针对完整性攻击的信息物理系统双通道联合编码检测

莫小磊; 曾维鑫; 富佳伟; 窦克勤; 王言伟; 孙希明; 林思达; 隋天举

doi:10.11999/JEIT250729

针对完整性攻击的信息物理系统双通道联合编码检测

doi: 10.11999/JEIT250729 cstr: 32379.14.JEIT250729

1.
大连理工大学控制科学与工程学院大连 116024
2.
中国航空工业集团公司沈阳飞机设计研究所沈阳 110035
3.
国家工业信息安全发展研究中心北京 100040
4.
大连海事大学理学院大连 116026

基金项目: 国家自然科学基金(62322306,62173057)，航空科学基金(2022Z018063001)，KGJ基础科研项目(JCKY2023110C080)，大连理工大学重大项目科研专题(DUT24ZD412)

详细信息

作者简介:
莫小磊：男，硕士生，研究方向为信息物理系统攻击检测、安全状态估计

曾维鑫：男，硕士生，研究方向为信息物理系统攻击检测、安全状态估计

富佳伟：男，博士，高级工程师，研究方向为飞机总体设计

窦克勤：男，博士在读，研究员，研究方向为工业信息安全

王言伟：男，博士在读，教授级高级工程师，研究方向为飞机总体设计、机载智能信息系统

孙希明：男，博士，教授，研究方向为切换系统控制、工业网络智能控制与优化

林思达：男，博士，副教授，研究方向为网络化控制系统优化

隋天举：男，博士，教授，研究方向为系统安全防护和故障诊断、工业互联网和网络化控制系统

通讯作者:
富佳伟　fjw15210591734@163.com

中图分类号: TP13; TP309
计量
- 文章访问数: 38
- HTML全文浏览量: 17
- PDF下载量: 9
- 被引次数: 0
出版历程
- 修回日期: 2025-11-12
- 录用日期: 2025-11-12
- 网络出版日期: 2025-11-17

Two-channel joint coding detection for cyber-physical systems against integrity attacks

1.
School of Control Science and Engineering, Dalian University of Technology, Dalian 116024, China
2.
AVIC Shenyang Aircraft Design and Research Institute, Shenyang 110035, China
3.
China Industrial Control Systems Cyber Emergency Response Team, Beijing 100040, China
4.
School of Science, Dalian Maritime University, Dalian 116026, China

Funds: National Natural Science Foundation of China(62322306,62173057), Aeronautical Science Foundation of China(2022Z018063001), KGJ Basic Research and Development Program(JCKY2023110C080), Dalian University of Technology Major Project Research Topics(DUT24ZD412)

摘要

摘要: 信息物理系统(Cyber-Physical System, CPS)完整性攻击针对系统数据流发起攻击，破坏输入输出数据一致性，由于其攻击方式多变、隐蔽性强的特性，较其他CPS攻击在检测及防护上更为困难。为此，本文提出了一种控制-输出双通道的数据加性-乘性联合编码检测方案，旨在检测完整性攻击并在三种典型攻击上进行验证，包括控制通道偏置攻击、输出通道重放攻击以及双通道隐蔽攻击。完整性攻击通过部分或全面系统信息的获取及掌控可使卡方检测器检测值小于阈值，从而实现对CPS系统“隐形”。为此，本文方案创新性地在通道两侧布置加性正负水印对以及乘性编码/解码矩阵对，未知信号及部件的引入为攻击者带来了信息不确定性，使残差统计特性偏离其期望数值。此外，水印对与矩阵对之间通过不同机制实现了解耦，其正负或互逆形式使得无攻击时不影响系统的控制性能，并且以时变形式防止攻击者对其重构。最后，通过计算推导出引入本文方案后三种攻击前后残差统计特性的变化，并以飞行器飞行轨迹仿真为例，说明方案的有效性和先进性。
- 信息物理系统 /
- 完整性攻击 /
- 物理水印 /
- 编码矩阵
Abstract: Objective With the rapid development of computing, control, and sensing technologies, cyber-physical systems (CPS), which deeply integrate information and physical processes, have been widely used in various industries, such as infrastructure sector, aviation, energy, healthcare, manufacturing, and transportation, etc. However, due to the real-time and heterogeneous nature of information and physical processes, CPS are more vulnerable to attacks and damages when communicating and interacting with each other. CPS attacks can be categorized into three major types, namely, availability attacks, integrity attacks, and reliability attacks, according to the three elements of information security. Integrity attacks are launched against the data flow of CPS to destroy the consistency of input and output data, which is more difficult to be detected and protected than other CPS attacks due to the changeable and covert nature of the attacks. Currently, the mainstream detection methods include actively changing control signals, sensing signals, or system models, which can only address the detection of a single class of attacks and suffer from degraded control performance, complexity of the model and high latency due to the active change approach. Methods In this paper, a joint data additive-multiplicative coding detection scheme for control-output two-channel is proposed and applied on three typical integrity attacks so as to verify them. Three typical integrity attacks, namely, control channel bias attack, output channel replay attack, and two-channel covert attack, are selected. The attack achieves “stealthy” to the CPS system by obtaining and controlling the system information partially or comprehensively, so that the detection value of the residual-based ${\chi ^2}$ detector is less than the threshold value. In this paper, we innovatively arrange additive positive/negative watermarking pairs and multiplicative coding/decoding matrix pairs on both sides of the channel. Due to the introduction of unknown signals and components, which brings information uncertainty to the attacker, the statistical characteristics of the residuals deviate from the well-designed values, which are generated by the attacker using the known information to construct the integrity attack. In addition, decoupling between watermarking pairs and matrix pairs is achieved due to the different introduction mechanisms, which are in positive-negative or mutual inverse form so that the control performance of the normal system is not affected in the absence of attacks, and in a time-varying form that prevents the attacker from reconfiguring the detection components. Results and Discussions Simulation experiments on the flight trajectory of the aerial vehicle are designed to verify the effect of integrity attack on the flight trajectory and the effectiveness of the proposed scheme. Based on Newton's equations of motion, the trajectory model of the aerial vehicle mass is established, and its attitude dynamics and rotational motion are ignored to focus on trajectory analysis. The detection effects with and without applying the detection scheme are compared and demonstrated for three different attacks (Fig.2, Fig.3, Fig.4), which proves the effectiveness and advancement of the scheme designed in this paper. Conclusions This paper investigates the detection of integrity attacks in CPS systems. It models three typical attack types—bias, replay, and covert attacks—and identifies the necessary conditions for successfully executing each. Building upon this foundation, it innovatively proposes a detection scheme combining additive watermarks with multiplicative encoding matrices, achieving successful detection of all three attack types. The proposed solution employs additive positive-negative watermark pairs and multiplicative encoding/decoding matrix pairs to achieve successful detection without compromising normal system control performance. It employs a time-varying approach to prevent attackers from reconstructing the watermark and matrix pairs. Finally, using aerial vehicle flight trajectories simulation as an example, the effectiveness and advanced nature of this detection solution is demonstrated.
- Cyber-Physical Systems (CPS) /
- Integrity Attacks /
- Physical Watermarking /
- Coding Matrices

HTML全文

图 1 针对完整性攻击的综合检测方案

下载: 全尺寸图片幻灯片

图 2 偏置攻击检测结果对比

下载: 全尺寸图片幻灯片

图 3 重放攻击检测结果对比

下载: 全尺寸图片幻灯片

图 4 隐蔽攻击检测结果对比

下载: 全尺寸图片幻灯片

参考文献(21)

[1]	TEIXEIRA A, PÉREZ D, SANDBERG H, et al. Attack models and scenarios for networked control systems[C]. Proceedings of the 1st International Conference on High Confidence Networked Systems, Beijing, China, 2012: 55–64. doi: 10.1145/2185505.2185515.
[2]	方崇荣. 信息物理系统中数据完整性攻击的检测与防御研究[D]. [博士论文], 浙江大学, 2021. doi: 10.27461/d.cnki.gzjdx.2021.001222. FANG Chongrong. Research on detection and defense of data integrity attacks in cyber-physical systems[D]. [Ph. D. dissertation], Zhejiang University, 2021. doi: 10.27461/d.cnki.gzjdx.2021.001222.
[3]	CÁRDENAS A A, AMIN S, LIN Z Y, et al. Attacks against process control systems: Risk assessment, detection, and response[C]. Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, Hong Kong, China, 2011: 355–366. doi: 10.1145/1966913.1966959.
[4]	叶丹, 靳凯净, 张天予. 网络攻击下的信息物理系统安全性研究综述[J]. 控制与决策, 2023, 38(8): 2243–2252. doi: 10.13195/j.kzyjc.2023.0386. YE Dan, JIN Kaijing, and ZHANG Tianyu. A survey on security of cyber-physical systems under network attacks[J]. Control and Decision, 2023, 38(8): 2243–2252. doi: 10.13195/j.kzyjc.2023.0386.
[5]	HUANG Xin, LI Jian, and SU Qingyu. An observer with cooperative interaction structure for biasing attack detection and secure control[J]. IEEE Transactions on Systems, Man, and Cybernetics: Systems, 2023, 53(4): 2543–2553. doi: 10.1109/TSMC.2022.3213516.
[6]	赵华. 工业控制系统异常检测算法研究[D]. [硕士论文], 冶金自动化研究设计院, 2013. doi: 10.7666/d.Y2362236. ZHAO Hua. Research on anomaly detection algorithm for industrial control systems[D]. [Master dissertation], Automation Research and Design Institute of Metallurgical Industry, 2013. doi: 10.7666/d.Y2362236.
[7]	MO Yilin and SINOPOLI B. Secure control against replay attacks[C]. Proceedings of 2009 47th Annual Allerton Conference on Communication, Control, and Computing (Allerton), Monticello, USA, 2009: 911–918. doi: 10.1109/ALLERTON.2009.5394956.
[8]	FERRARI R M G and TEIXEIRA A M H. Detection and isolation of replay attacks through sensor watermarking[J]. IFAC-PapersOnLine, 2017, 50(1): 7363–7368. doi: 10.1016/j.ifacol.2017.08.1502.
[9]	FANG Chongrong, QI Yifei, CHENG Peng, et al. Optimal periodic watermarking schedule for replay attack detection in cyber–physical systems[J]. Automatica, 2020, 112: 108698. doi: 10.1016/j.automatica.2019.108698.
[10]	杜大军, 张竞帆, 张长达, 等. 动态水印攻击检测方法的鲁棒性研究[J]. 自动化学报, 2023, 49(12): 2557–2568. doi: 10.16383/j.aas.c200614. DU Dajun, ZHANG Jingfan, ZHANG Changda, et al. Robustness of dynamic-watermarking attack-detection method[J]. Acta Automatica Sinica, 2023, 49(12): 2557–2568. doi: 10.16383/j.aas.c200614.
[11]	MIAO Fei, ZHU Quanyan, PAJIC M, et al. Coding schemes for securing cyber-physical systems against stealthy data injection attacks[J]. IEEE Transactions on Control of Network Systems, 2017, 4(1): 106–117. doi: 10.1109/TCNS.2016.2573039.
[12]	YE Dan, ZHANG Tianyu, and GUO Ge. Stochastic coding detection scheme in cyber-physical systems against replay attack[J]. Information Sciences, 2019, 481: 432–444. doi: 10.1016/j.ins.2018.12.091.
[13]	张正道, 杨佳佳, 谢林柏. 基于辅助信息补偿和控制信号编码的重放攻击检测方法[J]. 自动化学报, 2023, 49(7): 1508–1518. doi: 10.16383/j.aas.c210092. ZHANG Zhengdao, YANG Jiajia, and XIE Linbo. Replay attack detection method based on auxiliary information compensation and control signal coding[J]. Acta Automatica Sinica, 2023, 49(7): 1508–1518. doi: 10.16383/j.aas.c210092.
[14]	HOEHN A and ZHANG Ping. Detection of covert attacks and zero dynamics attacks in cyber-physical systems[C]. Proceedings of 2016 American Control Conference (ACC), Boston, USA, 2016: 302–307. doi: 10.1109/ACC.2016.7524932.
[15]	ATTAR M and LUCIA W. An active detection strategy based on dimensionality reduction for false data injection attacks in cyber-physical systems[J]. IEEE Transactions on Control of Network Systems, 2023, 10(4): 1844–1854. doi: 10.1109/TCNS.2023.3244103.
[16]	GRIFFIOEN P, WEERAKKODY S, and SINOPOLI B. An optimal design of a moving target defense for attack detection in control systems[C]. Proceedings of 2019 American Control Conference (ACC), Philadelphia, USA, 2019: 4527–4534. doi: 10.23919/ACC.2019.8814689.
[17]	XU Wangkun, JAIMOUKHA I M, and TENG Fei. Robust moving target defence against false data injection attacks in power grids[J]. IEEE Transactions on Information Forensics and Security, 2023, 18: 29–40. doi: 10.1109/TIFS.2022.3210864.
[18]	WANG Jiazhou, TIAN Jue, LIU Yang, et al. MMTD: Multistage moving target defense for security-enhanced D-FACTS operation[J]. IEEE Internet of Things Journal, 2023, 10(14): 12234–12247. doi: 10.1109/JIOT.2023.3245628.
[19]	ANDERSON B D O and MOORE J B. Optimal Filtering[M]. New York: Dover Publications, 2005: 307–341.
[20]	YE N, EMRAN S M, CHEN Q, et al. Multivariate statistical analysis of audit trails for host-based intrusion detection[J]. IEEE Transactions on Computers, 2002, 51(7): 810–820. doi: 10.1109/TC.2002.1017701.
[21]	KWON C, LIU Weiyi, and HWANG I. Security analysis for cyber-physical systems against stealthy deception attacks[C]. Proceedings of 2013 American Control Conference, Washington, USA, 2013: 3344–3349. doi: 10.1109/ACC.2013.6580348.