Search

Decentralized control systems are widely used in a number of situations and applications. In order for these systems to function properly and achieve their desired goals, information must be propagated between agents. However, communication between agents entails connecting to a network, potentially allowing adversaries to infiltrate the system through the network and attack multiple agents. To increase resiliency against these attacks, it is desirable for agents to operate disconnected from the network as much as possible, only communicating with other agents when it is absolutely necessary to achieve their goal or to maintain the safety of the overall system. This in turn decreases communication costs. Previous approaches to decentralized event-triggered control are mainly concerned with minimizing communication costs and therefore assume that every agent is always connected to the network with the ability to receive any information that is sent to it. In this work, we address the issue of maintaining the safety and stability of the overall system when there is no attack but some agents may be disconnected from the network and unable to receive critical information from other agents. We design an event-triggered mechanism for network connection and communication that is a function of only local information and that ensures stability for the overall system in attack-free scenarios. An algorithm describing this communication protocol is provided, and our approach is illustrated via simulation.

Decentralized control systems exist in many scenarios where agents have the ability to fully communicate with one another but do not do so for multiple reasons, including cost and the possibility of an adversary infiltrating the system through the communication network. In this paper, we present a procedure that determines when agents should communicate with one another after having been disconnected from the network for a period of time. This procedure does not depend on the type of decentralized control system being used. When agents do communicate with one another, we guarantee the safety and resilience of the system against malicious adversaries by utilizing software rejuvenation, a prevention mechanism against unanticipated and undetectable attacks on cyber-physical systems. Without implementing any detection algorithm, the system is periodically refreshed with a secure and trusted copy of the control software to eliminate any malicious modifications to the run-time code and data that may have corrupted the controller. We present an algorithm that satisfies the conditions necessary to ensure safe recovery while agents communicate with one another. A procedure for calculating parameters that achieve these conditions is presented, and our approach is illustrated via simulation.

Software rejuvenation has been proposed as a prevention mechanism against unanticipated and undetectable attacks on cyber-physical systems. Without needing to implement any detection algorithm, the system is periodically refreshed with a secure and trusted copy of the control software to eliminate any malicious modifications to the run-time code and data that may have corrupted the controller. Previous work has considered using software rejuvenation while being able to disconnect from the network when recovering from dangerous situations. In contrast, we consider using software rejuvenation in cases where a network connection is needed in order for proper recovery to occur. We present an algorithm that satisfies the conditions necessary to ensure safe recovery in such situations where the system must become vulnerable in order to be safe. A procedure for calculating optimal parameters to achieve these conditions is presented, and our approach is illustrated via simulation.

In this paper, we consider approaches for detecting integrity attacks carried out by intelligent and resourceful adversaries in control systems. Passive detection techniques are often incorporated to identify malicious behavior. Here, the defender utilizes finely-tuned algorithms to process information and make a binary decision, whether the system is healthy or under attack. We demonstrate that passive detection can be ineffective against adversaries with model knowledge and access to a set of input/output channels. We then propose active detection as a tool to detect attacks. In active detection, the defender leverages degrees of freedom he has in the system to detect the adversary. Specifically, the defender will introduce a physical secret kept hidden from the adversary, which can be utilized to authenticate the dynamics. In this regard, we carefully review two approaches for active detection: physical watermarking at the control input, and a moving target approach for generating system dynamics. We examine practical considerations for implementing these technologies and discuss future research directions.

Data analytics promises to detect behavioral patterns, which may be used to improve decision making. However, decisions need to motivated, and they are often motivated by models. In this paper we explore the interplay between data analytics and process modeling, specifically in normative settings. We look specifically at value nets, mathematical models of the flow of money and goods, as used in accounting. Such models can be used to analyze the proportions of various flows, such as resources consumed and products produced. Such analyses can be used in the planning and control cycle, for forecasting, setting a budget, testing and possibly adjusting the budget. In other words, it can be used for adaptive normative modeling. We look in particular at a case study of a provider of public transport services for school children. The case shows that the use of value nets for analysis of proportions is (i) feasible, and (ii) useful, in the sense that it provides valuable new insights about the revenue model.