[Paper Review] Secure Sensor Design Against Undetected Infiltration: Minimum Impact-Minimum Damage

Muhammed O. Sayin, Tamer Başar|arXiv (Cornell University)|Jan 5, 2018

Smart Grid Security and Resilience18 references3 citations

TL;DR

This paper proposes a game-theoretic secure sensor design framework for cyber-physical systems to minimize damage from undetected controller infiltration by optimizing sensor outputs in advance. Using semi-definite programming, the method computes optimal linear sensor strategies that reduce expected quadratic cost under adversarial control objectives, achieving up to 40% performance improvement over classical schemes even under inaccurate statistical perception.

ABSTRACT

We propose a new defense mechanism against undetected infiltration into controllers in cyber-physical systems. To this end, we cautiously design the outputs of the sensors that monitor the state of the system. Different from the defense mechanisms that seek to detect infiltration, the proposed approach seeks to minimize the damage of possible attacks before they have been detected. Controller of a cyber-physical system could have been infiltrated into by an undetected attacker at any time of the operation. Disregarding such a possibility and disclosing system's state without caution benefits the attacker in his/her malicious objective. Therefore, secure sensor design can improve the security of cyber-physical systems further when incorporated along with other defense mechanisms. We, specifically, consider a controlled Gauss-Markov process, where the controller could have been infiltrated into at any time within the system's operation. In the sense of game-theoretic hierarchical equilibrium, we provide a semi-definite programming based algorithm to compute the optimal linear secure sensor outputs and analyze the performance for various scenarios numerically.

Motivation & Objective

• Address the critical gap in securing cyber-physical systems against advanced persistent threats that remain undetected during controller infiltration.
• Formally model the interaction between a secure sensor designer and an adversarial controller as a hierarchical Stackelberg game with distinct objectives.
• Design linear sensor outputs in advance to minimize the worst-case impact of undetected attacks, even when the controller is compromised at any time during operation.
• Ensure robustness against inaccurate perception of system statistics by the sensor designer while maintaining strong performance gains over classical schemes.
• Provide a computationally tractable solution via semi-definite programming for optimal secure sensor strategy computation under linear Gaussian dynamics.

Proposed method

• Model the system as a controlled Gauss-Markov process with linear Gaussian dynamics and assume the controller may be infiltrated at any time.
• Formulate the problem as a hierarchical Stackelberg game where the sensor designer commits to a linear sensor strategy first, followed by the attacker’s optimal control response.
• Derive optimal control inputs for both the defender (sensor designer) and the attacker (infiltrated controller) under given linear sensor strategies.
• Use semi-definite programming (SDP) to compute the optimal linear secure sensor outputs that minimize the expected quadratic cost under adversarial objectives.
• Introduce a normalized gain matrix representation to analyze the time evolution of sensor influence and rank properties of the optimal solution.
• Evaluate robustness by simulating scenarios where the sensor designer has inaccurate perception of the true state transition statistics.

Experimental results

Research questions

• RQ1 To what extent can secure sensor design reduce the damage caused by undetected controller infiltration in cyber-physical systems?
• RQ2 How can optimal linear sensor outputs be computed to minimize the expected cost under adversarial control objectives when the controller may be compromised at any time?
• RQ3 What performance gains does the proposed secure sensor design achieve compared to classical sensor designs in the presence of undetected attacks?
• RQ4 How robust is the proposed scheme when the sensor designer has inaccurate perception of the underlying system statistics?
• RQ5 What is the impact of sensor output design on the system's resilience when attackers have partial or full knowledge of the system dynamics?

Key findings

• The proposed secure sensor design achieves a 40% average performance enhancement over classical sensor schemes, even when the controller is infiltrated.
• In the best-case scenario (no infiltration), the proposed scheme performs comparably to classical schemes, but in all other cases, it significantly outperforms them.
• The optimal gain matrix at the final time step has rank 4, while earlier gain matrices have rank 2, indicating a structural shift in sensor influence over time.
• Even under inaccurate perception of system statistics, the proposed scheme maintains strong performance, outperforming classical schemes across all tested cases.
• Case 1 (no infiltration) shows slightly improved performance under inaccurate perception due to higher perceived probability (0.85 vs. actual 0.70), but the scheme remains robust overall.
• The average performance degradation due to statistical misperception is 1.1× (from 7.0 to 8.1), yet the proposed scheme still dominates classical schemes in all scenarios.