Attack Detection and Identification in Cyber-Physical Systems

Francesco Bullo

Center for Control,Dynamical Systems & Computation

University of California at Santa Barbara

http://motion.me.ucsb.edu

International Workshop on Emerging Frontiers in Systems and ControlTsinghua University, Beijing, China, May 18, 2012

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 1 / 30

Acknowledgements

Florian Dorfler Fabio Pasqualetti

Workshop Organizers:Center for Intelligent and Networked Systems, Tsinghua University

Institute of Systems Science, Chinese Academy of Sciences

Chair: Xiaohong Guan, Co-Chair: Yiguang Hong, Program Chair: Qingshan Jia

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 2 / 30

Outline

1 Cyber-Physical Security

2 Models of Cyber-Physical Systems and Attacks

3 Analysis and Design ResultsSummarySome Technical Details

4 Summary and Future Directions

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 3 / 30

Cyber-Physical Systems

Water Supplier Description 2-18

Figure 2-5. City of Portland Water Supply Schematic Diagram

Moore’s Law in Computing/Communication/Control

Renewables and PMUs in smart grid, autonomy/networking in robotics,distributed intelligence in industrial processes cyber-physical networks

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 4 / 30

Application Domains

15

512

1110

7

8

9

4

3

1

2

17

18

14

16

19

20

21

24

26

27

28

31

32

34 33

36

38

39 22

35

6

13

30

37

25

29

23

1

10

8

2

3

6

9

4

7

5

F

Fig. 9. The New England test system [10], [11]. The system includes10 synchronous generators and 39 buses. Most of the buses have constantactive and reactive power loads. Coupled swing dynamics of 10 generatorsare studied in the case that a line-to-ground fault occurs at point F near bus16.

test system can be represented by

!i = "i,Hi

#fs"i = !Di"i + Pmi ! GiiE

2i !

10!

j=1,j !=i

EiEj ·

· {Gij cos(!i ! !j) + Bij sin(!i ! !j)},

"##$##%

(11)

where i = 2, . . . , 10. !i is the rotor angle of generator i withrespect to bus 1, and "i the rotor speed deviation of generatori relative to system angular frequency (2#fs = 2# " 60Hz).!1 is constant for the above assumption. The parametersfs, Hi, Pmi, Di, Ei, Gii, Gij , and Bij are in per unitsystem except for Hi and Di in second, and for fs in Helz.The mechanical input power Pmi to generator i and themagnitude Ei of internal voltage in generator i are assumedto be constant for transient stability studies [1], [2]. Hi isthe inertia constant of generator i, Di its damping coefficient,and they are constant. Gii is the internal conductance, andGij + jBij the transfer impedance between generators iand j; They are the parameters which change with networktopology changes. Note that electrical loads in the test systemare modeled as passive impedance [11].

B. Numerical Experiment

Coupled swing dynamics of 10 generators in thetest system are simulated. Ei and the initial condition(!i(0),"i(0) = 0) for generator i are fixed through powerflow calculation. Hi is fixed at the original values in [11].Pmi and constant power loads are assumed to be 50% at theirratings [22]. The damping Di is 0.005 s for all generators.Gii, Gij , and Bij are also based on the original line datain [11] and the power flow calculation. It is assumed thatthe test system is in a steady operating condition at t = 0 s,that a line-to-ground fault occurs at point F near bus 16 att = 1 s!20/(60Hz), and that line 16–17 trips at t = 1 s. Thefault duration is 20 cycles of a 60-Hz sine wave. The faultis simulated by adding a small impedance (10"7j) betweenbus 16 and ground. Fig. 10 shows coupled swings of rotorangle !i in the test system. The figure indicates that all rotorangles start to grow coherently at about 8 s. The coherentgrowing is global instability.

C. Remarks

It was confirmed that the system (11) in the New Eng-land test system shows global instability. A few comments

0 2 4 6 8 10-5

0

5

10

15

!i /

ra

d

10

02

03

04

05

0 2 4 6 8 10-5

0

5

10

15

!i /

ra

d

TIME / s

06

07

08

09

Fig. 10. Coupled swing of phase angle !i in New England test system.The fault duration is 20 cycles of a 60-Hz sine wave. The result is obtainedby numerical integration of eqs. (11).

are provided to discuss whether the instability in Fig. 10occurs in the corresponding real power system. First, theclassical model with constant voltage behind impedance isused for first swing criterion of transient stability [1]. This isbecause second and multi swings may be affected by voltagefluctuations, damping effects, controllers such as AVR, PSS,and governor. Second, the fault durations, which we fixed at20 cycles, are normally less than 10 cycles. Last, the loadcondition used above is different from the original one in[11]. We cannot hence argue that global instability occurs inthe real system. Analysis, however, does show a possibilityof global instability in real power systems.

IV. TOWARDS A CONTROL FOR GLOBAL SWING

INSTABILITY

Global instability is related to the undesirable phenomenonthat should be avoided by control. We introduce a keymechanism for the control problem and discuss controlstrategies for preventing or avoiding the instability.

A. Internal Resonance as Another Mechanism

Inspired by [12], we here describe the global instabilitywith dynamical systems theory close to internal resonance[23], [24]. Consider collective dynamics in the system (5).For the system (5) with small parameters pm and b, the set{(!,") # S1 " R | " = 0} of states in the phase plane iscalled resonant surface [23], and its neighborhood resonantband. The phase plane is decomposed into the two parts:resonant band and high-energy zone outside of it. Here theinitial conditions of local and mode disturbances in Sec. IIindeed exist inside the resonant band. The collective motionbefore the onset of coherent growing is trapped near theresonant band. On the other hand, after the coherent growing,it escapes from the resonant band as shown in Figs. 3(b),4(b), 5, and 8(b) and (c). The trapped motion is almostintegrable and is regarded as a captured state in resonance[23]. At a moment, the integrable motion may be interruptedby small kicks that happen during the resonant band. That is,the so-called release from resonance [23] happens, and thecollective motion crosses the homoclinic orbit in Figs. 3(b),4(b), 5, and 8(b) and (c), and hence it goes away fromthe resonant band. It is therefore said that global instability

!"#$%&'''%()(*%(+,-.,*%/012-3*%)0-4%5677*%899: !"#$%&'

(')$

Authorized licensed use limited to: Univ of Calif Santa Barbara. Downloaded on June 10, 2009 at 14:48 from IEEE Xplore. Restrictions apply.

Water Supplier Description 2-18

Figure 2-5. City of Portland Water Supply Schematic Diagram

power generation, transportation, distribution networks

water, oil, gas and mass transportation systems

sensor networks

process control and industrial automation systems(metallurgical process plants, oil refining, chemical plants,pharmaceutical manufacturing ... ubiquitous SCADA/PLC systems)

Security of these networks is critically important

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 5 / 30

The Cyber-Physical Security Problem

Stuxnet worm (Iran, 2010)New York Times 15jan2011: replayattack as if “out of the movies:”

1 records normal operations andplays them back to operators

2 spins centrifuges at damagingspeeds

“Repository of Ind. Security Incidents”

http://www.securityincidents.org

www.theiet.org/engtechmag 8 November - 21November 2008 Engineering & Technology

43

SOME OF MANYWater industry Maroochy Shire sewage spill; Salt River Project SCADA hack; software flaw makes MA water undrinkable; Trojan/Keylogger on Ontario SCADA System; viruses on Aussie SCADA laptops; audit/blaster causes water SCADA crash; penetration of California irrigation district wastewater treatment plant SCADA; SCADA system tagged with message: ‘I enter in your server like you in Iraq’. Petroleum industry Electronic sabotage of Venezuela oil operations; CIA Trojan causes Siberian gas explosion; anti-virus software prevents boiler safety shutdown; slammer infected laptop shuts down DCS; electronic sabotage of gas processing plant; Slammer impacts offshore

platforms; Code Red Worm defaces automation Web pages; penetration test locks-up gas SCADA System. Chemical industryIP address change shuts down chemical plant; hacker changes chemical plant set points; Nachi Worm on advanced process control servers; SCADA attack on plant of chemical company; contractor connects to remote PLC; Blaster Worm infects chemical plant. Power industrySlammer infects control central LAN via VPN; Slammer causes loss of comms to substations; Slammer infects Ohio nuclear plant SPDS; Iranian hackers attempt to disrupt Israel power system; utility SCADA System attacked; virus attacks a European Utility; facility cyber attacks on Asian utility; power plant security details leaked on Internet.

changing. Justin Lowe, a management consultant at PA Consulting who focuses on SCADA security, says: “In the past there was a gap between the skill sets of IT people and control engineers. These days there’s much more of an overlap – the growth of IT-based control systems has fostered a conver-gence between them in terms of working together. As a result,

I’m now seeing more interest from IT people in focusing on the control side; there’s no way that would have happened five years ago.”

PROPER MANAGEMENT REQUIREDYet all this technology will be as nothing without proper management, so who should have overall responsibility for

an organisation’s security? “I think it should be a mix of people,” says Lowe. “In terms of accountability, it should be someone at professional engineer level, but for ongoing monitoring and maintenance it can be someone at the administrative level.”

Lowe also says that, should company culture permit it and providing it’s tailored to the control system environment, part or all of the security management can be outsourced. “For example, you can outsource the management of the firewall(s),” says Lowe, “something that could well find favour with a typical IT depart-ment that is used to managing Internet firewalls but has never encountered the range of weird protocols circulating in a control system environment.

“And make no mistake, firewalls need ongoing manage-ment and maintenance – they are not ‘fit and forget’ technology,” he says.

But whichever approach you choose, responsibility for security needs to go all the way to board level. But who should have it? “I’ve seen it sitting

with various functions but in general I think it’s more a role for operations and the COO,” says Lowe. “But whoever takes it on, you must have someone at board level.”

And if the worst comes to the worst, and a major attack does succeed, what’s the best way to deal with it? “Plan for the worst scenario – and be prepared for it,” says Lowe.

“This is a really weak area in many companies because of people’s natural focus on technology. It’s critical to have a fast response plan and some conti-nuity planning, such as a spare or back-up system, in place.”

However, he warns against a blanket approach to back-up. “A prime example is a safety system, which obviously needs a back-up; other, less critical systems may not,” he says. “You have to make some risk-based decisions, something people tend to forget about. It’s a combi-nation of technology and management.”

So there’s a consensus. Don’t ignore the fact that cyber attacks are real and occurring regularly – and do something about it. You have been warned.

security incidents

The Davis- Besse power station control room

Protection requires hardware-based security appliances at the control device level

These incidents all come from the Industrial Security Incident Database (ISID)

040-043_ET_issue19.indd 43 29/10/08 12:20:12F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 6 / 30

Cyber-Physical Security 6=Cyber Security, Fault Tolerance

Cyber-physical security complements cyber security

Cyber security (e.g., secure communication, secure code execution)

does not verify “data compatible with physics/dynamics”

is ineffective against direct attacks on the physics/dynamics

is never foolproof (e.g., insider attacks, OS zero-day vulnerabilities)

Cyber-physical security extends fault tolerance

fault detection considers accidental/generic failures

cyber-physical security models worst-case attacks

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 7 / 30

An Incomplete List of Related Results

S. Amin et al, “Safe and secure networked control systems under denial-of-service attacks,”

Hybrid Systems: Computation and Control 2009.

Y. Liu, M. K. Reiter, and P. Ning, “False data injection attacks against state estimation in electric power grids,”

ACM Conference on Computer and Communications Security, Nov. 2009.

A. Teixeira et al. “Cyber security analysis of state estimators in electric power systems,”

IEEE Conf. on Decision and Control, Dec. 2010.

S. Amin, X. Litrico, S. S. Sastry, and A. M. Bayen, “Stealthy deception attacks on water SCADA systems,”

Hybrid Systems: Computation and Control, 2010.

Y. Mo and B. Sinopoli, “Secure control against replay attacks,”

Allerton Conf. on Communications, Control and Computing, Sep. 2010

G. Dan and H. Sandberg, “Stealth attacks and protection schemes for state estimators in power systems,”

IEEE Int. Conf. on Smart Grid Communications, Oct. 2010.

Y. Mo and B. Sinopoli, “False data injection attacks in control systems,”

First Workshop on Secure Control Systems, Apr. 2010.

S. Sundaram and C. Hadjicostis, “Distributed function calculation via linear iterative strategies in the presence of

malicious agents,” IEEE Transactions on Automatic Control, vol. 56, no. 7, pp. 1495–1508, 2011.

R. Smith, “A decoupled feedback structure for covertly appropriating network control systems,”

IFAC World Congress, Aug. 2011.

F. Hamza, P. Tabuada, and S. Diggavi, “Secure state-estimation for dynamical systems under active adversaries,”

Allerton Conf. on Communications, Control and Computing, Sep. 2011.

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 8 / 30

Outline

1 Cyber-Physical Security

2 Models of Cyber-Physical Systems and Attacks

3 Analysis and Design ResultsSummarySome Technical Details

4 Summary and Future Directions

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 9 / 30

An Example of Cyber-Physical Attack

g1

g2g3

b4

b1

b5b2

b6

b3

1

0.8

0.6

0.4

0.2

0

0.2

0.4

0.6

0.8

1

1

0.8

0.6

0.4

0.2

0

0.2

0.4

0.6

0.8

1

1

0.8

0.6

0.4

0.2

0

0.2

0.4

0.6

0.8

1

Sensors

1

2

3

1 Physical dynamics: classical generator model & DC load flow

2 Measurements: angle and frequency of generator g1

3 Attack: modify real power injections at buses b4 & b5

“Distributed internet-based load altering attacks against smart power grids” IEEE Trans on Smart Grid, 2011

The attack affects the second and third generators while remainingundetected from measurements at the first generator

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 10 / 30

Models of Power Networks

Small-signal structure-preserving power network model:

1 transmission network: generators �� , buses •◦ ,DC load flow assumptions, and networksusceptance matrix Y = Y T

2 generators �� modeled by swing equations:

Mi θi + Di θi = Pmech.in,i −∑

jYij ·

(θi − θj

)

2

10

30 25

8

37

29

9

38

23

7

3622

6

35

19

4

3320

5

34

10

3

32

6

2

31

1

8

7

5

4

3

18

17

26

2728

24

21

16

1514

13

12

11

1

39

9

3 buses •◦ with constant real power demand:

0 = Pload,i −∑

jYij ·

(θi − θj

)

⇒ Linear differential-algebraic dynamics: E x = Ax

YjkYikk

Pload,k

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 11 / 30

Models of Water Networks

Linearized municipal water supply network model:

1 reservoirs with constant pressure heads: hi (t) = hreservoiri = const.

2 pipe flows obey linearized Hazen-Williams eq: Qij = gij · (hi − hj)

3 balance at tank:Ai hi =

∑j→i Qji −

∑i→k Qik

4 demand = balance at junction:di =

∑j→i Qji −

∑i→k Qik

5 pumps & valves:

hj−hi = +∆hpump/valvesij = const.

⇒ Linear differential-algebraic dynamics: E x = Ax

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 12 / 30

Prototypical Attacks

Dynamic false data injection:

(sE − A)−1 Cx(t)

+ y(t)x(0)

DKuK(t)

G(s)�(s − p) − 1

�

Covert attack:

(sE − A)−1 Cx(t)

+ y(t)x(0)

BK uK(t)

DKuK(t)

Static stealth attack:

Cx(t) + y(t)

CDKuK(t)

u(t)

Replay attack:

(sE − A)−1 Cx(t)

+ y(t)x(0)

BK uK(t)

DKuK(t)x(0) +

−

−

corrupt measurements according to C affect system and reset output

closed loop replay attack render unstable pole unobservable

(sE − A)−1 C

(sE − A)−1 C

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 13 / 30

Models of Networks, Attackers and Monitors #1

Network model

E x(t) = Ax(t) + Bu(t) (state and actuator attack)

y(t) = Cx(t) + Du(t) (data substitution attack)

Byzantine Cyber-Physical Attackers

1 colluding omniscent attackers:know model structure and parametersmeasure full statecan apply some control signal and corrupt some measurements

2 attacker’s objective is to change/disrupt the physical state

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 14 / 30

Models of Networks, Attackers and Monitors #2

Security System

1 knows structure and parameters

2 measures output signal

Objectives

1 vulnerability analysis (fundamental monitor limitations)

2 detection and identification monitors

3 secure-by-design systems

4 attack strategies

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 15 / 30

Outline

1 Cyber-Physical Security

2 Models of Cyber-Physical Systems and Attacks

3 Analysis and Design ResultsSummarySome Technical Details

4 Summary and Future Directions

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 16 / 30

Framework for Cyber-Physical Security

1 a modeling framework for cyber-physical systems under attackgeneralizing broad range of previous results

2 fundamental detection and identification limitations

3 system- and graph-theoretic detection and identification conditions

4 centralized attack detection and identification procedures

5 distributed attack detection and identification procedures

References

F. Pasqualetti, F. Dorfler, and F. Bullo. “Cyber-physical security via geometriccontrol: Distributed monitoring and malicious attacks” 2012 IEEE CDC. Submitted

—– “Attack Detection and Identification in Cyber-Physical Systems – Part I:Models and Fundamental Limitations” IEEE Trans Automatic Control, Feb 2012.Submitted. Available at http://arxiv.org/abs/1202.6144v2

—– “Attack Detection and Identification in Cyber-Physical Systems – Part II:Centralized and Distributed Monitor Design” IEEE Trans Automatic Control, Feb2012. Submitted. Available at http://arxiv.org/abs/1202.6049

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 17 / 30

Result #1: Vulnerabilities AnalysisWestern US (WECC 3-m, 6-b)

g1

g2g3

b4

b1

b5b2

b6

b3

1

0.8

0.6

0.4

0.2

0

0.2

0.4

0.6

0.8

1

1

0.8

0.6

0.4

0.2

0

0.2

0.4

0.6

0.8

1

1

0.8

0.6

0.4

0.2

0

0.2

0.4

0.6

0.8

1

Sensors

θ1ω1

δ1

y2 f2θ5

δ3

ω3θ3

f1 θ4

δ2

ω2 θ2

y1

θ6

1 undetectable attacks exist

2 input/output (intruder/monitor) system has invariant zero

3 number of attacked signals > size of input/output linking

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 18 / 30

Result #2: Distributed Monitor DesignIEEE 118 bus (Midwest, 54-m 118-b)

� �

�

�

� �

�

�

��

��

��

��

��

���

��

��

��

��

��

��

��

��

��

��

��

��

��

��

��� ��

��

��

������

��

��

��

��

��

��

��

�� �� ��

��

��

��

����

��

��

��

��

��

�� �� ����

����

��

��

��

��

��

��

��

��

��

��

���

��

��

��

��

��

��

��

��

��� ��

��

��

��

��

��

��

����

��

��

��

�� ��

����

��

��

����

��

��

��

��

���

������

���

��� ���

���

���

���

���

���

���

���

G

G

G

G

G G

G

G

GG

G

GG

G

G

G

G G

G

G

G

G

G G

G G

G

G G

G

G

G

G

G G G G G

G

G

�

G

G

G

G

G

G

G

G

G

G

G

G

G

G

2QH�OLQH�'LDJUDP�RI�,(((�����EXV�7HVW�6\VWHP

,,7�3RZHU�*URXS������

6\VWHP�'HVFULSWLRQ�

����EXVHV����EUDQFKHV���ORDG�VLGHV���WKHUPDO�XQLWV

Area 1

Area 2

Area 4

Area 5

Area 3

IEEE 118 Bus System

Waveform iteration error:

1 2 3 4 5 6 7 8 9 100

20

40

60

80

100

120

Err

or

Iterations

Detection via residual filter design

Centralized and distributed filters

Distributed iterative filtersvia waveform relaxation

Residuals r(k)i (t) for k = 100:

0 5 10 15 20 25 30 35 401

0

1

0 5 10 15 20 25 30 35 401

0

1

0 5 10 15 20 25 30 35 401

0

1

0 5 10 15 20 25 30 35 401

0

1

0 5 10 15 20 25 30 35 401

0

1

Time

Residual Area 1

Residual Area 2

Residual Area 4

Residual Area 5

Residual Area 3

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 19 / 30

Result #3: Optimal Cooperative AttacksWestern US (WECC, 16-m 13-b)

10

1

2

34

5

6

7

8

9

1112

13

14

15

16

South ArizonaSoCal

NoCal

PacNW

Canada

North

Montana

Utah

0 1 2 3 4 5 6 7 8 9 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

0 5 101

0.5

0

0.5

1

ω1

ω5

ω9

ω13

ω2 ω3 ω4

ω6 ω7 ω8

ω10 ω11 ω12

ω14 ω15 ω16

Optimal attack design via geometric control

Two attackers suffice for network-wide instability

Specific effect against selected machines

Attack unidentifiable by single machine

De Marco et al, “Malicious control in a competitive power systems environment” CCA ’96

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 20 / 30

Outline

1 Cyber-Physical Security

2 Models of Cyber-Physical Systems and Attacks

3 Analysis and Design ResultsSummarySome Technical Details

4 Summary and Future Directions

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 21 / 30

Technical Assumptions

E x(t) = Ax(t) + BKuK (t)

y(t) = Cx(t) + DKuK (t)

Technical assumptions guaranteeing existence, uniqueness, & smoothness:

(i) (E ,A) is regular: |sE − A| does not vanish for all s ∈ C

(ii) the initial condition x(0) is consistent (can be relaxed)

(iii) the unknown input uK (t) is sufficiently smooth (can be relaxed)

Attack set K = sparsity pattern of attack input

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 22 / 30

Undetectable AttackDefinition

An attack remains undetected if its effect on measurements isundistinguishable from the effect of some nominal operating conditions

Normal operatingcondition

Undetectableattacks

Detectableattacks

y(·, 0, t) y(·, uK(t), t)

Definition (Undetectable attack set)

The attack set K is undetectable if there exist initial conditions x1, x2, andan attack mode uK (t) such that, for all times t

y(x1, uK , t) = y(x2, 0, t).

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 23 / 30

Undetectable AttackCondition

By linearity, an undetectable attack is such that y(x1 − x2, uK , t) = 0

zero dynamics

Theorem

For the attack set K , there exists an undetectable attack if and only if

[sE − A −BK

C DK

] [xg

]= 0

for some s, x 6= 0, and g.

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 24 / 30

Unidentifiable AttackDefinition

The attack set K remains unidentified if its effect on measurements isundistinguishable from an attack generated by a distinct attack set R 6= K

Attacks by KUnidentifiable

attacksAttacks by R

y(·, uK(t), t) y(·, uR(t), t)

Definition (Unidentifiable attack set)

The attack set K is unidentifiable if there exists an admissible attack setR 6= K such that

y(xK , uK , t) = y(xR , uR , t).

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 25 / 30

Unidentifiable AttackCondition

By linearity, the attack set K is unidentifiable if and only if there exists adistinct set R 6= K such that y(xK − xR , uK − uR , t) = 0.

Theorem

For the attack set K , there exists an unidentifiable attack if and only if

[sE − A −BK −BR

C DK DR

]

xgKgR

= 0

for some s, x 6= 0, gK , and gR .

So far we have shown:

fundamental detection/identification limitations

system-theoretic conditions for undetectable/unidentifiable attacks

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 26 / 30

From Algebraic to Graph-theoretical Conditions

Ex(t) = Ax(t) + Bu(t)

y(t) = Cx(t) + Du(t)θ1ω1

δ1

y2 f2θ5

δ3

ω3θ3

f1 θ4

δ2

ω2 θ2

y1

θ6

the vertex set is the union of the state, input, and output variables

edges corresponds to nonzero entries in E , A, B, C , and D

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 27 / 30

Zero Dynamics and Connectivity

A linking between two sets of vertices is a set of mutually-disjoint directedpaths between nodes in the sets

Input Output

Theorem (Detectability, identifiability, linkings, and connectivity)

If the maximum size of an input-output linking is k:

there exists an undetectable attack set K1, with |K1| ≥ k, and

there exists an unidentifiable attack set K2, with |K2| ≥ dk2 e.

statement becomes necessary with generic parameters

statement applies to systems with parameters in polytopes

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 28 / 30

Outline

1 Cyber-Physical Security

2 Models of Cyber-Physical Systems and Attacks

3 Analysis and Design ResultsSummarySome Technical Details

4 Summary and Future Directions

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 29 / 30

Summary and Future Directions

Cyber-Physical Security1 fundamental limitations2 distributed monitor design3 control theory + distributed algorithms

Research Avenues1 optimal network clustering for distributed procedures2 analysis of costs and effects of attacks3 optimal monitors with noise and faults4 nonlinear and piecewise systems5 integration with hypothesis testing and system optimization

F. Bullo UCSB Cyber-Physical Security Beijing 19may2012 30 / 30