IEEE Systems, Man and Cybernetics Magazine - April 2021 - 40

Algorithm 1. A KF detector that uses an
authentication signal [95].
1)	The state-space dynamics of a linear time-invariant
system are provided as follows:
x (k + 1) = Ax (k ) + Bu (k ) + w (k )

y (k ) = Cx (k ) + v (k ),

	

(6)

	where x (k ) ! R n denotes the system state, y (k ) ! R m
indicates a vector of sensor measurements, u (k ) ! R p
implies the control input, and w (k ) ! R n and v (k ) ! R m
represent process noise and measurement noise, respectively. It is assumed that x(0), w(k), and v(k) are independent Gaussian random variables. Moreover, A, B, and C
show system, input, and output matrices, respectively.
2)	The state is estimated by the KF:

	

xt (k + 1|k) = Axt (k |k) + Bu (k)
P (k + 1|k) = AP (k |k) A T + Q
K (k) = P (k |k - 1) C T (CP (k |k - 1) C T + R ) -1 
tx (k |k) = xt (k |k - 1) + K (k) (y (k) - Cxt (k |k - 1))
(7)
P (k |k) = P (k |k - 1) - K (k) CP (k |k - 1),

	where xt (k |k ) and P (k |k ) indicate the estimated
state and the covariance matrix of the state, respectively. In addition, xt (k + 1|k ) and P (k + 1|k ) denote
the predicted state and the expected covariance of
the state, respectively; K(k) implies the Kalman gain.
It is assumed that the values of Q and R are constant and known. We also put xt (0|- 1) = xr (0), and
P (0|- 1) = R , as initial conditions. For a detectable
system, the Kalman gain converges in a few steps, and
we define P / lim k " 3 P (k |k - 1), K / PC T (CPC T + R )-1.
Therefore, the state is recursively computed by
xt (k |k ) = xt (k |k - 1) + K (y (k ) - Cxt (k |k - 1)).
3)	The optimal control is augmented using the cost function
	

J = Min lim T " 3 E

T -1

1|
(x (k )T Wx (k ) + u (k )T Uu (k )), (8)
T k =0

	where matrices W and U are semidefinite. The optimal control is driven as u * = Lxt (k |k ). and L = -(B T SB + U )-1 B T SA.
The variable S is determined by the Riccati equation
S = A T SA + W - A T SB (B T SB + U )-1 B T SA.
4)	An | 2 detector is formulated as follows:
	 g (k ) =

k

|

i +k -g +1

0.4
0.35

Detector With an Authentication Signal

0.3
0.25
0.2
0.15
0.1
0.05

Detector

(y (k ) - Cxt (i |i - 1)T g -1(y (i ) - Cxt (i |i - 1)), (9)

	where g is a sliding window in which g(k)is calculated. If
o #|g (k )|, an attack is detected. Parameter o is a predefined threshold. The final control signal is calculated:
u (k ) = u * (k ) + Tu (k ), where Tu (k ) is an authentication signal with zero mean.

40	

intended damage. Simulations on an unmanned ground
vehicle (UGV) illustrate the attack's effectiveness.
A model-based attack detector is developed in [95] to
isolate a replay attack. A KF-based estimator is presented
to approximate the system state, and an LQG controller is
designed to obtain an optimal control law. An |2 detector
based on residual estimation is employed to detect system
abnormality. The proposed |2 detector is independent
identically distributed (IID) Gaussian with low probability.
Therefore, if the system under the attack remains stable,
the detector's Gaussian distribution converges to one similar to that of normal system operation. The detection rate
is equal to the false alarm rate, and the detector cannot
distinguish the replay attack. Later, an authentication control signal is added to the optimal control signal to address
this issue, and the new detector succeeds. The procedure
for designing the control law is explained in Algorithm 1.
Figure 3 illustrates an |2 detector and a detector with
an authentication signal added to the optimal controller.
Note that the capability of the detector sharply improves
when an authentication signal is added to the controller.
However, the controller is not optimal, and as a result, an
extra cost is forced upon the system. To address optimality
and detectability problems in systems under attack,
authentication signal optimization is performed in [96]. The
detectability of the |2 detector is maximized, and concurrently, the LQG performance loss is constrained to be less
than a certain value. This problem can be solved by the
Lagrangian method. Figure 4 presents an |2 detector with
nonoptimal and optimal authentication signals. The importance of optimizing the authentication signal is obvious
from Figure 4. The power of the optimal detector is almost
15 times greater than the nonoptimal detector.
In [9], a model-based approach using an extended KF
(EKF)-based estimator is developed to isolate cyberattacks for a class of stochastic nonlinear systems. DoS and
false data injections are considered. The EKF is applied to

Detection Rate

applied to detect attacks on sensors. A linear attack strategy is adopted, and the operation proves to be stealthy, providing an optimal closed-loop form for a successful attack.
Moreover, simulations show that the attack cannot be
detected. In [94], an optimal deception strategy is introduced against a CPS. First, an |2 detector that uses a Kalman filtering method is discussed. Then, an optimal attack
is formulated using the Kullback-Leibler divergence, and
the singular value decomposition method is employed to
divide the residual into two parts to investigate the
attack's stealthiness. An attack policy is proposed from a
hacker's perspective to obtain an upper bound for the

IEEE SYSTEMS, MAN, & CYBERNETICS MAGAZINE Apri l 2021

0 10 11 12 13 14 15 16 17 18 19 20
Time (s)
Figure 3. The | 2 detector and a detector with

an authentication signal added to the optimal
controller [95].
IEEE Systems, Man and Cybernetics Magazine - April 2021

Table of Contents for the Digital Edition of IEEE Systems, Man and Cybernetics Magazine - April 2021
