A vector-valued model-based cumulative sum (CUSUM) procedure is proposed for identifying falsified sensor measurements. To fulfill a desired detection performance, given the system dynamics, we derive tools for tuning the CUSUM procedure. We characterize the state degradation that a stealthy attacker can induce to the system while remaining undetected by the detection procedure. We quantify the advantage of using a dynamic detector (CUSUM), which leverages the history of the state, over a static detector (chi-squared) which uses a single measurement at a time. Simulation experiments are presented to illustrate the performance of the detection scheme.

A vector‐valued model‐based cumulative sum (CUSUM) procedure is proposed for identifying faulty/falsified sensor measurements. First, given the system dynamics, the authors derive tools for tuning the CUSUM procedure in the fault/attack‐free case to fulfil the desired detection performance (in terms of false alarm rate). They use the widely‐used chi‐squared fault/attack detection procedure as a benchmark to compare the performance of the CUSUM. In particular, they characterise the state degradation that a class of attacks can induce the system while enforcing that the detectors (CUSUM and chi‐squared) do not raise alarms. In doing so, they find the upper bound of state degradation that is possible by an undetected attacker. They quantify the advantage of using a dynamic detector (CUSUM), which leverages the history of the state, over a static detector (chi‐squared), which uses a single measurement at a time. Simulations of a chemical reactor with a heat exchanger are presented to illustrate the performance of their tools.

In this manuscript, we present a detailed case study about model-based attack detection procedures for Cyber-Physical Systems (CPSs). In particular, using EPANET (a simulation tool for water distribution systems), we simulate a Water Distribution Network (WDN). Using this data and sub-space identification techniques, an input-output Linear Time Invariant (LTI) model for the network is obtained. This model is used to derive a Kalman filter to estimate the evolution of the system dynamics. Then, residual variables are constructed by subtracting data coming from EPANET and the estimates of the Kalman filter. We use these residuals and the Bad-Data and the dynamic Cumulative Sum (CUSUM) change detection procedures for attack detection. Simulation results are presented - considering false data injection and zero-alarm attacks on sensor readings, and attacks on control input - to evaluate the performance of our model-based attack detection schemes. Finally, we derive upper bounds on the estimator-state deviation that zero-alarm attacks can induce.