Vulnerability of Cyber-Physical Systems to Optimal Stealthy Deterministic Attack Strategies

Abstract

Cyber-physical systems (CPSs) are an emerging technology with the potential to be transformational in the field of systems and control. They combine wireless and virtual components with physical infrastructure to create systems that are more adaptable, scalable, and resilient than their traditional counterparts. Unfortunately, the connections in these wireless networks may be vulnerable to attacks from hostile adversaries that seek to impair the system. This is why the security of CPSs has become a popular area of research in the past decade. Development of effective countermeasures requires a solid understanding of potential vulnerabilities, so it is necessary to study how attackers could successfully degrade system performance while remaining undetected. Two deterministic attack models with different stealthiness conditions are considered. First of all, we study the properties and optimization of strictly stealthy attacks that cannot be detected by output and innovation-based detectors on CPSs. These attacks may target both actuator and sensor communication channels with the goal of impairing system performance. We provide a necessary and sufficient condition for a system to be susceptible to a strictly stealthy attack of any given time length. Furthermore, we analytically derive the optimal attack out of all possible strictly stealthy attacks with a particular length based on an energy constraint and a summation-based quadratic objective function. Secondly, we examine optimal stealthy attacks that utilize a relaxed stealthiness condition. This condition ensures that the attacks are difficult for any innovation-based detectors to perceive. In order to determine the maximum performance degradation that the attacks may cause, a general optimization problem that can be solved numerically is formulated for a finite attack length. For non-divergent systems over an infinite horizon, the optimal constant and alternating attacks are derived analytically for any system configuration. Characteristics of a novel low-dimensional sinusoidal class of attacks are investigated and procedures for optimization are given. Furthermore, a condition is provided for constant and alternating attacks to be superior to most or all sinusoidal attacks. A mechanism to compare deterministic and stochastic attacks is also presented. Finally, we illustrate the theoretical results using several numerical examples to demonstrate the effectiveness of the designed attacks.