Search

The problem considered in this paper is dual to the control problem for over-actuated systems found in the literature. We show that, due to a certain notion of weak output redundancy, there always exists an unobservability subspace containing the input subspace, which ensures that the original system can be partitioned into two subsystems, one of which is not affected by actuator faults. We use this fact to estimate the disturbance and the fault in a cascaded fashion: we first design a discrete-time filter on a properly designed residual signal, that can reconstruct the disturbance. The estimated disturbance can then be used to perform fault detection and estimation in a cascaded fashion. A numerical example verifies the efficacy of the proposed strategy.

We address state estimation in the presence of faults and unknown disturbances combining unknown input observers (UIOs) and sliding mode observers. We consider a well-established UIO design for linear time-invariant systems and augment it with a nonlinear sliding mode action. This latter term deals with matched disturbances affecting the actuation channels, such as actuator faults, while the UIO provides geometric decoupling from the remaining exogenous inputs. We thoroughly present the analysis of the proposed observer, together with existence conditions stemming from the joint design. We also investigate how our design geometrically relates with other known results in the field of unknown-input state estimation, and discuss its benefits and pitfalls. An advantage of our design is that it allows reconstruction of the fault in finite time, under just boundedness assumptions, while other disturbances are rejected by the UIO. Numerical simulations show the effectiveness of the proposed method.

The paper deals with the key problem of detecting cyber-attacks in the context of large-scale systems (LSS). As these systems grow in size and complexity, cyber-attacks may target limited parts of the LSS, leading to tackling the problem in a decentralized way. We analyze the properties of distributed detection schemes under both local and interconnection attacks, and show that they are vulnerable to attacks that exploit the structure of the interconnections between subsystems. We also provide conditions and strategies that may be adopted to make the distributed control architecture regulating the LSS robust to this class of cyber-attacks.

Distributed detection of covert attacks for linear large-scale interconnected systems is addressed in this article. Existing results consider the problem in centralized settings. This article focuses on large-scale systems subject to bounded process and measurement disturbances, where a single subsystem is under a covert attack. A detection methodology is proposed, where each subsystem can detect the presence of covert attacks in neighboring subsystems in a distributed manner. The detection strategy is based on the design of two model-based observers for each subsystem using only local information. An extensive detectability analysis is provided and simulation results on a power network benchmark are given, showing the effectiveness of the proposed methodology for the detection of covert cyber-attacks.

Ubiquity of embedded computers and network connectivity have made control systems vulnerable to potential cyber-attacks. This has become a relevant problem after real-world cyber-security breaches targeting automation equipment, and notable research effort has been made in order to model such attacks and to render these systems more secure. However, particularly resourceful agents can design attacks that cannot be detected by existing monitoring system, and are therefore called stealthy. In this work, we address the case when these attacks are deployed on part of a Large-Scale System (LSS), which can be partitioned into a collection of Linear Time Invariant (LTI) systems. We provide a local characterisation of stealthy attacks for LSSs, including modelling in the state-space domain, analysis of the way physical interconnections affect detectability, and control resilience. For detectable attacks, we develop a general detection method that is distributed and scalable by design, as it relies only on neighbour-to-neighbour communication. The core principle is that, if one system is misbehaving, its neighbours can exploit the physical coupling to reveal such otherwise stealthy anomaly. Of this general idea, we devise two different implementations, depending on the types of disturbances affecting the system, namely disturbances with known bounds and stochastic Gaussian noise. In both cases, we design a residual generator which is sensitive to attacks in neighbouring systems, and provide theoretical analysis of its detection capabilities. Next, we give additional insights on the isolation properties ensuing our proposed methodology, obtaining conditions under which it is feasible. We prove that there are, in fact, some system topologies that do not allow for attack isolation. For those cases, we suitably augment the proposed detection algorithm and show that it is possible to isolate attacks in all cases, at the price of increased communication complexity. Isolation is a necessary step to allow for accommodation of the considered class of attacks. By this, we mean the design of an attack-tolerant control system that can counterbalance an attack’s effects once one is detected. Finally, in the last part of this work, we present early results in the disturbance-free case on how accommodation can be implemented. We provide existence conditions depending on the structure of the interconnections, and propose an algorithm that covers all cases. Each one of the methods proposed in this work is accompanied by a simulation example that demonstrates its effectiveness. Open Access

The design of a distributed architecture for the detection of covert attacks in interconnected Cyber-Physical Systems is addressed in this paper, in the presence of stochastic uncertainties. By exploiting communication between neighbors, the proposed scheme allows for the detection of covert attacks that are locally stealthy. The proposed methodology adopts a decentralized filter, jointly estimating the local state and the aggregate effect of the physical interconnections, and uses the communicated estimates to obtain an attack-sensitive residual. We derive some theoretical detection properties for the proposed architecture, and present numerical simulations.

Monitoring systems are essential to understand and control the behaviour of systems and networks. Cyber-physical systems (CPS) are particularly delicate under that perspective since they involve real-time constraints and physical phenomena that are not usually considered in common IT solutions. Therefore, there is a need for publicly available monitoring tools able to contemplate these aspects. In this poster/demo, we present our initiative, called CPS-MT, towards a versatile, real-time CPS monitoring tool, with a particular focus on security research. We first present its architecture and main components, followed by a MiniCPS-based case study. We also describe a performance analysis and preliminary results. During the demo, we will discuss CPS-MT’s capabilities and limitations for security applications.