Observer-based Anomaly Diagnosis and Mitigation for Cyber-Physical Systems

Abstract

Cyber-Physical Systems (CPS) seamlessly integrate computational devices, communication networks, and physical processes. The performance and functionality of many critical infrastructures such as power, traffic, and health-care networks and smart cities rely on advances in CPS. However, higher connectivity increases the vulnerability of CPS because it exposes them to threats from both the cyber domain and the physical domain. An attack or a fault within the cyber or physical domain can subsequently affect the cyber domain, the physical domain, or both, resulting in anomalies. An attack or a fault on CPS can have serious or even lethal consequences. Traditional anomaly diagnosis techniques mainly focus on cyber-to-cyber or physical-to-physical interactions. However, in practice they can often be subverted in the face of cross-domain attacks or faults. In summary, the safety and reliability of CPS become more and more crucial every day and existing techniques to diagnose or mitigate CPS attacks and faults are not sufficient to eliminate vulnerability.

The motivation of this dissertation is to enhance anomaly diagnosis and mitigation for CPS, covering physical-to-physical and cyber-to-physical attacks or faults. With the advantage of dealing with system uncertainties and providing system state estimation, observer-based anomaly diagnosis is of great interest. The first task is to design a multiple observers framework to diagnose sensor anomalies for continuous systems. Since CPS contain both continuous and discrete variables, CPS are modeled as hybrid systems. Utilizing the relationship between the continuous and discrete variables, a conflict-driven hybrid observer-based anomaly detection method is proposed, which checks for conflicts between the continuous and discrete variables to detect anomalies. Lastly, the observer design for hybrid systems is improved to enable observer-based anomaly diagnosis for a wider class of hybrid systems.

The novel observer-based anomaly diagnosis and mitigation approaches introduced in this dissertation can not only diagnose anomalies caused by traditional faults, but also anomalies caused by sophisticated attacks. This research work can benefit the overall security of critical infrastructures, preventing disastrous consequences and reducing economic loss. The effectiveness of the proposed approaches is demonstrated mathematically and illustrated through applications to various simulated systems, including a suspension system, the Positive Train Control system and a microgrid system.