Coding encryption method for spoofing attack detection of industrial information physical system

Abstract

The invention discloses a coding encryption method for industrial information physical system spoofing attack detection. The coding encryption method comprises the following steps: step 1, establishing an industrial information physical system model; step 2, establishing a coding encryption mechanism, realizing a data encryption and decryption process without spoofing attack, and generating a detection residual error; 3, according to the coding encryption mechanism and the residual error in the step 2, introducing an information physical system spoofing attack model, and analyzing the residual error change under the attack; 4, based on the residual change, selecting a detection statistic, setting a detection strategy and a detection threshold, and completing spoofing attack detection; and step 5, introducing a coding and decoding restarting mechanism to guarantee the normal operation of the system after the attack is ended and under the condition that a coding error exists. By encoding, decoding and encrypting the transmission data, spoofing attack detection is realized, certain confidentiality is provided, and the problems of limitation, difficulty in implementation and the like of the existing spoofing attack detection scheme can be effectively solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial cyber-physical system security, and in particular, relates to a coding encryption method for detecting deception attacks on industrial cyber-physical systems. Background Art

[0002] Cyber-physical systems are comprehensive technical systems that integrate industrial equipment, information technology, and communication networks. They are widely used in water conservancy, smart grids, aerospace, and other fields, providing technical support for complex industrial scenarios. However, the introduction of wireless communication networks has exposed cyber-physical systems to the dual threats of physical and cyber attacks. Cyber ​​attacks have become the main means of destroying cyber-physical systems due to their low cost and high destructiveness. Deception attacks are a typical type of cyber attack in which attackers destroy the remote state estimation of the system by modifying control data or measurement data. By mastering certain system models and defense knowledge, attackers can remain hidden from detectors while carrying out attacks, and deliver a fatal blow to cyber-physical systems. Therefore, achieving accurate detection and defense against deception attacks has become the key to protecting the safe operation of cyber-physical systems.

[0003] Existing deception attack detection methods all have certain limitations and shortcomings. Detectors based on statistical characteristics are not effective against hidden attacks. Detection schemes based on machine learning require complex model training and a large amount of data, with poor interpretability, and are difficult to implement and apply in industrial scenarios. Active detection schemes such as the moving target method and the physical watermark method affect the control performance of the information-physical system to a certain extent, or require the system to be modified, making it difficult to implement. Therefore, in order to ensure the safe and stable operation of the information-physical system, it is urgent to design a deception attack detection scheme that is efficient, maintains control performance, and is simple and convenient to implement. Summary of the invention

[0004] In order to solve the above problems, the present invention proposes a coding and encryption method for deception attack detection in industrial information-physical systems. By encoding, decoding and encrypting the transmitted data, deception attack detection is achieved while providing a certain degree of confidentiality. It can effectively solve the limitations and difficulty of implementation of existing deception attack detection schemes.

[0005] To achieve the above object, the technical solution adopted by the present invention is: a coding encryption method for industrial cyber-physical system deception attack detection, comprising the steps of:

[0006] Step 1: Establish an industrial cyber-physical system model, and provide the discrete linear time-invariant state space equation and remote state estimation of the industrial cyber-physical system model;

[0007] Step 2: Establish a coding encryption mechanism to realize the data encryption and decryption process without deception attacks and generate detection residuals;

[0008] Step 3: Based on the coding encryption mechanism and residual described in step 2, introduce the cyber-physical system deception attack model and analyze the residual changes under the attack;

[0009] Step 4: Based on the residual change, select the detection statistic, set the detection strategy and detection threshold, and complete the deception attack detection;

[0010] Step 5: Introduce a codec restart mechanism to ensure that the system operates normally after the attack ends and in the presence of coding errors.

[0011] Furthermore, in step 1, a discrete linear time-invariant information-physical system state space model with Gaussian noise is established:

[0012]

[0013] Where k represents the time, x(k) represents the state signal of the cyber-physical system, y(k) is the system measurement output signal, matrix A is the cyber-physical system matrix with appropriate dimensions, matrix C is the measurement matrix with appropriate dimensions, w(k) represents the process noise of the system, and v(k) is the measurement noise of the system;

[0014] Building a discrete cyber-physical system Kalman filter model for remote state estimation:

[0015]

[0016] in, is the state signal estimate of the cyber-physical system at time k-1, is the predicted quantity of the state signal of the system at time k;

[0017] Define the sequence of innovations transmitted in the channel:

[0018]

[0019] P(k|k-1)=AP(k-1)A T +Q;

[0020] Among them, P(k|k-1) is the covariance matrix of the state signal prediction error at time k; P(k-1) is the covariance matrix of the state signal estimation error at time k-1, and Q is the process noise matrix;

[0021] Build the Kalman filter gain matrix:

[0022] K(k)=P(k|k-1)C T (CP(k|k-1)C T +R) -1 ;

[0023] Get the estimated value of the state signal of the discrete information physical system at time k:

[0024]

[0025] Establish the covariance matrix of the state signal estimation error at time k:

[0026] P(k)=(IK(k))CP(k / k-1);

[0027] Where I is the identity matrix.

[0028] Furthermore, in step 2, a coding encryption mechanism is established to implement a data encryption and decryption process without a deception attack and generate a detection residual, including the steps of:

[0029] Define the data transmitted in the communication channel: c (k) = L1z(k) + L2z(k-1);

[0030] Wherein, L1 and L2 are encoding matrices with specified dimensions, z(k) is the new information data at time k, and z(k-1) is the new information data at time k+1;

[0031] When the system operates normally, the decoded data is:

[0032]

[0033] Among them, z d (k-1) is the decoded data at time k-1;

[0034] At this point, the decoding process is represented as a dynamic system:

[0035]

[0036] in, u(k)=[z T (k) z T (k-1)] T ;

[0037] Define z(-1)=z d (-1) = 0. At this time, the codec satisfies z d (k) = z(k), the decoding process is a stable dynamic system;

[0038] Define the detection residual: r(k) = z d (k).

[0039] Furthermore, in step 3, a cyber-physical system deception attack model is introduced to analyze the residual change caused by the deception attack, including:

[0040] In cyber-physical control systems, attackers construct hidden false data by eavesdropping on the data transmitted in the channel, and then send them to the remote state estimator and detector;

[0041] When the encoding and decoding mechanism is not used, the malicious vector constructed by the attacker is as follows:

[0042]

[0043] Where T(k) is an attack matrix with appropriate dimensions, b(k) is an independent and identically distributed Gaussian random vector, and z(k) is the new information data at time k;

[0044] A spoofing attack satisfies:

[0045]

[0046] Among them, E{z(k)} and are z(k) and The expectation of Cov{z(k)} and are z(k) and The covariance matrix of

[0047] Based on the encoding and decoding mechanism described in step 2, the malicious data constructed by the attacker is:

[0048]

[0049] L1 and L2 are encoding matrices with specified dimensions;

[0050] Decoded data after the attack:

[0051]

[0052] is the decoded data at time k under the deception attack, is the decoded data at time k-1 under the spoofing attack;

[0053] The decoding process at this time is a dynamic system:

[0054]

[0055] in,

[0056]

[0057] The attack is defined to start at time k0+1, and the initial value of the system is Selecting only the encoding matrices L1 and L2 makes the decoding system unstable, and the decoding error caused by the attack will diverge quickly; the divergence of the decoded data further leads to detection residuals. As the data continues to diverge, the statistical characteristics change; based on this fact, deception attack detection is further achieved.

[0058] Furthermore, in step 4, based on the residual change caused by the cyber-physical deception attack in step 3, a detection statistic is selected, a detection strategy and a detection threshold are set, and attack detection is implemented, including:

[0059] Definition of χ 2 Detection volume:

[0060]

[0061] Where j represents the detector window size, k is the time, r(i) is the residual at time i, and χ 2 (l) is a chi-square distribution with l degrees of freedom, Π is the covariance matrix of the residual r(k);

[0062] Set the detection strategy and detection threshold: When the system is operating normally, the residual follows a chi-square distribution with a degree of freedom of l. Select the detection threshold J according to the chi-square distribution table and the false alarm rate α th ; After the attack begins, the residuals diverge, the covariance increases, and further χ 2 The detection statistics will quickly diverge beyond the threshold; therefore, when the statistics exceed the threshold, it means that the detector has detected an attack, and when the statistics are less than the threshold, it means that no attack has been detected.

[0063] Furthermore, in step 5, a codec restart mechanism is introduced to ensure that the system operates normally after the attack ends and when there are coding errors, including:

[0064] 5.1: Set the restart threshold to prevent excessive divergence of residuals;

[0065] 5.2: Time tag asynchronous restart mechanism;

[0066] 5.3: Periodic restart mechanism.

[0067] Furthermore, in 5.1, the restart threshold is set to prevent excessive divergence of residuals, including:

[0068] Set the restart threshold J re,th When the detection amount When setting the new information data z(k) at time k and the decoded data z d (k) is 0, that is, z(k) = z d (k) = 0, restart the codec encryption mechanism;

[0069] If the residual still diverges after restart, it is considered that the deception attack is still ongoing; if the residual no longer diverges and remains below the threshold, it is considered that the attack is over and the alarm stops.

[0070] Furthermore, in 5.2, the time tag asynchronous restart mechanism includes:

[0071] Add a time tag to the sent data and define the time tag k sent by the sender s , the time label k accepted by the receiver r ; When the detector detects k s ≠k r , set z(k r -1)=z d (k r -1)=0, and the sender re-encodes and sends the encoded data z c (k r ), restart the codec encryption mechanism.

[0072] Furthermore, in 5.3, the periodic restart mechanism includes:

[0073] Define the restart time k i (i=0,1,2,…), satisfying k i+1 =k i +τ, τ is the restart period; at each moment k = k i , set z(k i -1)=z d (k i -1)=0, restart the codec encryption mechanism.

[0074] The beneficial effects of adopting this technical solution are:

[0075] The present invention relates to a coding and encryption scheme for detecting deception attacks on information-physical systems. An industrial information-physical system model is established to collect system input and output data; a coding and encryption scheme is established and a deception attack model is introduced; detection residuals are generated based on the coding and decoding scheme, and residual feature changes caused by deception attacks are analyzed; detection statistics are selected, detection thresholds and alarm strategies are set, and deception attacks are detected; a coding and decoding restart mechanism is introduced to ensure the normal operation of the system. The proposed information-physical system deception attack detection mechanism based on coding and encryption can achieve high-precision detection of deception attacks, and encoding and processing of data can also prevent eavesdropping attacks, while maintaining system control performance and being easy to implement, effectively solving the problems of certain limitations and poor applicability of existing deception attack detection methods.

[0076] The coding and decoding encryption scheme proposed in the present invention realizes high-performance detection of deception attacks on information-physical systems. By encoding and encrypting the transmitted data, the decoding process can be represented as a dynamic process. When the system operates normally, the decoding process is stable. After the attack occurs, the decoding error caused by the attack quickly diverges through a dynamic process, further realizing the detection of deception attacks. The restart mechanism introduced in the scheme can prevent the waste of resources and instability caused by excessive divergence of the detector, and ensure that the detection mechanism can still operate normally after the attack ends and in the presence of coding errors. Compared with existing detection schemes, the proposed coding and encryption detection mechanism can efficiently detect deception attacks, while being easy to implement and maintaining control performance without modifying the system structure. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 A schematic flow chart of a coding encryption method for industrial cyber-physical system deception attack detection according to the present invention;

[0078] Figure 2 A diagram showing a cyber-physical system model in an embodiment of the present invention;

[0079] Figure 3 The result of the codec encryption scheme spoofing attack detection in the embodiment of the present invention;

[0080] Figure 4 It is the false alarm rate and detection rate results of the coding and decoding encryption deception attack detection scheme in the embodiment of the present invention. DETAILED DESCRIPTION

[0081] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described below with reference to the accompanying drawings.

[0082] In this embodiment, see Figure 1 As shown, the present invention proposes a coding encryption method for industrial cyber-physical system deception attack detection, comprising the steps of:

[0083] Step 1: Establish an industrial cyber-physical system model, and provide the discrete linear time-invariant state space equation and remote state estimation of the industrial cyber-physical system model;

[0084] Step 2: Establish a coding encryption mechanism to realize the data encryption and decryption process without deception attacks and generate detection residuals;

[0085] Step 3: Based on the coding encryption mechanism and residual described in step 2, introduce the cyber-physical system deception attack model and analyze the residual changes under the attack;

[0086] Step 4: Based on the residual change, select the detection statistic, set the detection strategy and detection threshold, and complete the deception attack detection;

[0087] Step 5: Introduce a codec restart mechanism to ensure that the system operates normally after the attack ends and in the presence of coding errors.

[0088] As an optimized implementation of the above embodiment, an industrial cyber-physical system model is established, such as Figure 2 shown.

[0089] In step 1, a discrete linear time-invariant information-physical system state space model with Gaussian noise is established:

[0090]

[0091] Where k represents the time, χ(k) represents the state signal of the cyber-physical system, y(k) is the system measurement output signal, matrix A is the cyber-physical system matrix with appropriate dimensions, matrix C is the measurement matrix with appropriate dimensions, w(k) represents the process noise of the system, which is an independent and identically distributed Gaussian signal; v(k) is the measurement noise of the system, which obeys the zero-mean Gaussian distribution and satisfies:

[0092] Cov{[w T (k),v T (k)] T}=diag{Q,R}

[0093] Among them, Q>0 and R>0 are the covariance matrices of process noise and measurement noise, respectively.

[0094] Building a discrete cyber-physical system Kalman filter model for remote state estimation:

[0095]

[0096] in, is the state signal estimate of the cyber-physical system at time k-1, is the predicted quantity of the state signal of the system at time k;

[0097] Define the sequence of innovations transmitted in the channel:

[0098]

[0099] P(k|k-1)=AP(k-1)A T +Q;

[0100] Among them, P(k|k-1) is the covariance matrix of the state signal prediction error at time k; P(k-1) is the covariance matrix of the state signal estimation error at time k-1, and Q is the process noise matrix;

[0101] Build the Kalman filter gain matrix:

[0102] K(k)=P(k|k-1)C T (CP(k|k-1)C T +R) -1 ;

[0103] Get the estimated value of the state signal of the discrete information physical system at time k:

[0104]

[0105] Establish the covariance matrix of the state signal estimation error at time k:

[0106] P(k)=(IK(k))CP(k / k-1);

[0107] Where I is the identity matrix.

[0108] As an optimized implementation scheme of the above embodiment, in step 2, a coding encryption mechanism is established to implement the data encryption and decryption process without deception attack and generate detection residuals, including the steps of:

[0109] Define the data transmitted in the communication channel: c (k) = L1z(k) + L2z(k-1);

[0110] Wherein, L1 and L2 are encoding matrices with specified dimensions, z(k) is the new information data at time k, and z(k-1) is the new information data at time k+1;

[0111] When the system operates normally, the decoded data is:

[0112]

[0113] Among them, z d (k-1) is the decoded data at time k-1;

[0114] At this point, the decoding process is represented as a dynamic system:

[0115]

[0116] in, u(k)=[z T (k) z T (k-1)] T ;

[0117] Define z(-1)=z d (-1) = 0. At this time, the codec satisfies z d (k) = z(k), the decoding process is a stable dynamic system;

[0118] Define the detection residual: r(k) = z d(k).

[0119] When no deception attack is implemented, the detection residual r(k) obeys a zero-mean Gaussian distribution with a covariance of in,

[0120] As an optimized implementation scheme of the above embodiment, in step 3, a cyber-physical system deception attack model is introduced to analyze the residual change caused by the deception attack, including:

[0121] In cyber-physical control systems, attackers construct hidden false data by eavesdropping on the data transmitted in the channel, and then send them to the remote state estimator and detector;

[0122] When the encoding and decoding mechanism is not used, the malicious vector constructed by the attacker is as follows:

[0123]

[0124] Where T(k) is an attack matrix with appropriate dimensions, b(k) is an independent and identically distributed Gaussian random vector, and z(k) is the new information data at time k;

[0125] A spoofing attack satisfies:

[0126]

[0127] Among them, E{z(k)} and are z(k) and The expectation of Cov{z(k)} and are z(k) and The covariance matrix of

[0128] Based on the encoding and decoding mechanism described in step 2, the malicious data constructed by the attacker is:

[0129]

[0130] L1 and L2 are encoding matrices with specified dimensions;

[0131] Decoded data after the attack:

[0132]

[0133] is the decoded data at time k under the deception attack, is the decoded data at time k-1 under the spoofing attack;

[0134] The decoding process at this time is a dynamic system:

[0135]

[0136] in,

[0137]

[0138] [z T (k) z T (k-1) b T (k)] T ;

[0139] The attack is defined to start at time k0+1, and the initial value of the system is Selecting only the encoding matrices L1 and L2 makes the decoding system unstable, and the decoding error caused by the attack will diverge quickly; the divergence of the decoded data further leads to detection residuals. As the data continues to diverge, the statistical characteristics change; based on this fact, deception attack detection is further achieved.

[0140] As an optimized implementation scheme of the above embodiment, in step 4, based on the residual change caused by the cyber-physical deception attack in step 3, a detection statistic is selected, a detection strategy and a detection threshold are set, and attack detection is implemented, including:

[0141] Definition of χ 2 Detection volume:

[0142]

[0143] Where j represents the detector window size, k is the time, r(i) is the residual at time i, and χ 2 (l) is a chi-square distribution with l degrees of freedom, Π is the covariance matrix of the residual r(k);

[0144] Set the detection strategy and detection threshold: When the system is operating normally, the residual follows a chi-square distribution with a degree of freedom of l. Select the detection threshold J according to the chi-square distribution table and the false alarm rate α th ; After the attack begins, the residuals diverge, the covariance increases, and further χ 2 The detection statistics will quickly diverge beyond the threshold; therefore, when the statistics exceed the threshold, it means that the detector has detected an attack, and when the statistics are less than the threshold, it means that no attack has been detected.

[0145] The detection strategy is expressed as:

[0146]

[0147] As an optimized implementation of the above embodiment, in step 5, a codec restart mechanism is introduced to ensure that the system operates normally after the attack ends and when there are coding errors, including:

[0148] 5.1: Set the restart threshold to prevent excessive divergence of residuals.

[0149] After the attack occurs, based on the analysis in step 3, the unstable dynamic system has been activated, and even if the attack ends, the residual will continue to diverge. This situation will cause the system to be unable to identify whether the deception attack has ended, and the defense system will continue to respond to non-existent attacks, wasting resources and causing instability in the cyber-physical system. At the same time, the detector loses its sensitivity to new attacks, and the attacker may use the detector's divergent state to launch new attacks.

[0150] In order to keep the detector working continuously, the restart threshold J is set re,th When the detection amount When setting the new information data z(k) at time k and the decoded data z d (k) is 0, that is, z(k) = z d (k) = 0, restart the encoding encryption and decryption mechanism;

[0151] If the residual still diverges after restart, it is considered that the deception attack is still ongoing; if the residual no longer diverges and remains below the threshold, it is considered that the attack is over and the alarm stops.

[0152] 5.2: Time tag asynchronous restart mechanism.

[0153] Codec encryption realizes deception attack detection from the perspective of data correlation in the time dimension, requiring time synchronization at both ends of the channel.

[0154] Considering data loss and communication delay, a time tag is added to the sent data and the time tag k sent by the sender is defined as s , the time label k accepted by the receiver r ; When the detector detects k s ≠k r , set z(k r -1)=z d (k r -1)=0, and the sender re-encodes and sends the encoded data z c (k r ), restart the codec encryption mechanism.

[0155] 5.3: Periodic restart mechanism.

[0156] Based on the analysis in step 3, the codec encryption scheme is sensitive to attacks. At the same time, decoding errors caused by calculation accuracy, noise, etc. will also accumulate in the residual. In order to prevent the residual from diverging due to error accumulation and affecting the detection performance of the codec mechanism, a periodic restart mechanism is introduced.

[0157] Define the restart time k i (i=0,1,2,…), satisfying k i+1 =ki +τ, τ is the restart period; at each moment k = k i , set z(k i -1)=z d (k i -1)=0, restart the codec encryption mechanism.

[0158] Examples:

[0159] Consider a cyber-physical system with the following parameters:

[0160]

[0161] C=I 3×3 ;

[0162] Q=R=I 3×3 ;

[0163] L1=I 3×3 ;

[0164] L2=1.01×I 3×3 ;

[0165] When k∈[51,100], a deception attack is carried out on the system, χ 2 The test statistic changes as Figure 3 As shown, the false alarm rate and detection rate results are as follows Figure 4 As shown. Figure 4 As shown in Figure 1, after the attack begins, the detection volume quickly diverges to exceed the threshold, thus achieving the detection of deception attacks. Figure 4 As shown in the figure, when there is no attack, the false alarm rate of the system is very low. After the attack starts, as the attack continues, the detection rate gradually approaches 1.

[0166] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A coding encryption method for industrial cyber-physical system deception attack detection, characterized in that: Includes steps: Step 1: Establish an industrial cyber-physical system model, and provide the discrete linear time-invariant state space equation and remote state estimation of the industrial cyber-physical system model; Step 2: Establish a coding encryption mechanism to realize the data encryption and decryption process without deception attacks and generate detection residuals; Step 3: Based on the coding encryption mechanism and residual described in step 2, introduce the cyber-physical system deception attack model and analyze the residual changes under the attack; Step 4: Based on the residual change, select the detection statistic, set the detection strategy and detection threshold, and complete the deception attack detection; Step 5: Introduce a codec restart mechanism to ensure that the system operates normally after the attack ends and in the presence of coding errors.

2. The coding encryption method for industrial cyber-physical system deception attack detection according to claim 1 is characterized in that: In step 1, a discrete linear time-invariant information-physical system state space model with Gaussian noise is established: Where k represents the time, χ(k) represents the state signal of the cyber-physical system, y(k) is the system measurement output signal, matrix A is the cyber-physical system matrix with appropriate dimensions, matrix C is the measurement matrix with appropriate dimensions, w(k) represents the process noise of the system, and v(k) is the measurement noise of the system; Building a discrete cyber-physical system Kalman filter model for remote state estimation: in, is the state signal estimate of the cyber-physical system at time k-1, is the predicted quantity of the state signal of the system at time k; Define the sequence of innovations transmitted in the channel: P(k|k-1)=AP(k-1)A T +Q; Among them, P(k|k-1) is the covariance matrix of the state signal prediction error at time k; P(k-1) is the covariance matrix of the state signal estimation error at time k-1, and Q is the process noise matrix; Build the Kalman filter gain matrix: K(k)=P(k|k-1)C T (CP(k|k-1)C T +R) -1 ; Get the estimated value of the state signal of the discrete information physical system at time k: Establish the covariance matrix of the state signal estimation error at time k: P(k)=(IK(k))CP(k|k-1) Where I is the identity matrix.

3. The coding encryption method for industrial cyber-physical system deception attack detection according to claim 1 is characterized in that: In step 2, a coding encryption mechanism is established to implement the data encryption and decryption process without deception attack and generate detection residuals, including the steps of: Define the data transmitted in the communication channel: c (k) = L1z(k) + L2z(k-1); Wherein, L1 and L2 are encoding matrices with specified dimensions, z(k) is the new information data at time k, and z(k-1) is the new information data at time k+1; When the system operates normally, the decoded data is: Among them, z d (k-1) is the decoded data at time k-1; At this point, the decoding process is represented as a dynamic system: Among them, u(k)=[z T (k) z T (k-1)] T ; Define z(-1)=z d (-1) = 0; at this time, the codec satisfies z d (k) = z(k), the decoding process is a stable dynamic system; Define the detection residual: r(k) = z d (k).

4. The coding encryption method for industrial cyber-physical system deception attack detection according to claim 1 is characterized in that: In step 3, a cyber-physical system deception attack model is introduced to analyze the residual changes caused by the deception attack, including: In cyber-physical control systems, attackers construct hidden false data by eavesdropping on the data transmitted in the channel, and then send them to the remote state estimator and detector; When the encoding and decoding mechanism is not used, the malicious vector constructed by the attacker is as follows: Where T(k) is an attack matrix with appropriate dimensions, b(k) is an independent and identically distributed Gaussian random vector, and z(k) is the new information data at time k; A spoofing attack satisfies: Among them, E{z(k)} and are z(k) and The expectation of Cov{z(k)} and are z(k) and The covariance matrix of Based on the encoding and decoding mechanism described in step 2, the malicious data constructed by the attacker is: L1 and L2 are encoding matrices with specified dimensions; Decoded data after the attack: is the decoded data at time k under the spoofing attack, is the decoded data at time k-1 under the spoofing attack; The decoding process at this time is a dynamic system: in, The attack is defined to start at time k0+1, and the initial value of the system is Selecting only the encoding matrices L1 and L2 makes the decoding system unstable, and the decoding error caused by the attack will diverge quickly; the divergence of the decoded data further leads to detection residuals. As the data continues to diverge, the statistical characteristics change; based on this fact, deception attack detection is further achieved.

5. The coding encryption method for industrial cyber-physical system deception attack detection according to claim 1 is characterized in that: In step 4, based on the residual change caused by the cyber-physical deception attack in step 3, a detection statistic is selected, a detection strategy and a detection threshold are set, and attack detection is implemented, including: Definition of χ 2 Detection volume: Where j represents the detector window size, k is the time, r(i) is the residual at time i, and χ 2 (1) is a chi-square distribution with l degrees of freedom, and Π is the covariance matrix of the residual r(k); Set the detection strategy and detection threshold: When the system is operating normally, the residual follows a chi-square distribution with a degree of freedom of l. Select the detection threshold J according to the chi-square distribution table and the false alarm rate α th ; After the attack begins, the residuals diverge, the covariance increases, and further χ 2 The detection statistics will quickly diverge beyond the threshold; therefore, when the statistics exceed the threshold, it means that the detector has detected an attack, and when the statistics are less than the threshold, it means that no attack has been detected.

6. The coding encryption method for industrial cyber-physical system deception attack detection according to claim 1 is characterized in that: In step 5, a codec restart mechanism is introduced to ensure that the system operates normally after the attack ends and when there are coding errors, including: 5.1: Set the restart threshold to prevent excessive divergence of residuals; 5.2: Time tag asynchronous restart mechanism; 5.3: Periodic restart mechanism.

7. A coding encryption method for industrial cyber-physical system deception attack detection according to claim 6, characterized in that: In 5.1, restart thresholds are set to prevent excessive divergence of residuals, including: Set the restart threshold J re,th When the detection amount When setting the new information data z(k) at time k and the decoded data z d (k) is 0, that is, z(k) = z d (k) = 0, restart the codec encryption mechanism; If the residual still diverges after restart, it is considered that the deception attack is still ongoing; if the residual no longer diverges and remains below the threshold, it is considered that the attack is over and the alarm stops.

8. The coding encryption method for industrial cyber-physical system deception attack detection according to claim 6 is characterized in that: In 5.2, the time tag asynchronous restart mechanism includes: Add a time tag to the sent data and define the time tag k sent by the sender s , the time label k accepted by the receiver r ; When the detector detects k s ≠k r , set z(k r -1)=z d (k r -1)=0, and the sender re-encodes and sends the encoded data z c (k r ), restart the codec encryption mechanism.

9. The coding encryption method for industrial cyber-physical system deception attack detection according to claim 6 is characterized in that: In 5.3, the periodic restart mechanism includes: defining the restart time k i (i=0,1,2,…), satisfying k i+1 =k i +τ, τ is the restart period; at each moment k = k i , set z(k i -1)=z d (k i -1)=0, restart the codec encryption mechanism.

Images