CN115051872B - Attack detection method considering attack signal and unknown disturbance based on interconnected CPS - Google Patents
Attack detection method considering attack signal and unknown disturbance based on interconnected CPS Download PDFInfo
- Publication number
- CN115051872B CN115051872B CN202210764383.4A CN202210764383A CN115051872B CN 115051872 B CN115051872 B CN 115051872B CN 202210764383 A CN202210764383 A CN 202210764383A CN 115051872 B CN115051872 B CN 115051872B
- Authority
- CN
- China
- Prior art keywords
- matrix
- attack
- cps
- signal
- interconnected
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 19
- 239000011159 matrix material Substances 0.000 claims abstract description 70
- 238000000034 method Methods 0.000 claims abstract description 33
- 230000008878 coupling Effects 0.000 claims description 6
- 238000010168 coupling process Methods 0.000 claims description 6
- 238000005859 coupling reaction Methods 0.000 claims description 6
- 230000006641 stabilisation Effects 0.000 claims description 2
- 238000011105 stabilization Methods 0.000 claims description 2
- 230000035945 sensitivity Effects 0.000 description 6
- 238000004088 simulation Methods 0.000 description 6
- 238000013461 design Methods 0.000 description 4
- 230000000694 effects Effects 0.000 description 4
- 238000011160 research Methods 0.000 description 3
- 238000006467 substitution reaction Methods 0.000 description 2
- 238000010276 construction Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 230000002401 inhibitory effect Effects 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000000087 stabilizing effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Environmental & Geological Engineering (AREA)
- Feedback Control In General (AREA)
Abstract
The invention relates to an attack detection method based on an interconnected CPS (control system) and considering attack signals and unknown disturbance, which comprises the following steps: establishing a relation model and a connection topological graph for describing an interconnection information physical system, wherein each subsystem in the relation model has a random noise signal and an attack signal; setting a robust observer for the sensors in the CPS according to the relational model, using H ‑ And mixing L 2 ‑L ∞ /H ∞ Performance and setting an optimal parameter calculation gain matrix to obtain state estimation information of the CPS; wherein the optimal parameter is the minimum parameter value when the linear inequality condition is satisfied; and setting an interval threshold value generation method according to the state estimation information of the CPS, comparing the output state with the magnitude relation between the upper limit and the lower limit of the threshold value, and judging whether the CPS is attacked or not. The attack detection method based on the interconnected CPS and considering the attack signal and the unknown disturbance effectively solves the problems of certain limitation, non-wide application range and poor applicability of the existing method.
Description
Technical Field
The invention relates to the technical field of attack detection, in particular to an attack detection method based on an interconnected CPS (control system) and considering attack signals and unknown disturbance.
Background
Cyber Physical Systems (CPS) are complex multidimensional systems involving information networks and physical processes, with subsystems working in coordination and communicating through network connections. Due to the rapid development of technologies and the improvement of data processing, it has attracted much research attention as an intelligent system that is highly integrated and interactive in a network environment. Although the network connection enables each subsystem to process information and communicate with each other, it also increases the likelihood that the system will be attacked. Further research into CPS is needed to increase its susceptibility to attack to meet security and protection standards. For a system under unknown disturbance, if the unknown input is not reasonably processed, the control effect of the system will be affected. In the past, attack detection research on CPS and an interconnection system mainly focuses on attack signals in a full frequency domain, and malicious attack detection belonging to a limited frequency domain is ignored. When a single index is considered and the interference robustness and the sensitivity to the attack are not considered simultaneously, the application effect of the design method is poor.
Based on H - /H ∞ Has been proposed to suppress the effect of perturbation and attack signals on the residual. The sensitivity to attack is considered while the residual robustness is considered, but the method has certain limitations and is not flexible enough. When a detection method is designed, constant threshold residual error evaluation is selected, but the method is not wide in application range and poor in applicability. Therefore, it is necessary to design a new technical solution to comprehensively solve the problems in the prior art.
Disclosure of Invention
The invention aims to provide an attack detection method based on an interconnected CPS (control performance system) and considering attack signals and unknown disturbance, which can effectively solve the problems of certain limitation, non-wide application range and poor applicability of the existing method.
In order to solve the technical problems, the invention adopts the following technical scheme:
an attack detection method based on an interconnected CPS considering attack signals and unknown disturbance comprises the following steps:
s1, establishing a relation model and a connection topological graph for describing an interconnection information physical system, wherein each subsystem in the relation model has a random noise signal and an attack signal;
s2, setting a robust observer for a sensor in an interconnection information physical system according to the relation model, and using H - And mixing L 2 -L ∞ /H ∞ Setting the optimal parameters to obtain a gain matrix to obtain state estimation information of the interconnection information physical system; wherein the optimal parameter is a minimum parameter value when the linear inequality is satisfied;
and S3, setting an interval threshold value generation method according to the state estimation information of the interconnected information physical system, comparing the magnitude relation between the output state and the upper limit and the lower limit of the threshold value, and judging whether the attack signal is received or not.
Wherein, step S1 includes the following steps:
defining an interconnected CPS comprising N-dimensional subsystems, each subsystem consisting of a physical part and a network part, the subsystems being coupled to each other and the construction of the subsystems being as follows:
wherein x is i (k)∈R m Represents a state vector, u i (k)∈R n Representing the control input signal, ω i (k)∈R q Representing an unknown perturbation signal; a is an element of R m ,B∈R m×n ,C∈R p×m ,D∈R m×q And K ∈ R p×r Respectively known coefficient matrixes with certain dimensionality; the scalar a represents the coupling strength between the subsystems, Λ is the coupling matrix describing the connections between the subsystems, y i (k)∈R p Is an output signal, and K ∈ R p×r A matrix of constants; sensor attack f si (k)∈R r Occurs in a low frequency range and satisfies a frequency conditionWhereinWhich is indicative of the frequency of the signal,representing a low frequency boundary;
the dynamic equation of the whole system is expressed as:
when at least one subsystem is attacked by a sensor, an observer is designed and described as follows:
wherein z (k) is ∈ R Nm Is a vector of the system, and is,state estimation value, F ∈ R Nm×Nm ,J∈R Nm×Nm ,L∈R Nm×Np And H ∈ R Nm×Np A matrix to be determined is obtained;
e(k+1)=Jx(k+1)-z(k+1)+HK y f s (k+1)
=J(Ax(k)+Bu(k)+Dω(k)+K x f s (k))
-(Fz(k)+JBu(k)+Ly(k))+HK y f s (k+1)
=Fe(k)+(JA-F-(FH+L)C)x(k)+JK x f s (k)
-(FH+L)K y f s (k)+HK y f s (k+1)+JDω(k)
when the condition JA-F- (FH + L) C =0 is satisfied, it is known that:
e(k+1)=Fe(k)+JK x f s (k)-(FH+L)K y f s (k)+HK y f s (k+1)+JDω(k)
assuming that the matrix M is a full rank matrix, M T M is a nonsingular matrix, and the pseudo-inverse matrix of M is expressed as M * =(M T M) -1 M T ,Z∈R (Nm)×(Nm+NP) Is an arbitrary matrix. It can be seen that J and H are described as:
the step S2 includes the steps of:
a. Let V 1 (k)=e T (k)P ω e (k), when system stability is considered, the lyapunov stability condition is satisfied:
ΔV 1 (k)=V 1 (k+1)-V 1 (k)<0
the following inequality holds:
b. when the residual signal and the unknown disturbance satisfy L 2 -L ∞ /H ∞ When the condition is satisfied, the following inequality is satisfied:
when b =0, only H is satisfied ∞ An index; when b =1, only L is satisfied 2 -L ∞ An index;
with the linear matrix equation of small, the following equation of small holds:
c. when only H is considered - When indicating, let V 2 (k)=e T (k)Q f e (k), and satisfies the Lyapunov stabilization condition:
ΔV 2 (k)=V 2 (k+1)-V 2 (k)<0
introducing additional parameters and matrix according to the linear matrix inequality, and making F = JA-GC, M 1 =α 2 G,M 2 =V 1 T G and W = GG, and found that
d. combining the above indices, for a given performance scalar η>0,γ>0,α 1 ,α 2 And 0 ≦ b ≦ 1, the proposed error system is considered stable and satisfies if there is a symmetric matrix P ω =P ω T >0,P f =P f T >0,Q f =Q f T >0, with appropriate dimensional matrix W, V 1 And G, satisfying L 2 -L ∞ /H ∞ And H index, such that the following conditions hold:
wherein,
for a given scalar η>0, stabilizing the system, and obtaining a minimum parameter gamma according to the conditions; according to G = G -1 W, a gain matrix is obtained.
Step S3 includes the following steps:
the state interval is defined as:
if it is notFor a schuler matrix, defineWherein R is a randomly selected Schur matrix, which can be generally selected to be a non-negative matrix;
describing a Sylvester equation:for any Q, then a unique matrix T andwhen the system state is satisfiedWhen the system outputs, the following conditions are met:
for discrete CPS, the attack detection method based on interconnected CPS considering attack signals and unknown disturbance provided by the technical scheme focuses on sensor attack signals existing in a limited frequency range, and uses generalized Kalman-Yakubovic-Popov (GKYP) lemma to deduce sufficient conditions for designing a finite frequency observer; in order to consider the robustness of residual errors to interference, the method of the invention is used for mixing H - And mixing L 2 -L ∞ /H ∞ Proposed on the basis of indices, involving only a single H ∞ The indexes are compared, and the method is more flexible and effective.
In addition, with H - And mixing L 2 -L ∞ /H ∞ Combined with, rather than involving, only a single L 2 -L ∞ /H ∞ Compared with the index method, the method of the invention has more sensitivity; the conservatism of the observer design can be reduced by using additional parameters and matrices due to the presence of the matrices coupled to each other.
The attack detection method based on the interconnected CPS and considering the attack signals and unknown disturbance ensures the reasonable operation of the system by constructing the control framework of the system, designing mixed parameter control, estimating the state of the system and detecting the attack signals in real time.
Drawings
FIG. 1 is a topological block diagram of a system;
FIG. 2 shows the actual values and estimated values of the system according to embodiment 1 of the present invention;
FIG. 3 shows the output value and the upper and lower threshold values of the interval threshold of the system 1 according to embodiment 1 of the present invention;
FIG. 4 shows the output values and the upper and lower values of the interval threshold of the system 2 according to embodiment 1 of the present invention;
FIG. 5 shows the output values of the system 3 and the upper and lower values of the threshold interval according to embodiment 1 of the present invention;
FIG. 6 shows the output values of the system 4 and the upper and lower values of the threshold interval according to embodiment 1 of the present invention;
FIG. 7 shows the residual signal and H only used in embodiment 1 of the present invention ∞ Residual signal values generated by the method;
FIG. 8 shows the actual values and estimated values of the system according to embodiment 2 of the present invention;
FIG. 9 shows the output values and the upper and lower values of the interval threshold of the system 1 according to embodiment 2 of the present invention;
FIG. 10 shows the output values of the system 2 and the upper and lower threshold values of the interval according to embodiment 2 of the present invention;
FIG. 11 shows the output values of the system 3 and the upper and lower values of the threshold interval according to embodiment 2 of the present invention;
FIG. 12 shows the output values of the system 4 and the upper and lower values of the threshold interval according to embodiment 2 of the present invention;
FIG. 13 shows the residual signal and L only used in embodiment 2 of the present invention 2 -L ∞ /H ∞ The method generates residual signal values.
Detailed Description
In order that the objects and advantages of the invention will be more clearly understood, the following description is given in conjunction with the examples. It is to be understood that the following text is merely illustrative of one or more specific embodiments of the invention and does not strictly limit the scope of the invention as specifically claimed.
The technical scheme adopted by the invention is shown in figures 1-13, and the attack detection method based on the interconnected CPS considering attack signals and unknown disturbance comprises the following steps:
the method comprises the following steps: the method comprises the steps of establishing a relation model and a connection topological graph for describing an interconnection information physical system, constructing an integral system by using interconnection information of a plurality of subsystems, and then solving the problems related to observer design for constructing the system.
Here, an interconnected CPS is defined comprising N-dimensional subsystems, each subsystem consisting of a physical part and a network part, and the subsystems may be constructed as follows:
wherein x is i (k)∈R m Represents a state vector, u i (k)∈R n Representing the control input signal, ω i (k)∈R q Representing an unknown perturbation signal. In addition, A ∈ R m ,B∈R m×n ,C∈R p×m ,D∈R m×q And K ∈ R p×r Respectively a matrix of coefficients known to have a certain dimension. The subsystems are coupled to each other, and a scalar a represents the coupling strength between the subsystems, and Λ is a coupling matrix describing the connections between the subsystems. The output signal is y i (k)∈R p And K ∈ R p×r A matrix of constants.
Sensor attack f si (k)∈R r Occurs in a low frequency range and satisfies a frequency conditionWhereinWhich is indicative of the frequency of the signal,indicating a low frequency boundary.
The dynamic equation of the overall system is expressed as:
when at least one subsystem is attacked by a sensor, an observer is designed and described as follows:
wherein z (k) epsilon R Nm Is a vector of the system, and is,state estimate, F ∈ R Nm×Nm ,J∈R Nm×Nm ,L∈R Nm×Np And H ∈ R Nm×Np Is the matrix that needs to be determined.
e(k+1)=Jx(k+1)-z(k+1)+HK y f s (k+1)
=J(Ax(k)+Bu(k)+Dω(k)+K x f s (k))
-(Fz(k)+JBu(k)+Ly(k))+HK y f s (k+1)
=Fe(k)+(JA-F-(FH+L)C)x(k)+JK x f s (k)
-(FH+L)K y f s (k)+HK y f s (k+1)+JDω(k)
when the condition JA-F- (FH + L) C =0 is satisfied, it is known that:
e(k+1)=Fe(k)+JK x f s (k)-(FH+L)K y f s (k)+HK y f s (k+1)+JDω(k)
assuming that the matrix M is a full rank matrix, M T M is a nonsingular matrix, and the pseudo-inverse matrix of M is expressed as M * =(M T M) -1 M T ,Z∈R (Nm)×(Nm+Np) Is an arbitrary matrix. It can be seen that J and H are described as:
step two: in view of the residual sensitivity to attacks and its robustness to unknown disturbances, the observer is designed and uses H - And mixing L 2 -L ∞ /H ∞ And a gain matrix obtained by performance is used for inhibiting the influence of unknown interference and attack signals on state estimation errors and finite frequency domain attack detection, and the generalized Kalman-Yakubovic-Popov (GKYP) lemma is used for setting relevant effective conditions of an observer.
a. Let V 1 (k)=e T (k)P ω e (k), when system stability is considered, the lyapunov stability condition is satisfied:
ΔV 1 (k)=V 1 (k+1)-V 1 (k)<0
the following inequality holds:
b. when the residual signal and the unknown disturbance satisfy L 2 -L ∞ /H ∞ When the condition is satisfied, the following inequality is satisfied:
when b =0, only H is satisfied ∞ An index; when b =1, only L is satisfied 2 -L ∞ And (4) an index. It can be seen that the inequality holds:
with the linear matrix inequality, the following inequality holds:
When the following inequalities hold, that is
bt T (k)r(k)-V 1 (k)=be T (k)C T Ce(k)-V 1 (k)
=be T (k)C T Ce(k)-e T (k)P ω e(k)
=e T (k)(bC T C-P ω )e(k)<0
c. When only H is considered - When indicating, let V 2 (k)=e T (k)Q f e (k) and satisfies the Lyapunov stability condition Δ V 2 (k)=V 2 (k+1)-V 2 (k)<0
The following inequality is known to hold:
Introducing additional parameters and matrix according to the linear matrix inequality, and making F = JA-GC, M 1 =α 2 G,M 2 =V 1 T G and W = GG, and found that
d. combining the above indices, for a given performance scalar η>0,γ>0,α 1 ,α 2 And b is 0. Ltoreq. B.ltoreq.1, inThe error system is considered stable and satisfies the symmetry matrix P if present ω =P ω T >0,P f =P f T >0,Q f =Q f T >0, with appropriate dimensional matrix W, V 1 And G, satisfying L 2 -L ∞ /H ∞ And H - An index such that the following condition holds:
wherein,
for a given scalar η>0, the system is stable, and the minimum parameter gamma can be obtained according to the above conditions. According to G = G -1 W, a gain matrix is obtained.
Step three: a threshold upper limit and lower limit generation method based on an interval threshold is provided, and the feasibility of the method is verified through a simulation result.
the state interval may be defined as:
if it is usedFor a schuler matrix, defineWhere R is a randomly selected Schur matrix, which can generally be selected to be a non-negative matrix. Describing a Sylvester equation:for any Q, then a unique matrix T andwhen the system state is satisfiedWhen the system outputs, the following conditions are met:
as shown in fig. 1, considering an interconnected CPS with four subsystems, assuming the same structure for all subsystems, the pre-designed coefficient parameters are chosen as:
the perturbation signal is described as ω (k) =0.5sin (0.3 k), and its upper and lower bounds can be described as:
example 1
In this case, the system is subject to a sudden low frequency domain attack after k =65 and satisfiesThe attack signal is described as:
definition of alpha 1 =0.04,α 2 =-0.832,b=0.6,V 1 =-1.52HK 3 η =0.585. And (3) obtaining the minimum parameter gamma =0.019 according to the conditions given in the step 2.
the non-negative matrix R is defined as:
R=diag{0.126,0.042,0.126,0.042,0.084,0.126,0.042,0.084,0.126,0.084,0.042,0.126}。Q 1 =-4I 8 ,Q 2 =[-1.255I 4 -1.75I 4 ]. Solving Sylvester equation to obtain matrix
Fig. 2-7 show simulation results. The state estimation of the system is shown in fig. 2, where the solid line represents the actual state and the dashed line represents the estimated state generated by the proposed method. Simulation results show that the method has higher speed in the aspect of state estimation and converges to a close state, so that good control is realized.
To demonstrate the increased sensitivity of the residual to the attack, we paired the use of H ∞ The method of performance was compared to the method set forth in case 1. Fig. 3-6 depict the detection effect, where the dashed lines represent the boundaries of the threshold. In fig. 3,5 and 6, all output signals are within the threshold. In fig. 4, the output signal obtained according to the proposed method exceeds its upper or lower threshold, i.e. it means that an attack occurs after k = 65. Based on the proposed strategy we can notice that the subsystem 2 is under attack. In FIG. 7, the finite frequency H is not considered - In the case of the index, the residual error resulting from the method used in this study is greater than the residual error obtained in the previous study. It can be concluded that the proposed process ratio with mixing index hasSingle H ∞ The method of performance is more sensitive to attack signals.
Example 2
In this case, the system is suddenly attacked at 45 < k < 75 and satisfies the low frequency rangeAnd is described as:
definition of alpha 1 =0.97,α 2 =-0.62,b=0.13,V 1 =-2.85HK 3 η =0.36, and the minimum coefficient γ =0.080 is obtained.
R and Q are defined as:
R=diag{0.045,0.015,0.045,0.015,0.03,0.045,0.015,0.03,0.045,0.03,0.015,0.045},
The simulation results are shown in fig. 8-13. The state estimation of the system is illustrated in fig. 8, where the solid line represents the actual state and the dashed line represents the estimated state generated by the proposed method. Simulation results show that the method has higher speed in the aspect of state estimation and converges to a close state, so that good control is realized.
Fig. 9-11 show that all output signals are within the threshold range. In fig. 12, when the finite frequency H is considered at the same time - Exponentially, the output signal obtained according to the proposed method exceeds its upper or lower threshold limit, i.e. it means that an attack occurring between k =45 and k =75 can be successfully detected. To show the improvement in residual sensitivity, the simulation results are compared in fig. 13. Between k =45 and k =75, by combining L 2 -L ∞ /H ∞ And H - Exponential, it can be seen that the residual signal ratio with hybrid performance uses only L 2 -L ∞ /H ∞ The method produces larger residual values.
By the proposed method we can detect that the subsystem 4 is under attack.
The present invention is not limited to the above embodiments, and those skilled in the art can make various equivalent changes and substitutions without departing from the principle of the present invention after learning the content of the present invention, and these equivalent changes and substitutions should be considered as belonging to the protection scope of the present invention.
Claims (3)
1. An attack detection method considering attack signals and unknown disturbance based on an interconnected CPS is characterized by comprising the following steps:
s1, establishing a relation model and a connection topological graph for describing an interconnection information physical system, wherein each subsystem in the relation model has a random noise signal and an attack signal;
s2, setting a robust observer for a sensor in an interconnected information physical system according to the relation model, and using H-and mixed L 2 -L ∞ /H ∞ Performance and setting an optimal parameter calculation gain matrix to obtain state estimation information of the interconnection information physical system; the optimal parameter is the minimum parameter value when a linear inequality condition is met;
the gain matrix is obtained as follows:
a. Let V 1 (k)=e T (k)P ω e (k), when system stability is considered, the lyapunov stability condition is satisfied:
ΔV 1 (k)=V 1 (k+1)-V 1 (k)<0
the following inequality holds:
b. when the residual signal and the unknown disturbance satisfy L 2 -L ∞ /H ∞ When the condition is satisfied, the following inequality is satisfied:
when b =0, only H is satisfied ∞ An index; when b =1, only L is satisfied 2 -L ∞ An index;
with the linear matrix inequality, the following inequality holds:
c. when only H is considered - When indicating, let V 2 (k)=e T (k)Q f e (k), and satisfies the Lyapunov stabilization condition:
ΔV 2 (k)=V 2 (k+1)-V 2 (k)<0
introducing additional parameters and matrix according to the linear matrix inequality, and making F = JA-GC, M 1 =α 2 G,M 2 =V 1 T G and W = GG, and found that
d. combining the above indices, for a given performance scalar η > 0, γ > 0, α 1 ,α 2 And 0 ≦ b ≦ 1, the proposed error system is considered stable and satisfies if there is a symmetric matrix P ω =P ω T >0,P f =P f T >0,Q f =Q f T > 0, with a matrix W, V of appropriate dimensions 1 And G, satisfying L 2 -L ∞ /H ∞ And H - An index such that the following conditions are satisfied:
wherein,
for a given scalar η > 0, the systemStable, the minimum parameter gamma can be obtained according to the above conditions; according to G = G -1 W, obtaining a gain matrix;
and S3, setting an interval threshold value generation method according to the state estimation information of the interconnected information physical system, comparing the magnitude relation between the output state and the upper limit and the lower limit of the threshold value, and judging whether the attack signal is received or not.
2. The interconnected CPS-based attack detection method taking into account attack signals and unknown disturbances according to claim 1, wherein step S1 comprises the steps of:
defining an interconnected cyber-physical system comprising N-dimensional subsystems, each subsystem comprising a physical part and a network part, the subsystems being coupled to each other and the subsystems being constructed as follows:
wherein x is i (k)∈R m Represents a state vector, u i (k)∈R n Representing the control input signal, ω i (k)∈R q Representing an unknown perturbation signal; a is equal to R m ,B∈R m×n ,C∈R p×m ,D∈R m×q And K ∈ R p×r Respectively coefficient matrixes with certain dimensionality are known; a scalar a represents the coupling strength between the subsystems, a is the coupling matrix describing the connections between the subsystems, y i (k)∈R p Is an output signal, and K ∈ R p×r A matrix of constants; sensor attack f si (k)∈R r Occurs in a low frequency range and satisfies a frequency conditionWhereinWhich is indicative of the frequency of the signal,representing a low frequency boundary;
the dynamic equation of the whole system is expressed as:
when at least one subsystem is attacked by a sensor, an observer is designed and described as follows:
wherein z (k) is ∈ R Nm Is a vector of the system, and is,state estimation value, F ∈ R Nm×Nm ,J∈R Nm×Nm ,L∈R Nm×Np And H ∈ R Nm×Np A matrix to be determined is obtained;
e(k+1)=Jx(k+1)-z(k+1)+HK y f s (k+1)
=J(Ax(k)+Bu(k)+Dω(k)+K x f s (k))
-(Fz(k)+JBu(k)+Ly(k))+HK y f s (k+1)
=Fe(k)+(JA-F-(FH+L)C)x(k)+JK x f s (k)
-(FH+L)K y f s (k)+HK y f s (k+1)+JDω(k)
when the condition JA-F- (FH + L) C =0 is satisfied, it is known that:
e(k+1)=Fe(k)+JK x f s (k)-(FH+L)K y f s (k)+HK y f s (k+1)+JDω(k)
assuming that the matrix M is a full rank matrix, M T M is a nonsingular matrix, and the pseudo-inverse matrix of M is expressed as M * =(M T M) -1 M T ,Z∈R (Nm)×(Nm+Np) Is an arbitrary matrix; it can be seen that J and H are described as:
3. the interconnected CPS-based attack detection method taking into account attack signals and unknown perturbations as claimed in claim 1, wherein step S3 comprises the steps of:
the state interval is defined as:
if it is notFor the schuler matrix, defineWherein R is a randomly selected Schur matrix, which can be selected as a non-negative matrix;
describing a Sylvester equation:for any Q, then a unique matrix T andwhen the system state is satisfiedWhen the system output meets the following conditions:
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210764383.4A CN115051872B (en) | 2022-06-30 | 2022-06-30 | Attack detection method considering attack signal and unknown disturbance based on interconnected CPS |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210764383.4A CN115051872B (en) | 2022-06-30 | 2022-06-30 | Attack detection method considering attack signal and unknown disturbance based on interconnected CPS |
Publications (2)
Publication Number | Publication Date |
---|---|
CN115051872A CN115051872A (en) | 2022-09-13 |
CN115051872B true CN115051872B (en) | 2023-03-17 |
Family
ID=83165662
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202210764383.4A Active CN115051872B (en) | 2022-06-30 | 2022-06-30 | Attack detection method considering attack signal and unknown disturbance based on interconnected CPS |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN115051872B (en) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN117039890B (en) * | 2023-10-08 | 2023-12-22 | 南京邮电大学 | Network attack detection-oriented power distribution network prediction auxiliary interval state estimation method |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109191326A (en) * | 2018-08-23 | 2019-01-11 | 东北大学 | The interdependent deposit system network attack methods of risk assessment of power distribution network CPS based on attacker visual angle |
CN109861825A (en) * | 2019-02-15 | 2019-06-07 | 浙江工商大学 | Detection method is internaled attack based on Weighted Rule and consistent degree in CPS system |
CN112600814A (en) * | 2020-12-08 | 2021-04-02 | 震兑工业智能科技有限公司 | Detection method and system for deception attack of ship CPS (cyber-physical system) |
CN113009825A (en) * | 2021-02-08 | 2021-06-22 | 云境商务智能研究院南京有限公司 | Deception-attacked nonlinear networked system state estimation method |
CN114063602A (en) * | 2021-11-15 | 2022-02-18 | 沈阳航空航天大学 | Active attack detection method for improving detection rate |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8666111B2 (en) * | 2011-05-24 | 2014-03-04 | Tata Consultancy Services Limited | System and method for detecting the watermark using decision fusion |
US11252169B2 (en) * | 2019-04-03 | 2022-02-15 | General Electric Company | Intelligent data augmentation for supervised anomaly detection associated with a cyber-physical system |
CN110213115B (en) * | 2019-06-25 | 2022-04-22 | 南京财经大学 | Security control method of event-driven network control system under multi-network attack |
CN110855683B (en) * | 2019-11-18 | 2021-08-10 | 东北电力大学 | Method for carrying out attack detection and reconstruction on electric power information physical system |
CN111130106B (en) * | 2020-01-10 | 2024-04-12 | 浙江工业大学 | Attack detection method for multi-region power system |
CN113765880B (en) * | 2021-07-01 | 2022-05-20 | 电子科技大学 | Power system network attack detection method based on space-time correlation |
CN113741198A (en) * | 2021-09-16 | 2021-12-03 | 云境商务智能研究院南京有限公司 | T-S fuzzy system self-adaptive event trigger state estimation method under random network attack |
CN114326382A (en) * | 2021-11-16 | 2022-04-12 | 山东师范大学 | Adaptive elastic tracking control method and system with spoofing attack |
-
2022
- 2022-06-30 CN CN202210764383.4A patent/CN115051872B/en active Active
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109191326A (en) * | 2018-08-23 | 2019-01-11 | 东北大学 | The interdependent deposit system network attack methods of risk assessment of power distribution network CPS based on attacker visual angle |
CN109861825A (en) * | 2019-02-15 | 2019-06-07 | 浙江工商大学 | Detection method is internaled attack based on Weighted Rule and consistent degree in CPS system |
CN112600814A (en) * | 2020-12-08 | 2021-04-02 | 震兑工业智能科技有限公司 | Detection method and system for deception attack of ship CPS (cyber-physical system) |
CN113009825A (en) * | 2021-02-08 | 2021-06-22 | 云境商务智能研究院南京有限公司 | Deception-attacked nonlinear networked system state estimation method |
CN114063602A (en) * | 2021-11-15 | 2022-02-18 | 沈阳航空航天大学 | Active attack detection method for improving detection rate |
Non-Patent Citations (1)
Title |
---|
孔令霖 ; 林家骏 ; 周昆 ; .一种抗CPS控制层欺骗攻击的算法.2015,(02),全文. * |
Also Published As
Publication number | Publication date |
---|---|
CN115051872A (en) | 2022-09-13 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
Karimi | Robust H∞ filter design for uncertain linear systems over network with network-induced delays and output quantization | |
CN113741309B (en) | Dual-dynamic event trigger controller model design method based on observer | |
CN115051872B (en) | Attack detection method considering attack signal and unknown disturbance based on interconnected CPS | |
CN112350664B (en) | Limited frequency fault detection method based on event trigger strategy | |
CN107070734B (en) | A kind of network control system fault detection method | |
Chen et al. | Resilient filter of nonlinear network systems with dynamic event-triggered mechanism and hybrid cyber attack | |
CN110989552B (en) | Fault estimation method of continuous stirred tank reactor system under network attack | |
CN109936568B (en) | Malicious attack prevention sensor data acquisition method based on recurrent neural network | |
CN110531732B (en) | Random fault detection method for nonlinear networked control system | |
Yang et al. | An unknown input multiobserver approach for estimation and control under adversarial attacks | |
CN114615143A (en) | Elastic distributed safety monitoring method under multi-sensor-observation network | |
CN113721458A (en) | Nonlinear system fault estimation observation method and device with disturbance | |
El-Amrani et al. | A finite frequency range approach to H∞ filtering for TS fuzzy systems | |
CN109660522B (en) | Deep self-encoder-based hybrid intrusion detection method for integrated electronic system | |
Zhu et al. | Fault detection for nonlinear networked control systems based on fuzzy observer | |
Kazemi et al. | Efficient resilient dynamic co‐estimation framework for cyber‐physical systems under sensor attacks | |
CN116502708A (en) | Performance evaluation and committee voting-based Bayesian attack resistant DFL method | |
CN111208731A (en) | Method for carrying out attack detection and reconstruction on electric power information physical system | |
Lu et al. | General decay synchronization and H∞ synchronization of multi-weighted coupled reaction-diffusion neural networks | |
CN114063602B (en) | Active attack detection method for improving detection rate | |
CN114039867B (en) | Joint interval estimation method for state and fault of networked control system under hidden attack | |
Lv et al. | Finite-Time Attack Detection and Secure State Estimation for Cyber-Physical Systems | |
Aldana-López et al. | Distributed differentiation with noisy measurements for exact dynamic consensus | |
Wang et al. | Sensor gain fault diagnosis for a class of nonlinear systems | |
CN111008687A (en) | Neural network monitoring model for safety of edge nodes of Internet of things |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |