Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

State Reconstruction Under Malicious Sensor Attacks

Wei Liu

TL;DR

Problem: reconstruct the state of a discrete-time CPS when up to $s$ sensors can be attacked and the attacked set is unknown. Approach: prove that the state is $s$-error correctable after at most $r\le n$ steps if the system is $s$-sparse observable, and develop two exact reconstruction schemes, SESVS and SESGC, with supporting algorithms and theorems. Key contributions: (i) a formal error-correction condition under sparse observability, (ii) SESVS leveraging repeated measurement values across sensor-subset combinations, (iii) SESGC using the plant model to filter candidate states via Algorithm 1, and (iv) robustness results showing reconstruction remains feasible even when $s$ approaches or exceeds half of the sensors under appropriate conditions. Significance: enables exact state reconstruction in malicious CPS scenarios and is demonstrated on a four-dimensional dynamic system and a three-inertia system, highlighting practical applicability and resilience to sensor attacks.

Abstract

This paper considers the state reconstruction problem for discrete-time cyber-physical systems when some of the sensors can be arbitrarily corrupted by malicious attacks where the attacked sensors belong to an unknown set. We first prove that the state is $s$-error correctable if the system under consideration is $s$-sparse observable where $s$ denotes the maximum number of attacked sensors. Then, two state reconstruction methods are presented where the first method is based on searching elements with the same value in a set and the second method is developed in terms of searching element satisfying a given condition. In addition, after establishing and analyzing the conditions that the proposed state reconstruction methods are not effective, we address that it is very hard to prevent the state reconstruction when either state reconstruction method proposed in this paper is used. The correctness and effectiveness of the proposed methods are examined via an example of four-dimensional dynamic systems and a real-world example of three-inertia systems.

State Reconstruction Under Malicious Sensor Attacks

TL;DR

Problem: reconstruct the state of a discrete-time CPS when up to sensors can be attacked and the attacked set is unknown. Approach: prove that the state is -error correctable after at most steps if the system is -sparse observable, and develop two exact reconstruction schemes, SESVS and SESGC, with supporting algorithms and theorems. Key contributions: (i) a formal error-correction condition under sparse observability, (ii) SESVS leveraging repeated measurement values across sensor-subset combinations, (iii) SESGC using the plant model to filter candidate states via Algorithm 1, and (iv) robustness results showing reconstruction remains feasible even when approaches or exceeds half of the sensors under appropriate conditions. Significance: enables exact state reconstruction in malicious CPS scenarios and is demonstrated on a four-dimensional dynamic system and a three-inertia system, highlighting practical applicability and resilience to sensor attacks.

Abstract

This paper considers the state reconstruction problem for discrete-time cyber-physical systems when some of the sensors can be arbitrarily corrupted by malicious attacks where the attacked sensors belong to an unknown set. We first prove that the state is -error correctable if the system under consideration is -sparse observable where denotes the maximum number of attacked sensors. Then, two state reconstruction methods are presented where the first method is based on searching elements with the same value in a set and the second method is developed in terms of searching element satisfying a given condition. In addition, after establishing and analyzing the conditions that the proposed state reconstruction methods are not effective, we address that it is very hard to prevent the state reconstruction when either state reconstruction method proposed in this paper is used. The correctness and effectiveness of the proposed methods are examined via an example of four-dimensional dynamic systems and a real-world example of three-inertia systems.

Paper Structure

This paper contains 20 sections, 15 theorems, 45 equations.

Table of Contents

  1. Introduction
  2. Problem Formulation
  3. Secure State Reconstruction
  4. Error Correction
  5. Secure State Reconstruction based on SESVS
  6. Secure State Reconstruction based on SESGC
  7. Numerical Examples
  8. Example of Four-Dimensional Dynamic Systems
  9. Example of Three-Inertia Systems
  10. Conclusion
  11. Proof of Lemma \ref{['Lemma1']} and Theorem \ref{['Theorem1']}
  12. Proof of Lemma \ref{['Lemma1']}
  13. Proof of Theorem \ref{['Theorem1']}
  14. Proof of Theorem \ref{['Theorem2']} and Corollary \ref{['corollary1']}
  15. Proof of Theorem \ref{['Theorem2']}
  16. ...and 5 more sections

Key Result

Lemma 1

If $\Gamma$ is known and $(A,C(\Gamma))$ is observable, the state $x_{k-r+1}$ can be exactly computed via in $r\geq a$ with $a\leq n$ where and $a$ is the minimum value of $r$ such that the rank of $O_{\Gamma}$ is $n$.

Theorems & Definitions (34)

  • Definition 1
  • Definition 2
  • Lemma 1
  • Example 1
  • Remark 1
  • Remark 2
  • Theorem 1
  • Example 2
  • Remark 3
  • Remark 4
  • ...and 24 more