A watermark-based defense strategy to improve the detection rate of false-data-injection attacks

Abstract

A novel proactive method to defend against false-data-injection (FDI) attacks is proposed in this paper. FDI attacks have a high degree of concealment, which can seriously threaten the security of cyber-physical systems (CPS). Therefore, a new watermark-based encryption defense strategy is proposed to improve the attack detection rate. Moreover, the proposed watermark-based approach cannot affect the system performance in the absence of attacks, and the ${\chi }^2$ abnormal detector is utilized to detect attacks. Furthermore, FDI attacks are be divided into two different types in this work, that is, additive FDI (A-FDI) attacks and multiplicative FDI (M-FDI) attacks. In addition, three different attack detection scenarios are discussed, and the detection capabilities of the proposed defense method are analyzed. Finally, numerical simulation results are given to illustrate the effectiveness of the main results.

Introduction

Cyber-Physical Systems (CPS) are complex systems, which use computing, control, and communication to connect the network to the physical environment.^1–3 CPS can improve the ability of traditional engineering systems, and it can be applied to different environments, such as intelligent transportation systems, ⁴ water supply systems, ⁵ intelligent grids, ⁶ etc. On the other hand, the network security of CPS is also facing great challenges. So far, many malicious attacks against CPS have been reported, such as the Stuxnet virus targeting Iranian nuclear facilities in 2010, and an upgraded version targeting Iranian nuclear facilities in 2018. ⁷ The Ukrainian power grid was attacked in 2015, causing a massive blackout. ⁸ If CPS is attacked, it may cause great loss to the economy, society and security. Therefore, researchers have paid extensive attention to the attack detection.

To ensure the safety of CPS, the defense technology is essential. For example, the authors in ⁹ proposed three security vulnerabilities, that is, privacy, integrity, and effectiveness, which are considered to be important for protecting the information. According to, ¹⁰ the attacker’s ability depends on the knowledge of the system model, disruptive resources, and disclosure resources. The FDI attack studied in this paper belongs to deception attacks, such as the false data injection attack (FDIA) mentioned in ¹¹ and dynamic false data injection attack (DFDIA) mentioned in. ¹² which are highly concealed and destructive.^13–16 To ensure that the bad value detection of the detector is bypassed and the control performance of the system is affected, attackers can use information transmission network vulnerabilities to inject false data carefully into sensors and/or actuators. Through careful design, an attacker can destroy the system’s control performance and deceive the abnormal detector. Thus, FDI attacks have a greater threat to the security of CPS.

The approaches to detect malicious attacks can be divided into passive and active detection methods. ¹⁷ As we all know, most anomaly detection algorithms are passive, such as the residual-based ${\chi }^2$ detector. The optimal linear cyber-attack was designed in, ¹⁸ in which attacks can maximize the estimation error covariance and remain stealthy when the ${\chi }^2$ detector is employed by the system. Different from the passive detection method, the proactive detection approach changes the parameters of the system and then verifies whether the system changes as expected, which can prevent the adversary from knowing these parameters to resist attacks. For example, a watermark was added to the control signal in. ¹⁹ In, ²⁰ the random noise with known distribution was served as the watermark in the control signal. In, ²¹ the authors proposed a periodic watermarking strategy to reduce control overhead. In, ²² a robust physical watermarking and detection algorithm were proposed. However, these results are methods to optimize the detection probability by reducing the control performance. Thus, watermark-based approach can be used to resist man-in-the-middle attacks, and the original data was restored by removing the watermark in. ²³ In addition, the authors in ²⁴ considered the idea of watermarking and moving target defense, which combine the watermark with a non-linear static auxiliary function to resist covert FDI attacks.

In this paper, a novel proactive watermark-based defense strategy is proposed to improve the detection rate of false-data-injection attacks. The contributions of this paper are summarized as follows:

1. A new watermark-based encryption strategy is designed, which can guarantee that the system performance cannot be affected by the watermarks in the absence of attacks. Different from the existing static watermarking methods, dynamic watermarking implements encryption through time-varying random parameters, which not only avoids the long-term monitoring and cracking risk, but also ensures the system performance without any attack.

2. FDI attacks are divided into two different types, namely, additive and multiplicative FDI attacks. Moreover, three different attack detection situations are analyzed and the proactive attack detection method proposed in this work can greatly improve the detection rate.

The rest of the paper is given as follows. Problem formulation is introduced in Section 2 and the main results are provided in Section 3. Attack detection in different scenarios is given in Section 4 and the simulation results are shown in Section 5. Finally, some conclusions are given in Section 6.

Problem formulation

In this section, the system block diagram under a watermarking encryption proactive defense strategy is provided, which is shown in Figure 1. The system uses dynamic watermarking encryption strategy to improve the detection capability of FDI attacks. It is composed of plant, sensor, encoder, decoder, estimator, detector, and attacker modules.

Figure 1.

The system block diagram under the watermarking encryption defense strategy.

After the sensor collects the physical state data $y_k$ of the controlled object, the encoder encrypts the data ${\hat{y}}_k$ using time-varying parameters ( $a_k$ is a random scaling factor, $b_k$ is a random noise) to interfere with the attacker’s cracking of the transmitted data. The attacker can change the encrypted data to ${\tilde{y}}_k^{\prime }$ through a man-in-the-middle attack, and the decoder restores the data based on the shared key. If the data is changed, the decrypted $y_k^{\prime }$ will deviate from the true value. An estimator (such as Kalman filter) computes a system state estimate from decrypted data, and a detector identifies anomalies by analyzing residuals (such as ${\chi }^2$ detector) and triggers an alarm. The system greatly improves the attack detection rate through the unpredictability of dynamic watermarking, and at the same time ensures that the system performance is not affected when there is no attack, and provides an efficient security protection mechanism for the information physical system.

System model

Consider the following linear time-invariant (LTI) system:

$$x_{k+1}=A{x}_k+w_k$$

(1)

$$y_k=C{x}_k+v_k$$

(2)

where $k\in \mathbb{N}$ is the time index, $x_k\in {\mathbb{R}}^n$ is the state of the system, and $y_k\in {\mathbb{R}}^m$ is the measurement of sensors. $A$ and $C$ are system matrix and measurement matrix with appropriate dimensions, respectively. $w_k\in {\mathbb{R}}^n$ is the process noise, and $v_k\in {\mathbb{R}}^m$ is the measurement noise. It is assumed that the system noises are zero-mean Gaussian white noise with covariance $Q\ge 0$ and $R\ge 0$ , that is, $w_k~\mathcal{N}(0,Q)$ and $v_k~\mathcal{N}(0,R)$ . Where $R$ is the diagonal covariance matrix, indicating that the measurement noise of each sensor is independent. $w_k$ and $v_k$ are independent of each other. Moreover, the initial state $x_0$ is a Gaussian random variable with covariance ${\Sigma }_0$ , that is, $x_0~\mathcal{N}\left({\overline{x}}_0,{\Sigma }_0\right)$ . The pair $(A,C)$ is detectable and $(A,\sqrt{Q})$ is stabilizable.

Kalman filter

For the LTI system (1)-(2), Kalman filter is employed to estimate the state $x_k$ . The recursive formula of the Kalman filter are given as follows:

$$\begin{array}{c}{\hat{x}}_k^{-}=A{\hat{x}}_{k-1}\hfill \\ P_k^{-}=A{P}_{k-1}{A}^T+Q\hfill \\ K_k=P_k^{-}{C}^T{({\mathrm{CP}}_k^{-}{C}^T+R)}^{-1}\hfill \\ {\hat{x}}_k={\hat{x}}_k^{-}+K_k(y_k-C{\hat{x}}_k^{-})\hfill \\ P_k=(I-K_{k}C)P_k^{-}\hfill \end{array}$$

(3)

where ${\hat{x}}_k^{-}$ is the priori state estimate, and ${\hat{x}}_k$ is the posterior state estimate. $P_k^{-}$ is the priori estimation covariance, and $P_k$ is the posterior estimate covariance. $K_k$ is the Kalman filter gain. The recursion starts from ${\hat{x}}_0^{-}=0$ and $P_0^{-}={\Sigma }_0\ge 0$ .

It should be pointed out that if the system is detectable, the Kalman filter gain and error covariance will converge to a stable value in a short period from the any initial conditions. ²⁵ Therefore, it is assumed that the filter starts to operate from a steady-state, and the steady-state value of the priori error covariance is defined by

$$\overline{P}\stackrel{\mathrm{\Delta }}{=}\underset{k\to \infty }{\lim }{P}_k^{-}$$

(4)

where $\overline{P}$ is the unique solution of $h°\tilde{g}=X$ , where

$$h\left(X\right)\stackrel{\mathrm{\Delta }}{=}\mathrm{AX}{A}^T+Q$$

(5)

$$\tilde{g}\left(X\right)\stackrel{\mathrm{\Delta }}{=}X-X{C}^T{(\mathrm{CX}{C}^T+R)}^{-1}\mathrm{CX}.$$

(6)

For simplicity, the Kalman filter is assumed to start from the steady state, that is, ${\Sigma }_0=\overline{P}$ . Thus, the fixed gain of steady state Kalman filter can be calculated by

$$K\stackrel{\mathrm{\Delta }}{=}\overline{P}{C}^T{(C\overline{P}{C}^T+R)}^{-1}.$$

(7)

${\mathit{\chi }}^2$ detector

The ${\chi }^2$ detector is a residue-based detector,^18,26 which is often used to detect whether the system is abnormal. Firstly, Kalman filter residual is given as follows:

$$r_k\stackrel{\mathrm{\Delta }}{=}{y}_k-C{\hat{x}}_k^{-}.$$

(8)

When the system is attack-free, the residual $r_k$ satisfies $r_k\in \mathcal{N}(0,\mathcal{P})$ , where $\mathcal{P}=\mathrm{CP}{C}^T+R$ . Then, according to the statistical characteristics of the system residual, $g_k$ can be defined as follows

$$g_k=\sum _{i=k-+1}^k{r}_i^T{\mathcal{P}}^{-1}{r}_i\underset{H_1}{\overset{H_0}{\lessgtr }}\beta$$

(9)

where $g_k\in {\mathbb{R}}_{+}$ is the ${\chi }^2$ value with $m\mathcal{J}$ degrees of freedom, and $\mathcal{J}$ is the window size of detection. $\beta$ is the detection threshold, which is determined by the confidence coefficient, denoted as $P_{\beta }$ . The false alarm rate $\alpha$ can be expressed as $1-P_{\beta }$ . The hypothesis $H_0$ means that the system is normal (attack-free), and the opposite is true for hypothesis $H_1$ . Thus, we can obtain that

$$H_0:\{\begin{array}{c}\mathbb{E}[r_k]=0_{p\times 1}\hfill \\ \multicolumn{1}{c}{\mathbb{E}[r_k{r}_k^T]=\mathcal{P}}\end{array},H_1:\{\begin{array}{c}\mathbb{E}[r_k]\ne 0_{p\times 1}\hfill \\ \multicolumn{1}{c}{\mathbb{E}[r_k{r}_k^T]\ne \mathcal{P}}\end{array}.$$

(10)

Attacks model

It is assumed that an attacker can intercept the transmission data. Two different attacks will be introduced with the concept of linear man-in-the-middle (MITM) attack in this paper. In, ¹⁸ the linear MITM attack is designed as follows

$${\tilde{y}}_k^{\prime }={\mathrm{\Gamma }}_k{\tilde{y}}_k+{\mu }_k$$

(11)

where ${\mathrm{\Gamma }}_k$ and ${\mu }_k$ are varying-time parameters determined by the attacker.

In this paper, we will re-consider the MITM attack carefully. It can be seen from (11) that when ${\mathrm{\Gamma }}_k=I$ and ${\mu }_k=y_k^a$ , the linear MITM attack becomes the FDI attack, which is called an additive FDI (A-FDI) attack in this paper. The A-FDI attack can be modeled as follows

$$y_k^{\prime }={\tilde{y}}_k+y_k^a$$

(12)

where $y_k^a$ is the attack vector launched by an adversary. As a result, one can obtain that

$$y_k^{\prime }=C{x}_k+v_k+a_k^{-1}{y}_k^a$$

(13)

where $a_k$ is a time-varying parameter given by the defender and will be discussed later.

If the residual $r_k^a=y_k^{\prime }-C{\hat{x}}_k^{-}$ has the same distribution as the residual $r_k=y_k-C{\hat{x}}_k^{-}$ , then ${\chi }^2$ detector (9) cannot detect malicious attacks; otherwise, attacks can be detected. In other words, if the detection rate is less than or equal to the false alarm rate $\alpha$ , attacks cannot be detected. ²⁰

On the other hand, as studied in, ¹⁸ the MITM attack is optimal with ${\mathrm{\Gamma }}_k=-I$ and ${\mu }_k=0$ , which may cause the largest state estimation error without being detected by the defender. In this paper, this kind of attack is defined as a multiplicative FDI (M-FDI) attack. An M-FDI attack can be modeled as follows:

$$y_k^{\prime }={\mathrm{\Gamma }}_k{y}_k$$

(14)

In this paper, the attack matrix ${\mathrm{\Gamma }}_k$ is selected to be ${\mathrm{\Gamma }}_k=-I$ according to the result in. ¹⁸ Then, we can derive that

$$y_k^{\prime }=-(C{x}_k+v_k).$$

(15)

• Remark 1. It is noted that the linear MITM attack is divided into A-FDI and M-FDI attacks in this work. We will show that the proposed proactive defense strategy will have different effects on different types of attacks.

Main results

In this section, the watermarking-based defense strategy is introduced, and the defense algorithm is given. Furthermore, the influence of the designed encryption defense strategy on the system performance is analyzed as well.

Watermarking-based active defense strategy

The watermarking encryption module and decryption module are added to the cyber-physical system, which can be utilized to detect malicious attacks by the system. When sending data, the transmitted data is encrypted into the following form:

$${\tilde{y}}_k=a_k{y}_k+b_k$$

(16)

where ${\tilde{y}}_k$ represents the encrypted data at the sending end. It is noted that the parameters $a_k$ and $b_k$ are served as watermarks in this paper, and $a_k\in (0,1]$ is designed as a random number. In addition, both $a_k$ and $b_k$ are given by pseudo-random number generators, which can use the same seed number in the sender and the receiver to generate the same random number.^27,28 It should be pointed out that the seed of $b_k$ is designed to be different from $a_k$ and $b_k~\mathcal{N}(0,{\Sigma }_b)$ . Moreover, $b_k$ is independent of $r_k$ .

• Remark 2. To ensure that the designed watermarks do not affect the system’s performance, it is necessary to keep the watermarks on both sending and receiving sides consistently. The time-varying sequences $a_k$ and $b_k$ can be obtained by using an encrypted secure pseudo-random number generators. It is worth noting that only the defender knows the seeds of the pseudo-random number generator.

• Remark 3. If the watermarks are designed to be constants, that is, $a_k\equiv a$ and $b_k\equiv b$ , then an attacker can estimate watermarks to obtain $y_k$ by monitoring and intercepting the data transmitted in the wireless network for a long time. In this way, an attacker who fully understands the watermarks can bypass the security module. The watermarking-based encryption defense is completely ineffective. Therefore, the watermarks are chosen as time-varying variables instead of constants in this paper.

Note that the decoder will receive ${\tilde{y}}_k$ in the absence of attacks. Then, one can obtain that

$$y_k^{\prime }={a_k}^{-1}({\tilde{y}}_k-b_k)\equiv y_k$$

(17)

where $y_k^{\prime }$ represents the data after reverse calculation. As a result, the encryption algorithm will not affect the system state estimation without attacks.

Based on the dynamic parameter design of the pseudo-random number generator, the attacker cannot crack the watermark through traditional statistical analysis, and the synchronous decryption mechanism of the receiver ensures the accuracy of the state estimation without attack.

Performance analysis when the system is attacked

When the A-FDI attack is considered, then ${\tilde{y}}_k^{\prime }$ can be represented as follows:

$${\tilde{y}}_k^{\prime }={\tilde{y}}_k+y_k^a=a_k{y}_k+b_k+y_k^a.$$

(18)

After the receiving end receives the attacked vector ${\tilde{y}}_k^{\prime }$ , it can calculate $y_k^{\prime }$ as follows:

$$y_k^{\prime }=a_k^{-1}({\tilde{y}}_k^{\prime }-b_k)=y_k+a_k^{-1}{y}_k^a.$$

(19)

As a result, the residual of Kalman filter can be computed as follows:

$$\begin{array}{c}\multicolumn{1}{c}{r_k^a=y_k^{\prime }-C{\hat{x}}_k^{-}=y_k-C{\hat{x}}_k^{-}+a_k^{-1}{y}_k^a}\\ \multicolumn{1}{c}{=r_k+{a_k}^{-1}{y}_k^a.}\end{array}$$

(20)

• Theorem 1. For the system (1)–(2), when the watermarks defined in (16) are considered and $a_k\to 0$ , the detection rate of the detector (9) can be improved, that is,

$$\mathbf{Pr}\{g_k^A\ge \beta \}>>\mathbf{Pr}\{g_k\ge \beta \}$$

(21)

at time step $k$ , where $g_k^A$ is the ${\chi }^2$ value after being attacked by a malicious A-FDI attack (12).

• Proof. At time step $k$ , when the system is attack-free, the expectation of $g_k$ can be calculated by

$$\mathbb{E}[g_k]=\mathbb{E}[r_k^T{\mathcal{P}}^{-1}{r}_k]=m.$$

(22)

When the system is attacked by an A-FDI attack at time step $k$ , then $\mathbb{E}[g_k^A]$ can be calculated by

$$\begin{array}{c}\multicolumn{1}{c}{\mathbb{E}[g_k^A]=\mathbb{E}[{\left(r_k^a\right)}^T{\mathcal{P}}^{-1}\left(r_k^a\right)]}\\ \multicolumn{1}{c}{=\mathbb{E}[{(r_k+a_k^{-1}{y}_k^a)}^T{\mathcal{P}}^{-1}(r_k+a_k^{-1}{y}_k^a)]}\\ =\mathbb{E}[r_k^T{\mathcal{P}}^{-1}{r}_k+{\left(a_k^{-1}{y}_k^a\right)}^T{\mathcal{P}}^{-1}\left(a_k^{-1}{y}_k^a\right)\hfill \\ \multicolumn{1}{c}{+r_k^T{\mathcal{P}}^{-1}\left(a_k^{-1}{y}_k^a\right)+{\left(a_k^{-1}{y}_k^a\right)}^T{\mathcal{P}}^{-1}{r}_k]}\\ =m+\mathbb{E}[{\left(a_k^{-1}{y}_k^a\right)}^T{\mathcal{P}}^{-1}\left(a_k^{-1}{y}_k^a\right)\hfill \\ \multicolumn{1}{c}{+r_k^T{\mathcal{P}}^{-1}\left(a_k^{-1}{y}_k^a\right)+{\left(a_k^{-1}{y}_k^a\right)}^T{\mathcal{P}}^{-1}{r}_k]}\\ =m+\mathbb{E}[{(a_k^{-1}{y}_k^a+2r_k)}^T{\mathcal{P}}^{-1}\left(a_k^{-1}{y}_k^a\right)].\hfill \end{array}$$

(23)

When the parameter $a_k$ is selected such that $a_k\to 0$ , then one can derive that $\mathbb{E}[{(a_k^{-1}{y}_k^a+2r_k)}^T{\mathcal{P}}^{-1}\left(a_k^{-1}{y}_k^a\right)]>>0$ . Consequently, one can obtain that $\mathbb{E}[g_k^A]>>\mathbb{E}[g_k]=m$ , which implies $\mathbf{Pr}\{g_k^M\ge \beta \}>>\mathbf{Pr}\{g_k\ge \beta \}$ when $a_k\to 0$ . ▪

When the M-FDI attack is considered, then ${\tilde{y}}_k^{\prime }$ can be computed by

$${\tilde{y}}_k^{\prime }=-{\tilde{y}}_k=-(a_k{y}_k+b_k).$$

(24)

After the receiving end receives ${\tilde{y}}_k^{\prime }$ , $y_k^{\prime }$ can be obtained

$$\begin{array}{c}\multicolumn{1}{c}{y_k^{\prime }=\frac{{\tilde{y}}_k^{\prime }-b_k}{a_k}=\frac{-(a_k{y}_k+b_k)-b_k}{a_k}}\\ \multicolumn{1}{c}{=-y_k-2\frac{b_k}{a_k}.}\end{array}$$

(25)

As a result, the residual of Kalman filter $r_k$ can be derived as follows

$$r_k^a=y_k^{\prime }-C{\hat{x}}_k^{-}=r_k-2(y_k+\frac{b_k}{a_k}).$$

(26)

Theorem 2. For the system (1)-(2), when the watermarks defined in (16) is considered and $b_k>>a_k$ , the detection rate of the detector (9) can be improved, that is,

$$\mathbf{Pr}\{g_k^M\ge \beta \}>>\mathbf{Pr}\{g_k\ge \beta \}$$

(27)

at time step $k$ , where $g_k^M$ is the ${\chi }^2$ value after being attacked by an M-FDI attack (15).

• Proof. When the system is attacked by an M-FDI attack (15), then one can obtain that

$$\begin{array}{c}\mathbb{E}[g_k^M]=\mathbb{E}[{\left(r_k^a\right)}^{T}p\left(r_k^a\right)]\hfill \\ =m+2\mathbb{E}[{(y_k+b_k{a}_k^{-1}-r_k)}^T\times p^{-1}(y_k+b_k{a}_k^{-1}))].\hfill \end{array}$$

(28)

When the parameters $a_k$ and $b_k$ satisfy $a_k<<b_k$ , then the value of $b_k/a_k$ is very large. Moreover, $b_k/a_k\to \infty$ if $a_k\to 0$ and $\mathbb{E}[g_k^M]>>\mathbb{E}[g_k]=m$ , which implies $\mathbf{Pr}\{g_k^M\ge \beta \}>>\mathbf{Pr}\{g_k\ge \beta \}$ when $b_k>>a_k$ .▪

The estimated error covariances of Kalman filter under both A-FDI and M-FDI attacks will be given in the following theorems, and the impact of both types of attacks on system performance is analyzed as well.

Theorem 3. Consider the system in the presence of A-FDI attacks. The estimated error covariance of the state can be calculated by

$$\begin{array}{c}\multicolumn{1}{c}{P_k=A{P}_{k-1}{A}^T+Q+K(C\overline{P}{C}^T+R+{\mathcal{L}}_k^A)K^T}\\ \multicolumn{1}{c}{-\overline{P}{C}^T{K}^T-\mathrm{KC}\overline{P}}\end{array}$$

(29)

where ${\mathcal{L}}_k^A=\mathbb{E}[a_k^{-2}{y}_k^a{\left(y_k^a\right)}^T]$ .

• Proof. Combining the system (1)–(2), Kalman filter (3), and residual (8), the error covariance of the system under A-FDI attacks can be calculated by

$$\begin{array}{c}\multicolumn{1}{c}{P_k=\mathbb{E}[(x_k-{\hat{x}}_k){(x_k-{\hat{x}}_k)}^T]}\\ =\mathbb{E}\{[(x_k-{\hat{x}}_k^{-})-{\mathrm{Kr}}_k^a]{[(x_k-{\hat{x}}_k^{-})-{\mathrm{Kr}}_k^a]}^T\}\hfill \\ =\mathbb{E}[(x_k-{\hat{x}}_k^{-}){(x_k-{\hat{x}}_k^{-})}^T]+\mathbb{E}[K\left(r_k^a\right){\left(r_k^a\right)}^T{K}^T]\hfill \\ -\mathbb{E}[(x_k-{\hat{x}}_k^{-}){\left(r_k^a\right)}^T{K}^T]-\mathbb{E}[K\left(r_k^a\right){(x_k-{\hat{x}}_k^{-})}^T].\hfill \end{array}$$

(30)

For the first term of (30), we can obtain that

$$\begin{array}{c}\mathbb{E}[(x_k-{\hat{x}}_k^{-}){(x_k-{\hat{x}}_k^{-})}^T]\hfill \\ \multicolumn{1}{c}{=\mathbb{E}[(A{x}_{k-1}+w_{k-1}-A{\hat{x}}_k^{-}){(A{x}_{k-1}+w_{k-1}-A{\hat{x}}_k^{-})}^T]}\\ \multicolumn{1}{c}{=A\mathbb{E}[(x_{k-1}-{\hat{x}}_{k-1}){(x_{k-1}-{\hat{x}}_{k-1})}^T]A^T+\mathbb{E}[w_{k-1}{w}_{k-1}^T]}\\ \multicolumn{1}{c}{=A{P}_{k-1}{A}^T+Q}\end{array}$$

(31)

For the second term of (30), $r_k^a=r_k+a_k^{-1}{y}_k^a$ . Moreover, $r_k$ and $y_k^a$ are independent of each other. As a result, one can obtain $\mathrm{Cov}(r_k,y_k^a)=0$ and

$$\begin{array}{c}\mathbb{E}[K\left(r_k^a\right){\left(r_k^a\right)}^T{K}^T]\hfill \\ \multicolumn{1}{c}{=K\mathbb{E}\left[(r_k+a_k^{-1}{y}_k^a){(r_k+a_k^{-1}{y}_k^a)}^T\right]K^T}\\ \multicolumn{1}{c}{=K\mathbb{E}[r_k{r}_k^T+\left(a_k^{-1}{y}_k^a\right){\left(a_k^{-1}{y}_k^a\right)}^T]K^T}\\ \multicolumn{1}{c}{=K(\mathcal{P}+{\mathcal{L}}_k^A)K^T}\\ \multicolumn{1}{c}{=K(C\overline{P}{C}^T+R+{\mathcal{L}}_k^A)K^T.}\end{array}$$

(32)

For the third term of (30), the relationship between $x_k-{\hat{x}}_k^{-}$ and $r_k^a$ needs to be considered. Combined with the recursion of formula (3), the state estimation error $x_k-{\hat{x}}_k^{-}$ can be decomposed into the cumulative effect of initial error and process noise. Based on the system dynamics equations and prediction estimates, the error can be recursively expanded as:

$$x_k-{\hat{x}}_k^{-}=A(x_{k-1}-{\hat{x}}_{k-1})+{\omega }_{k-1}$$

(33)

Further recursive expansion to the initial moment, get:

$$\begin{array}{c}\multicolumn{1}{c}{x_k-{\hat{x}}_k^{-}=A^k(x_0-{\hat{x}}_0^{-})+\sum _{i=0}^{k-1}{A}^i{\omega }_{k-1-i}}\\ \multicolumn{1}{c}{-\sum _{i=0}^{k-1}{A}^{i+1}K{r}_{k-i-1}}\end{array}$$

(34)

$U_k=A^k(x_0-{\hat{x}}_0^{-})+\sum _{i=0}^{k-1}{A}^i{w}_{k-1-i}$ , represents the linear combination of initial state estimation error and process noise. Then the error can be expressed as:

$$x_k-{\hat{x}}_k^{-}=U_k-\sum _{i=0}^{k-1}{A}^{i+1}K{r}_{k-i-1}$$

(35)

According to the definition of $r_k^a$ , we can derive

$$\begin{array}{c}{r}_k^a=y_k+a_k^{-1}{y}_k^a-C{\hat{x}}_k^{-}\hfill \\ =C(x_k-{\hat{x}}_k^{-})+v_k+V_k^1\hfill \\ =C[A{x}_{k-1}+w_{k-1}-A({\hat{x}}_{k-1}^{-}+K{z}_{k-1})]+V_k^1\hfill \\ =\mathrm{CA}(I-\mathrm{KC})(x_{k-1}-{\hat{x}}_{k-1}^{-})+C{w}_{k-1}+V_k\hfill \\ =C[A(I-\mathrm{KC}){]}^k(x_0-{\hat{x}}_0^{-})+V_k\hfill \\ \multicolumn{1}{c}{+\sum _{i=0}^{k-1}C[A(I-\mathrm{KC}){]}^i{w}_{k-i-1}}\end{array}$$

(36)

where $V_k^1=v_k+a_k^{-1}{y}_k^a$ and $V_k=V_k^1-\mathrm{CAK}{v}_{k-1}$ . Note that $\mathrm{Cov}(r_k,r_k^a)=0$ and $\mathrm{Cov}(U_k,V_k)=0$ . Thus, the third term of (30) can be computed by

$$\begin{array}{c}\mathbb{E}[(x_k-{\hat{x}}_k^{-}){\left(r_k^a\right)}^T{K}^T]\hfill \\ \multicolumn{1}{c}{=\mathbb{E}[\{A^k(x_0-{\hat{x}}_0^{-})+\sum _{i=0}^{k-1}{A}^i{w}_{k-1-i}\}}\\ \multicolumn{1}{c}{\times \{C{[A(I-\mathrm{KC})]}^k(x_0-{\hat{x}}_0^{-})}\\ \multicolumn{1}{c}{+\sum _{i=0}^{k-1}C{[A(I-\mathrm{KC})]}^i{w}_{k-1-i}{\}}^T]K^T}\\ \multicolumn{1}{c}{=\{A^k\mathbb{E}\left[(x_0-{\hat{x}}_0^{-}){(x_0-{\hat{x}}_0^{-})}^T\right]{\left[{(I-\mathrm{KC})}^T{A}^T\right]}^k}\\ \multicolumn{1}{c}{+\sum _{i=0}^{k-1}{A}^i\mathbb{E}\left[w_{k-1-i}{w}_{k-1-i}^T\right]{\left[{(I-\mathrm{KC})}^T{A}^T\right]}^i\}{C}^T{K}^T}\\ \multicolumn{1}{c}{=\{A^k\overline{P}{\left[{(I-\mathrm{KC})}^T{A}^T\right]}^k}\\ \multicolumn{1}{c}{+\sum _{i=0}^{k-1}{A}^{i}Q{\left[{(I-\mathrm{KC})}^T{A}^T\right]}^i\}{C}^T{K}^T}\\ \multicolumn{1}{c}{=\overline{P}{C}^T{K}^T}\end{array}$$

(37)

where $\overline{P}={(h°\tilde{g})}^n\left(\overline{P}\right)$ is the unique solution of $h°\tilde{g}=X$ in the last equality, that is,

$$\begin{array}{l}\overline{P}={\left(h°\tilde{g}\right)}^n\left(\overline{P}\right)\\ ={\left[A\left(I-KC\right)\right]}^n\overline{P}{\left(A^T\right)}^n+\sum _{i=0}^{n-1}{\left[A\left(I-KC\right)\right]}^{i}Q{\left(A^T\right)}^i\\ =A^n\overline{P}{[{\left(I-KC\right)}^T{A}^T]}^n+\sum _{i=0}^{n-1}{A}^{i}Q{[{\left(I-KC\right)}^T{A}^T]}^i.\end{array}$$

Similarly, the fourth term of (30) can be derived as follows

$$\mathbb{E}[(x_k-{\hat{x}}_k^{-}){\left(r_k^a\right)}^T{K}^T]=\mathrm{KC}\overline{P}.$$

(38)

Substituting (31)–(32), (37) and (38) into (30) yields

$$\begin{array}{c}\multicolumn{1}{c}{P_k=A{P}_{k-1}{A}^T+Q+K(C\overline{P}{C}^T+R{+}_k^A)}\\ \multicolumn{1}{c}{K^T-\overline{P}{C}^T{K}^T-\mathrm{KC}\overline{P}.}\end{array}$$

(39)

which completes the proof.▪

• Theorem 4. Consider the system in the presence of M-FDI attacks. The estimated error covariance of the state can be calculated by

$$\begin{array}{c}\multicolumn{1}{c}{P_k=A{P}_{k-1}{A}^T+Q+K(C\overline{P}{C}^T+R+{\mathcal{L}}_k^M)K^T}\\ \multicolumn{1}{c}{-\overline{P}{C}^T{K}^T-\mathrm{KC}\overline{P}}\end{array}$$

(40)

where ${\mathcal{L}}_k^M=4\mathbb{E}[(y_k+b_k{a}_k^{-1}){(y_k+b_k{a}_k^{-1})}^T]$ .

• Proof. The proof is similar to the proof of Theorem 3 and is omitted here.▪

Attack detection in different scenarios

In the section, four different situations will be discussed. Note that it is assumed that the attacker already knows the structure of ${\tilde{y}}_k$ .

Both $a_k$ and $b_k$ are not available to an attacker

In this case, the attacker can guess the values of $a_k$ and $b_k$ . It is assumed that the guessed values of $a_k$ and $b_k$ are $a_k^{\mathrm{guess}}$ and $b_k^{\mathrm{guess}}$ , respectively. Then, it is assumed that the attacker wants to guess the real measurement of sensors. The guessed value of sensor measurement $y_k^{\mathrm{guess}}$ can be derived as

$$y_k^{\mathrm{guess}}=\frac{{\tilde{y}}_k-b_k^{\mathrm{guess}}}{a_k^{\mathrm{guess}}}.$$

(41)

Then, the MITM attack can be designed as

$$\begin{array}{c}\multicolumn{1}{c}{{\tilde{y}}_k^{\prime }=a_k^{\mathrm{guess}}({\mathrm{\Gamma }}_k{y}_k^{\mathrm{guess}}+{\mu }_k)+b_k^{\mathrm{guess}}}\\ \multicolumn{1}{c}{={\mathrm{\Gamma }}_k{\tilde{y}}_k+a_k^{\mathrm{guess}}{\mu }_k+(I-{\mathrm{\Gamma }}_k)b_k^{\mathrm{guess}}.}\end{array}$$

(42)

For the A-FDI attack, ${\mathrm{\Gamma }}_k=I$ and ${\mu }_k=y_k^a$ , we can derive that

$${\tilde{y}}_k^{\prime }={\tilde{y}}_k+a_k^{\mathrm{guess}}{y}_k^a.$$

(43)

Thus, one can get

$$y_k^{\prime }=\frac{{\tilde{y}}_k^{\prime }-b_k}{a_k}=y_k+\frac{a_k^{\mathrm{guess}}}{a_k}{y}_k^a$$

(44)

From (29), the estimated error covariance of the state can be calculated by

$$\begin{array}{c}\multicolumn{1}{c}{P_k=A{P}_{k-1}{A}^T+Q+K(C\overline{P}{C}^T+R+{\mathcal{L}}_k^A)K^T}\\ \multicolumn{1}{c}{-\overline{P}{C}^T{K}^T-\mathrm{KC}\overline{P}}\end{array}$$

(45)

where ${\mathcal{L}}_k^A=\mathbb{E}[{\left(a_k^{\mathrm{guess}}{a}_k\right)}^{-2}{y}_k^a{\left(y_k^a\right)}^T]$ .

Furthermore, one can obtain that

$$\mathbb{E}[g_k^A]=m+\mathbb{E}\left[{(\frac{a_k^{\mathrm{guess}}}{a_k}{y}_k^a+2r_k)}^T{\mathcal{P}}^{-1}\left(\frac{a_k^{\mathrm{guess}}}{a_k}{y}_k^a\right)\right].$$

In order to bypass the detector, the A-FDI attack should satisfy $\mathbb{E}[g_k^A]<\beta$ . Since the specific value of $a_k$ is not known and $a_k$ is selected to be small, the stealthy A-FDI attack is difficult to launch.

On the other hand, for the M-FDI attack, ${\mathrm{\Gamma }}_k=-I$ and ${\mu }_k=0$ , one can derive that

$${\tilde{y}}_k^{\prime }=-{\tilde{y}}_k+2b_k^{\mathrm{guess}}$$

(46)

and

$$y_k^{\prime }=\frac{{\tilde{y}}_k^{\prime }-b_k}{a_k}=-y_k+2\frac{b_k^{\mathrm{guess}}-b_k}{a_k}.$$

(47)

The estimation error covariance can be obtained similar to (40), where

$${\mathcal{L}}_k^M=2\mathbb{E}\left[(\frac{b_k^{\mathrm{guess}}-b_k}{a_k}-y_k){(\frac{b_k^{\mathrm{guess}}-b_k}{a_k}-y_k)}^T\right].$$

Furthermore, one can derive that

$$\mathbb{E}[g_k^M]=m+4\mathbb{E}[{({\mathcal{M}}_k+r_k)}^T{P}^{-1}\left({\mathcal{M}}_k\right)].$$

(48)

where ${\mathcal{M}}_k=-y_k+(b_k^{\mathrm{guess}}-b_k)a_k^{-1}$ . In order to bypass the detector, the M-FDI attack should satisfy $\mathbb{E}[g_k^M]<\beta$ . Since the specific value of $b_k$ is not known and $a_k$ is selected to be small, the stealthy M-FDI attack is difficult to launch.

• Corollary 1. Assume that the attacker only knows the structure of ${\tilde{y}}_k$ and does not know the specific values of $a_k$ and $b_k$ . It is difficult for an adversary to launch stealthy A-FDI and M-FDI attacks when the watermark-based strategy is utilized by the system.

Only $a_k$ is available to an attacker

In this case, it is assumed that the attacker has obtained the watermark $a_k$ . The guessed value $y_k^{guess}$ can be given by

$$y_k^{\mathrm{guess}}=\frac{{\tilde{y}}_k-b_k^{\mathrm{guess}}}{a_k}.$$

(49)

Then, the MITM attack can be represented by

$$\begin{array}{c}\multicolumn{1}{c}{{\tilde{y}}_k^{\prime }=a_k({\mathrm{\Gamma }}_k{y}_k^{\mathrm{guess}}+{\mu }_k)+b_k^{\mathrm{guess}}}\\ \multicolumn{1}{c}{={\mathrm{\Gamma }}_k{\tilde{y}}_k+a_k{\mu }_k+(I-{\mathrm{\Gamma }}_k)b_k^{\mathrm{guess}}.}\end{array}$$

(50)

For the A-FDI attack, one can derive that

$${\tilde{y}}_k^{\prime }={\tilde{y}}_k+a_k{y}_k^a$$

(51)

and

$$y_k^{\prime }=\frac{{\tilde{y}}_k^{\prime }-b_k}{a_k}=y_k+y_k^a.$$

(52)

Furthermore, one can calculate

$$\mathbb{E}[g_k^A]=m+\mathbb{E}[{(y_k^a+2r_k)}^T{\mathcal{P}}^{-1}{y}_k^a].$$

(53)

It can be seen from (53) that if $y_k^a=-2r_k$ , then an attacker can launch stealthy A-FDI attacks. However, the exact value of $r_k$ is unknown to an adversary since the watermark $b_k$ is unavailable to him or her.

On the other hand, for the M-FDI attack, one can derive

$${\tilde{y}}_k^{\prime }=-{\tilde{y}}_k+2b_k^{\mathrm{guess}}.$$

(54)

It is noted that this situation is the same as discussed in (46), that is, $\mathbb{E}[g_k^M]=m+4\mathbb{E}[{({\mathcal{M}}_k+r_k)}^T{\mathcal{P}}^{-1}\left({\mathcal{M}}_k\right)]$ , where ${\mathcal{M}}_k=-y_k+(b_k^{\mathrm{guess}}-b_k)a_k^{-1}$ .

• Corollary 2. Consider the scenario that an attacker already knows the structure of ${\tilde{y}}_k$ and the specific value of $a_k$ , but cannot obtain the information of $b_k$ . The designed watermarks can only have effect on the detection rate of M-FDI attacks.

Only $b_k$ is available to an attacker

When the adversary can only obtain the information of $b_k$ , the guessed value $y_k^{\mathrm{guess}}$ is given by

$$y_k^{\mathrm{guess}}=\frac{{\tilde{y}}_k-b_k}{a_k^{\mathrm{guess}}}$$

(55)

which implies

$$\begin{array}{c}\multicolumn{1}{c}{{\tilde{y}}_k^{\prime }=a_k^{\mathrm{guess}}({\mathrm{\Gamma }}_k{y}_k^{\mathrm{guess}}+{\mu }_k)+b_k}\\ \multicolumn{1}{c}{={\mathrm{\Gamma }}_k{\tilde{y}}_k+a_k^{\mathrm{guess}}{\mu }_k+(1-{\mathrm{\Gamma }}_k)b_k.}\end{array}$$

(56)

For the A-FDI attack, one can derive that

$${\tilde{y}}_k^{\prime }={\tilde{y}}_k+a_k^{\mathrm{guess}}{y}_k^a.$$

(57)

and

$$y_k^{\prime }=\frac{{\tilde{y}}_k^{\prime }-b_k}{a_k}=y_k+\frac{a_k^{\mathrm{guess}}}{a_k}{y}_k^a$$

(58)

It is noted that (58) is the same as given in (44), which implies

$$\mathbb{E}[g_k^A]=m+E\left[{(\frac{a_k^{\mathrm{guess}}}{a_k}{y}_k^a+2r_k)}^T{\mathcal{P}}^{-1}\left(\frac{a_k^{\mathrm{guess}}}{a_k}{y}_k^a\right)\right].$$

Similarly, when the M-FDI attack is considered, one can compute

$${\tilde{y}}_k^{\prime }=-{\tilde{y}}_k+2b_k.$$

(59)

and

$$y_k^{\prime }=\frac{{\tilde{y}}_k^{\prime }-b_k}{a_k}=-y_k$$

(60)

which implies that the corresponding M-FDI attack is the optimal linear attack without being detected.

• Corollary 3. Consider the case that an attacker already knows the structure of ${\tilde{y}}_k$ and the specific value of $b_k$ , but cannot obtain the value of $a_k$ . The designed watermarks can only have effect on the detection rate of A-FDI attacks.

Numerical examples

In this section, numerical simulation will be given to illustrate the effectiveness of the proposed results. For the linear system described by (1)–(2), we adopt the same system parameters as that utilized in, ²⁹ where

$$A=\left[\begin{array}{cccc}0.716\hfill & 0.245\hfill & 0.211\hfill & 0.031\hfill \\ \multicolumn{1}{c}{0.113}& 0.341\hfill & 0.234\hfill & 0.109\hfill \\ \multicolumn{1}{c}{0.039}& 0.231\hfill & 0.467\hfill & 0.019\hfill \\ \multicolumn{1}{c}{0.019}& 0.171\hfill & 0.012\hfill & 0.321\hfill \end{array}\right],$$

$$C=\left[\begin{array}{cccc}0.121\hfill & 0.828\hfill & 0.164\hfill & 0.245\hfill \\ \multicolumn{1}{c}{0.635}& 0.413\hfill & 0.517\hfill & 0.131\hfill \\ \multicolumn{1}{c}{0.234}& 0.598\hfill & 0.658\hfill & 0.325\hfill \\ \multicolumn{1}{c}{0.351}& 0.765\hfill & 0.126\hfill & 0.989\hfill \end{array}\right],$$

$$Q=\mathrm{diag}\{0.228,0.316,0.683,0.461\},$$

$$R=\mathrm{diag}\{0.131,0.138,0.123,0.102\}.$$

The window size $\mathcal{J}$ of the ${\chi }^2$ detector is set to 1, the confidence coefficient is 95%, and the degree of freedom is 4. According to the critical value table of the ${\chi }^2$ distribution, $\beta =9.488$ can be obtained. Assume that $a_k\in (0,0.001]$ and $b_k~N(0,1)$ , generated dynamically within a bounded interval, are given in Figures 2 and 3, respectively. In addition, it is assumed that the attacker launches attacks during the time intervals [20,35] and [60,75]. In addition, the attack vector $y_k^a\in [0,1]$ launched by the adversary is shown in Figure 4.

Figure 2.

The watermark $a_k$ .

Figure 3.

The watermark $b_k$ on each channel.

Figure 4.

The attack vector $y_k^a$ on each channel.

Case 1: Both $a_k$ and $b_k$ are not available to an attacker

In this situation, both watermarks $a_k$ and $b_k$ are not available to an attacker and the simulation result is given in Figure 5. It is can be seen from Figure 5 that almost all A-FDI and M-FDI attacks can be detected, which implies that it is difficult for an adversary to launch stealthy A-FDI and M-FDI attacks. In this section, 0 and 1 represent that the system is attack-free and attacked, respectively.

Figure 5.

The attack detection result when both $a_k$ and $b_k$ are not available.

Case 2: Only $a_k$ is available to an attacker

When an attacker can only obtain the knowledge of $a_k$ , the simulation result is given in Figure 6. It can be seen from Figure 6 that the designed watermark-based defense strategy is only effective for detecting M-FDI attacks. On the other hand, since the A-FDI attack cannot be detected, the remote estimator uses the sensor data including the attack to estimate the state of the system, which implies that the system can be threatened by the A-FDI attacks.

Figure 6.

The attack detection result when only $a_k$ is available to an attacker.

Case 3: Only $b_k$ is available to an attacker

In this case, an adversary can only obtain the information of $b_k$ and the simulation result is given in Figure 7. It can be seen from Figure 7 that the designed watermarks are only effective for detecting A-FDI attacks. On the other hand, since the M-FDI attack cannot be detected, the remote estimator uses the sensor data including the attack to estimate the state of the system, which implies that the system can be deteriorated by malicious M-FDI attacks.

Figure 7.

The attack detection result when only $b_k$ is available to an attacker.

Conclusions

In this paper, a proactive defense strategy based on dynamic watermark encryption is proposed to detect both A-FDI and M-FDI attacks. In addition, the data output by the sensor is encrypted and decrypted, which could greatly improve the attack detection rate. Moreover, the watermarks do not affect the system performance in the absence of attacks. When the watermarks are well designed, the attack detection rate of ${\chi }^2$ detector can be greatly improved. Furthermore, three different attack detection scenarios have been analyzed and the corresponding results are demonstrated through numerical simulation examples. The results show that the detection rate of both A-FDI and M-FDI attacks can be greatly improved if the watermarks $a_k$ and $b_k$ are not available to an adversary.