Optimal sensor design for secure cyber-physical systems

7th IFAC Workshop on Distributed Estimation and 7th IFAC Workshop on Distributed Estimation and Control Networked 7th IFACin Workshop onSystems Distributed Estimation Availableand online at www.sciencedirect.com Control Networked 7th IFACin onSystems Distributed and Chicago, IL, USA, September 16-17,Estimation 2019 Control inWorkshop Networked Systems Chicago, IL, USA, September 16-17, 2019 Control in Networked Systems Chicago, IL, USA, September 16-17, 2019 Chicago, IL, USA, September 16-17, 2019

ScienceDirect

IFAC PapersOnLine 52-20 (2019) 387–390

Optimal sensor design for secure Optimal sensor design for secure Optimal sensor design for secure cyber-physical systems Optimal sensor design for secure cyber-physical systems cyber-physical systems cyber-physical systems 2 ∗ 1

Mohamed Mohamed Ali Ali Belabbas Belabbas1 ,, Xudong Xudong Chen Chen2 ∗ Mohamed Ali Belabbas11 , Xudong Chen22 ∗∗ Mohamed Ali Belabbas , Xudong Chen ∗ ∗ Coordinated Science Laboratory, University of Illinois at ∗ Coordinated Science Laboratory, University of Illinois at Universityand of Illinois at Urbana-Champaign, IL, USA Computer ∗ Coordinated Science Urbana-Champaign, IL,Laboratory, USA and and Electrical Electrical and Computer Coordinated Science Laboratory, UniversityCO, of Illinois at Urbana-Champaign, IL, USA and Electrical and Computer Engineering Department, CU Boulder, USA Engineering Department, CU Electrical Boulder, CO, Urbana-Champaign, IL, USA and and USA Computer Engineering Department, CU Boulder, CO, USA Engineering Department, CU Boulder, CO, USA

Abstract: Abstract: Abstract: The vision vision of of secure secure cyber-physical cyber-physical systems systems requires requires to to develop develop aa new new array array of of tools tools to to prevent, prevent, The Abstract: The vision of secure cyber-physical systems requires to develop a new array of tools to prevent, monitor for, and recover from a wide variety of potential attacks to a system. We contribute to monitor for,ofand recover from a wide varietyrequires of potential attacksa to a system. contribute to The vision secure cyber-physical systems to develop new array of We tools to injection prevent, monitor for,here and recover from athe wide varietyofof optimal potential attacks to a system. We contribute to this vision by addressing problem sensor design for detection of this vision here by addressing problem ofof optimal sensor design for detection of injection monitor for, and recover from athe wide variety potential attacks tooutput a system. We contribute to this vision here by addressing the problem of optimal design for detection of injection attacks. More precisely, we consider an attack in which whichsensor sensor is corrupted, corrupted, and we we attacks. More precisely, we consider an attack in aa sensor output is and this vision here by addressing the problem of optimal sensor design for detection of injection attacks. More precisely, we consider anin in which a sensor output is corrupted, we have at at our our disposal sensor deployed inattack an ad-hoc ad-hoc fashion and thus thus is secure. secure. How to toand design have disposal aa sensor deployed an fashion and is How design attacks. More precisely, we consider an attack inofwhich a sensor output is corrupted, and we have at our disposal a sensor deployed in an ad-hoc fashion and thus is secure. How to design the sensor so that we maximize the probability detection of such an injection attack? We the sensor sodisposal that wea maximize the probability of detection of such an injection attack? We have at our sensor deployed in an ad-hoc fashion and thus is secure. How to design the sensor so that we maximize the probability of detection of such an injection attack? We pose the the problem problem here here as as an an hypothesis hypothesis test, test, describe describe an an optimization optimization problem problem that that the the optimal optimal pose the sensor sotothat we as maximize the probability of analytic detection of suchin ana particular injection attack? We pose the problem here an furthermore hypothesis test, describe an optimization problem that the optimal sensor needs satisfy, and furthermore obtain the solution case. sensor needs to satisfy, and obtain the analytic solution in a particular case. pose the problem here as an hypothesis test, describe an optimization problem that the optimal sensor needs to satisfy, and furthermore obtain the analytic solution in a particular case. sensor needs to The satisfy, andPublished furthermore obtain the solution in a particular case. Copyright © 2019. Authors. by Elsevier Ltd. Allanalytic rights reserved. Keywords: Sensor Sensor design, design, Secure Secure sensing, sensing, Neyman-Pearson Neyman-Pearson test, test, Cyber-physical Cyber-physical systems systems Keywords: Keywords: Sensor design, Secure sensing, Neyman-Pearson test, Cyber-physical systems Keywords: Sensor design, Secure sensing, Neyman-Pearson test, Cyber-physical systems 1. INTRODUCTION INTRODUCTION Hatano 1. Hatano et et al. al. [2005], [2005], Zelazo Zelazo and and Mesbahi Mesbahi [2011]. [2011]. These These Hatano et al. [2005], Zelazo andrelating Mesbahi [2011]. These 1. INTRODUCTION works provided analysis results the performance works provided analysis results relating the[2011]. performance 1. INTRODUCTION Hatano et al. [2005], Zelazo and Mesbahi These works provided analysis results relating the performance of these systems to the underlying network structure We consider consider here here the the optimal optimal placement placement of of sensors sensors to to of these systems to the underlying network structure using using We works provided analysis results relating the performance of these systems to themeasure underlying network structure using an H Xiao et al. [2007], Zelazo We consider here the optimal placement of sensors to detect intrusive signals in control systems. In general, one 2 performance an H performance measure Xiao et al. [2007], Zelazo detect intrusive signals in controlplacement systems. Inofgeneral, one 2 systems to the underlying network structure using of these We consider here the in optimal sensorsone to an H performance measure Xiao et al. [2007], Zelazo and Mesbahi [2011], Bamieh et al. [2012], Patterson and detect intrusive signals control systems. In general, 2 design sensors to maximize the quality of the estimate of andHMesbahi [2011], Bamieh al. [2012], and design intrusive sensors tosignals maximize the quality of the estimateone of an measure et et al. Patterson [2007], Zelazo detect in control systems. In general, 2 performance and Mesbahi [2011], Bamieh etXiao al. [2012], Patterson and Bamieh [2011]. design sensors to maximize the quality of the estimate of a signal of interest, and work done in Belabbas [2016], Bamieh [2011]. a signal of interest, and work done in Belabbas [2016], and Mesbahi [2011], Bamieh et al. [2012], Patterson and design sensors to maximize the quality of the estimate of Bamieh [2011]. aChen signal of interest, and work done in Belabbas [2016], [2018] showed showed that that this this problem problem is is tractable tractable in in some some For studies with a focus on sensor design, we mention Sayin Chen [2018] Bamieh [2011]. a signal of interest, and work done in Belabbas [2016], studies with a focus on sensor design, we mention Sayin Chen [2018] showed that this problemin tractable in some For regimes. Here, we consider consider situations iniswhich which one suspects suspects studies with awhere focus secure on sensor design, we mention Sayin regimes. Here, we situations one and Ba¸ sensor design under Chen [2018] showed that this problem iswhich tractable insignal some For and studies Ba¸ssar ar [2017] [2017] secure sensor design under channel channel regimes. Here, we consider situations in one suspects that a sensor may be breached and subject to For with awhere focus on sensor design, we mention Sayin that a sensor may be breached and subject to signal and Ba¸ s ar [2017] where secure sensor design under channel tampering is studied from a game theoretic point of view. regimes. Here, we consider situations in which one suspects tampering is studied from a game theoretic point of view. that a sensor may be breached and subject to signal injection. How could we detect such a sensor attack? The and Ba¸ s ar [2017] where secure sensor design under channel injection. How could we detect such a sensor attack? The tampering is studied from a game theoretic point of view. In Fawzi et al. [2011], the authors investigate the problem that a sensor may be breached and subject to signal In Fawzi et al. [2011], the authors investigate the problem injection. How could we detect such a sensor attack? The type of of scenarios scenarios we we have have in in mind mind is is the the following: following: consider consider tampering isal.studied from awhen gamesensors theoretic point ofattack. view. type In Fawzi et [2011], the authors investigate the problem of state estimations in CPS are under injection. How could we detect such a sensor attack? The of state estimations in the CPSauthors when sensors are under attack. type of scenarios we by haveaa inlinear mind dynamics is the following: a plant plant described by linear dynamics with consider additive In Fawzi et al. [2011], investigate the problem a described with additive of state estimations in CPS when sensors are under attack. For other game-theoretic approaches, we refer to type of scenarios have mind isthe the following: consider Forstate other game-theoretic approaches, weare refer to Li Li et et al. al. aGaussian plant described by a inlinear additive of Gaussian noise. we The state x of ofdynamics plantwith is observed observed estimations in CPS when sensors under noise. The state x the plant is For other game-theoretic approaches, we refer to Liattack. et al. [2017] and Saad et al. [2011], where cooperation among a plant described by a linear dynamics with additive [2017] and Saad et al. [2011], where cooperation among Gaussian noise. The state x of the plant is observed through p linear sensors C x, subject to sensor noise, and For other game-theoretic approaches, we refer to Li et al. i through p noise. linear sensors Ci x,xsubject toplant sensorisnoise, and [2017] Saad al. [2011], where cooperation among wirelessand nodes has been recently proposed for Gaussian The state of the observed nodes haset been recently proposed for improving improving through p output linear sensors Cisensors, x, subject to sensor noise, and wireless from the of these a Kalman-Bucy filter [2017] and Saad et al. [2011], where cooperation among from thep output of these a to Kalman-Bucy wireless nodes hassecurity been recently proposed for improving layer of transmission in through linear sensors Cisensors, x, subject sensor noise,filter and the the physical physical layer of wireless wireless transmission in the the from the x these sensors, a One Kalman-Bucy estimate ˆ of state is has to nodes hassecurity been recently proposed for improving estimate x ˆoutput of the the of state is obtained. obtained. One has access access filter to aa wireless the physical layer security of wireless transmission in the presence of multiple eavesdroppers. Taking the point of from the output of these sensors, a Kalman-Bucy filter presence of multiple eavesdroppers. Taking the point of estimate x ˆ of the state is obtained. One has access to a secured sensor, this sensor can be built in the plant or can the physical layer security of wireless transmission in secured sensor, thisstate sensor can be built in the plant orto cana presence of attacker, multiple the eavesdroppers. Taking the[2015] pointthe of view of the authors of Kim et al. use estimate x ˆ of the is obtained. One has access view of the attacker, the authors of Kim et al. [2015] use secured sensor, this sensor can be built in the plant or can be set-up in an ad-hoc fashion when one suspects an attack presence of multiple eavesdroppers. Taking the point of be set-upsensor, in an ad-hoc fashion when one in suspects an attack view of the attacker, the authors of Kim et al. [2015] use data driven, subspace methods to design attacks on state secured this sensor can be built the plant or can data driven, subspacethe methods to of design attacks on state be set-up in an ad-hoc fashion when one suspects an attack is taking place for example. The general question we ask view of the attacker, authors Kim et al. [2015] use data driven, subspace methods to design attacks on state is taking place for example. The general question ask estimators. be set-up in an ad-hoc fashionbest when one suspects anwe attack estimators. is taking for example. The general question then the following: how design the sensors of the driven, subspace methods to design attacks on state is then theplace following: how to to best design the sensorswe of ask the data estimators. is taking place for example. The general question we ask is then the following: how to best design the sensors of the plant and the secure sensor to maximize the probability estimators. plant secure how sensor to maximize probability is thenand the the following: to best design thethe sensors of the plant and the sensor to maximize the probability of of a injection, while the 2. of detection detection of secure a signal signal injection, while keeping keeping the false false 2. PROBLEM PROBLEM FORMULATION FORMULATION plant and the secure sensor to maximize the probability of detection of a signal injection, while keeping the false 2. PROBLEM FORMULATION alarm rate (deciding there is an attack when no attack is alarm rate (deciding there is an attack when no attack is of detection of a signal injection, while keeping the false 2. PROBLEM FORMULATION alarm rate (deciding an attack when no attack is We now give a general problem taking place) under given value? statement, taking place) under aathere givenis value? We now give a general problem statement, of of which which only only a a alarm rate (deciding there is an attack when no attack is taking place) under a given value? We now give a general problem statement, of which only a particular case will be solved below. Consider the control Common control theoretic approaches to security are often particular case will be solved below. Consider the control taking place) under a given value? We now give a general problem statement, of which only Common control theoretic approaches to security are often particular case will be solved below. Consider the controla with observation: Common control theoretic approaches totools security arerobust often system related to notions of robustness using from system with observation: particular case will be solved below. Consider the control  related to notions of robustness using tools from robust Common theoretic approaches totools security arerobust often system  with observation: related tocontrol notions of robustness using from dx = Axdt control theory Bamieh et al. [1999], Dullerud and Paganini  system with observation:  dx = Axdt + + Budt Budt + + dw, dw, control theory Bamieh et al. [1999], Dullerud and Paganini  related to notions of[2013], robustness using toolstolerance from robust dx0 = =C Axdt + Budt + dw, control theory Bamieh et al.or [1999], Dullerud and Paganini  [2000], Doyle et al. that of fault and  xdt + dv , dy (1) 0 xdt+ 0 , + dw, [2000], Doyle et al. [2013], or that Dullerud of fault tolerance and = C + dv dy (1) dx Axdt Budt control theory Bamieh et al. [1999], and Paganini 0 0 0   [2000], Doyle et al. [2013], or that of fault tolerance and the study of fault detection and isolation in dynamical = C xdt + dv , dy (1)  0 0 0 = C xdt + dv + s dt, ∀i = 1, . . . , p, dy the study of fault detection and isolation in dynamical i i i i [2000], Doyle et al. [2013], or that of fault tolerance and  = C xdt + dv + s dt, ∀i = 1, . . . , p, dy dy0i (1) i xdt + dvi0 , i 0 the studyIn ofthis faultcontext, detection and isolation in dynamical systems. significant attention has been = C xdt + dv + s dt, ∀i = 1, . . . , p, dy systems. In this context, significant attention has been  i i i i the study ofthis faultcontext, detection and isolation in dynamical is the measurement output from the secured where yy0 (t) = C xdt + dv + s dt, ∀i = 1, . . . , p, dy systems. In significant attention has been placed on distributed averaging protocols (consensus) cori i i i (t) is the measurement output from the secured where 0 placed on In distributed averaging protocols (consensus) cor- where systems. this context, significant attention has been is theyyimeasurement thethe secured (t)’s, = ,, p, mea0 (t)other placed on distributed averaging protocols (consensus) cor- sensor rupted by noises et Das et sensor yyand and other (t)’s, for for all all ii output = 1, 1, .. .. ..from p, are are the meaimeasurement rupted on bydistributed noises Xiao Xiao et al. al. [2007], [2007], Das et al. al. [2010], [2010], is theyfrom output from theThroughsecured where 0 (t) placed averaging protocols (consensus) corsensor and other (t)’s, for all i = 1, . . . , p, are the meaoutputs the sensors of the plant. i rupted by noises Xiao et al. [2007], Das et al. [2010], surement surement outputs from the sensors of the plant. Throughsensor and other yfrom for all A i =isof1, . . . ,plant. p,soare theameai (t)’s,the rupted by noises Xiao et al. [2007], Das et al. [2010], surement outputs sensors the Throughout the paper, we assume that stable, that 1 [email protected], 2 [email protected]. M.-A. Belabout the paper, we from assume A isofstable, so that a pair pair 1 [email protected], 2 [email protected]. M.-A. Belabsurement outputs thethat sensors the plant. Throughout theis paper, wedetectable assume that A is stable, so The that a pair (A, C) always Brockett [2015]. signals 2 [email protected]. bas1 [email protected], would like to acknowledge the support of grant M.-A. NSF ECCSBelab(A, C) is always detectable Brockett [2015]. The signals bas1 [email protected], would like to acknowledge the support of grant M.-A. NSF ECCSout the paper, we assume that A is stable, so that a pair 2 [email protected]. Belab(A, C) injection is alwaysattacks detectable [2015]. Theproblem signals ssi are (and ssi can be 0). 1809076. Chen like to the acknowledge support grant bas wouldX.like to would acknowledge support ofthe grant NSFofECCSinjection attacks (andBrockett 0). The The problem 1809076. X.like Chen would like to the acknowledge the support ofECCSgrant i are i can be (A, C) is always detectable Brockett [2015]. The signals bas would to acknowledge support of grant NSF si are betwo-fold: 0). The (1) problem NSF ECCS-1809315. we are concerned with the How 1809076. X. Chen would like to acknowledge the support of grant i can is NSF ECCS-1809315. we are injection concernedattacks with in in(and the sspaper paper is How si are betwo-fold: 0). The (1) problem 1809076. X. Chen would like to acknowledge the support of grant i can is NSF ECCS-1809315. we are injection concernedattacks with in(and the paper two-fold: (1) How NSF ECCS-1809315. we are concerned with in the paper is two-fold: (1) How 2405-8963 Copyright © 2019. The Authors. Published by Elsevier Ltd. All rights reserved.

Copyright © 2019 IFAC 387 Copyright © under 2019 IFAC 387 Control. Peer review responsibility of International Federation of Automatic Copyright © 2019 IFAC 387 10.1016/j.ifacol.2019.12.186 Copyright © 2019 IFAC 387

2019 IFAC NecSys 388 Mohamed Ali Belabbas et al. / IFAC PapersOnLine 52-20 (2019) 387–390 Chicago, IL, USA, September 16-17, 2019

where we assume, without loss of generality, that B = 0 in Eq. (1). Now, let ˆ0 (t). (3) z(t) := x ˆ1 (t) − x Note that z(t) is a Gaussian random variable, whose mean and variance can be computed as follows:

Noise

Controller

x ˆ

u

Estimator

System

x

Absence of injection attack: In this case, we have that s1 (t) ≡ 0 and it should be clear that the mean of z(t) is 0 in steady-state: Ez(t) ≡ 0. (4) The covariance of z(t) (in steady-state as well) is given by (5) cov(z(t)) = Σ0 + Σ1 . To see this, we note that

Sensor Intrusion Noise

x ˆ0

Estimator

corrupted/ secure

Ad-hoc Sensor Noise

Fig. 1. If an attack is suspected, an ad-hoc sensor (in green) or secure sensor can be used to form an estimate x ˆ0 of the state that is compare to the estimate x ˆ. We derive the sensor and decision rule that yield the highest detection rate of attacks. can we utilize the secured sensor to detect injection attacks? We will propose an approach below which compares the Kalman-Bucy filter estimates of the states using the secured sensor and the sensors of the plant. Of course, always declaring that the system is under attack will yield a perfect detection rate; however, it is likely to also result in a very high false alarm rate. Hence, one needs to set a bound on a maximum allowable false alarm rate. This results in a standard Neyman-Pearson test; (2) Based on the proposed approach, how can we design all the sensors C0 , . . . , Cp (of fixed norm) to maximize the detection rate of injection attacks under a given false alarm rate. The rationale behind (1) is that given sensor signals yi , most algorithms will run a Kalman-Bucy filter to obtain an estimate x ˆ to be used for monitoring or control purposes, and thus this estimate will be readily available in most practical situations. The rational behind (2) is the realization that not all sensors are the same when it comes to detecting an injection attack, and thus given the freedom to design a sensor, one should seek the one that maximizes the detection rate for a given false alarm rate. 2.1 Detection approach We now elaborate on technical details of the above mentioned detection approach. For ease of presentation, we will consider the special case where p = 1, i.e., there is only one sensor of plant. As is argued above, we will compare two Kalman-Bucy filter estimates x ˆ0 (t) and x ˆ1 (t), which use y0 (t) and y1 (t) respectively. More specifically, since A is stable, both (A, C0 ) and (A, C1 ) are detectable. Then, it is well known that x ˆ0 (t) and x ˆ1 (t), for t sufficiently large (so that the asymptotic regime is considered), are given by the following:  xi dt + Σi Ci (dyi − Ci x ˆi dt) dˆ xi = Aˆ (2)   0 = AΣi + Σi A + I − Σi Ci Ci Σi 388

x0 (t) − x(t)) z(t) = (ˆ x1 (t) − x(t)) − (ˆ := e1 (t) − e0 (t), where ei (t) is the estimation error of each Kalman-Bucy filter estimate and it obeys the following differential equation: dei = (A − Σi Ci Ci )ei + Σi Ci dvi , ∀i = 0, 1, (6) From (6), we see that e0 (t) and e1 (t) are independent random variables; hence, the covariance of z(t) is the sum of the covariances of e0 (t) and e1 (t). Presence of injection attack: The injection attack can be either deterministic or stochastic, but we assume in the latter case that s1 (t) is independent of vi (t). Compared to the previous case, the effect of s1 (t) on the z(t) is to shift the mean of z(t) to Ez(t) = Σ1 C1 Es1 (t), and the covariance of z(t) to

(7)

cov(z(t)) = Σ0 + Σ1 + var(s1 (t))Σ1 C1 C1 Σ1 . Of course, when s1 (t) is deterministic, then cov(s1 (t)) = 0 and, hence, cov(z(t)) will be reduced to Σ1 + Σ0 which is the same as the covariance in the previous case. The general case can be hard to tackle. We focus in the paper on a simple case where the injection attack (8) s1 (t) ≡ s is constant. Such an assumption significantly simplifies the detection problem. On the other hand, the simplification helps illustrate the optimal sensor design problem, which is the main focus of the paper. To this end, we now recall the Neyman-Pearson test: Background: Neyman-Pearson test: We denote by H0 the hypothesis that there is no injection attack on the sensor, and by H1 the hypothesis that there is an injection attack. An attack detector is then a binary function I(z(t)) which takes the value 1 when we believe that H1 is true, and 0 otherwise. The detection rate D of I is then D := P(I(z(t)) = 1 | H1 is true), and the false alarm rate F is F := P(I(z(t)) = 1 | H0 is true). Set 0 < α < 1 to be the maximal allowable false detection rate; we seek to find Λ so that D is maximized with F ≤ α. The Neyman-Pearson lemma Neyman and Pearson [1933] states that the above optimum is obtained by comparing the ratio of likelihood of both hypotheses with a threshold

2019 IFAC NecSys Mohamed Ali Belabbas et al. / IFAC PapersOnLine 52-20 (2019) 387–390 Chicago, IL, USA, September 16-17, 2019

determined by the false alarm rate. To be more specific, let λi be the likelihood that Hi is true given z(t): λi := P(Hi is true | z(t)). Now set Λ(z) to be the ratio of these likelihoods: λ0 . Λ(z) := λ1 The Neyman-Pearson lemma states that there exists a threshold η so that setting  0 if Λ(z(t)) ≥ η, I(z(t)) = 1 otherwise. yields the optimal detector. Furthermore, η is obtained by solving the equation α = P(Λ(z) ≤ η | H0 is true). Sensor design for attack detection: We now formulate in precise terms what the optimal sensor design for attack detection is. Given the false alarm rate F , the detection rate D will depend on the the sensors C0 and C1 . We maximize the detection rate through an optimal design of the two sensors. We can obtain the following theorem, whose proof we omit here due to space constraints: Theorem 2.1. Consider the Neyman-Pearson test described above with given false alarm rate F . Set Φ : (C0 , C1 ) → C1 Σ1 (Σ0 + Σ1 )−1 Σ1 C1 . Then the sensors C0∗ , C1∗ of unit norm that maximize the detection rate D are (C0∗ , C1∗ ) = arg max Φ(C0 , C1 ), Ci =1

2.2 A conjecture and an analytic solution

We take here a different approach, which relies mostly on matrix analysis. However, at the stage, we cannot handle the most general case. We can only provide a complete solution to the special case where A is symmetric. We summarize below the main result: Theorem 2.2. Let A ∈ Rn×n be stable and symmetric. Let 0 > λ1 ≥ · · · ≥ λn be the eigenvalues of A and v1 , . . . , vn be the corresponding eigenvectors of unit length. Then, arg max Φ(C) = v1 , C=1

and max Φ =

C=1

2(

1  . λ21 + 1 − λ1 )

We note that Theorem 2.2 can be straightforwardly generalized to the case where C = r is arbitrary: The optimal C is aligned with v1 , and maxC=r Φ becomes max Φ =

r2  . 2( λ21 + r2 − λ1 )

(9)

3. CONCLUSION AND OUTLOOK

The above theorem provides a strong characterization of the optimal sensors, using which, numerical simulations can be performed. The numerical solutions led us to the following conjecture: Conjecture 2.1. The optimal sensor placement for injection attack detection is so that C1∗ = C0∗ . More precisely, arg max Φ(C0 , C1 ) = arg max Φ(C, C). Ci =1

geometric approach to tackle the problem is to derive the gradient flow of the cost function Φ over the space of rank-one matrices {CC  | C = 1} and investigate the equilibrium points of the gradient flow. These equilibrium points necessarily include the global minimum point. Of course, a significant amount of efforts will be made to analyze these equilibrium points and decided which one could be a local/global minimum point. More details of such an approach can be found in Belabbas [2016] and Chen [2018].

C=r

where Σi satisfy the ARE in Eq. (2).

389

C=1

The conjecture is more or less natural: in order to decide whether the sensor C1 has been affected by an injection attack, it is better to compare it to a similar sensor C0 which is likely to yield a measurement output y0 (t) that is statistically similar to y1 (t). However, this is not apparent from the expression of the optimal sensor given in Theorem 2.1 since there, the roles of C0 and C1 are not symmetric, i.e. Φ(C0 , C1 ) is not necessarily equal to Φ(C1 , C0 ). We will assume in the sequel that Conjecture 2.1 is true. For ease of notation, we let C := C0 = C1 and since C0 = C1 , it follows that Σ0 = Σ1 =: Σ. Consequently, the expression of Φ can be simplified as follows: Φ(C) := CΣC  /2. We note again that Σ depends on C through the algebraic Riccati equation. Our goal now is to maximize the above Φ(C) over C = 1. The optimization problem is still hard to solve. A 389

Cyber-physical systems are subject, by their very nature, to a wide variety of potential attacks, and it is not always easy of possible to prevent or predict such attacks. In these cases, monitoring the system to detect anomalous behaviors is of the utmost importance, since early detection can help avoid catastrophic failure. Hence, finding methods that provide the best detection rate of attacks is thus similarly of the utmost importance. We addressed this problem in this paper in the case of an injection attack on a sensor, and provided an expression for optimal sensors (optimal in the sense that they maximize the detection rate given a bound on the false alarm rate). Furthermore, we gave an explicit solution to the problem in a particular case, showing that the optimal placement problem reduced to an eigen-problem, and provided a conjecture as to the general case. The analysis performed here is however still limited to the case of a unique sensor, and it would be of course quite important to extend it to the case of several sensors. Furthermore, the optimization problem here only addresses injection attack detection, ignoring the quality of the sensor for estimation of the state of the system, its primary purpose. Obtaining sensors which balance these two objectives, namely quality of estimation and attack detection rate, is also an important problem which we believe the techniques outlined here would allow us to solve.

2019 IFAC NecSys 390 Mohamed Ali Belabbas et al. / IFAC PapersOnLine 52-20 (2019) 387–390 Chicago, IL, USA, September 16-17, 2019

REFERENCES Bamieh, B., Jovanovic, M.R., Mitra, P., and Patterson, S. (2012). Coherence in Large-Scale Networks: DimensionDependent Limitations of Local Feedback. IEEE Transactions on Automatic Control, 57(9), 2235–2249. Bamieh, B., Paganini, F., and Dahleh, M.A. (1999). Optimal control of distributed arrays with spatial invariance, volume 245 of Lecture Notes in Control and Information Sciences, chapter 24, 329–343. Springer London, London. Belabbas, M.A. (2016). Geometric methods for optimal sensor design. Proceedings of the Royal Society, Series A Math Phys Eng Sci, 472(2185), 20150312. Brockett, R.W. (2015). Finite dimensional linear systems, volume 74. SIAM. Chen, X. (2018). Joint actuator-sensor design for stochastic linear systems. In 2018 IEEE Conference on Decision and Control (CDC), 6668–6673. IEEE. Das, A., Hatano, Y., and Mesbahi, M. (2010). Agreement over noisy networks. IET Control Theory & Applications, 4(11), 2416. Doyle, J.C., Francis, B.A., and Tannenbaum, A.R. (2013). Feedback control theory. Courier Corporation. Dullerud, G. and Paganini, F. (2000). A course in robust control theory: a convex approach. Springer-Verlag, New York. Fawzi, H., Tabuada, P., and Diggavi, S. (2011). Secure state-estimation for dynamical systems under active adversaries. In Communication, Control, and Computing (Allerton), 2011 49th Annual Allerton Conference on, 337–344. IEEE. Hatano, Y., Mesbahi, M., and Das, A. (2005). Agreement in presence of noise: pseudogradients on random geometric networks. In 44th IEEE Conference on Decision and Control, 2005, 6382–6387. Seville, Spain. Kim, J., Tong, L., and Thomas, R.J. (2015). Subspace methods for data attack on state estimation: A data driven approach. IEEE Trans. Signal Processing, 63(5), 1102–1114. Li, Y., Quevedo, D.E., Dey, S., and Shi, L. (2017). A gametheoretic approach to fake-acknowledgment attack on cyber-physical systems. IEEE Transactions on Signal and Information Processing over Networks, 3(1), 1–11. Neyman, J. and Pearson, E.S. (1933). Ix. on the problem of the most efficient tests of statistical hypotheses. Philosophical Transactions of the Royal Society of London. Series A, Containing Papers of a Mathematical or Physical Character, 231(694-706), 289–337. Patterson, S. and Bamieh, B. (2011). Network Coherence in Fractal Graphs. In Proc. 50th IEEE Conference on Decision and Control, 6445–6450. Orlando, FL. Saad, W., Han, Z., Ba¸sar, T., Debbah, M., and Hjørungnes, A. (2011). Distributed coalition formation games for secure wireless transmission. Mobile Networks and Applications, 16(2), 231–245. Sayin, M.O. and Ba¸sar, T. (2017). Secure sensor design for cyber-physical systems against advanced persistent threats. In International Conference on Decision and Game Theory for Security, 91–111. Springer. Xiao, L., Boyd, S., and Kim, S. (2007). Distributed average consensus with least-mean-square deviation. Journal of Parallel and Distributed Computing, 67, 33–46. doi: 10.1016/j.jpdc.2006.08.010. 390

Zelazo, D. and Mesbahi, M. (2011). Edge Agreement: Graph-Theoretic Performance Bounds and Passivity Analysis. IEEE Transactions on Automatic Control, 56(3), 544–555.