

3 For any y Y, we can define the set X(y) as the set of feasible x that can generate y, ie, X(y), {x R n : 9 w, a, such that kwk, kak l and y = Hx + Gw + a} An estimator is a function f : Y! R n, where ˆx = f(y) Given y, the magnitude of the worst case estimation error is defined as e(y), su xx(y) kf(y) xk From the definition of the Chebyshev center, we know that the otimal estimator with smallest worst case error e is given by f (y), c(x(y)), with worst case error e(y) =r(x(y)) Therefore, the worst case error magnitude for all ossible y is given by e, su r(x(y)) yy n the following sections, we rovides an uer and lower bound for e We further roose an algorithm to comute c(x(y)) via convex otimization Performance Bounds for the Otimal Estimator This section is devoted to analyzing the erformance of the otimal estimator To this end, for any index set = {i,,i j }, define the comlement set c = S\ and define subsace V, san(e i,,e ij ) R m, where e i R m is the ith canonical basis vector Define the following set: X (y), {x R n : 9 w, a V c, such that kwk and y = Hx + Gw + a} Hence, X (y) reresents all ossible states that can generate measurement y when the sensors in are good and the sensors in c are comromised By enumerating all ossible s, it is easy to see that X(y) can be written as X(y) = [ X (y) =m For any = {i,,i j }, we can define H, h i h ij 5,G, l g i g ij where g i is the ith row vector of G F, G G T 5,y, y i y ij 5, Since G is full rank, G is full row rank, which imlies that F is full rank Thus, if H is full column rank, we can define K, H T F H H T F,, P, H T F H U, ( H K ) T F ( H K ) The following theorem rovides bounds on e : Theorem f there exists an index set K Swith cardinality m l, such that H K is not of full column rank, then e = f for all K = m l, H K is full column rank, then for all ossible y Y, we have su d(x(y)) = (PK ) () yy K =m l Therefore, e satisfies (PK ) e K =m l K =m l where (P ) is the sectral radius of P (PK ), () Before roving Theorem, we need the following lemma: Lemma f K K Sand H K is full column rank, then the following statement holds: ) H K is also full column rank ) P K P K Proof Without loss of generality, let us assume that HK H K = () H K Therefore, n rank(h K ) rank(h K )=n Hence, H K is full column rank, which imlies that P K is well-defined To rove P K P K, we only need to rove that H T K F K H K H T K F K H K (5) From definition of F, we can write F K as F F F K = F F, where F = F K Using Schur comlements, we have F F K = F + F F FF F F F Combining with (), we can rove (5) We are now ready to rove Theorem : Proof of Theorem We first rove () Suose that for all K Swith cardinality m l, H K is full column rank Let us consider a air of set, J with cardinality m l Define K as K = \ J = S\ [ c J c Clearly, K m l and it includes a index set of size m l Hence, by Lemma, H K is also full column rank Now for any oint x X (y) and x X J (y), we have: Hx + Gw + a = Hx + Gw + a = y, () where a V c and a V J c Since both a and a have zero entries on the ith entry, where i K, () imlies that H K x + G K w )=H K x + G K w ) ()

4 which imlies that By the fact that kw x x = K K G K (w w ) (8) w k, we have kx x kkk K G K k = (P K ), where kk K G K k is the largest singular value of K K G K Therefore, by Lemma, we have su d(x(y)) yy K m l = K =m l (PK ) (PK ) Now we need to rove that the equality of () holds Suose that we find x,x and kw k, kw k that satisfies () and kx x k = (P K ) We know that H K x + G K w = H K x + G K w (9) Therefore, let us create a y, such that Thus, y K = H K x + G K w, y \K = H \K x + G \K w, y J\K = H J\K x + G J\K w, y S\([J) = y K H K x = G K w, y \K H \K x = G \K w, which imlies that x X (y) On the other hand, y K H K x = H K (x x )+G K w = G K w, y J\K H J\K x = G J\K w, which imlies that x X J (y) Therefore, () holds () can be roved by alying Theorem Now suose there exists an K = m l, such that H K is not full column rank We can find index set, J, such that = J = m l and T J = K Furthermore, we know that there exists x =, such that H K x = As a result, if we choose x =, w = w =, then (9) holds for x,x,w,w Now by the similar argument, we can construct a y, such that x X (y) and x = X J (y) Moreover, by linearity, we know that Hence, by Theorem, e x X ( y), = x X J ( y) d(x(y)) su yy k x k su = R 5 Estimator Design n this section, we first characterize the shae of X (y): Theorem Define the function V (x) :R n! R as the solution of the following otimization roblem: kwk minimize wr m subject to G w = y H x () Then V (x) is given by V (x) =(x ˆx (y)) T P (x ˆx (y)) + " (y), () where and ˆx (y) =K y, () " (y) =y T U y () Proof Consider the constraint of the otimization roblem () y H x = G w () As G is full row rank, G is also full row rank Consider the singular value decomosition of G, we get G = Q Q, where Q,Q are orthogonal matrices with roer dimensions and is an invertible and diagonal matrix Hence, () imlies that Q T y Q T H x = v (5) where v = Q w and kvk = kwk By rojecting Q T y into the subsace san( Q T H ), we have Q T y Q T H ˆx (y) + Q T H [x ˆx (y)] = v () The first term on the LHS of () is erendicular to the second term Thus, () is equivalent to " (y)+(x ˆx (y)) T P (x ˆx (y)) = v kvk = kwk Clearly, the equality holds when v = v,,v,,, Hence V (x) =" (y)+(x ˆx (y)) T P (x ˆx (y)) By Theorem, we immediately have the following corollary: Corollary f " (y) >, then X (y) is an emty set Otherwise, X (y) is an ellisoid given by X (y) ={x :(x ˆx (y)) T P (x ˆx (y)) " (y)} ()

5 Proof By definition, x X (y) is equivalent to the existence of w, such that kwk and y = H x + G w Hence, the corollary holds by Theorem Remark One can view " (y) as the deviation of the measurement from the attack model f " (y), ie, the deviation cannot be exlained by the noise, then X (y) is emty, which imlies that the good sensor set is not Let us define set as, { S : = m l, " (y)} (8) Since X(y) = S =l X (y) = S X (y), we know that X(y) is a union of ellisoids To check if a ball covers a union of ellisoids, we have the following theorem [5]: Theorem A ball B(x, r) covers X(y) if and only if for every index set = m l, such that " (y), there exists, such that x x T r x T 5, (9) x where is defined as, = P P ˆx (y) ˆx (y) T P ˆx (y) T P ˆx (y)+" (y) 5 Proof This theorem can be roved by Lemma 8 in [5] Therefore, we can derive the otimal state estimate as the solution of the following semidefinite rogramming roblem: minimize ' () ˆx,', subject to ',, 8, ˆx ˆx T ' ˆx T 5, 8 ˆx where the radius of the Chebyshev ball is r = ' n conclusion, the otimal state estimation can be comuted via the following algorithm: ) Enumerate all ossible = m l, comute ˆx (y) and " (y) via () and () ) Check whether " (y) is no greater than Comute the index set via (8) ) Solve the otimization roblem () Numerical Examle n this section, we rovide a numerical examle to illustrate our estimator design We assume that n =, m = and one sensor is comromised The noise is assume to satisfy kwk = We further assume that H = 5,G= t is easy to check that for any K = m l =, H K is full column rank We first consider the worst case erformance of our estimator One can verify that K = (P K)=8 where the corresonding K = {, } Using the rocedure described in the roof of Theorem, we choose = {,, }, J = {,, } We can then construct the following variables: and x = 5 x =,w =,w = The corresonding y is given by y = The otimal state estimate ˆx and worst-case error e(y) is given by ˆx = 85,e(y) =8 On the other hand, if the system oerator is unaware of the existence of the adversary, it is easy to rove that the otimal estimator designed for the non-adversarial environment is given by ˆx = H T (GG T ) H H T (GG T ) y () For our case, the state estimate given by () is ˆx = 8 9 for which the worst case error e(y) =,

6 X {,,} (y) X {,,} (y) Fig : The erformance of the otimal state estimator The green ellise corresonds to X {,,} (y) and the red ellise corresonds to X {,,} (y) The set X {,,} (y) and X {,,} (y) is emty The black + is the otimal state estimate while the black dashed line is the Chebyshev ball for X(y) The red corresonds to the outut of the otimal state estimator designed for benign sensors and the red dashed line is the minimum covering ball of X(y) centered at Conclusion and Future Work We consider the estimation of a vector state x based on m measurements, where l of them are malicious and can be changed arbitrarily by an adversary We rove that if the system is not observable after removing l sensor measurements, then the attacker can make the worst case estimation error to be infinite On the other hand, we rovides uer and lower bound for the worst case estimation error when the system remains observable after removing any set of l sensors We then derive the otimal state estimation as the solution of a semidefinite rogramming roblem n the future, we want to find a near otimal state estimator with lower comutation comlexity Furthermore, we would like to consider stochastic noise models References [] T M Chen, Stuxnet, the real start of cyber warfare? [editor s note], vol, no,, [] D P Fidler, Was stuxnet an act of war? decoding a cyberattack, EEE Security & Privacy, vol 9, no, 5 59, [] A A Cárdenas, S Amin, and S Sastry, Research challenges for the security of control systems, in HOTSEC 8: Proceedings of the rd conference on Hot toics in security Berkeley, CA, USA: USENX Association, 8, [] S A Kassam and H V Poor, Robust techniques for signal rocessing: A survey, vol, no, 8, 985 [5] R A Maronna, D R Martin, and V J Yohai, Robust Statistics: Theory and Methods Wiley, [] P J Huber and E M Ronchetti, Robust Statistics Wiely, 9 [] F R Hamel, A general qualitative definition of robustness, The Annals of Mathematical Statistics, vol, no, 88 89, Dec 9 [8] D L Donoho and P J Huber, The notion of breakdown oint, A Festschrift for Erich L Lehmann, 5 8, 98 [9] F R Hamel, The influence curve and its role in robust estimation, Journal of the American Statistical Association, vol 9, no, 8 9, 9 [] A Abur and A G Exósito, Power System State Estimation: Theory and mlementation CRC Press, [] Y Liu, M Reiter, and P Ning, False data injection attacks against state estimation in electric ower grids, in Proceedings of the th ACM conference on Comuter and communications security, 9 [] H Sandberg, A Teixeira, and K H Johansson, On security indices for state estimators in ower networks, in First Worksho on Secure Control Systems, [] L Xie, Y Mo, and B Sinooli, ntegrity data attacks in ower market oerations, EEE Transactions on Smart Grid, vol, no, 59, [] A Willsky, A survey of design methods for failure detection in dynamic systems, Automatica, vol,, Nov 9 [5] F Pasqualetti, A Bicchi, and F Bullo, Consensus comutation in unreliable networks: A system theoretic aroach, EEE Transactions on Automatic Control, vol 5, no, 9, Jan [] F Pasqualetti, F Dorfler, and F Bullo, Cyber-hysical attacks in ower networks: models, fundamental limitations and monitor design, in Proc 5th EEE Conf Decision and Control and Euroean Control Conf (CDC-ECC),, 95 [] S Sundaram, M Pajic, C Hadjicostis, R Mangharam, and G J Paas, The wireless control network: monitoring for malicious behavior, in EEE Conference on Decision and Contro, Atlanta, GA, Dec [8] H Fawzi, P Tabuada, and S Diggavi, Security for control systems under sensor and actuator attacks, in Proc EEE 5st Annual Conf Decision and Control (CDC), Maui, H,, [9] M Pajic, J Weimer, N Bezzo, P Tabuada, O Sokolsky, Lee, and G Paas, Robustness of attack-resilient state estimators, in Cyber-Physical Systems (CCPS), ACM/EEE nternational Conference on, Aril, [] Y Mo, E Garone, A Casavola, and B Sinooli, False data injection attacks against state estimation in wireless sensor networks, in Proc 9th EEE Conf Decision and Control (CDC), Atlanta, Georgia,, [] Y Mo and B Sinooli, False data injection attacks in cyber hysical systems, in First Worksho on Secure Control Systems, Stockholm, Sweden, Aril [], Robust estimation in the resence of integrity attacks, in 5nd EEE Conference on Decision and Control,, 85 9 [], Secure estimation in the resence of integrity attacks, Automatic Control, EEE Transactions on, vol PP, no 99,, [] L Danzer, B Grünbaum, and V Klee, Helly s Theorem and ts Relatives, ser Proceedings of symosia in ure mathematics: Convexity American Mathematical Society, 9 [5] E Yildirim, On the minimum volume covering ellisoid of ellisoids, SAM Journal on Otimization, vol, no,, [Online] Available: htt: //dxdoiorg//55