Security Index from Input/Output Data: Theory and Computation

TL;DR

This work addresses risk assessment for cyber-physical control systems using data alone. It defines a data-driven security index $\rho(i)$ that can be computed from input/output data without a known model and proves that, under $L \ge n$ and persistently exciting data of order $n+2L$, $\rho(i)$ equals the model-based index $\delta(i)$, enabling exact component-risk quantification from data. The paper also establishes NP-hardness for computing $\rho(i)$, and provides a polynomial-time greedy upper bound $\overline{\rho(i)}$; numerical experiments on vehicle platooning corroborate the equivalence and illustrate practical computation trade-offs. Overall, the results offer a principled, data-only method to rank vulnerability of components to perfectly undetectable attacks and to bound that risk efficiently in practice.

Abstract

The concept of a security index quantifies the minimum number of components that must be compromised to carry out an undetectable attack. This metric enables system operators to quantify each component's security risk and implement countermeasures. In this paper, we introduce a data-driven security index that can be computed solely from input/output data when the system model is unknown. We show a sufficient condition under which the data-driven security index coincides with the model-based security index, which implies that the exact risk level of each component can be identified solely from the data. We provide an algorithm for computing the data-driven security index. Although computing this index is NP-hard, we derive a polynomial-time computable upper bound. Numerical examples on vehicle platooning illustrate the efficacy and limitations of the proposed index and algorithms.

Figures (6)

• Figure 1: Platoon consisting of five vehicles.
• Figure 2: Input data.
• Figure 3: Output data.
• Figure 4: Values of the model-based security index $\delta(i)$, data-driven security index $\rho(i)$, and its upper bound $\overline{\rho(i)}$ of each component $i \in \mathcal{I}$.
• Figure 5: Computational times per component for $\delta(i)$, $\rho(i)$, and $\overline{\rho(i)}$.

Theorems & Definitions (1)

• Definition 1