Interconnected information physical system distributed attack detection method based on equivalent space method

Abstract

The invention discloses an interconnected information physical system distributed attack detection method based on an equivalent space method. The method comprises the following steps: step 1, establishing a distributed model and an overall model of an interconnected information physical system; 2, constructing a coverage attack model and a replay attack model in the interconnected information physical system; 3, constructing an overall residual error and a distributed residual error of the interconnected information physical system based on an equivalent space method; 4, based on the distributed residual errors in the step 3, analyzing residual error changes of neighbor subsystems when a single subsystem in the interconnected information physical system is subjected to network attacks; and 5, selecting a proper detection statistical magnitude by using residual error change caused by the attack, formulating a detection strategy and selecting a detection threshold value, and completing attack detection. According to the method, distributed attack detection on the interconnected information physical system is realized by constructing the distributed residual error of the interconnected information physical control system based on the equivalent space method.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security of interconnected cyber-physical control systems, and in particular, relates to a distributed attack detection method for interconnected cyber-physical systems based on an equivalent space method. Background Art

[0002] An interconnected cyber-physical control system is composed of multiple cyber-physical control systems that are coupled on physical devices and have information transmission between communication networks. In addition, traditional infrastructure such as power systems and transportation systems are now large-scale interconnected systems. The design and construction costs of interconnected cyber-physical control systems are often high, and cyber attacks on the systems can cause huge social and economic losses. Since interconnected cyber-physical control systems have a more complex structure and composition than single systems, the mutual influence and coupling between various systems greatly increase the difficulty of attack detection and isolation. Interconnected cyber-physical control systems are interconnected on physical devices and communication networks, and the various subsystems influence each other, making interconnected cyber-physical control systems more sensitive to cyber attacks and more vulnerable to attacks.

[0003] Most of the current methods for distributed attack detection in interconnected systems are based on observer-based detection schemes, and the design of detectors is relatively complex. In large-scale interconnected cyber-physical control systems, dynamic control processes often affect each other, which makes it very complicated to detect and isolate attacks from the perspective of dynamic feedback. Summary of the invention

[0004] In order to solve the above problems, the present invention proposes a distributed attack detection method for interconnected information-physical systems based on the equivalent space method. By constructing a distributed residual of an interconnected information-physical control system based on the equivalent space method, distributed attack detection of the interconnected information-physical system is realized, and attack detection can be realized simply and efficiently while ensuring control performance.

[0005] To achieve the above object, the technical solution adopted by the present invention is: a distributed attack detection method for interconnected cyber-physical systems based on an equivalent space method, comprising the steps of:

[0006] Step 1: Build an interconnected cyber-physical system model, including a distributed system model and an overall system model;

[0007] Step 2: Build a hidden network attack model based on the interconnected cyber-physical system model, including the overlay attack model and the replay attack model;

[0008] Step 3: For the hidden network attack model, the overall residual of the interconnected cyber-physical system is constructed based on the equivalent space method, and then the overall residual is split into distributed residuals according to the system dimension relationship;

[0009] Step 4: Based on the obtained distributed residuals, analyze the impact of the locally hidden network attack on the residuals of the neighbor subsystem, and analyze the changes in the residuals when the attack occurs;

[0010] Step 5: Select appropriate detection statistics according to the change of residuals, formulate corresponding detection strategies and select appropriate detection thresholds to complete attack detection.

[0011] Furthermore, the distributed system model is:

[0012]

[0013] Among them, k represents the time, x i is the state vector of the current subsystem, x j is the state vector of other subsystems, u i is the input vector, y i is the output vector, w i ,q i are independent and identically distributed Gaussian random vectors with mean 0 and covariance matrices Q and W respectively, Q and W are positive definite diagonal matrices, A ii , A ij , B i , C i is a constant matrix, N represents the number of subsystems in the entire interconnected cyber-physical system, and the subscripts i and j represent the i-th subsystem and the j-th subsystem, respectively.

[0014] Furthermore, the overall system model is:

[0015]

[0016] Where x is the state vector containing all subsystems, u is the input vector containing all subsystems, y is the output vector containing all subsystems, w and q are Gaussian random vectors containing all subsystems, A, B and C are constant matrices;

[0017] C=diag{C1,C2,…C N},A=[A ij ] N×N , B by replacing C in C i Replace with B i get.

[0018] Furthermore, the coverage attack model is:

[0019]

[0020] Where k represents the time, u(k) represents the normal control input signal, and y(k) represents the normal measurement output signal. Indicates that the physical control object receives the control input signal injected with the attack signal. represents the output measurement signal of the injected attack signal received by the detector, η(k) and γ(k) represent the attack signal injected by the coverage attack through the communication link;

[0021] When establishing the attack signals η(k) and γ(k), the detector cannot distinguish between the attacked output signal and the normal output signal:

[0022]

[0023] in, represents the system knowledge matrix mastered by the attacker, The state vector representing the attack signal designed by the attacker;

[0024] Assume that the attacker has complete knowledge of the system, i.e. And in If the attack is launched at the same time, the coverage attack is completely concealed.

[0025] Furthermore, the replay attack model is:

[0026] Replay attacks are carried out in two stages: the first stage is the eavesdropping stage, in which the attacker records the output and input signals for a sufficiently long time through eavesdropping; the second stage is the replay stage, in which the attacker replays the past output signals at the detector end to cover up the impact of the injection attack on the input signal on the output;

[0027]

[0028] Among them, τ k >0, indicating the data before the replay time, a(k) indicates the attack signal injected by the attacker, represents the control input signal received by the physical control object into which the attack signal is injected, Represents the replay received by the detector in the past τ k The output measurement signal at the time.

[0029] Furthermore, for the hidden network attack model, the overall residual of the interconnected cyber-physical system is constructed based on the equivalent space method, and then the overall residual is split into distributed residuals according to the system dimension relationship, including the steps of:

[0030] First, based on the overall model of the interconnected system, assuming that q(k) = 0, w(k) = 0; define the matrix:

[0031] y s (k) = H o,s χ(ks)+H u,s u s (k);

[0032] Among them, s represents the window length, y s (k), χ(ks), u s (k) is a matrix composed of the measured output vector, state vector and control input vector of the system in the past. o,s , H u,s is a matrix composed of system matrices A, B, and C. According to the relationship between the ranks of the system matrices, there is at least one non-zero vector v s , so that v s H o,s =0;

[0033] Therefore, the residual r with a window length s generated based on the equivalent space method is s (k) is:

[0034] r s (k) = v s (y s (k)-H u，s u s (k))

[0035] Reconsider the influence of w(k) and q(k) on the residual generator and repeat the above steps to obtain

[0036] y s (k) = H o,s χ(ks)+H u,s u s (k)+H e,s e s (k);

[0037] Among them, e s (k) is a matrix composed of the process noise and measurement noise of the system at past moments, H e,s is a matrix composed of system matrices C and A;

[0038] Finally, the overall residual generated is:

[0039] r s (k) = v s (y s (k)-H u,s u s (k)) = v s H e,s e s (k);

[0040] Then, the overall residual is split into distributed residuals by row:

[0041]

[0042] where rs,i represents the distributed residual corresponding to the i-th subsystem, v s,i is a non-zero vector, Yes H o,s , H u,s The matrix composed of the rows corresponding to the i-th subsystem in H o,s and H u,s The dimension is l m×N×(s+1) Then the number of rows corresponding to the i-th subsystem is row i It should be composed of m arithmetic progressions; and the common difference of these m arithmetic progressions is s+1, and the first terms are all elements in {m×(i-1)+1,m×(i-1)+2,…,m×i};

[0043] thereby:

[0044] Among them, Θ i For r s,i The covariance matrix of (k), Yes H e,s The matrix consisting of the rows corresponding to the i-th subsystem in .

[0045] Furthermore, based on the obtained distributed residuals, the impact of the network attack with local concealment on the residual of the neighbor subsystem is analyzed, and the change of the residual when the attack occurs is analyzed, including the steps of:

[0046] Assuming that only the jth subsystem is attacked, according to the distributed system model, the physical dynamics model of the attacked jth subsystem is expressed as:

[0047]

[0048] Among them, A ii , A ij , B i , C i is a constant matrix, u j,a (k) represents the attacked control input signal received by the physical control object of the jth subsystem, which is denoted as u j,a (k) = u j (k)+a j (k), a j (k) represents the malicious signal injected by the attacker of the jth subsystem, u j (k) represents the jth subsystem input vector, χ j represents the state vector of the jth subsystem, y j represents the j-th subsystem output vector, w j is a Gaussian random vector; q j (k) is a Gaussian random vector, γj (k) is the attack vector injected into the sensor output channel;

[0049] Then the χ of the physical dynamics model of the i-th subsystem is j for:

[0050]

[0051] q i (k) is a Gaussian random vector, then we can derive:

[0052]

[0053] in, H o,s , H u,s , H e,s The matrix consisting of the row vectors corresponding to the i-th subsystem in s (k) is the matrix composed of attack signals, y s (k), x(ks), u s (k) is a matrix composed of the measured output vector, state vector, and control input vector of the system in the past. s (k) is a matrix composed of the process noise and measurement noise of the system at past moments;

[0054] Then the distributed residual of the i-th subsystem is:

[0055]

[0056] It represents the residual of the i-th subsystem when the system is attacked. Assuming that the attack comes from k a = Starting at time ks, there is a s (k)≠0, and The core space of

[0057]

[0058] It means that the covert attack on the jth subsystem will cause the covariance of the residuals of its neighboring subsystems to change;

[0059] The same conclusion is obtained when the j-th subsystem is subjected to the replay attack model.

[0060] Furthermore, according to the change of residual, appropriate detection statistics are selected, corresponding detection strategies are formulated, and appropriate detection thresholds are selected to complete attack detection, including:

[0061] Based on X 2 The test method is used to evaluate residuals and design thresholds, and the statistics are defined:

[0062]

[0063] in, represents the detection statistic of the ith subsystem at time k, r s,i (k) represents the distributed residual of the i-th subsystem, Θ i represents the covariance matrix of the distributed residual of the i-th subsystem under normal circumstances;

[0064] When an attack occurs, s,i Replace with χ 2 The test criteria are:

[0065]

[0066] in, Subject to X with I degrees of freedom 2 distributed, is the detection threshold; by finding X under the condition of selecting the false alarm rate α 2 Critical table obtained.

[0067] The beneficial effects of adopting this technical solution are:

[0068] The present invention relates to a distributed attack detection method for interconnected information-physical systems based on an equivalent space method, which constructs a distributed and overall model of an interconnected information-physical control system, establishes two hidden network attack models and defines local hiddenness in the interconnected system; constructs a distributed residual based on the equivalent space method; and analyzes the impact of network attacks on residual characteristics, selects detection statistics, formulates detection mechanisms and appropriate detection thresholds, and completes distributed detection of network attacks with local hiddenness in the interconnected system. The proposed distributed attack detection scheme for interconnected information-physical control systems based on the equivalent space method can realize the detection of network attacks with local hiddenness. At the same time, the scheme does not need to involve complex observers, and can simply and efficiently realize distributed network attack detection in interconnected systems while ensuring the system control system, effectively solving the limitations of existing distributed attack detection methods for interconnected information-physical control systems.

[0069] The distributed attack detection method for interconnected information-physical systems based on the equivalent space method proposed in the present invention realizes efficient distributed attack detection of interconnected information-physical control systems. The input-output relationship of the system is utilized to construct the residual through the equivalent space method, and the overall residual is split into distributed residuals. When a subsystem of the interconnected information-physical control system is attacked by a hidden network, it will not affect the residual of the current subsystem, but will affect the change in the residual statistics of its neighboring subsystems. Thus, the change in the residual statistics is used to detect network attacks. This scheme only uses local system knowledge and input-output data, avoids complex observer design, and does not need to add active mechanism signals. Compared with existing detection schemes, the proposed distributed attack detection scheme based on equivalent space can simply and efficiently realize attack detection, while ensuring the system control system, and does not require the subsystem to master global information. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 A schematic diagram of a flow chart of a distributed attack detection method for interconnected cyber-physical systems based on an equivalent space method of the present invention;

[0071] Figure 2 A schematic diagram of a coverage attack model in an embodiment of the present invention;

[0072] Figure 3 A schematic diagram of a replay attack model in an embodiment of the present invention;

[0073] Figure 4 A topological structure diagram of an interconnected cyber-physical system in an embodiment of the present invention;

[0074] Figure 5 The coverage attack detection result in the embodiment of the present invention;

[0075] Figure 6 This is a graph showing the coverage attack detection rate results in an embodiment of the present invention;

[0076] Figure 7 The replay attack detection result in the embodiment of the present invention;

[0077] Figure 8 This is a graph showing the replay attack detection rate results in an embodiment of the present invention. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described below with reference to the accompanying drawings.

[0079] In this embodiment, see Figure 1 As shown, the present invention proposes a distributed attack detection method for interconnected cyber-physical systems based on an equivalent space method, comprising the steps of:

[0080] Step 1: Build an interconnected cyber-physical system model, including a distributed system model and an overall system model;

[0081] Step 2: Build a hidden network attack model based on the interconnected cyber-physical system model, including the overlay attack model and the replay attack model;

[0082] Step 3: For the hidden network attack model, the overall residual of the interconnected cyber-physical system is constructed based on the equivalent space method, and then the overall residual is split into distributed residuals according to the system dimension relationship;

[0083] Step 4: Based on the obtained distributed residuals, analyze the impact of the locally hidden network attack on the residuals of the neighbor subsystem, and analyze the changes in the residuals when the attack occurs;

[0084] Step 5: Select appropriate detection statistics according to the change of residuals, formulate corresponding detection strategies and select appropriate detection thresholds to complete attack detection.

[0085] As an optimization solution of the above embodiment, in step 1, a distributed model and an overall system model of the interconnected cyber-physical control system are constructed respectively, and the distributed system model is:

[0086]

[0087] Among them, k represents the time, χ i is the state vector of the current subsystem, χ j is the state vector of other subsystems, u i is the input vector, y i is the output vector, w i ,q i are independent and identically distributed Gaussian random vectors with mean 0 and covariance matrices Q and W respectively, Q and W are positive definite diagonal matrices, A ii , A ij , B i , C i is a constant matrix, N represents the number of subsystems in the entire interconnected cyber-physical system, and the subscripts i and j represent the i-th subsystem and the j-th subsystem, respectively. Definition is the set of all subsystems directly connected to the ith subsystem at the physical level, when When A ij =0.

[0088] The overall system model of the interconnected cyber-physical system is:

[0089]

[0090] Where x is the state vector containing all subsystems, u is the input vector containing all subsystems, y is the output vector containing all subsystems, w and q are Gaussian random vectors containing all subsystems, A, B and C are constant matrices;

[0091] C=diag{C1,C2,…C N},A=[A ij ] N×N , B by replacing C in C i Replace with B i get.

[0092] As an optimized implementation scheme of the above embodiment, in step 2, a network attack model with concealment is constructed, which are respectively a coverage attack and a replay attack;

[0093] like Figure 2 As shown, the coverage attack model is:

[0094]

[0095] Where k represents the time, u(k) represents the normal control input signal, and y(k) represents the normal measurement output signal. Indicates that the physical control object receives the control input signal injected with the attack signal. represents the output measurement signal of the injected attack signal received by the detector, η(k) and γ(k) represent the attack signal injected by the coverage attack through the communication link;

[0096] When establishing the attack signals η(k) and γ(k), the detector cannot distinguish between the attacked output signal and the normal output signal:

[0097]

[0098] in, represents the system knowledge matrix mastered by the attacker, The state vector representing the attack signal designed by the attacker;

[0099] Assume that the attacker has complete knowledge of the system, i.e. And in If the attack is launched at the same time, the coverage attack is completely concealed.

[0100] like Figure 3 As shown, the replay attack model is:

[0101] Replay attacks are carried out in two stages: the first stage is the eavesdropping stage, in which the attacker records the output and input signals for a sufficiently long time through eavesdropping; the second stage is the replay stage, in which the attacker replays the past output signals at the detector end to cover up the impact of the injection attack on the input signal on the output;

[0102]

[0103] Among them, τ k >0, indicating the data before the replay time, a(k) indicates the attack signal injected by the attacker, represents the control input signal received by the physical control object into which the attack signal is injected, Represents the replay received by the detector in the past τ k The output measurement signal at the time.

[0104] As an optimized implementation scheme of the above embodiment, in step 3, for a hidden network attack model, the overall residual of the interconnected cyber-physical system is constructed based on the equivalent space method, and then the overall residual is split into distributed residuals according to the system dimension relationship, including the steps of:

[0105] First, based on the overall model of the interconnected system, assuming that q(k) = 0, w(k) = 0; define the matrix:

[0106] y s (k) = H o,s χ(ks)+H u,s u s (k);

[0107] Among them, s represents the window length, y s (k), χ(ks), u s (k) is a matrix composed of the measured output vector, state vector and control input vector of the system in the past. o,s , H u,s is a matrix composed of system matrices A, B, and C. According to the relationship between the ranks of the system matrices, there is at least one non-zero vector v s , so that v s H o,s =0;

[0108] Therefore, the residual r with a window length s generated based on the equivalent space method is s (k) is:

[0109] r s (k) = v s (y s (k)-H u,s u s (k));

[0110] Reconsidering the impact of w(k) and q(k) on the residual generator, repeat the above steps to obtain:

[0111] y s (k) = H o,s χ(ks)+H u,s u s (k)+H e,s e s (k);

[0112] Among them, e s (k) is a matrix composed of the process noise and measurement noise of the system at past moments, H e,s is a matrix composed of system matrices C and A;

[0113] Finally, the overall residual generated is:

[0114] r s (k) = v s (y s (k)-H u,s u s (k)) = v s H e,s e s (k);

[0115] Then, the overall residual is split into distributed residuals by row:

[0116]

[0117] where r s,i represents the distributed residual corresponding to the i-th subsystem, v s,i is a non-zero vector, Yes H o,s , H u,s The matrix composed of the rows corresponding to the i-th subsystem in H o,s and H u,s The dimension is l m×N×(s+1) Then the number of rows corresponding to the i-th subsystem is row i It should be composed of m arithmetic progressions; and the common difference of these m arithmetic progressions is s+1, and the first terms are all elements in {m×(i-1)+1,m×(i-1)+2,…,m×i};

[0118] thereby:

[0119] Among them, Θ i For r s,i The covariance matrix of (k), Yes H e,sThe matrix consisting of the rows corresponding to the i-th subsystem in .

[0120] As an optimized implementation scheme of the above embodiment, in step 4, based on the obtained distributed residual, analyzing the impact of the network attack with local anonymity on the residual of the neighbor subsystem, and analyzing the change of the residual when the attack occurs, includes the steps of:

[0121] Assuming that only the jth subsystem is attacked, according to the distributed system model, the physical dynamics model of the attacked jth subsystem is expressed as:

[0122]

[0123] Among them, A ii , A ij , B i , C i is a constant matrix, u j,a (k) represents the attacked control input signal received by the physical control object of the jth subsystem, which is denoted as u j,a (k) = u j (k)+a j (k), a j (k) represents the malicious signal injected by the attacker of the jth subsystem, u j (k) represents the jth subsystem input vector, χ j represents the state vector of the jth subsystem, y j represents the j-th subsystem output vector, w j is a Gaussian random vector; q j (k) is a Gaussian random vector, γ j (k) is the attack vector injected into the sensor output channel;

[0124] Then the χ of the physical dynamics model of the i-th subsystem is j for:

[0125]

[0126] q i (k) is a Gaussian random vector, then we can derive:

[0127]

[0128] in, H o,s , H u,s , H e,s The matrix consisting of the row vectors corresponding to the i-th subsystem in s (k) is the matrix composed of attack signals, y s (k), x(ks), us (k) is a matrix composed of the measured output vector, state vector, and control input vector of the system in the past. s (k) is a matrix composed of the process noise and measurement noise of the system at past moments;

[0129] Then the distributed residual of the i-th subsystem is:

[0130]

[0131] It represents the residual of the i-th subsystem when the system is attacked. Assuming that the attack comes from k a = Starting at time ks, there is a s (k)≠0, and The core space of

[0132]

[0133] It means that the covert attack on the jth subsystem will cause the covariance of the residuals of its neighboring subsystems to change;

[0134] The same conclusion is obtained when the j-th subsystem is subjected to the replay attack model.

[0135] As an optimized implementation scheme of the above embodiment, in step 5, a suitable detection statistic is selected according to the change of the residual, a corresponding detection strategy is formulated, and a suitable detection threshold is selected to complete the attack detection, including:

[0136] Based on χ 2 The test method is used to evaluate residuals and design thresholds, and the statistics are defined:

[0137]

[0138] in, represents the detection statistic of the ith subsystem at time k, r s,i (k) represents the distributed residual of the i-th subsystem, Θ i represents the covariance matrix of the distributed residual of the i-th subsystem under normal circumstances;

[0139] When an attack occurs, s,i Replace with χ 2 The test criteria are:

[0140]

[0141] in, Subject to χ with I degrees of freedom 2 distributed, is the detection threshold; by finding X under the condition of selecting the false alarm rate α 2 Critical table obtained.

[0142] Examples:

[0143] Consider an interconnected cyber-physical system with the following parameters and topology: Figure 4 As shown:

[0144]

[0145]

[0146]

[0147]

[0148]

[0149]

[0150]

[0151] B1=B2=B3=B4=[1 1 1 1] T ;

[0152]

[0153] s=9; k=800; W=I4; Q=I2;

[0154] Set k = 400 to k = 600 to perform a coverage attack on the first subsystem, and set a1 = 10. When performing a coverage attack, the x of each subsystem is 2 The test statistic changes as Figure 5 The detection rate results are shown in Figure 6 As shown. Figure 4 It can be seen that after the attack begins, the statistics of the first subsystem do not change much, but the residual statistics of its neighbor subsystems exceed the threshold, achieving coverage attack detection.

[0155] Set k=400 to k=800 to perform a replay attack on the first subsystem, replay τ k =200, and apply attack signal a1=10 between k=400 and k=600. When replaying the attack, the x of each subsystem is 2 The test statistic changes as Figure 7 The detection rate results are shown in Figure 8 As shown. Figure 7It can be seen that after the attack begins, the statistics of the first subsystem do not change much, but the residual statistics of its neighbor subsystems exceed the threshold, realizing replay attack detection.

[0156] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A distributed attack detection method for interconnected cyber-physical systems based on equivalent space method, characterized in that: Includes steps: Step 1: Build an interconnected cyber-physical system model, including a distributed system model and an overall system model; Step 2: Build a hidden network attack model based on the interconnected cyber-physical system model, including the overlay attack model and the replay attack model; Step 3: For the hidden network attack model, the overall residual of the interconnected cyber-physical system is constructed based on the equivalent space method, and then the overall residual is split into distributed residuals according to the system dimension relationship; Step 4: Based on the obtained distributed residuals, analyze the impact of the locally hidden network attack on the residuals of the neighbor subsystem, and analyze the changes in the residuals when the attack occurs; Step 5: Select appropriate detection statistics according to the change of residuals, formulate corresponding detection strategies and select appropriate detection thresholds to complete attack detection.

2. The method for detecting distributed attacks on interconnected cyber-physical systems based on equivalent space method according to claim 1 is characterized in that: The distributed system model is: Among them, k represents the time, x i is the state vector of the current subsystem, x j is the state vector of other subsystems, u i is the input vector, y i is the output vector, w i ,q i are independent and identically distributed Gaussian random vectors with mean 0 and covariance matrices Q and W respectively, Q and W are positive definite diagonal matrices, A ii , A ij , B i , C i is a constant matrix, N represents the number of subsystems in the entire interconnected cyber-physical system, and the subscripts i and j represent the i-th subsystem and the j-th subsystem, respectively.

3. The method for detecting distributed attacks on interconnected cyber-physical systems based on equivalent space method according to claim 2 is characterized in that: The overall system model is: Where x is the state vector containing all subsystems, u is the input vector containing all subsystems, y is the output vector containing all subsystems, w and q are Gaussian random vectors containing all subsystems, A, B and C are constant matrices; C = diag{C1, C2, ... C N },A=[A ij ] N×N , B by replacing C in C i Replace with B i get.

4. The method for detecting distributed attacks on interconnected cyber-physical systems based on equivalent space method according to claim 1, characterized in that: The coverage attack model is: Where k represents the time, u(k) represents the normal control input signal, and y(k) represents the normal measurement output signal. Indicates that the physical control object receives the control input signal injected with the attack signal. represents the output measurement signal of the injected attack signal received by the detector, η(k) and γ(k) represent the attack signal injected by the coverage attack through the communication link; When establishing the attack signals η(k) and γ(k), the detector cannot distinguish between the attacked output signal and the normal output signal: in, represents the system knowledge matrix mastered by the attacker, The state vector representing the attack signal designed by the attacker; Assume that the attacker has complete knowledge of the system, i.e. And in If the attack is launched at the same time, the coverage attack is completely concealed.

5. The method for detecting distributed attacks on interconnected cyber-physical systems based on equivalent space method according to claim 4 is characterized in that: The replay attack model is: Replay attacks are carried out in two stages: the first stage is the eavesdropping stage, in which the attacker records the output and input signals for a sufficiently long time through eavesdropping; the second stage is the replay stage, in which the attacker replays the past output signals at the detector end to cover up the impact of the injection attack on the input signal on the output; Among them, τ k >0, represents the data before the replay time, a(k) represents the attack signal injected by the attacker, represents the control input signal received by the physical control object into which the attack signal is injected, Represents the replay received by the detector in the past τ k The output measurement signal at the time.

6. The method for detecting distributed attacks on interconnected cyber-physical systems based on equivalent space method according to claim 1, characterized in that: For the hidden network attack model, the overall residual of the interconnected cyber-physical system is constructed based on the equivalent space method, and then the overall residual is split into distributed residuals according to the system dimension relationship, including the following steps: First, based on the overall model of the interconnected system, assuming that q(k) = 0, w(k) = 0; define the matrix: y s (k)=H o，s x(k-s)+H u，s u s (k); Among them, s represents the window length, y s (k), x(ks), u s (k) is a matrix composed of the measured output vector, state vector and control input vector of the system in the past. o，s , H u，s is a matrix composed of system matrices A, B, and C. According to the relationship between the ranks of the system matrices, there is at least one non-zero vector v s , so that v s H o，s =0; Therefore, the residual r with a window length s generated based on the equivalent space method is s (k) is: r s (k)=v s (y s (k)-H u，s u s (k)); Reconsider the influence of w(k) and q(k) on the residual generator and repeat the above steps to obtain y s (k)=H o，s x(k-s)+H u，s u s (k)+H e，s e s (k); Among them, e s (k) is a matrix composed of the process noise and measurement noise of the system at past moments, H e，s is a matrix composed of system matrices C and A; Finally, the overall residual generated is: r s (k)=v s (y s (k)-H u，s u s (k))=v s H e，s e s (k); Then, the overall difference is split into distributed residuals by row: where r s，i represents the distributed residual corresponding to the i-th subsystem, v s，i is a non-zero vector, Yes H o，s , H u，s The matrix composed of the rows corresponding to the i-th subsystem in H o，s and H u，s The dimension is l m×N×(s+1) Then the number of rows corresponding to the i-th subsystem is row i It should be composed of m arithmetic progressions; and the common difference of these m arithmetic progressions is s+1, and the first terms are all elements in {m×(i-1)+1, m×(i-1)+2,..., m×i}; thereby: Among them, Θ i For r s，i The covariance matrix of (k), Yes H e，s The matrix consisting of the rows corresponding to the i-th subsystem in .

7. The method for detecting distributed attacks on interconnected cyber-physical systems based on equivalent space method according to claim 1, characterized in that: Based on the obtained distributed residuals, the impact of the local hidden network attack on the residual of the neighbor subsystem is analyzed, and the change of the residual when the attack occurs is analyzed, including the following steps: Assuming that only the jth subsystem is attacked, according to the distributed system model, the physical dynamics model of the attacked jth subsystem is expressed as: Among them, A ii , A ij , B i , C i is a constant matrix, u j，a (k) represents the attacked control input signal received by the physical control object of the jth subsystem, which is denoted as u j，a (k) = u j (k)+a j (k), a j (k) represents the malicious signal injected by the attacker of the jth subsystem, u j (k) represents the j-th subsystem input vector, x j (k) represents the state vector of the jth subsystem, y j (k) represents the j-th subsystem output vector, w j (k) is a Gaussian random vector; q j (k) is a Gaussian random vector, γ j (k) is the attack vector injected into the sensor output channel; Then the x of the physical dynamics model of the i-th subsystem is j for: q i (k) is a Gaussian random vector; Then we can deduce that: in, H o，s , H u，s , H e，s The matrix consisting of the row vectors corresponding to the i-th subsystem in s (k) is a matrix composed of attack signals, y s (k), x(ks), u s (k) is a matrix composed of the measured output vector, state vector, and control input vector of the system in the past. s (k) is a matrix composed of the process noise and measurement noise of the system at past moments; Then the distributed residual of the i-th subsystem is: It represents the residual of the i-th subsystem when the system is attacked. Assuming that the attack comes from k a = Starting at time ks, there is a s (k)≠0, and The core space of It means that the covert attack on the jth subsystem will cause the covariance of the residuals of its neighboring subsystems to change; The same conclusion is obtained when the j-th subsystem is subjected to the replay attack model.

8. The method for detecting distributed attacks on interconnected cyber-physical systems based on equivalent space method according to claim 1, characterized in that: Select appropriate detection statistics according to the change of residuals, formulate corresponding detection strategies and select appropriate detection thresholds to complete attack detection, including: Based on X 2 The test method is used to evaluate residuals and design thresholds, and the statistics are defined: in, represents the detection statistic of the ith subsystem at time k, r s，i (k) represents the distributed residual of the i-th subsystem, Θ i represents the covariance matrix of the distributed residual of the i-th subsystem under normal circumstances; When an attack occurs, s，i Replace with X 2 The test criteria are: in, Subject to X with l degrees of freedom 2 distributed, is the detection threshold; by finding X under the condition of selecting the false alarm rate α 2 Critical table obtained.

Images