A co-design methodology for cyber-physical systems under actuator fault and cyber attack

This paper investigates the controller design problem of cyber-physical systems (CPSs) to ensure the reliability and security when actuator faults in physical layers and attacks in cyber layers occur simultaneously. The actuator faults are time-varying, which cover bias fault, outage, loss of effectiveness and stuck. Besides that, some state-dependent cyber attacks are launched in control input commands and system measurement data channels, which may lead state information to the opposite direction. A novel co-design controller scheme is constructed by adopting a new Lyapunov function, Nussbaum-type function, and direct adaptive technique, which may further relax the requirements of actuator/sensor attacks information. It is proven that the states of the closed-loop system asymptotically converge to zero even if actuator faults, actuator attacks and sensor attack are time-varying and co-existing. Finally, simulation results are presented to show the effectiveness of the proposed control method.     

Secure state estimation for event-triggered cyber-physical systems against deception attacks

Nowadays, cyber-physical systems (CPSs) have been widely used in various fields due to their powerful performance and low cost. The cyber attacks will cause security risks and even huge losses according to the universality and vulnerability of CPSs. As a typical network attack, deception attacks have the features of high concealment and strong destructiveness. Compared with the traditional deception attack models with a constant value, a deception attack with random characteristics is introduced in this paper, which is difficult to identify. In order to defend against such deception attacks and overcome energy constraints in CPSs, the secure state estimation and the event-triggered communication mechanism without feedback information are co-considered to reconcile accuracy of estimation and energy consumption. Firstly, an event-triggered augmented state estimator is proposed for secure state estimation and attack identification. Then, under the ideology of equivalence, the augmented state estimator is derived as a concise two-stage estimator with reduced order. The two-stage estimator can perform the secure state estimation and attack identification respectively. The estimators ensure the accuracy of attack identification well since not treating attack information as the trigger event. Afterward, the comparison of the computational complexity of these two algorithms is analyzed. Finally, an example of a target tracking system is supplied to prove the effectiveness and efficiency of the proposed algorithm.     

Finite-time attack detection for nonlinear complex cyber-physical networks under false data injection attacks

This paper investigates the problem of finite-time attack detection for nonlinear complex cyber-physical networks under false data injection (FDI) attacks. Firstly, a Takagi-Sugeno (T-S) fuzzy model is used to approximate nonlinear complex cyber-physical networks in which the measurement channels are injected by FDI attacks. Secondly, based on adding a power integrator technique, a finite-time fuzzy observer is designed to achieve the rapid state observation of complex cyber-physical networks within a finite time by adjusting the observer parameters. Then, an attack detection mechanism consisting of the finite-time fuzzy observer and an attack detector is developed to detect FDI attacks, which can trigger an alarm within a finite time when FDI attacks occur. Finally, simulation results are given to show the effectiveness and superiority of the proposed method.     

Switching resilient control scheme for cyber-physical systems against DoS attacks

This paper investigates the problem of resilient control for cyber-physical systems (CPSs) described by T-S fuzzy models. In the presence of denial-of-service (DoS) attacks, information transmission over the communication network is prevented. Under this circumstance, the traditional control schemes which are proposed based on perfect measurements will be infeasible. To overcome this difficulty, with the utilization of an equivalent switching control method, a novel gain-switched observer-based resilient control scheme is proposed. According to whether the DoS attack is activated, two different controller synthesis conditions are given by combining the information of the tolerable DoS attacks. In addition, a quantitative relationship between the resilience against DoS attacks and the obtained disturbance attenuation level is revealed, which is helpful for balancing the tradeoff between the abilities to tolerate DoS attacks and attenuate the influence of external disturbance. Finally, simulation results are provided to verify the effectiveness of the proposed switching control scheme.     

Sliding-mode secure control for jump cyber– physical systems with malicious attacks

This paper develops the secure control strategy design issue for jump cyber–physical systems (CPSs) with malicious attacks. In the jump CPSs, the jump signals are assumed to obey the semi-Markov distribution with the transition probability depends on the stochastic sojourn-time, the physical plant and actuator simultaneous subject to the adversarial attack. A secure control strategy on robust sliding-mode control (SMC) is designed to deal with the malicious attacks. Firstly, an integral sliding-mode hyperplane is constructed, and the sliding-mode dynamics is discussed. Then, the slide-mode parameters are solved by the linear matrix inequality method with prescribed H∞ damping index. Furthermore, a robust sliding-mode controller is presented, and the reachability of the sliding-mode motion is analyzed. Finally, two examples are implemented to prove the potential of the secure control approach.     

Performance degradation of stealthy attacks against sensor measurements in vector systems

In this work, we analyze the performance degradation of stealthy attacks against sensor measurements in vector systems. Two types of attacks are considered. One is strictly stealthy attack and the other is ?-stealthy attack. For the strictly stealthy attack, we characterize the upper bound of the performance degradation and design an optimal strictly stealthy attack that can achieve the upper bound. For the ?-stealthy attack, we quantify the upper bound of the performance degradation and propose a sub-optimal ?-stealthy attack approximately achieving the upper bound. Numerical results are given to illustrate the trade off between performance degradation versus the stealthiness level of the attack.     

False data injection attacks on sensors against state estimation in cyber-physical systems

In this paper, the problem about the false data injection attacks on sensors to degrade the state estimation performance in cyber-physical systems(CPSs) is investigated. The attack strategies for unstable systems and stable ones are both designed. For unstable systems, based on the idea of zero dynamics, an unbounded attack strategy is proposed which can drive the state estimation error variations to infinity. The proposed method is more general than existing unbounded attack strategies since it relaxes the requirement for the initial value of the estimation error. For stable systems, it is difficult to bring unbounded impacts on the estimation error variations. Therefore, in this case, an attack strategy with adjustable attack performance which makes the estimation error variations track predesigned target values is proposed. Furthermore, a uniform attack strategy which aims to deteriorate state estimation for both stable systems and unstable ones is derived. Finally, simulations are provided to illustrate the effectiveness of the proposed attack strategies.     

Distributed filtering algorithm based on local outlier factor under data integrity attacks

Network security is becoming a prominent issue for the development of information technology, and intelligent network attacks pose great challenges to system security due to its strong concealment. The existence of these attacks threatens the operation process of the complicated control system. Motivated by such a security problem, we study the secure distributed filtering algorithm under a kind of complex data integrity attack which can attack in two forms. We design a detection mechanism based on local outlier factor to distinguish the rightness of exchanged data, which determines whether to fuse the estimates by comparing the local density (LD) of the estimation of each sensor. Such a detection mechanism does not need the sensor to transmit redundant data information, thus greatly saving calculation cost and improving transmission efficiency. Meanwhile, we optimize the distributed filtering algorithm and obtain a suboptimal estimation gain. Finally, we demonstrate a numerical example to verify the availability of the filtering algorithm, and explore the influence of detector parameters on the performance of the estimation system.     

Detection of replay attacks in cyber-physical systems using a frequency-based signature

This paper proposes a frequency-based approach for the detection of replay attacks affecting cyber-physical systems (CPS). In particular, the method employs a sinusoidal signal with a time-varying frequency (authentication signal) into the closed-loop system and checks whether the time profile of the frequency components in the output signal are compatible with the authentication signal or not. In order to carry out this target, the couplings between inputs and outputs are eliminated using a dynamic decoupling technique based on vector fitting. In this way, a signature introduced on a specific input channel will affect only the output that is selected to be associated with that input, which is a property that can be exploited to determine which channels are being affected. A bank of band-pass filters is used to generate signals whose energies can be compared to reconstruct an estimation of the time-varying frequency profile. By matching the known frequency profile with its estimation, the detector can provide the information about whether a replay attack is being carried out or not. The design of the signal generator and the detector are thoroughly discussed, and an example based on a quadruple-tank process is used to show the application and effectiveness of the proposed method.     

Periodic event-triggered resilient control for cyber-physical systems under denial-of-service attacks

This paper studies the problem of designing a resilient control strategy for cyber-physical systems (CPSs) under denial-of-service (DoS) attacks. By constructing an H_∞ observer-based periodic event-triggered control (PETC) framework, the relationship between the event-triggering mechanism and the prediction error is obtained. Then, inspired by the maximum transmission interval, the input-to-state stability of the closed-loop system is proved. Compared with the existing methods, a Zeno-free periodic PETC scheme is designed for a continuous-time CPS with the external disturbance and measurement noise. In particular, the objective of maximizing the frequency and duration of the DoS attacks is achieved without losing robustness. Finally, two examples are given to verify the effectiveness of the proposed approach.     

Web应用防火墙中DDoS防范的设计与实现

分析DDoS攻击的形成及特征,对各种拒绝服务攻击的实现算法进行对比分析。重点研究可用于检测和防御基于HTTP协议的DDoS攻击的方法,消除或者减少HTTP-Flood攻击对Web服务器的影响,从而达到保护Web服务器的目的。最后,将这种检测防御方法移植到Web应用防火墙（WAF）的DDoS模块中,实现Web服务器防范DDoS攻击的最终解决方案。     

Observer-based detection and reconstruction of dynamic load altering attack in smart grid

This paper mainly focuses on the problems of attack detection and reconstruction of cyber physical systems (CPS) under dynamic load altering attacks (D-LAA). Taking the smart grid as an example, firstly, the power system subjected to the attack is modeled as a power CPS through system characteristics to provide conditions for attack detection. On this basis, we assume that two vulnerable loads are attacked simultaneously to investigate the impact of the attack on the system. Secondly, a robust sliding mode observer is designed to implement attack reconstruction with the residual signal generated by the observer. After that, an attack detection logic is applied to complete the attack detection by comparing the threshold with the residual. Finally, a three generators and six buses power system is given as an example to verify the feasibility of attack detection and reconstruction by using the real-time simulation platform built by StarSim and MT respectively. The simulation results are given in this paper.     

Adaptive quantitative exponential synchronization in multiplex Cohen-Grossberg neural networks under deception attacks

In this article, a secure exponential synchronization problem is studied for multiplex Cohen-Grossberg neural networks under stochastic deception attacks. In order to resist the malicious attack from attackers modifying the data in transmission module under a certain probability, an attack resistant controller, which has the ability to automatically adjust its own parameters according to external attacks, is designed for each Cohen-Grossberg neural subnet. An exponential adaptive quantitative controlling algorithm is proposed to synchronize Cohen-Grossberg neural network state, and a sufficient criterion is established to realize the synchronization error tends to zero under malicious attacks. Moreover, synchronization mode we study is the synchronization among Cohen-Grossberg neural subnets in multiplex networks. An example is presented to testify the validity of proposed theoretical framework.     

云环境下基于移动代理的入侵检测系统的研究

云计算的特点是具有强大的计算能力和存储能力。入侵检测技术在网络安全技术中占有重要地位,但目前的入侵检测技术仍存在许多尚未解决的问题,如无法应对分布式大规模数据流攻击等。移动代理技术可给入侵检测系统带来更好的灵活性和可扩展性,结合移动代理的优势,构造了云环境下基于移动代理的入侵检测系统框架。采用NS2软件分别模拟一般网络条件与云环境下基于移动代理框架的DDoS节点攻击的两种场景,实验结果表明,云环境下基于移动代理框架的检测效果更佳。     

Data-driven attacks and data recovery with noise on state estimation of smart grid

In this paper, we focus on the false data injection attacks (FDIAs) on state estimation and corresponding countermeasures for data recovery in smart grid. Without the information about the topology and parameters of systems, two data-driven attacks (DDAs) with noisy measurements are constructed, which can escape the detection from the residue-based bad data detection (BDD) in state estimator. Moreover, in view of the limited energy of adversaries, the feasibility of proposed DDAs is improved, such as more sparse and low-cost DDAs than existing work. In addition, a new algorithm for measurement data recovery is introduced, which converts the data recovery problem against the DDAs into the problem of the low rank approximation with corrupted and noisy measurements. Especially, the online low rank approximate algorithm is employed to improve the real-time performance. Finally, the information on the 14-bus power system is employed to complete the simulation experiments. The results show that the constructed DDAs are stealthy under BBD but can be eliminated by the proposed data recovery algorithms, which improve the resilience of the state estimator against the attacks.     

Co-design of output-based security control and dynamic event-triggered mechanism for NCSs under hybrid cyber attacks

This paper investigates output-based dynamic event-triggered control for networked control systems (NCSs), in which hybrid cyber attacks randomly occur in communication network. First, a gain adjustable dynamic output feedback (DOF) controller is designed for NCSs and relaxes state-available constraint in presence of three types of attacks, including stochastic deception attacks, replay attacks and aperiodic denial-of-service (DoS) attacks. Second, a output-based dynamic event-triggered mechanism (DETM) is designed to optimize limited network resources under the cyber attacks. Third, a new switched system is established to describe the effect of hybrid cyber attacks, the DOF controller and the DETM simultaneously. Then, criteria for guaranteeing asymptotically stability of the switched system are obtained. Furthermore, the co-design method of DETM and DOF controller is provided to maintain the NCSs stability. Finally, an example is presented to show the effectiveness of the proposed methods in this paper.     

Leader-following consensus of multi-agent systems with connectivity-mixed attacks and actuator/sensor faults

This study investigates the leader-following consensus issue of multi-agent systems subject to simultaneous connectivity-mixed attacks, actuator/sensor faults and disturbances. Connectivity-mixed attacks are remodeled into connectivity-maintained and connectivity-paralyzed topologies in a switched version, and actuator/sensor faults are established with unified incipient-type and abrupt-type characteristics. Then, unknown input observer-based decoupling and estimation are incorporated to achieve unknown state and fault observations with the normalized technique, and the leader-following consensus-based compensation to faults, resilience to attacks and robustness to disturbances are also realized with the neighboring output information and sensor fault estimation through the distributed framework. Criteria of achieving exponential leader-following consensus of multi-agent systems under cyber-physical threats are derived with dual attack frequency and activation rate indicators. Simulation example is conducted to exemplify the validation and merits of the proposed leader-following consensus algorithm.     

A Novel Copy-Move Forgery Detection Algorithm via Feature Label Matching and Hierarchical Segmentation Filtering

Recently, some copy-move forgeries have made use of homogeneous region(s) in an image with the large-scaling attack(s) to highlight or cover the target objects, which is easy to implement but difficult to detect. Unfortunately, existing Copy-Move Forgery Detection (CMFD) methods fail to detect such kinds of forgeries because they are incapable of extracting a sufficient number of effective keypoints in the homogeneous region(s), leading to inaccuracy and inefficiency in detection. In this work, a new CMFD scheme is proposed: 1) An improved SIFT structure with inherent scaling invariance is designed to enhance the capability of extracting effective keypoints in the homogeneous region. 2). The enhancement of massive keypoints extraction in the homogeneous region incurs a heavy computational burden in feature matching (Note that this is a common issue in all CMFD methods). For this reason, a new Feature Label Matching (FLM) method is proposed to break down the massive keypoints into different small label groups, each of which contains only a small number of keypoints, for significantly improved matching effectiveness and efficiency. 3) Identifying true keypoints for matching is a critical issue for performance. In our work, the Hierarchical Segmentation Filtering (HSF) algorithm is newly proposed to filter out suspicious outliers, based on the statistics on the coarse-to-fine hierarchical segmentations. 4) Finally, the fusion of the coarse-to-fine hierarchical segmentation maps fills the forgery regions precisely. In our experiments, the proposed scheme achieves excellent detection performance under various attacks, especially for the homogeneous region(s) detection under large-scaling attack(s). Extensive experimental results demonstrate that the proposed scheme achieves the best F₁ scores and least computational cost in addressing the geometrical attacks on the IMD dataset (a comprehensive dataset), and CMH datasets (most forgery samples under geometric attacks). Compared to existing state-of-the-art methods, the proposed scheme raises at least 20% and 25% in terms of F₁ scores under scaling factors of 50%, and 200% in large-scaling sub-datasets of IMD, respectively.