An industrial control system dual-channel false data injection attack detection method

Abstract

The application discloses an industrial control system double-channel false data injection attack detection method, which combines an extended observer and a Kalman filter to estimate disturbance, redesigns a residual detector based on the Kalman filter in the face of disturbance compensation, and designs a watermark encryption algorithm for the case that the disturbance is attacked. The method can successfully detect double-channel attacks that have concealment on the residual detector based on the Kalman filter, avoid the attack false alarm problem existing in the disturbance scene, realize accurate detection of double-channel false data injection attacks in the industrial control system, and has important value for the safety protection of the industrial process control system.

Description

Technical Field

[0001] This invention relates to the field of security protection for industrial control systems, specifically a method for detecting dual-channel fake data injection attacks in industrial control systems. Background Technology

[0002] Currently, fake data injection attacks in industrial control systems employ diverse methods, and attackers are becoming increasingly sophisticated. For instance, when attackers have knowledge of the system model, detection by defenders becomes significantly more challenging. Existing detection methods for fake data injection attacks are typically based on estimation, primarily Kalman filtering, which is often combined with residual detection for attack detection.

[0003] Fake data injection attacks can target sensor channels, affecting the state estimation process and indirectly leading to incorrect controller decisions; they can also target actuator channels, modifying the control commands received by the actuators to directly cause incorrect control actions, thus affecting the entire system. Consider the following typical industrial control system model:

[0004]

[0005] In the above formula These three variables represent the system state variables at time k, the control input, and the output, respectively, while x(k+1) represents the system state variables at time k+1. Represents the state matrix, Represents the input matrix, Indicates the output matrix. For disturbance quantity, This indicates that the disturbance acts on the system through the disturbance channel, and w(k) and v(k) are the noise in the system, which follows a Gaussian distribution and exists as w(k) ~ N(0,Q). w ),v(k)~N(0,Q v ), Q w and Q v Let represent the covariance matrices of the two data sources, respectively. The operational form of a dual-channel fake data injection attack can be represented as follows:

[0006]

[0007] In the above formula, y a (k) and u a α(k) represents the output and control quantities after the attack, respectively. α(k) represents the attack applied to the output quantity on the sensor channel, and β(k) represents the attack applied to the actuator channel.

[0008] A dual-channel attack refers to simultaneously targeting both the sensor and actuator channels. The attacker has prior knowledge of the system model and can intercept system data in real time. For example, through careful design, a Kalman filter-based residual detector can fail to detect this attack. A typical form of this dual-channel attack is... [1] :

[0009]

[0010] In the above formula Gaussian noise is set for the attacker; β(k) is the attack applied to the actuator channel, F is the iterative gain matrix; α(k) is the sensor channel attack, which contains the system model matrices A, B, C and the real-time data y(k) and u(k-1) in the system. This refers to the system state estimate generated by the attacker's Kalman filter. In existing false data injection attack detection methods, to avoid false alarms due to disturbances, some methods pre-estimate the disturbance quantity and transmit the estimated disturbance quantity d(k) and output quantity y(k) together through the communication network. Attackers also have the ability to attack the disturbance quantity in the communication network against these detection methods. For detection methods aimed at disturbance compensation, the disturbance quantity d after the attacker's attack... a (k) is the Gaussian noise ω(k) set by the attacker to evade detection.

[0011] Under the aforementioned attacks, the system appears perfectly normal on the surface. After the attack, the system variables conform to the system model's rules, and the system output also meets the accuracy and stability indicators of the control system. Considering the objective existence of disturbances in industrial control systems, it is urgent to implement detection of such attacks under disturbed systems in order to achieve comprehensive security protection for industrial control systems. Summary of the Invention

[0012] This invention addresses the problems existing in the background technology by designing a dual-channel fake data injection attack detection method for industrial control systems. The method combines an extended observer (ESO) and Kalman filtering to estimate the disturbance, transmits the disturbance and output together to the detector via a communication network, redesigns a residual detector based on Kalman filtering for disturbance compensation, and designs a watermark encryption algorithm for attack detection. The method includes the following steps:

[0013] 1) Utilize the control quantity u after being attacked a The combined estimate of the state and disturbance is estimated using the output y(k) and the output y(k). complex

[0014] The perturbation estimation method is based on Kalman filtering and ESO. The ESO part is as follows:

[0015]

[0016] Among them, E s For the gain of ESO, E is the posterior estimate of the state variables by the Kalman filter at time k. s pass

[0017] Configure system pole selection, and include:

[0018]

[0019] Where A, B, C, and D are the parameter matrices in the control system. Represents the system matrix.

[0020] Represents the input matrix, Represents the output matrix. Denotes the perturbation channel matrix, k x ,k y ,k u ,k d Let x(k), y(k), u(k), and d(k) be the dimensions of x(k), y(k), u(k), and d(k), respectively, where x(k), u(k), and d(k) are the system state variables, control variables, and disturbance variables at time k, respectively.

[0021] The momentum and Kalman filter part is as follows:

[0022]

[0023] Where K f The gain of the Kalman filter. This represents the prior estimate of the system state variables at time k.

[0024] K is the perturbation estimated by ESO at time k. f Calculate using the following steps:

[0025] 1-1) Iterate according to the following formula:

[0026]

[0027] The iterative process makes the intermediate variable K s (k) is stable, and the stable K s (k) is denoted as K s In the above formula, Q w and Q v Let Q represent the covariance matrices of w(k) and v(k), respectively. d Let A(k) = AK be the covariance matrix of d(k). s (k)C,P represents the covariance matrix of the system state estimation error;

[0028] 1-2) Calculate the Kalman filter gain K f :K f =A -1 K s 1) Where A is the system matrix in the control system model; 2) In Extract the disturbance estimate from the middle

[0029]

[0030] In the above formula For dimension k d unit array, It is a zero matrix, and Watermark encryption becomes

[0031] d ink (k), the encryption steps are as follows:

[0032] 2-1) Generate a time-varying watermark sequence ink(k) that does not conform to a Gaussian distribution;

[0033] 2-2) Superimpose the watermark signal onto the estimated disturbance signal:

[0034]

[0035] In the above formula, d ink (k) is the perturbation estimation signal after watermark encryption;

[0036] 3) d ink (k) and y(k) are transmitted together to the controller and detector via the communication network. Due to the possibility of sensor channel attacks during transmission, they are respectively denoted as (k) and (y(k)) at the controller and detector. and y a (k);

[0037] 4) Perform watermark removal operation to obtain

[0038]

[0039] In the above formula This is the estimated disturbance signal after watermark removal;

[0040] 5) Use the potentially vulnerable output quantity y on the controller side. a (k) Perform state estimation based on Kalman filtering. The estimation method is as follows:

[0041]

[0042] In the above formula This represents the prior estimate of the system state variables at time k. The posterior estimate of the system state variables at time k represents the Kalman filter gain, which is calculated as follows:

[0043] K = PC T (CPC T +Q v ) -1

[0044] In the above formula, P represents the covariance matrix of the system state estimation error, and Q... v Let v(k) be the covariance matrix;

[0045] 6) Calculate the residual z(k) for disturbance compensation. The calculation steps are as follows:

[0046] 6-1) Calculate the state estimation error at time k.

[0047]

[0048] 6-2) Utilization and Perform disturbance compensation and calculate the residual z(k):

[0049]

[0050] In the above formula This represents the prior estimate of the system state variables by the Kalman filter at time k under attack conditions.

[0051] This is the estimated perturbation value after the attack at time k-1;

[0052] 7) Combine the residual result z(k) with the preset threshold z th In comparison, if z(k) > z th If an alert is issued, proceed to step 1); otherwise, proceed to step 1) and continue with the attack detection at the next moment.

[0053] Beneficial effects:

[0054] This invention discloses a method for detecting dual-channel fake data injection attacks in industrial control systems. This method combines an extended observer and a Kalman filter for disturbance estimation, redesigns a residual detector based on the Kalman filter for disturbance compensation, and specifically designs a watermark encryption detection algorithm. This method can detect stealthy dual-channel fake data injection attacks while avoiding false alarms caused by external disturbances in the industrial control loop. It achieves accurate detection of dual-channel fake data injection attacks in industrial control systems, and has significant value for the security protection of industrial process control systems. Attached Figure Description

[0055] Figure 1 This is a structural diagram of the control loop and attack detection system in an embodiment of the present invention;

[0056] Figure 2 This is a flowchart of the attack detection process in an embodiment of the present invention;

[0057] Figure 3 This is a diagram illustrating the stealth effect of a dual-channel attack in an embodiment of the present invention.

[0058] Figure 4 This is a schematic diagram illustrating the disturbance estimation principle in an embodiment of the present invention;

[0059] Figure 5 This is a diagram showing the perturbation estimation results before the attack in an embodiment of the present invention;

[0060] Figure 6 This is a diagram showing the residual detection results under dual-channel attack in an embodiment of the present invention. Detailed Implementation

[0061] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, illustrating the implementation effect of the dual-channel fake data injection attack detection method for industrial control systems through specific operation procedures. This embodiment is implemented based on the technical solution of the present invention, but the scope of protection of the present invention is not limited to the following embodiments.

[0062] The schematic diagram of the control loop structure in this embodiment is shown below. Figure 1 As shown, a digital simulation is used for illustration. A composite disturbance observer is installed at the industrial site for disturbance estimation, and an attack detector is installed in the control room for attack detection. The basic model of the control system includes 3 state variables, 2 measured outputs, and 2 control inputs. The specific model parameter settings are as follows:

[0063]

[0064]

[0065] Both v(k) and w(k) have an amplitude of 1.0 × 10. -3 The system has a zero-mean random variable, and there is a sinusoidal perturbation with an amplitude of 1. The perturbation acts on the system state variables through matrix D, where matrix D = [0.05 0.03 0.06]. T System control is achieved through status feedback; in this embodiment, the detection threshold z is used. th =0.1.

[0066] The workflow of this implementation case is as follows: Figure 2 As shown, a dual-channel fake data injection attack was injected into the system at time 50:

[0067]

[0068] The initial value of the forward channel attack β(k) is: Iterative gain matrix α(k) represents the sensor channel attack at time k, and ξ(k) represents the Gaussian component in α(k); simultaneously, the perturbation amount after watermark encryption is applied at time 50. Set to Gaussian noise ω(k), ω(k)~N(0,1.0×10⁻⁶). -3 The detection results of a traditional Kalman filter-based residual detector under attack are as follows: Figure 3 As shown, the false alarm situation of the detector to disturbances is explained before time 50, and the stealth of the dual-channel false data injection attack is explained after time 50.

[0069] The specific implementation steps for this case study are as follows:

[0070] 1) Utilize the control quantity u after being attacked a The combined estimation of state and disturbance is obtained by using (k) and output y(k). Composite disturbance

[0071] The dynamic estimation method is based on Kalman filtering and ESO, and the principle is as follows: Figure 4 As shown, the ESO part is:

[0072]

[0073] in E is the posterior estimate of the state variables by the Kalman filter at time k. s E represents the gain of ESO. s By configuring the matrix The pole is obtained at [0+2i 0-..7i7 .400.1.]. And there are:

[0074]

[0075] Where A, B, C, and D are the parameter matrices in the control system. Represents the system matrix.

[0076] Represents the input matrix, Represents the output matrix. This indicates that the disturbance acts on the system through this disturbance channel, k x ,k y ,k u ,k d Let x(k), y(k), u(k), and d(k) be the dimensions of x(k), y(k), u(k), and d(k), respectively, and let x(k), u(k), and d(k) be the system states at time k.

[0077] The variables are quantity, control quantity, and disturbance quantity, with the Kalman filter part being:

[0078]

[0079] in This represents the prior estimate of the system state variables at time k. This represents the posterior estimate of the system state variables at time k. K is the perturbation estimated by ESO at time k. f The gain of the Kalman filter is calculated according to the following steps:

[0080] 1-1) Iterate according to the following formula:

[0081]

[0082] The iterative process makes the intermediate variable K s (k) is stable, and the stable K s (k) is denoted as K s In the above formula, Q w and Q v Let Q represent the covariance matrices of w(k) and v(k), respectively. d Let A(k) = AK be the covariance matrix of d(k). s (k)C,P represents the covariance matrix of the system state estimation error;

[0083] 1-2) Calculate the Kalman filter gain K f =A -1 K s Where A is the system matrix in the control system model;

[0084] 2) In Separate from

[0085]

[0086] In the above formula For dimension k d unit array, The zero matrix is ​​used to compare the separated disturbances with the actual system disturbances, for example... Figure 5 As shown, and will Watermark encryption becomes d ink (k), the encryption steps are as follows:

[0087] 2-1) Generate a time-varying watermark sequence ink(k) that does not conform to a Gaussian distribution;

[0088] 2-2) Superimpose the watermark signal onto the estimated disturbance signal:

[0089]

[0090] In the above formula, d ink (k) is the perturbation estimation signal after watermark encryption;

[0091] 3) d ink (k) and y(k) are transmitted together to the controller and detector via the communication network, d ink After being transmitted through the communication network, y(k) and y(k) are respectively denoted as and y a (k);

[0092] 4) Perform watermark removal operation to obtain The watermark removal process is as follows:

[0093]

[0094] In the above formula This is the estimated disturbance signal after watermark removal;

[0095] 5) Use the potentially vulnerable output quantity y on the controller side. a (k) Perform state estimation based on Kalman filtering. The estimation method is as follows:

[0096]

[0097] In the above formula This represents the prior estimate of the system state variables at time k. The posterior estimate of the system state variables at time k represents the Kalman filter gain, which is calculated as follows:

[0098] K = PC T (CPC T +Q v ) -1

[0099] In the above formula, P represents the covariance matrix of the system state estimation error, and Q... v Let v(k) be the covariance matrix.

[0100] 6) Calculate the residuals for disturbance compensation. The calculation steps are as follows:

[0101] 6-1) Calculate the state estimation error at time k.

[0102]

[0103] 6-2) Utilization and Perform disturbance compensation and calculate the residual z(k):

[0104]

[0105] In the above formula This represents the prior estimate of the system state variables by the Kalman filter at time k under attack conditions. This is the estimated perturbation value after the attack corresponding to k-1;

[0106] 7) Combine the residual result z(k) with the preset threshold z th In comparison, the dimension of the residual z(k) is the same as that of the measured output y(k), which is two-dimensional. The residual detection results are as follows: Figure 6 As shown in the figure, z1 and z2 are the two components of the two-dimensional residual z(k). It can be seen that after the dual-channel attack occurs at time 50, z(k) > z th The detector issues an attack warning and proceeds to step 1).

[0107] In summary, this attack detection method can successfully detect stealthy dual-channel attacks on detectors based on Kalman filter residuals, while avoiding false alarms in disturbed scenarios, which is of great value for the security protection of industrial process control systems.

[0108] The present invention has been clearly described through the above embodiments and accompanying drawings. Without departing from the spirit and essence of the present invention, those skilled in the art can make corresponding changes and modifications based on the present invention, and these changes and modifications all fall within the protection scope of the claims of the present invention.

[0109] All methods not covered in this invention are the same as or can be implemented using existing technologies.

Claims

1. A method for detecting dual-channel fake data injection attacks in industrial control systems, characterized in that... This paper addresses the detection of fake data injection attacks on both sensor and actuator channels. These attacks are highly evasive to Kalman filter-based residual attack detectors. The method first observes system disturbances, then transmits the watermarked, encrypted disturbance and output values ​​to the controller / attack detector. Finally, a new Kalman filter-based residual detector is designed for attack detection. The steps include: 1) Utilize the control quantity u after being attacked a The combined estimate of the state and disturbance is estimated using the output y(k) and the output y(k). k represents the time; 2) In Extracting disturbance estimates from the data And Watermark encryption becomes d ink (k); 3) d ink (k) and y(k) are transmitted together to the controller and detector via the communication network, d ink After being transmitted through the communication network, y(k) and y(k) are respectively denoted as and y a (k); 4) Perform watermark removal operation to obtain the watermark-removed perturbation estimation signal. 5)Use y a (k) Perform state estimation; 6) Calculate the residual z(k) for disturbance compensation; 7) Combine the residual result z(k) with the preset threshold z th In comparison, if z(k) > z th If a warning is issued, proceed to step 1; otherwise, proceed directly to step 1.

2. The method according to claim 1, characterized in that... The system state and disturbances are estimated at the industrial site using a composite disturbance estimation method based on Kalman filtering and an extended observer, yielding combined estimates. The extended observer part in the composite perturbation estimation is: Where E s To expand the observer gain, It is the posterior estimate of the state variables by the Kalman filter at time k, and we have: Where A, B, C, and D are the parameter matrices in the control system. Represents the system matrix. Represents the input matrix, Represents the output matrix. Denotes the perturbation channel matrix, k x ,k y ,k u ,k d Let x(k), y(k), u(k), and d(k) be the dimensions of x(k), y(k), u(k), and d(k), respectively, where x(k), u(k), and d(k) are the system state variables, control variables, and disturbance variables at time k, respectively. The Kalman filter part is as follows: Where K f The gain of the Kalman filter. This represents the prior estimate of the system state variable at time k. This represents the perturbation estimated by the extended state observer at time k.

3. The method according to claim 2, characterized in that... The gain E of the extended observer s By configuring pole selection, the gain K of the Kalman filter can be adjusted. f Calculate using the following steps: 1-1) Iterate according to the following formula: The iterative process makes the intermediate variable K s (k) is stable, and the stable K s (k) is denoted as K s In the above formula, Q w and Q v Let Q represent the covariance matrices of w(k) and v(k), respectively, where w(k) and v(k) are the noise in the system; d Let d(k) be the covariance matrix. A(k) = AK s (k)C,P represents the covariance matrix of the system state estimation error; 1-2) Calculate the Kalman filter gain K f =A -1 K s , where A is the system matrix in the control system model.

4. The method according to claim 1, characterized in that... The following method is used from Separate from In the above formula For dimension k d unit array, It is a zero matrix.

5. The method for detecting dual-channel fake data injection attacks in an industrial control system according to claim 1, characterized in that... Will Watermark encryption is performed, and the encryption steps are as follows: 2-1) Generate a time-varying watermark sequence ink(k) that does not conform to a Gaussian distribution; 2-2) Superimpose the watermark signal onto the estimated disturbance signal: In the above formula, d ink (k) is the perturbation estimation signal after watermark encryption.

6. The method according to claim 1, characterized in that... Transmitted to the controller side Perform watermark removal: In the above formula This is the estimated disturbance signal after watermark removal.

7. The method according to claim 1, characterized in that... Using y on the controller side a (k) Perform state estimation based on Kalman filtering. The estimation method is as follows: In the above formula This represents the prior estimate of the system state variables at time k. The posterior estimate of the system state variables at time k represents the Kalman filter gain, which is calculated as follows: K=PC T (CPC T +Q v ) -1 In the above formula, P represents the covariance matrix of the system state estimation error, and Q... v Let v(k) be the covariance matrix.

8. The method according to claim 1, characterized in that... Attack detection is performed on the residual z(k) calculated for disturbance compensation. The calculation steps are as follows: 6-1) Calculate the state estimation error at time k. 6-2) Utilization and Perform disturbance compensation and calculate residuals: In the above formula This represents the prior estimate of the system's state variables at time k by the Kalman filter under attack conditions. This is the estimated perturbation value after being attacked at time k-1.

Images