FDI (False Data Injection)

Cyber Attacks
In articles

Student: SepideH Moazzeni

Supervisor: Dr. Mahdi Aliyari

Cyber-Attacks in Industrial CPSs

Five Attacks:

False
Denial of
Data
Service Replay
Injection
(DoS)
(FDI)

Zero
Dynamics Covert
attacks attacks
(ZDAs)

2
Attack Space and Impact Space

3
4
 ET-MFAC with False Data Injection Attacks (FDIA)

SISO nonlinear system

𝑦 ( 𝑘+1 ) = 𝑓 ( 𝑦 ( 𝑘 ) , … , 𝑦 ( 𝑘− 𝑛 𝑦 ) , 𝑢 ( 𝑘 ) ,… ,𝑢 ( 𝑘−𝑛𝑢 ) )

CFDL modeling:

𝑦 ( 𝑘+1 ) = 𝑓 ( 𝑦 ( 𝑘 ) ,𝑢 ( 𝑘 ) ) Δ 𝑦 ( 𝑘 +1 )= 𝜙 ( 𝑘 ) Δ 𝑢 ( 𝑘 ) ,|𝜙 ( 𝑘 )|≤ 𝑔

^ ^ ( 𝑘 −1 ) + 𝜂 Δ 𝑢 ( 𝑘 −1 ) [ Δ 𝑦 ( 𝑘 ) − 𝜙
𝜙 ( 𝑘 )= 𝜙 ^ ( 𝑘 −1 ) Δ 𝑢 ( 𝑘 −1 ) ]
MFAC framework: 2
Δ 𝑢 ( 𝑘 −1 ) +𝜇

𝜌^
𝜙 (𝑘)
𝑢 ( 𝑘 )=𝑢 ( 𝑘 − 1 ) +
^ (𝑘)
2
[ 𝑦 ( 𝑘 +1 ) − 𝑦 ( 𝑘 ) ]
∗

𝜆+ 𝜙
5
 ET-MFAC with False Data Injection Attacks (FDIA)

FDI attacks on the

transmission network
sensor to the controller

6
 ET-MFAC with False Data Injection Attacks (FDIA)

Event-Triggering Control Design

Set of the event-triggered instant is determined as:

Event-triggered Function:

event-triggered threshold

Event-triggering Condition:

𝜌^𝜙 ( 𝑘𝑖 )
𝑢 ( 𝑘 )=𝑢 ( 𝑘 − 1 ) + 2
^ (𝑘 )+ 𝜆
𝜙
[ 𝑦 ( 𝑘 +1 ) − 𝑦 ( 𝑘𝑖 ) ]
∗

𝑖 7
 ET-MFAC with False Data Injection Attacks (FDIA)

ET-MFAC Algorithm under FDI attacks:

^ ^ ( 𝑘 −1 ) + 𝜂 Δ 𝑢 ( 𝑘 −1 ) [ Δ 𝑦 ( 𝑘 ) − 𝜙
𝜙 ( 𝑘 )= 𝜙 ^ ( 𝑘 ) Δ 𝑢 ( 𝑘 −1 ) ]
2
Δ 𝑢 ( 𝑘 −1 ) +𝜇

^ ^ ( 1 ) , 𝑖𝑓 |𝜙
𝜙 ( 𝑘 )= 𝜙 ^ ( 𝑘 )| ≤ 𝜀 𝑜𝑟 | Δ 𝑢 ( 𝑘− 1 )|≤ 𝜀 𝑜𝑟 𝑠𝑖𝑔𝑛 ( 𝜙
^ ( 𝑘 ) ) ≠ 𝑠𝑖𝑔𝑛( ^
𝜙 ( 1 ))

𝜌𝜙^ (𝑘 )
𝑢 ( 𝑘 )=𝑢 ( 𝑘 − 1 ) + 2
𝑎 𝑖
^ (𝑘 )+ 𝜆
[ 𝑦 ( 𝑘 +1 ) − 𝑦 𝑎 (𝑘 𝑖) ]
∗

𝜙 𝑎 𝑖

8
 ET-MFAC with False Data Injection Attacks (FDIA)

Problem:
Any Theorem to guarantee that the tracking error is uniformly bounded
with ET-MAFC algorithm using I/O data ?!

∗
𝑒 ( 𝑘) = 𝑦 ( 𝑘 ) − 𝑦 ( 𝑘 )

{ 𝑒 ( 𝑘 )||𝑒 (𝑘 )| ≤ 𝜖

9
 ET-MFAC with False Data Injection Attacks (FDIA)

Theorem:

Problem can be solved by using the ET-MFAC algorithm , if there exist:

10
  ET-MFAC with False Data Injection Attacks (FDIA)

No Compensation scheme !!!

Just Formulating the Problem !!!
No proof for event-triggering condition !!!

11
  ET-MFAC with False Data Injection Attacks (FDIA)

Simulation:
Nonlinear Plant:

Desired Trajectory:

False Data:

Parameter:

12
 ET-MFAC with False Data Injection Attacks (FDIA)

Simulation Results:

13
 ET-MFAC with False Data Injection Attacks (FDIA)

Simulation Results:

14
15
 Data-Driven Control with DA and FDIA

Structure of CPSs via

unreliable Network

 Each unit is remotely

deployed.

 Information exchange
need to rely on network
transmission in a wired or
wireless communication
mode.

16
 Data-Driven Control with DA and FDIA

SISO Nonlinear System

𝑦 ( 𝑘+1 ) = 𝑓 ( 𝑦 ( 𝑘 ) , … , 𝑦 ( 𝑘− 𝑛 𝑦 ) , 𝑢 ( 𝑘 ) ,… ,𝑢 ( 𝑘−𝑛𝑢 ) )

CFDL modeling:

𝑦 ( 𝑘+1 ) = 𝑓 ( 𝑦 ( 𝑘 ) ,𝑢 ( 𝑘 ) ) Δ 𝑦 ( 𝑘 +1 )= 𝜙 ( 𝑘 ) Δ 𝑢 ( 𝑘 ) ,|𝜙 ( 𝑘 )|≤ 𝑏

^ ^ ( 𝑘 −1 ) + 𝜂 Δ 𝑢 ( 𝑘 −1 ) [ Δ 𝑦 ( 𝑘 ) − 𝜙
𝜙 ( 𝑘 )= 𝜙 ^ ( 𝑘 ) Δ 𝑢 ( 𝑘 −1 ) ]
MFAC framework: 2
Δ 𝑢 ( 𝑘 −1 ) +𝜇

𝜌^ 𝜙 (𝑘)
𝑢 ( 𝑘 )=𝑢 ( 𝑘 − 1 ) +
^ 2 [ 𝑦 𝑑 ( 𝑘 +1 ) − 𝑦 ( 𝑘 ) ]
𝜙 ( 𝑘) + 𝜆
17
 Data-Driven Control with DA and FDIA

Faded channel: (Rice fading model)

The openness and unreliability of the transmission channels
random fading phenomenon on the data.
Modeled as changes in signal amplitude and phase with a
random variable.

- sensor-to-controller:

- controller-to-actuator:

18
 Data-Driven Control with DA and FDIA

Faded channel: (Rice fading model)

- sensor-to-controller:
- controller-to-actuator:

1’st order:

Gaussian SV known expectations & variance

19
 Data-Driven Control with DA and FDIA

Deception Attack (DA)

DA could invert the direction of I/O data.

- sensor-to-controller side:

system output under DA:

- controller-to-actuator side:

control input under DA:

external zero-mean Gaussian white noise

20
 Data-Driven Control with DA and FDIA

False Data Injection Attack (FDIA)

DA could invert the direction of I/O data.

- sensor-to-controller side:

actual output:

- controller-to-actuator side:

actual control input:

SV obeying the Bernoulli distribution with known statistical values.

21
 Data-Driven Control with DA and FDIA

Input and Output

sensor-to-controller side: controller-to-actuator side:

22
 Data-Driven Control with DA and FDIA

Security Data-Driven MFAC

^ ^ ( 𝑘 −1 ) + 𝜂 Δ 𝑣 ( 𝑘 −1 ) [ Δ 𝑧 ( 𝑘 ) − 𝜙
𝜙 ( 𝑘 )= 𝜙 ^ ( 𝑘 −1 ) Δ 𝑢 ( 𝑘 −1 ) ]
2
𝜇+ Δ 𝑣 ( 𝑘 −1 )

^ ^ ( 1 ) , 𝑖𝑓 |𝜙
𝜙 ( 𝑘 )= 𝜙 ^ ( 𝑘 )| ≤ 𝜀 𝑜𝑟 | Δ 𝑣 ( 𝑘− 1 )| ≤ 𝜀 𝑜𝑟 𝑠𝑖𝑔𝑛 ( 𝜙
^ ( 𝑘) ) ≠ 𝑠𝑖𝑔𝑛( 𝜙
^ ( 1 ))

^ ( 𝑘)
𝜌𝜙
𝑣 ( 𝑘 )=𝑣 ( 𝑘 − 1 ) + [ 𝑦
′
( 𝑘 +1 ) − 𝑧 ( 𝑘 ) ] , 𝑦
′
𝑑 ( 𝑘 ) =− 𝑦 𝑑 (𝑘 )
𝜆+ ^
𝑑
𝜙2 ( 𝑘 )

Theorem: For the time-varying trajectory , there exists a in security data-driven control
scheme the system tracking error is convergent monotonically.

23
 Data-Driven Control with DA and FDIA

Compensation Scheme

^ ^ ( 𝑘 −1 ) + 𝜂 Δ 𝑣 ( 𝑘 −1 ) [ Δ 𝑟 ( 𝑘 ) − 𝜙
𝜙 ( 𝑘 )= 𝜙 ^ ( 𝑘 −1 ) Δ 𝑢 ( 𝑘 −1 ) ]
2
𝜇+ Δ 𝑣 ( 𝑘 −1 )

^ ^ ( 1 ) , 𝑖𝑓 |𝜙
𝜙 ( 𝑘 )= 𝜙 ^ ( 𝑘 )| ≤ 𝜀 𝑜𝑟 | Δ 𝑣 ( 𝑘− 1 )| ≤ 𝜀 𝑜𝑟 𝑠𝑖𝑔𝑛 ( 𝜙
^ ( 𝑘) ) ≠ 𝑠𝑖𝑔𝑛( 𝜙
^ ( 1 ))

^ ( 𝑘)
𝜌𝜙
𝑣 ( 𝑘 )=𝑣 ( 𝑘 − 1 ) + [ 𝑦 𝑑 ( 𝑘 +1 ) − 𝑟 ( 𝑘 ) ]
𝜆+ ^
𝜙2 ( 𝑘 )

𝑎
compensated output 𝑟 ( 𝑘 )=𝜃−𝑦 1 𝜃 𝑦 ( 𝑘 ) 𝑦 ( 𝑘 ) +𝛼 −1
𝑦 𝛼𝑦 (𝑘) 𝑦 (𝑘)+ 𝜁 𝑦 (𝑘)

−1 −1 𝑎
compensated input 𝑐 ( 𝑘 ) = 𝜃 𝑢 𝜃 𝑢 ( 𝑘 ) 𝑣 ( 𝑘 ) + 𝛼𝑢 𝛼𝑢 ( 𝑘 ) 𝑢 ( 𝑘 ) + 𝜁 𝑢 ( 𝑘 )

24
 Data-Driven Control with DA and FDIA

Theorem: Security Data-Driven MFAC

For the time-varying trajectory , there exists a in security data-driven control scheme the
system tracking error is convergent monotonically, with the upper bound .

Theorem: Compensation Scheme

For the time-varying trajectory , there exists a in compensation data-driven control scheme
the system tracking error is convergent monotonically, with the upper bound .

25
 Data-Driven Control with DA and FDIA

Security Data-Driven MFAC vs. Compensation Scheme

 Faster convergence rate on errors

 A slower upper bound on errors

26
  Data-Driven Control with DA and FDIA

:
compensated output −1 −1 𝑎
𝑟 ( 𝑘 )= 𝜃 𝑦 𝜃 𝑦 ( 𝑘 ) 𝑦 ( 𝑘 ) +𝛼 𝑦 𝛼 𝑦 ( 𝑘 ) 𝑦 ( 𝑘 ) + 𝜁 𝑦 ( 𝑘 )

−1 −1 𝑎
compensated input 𝑐 ( 𝑘 ) = 𝜃 𝑢 𝜃 𝑢 ( 𝑘 ) 𝑣 ( 𝑘 ) + 𝛼𝑢 𝛼𝑢 ( 𝑘 ) 𝑢 ( 𝑘 ) + 𝜁 𝑢 ( 𝑘 )

should be computed from !!! Not Such as the figure …

should be computed from u !!! Not Such as the figure … 27
 Data-Driven Control with DA and FDIA

28