With the advent of the smart industry, Industrial Control Systems (ICS) moved from isolated environments to connected platforms to meet Industry 4.0 targets. The inherent connectivity in these ...services exposes such systems to increased cybersecurity risks. To protect ICSs against cyberattacks, intrusion detection systems (IDS) empowered by machine learning are used to detect abnormal behavior of the systems. Operational ICSs are not safe environments to research IDSs due to the possibility of catastrophic risks. Therefore, realistic ICS testbeds enable researchers to analyze and validate their IDSs in a controlled environment. Although various ICS testbeds have been developed, researchers’ access to a low-cost, extendable, and customizable testbed that can accurately simulate ICSs and suits security research is still an important issue.
In this paper, we present ICSSIM, a framework for building customized virtual ICS security testbeds in which various cyber threats and network attacks can be effectively and efficiently investigated. This framework contains base classes to simulate control system components and communications. Simulated components are deployable on actual hardware such as Raspberry Pis, containerized environments like Docker, and simulation environments such as GNS-3. ICSSIM also offers physical process modeling using software and hardware in the loop simulation. This framework reduces the time for developing ICS components and aims to produce extendable, versatile, reproducible, low-cost, and comprehensive ICS testbeds with realistic details and high fidelity. We demonstrate ICSSIM by creating a testbed and validating its functionality by showing how different cyberattacks can be applied.
•Framework for building customized industrial control system testbeds.•Extendable and reproducible testbed equipped with various cyber attacks.•Using Docker container technology, which provides realistic network emulation.•Open-Source Framework for examination of DDoS, Scan, Replay, Injection and MitM attack.
This article is concerned with the problem of the <inline-formula> <tex-math notation="LaTeX">H_{\infty } </tex-math></inline-formula> output feedback control for a class of event-triggered networked ...systems subject to multiple cyber attacks. Two dynamic event-triggered generators are equipped at sensor and observer sides, respectively, to lower the frequency of unnecessary data transmission. The sensor-to-observer (STO) channel and observer-to-controller (OTC) channel are subject to deception attacks and Denial-of-Service (DoS) attacks, respectively. The aim of the addressed problem is to design an output feedback controller, with the consideration of the effects of dynamic event-triggered schemes (DETSs) and multiple cyber attacks. Sufficient condition is derived, which can guarantee that the resulted closed-loop system is asymptotically mean-square stable (AMSS) with a prescribed <inline-formula> <tex-math notation="LaTeX">H_{\infty } </tex-math></inline-formula> performance. Moreover, we provide the desired output feedback controller design method. Finally, the effectiveness of the proposed method is demonstrated by an example.
This paper investigates the controller design problem of networked control systems subject to cyber attacks. A hybrid-triggering communication strategy is employed to save the limited communication ...resources. State measurements are transmitted over a communication network and may be corrupted by cyber attacks. The aim of this paper is to design a controller for a new closed-loop system model with consideration of randomly occurring cyber attacks and the hybrid-triggering scheme. A stability criterion is obtained for the system stabilization by employing Lyapunov stability theory and stochastic analysis techniques. Moreover, the desired controller gain is derived by resorting to some matrix inequalities. Finally, a numerical example is exploited to demonstrate the usefulness of the proposed scheme.
Cyber-physical systems (CPSs) are increasingly threatened by stealthy false data injection (SFDI) attacks, which compromise system integrity by manipulating control signals and introducing false ...sensor data. These attacks are particularly challenging due to their diversity and often indistinguishable nature. In response to this issue, our work uncovers the fundamental causes behind SFDI attacks in linear time-invariant (LTI) systems and elucidates the principles enabling their stealth. We present a novel virtual extended system framework designed to eliminate strictly stealthy attacks within the entire CPS. Utilizing deep reinforcement learning (DRL) methodologies, we pioneer the use of detection results for real-time SFDI attack classification. Through numerical simulations, we validate our proposed method's effectiveness, demonstrating a classification accuracy of no less than 95%. Notably, even in scenarios where attackers manage to breach the framework partially, our method continues to provide a reliable success rate in SFDI attack detection and classification, showcasing its robustness and efficacy. Note to Practitioners -Cyber-physical systems (CPSs), a critical component of modern industries, are becoming increasingly susceptible to stealthy false data injection (SFDI) attacks. These attacks compromise system integrity by subtly manipulating control signals and feeding false sensor data, making them challenging to detect. Our research presents an innovative framework that uses deep reinforcement learning techniques to detect and classify these elusive attacks, achieving a classification accuracy of over 95%. The information on SFDI attack categories, ascertained by this method, lays the groundwork for the development of subsequent defence strategies. For professionals working in sectors reliant on CPSs, such as manufacturing, healthcare, and transportation, this framework offers a promising tool to enhance system security. Even in scenarios where the system has been partially compromised, our method continues to provide reliable detection and classification, underscoring its robustness and practical utility. The system remains effective despite full breach attempts on specific attack types, ensuring resilience against a broad range of SFDI attacks. In conclusion, our research offers a substantial advancement in protecting CPSs against cyber threats.
Over the last decade, the number of cyber attacks targeting power systems and causing physical and economic damages has increased rapidly. Among them, false data injection attacks (FDIAs) are a class ...of cyber‐attacks against power grid monitoring systems. Adversaries can successfully perform FDIAs to manipulate the power system state estimation (SE) by compromising sensors or modifying system data. SE is an essential process performed by the energy management system towards estimating unknown state variables based on system redundant measurements and network topology. SE routines include bad data detection algorithms to eliminate errors from the acquired measurements, e.g. in case of sensor failures. FDIAs can bypass BDD modules to inject malicious data vectors into a subset of measurements without being detected, and thus manipulate the results of the SE process. To overcome the limitations of traditional residual‐based BDD approaches, data‐driven solutions based on machine learning algorithms have been widely adopted for detecting malicious manipulation of sensor data due to their fast execution times and accurate results. This study provides a comprehensive review of the most up‐to‐date machine learning methods for detecting FDIAs against power system SE algorithms.
As distributed control layer makes dc microgrids vulnerable toward cyber attacks, the identification and mitigation of attacked agent(s) becomes even more challenging with heterogeneity between each ...source based on factors, such as capacity, reliability, and generation cost. This letter proposes a novel resilient methodology, which involves detection using adaptive discord element and immediate mitigation via an event-driven approach. The proposed approach successfully mitigates cyber attacks under experimental conditions.
This paper is concerned with the distributed filtering issue under the Cauchy-kernel-based maximum correntropy for large-scale systems subject to randomly occurring cyber-attacks in non-Gaussian ...environments. The considered cyber-attacks are hybrid and consist of both denial-of-service attacks and deception attacks. The weighted Cauchy kernel-based maximum correntropy criterion instead of the traditional minimum variance is put forward to evaluate the filtering performance against non-Gaussian noises as well as cyber-attacks. Based on the matrix decomposition and the fixed-point iterative update rules, the desired filter gain related with a set of Riccati-type equations is obtained to achieve the optimal filtering performance. Then, an improved version only dependent on the local information and neighboring one-step prediction is developed to realize the distributed implementation. Furthermore, the convergence of the developed fixed-point iterative algorithm is addressed via the famous Banach fixed-point theorem. Finally, a standard IEEE 39-bus power system is utilized to show the merit of the proposed distributed filtering algorithm in the presence of cyber-attacks and non-Gaussian noises.
By wielding memory event-triggered scheme (METS), this paper explores the issue of finite-time fault-tolerant control strategy for a sort of half-car active suspension system, which comprises ...actuator failures and cyber-attacks. Primarily, a full-order state observer is modeled to estimate the immeasurable states of the system. Based upon this observer design, a faulttolerant controller is well-established to confront the partial loss and to adopt the actuator fault inevitably. Subsequently, a proper METS is proffered to mitigate the frequent packet transmission in the network channel. In contrary with the conventional eventtriggered scheme (ETS), the prescribed METS can produce some newest triggering events by utilizing the current released packets. Thereby, the event generator can make more precise determinations, resulting in an improved control performance. Notably, the cyber-attack phenomenon is described by the Bernoulli distributed stochastic variable. By engaging Lyapunov function and integral inequality technique, sufficient condition in the structure of linear matrix inequality (LMI) assure the asymptotic mean-square finite-time boundedness (AMFTB) of the half-car active suspension model with a prescribed H∞ performance attenuation. Moreover, the controller and observer gain matrices are stipulated from the attained LMI conditions. Ultimately, the capability of the proposed control design is demonstrated through a half-car active suspension model.
This paper is concerned with the design of data-driven sensor injection attack for cyber-physical systems (CPSs) under channel constraints, where the attacker can only access a part of the sensor ...channels and the accessible channels switch over time. To enhance the attack's effectiveness while maintaining its stealthiness, the design problem is formulated as a constraint-type L2-gain optimization problem. Then, by optimizing the attack-direction matrix using the data-driven parametrization method, an attack policy with channel constraints is proposed. Specifically, the necessary and sufficient design conditions are established in terms of the attack stealthiness. Furthermore, the optimized attack stealthiness index and attack effectiveness index under channel constrains are obtained, and it is theoretically proven that the attack performance is reduced due to the passive channel switching. The effectiveness of the data-driven attack policy is illustrated by the IEEE 6 bus power system.
PDF
