Cross-level Detection of Sensor-based Deception Attacks on Cyber-Physical Systems

From electricity distribution to water management, higher levels of efficiency and performance have been attained by the synergy of computers, communications, and control. This higher level of performance, however, comes at a cost to system security. Cyber-Physical Systems (CPS) have intrinsic vulnerabilities that malicious agents can explore in order to harm the integrity of the system. An attacker employing deception-based methods seeks to have their target believe an incorrect version of reality. This paper describes two anomaly detection approaches using, respectively, micro-level and process-level techniques which are then combined into one cross-level hypothesis test. The process-level (also referred as macro-level) detector uses the physical interconnections that exist between the multiple sensors and implements a consensus algorithm to determine if one sensor is reporting anomalous values. The micro-level detector uses measurements of the integrated circuit power supply current draw sampling several times per clock cycle to determine if the code running inside the micro-controller of a sensor has been altered. One example of a sensor-based deception attack the present work focuses on is a simple replay attack launched from one sensor within the system that aims to mislead controllers while eluding conventional fault detectors. The theoretical performance of the proposed method is evaluated in two laboratory experiments.