Trust-based fault detection and robust fault-tolerant control of uncertain cyber-physical systems against time-delay injection attacks.

Control systems need to be able to operate under uncertainty and especially under attacks. To address such challenges, this paper formulates the solution of robust control for uncertain systems under time-varying and unknown time-delay attacks in cyber-physical systems (CPSs). A novel control method able to deal with thwart time-delay attacks on closed-loop control systems is proposed. Using a descriptor model and an appropriate Lyapunov functional, sufficient conditions for closed-loop stability are derived based on linear matrix inequalities (LMIs). A design procedure is proposed to obtain an optimal state feedback control gain such that the uncertain system can be resistant under an injection time-delay attack with variable delay. Furthermore, various fault detection frameworks are proposed by following the dynamics of the measured data at the system's input and output using statistical analysis such as correlation analysis and K-L (Kullback-Leibler) divergence criteria to detect attack's existence and to prevent possible instability. Finally, an example is provided to evaluate the proposed design method's effectiveness.

Introduction

During the last few years, uncertain systems have been widely encountered because of the environmental changes, systems' failures, and disturbances [1], [2]. These systems have been widely used in the application of electronic circuits, power systems, spring damping systems, and mechanical systems [3], [4], [5]. Since the industrial application of cyber-physical uncertain systems increases, stealthy cyber-attacks may occur to prevent systems' productivity and degrade systems' performances.

One important factor that can cause instability in most practical systems is time-delay effects. These effects in nonlinear systems can be the main reason for weaknesses of control approaches in most cases [6], [7]. Therefore, several robust and adaptive strategies have been done to control uncertain and nonlinear systems under time-delay effects with the assumption of parametric uncertainties. Therefore, several robust and adaptive strategies have been done to control uncertain and nonlinear systems under time-delay effects with the assumption of parametric uncertainties [8], [9], [10], [11], [12], [13], such as approaches with backstepping and dynamic surface designs [14], [15]. In [16], a set of network-based uncertain systems is introduced by modeling these problems with event-triggered robust filtering. A recent event-triggered control proposition is stated in [17] to synchronize a switched delayed neural network. When it comes to decentralized nets, in [18], the event-triggered filtering for a decentralized network interconnecting nonlinear system is developed. Also, some event-triggered methods using a periodic sampled-data control and with fuzzy systems are introduced in [19], [20], [21], [22], [23]. In [24], the networked control of uncertain nonlinear systems is investigated with an adaptive event-triggered strategy under unknown time-delay conditions.

Even though various studies have been done regarding robust and adaptive control of uncertain systems, a few approaches are related to designing the robust and adaptive control strategies of uncertain CPSs with time delays and considering cyber components. Besides, because of the unavailability of error surfaces of the measured and sent state information by sensors in CPSs, which various attackers could alter these surfaces, previous approaches [11], [12], [13], [14], [15], [16], [17], [18], [19], [20], [21], [22], [23], [24] cannot be applied to prevent cyberattacks in uncertain CPSs. Thus, the problem of designing control methods to resist uncertain time-delayed CPSs against different attack strategies is still an interesting subject to follow and consider.

Some approaches have been devoted to state the importance of the security issue of CPSs [25], [26], [27], [28], [29]. Control problems in these systems are categorized into three groups based on different cyber-attack scenarios; denial-of-service (DoS) attacks [30], [31], [32], [33], deception attacks [34], [35], [36], [37], [38], and replay attacks [39], [40], [41]. The latest studies regarding security control of CPSs against cyberattacks are as follows. In [42], the issue of designing event-based security control for uncertain state-dependent systems with the existence of hybrid attacks is proposed. Besides, the finite-time filtering method for networked state-dependent uncertain systems under multiple attacks (DoS, deception, and replay attacks) by considering the event-triggered approach is investigated in [43]. Another control strategy of nonlinear time-delayed CPSs under unspecific deception attacks is developed in [44], in which an adaptive, resilient, dynamic surface control using the neural-network scheme is proposed for deception attacks on both sensor and actuator sides.

One kind of malicious attack that can cause trouble in operating uncertain systems is a time-delay attack. A time-delay attack on a control system is the reason for adversaries that fundamentally add time delays into such systems and potentially forcing them to instability and crash. A recent approach has been made regarding time-delay attacks [45]. First, it is shown that cryptographic methods against these attacks would be useless in detecting cyber components. A cryptography-free time-delay attack recovery (CF-TDR) communication protocol is developed to identify failures and recover from these attacks' destructive effects.

Previous designed robust control approaches against time delays considered the existence of time-independent delays with known values. There is still no approach to investigating time-delay attacks with unknown and time-varying values on uncertain systems with a robust approach to detect these attacks and recover the system's performance. Various protection-based methods against data injection attacks have been developed lately. Most of them involve using protected measurement data or using estimated system data. However, if the attackers can infiltrate security systems and manipulate metering data, the control system will be compromised. On the other hand, these methods may not detect contaminated data with a statistical distribution similar to the previously measured safe data.

It is well known that a robust controller can often maintain states of a system bounded against various types of uncertainties, which can be the modeling uncertainties or environmental uncertainties. On the other hand, if unknown and time-varying delays are injected into the system's performance by an intruder, formerly applied robust control approaches cannot be further beneficial. Consequently, the uncertain system's stability under unknown and time-varying delays will be enhanced, and hence, the states of the system will remain bounded under various time delays. Besides, it is necessary to detect the delay's occurrence to implement other safety protocols. The main contributions are itemized as follows:

We allocate a robust controller that attenuates and partially eliminates the harmful effects of delayed contaminated data injection on system stability. Besides, to show the proposed approach's efficiency, the amount of delay is assumed to be randomly selected. Therefore, the designed feedback controller will prevent system instability based on random time delays.

We define uncertainties in the system as unknown values with the norm-bounded feature. Using a descriptor model representation and an appropriate Lyapunov functional, we formulate sufficient conditions for closed-loop stability based on the linear matrix inequalities (LMIs).

We present the online fault detection framework by following the dynamics of the measured data at the system's input and output to prevent the operating system from going into the faulty phase as quickly as possible. Attack detection methods are proposed and compared using statistical analysis such as correlation analysis and K-L divergence attack detection criteria.

Simulation results verify that the considered uncertain system will be resilient against malicious time-delay attacks. Therefore, the trustworthiness of the system's performance will be enhanced over time by applying the developed robust control protocol. Additionally, using the provided fault detection strategies, stealthy time-delay attacks can be detected at the time of their occurrence.

This paper's remainder is as follows: In Section 2, the uncertain control system is analyzed under the time-delay attack, and then, the robust delay-independent controller is proposed to overcome instability conditions in the system. In Section 3, various statistical attack detection methods are reviewed to detect faults in the system under the time-delay attacker's existence. Eventually, numerical simulations and concluding sections are presented in Sections 4 and 5, respectively.

Time-delay attack analysis for uncertain systems

Problem statement

Real-life processes in a smart fashion such as smart industrial systems can be modeled as nonlinear systems. Assume the nonlinear system given by the below state-space equations where and are the state and the control input vectors, respectively. Furthermore, is the input matrix, is the nonlinear function of system states, and C is the output matrix of the system. Suppose the obtained linearized model around its equilibrium point is controllable and also has the state-space matrices (). So, and can be decomposed as where ΔA, ΔB are model uncertainties and A, B, ΔA, and ΔB have applicable dimensions. Thus, the model of continuous-time uncertain system (1) (or approximation of system in a region of interest by an LTI system), can be expressed as following uncertain state space equations

It is assumed that the attacker tries to inject a time-delay attack to force the system to be unstable or have abnormal operations. We can consider the given uncertain system (4) with an augmented time-delay attack as: where are the system matrices with appropriate dimensions and also is assumed as a delay attack strategy, with . It should be noted that the delay term is assumed to be time-varying to obtain more general results in the paper for a worst-case scenario and to show the effectiveness of the proposed robust control solution with any random values of in further analysis.

The purpose of the control solution protocol is to frame a delay-independent robust controller , which assures the robust stability of the system under delay attacks for maximum and unknown delay . The structure of robust security control for the networked control system with time-delay attacks is illustrated in Fig. 1.

Figure 1

The structure of the CPS with the proposed robust controller and attack detection unit under unknown time-delay attacks.

Robust controller design for closed-loop uncertain CPSs

With the proposed robust control law , we have a closed-loop system as where K is the robust controller feedback gain and and where and are specific fixed-valued real matrices of applicable dimensions. Moreover, the possible system's uncertainties are described by the given equations where D0, E, E, D, and are fixed-valued real matrices of applicable dimensions. Besides, and are anonymous real-valued time-varying matrices with Lebesgue measurable items complying the given bounds

Assumption A1. In deriving formulas, it is assumed that: where is any matrix norm. With the above assumption, both stability conditions associated with continuous and continuously differentiable initial functions are equivalent. To derive stability conditions, the following lemmas are essential to mention.

[46], [47]

For any and any positive definite matrix ,

Let A, D, E, and F be real matrices of appropriate dimensions with . Accordingly, it can be concluded that:

For any scalar , for any matrix and scalar , which applies to the inequality , for any matrix and scalar >0, which applies to the inequality ,

Delay-independent stability for an uncertain system with time–delay attack

To find delay-independent stability condition, the descriptor representation of the system is given as follows

By defining the Lyapunov-Krasovskii functional candidate as: where and further results from the Theorem 1 can be concluded.

Under assumption A1, the uncertain system (3) under the injection time-delay attack introduced in (4) is stable for all delay values if there is a matrix , that satisfies the following LMI where

Additionally, other variables are defined as Then, the optimal state-feedback gain is then calculated by where the augmented closed-loop matrix is denoted as .

See the appendix in the article's supplementary files. □

The primary importance of the presented robust approach is to provide a method to formulate the uncertainties caused by the cyber attacks instead of modeling with stochastic processes (system uncertainties and insufficient information from attackers are mostly modeled by considering noise and stochastic processes). Thus, we proposed a delay-independent approach to reduce the disturbances' effects caused by the attacker and increase the system's robustness. Consequently, finding a solution to the discussed optimization problem yields to providing a method to counteract the disturbing effects of the attacker. However, it is not straightforward to propose an analytical solution in general, and hence, the robust protocol is formulated using LMI methods. The developed robust strategy performs conservatively, and we tried to reach the optimal solution using the descriptor representation stated in (17) and (18).

In cases that it is hard to satisfy proposed LMI conditions, the main LMI problem can be reformulated to a convex optimization problem with LMI conditions to provide a trade-off between the controller's performance and the system's sensitivity to the disturbances by setting the LMI conditions less than a constant error value. On the other hand, the considered attack form in (4) is formulated in a relatively complex formation, and therefore, further equations are derived in general conditions. For exceptional cases, feasible solutions can be achieved.

If we assume that the attacker has complete access to the control network and can inject time delays into the communication channels (worst-case attack scenario), consequently, the immediate measurement of the process state and the actuator signal , will be replaced by . Hence, the dynamic of the system (4) is reduced to

According to (24), by substituting by and then setting B=0 in LMI condition (22), a time-independent criterion for analyzing the stability condition of the system (24) using the results in Theorem 1 will be obtained.

It should be noted that there is always a small amount of delay in transmitting data packets in smart network control systems, even without any attacks in the system. When time-delay attacks occur, the attacker's delay is augmented to this intrinsic network communication's delay value. Besides, in analyzing delays in small-scale networks, only the delay from the time-delay attack is mostly considered to derive formulas. However, in large-scale networks such as large-scale load frequency control networks with time-delay attacks [45], the system's delay should also be considered to avoid the network's instability in a large-scale fashion. In this article's formulations, the augmented delay term is assumed to be a general delay term to cover the system's delay, too. By this assumption, this paper's methodology can be implemented to overcome the issue of the existence of the system's delay and the attacker's delay together.

Fault detection for a robust, resilient control protocol against time-delay attacks

Knowing the attack event and the maximum tolerable time delay, an attack detector will direct the system into an alarm state. Under the investigated control strategy, the proposed scheme is maintained in a stable condition in the alert state by the designed robust controller. It remains in this state until the system status is restored. This method can be used as an economical and straightforward method to ensure industrial control systems' stability and safety. In the presented control method, due to the system being stable at the time of the attack event and due to the system states' limited values, we expect to be able to implement the residual-based fault detection methods or distance selection criteria to detect a fault in the system. In this section, we compare and analyze the ability of different attack detection techniques.

Fault detection based on maximum correlation

The correlation coefficient is one of the criteria used to determine the association between two variables. The correlation coefficient indicates the severity of the relationship and the type of connection (direct or inverse). This coefficient is between 1 and -1 and is zero if there is no relationship between the two variables. The correlation coefficient between the two input variables and the output of state is defined as follows: where and are the average of the input and output data. The most important thing to remember about the correlation coefficient is that the correlation coefficient only indicates the linear relationship between two variables.

In the non-attack mode, according to (4), the output change is statically related to the input change; that means any arbitrary inputs entirely generate different output values. So, if the data does not change, the output of the system will be retained. Thus, we expect that by injecting the attack's signal into the system, we will see a decrease in the correlation between the system's input and output variables. With a delay in the system, we expect the correlation coefficients to be decreased due to input and output sequences since the output does not correlate with the input. Therefore, in the delay-based attack detection algorithm and the general correlation-based delay estimation, the correlation coefficient between the input sequence and the output sequence can be calculated. Furthermore, the delay length corresponding to the maximum confidence coefficient can be considered as an estimation of the time delay value. Besides, the simulation results illustrate that the correlation coefficient is effective for accurately identifying the time-delay attack.

Fault detection based on K-L divergence analysis

One of the most common methods for detecting the malicious injected data is to monitor the dynamics of the measured data from the system and use the distance criterion. To quantify measurement changes, one can use both absolute distance indices and the K-L divergence criterion. For both distance indices, the two probability distributions P and Q must be considered, where the probability distribution Q is the statistical distribution of non-invasive measurements and P is also the statistical distribution of the measurement data exposed to injecting contaminated data. If there is no attack, the distance index will be relatively small, while the mentioned index will increase when the attacker's malicious data is injected into the system. By comparing the current time interval index P with Q, one can determine whether inaccurate data has been injected into the system or not. In the following, the common distance-based statistical attack detection criteria are reviewed and in the numerical results, their effectiveness in detecting the current article's proposed attack is investigated.

Absolute distance criterion

A simple comparison criterion for the two probability distributions P and Q is the calculation of the absolute distance and can be defined as follows

K-L divergence measurement

For the two probability distributions P and Q, the K-L divergence criterion is defined as

Two essential features of the K-L divergence criterion are that it: (1) is always non-negative, i.e., ; and (2) equals to zero if, and only if P = Q.

When the inaccurate, malicious data is injected into the system, the probability distribution of the altered measurement data deviates from the probability distribution of the error-free data, resulting in a more considerable K-L divergence calculated value.

If the two distributions P and Q are Gaussian, the introduced K-L divergence criterion can be simplified as the following where and are the mean and covariance of the sequence P, and also, and are defined as the mean and covariance of the sequence Q. Also, n is the dimension of the sequences in general.

Numerical simulations

The effectiveness of the proposed robust control strategy under a time-delay attack is illustrated in this section.

An uncertain CPS with a malicious time-delay attack is assumed as the following form: where and

The total simulation time was set to 20 sec, and the sampling time to 0.02 sec. Based on the considered attack scenario, a time-delay attack is injected at time t = 8 sec with the maximum delay = 4 sec to all system states.

Fig. 2 shows the system's instability under this attack with the formerly developed robust controller as the one stated in [4]. We can conclude from Fig. 2 that designing a new robust control strategy is a must. Therefore, according to the developed robust control strategy, the feedback gain matrix K is calculated as

Figure 2

A) Instability of the uncertain system states trajectory by implementing conventional robust controller [4] under the time-delay attack, and B) assumed time delay attack g(t).

Moreover, Fig. 3 depicts the provided system's stability with the proposed robust controller against time-delay attacks. Additionally, Fig. 4 shows that system states and the proposed robust control signal under the time-delay attack remain bounded. As a result, the system could tolerate unknown time-delay attacks with the developed robust control strategy with the presented robust approach. Additionally, the system states' mean square error (MSE) values from the proposed robust control method based on various uncertainties under time-delay attacks are calculated in Table 1. According to Table 1, system states remain bounded under time-delay attacks with different uncertainty values.

Figure 3

A) System states convergence against time-delay attack with the proposed robust controller, and B) assumed time delay attack g(t).

Figure 4

A) The proposed bounded robust control trajectory and B) system states trajectory under the time-delay attack injected at time t = 8 sec.

Table 1

Calculated MSE of system states with the proposed robust control strategy against time-delay attacks under various system uncertainties.

‖ΔB‖_2	MSE(x1)	MSE(x2)	MSE(x3)	sum
0	0.0211	0.0148	0.0129	0.0489
0.4	0.0341	0.0156	0.0194	0.0692
0.8	0.0549	0.0165	0.0370	0.1085
1.2	0.0865	0.0177	0.0678	0.1720

Next step is to detect the attack's occurrence with various fault detection methods introduced in previous sections. Fig. 5 indicates the calculated correlation coefficient values before and after the time-delay attack. It can be observed that for data without attack, correlations are relatively close to 1 or -1, while the time-delay attack decreases the correlation coefficient value.

Figure 5

Correlation trajectory between states and control signal before and after the time-delay attack's existence.

Another way to detect faults can be developed by using the absolute distance criterion. Absolute distances and between P (system with attack) and Q (system without attack) are indicated in Fig. 6. So, it can be inferred that injecting false data attacks to the system enhances the Absolute distance values and .

Figure 6

Measurement variation with false data injection attacks in t = 8 sec: A) Absolute distance value D. B) K-L divergence value D.

In false data injection attacks, compared with absolute distance (Fig. 6.a), the K-L distance (Fig. 6.b) is more significant. Therefore, in total, the absolute distance criterion is not an ideal candidate to test false data injection attacks' existence. To detect false data injection attacks with the K-L divergence criterion, we should analyze and set its detection threshold from the standard data. If the K-L divergence runtime is larger than the threshold, false data have likely been injected into the system.

It is worth noticing that the absolute distance and K-L divergence methods only require the system's output data in a non-attack mode or at least an accurate estimation of the system's output. Since the designed controller is relatively resistant to attack, the system's output data does not change much abruptly, and based on Fig. 6, there would be no significant changes in and at the time of the onset of the attack. Although these attack detection parameters grow over time, injection of contaminated data into the system can be detected by decreasing the correlation level of the system's input and output data at the time of the attack event.

By the developed control method, the goal is to prevent the system from entering the destruction phase and, at the same time, to detect attacks. Therefore, previously introduced residual-based detection methods will be significantly ineffective in detecting attacks with low-amplitude or a small number of delays. So, considering a delay in the system with the variable sinusoidal behavior is practically the worst-case scenario. Based on this article's approach, the system can maintain its stability under this condition, as shown in simulation results. Thus, the system's response accuracy will be much higher than other control strategies, specifically in industrial systems.

Since the proposed robust control strategy can maintain the system states bounded under time-delay attacks with time-varying and unknown delays, the trustworthiness of the system's performance is increased. Moreover, by proposing the statistical methods to detect faults for the mentioned attacks, we illustrated in simulation results that attacks can be detected at the time of their occurrence and thus, we stated the term ‘Trust-based’ in the paper title to state that both provided fault detection and robust control strategies are trustworthy.

Conclusions

This article has proposed the secure, robust control design issue against unknown time-delay attacks of uncertain CPSs. The system's stability has been analyzed using a descriptor model representation and appropriate Lyapunov functional conditions for the closed-loop system. Furthermore, closed-loop security has been guaranteed by calculating the optimal feedback control gain in linear matrix inequalities (LMIs). Different time-delay attack detection frameworks have been proposed and compared according to the statistical analysis fault detection methods such as correlation analysis and Kullback-Leibler (K-L) divergence criteria from the mathematical view and in simulations. Finally, numerical results illustrated that the closed-loop uncertain system could remain stable with the proposed robust controller under time-delay attacks. The proposed approach can be applied to controlling systems with inaccurate models with variable environmental changes. Besides, suppose the system includes some delays or a threat of system instability due to delay effects caused by environmental changes. In that case, the presented conservative robust approach can be used to provide the system's stability, and it will enhance the system's resiliency. If the injected attack signals involve non-Gaussian distributions, new robust approaches should be developed since this paper's design cannot maintain the system's stability under non-Gaussian adversaries. Thus, subsequent studies include the security analysis of various types of CPSs in smart infrastructures under time-delay adversaries added to different types of Gaussian/non-Gaussian cyber threats and the design of associated fault detection and protection strategies.

Declarations

Author contribution statement

S. Baromand: Conceived and designed the experiments; Performed the experiments; Analyzed and interpreted the data; Contributed reagents, materials, analysis tools or data; Wrote the paper.

A. Zaman: Conceived and designed the experiments; Analyzed and interpreted the data; Contributed reagents, materials, analysis tools or data; Wrote the paper.

L. Mihaylova: Analyzed and interpreted the data; Contributed reagents, materials, analysis tools or data; Wrote the paper.

Funding statement

This work was supported by ECO-Qube (956059).

Data availability statement

Data will be made available on request.

Declaration of interests statement

The authors declare no conflict of interest.

Additional information

Supplementary content related to this article has been published online at https://doi.org/10.1016/j.heliyon.2021.e07294.

No additional information is available for this paper.