Revisiting a watermark-based detection scheme to handle cyber-physical attacks

Jose Rubio-Hernan (1, 2, 3) , Luca de Cicco (4) , Joaquin Garcia-Alfaro (5, 1, 2, 3)

1 TSP - RST - Département Réseaux et Services de Télécommunications
2 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
3 CNRS - Centre National de la Recherche Scientifique
4 Polytechnic University of Bari / Politecnico di Bari
5 R3S-SAMOVAR - Réseaux, Systèmes, Services, Sécurité

We address detection of attacks against cyber-physical systems. Cyber-physical systems are industrial control systems upgraded with novel computing, communication and interconnection capabilities. In this paper we reexamine the security of a detection scheme proposed by Mo and Sinopoli (2009) and Mo et al. (2015). The approach complements the use of Kalman filters and linear quadratic regulators, by adding an authentication watermark signal for the detection of integrity attacks. We show that the approach only detects cyber adversaries, i.e., attackers with the ability to eavesdrop information from the system, but that do not attempt to acquire any knowledge about the system model itself. The detector fails at covering cyber-physical adversaries, i.e., attackers that, in addition to the capabilities of the cyber adversary, are also able to infer the system model to evade the detection. We discuss an enhanced scheme, based on a multi-watermark authentication signal, that properly detects the two adversary models

Mots clés: Cyber-physical security; Critical infrastructures; Attack detection; Adversary model; Attack mitigation; Networked control system

Domaines: Cryptographie et sécurité [cs.CR]

Jose Rubio-Hernan, Luca de Cicco, Joaquin Garcia-Alfaro. Revisiting a watermark-based detection scheme to handle cyber-physical attacks. 11th International Conference on Availability, Reliability and Security (ARES 2016), Aug 2016, Salzbourg, Austria. pp.21 - 28, ⟨10.1109/ARES.2016.2⟩. ⟨hal-01449821⟩