Aerospace and Electronic Systems Magazine May 2017 - 41
Do et al.
inf md (T ; L ) = sup k0 (T − k0 + 1 > L | T ≥ k0 )
T ∈ α
k0 ≥ L
(13)
(under the assumption that no change occurs during the preheating
period; i.e., it is assumed that k0 ≥ L) over the class
{
}
α = T : fa (T ; m ) = sup 0 ( ≤ T < + m − 1) ≤ α ,
≥ L
(14)
where md denotes the worst-case probability of missed detection
and fa stands for the worst-case probability of false alarm within
any time window of length m.
The role of the greatest lower bound or infT ∈ α in (13) is as follows: we are looking for the best possible test (or stopping time)
T, which minimizes the worst-case probability of missed detection
md (defined by the least upper bound for the probability of missed
detection, or sup k0 ≥ L k0) over class α of all possible tests. Because
we are not sure that the minimum of md exists, it is preferable to
use infT ∈ α over class α . This class of tests α is defined in (14)
by using the least upper bound for the probability of false alarm, or
sup ≥ L 0, within any time window of length m. Here, we use sup
instead of max for the same reason.
Because the state-space model given by (10) may have a number of unobservable parameters, i.e., xk, x0, uk, and dk, the first step
of the attack detection procedure, i.e., residual generation, is reduced to 1) the Kalman filter or 2) the projection of observation yk
on the subspace of invariant statistics. The choice between these
two methods would seem to depend greatly on the nature (stochastic or deterministic) of the unobservable parameters, i.e., xk, x0, uk,
and dk. The unified statistical model of the residual generation by
the steady-state Kalman filter and by the fixed-size parity space
is developed [39]. It has been shown that the utilization of the residual vector (free from nuisance parameters) can be expressed by
the following unified statistical model:
rkk− L +1 = φkk− L +1 ( k0 ) + ξ kk− L +1 ,
0
if k < k0
0
φ1
φkk− L +1 ( k0 ) =
if k0 ≤ k < k0 + L ,
φk − k +1
0
φkk− L +1 ( k0 ) if k ≥ k0 + L
}
nn− k +1 =
n
1≤ k ≤ L
log
fφk −n+t ( rt )
f 0 ( rt )
t = n − k +1
,
(16)
(17)
where fφk −n+t () is the probability density function of the residual
rt under the attack-event hypothesis and f 0 () is the probability
density function under the no-attack-event hypothesis.
The optimal choice of the variable thresholds h1, ..., hL, i.e., hi
= ∞ for i = 1, ..., L − 1 and hL = hL(α), in the preceding stopping
rule leads to the following finite moving average (FMA) test:
{
(
)
}
T
TFMA = inf n ≥ L : φ1L (1) Σ −1rnn− L +1 ≥ h ,
(18)
T
L
where φ1 (1) = (φ1 ,...,φL ) and the threshold h = h (α ) is chosen as
a function of false alarm rate α.
The stopping rule in (16) is interpreted in the following manner: starting from the instant L (to fill out the sliding window of
observations), the detection of attack is declared at the first time
instant n (therefore, the infimum is used) when the maximum difference between the log-likelihood ratio nn− k +1 for testing the null
no-attack-event hypothesis against the alternative attack-event
hypothesis and the threshold hk calculated for the L last residuals rnn− L +1, i.e., max nn− k +1 − hk , is nonnegative. This means that
1≤ k ≤ L
the alternative hypothesis is more likely to be true than the null
hypothesis, provided that the worst-case probability of false alarm
is upper bounded by α.
The stopping rule in (18) is interpreted in the same way. Here,
the maximization of the difference between the log-likelihood ratio
and the threshold is reduced to the calculation of only one loglikelihood ratio per sliding window by the optimal choice of the
variable thresholds hk, k = 1, ..., L.
Some extensions of the proposed detection algorithm to the
joint detection-isolation problem can be found in [29].
CONCLUSION
(15)
where rkk− L +1 is the vector of L last residuals rk−L+1,...,rk, (ϕ1,...,ϕL) is
the change signature, and ξ kk− L +1 ~ ( 0, Σ ) is the vector of random
noises.
The motivation and rationalities of the window-limited cumulative sum test and the variable threshold window-limited cumulative sum (VTWL CUSUM) test as a solution to the transient
change detection problem can be found in [108], [110], and [113].
The stopping time of the VTWL CUSUM test is given by the following [39], [114]:
MAY 2017
{
TVTWL = inf n ≥ L : max nn− k +1 − hk ≥ 0 ,
SCADA systems have been playing a vital and an increasing role in
safety-critical infrastructures of a nation, including transportation
systems, electric power grids, gas pipelines, and water networks.
The rapid advance of information and communication technology
has rendered modern SCADA systems increasingly vulnerable to
cyber-physical attacks on both physical and cyber layers. Because
of their essential role, the security of SCADA systems against malicious attacks has received research attention over the last few
years.
Though approaches focused on information security may provide some elements of security for SCADA systems, their scope
may be limited with regards to the defense-in-depth strategy of
SCADA systems against malicious attacks: for example, some,
as revealed by the Stuxnet incident in 2010, are designed to bypass information security layers. Data-based and model-based
approaches of attack detection can be considered complementary
solutions to the information security approach, because they ac-
IEEE A&E SYSTEMS MAGAZINE
41
Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine May 2017
No label
Aerospace and Electronic Systems Magazine May 2017 - No label
Aerospace and Electronic Systems Magazine May 2017 - Cover2
Aerospace and Electronic Systems Magazine May 2017 - 1
Aerospace and Electronic Systems Magazine May 2017 - 2
Aerospace and Electronic Systems Magazine May 2017 - 3
Aerospace and Electronic Systems Magazine May 2017 - 4
Aerospace and Electronic Systems Magazine May 2017 - 5
Aerospace and Electronic Systems Magazine May 2017 - 6
Aerospace and Electronic Systems Magazine May 2017 - 7
Aerospace and Electronic Systems Magazine May 2017 - 8
Aerospace and Electronic Systems Magazine May 2017 - 9
Aerospace and Electronic Systems Magazine May 2017 - 10
Aerospace and Electronic Systems Magazine May 2017 - 11
Aerospace and Electronic Systems Magazine May 2017 - 12
Aerospace and Electronic Systems Magazine May 2017 - 13
Aerospace and Electronic Systems Magazine May 2017 - 14
Aerospace and Electronic Systems Magazine May 2017 - 15
Aerospace and Electronic Systems Magazine May 2017 - 16
Aerospace and Electronic Systems Magazine May 2017 - 17
Aerospace and Electronic Systems Magazine May 2017 - 18
Aerospace and Electronic Systems Magazine May 2017 - 19
Aerospace and Electronic Systems Magazine May 2017 - 20
Aerospace and Electronic Systems Magazine May 2017 - 21
Aerospace and Electronic Systems Magazine May 2017 - 22
Aerospace and Electronic Systems Magazine May 2017 - 23
Aerospace and Electronic Systems Magazine May 2017 - 24
Aerospace and Electronic Systems Magazine May 2017 - 25
Aerospace and Electronic Systems Magazine May 2017 - 26
Aerospace and Electronic Systems Magazine May 2017 - 27
Aerospace and Electronic Systems Magazine May 2017 - 28
Aerospace and Electronic Systems Magazine May 2017 - 29
Aerospace and Electronic Systems Magazine May 2017 - 30
Aerospace and Electronic Systems Magazine May 2017 - 31
Aerospace and Electronic Systems Magazine May 2017 - 32
Aerospace and Electronic Systems Magazine May 2017 - 33
Aerospace and Electronic Systems Magazine May 2017 - 34
Aerospace and Electronic Systems Magazine May 2017 - 35
Aerospace and Electronic Systems Magazine May 2017 - 36
Aerospace and Electronic Systems Magazine May 2017 - 37
Aerospace and Electronic Systems Magazine May 2017 - 38
Aerospace and Electronic Systems Magazine May 2017 - 39
Aerospace and Electronic Systems Magazine May 2017 - 40
Aerospace and Electronic Systems Magazine May 2017 - 41
Aerospace and Electronic Systems Magazine May 2017 - 42
Aerospace and Electronic Systems Magazine May 2017 - 43
Aerospace and Electronic Systems Magazine May 2017 - 44
Aerospace and Electronic Systems Magazine May 2017 - 45
Aerospace and Electronic Systems Magazine May 2017 - 46
Aerospace and Electronic Systems Magazine May 2017 - 47
Aerospace and Electronic Systems Magazine May 2017 - 48
Aerospace and Electronic Systems Magazine May 2017 - 49
Aerospace and Electronic Systems Magazine May 2017 - 50
Aerospace and Electronic Systems Magazine May 2017 - 51
Aerospace and Electronic Systems Magazine May 2017 - 52
Aerospace and Electronic Systems Magazine May 2017 - 53
Aerospace and Electronic Systems Magazine May 2017 - 54
Aerospace and Electronic Systems Magazine May 2017 - 55
Aerospace and Electronic Systems Magazine May 2017 - 56
Aerospace and Electronic Systems Magazine May 2017 - 57
Aerospace and Electronic Systems Magazine May 2017 - 58
Aerospace and Electronic Systems Magazine May 2017 - 59
Aerospace and Electronic Systems Magazine May 2017 - 60
Aerospace and Electronic Systems Magazine May 2017 - 61
Aerospace and Electronic Systems Magazine May 2017 - 62
Aerospace and Electronic Systems Magazine May 2017 - 63
Aerospace and Electronic Systems Magazine May 2017 - 64
Aerospace and Electronic Systems Magazine May 2017 - Cover3
Aerospace and Electronic Systems Magazine May 2017 - Cover4
http://www.brightcopy.net/allen/aesm/34-2s
http://www.brightcopy.net/allen/aesm/34-2
http://www.brightcopy.net/allen/aesm/34-1
http://www.brightcopy.net/allen/aesm/33-12
http://www.brightcopy.net/allen/aesm/33-11
http://www.brightcopy.net/allen/aesm/33-10
http://www.brightcopy.net/allen/aesm/33-09
http://www.brightcopy.net/allen/aesm/33-8
http://www.brightcopy.net/allen/aesm/33-7
http://www.brightcopy.net/allen/aesm/33-5
http://www.brightcopy.net/allen/aesm/33-4
http://www.brightcopy.net/allen/aesm/33-3
http://www.brightcopy.net/allen/aesm/33-2
http://www.brightcopy.net/allen/aesm/33-1
http://www.brightcopy.net/allen/aesm/32-10
http://www.brightcopy.net/allen/aesm/32-12
http://www.brightcopy.net/allen/aesm/32-9
http://www.brightcopy.net/allen/aesm/32-11
http://www.brightcopy.net/allen/aesm/32-8
http://www.brightcopy.net/allen/aesm/32-7s
http://www.brightcopy.net/allen/aesm/32-7
http://www.brightcopy.net/allen/aesm/32-6
http://www.brightcopy.net/allen/aesm/32-5
http://www.brightcopy.net/allen/aesm/32-4
http://www.brightcopy.net/allen/aesm/32-3
http://www.brightcopy.net/allen/aesm/32-2
http://www.brightcopy.net/allen/aesm/32-1
http://www.brightcopy.net/allen/aesm/31-12
http://www.brightcopy.net/allen/aesm/31-11s
http://www.brightcopy.net/allen/aesm/31-11
http://www.brightcopy.net/allen/aesm/31-10
http://www.brightcopy.net/allen/aesm/31-9
http://www.brightcopy.net/allen/aesm/31-8
http://www.brightcopy.net/allen/aesm/31-7
https://www.nxtbookmedia.com