Available online at www.sciencedirect.

com

ScienceDirect
ICT Express 9 (2023) 656–663
www.elsevier.com/locate/icte

Adaptive robust FDI attack detection for cyber–physical systems with

disturbance✩
Lu Li, Yong Chen ∗, Meng Li, Yuezhi Liu
School of Automation Engineering, University of Electronic Science and Technology of China, Chengdu 611731, China
Institute of Electric Vehicle Driving System and Safety Technology, University of Electronic Science and Technology of China, Chengdu 611731, China
Received 23 February 2022; received in revised form 24 March 2022; accepted 5 April 2022
Available online 12 April 2022

Abstract
This paper investigates the problem of attack detection for cyber–physical systems (CPSs) with disturbances, measurement noises, and
false data injection (FDI) attacks. A classical linear discrete-time system attack model is constructed and a robust attack detector based on the
mixed H_/H∞ is designed. Firstly, a system with an actuator that suffered a malicious attack is modeled. Then, a robust attack detector based
on the mixed H_/H∞ is designed in which the H_ index and H∞ index are used to characterize the sensitivity to attacks and robustness
to disturbances and measurement noises, respectively. And an adaptive detection threshold with a compensation term is proposed. Besides,
the designed robust attack detector enables the attack detection dynamic system to be asymptotically stable and to guarantee the H_/H∞
performance, and the robust attack detector gains are solved from a convex optimization. Finally, the obtained theoretical results are validated
through a numerical simulation and a three-area power system simulation.
© 2022 The Authors. Published by Elsevier B.V. on behalf of The Korean Institute of Communications and Information Sciences. This is an open
access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).
Keywords: Cyber–physical systems; Attack detection; False data injection attack; Linear matrix inequality; H_/H∞

1. Introduction In recent years, due to the need of informatization and

intelligence, the operation environment of CPSs is becoming
Cyber–physical system (CPS) is an intelligent system that
more and more open and interconnected. This not only im-
integrates computation, communication, and physical envi-
proves the operation efficiency, but also provides a new attack
ronment [1]. In recent years, CPS has been widely used channel for attackers, so that cyber attacks can directly affect
in the fields of automobiles, industrial automation, intelli- the security of CPSs, and have a significant impact on the
gent transportation systems, smart grids and so on [2]. Be- economy, environment and even human life.
cause the control layer and physical components are linked FDI is the most common type of cyber attack in CPS. Here,
by wired/wireless networks, CPS is particularly vulnerable to a false data may be injected by malicious attackers to modify
attacks, which can lead to undesirable loss or serious dam- the normal control signal during the control signal transport
age [3]. In [4], from an engineering perspective, the author from the controller to the actuator, or the measurement signal
discloses three typical types of cyber-attacks, i.e. denial-of- during the measurement signal transport from the sensor to the
service (DOS) attack [5,6], false data injection (FDI) attack controller through a wired or wireless network. It may affect
[7–9], and replay attack [10]. Safety is one of the important system performance, and in the worst case, cause system crash.
contents of CPS research. This paper mainly studies FDI For the sake of protecting the operation security of CPSs,
attacks of CPS. it is important to detect cyber attacks in a timely manner.
✩ This work was supported in part by the National Natural Science Besides, the external disturbances and measurement noises are
Foundation of China under Grant (61973331). inevitable and may be indistinguishable from attack. To cope
∗ Corresponding author at: School of Automation Engineering, University with these challenges, a scheme of attack detection on H /H∞
of Electronic Science and Technology of China, Chengdu 611731, China. for CPSs is proposed.
E-mail addresses: [email protected] (L. Li), [email protected]
Recently, more and more attention has been paid to the
(Y. Chen), [email protected] (M. Li), [email protected] (Y. Liu).
Peer review under responsibility of The Korean Institute of Communica- attack detection problem of CPSs under these cyber attacks,
tions and Information Sciences (KICS). and some progress has been made. For example, in [11],
https://doi.org/10.1016/j.icte.2022.04.002
2405-9595/© 2022 The Authors. Published by Elsevier B.V. on behalf of The Korean Institute of Communications and Information Sciences. This is an
open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).
L. Li, Y. Chen, M. Li et al. ICT Express 9 (2023) 656–663

Wei Ao et al. proposed sufficient conditions for detecting and security control of multi-area power systems with com-
state attack and sensor attack. Then two adaptive sliding munication delay and aperiodic DoS attacks. They proposed a
mode observers are designed and appropriate residual signals detection mechanism to identify DoS attacks occurred at the
are constructed to approximate the attacks. In [12], a finite actuator and a resilient control mechanism with a preserving
time attack detection and secure state estimation scheme is weighted H∞ performance. In [26], a robust fault detec-
proposed. Considering the detectability of the attack which tion method is proposed, and for the sake of making robust
is s-sparse, a new criterion of CPS detectability and dis- residual generators to be sensitive to faults and insensitive
criminability is proposed. Then, simulation results show that to unknown disturbances, a mixed H∞/H∞ performance is
the proposed detector and estimator can detect the attack given. Therein, the sensitivities evaluation of the residual to
and estimate the state in the specified finite time, respec- fault is characterized by the H∞ performance. It is known
tively. In [13], an effective event-triggered detection scheme that, the H performance can significantly improve diagnostic
based on event-triggered generalized extended state observer performance compared to the H∞ performance. In [27], Li
is proposed. In [14], a distributed detection method based
et al. proposed a residual generator based on the H /H∞ mixed
on nonlinear unknown input observer is proposed to detect
optimization technique and transform the H performance into
FDI attacks in large-scale smart grid systems. In [15], Li
an H∞ constraint to deal with the data-driven attack detection
et al. propose three sequential data verification and fusion
problem.
programs for different detection information scenes. However,
it requires a subset of safe sensors, which is difficult to However, there are some limitations to be aware of. First,
obtain. In [16], without an additional subset of safe sensors, the above literatures only consider the robustness to unknown
an FDI attack detection algorithm is designed using anomaly inputs such as noise and external interference, or use H∞
detection between the estimates of different sensor subsets performance rather than H performance to characterize sen-
under a small false alarm constraint. Moreover, in general, sitivity. Second, most of the residual evaluation functions
FDI attacks can remain invisible to the χ 2 detector. In [17], are constructed using all residual signals, which will waste
Ye et al. proposed a summation detector that considered the the storage resources of the computer. Third, the traditional
current information and previous information to detect the threshold is a precomputed constant, and it may lead to false
FDI attacks of CPSs with white noise. In [18], an online detection.
anomaly detection algorithm of power systems is proposed to Motivated by the above limitations, this paper investigates
detect abnormal measurement. In [19], to detect sensor attacks the problem of the detection of FDI attacks in CPS, and a
for the continuous-time systems, a detection and recognition scheme of attack detection on H /H∞ is proposed in the case
scheme based on distributed and decentralized observers is of false data injection attacks occurring at actuators. The main
proposed. In [20], considering a networked CPS with actuator contributions of this paper can be summarized:
attacks, sensor attacks and measurement noises, resilient attack (i) A robust attack detector based on H /H∞ is designed
detection estimators are proposed to detect FDI attacks that for the problem of attack detection. Different from the H∞
occurred at the physical system layer, and jamming attacks that detection filter ([23,25], et al.) in the above literatures, the de-
occurred when the measurement output transport wirelessly signed robust attack detector integrates H /H∞ index. Specif-
from sensors to remote estimators at the cyber layer. In [21], ically, the H index and H∞ index are used to characterize
by constructing an augmented system where the attacks are the sensitivity to attack and robustness to disturbances and
seen as part of the augmented state vector, a novel secure measurement, respectively.
Luenberger-like observer is proposed to estimate the state (ii) Compare with the traditional residual evaluation func-
and reconstruct the attacks according to their observability tion and the residual threshold ([20,27], et al.), a residual
automatically. Further, in [22], considering a CPS with the
evaluation function of finite time window and an adaptive
sensor attack which is s-sparse, event-triggered observers are
detection threshold with a compensation term is proposed to
proposed to deal with the problem of secure state reconstruc-
improve the detection efficiency.
tion and attack reconstruction, utilizing the augmented state
(iii) The Lyapunov function of the attack detection dynamic
and the notion of sparse observability.
When detecting the occurrence of attacks, the classical H2 , system is constructed and considering the H /H∞ performance
H and H∞ performance indices are used in many litera- index, the robust attack detector gains are solved from a
ture [23–27]. In [23], Gao et al. studied the problem of attack convex optimization.
detection and alarm response of CPSs with FDI attacks and Finally, two examples are given to show the effectiveness
noises. Considering the limited communication bandwidth and of the proposed robust attack detector.
H∞ disturbance attenuation level bound, they proposed the The rest of this paper is organized as follows. Section 2 for-
local detector and a distributed fusion strategy. A residual mulates the problem and proposed a classical linear discrete-
evaluation function and a traditional precomputed residual time system attack model. The robust attack detector based
threshold is constructed to determine whether an attack has on H /H∞ is designed and the gain matrixes are calculated in
occurred. Therein, a H∞ disturbance attenuation level bound Section 5. Section 4 validates the effectiveness of the designed
is used to represent the suppression to attack and noise, simul- robust attack detector. In Section 5, the conclusions of this
taneously. In [24], Cheng et al. studied the attack detection paper are summarized.
657
L. Li, Y. Chen, M. Li et al. ICT Express 9 (2023) 656–663

Table 1
Table of notations.
I The identity matrix with appropriate dimension.
AT The transpose of the matrix A.
B −1 The inverse of the matrix B.
X < (>)0 A positive-definite (negative-definite) matrix.
l2 [0, ∞) The space of square integrable functions on [0, ∞).
* The symmetric term in symmetric entries.
diag{a11 , a22 , . . . ann } A diagonal matrix.

the control input can be shown as u a (k) = u(k) + a(k),

where a(k) ∈ R p is an unknown attack signal. Utilizing
the measurement output y(k), a H /H∞-based robust attack
detector is proposed, and a residual signal will be used to
evaluate whether an attack has occurred.
Consider the actuator attacks, the linear discrete-time sys-
tem can be re-described by the following form:
xa (k + 1) = Axa (k) + Bu a (k) + ω(k)
{
(2)
ya (k) = C xa (k) + d(k)
where xa (k) is the system state under FDI attacks, ya (k) is the
system output under FDI attacks, and u a (k) is the control input
received by the system under FDI attacks.

3. Robust attack detector

Fig. 1. The framework of actuator attack detection for CPS. In this section, first of all, a robust attack detector based
on H /H∞ is designed to detect the cyber attack. Then, by
constructing a convex optimization, the gains of the attack
2. Problem formulation detector will be calculated.
Considering the measurement output y(k), a H /H∞-based
For the sake of convenience, the notations used in this paper
robust attack detector is proposed as follows:
are listed in Table 1.
σ (k + 1) = Ω σ (k) + Ξ ya (k)
{
Consider a class of CPSs described in the linear discrete-
time form: (3)
r (k) = Γ σ (k)
x(k + 1) = Ax(k) + Bu(k) + ω(k)
{
(1) where σ (k) ∈ R n is the attack detector state vector, r (k) ∈ R p
y(k) = C x(k) + d(k) is a residual signal, and matrixes Ω , Ξ and Γ are the attack
where x(k) ∈ R n is the system state, u(k) ∈ R p is the detector gains to be designed. Define χ(k) = [xaT (k), σ T (k)]T ,
control input, y(k) ∈ R m is the system output, ω(k) ∈ R n e(k) = r (k) − a(k), v(k) = [ω T (k), d T (k)]T . Then, the
and d(k) ∈ R m are the energy-bounded disturbances and following attack detection dynamic system can be obtained:
measurement noises. A, B, C represent the system matrixes
with appropriate dimensions. The system matrix pair (A, B) χ (k + 1) = Aχ(k) + Bv(k) + B̂a(k)
{
is assumed to be controllable. Moreover, a feedback controller (4)
e(k) = Cχ(k) + Da(k)
u(k) = K x(k) in which the gain matrix K ∈ R p×n satisfy
[ ] [ ] [ ]
matrix Φ ≜ A + B K is Schur is applied. Φ 0 I 0 B
where A = , B = , B̂ = , C =
Ξ C Ω 0 Ξ 0
Remark 1. In [28], a decentralized output feedback sampled- [ ]
data control strategy is designed to make the system insensitive 0 Γ , D = −I .
to DOS attacks. In other words, regardless of whether the To formulate a successful attack detection, the signal e(k)
attack occurs or not, it adopts a constant controller to ensure should be robust to disturbances and measurement noises and
that closed-loop system is robust to the attack and there is no sensitive to attack as much as can be designed. Here, we
need to design an attack detector. In this paper, an attack detec- employ the following H∞ and H− performance to indicate
tion scheme is proposed to detect the occurrence of malicious the robustness to disturbances and measurement noises and
attacks, which is more flexible and has more application value. sensitivities to attacks [27], respectively.
∞ ∞
In CPS, as depicted in Fig. 1, data exchange via a wired
∑ ∑
e T (k)e(k) ≤ γ 2 v T (k)v(k) (5)
or wireless network suffers from malicious FDI attack. Then, k=0 k=0
658
L. Li, Y. Chen, M. Li et al. ICT Express 9 (2023) 656–663

∞ ∞
⎡ ⎤
∑ ∑ −I 0 Ξ1 −I
e T (k)e(k) ≥ β 2 a T (k)a(k) (6) ⎢ ⎥
k=0 k=0
⎢∗ Ξ2 Ξ3 Ξ6 ⎥
⎥<0 (10)
⎢ ⎥
where positive scalar γ is the H∞ performance index, and
⎢
⎢∗ ∗ Ξ5 0 ⎥
positive scalar β is the H− performance index. Therein, γ
⎣ ⎦
reflects the robustness evaluation of the influence of v(k) on ∗ ∗ ∗ (β ∗ − 2)I
the error e(k) in the worst case. β reflects the sensitivities where
evaluation of the error e(k) to attack a(k). The smaller the γ , P1 − RT − R
[ ]
P2 − T − S
the stronger the error e(k) suppresses the unknown input v(k), Y , Ξ2 = ,
[ ]
Ξ1 = 0
and the smaller the false detection rate. On the contrary, the ∗ P3 − T − T T
larger the β, the more sensitive the error e(k) is to attack a(k),
R T Φ + XC RT
[ ] [ ]
and the greater the missing detection rate. Z X
Ξ3 = , Ξ4 = ,
To detect whether the FDI attack has occurred, a residual S T Φ + XC Z ST X
evaluation function of finite time window is proposed as [ ]
−P 1 −P 2
follows: Ξ5 = ,

 k ∗ −P 3
 ∑
θ (k) = √ r T (i)r (i) (7)
RT B
[ ]
i=k−τ +1 Ξ6 = , γ ∗ = γ 2, β ∗ = β 2.
where τ is the length of the window. In (7), when constructing ST B
a residual evaluation function, a finite time window is applied Then the attack detection dynamic system (4) is asymptoti-
to save the resources of computer storage, and r (k) = r (0) cally stable and satisfies the H− /H∞ performance. The robust
when k = −τ + 1, −τ + 2, . . . , −1. attack detector gain matrixes Ω , Ξ and Γ can be calculated
The attack detection method proposed in this paper is based as Ω = T −1 Z , Ξ = T −1 X , Γ = Y .
on threshold discrimination, which can determine whether an
attack has occurred. It is well known that detection threshold Proof. Construct a Lyapunov function for the attack detec-
can affect the accuracy of attack detection, then an adaptive tion dynamic system (4): V (k) = χ T (k)Pχ (k), where the
residual threshold θth in this paper is chosen as follows when symmetric matrix P > 0.
there is no attack: One has
λ ∆V (k) = V (k + 1) − V (k)
θth = sup θ (k) + sign(∆θ (k)) −α|∆θ (k)|
(8)
v(k)∈l2 ,a(k)=0 1+e = χ T (k + 1)Pχ(k + 1) − χ T (k)Pχ(k)
where ∆θ(k) = θ (k) − θ (k − 1), λ and α are two adjustable T
= χ T (k)(A P A − P)χ(k) + 2χ T (k)A P Bv(k) (11)
T

parameters, and the second term in (8) is a compensation term T T

of the supremum of θ (k) which is different from the traditional +2χ T (k)A P B̂a(k) + v T (k)B P Bv(k)
threshold. Then, the occurrence of attack can be detected when T
+2v T (k)B P B̂a(k) + a T (k) B̂ T P B̂a(k)
the residual evaluation function θ (k) is larger than the adaptive
Define J = ∞ k=0 (e (k)e(k) − γ v (k)v(k)). When a(k) =
T 2 T
∑
residual threshold θth .
0, considering the zero-initial condition as χ (k) = 0 and
Remark 2. In general, the residual threshold is usually the V (∞) ≥ 0, the following inequality can be derived:
residual evaluation function when there is no attack, and it can ∞
∑
e (k)e(k) − γ 2 v T (k)v(k) + V (∞) − V (0)
( T )
be precomputed. In practical systems, the influence of external J ≤
k=0
interference and model uncertainty on detection threshold is ∞
∑
e T (k)e(k) − γ 2 v T (k)v(k) + ∆V (k)
( )
not constant. Thus, a precomputed threshold may lead to false =
k=0
detection. In this paper, an adaptive residual threshold is used ∞ (
∑ T T T
to replace the traditional precomputed threshold, which can = χ T (k)(A P A + C C − P)χ (k) + 2χ T (k)A P Bv(k)
k=0
improve the detection efficiency. T
)
+v T (k)(B P B − γ 2 I )v(k)
⎡ ⎤
χ (k)
Theorem 1. If there exist positive scalars γ and β, symmetric ∑∞ [ ]
= χ (k) v (k) Σ ⎣
T T ⎦
matrix P > 0, and matrixes R, S, T , X , Y , Z , satisfying: k=0 v(k)

min γ∗ If there exist a symmetric matrix P > 0 and scalar γ > 0

T,X,Y,Z
⎡
−I 0 Ξ1 0
⎤ such that the inequality (12) is established, then the attack
⎢ ⎥ detection dynamic system (4) is asymptotically stable and the
⎢∗ Ξ2 Ξ3 Ξ4 ⎥ (9) H∞ performance (5) is satisfied.
s.t. ⎢ ⎥<0
⎢ ⎥
[ T T T ]
⎢∗ ∗ Ξ5 0 ⎥ A PA +C C − P A PB
Σ= <0 (12)
⎣ ⎦
T
∗ ∗ ∗ −γ ∗ I ∗ B P B − γ 2I
659
L. Li, Y. Chen, M. Li et al. ICT Express 9 (2023) 656–663

Using the Schur complement and [25, Lemma2], there

exists a symmetric matrix P > 0 such that (12) holds if and
only if there exist symmetric matrix P > 0 and matrix Λ such
that the inequality (13) is satisfied.
⎡ ⎤
−I 0 C D
⎢ ⎥
⎢ ∗ P − ΛT − Λ ΛT A ΛT B ⎥
⎥<0 (13)
⎢ ⎥
⎢
⎢∗
⎣ ∗ −P 0 ⎥
⎦
∗ ∗ ∗ −γ 2 I
When there are attacks, similar to the derivation above, Fig. 2. Attack detection performance: The detection threshold θth and
the conclusion that if there exist symmetric matrix P > 0 residual evaluation function θ (k) in [25].
and matrix Λ such that the inequality (14) holds, the attack
detection dynamic system (4) is asymptotically stable and the
H performance (6) is satisfied is drawn. 4. Results
⎡ ⎤
−I 0 C −D To illustrate the effectiveness of the attack detection method
⎢
⎢ ∗ P − ΛT − Λ ΛT A ΛT B̂
⎥
⎥ proposed in this paper, a numerical example and a three-area
⎥<0 (14) power system simulation example are given in this section.
⎢ ⎥
⎢
⎢∗
⎣ ∗ −P 0 ⎥
⎦
T Example 1. Consider
∗ ∗ ∗ β 2 I − 2D D [ the system (1) ] with the [ following
]
1.0224 1.2310 1
parameters: A = , B = , C =
[ ] [ ]
P1 P2 Λ1 Λ2
Partition P = and Λ = . Define [ ] 1.6060 −0.0224 2.5
∗ P3 Λ 3 Λ 4 1 0
.
[ ] [ ]
I 0 P1 P2
Π = , P = = Π T PΠ . Then, pre- 1 2
0 Λ−14 Λ 3 ∗ P 3 The disturbance and measurement noise signal ω (k) and
and post-multiply inequality (13) and (14) by the diagonal d (k) are uniformly distributed
[ over [−0.1, 0.1].] The feedback
matrix diag I, Π T , Π T , I and its transpose, and define gain is designed as K = −0.508 −0.0998 so that when
R = Λ1 , S = Λ2 Λ−1 there is no FDI attack occurred, the system (1) is stable. Then
4 Λ3 , T = Λ3 Λ4 Λ3 ,
T −1
(15) an FDI attack is given as follows:
X = Λ3T Ξ , Y = ΓΛ−1
4 Λ3 , Z = Λ3 ΩΛ4 Λ3
T −1
{
0.2 sin(0.1k), k ≥ 100
By performing some variable transformations on the ma- a(k) =
trixes in (13) and (14), the inequality (13) and (14) can be 0, other s
changed to (9) and (10), respectively. The gain matrixes Ω , Ξ and Γ in robust attack detector (3)
Meanwhile, we can
] obtain can be obtained from the convex optimization in Theorem 1.
R SΛ−1
[
3 Λ4 The parameters of the residual evaluation function (7) and the
Λ= , P = Π −T PΠ −1 ,
Λ3 Λ4 residual threshold (8) are taken as τ = 50, λ = 1.5×10−7 , and
(16)
α = 2 × 107 . Moreover, by setting 100 different disturbance
Ω = Λ3 Z Λ3 Λ4 , Ξ = Λ−T
−T −1
3 X, Γ = Y Λ −1
3 Λ 4 and measurement noise signal ω(k) and d(k) when there is no
Considering T = Λ3T Λ−1 attack, the first term of the residual threshold can be obtained.
4 Λ3 and the matrix transformation
in (16), the transfer function of the attack detection dynamic Then, the adaptive residual threshold with the compensation
system (4) can be transformed as the following form: term can be calculated utilizing the historical information and
the current information.
T (s) = Γ (s I − Ω )−1 Ξ
To show the FDI attack detection effectiveness and rapidity
= Y Λ−1 −T −1 −1 −T
3 Λ4 (s I − Λ3 Z Λ3 Λ4 ) Λ3 X (17)
of the proposed detection method, it is compared with an H∞
= Y (s I − T −1 Z )−1 T −1 X detection method without considering the H index in [25].
In [25], a robust fault detection filter is designed to detect
Then the robust attack detector gain matrixes Ω , Ξ and Γ
can be calculated as Ω = T −1 Z , Ξ = T −1 X , Γ = Y . This the occurrence of the attack. Therein, the H∞ performance
completes the proof. ■ index is used to represent the suppression of unknown inputs
by residuals. The residual threshold is the maximum value of
In Theorem 1, Ω , Ξ and Γ are obtained by optimizing the residual evaluation function when there is no attack and it
the H∞ index γ and taking a suitable H index β. Thus, is precomputed.
the system can be guaranteed to be insensitive to disturbances The detection threshold θth and residual evaluation function
and measurement noises to avoid false detection, and to be θ (k) in [25] and in this paper are given in Fig. 2 and Fig. 3,
sensitive to attacks to avoid missing detection. respectively. Therein, the dotted line and the dash-dotted line
660
L. Li, Y. Chen, M. Li et al. ICT Express 9 (2023) 656–663

Fig. 3. Attack detection performance: The detection threshold θth and

residual evaluation function θ (k) in this paper.

Fig. 5. The structure of the three-area power system.

βi is the frequency bias factor. Then a continuous-time linear

system of the three-area power system can be written as
follows:
{
ẋi (t) = Ai xi (t) + Bi u i (t)
(18)
yi (t) = Ci xi (t)
Fig. 4. The CPSs architecture for the three-area power system. ⎡ Di 1 1 ⎤
− − − 0
⎢ Mi N Mi Mi ⎥
⎢ ∑ ⎥
⎢2π Ti j 0 0 0
are the residual threshold and the residual evaluation func-
⎥
⎢ ⎥
tion in [25], respectively. The dashed line shows the residual
⎢ i=1, j̸=i ⎥
where Ai = ⎢ ⎢ ⎥,
threshold in this paper, and the solid line represents the resid- ⎢0 1 1 ⎥
0 − − ⎥
ual evaluation function in this paper. It can be seen that when
⎢
⎢ Tti Tti ⎥
⎥
the attack occurred at k = 100, the detector in this paper can ⎣ 1 1 ⎦
− 0 0 −
detect it at k = 103, and the method that in [25] can detect Tgi Ri Tgi
[ 1 ]T
it at k = 114. Obviously, the precalculated threshold in [25] 0 0 0
Tgi Ri , Ci = βi 1 0 0 . Di is
[ ]
Bi =
is far larger than the residual evaluation function before the the generator unit damping coefficient, Mi is the inertia of
attack occurs, which makes the detector unable to detect the generator, Ti j is the tie-line synchronizing coefficient between
occurrence of the attack in a timely manner, and may result area i and j, Tti is the turbine time constants, Tgi is the
in missing detections. It can be concluded that when there are governor time constants, and Ri is the speed droop.
external disturbances and noises, the detector in this paper can The system parameters of the three-area power system used
detect the occurrence of the FDI attack more quickly than the in simulations are as follows [29]:
method in [25]. The faster the detection speed is, the operator (1) Area 1
can maintain the system in time, and the less damage the attack
Tt1 = 0.31 s, Tg1 = 0.05 s, M1 = 0.2308 p.u. s
will cause to the system. This reflects the superiority of the 1
robust attack detector based on H /H∞ in this paper. D1 = 0.016 p.u./Hz, R1 = 3 Hz/p.u., β1 = + D1 .
R1
Example 2. In this subsection, by studying a three-area power (2) Area 2
system that is well integrated with CPSs as shown in Fig. 4, Tt2 = 0.35 s, Tg2 = 0.06 s, M2 = 0.2408 p.u. s
the effectiveness of the proposed attack detection method can 1
D2 = 0.018 p.u./Hz, R2 = 2.87 Hz/p.u., β2 = + D2 .
be verified. R2
Consider the three-area power system with the structure (3) Area 3
which is shown in Fig. 5, and let Tt3 = 0.30 s, Tg3 = 0.08 s, M3 = 0.2372 p.u. s
]T xi (t) = 1
∆ f i ∆Ptie−i ∆Pmi ∆Pgi , yi (t) = ∆Ptie−i + βi ∆ f i ,
[
D3 = 0.013 p.u./Hz, R3 = 2.92 Hz/p.u., β3 = + D3 .
where ∆ f i is the frequency deviation, ∆Ptie−i is the tie R3
line power deviation, ∆Pmi is the generator output power and T12 = 0.52 p.u./Hz, T23 = 0.47 p.u./Hz, and T31 =
deviation, ∆Pgi is the governor valve position deviation, and 0.55 p.u./Hz.
661
L. Li, Y. Chen, M. Li et al. ICT Express 9 (2023) 656–663

Substitute them into the continuous-time linear system, then

given the sampling period T = 0.05 s, the discrete-time model
can be obtained as follows:
{ ∗
xi (k + 1) = Ãi xi∗ (k) + B̃i u i∗ (k)
(19)
yi∗ (k) = C̃i xi∗ (k)
∫T
where Ãi = e Ai T , B̃i = 0 e Ai t Bi dt and C̃i = Ci .
Additionally, in this paper, considering the external distur-
bance and measurement noise signal ωi (k) and di (k) which
are uniformly distributed over [−0.1, 0.1], and the FDI attacks
ai (k), the system (19) can be rewritten as follows Fig. 6. Attack detection performance: The detection threshold θth and
xia (k + 1) = Ãi xia (k) + B̃i u ia (k) + ωi (k) residual evaluation function θ (k) in [25].
{
(20)
yia (k) = C̃i xia (k) + di (k)
where u ia (k) = u i∗ (k) + ai (k).
The feedback gain K is designed as follows so that when
there⎡is no attack occurred, the system in (19) is stable.
0.3171 −0.0401 −0.0814 −0.5890 −0.0026 −0.0003
⎢
K =⎢⎣−0.0025 −0.0003 −0.0001 0 0.3327 −0.0395
−0.0022 −0.0004 −0.0001 0 −0.0026 −0.0005
⎤
−0.0001 0 −0.0023 −0.0003 −0.0001 0
⎥
−0.0811 −0.7750 −0.0026 −0.0003 −0.0002 0 ⎥
⎦
−0.0002 0 0.3237 −0.0377 −0.1225 −1.1627
Then, the FDI attacks are given as follows:
]T Fig. 7. Attack detection performance: The detection threshold θth and
6 sin(0.1k) 6 sin(0.1k) 6 sin(0.1k) , k ≥ 100
{[
residual evaluation function θ (k) in this paper.
a(k) = [ ]T
0 0 0 , other s
The gain matrixes Ω , Ξ and Γ in attack detector (3) can less than that in [25]. Meanwhile, the precalculated threshold
be obtained from the convex optimization in Theorem 1. The in [25] is far larger than the residual evaluation function before
parameters of the residual evaluation function (7) and the the attack occurs, which makes the detector unable to detect
residual threshold (8) are taken as τ = 50, λ = 0.4 × 10−7 , the occurrence of the attack in a timely manner, and may
and α = 4 × 106 . Moreover, by setting 100 different external result in missing detections. Therefore, a conclusion can be
disturbance and measurement noise signal ω (k) and d (k) drawn that the method proposed in this paper can improve
when there is no attack, the first term of the residual threshold production efficiency and protect the safety of power system
can be obtained. Then, the adaptive residual threshold with the more effectively.
compensation term can be calculated utilizing the historical
information and the current information. 5. Conclusion
If the three-area power system is attacked by malicious
In this paper, the problem of detection of the FDI at-
attackers during the operation, various problems may occur,
tack which occurred at the actuator for CPS with external
thus affecting the production schedule, reducing the production
disturbances and measurement noises is studied. A robust
efficiency, and even causing the equipment to be damaged.
attack detector based on H− /H∞ is proposed for the classical
Hence, timely detect the attacks is very important.
linear discrete-time system and an adaptive detection threshold
Figs. 6 and 7 show the FDI attack detection effectiveness
is chosen. Moreover, considering the H− /H∞ performance,
and rapidity of the method in [25] and the proposed method
the attack detector gains are solved by calculating a convex
in this paper, respectively. To compare with an H∞ detection
optimization. The simulation results show that the proposed
method without considering the H index in [25], the time
detection strategy has a fast response speed to the FDI attack
from when an attack occurs to when the attack is detected is
detection. Furthermore, how to design a resilient control mech-
called detection time. The longer the detection time, the more
anism based on the attack detector proposed in this paper will
damage the attack will do to the three-area power system. It
be our future work.
can be seen that when the attack occurred at T1 = 5 s, the
attack detector in this paper can detect it at T2 = 5.35 s,
Declaration of competing interest
in other words, the detection time required for the attack
detector in this paper is ∆T = 0.35 s. However, the method The authors declare that they have no known competing
in [25] can detect it at T ′ = 5.95 s, and the detection time financial interests or personal relationships that could have
is ∆T ′ = 0.95 s. The detection time of this paper is far appeared to influence the work reported in this paper.
662
L. Li, Y. Chen, M. Li et al. ICT Express 9 (2023) 656–663

References [15] Y. Li, L. Shi, T. Chen, Detection against linear deception attacks on
multi-sensor remote state estimation, IEEE Trans. Control Netw. Syst.
[1] R. Cao, L. Hao, Q. Gao, J. Deng, J. Chen, Modeling and decision- 5 (3) (2018) 846–856.
making methods for a class of cyber–physical systems based on [16] A. Chattopadhyay, U. Mitra, Security against false data-injection attack
modified hybrid stochastic timed Petri net, IEEE Syst. J. 14 (4) (2020) in cyber-physical systems, IEEE Trans. Control Netw. Syst. 7 (2)
4684–4693. (2020) 1015–1027.
[2] R. Meira-Góes, et al., Synthesis of sensor deception attacks at the [17] D. Ye, T.-Y. Zhang, Summation detector for false data-injection
supervisory layer of cyber–physical systems, Automatica 121 (2020) attack in cyber-physical systems, IEEE Trans. Cybern. 50 (6) (2020)
109172. 2338–2345.
[3] M. Li, Y. Chen, Y. Liu, Sliding-mode secure control for jump cyber– [18] A. Ashok, M. Govindarasu, V. Ajjarapu, Online detection of stealthy
physical systems with malicious attacks, J. Franklin Inst. B 358 (7) false data injection attacks in power system state estimation, IEEE
(2021) 3424–3440. Trans. Smart Grid 9 (3) (2018) 1636–1646.
[4] D. Ding, et al., A survey on security control and attack detection for [19] N. Chowdhury, J. Belikov, D. Baimel, et al., Observer-based detection
industrial cyber-physical systems, Neurocomputing 275 (31) (2018) and identification of sensor attacks in networked CPSs, Automatica
1674–1683. 121 (2020) 109166.
[5] L. An, G. Yang, Decentralized adaptive fuzzy secure control for [20] Y. Guan, X. Ge, Distributed attack detection and secure estimation of
nonlinear uncertain interconnected systems against intermittent DoS networked cyber-physical systems against false data injection attacks
attacks, IEEE Trans. Cybern. 49 (3) (2019) 827–838. and jamming attacks, IEEE Trans. Signal Inf. Process. over Netw. 4
[6] Y.A. Li, P. Zhang, L.A. Ma, Denial of service attack and defense (1) (2018) 48–59.
method on load frequency control system, J. Franklin Inst. B 356 [21] A.Y. Lu, G.H. Yang, Secure luenberger-like observers for cyber–
(15) (2019) 8625–8645. physical systems under sparse actuator and sensor attacks, Automatica
[7] M. Li, Y. Chen, Wide-area robust sliding mode controller for power 98 (2018) 124–129.
systems with false data injection attacks, IEEE Trans. Smart Grid 11 [22] Y. Shoukry, P. Tabuada, Event-triggered state observers for sparse
(2) (2020) 922–930. sensor noise/attacks, IEEE Trans. Automat. Control 61 (8) (2016)
[8] B. Xie, et al., A novel trust-based false data detection method for 2079–2091.
power systems under false data injection attacks, J. Franklin Inst. B [23] L. Gao, B. Chen, L. Yu, Fusion-based FDI attack detection in cyber-
358 (1) (2021) 56–73. physical systems, IEEE Trans. Circuits Syst. II Express Briefs 67 (8)
[9] B. Chen, Y. Niu, Y. Zou, Security control for Markov jump system (2020) 1487–1491.
with adversarial attacks and unknown transition rates via adap- [24] Z. Cheng, et al., Detection-based weighted H∞ LFC for multi-area
tive sliding mode technique, J. Franklin Inst. B 356 (6) (2019) power systems under DoS attacks, IET Control Theory Appl. 13 (12)
3333–3352. (2019) 1909–1919.
[10] B. Chen, D.W.C. Ho, G. Hu, L. Yu, Secure fusion estimation for [25] X. He, Z. Wang, Y.D. Ji, D.H. Zhou, Robust fault detection for
bandwidth constrained cyber-physical systems under replay attacks, networked systems with distributed sensors, IEEE Trans. Aerosp.
IEEE Trans. Cybern. 48 (6) (2018) 1862–1876. Electron. Syst. 47 (1) (2011) 166–177.
[11] W. Ao, Y. Song, C. Wen, Adaptive cyber-physical system attack [26] S. Yin, G. Wang, H.R. Karimi, Data-driven design of robust fault
detection and reconstruction with application to power systems, IET detection system for wind turbines, Mechatronics 24 (4) (2014)
Control Theory Appl. 10 (12) (2016) 1458–1468. 298–306.
[12] W. Ao, Y. Song, C. Wen, et al., Finite time attack detection and [27] X. Li, X. Shen, A data-driven attack detection approach for DC servo
supervised secure state estimation for cpss with malicious adversaries, motor systems based on mixed optimization strategy, IEEE Trans. Ind.
Inf. Sci. 451–452 (2018) 67–82. Inform. 16 (9) (2020) 5806–5813.
[13] A. Patel, S. Purwar, Event triggered detection of cyber attacks on load [28] S. Li, C.K. Ahn, Z. Xiang, Decentralized sampled-data control for
frequency control, IET Cyber-Phys. Syst. Theory Appl. 5 (3) (2020) cyber-physical systems subject to DoS attacks, IEEE Syst. J. 15 (4)
263–273. (2021) 5126–5134.
[14] X. Wang, X. Luo, Y. Zhang, X. Guan, Detection and isolation of false [29] Y. Liu, Y. Chen, M. Li, Dynamic event-based model predictive load
data injection attacks in smart grids via nonlinear interval observer, frequency control for power systems under cyber attacks, IEEE Trans.
IEEE Internet Things J. 6 (4) (2019) 6498–6512. Smart Grid 12 (1) (2021) 715–725.

663