arXiv subjects

Bruno Sinopoli

Publications and source records attributed to Bruno Sinopoli.

At least 55 records · Page 3Linked to original sources

arXiv2019

Joint attack detection and secure state estimation of cyber-physical systems

This paper deals with secure state estimation of cyber-physical systems subject to switching (on/off) attack signals and injection of fake packets (via either packet substitution or insertion of extra packets). The random set paradigm is adopted in order to model, via Random Finite Sets (RFSs), the switching nature of both system attacks and the injection of fake measurements. The problem of detecting an attack on the system and jointly estimating its state, possibly in the presence of fake measurements, is then formulated and solved in the Bayesian framework for systems with and without direct feedthrough of the attack input to the output. This leads to the analytical derivation of a hybrid Bernoulli filter (HBF) that updates in real-time the joint posterior density of a Bernoulli attack RFS and of the state vector. A closed-form Gaussian-mixture implementation of the proposed hybrid Bernoulli filter is fully derived in the case of invertible direct feedthrough. Finally, the effectiveness of the developed tools for joint attack detection and secure state estimation is tested on two case-studies concerning a benchmark system for unknown input estimation and a standard IEEE power network application.

eess.SY↗

arXiv2018

Software Rejuvenation for Secure Tracking Control

Software rejuvenation protects cyber-physical systems (CSPs) against cyber attacks on the run-time code by periodically refreshing the system with an uncorrupted software image. The system is vulnerable to attacks when it is communicating with other agents. Security is guaranteed during the software refresh and re-initialization by turning off all communication. Although the effectiveness of software rejuvenation has been demonstrated for some simple systems, many problems need to be addressed to make it viable for real applications. This paper expands the scope of CPS applications for which software rejuvenation can be implemented by introducing architectural and algorithmic features to support trajectory tracking. Following each software refresh, while communication is still off, a safety controller is executed to assure the system state is within a sufficiently small neighborhood of the current point on the reference trajectory. Communication is then re-established and the reference trajectory tracking control is resumed. A protected, verified hypervisor manages the software rejuvenation sequence and delivers trusted reference trajectory points, which may be received from untrusted communication, but are verified using an authentication process. We present the approach to designing the tracking and safety controllers and timing parameters and demonstrate the secure tracking control for a 6 DOF quadrotor using the PX4 jMAVSim quadrotor simulator. The concluding section discusses directions for further research.

eess.SY↗

arXiv2018

Design of Software Rejuvenation for CPS Security Using Invariant Sets

Software rejuvenation has been proposed as a strategy to protect cyber-physical systems (CSPs) against unanticipated and undetectable cyber attacks. The basic idea is to refresh the system periodically with a secure and trusted copy of the online software so as to eliminate all effects of malicious modifications to the run-time code and data. Following each software refresh a safety controller assures the CPS is driven to a safe state before returning to the mission control mode when the CPS is again vulnerable attacks. This paper considers software rejuvenation design from a control-theoretic perspective. Invariant sets for the Lyapunov function for the safety controller are used to derive bounds on the time that the CPS can operate in mission control mode before the software must be refreshed and the maximum time the safety controller will require to bring the CPS to a safe operating state. With these results it can be guaranteed that the CPS will remain safe under cyber attacks against the run-time system and will be able to execute missions successfully if the attacks are not persistent. The general approach is illustrated using simulation of the nonlinear dynamics of a quadrotor system. The concluding section discusses directions for further research.

eess.SY↗

arXiv2018

Robustness of flow networks against cascading failures under partial load redistribution

We study the robustness of flow networks against cascading failures under a partial load redistribution model. In particular, we consider a flow network of $N$ lines with initial loads $L_1, \ldots, L_N$ and free-spaces (i.e., redundant space) $S_1, \ldots, S_N$ that are independent and identically distributed with joint distribution $P_{LS}(x,y)=\mathbb{P}(L \leq x, S \leq y)$. The capacity $C_i$ is the maximum load allowed on line $i$, and is given by $C_i=L_i + S_i$. When a line fails due to overloading, it is removed from the system and $(1-\varepsilon)$-fraction of the load it was carrying (at the moment of failing) gets redistributed equally among all remaining lines in the system; hence we refer to this as the {\it partial} load redistribution model. The rest (i.e., $\varepsilon$-fraction) of the load is assumed to be lost or absorbed, e.g., due to advanced circuitry disconnecting overloaded power lines or an inter-connected network/material absorbing a fraction of the flow from overloaded lines. We analyze the robustness of this flow network against random attacks that remove a $p$-fraction of the lines. Our contributions include (i) deriving the final fraction of alive lines $n_{\infty}(p,\varepsilon)$ for all $p, \varepsilon \in (0,1)$ and confirming the results via extensive simulations; (ii) showing that partial redistribution might lead to (depending on the parameter $0<\varepsilon \leq 1$) the order of transition at the critical attack size $p^{*}$ changing from first to second-order; and (iii) proving analytically that flow networks achieve maximum robustness (quantified by the area $\int_{0}^{1} n_{\infty}(p,\varepsilon) \mathrm{d}p$) when all lines have the same free-space regardless of their initial load. The optimality of equal free-space allocation is also confirmed on real-world data from the UK National Power Grid.

physics.soc-ph↗

arXiv2018

Distributed Estimation Via a Roaming Token

We present an algorithm for the problem of linear distributed estimation of a parameter in a network where a set of agents are successively taking measurements. The approach considers a roaming token in a network that carries the estimate, and jumps from one agent to another in its vicinity according to the probabilities of a Markov chain. When the token is at an agent it records the agent's local information. We analyze the proposed algorithm and show that it is consistent and asymptotically optimal, in the sense that its mean-square-error (MSE) rate of decay approaches the centralized one as the number of iterations increases. We show these results for a scenario where the network changes over time, and we consider two different set of assumptions on the network instantiations: they are i.i.d. and connected on the average, or they are deterministic and strongly connected for every finite time window of a fixed size. Simulations show our algorithm is competitive with consensus+innovations type algorithms, achieving a smaller MSE at each iteration in all considered scenarios.

eess.SY↗

arXiv2018

Optimal Threshold Policies for Robust Data Center Control

With the simultaneous rise of energy costs and demand for cloud computing, efficient control of data centers becomes crucial. In the data center control problem, one needs to plan at every time step how many servers to switch on or off in order to meet stochastic job arrivals while trying to minimize electricity consumption. This problem becomes particularly challenging when servers can be of various types and jobs from different classes can only be served by certain types of server, as it is often the case in real data centers. We model this problem as a robust Markov Decision Process (i.e., the transition function is not assumed to be known precisely). We give sufficient conditions (which seem to be reasonable and satisfied in practice) guaranteeing that an optimal threshold policy exists. This property can then be exploited in the design of an efficient solving method, which we provide. Finally, we present some experimental results demonstrating the practicability of our approach and compare with a previous related approach based on model predictive control.

cs.PF↗

arXiv2017

A Bernoulli-Gaussian Physical Watermark for Detecting Integrity Attacks in Control Systems

We examine the merit of Bernoulli packet drops in actively detecting integrity attacks on control systems. The aim is to detect an adversary who delivers fake sensor measurements to a system operator in order to conceal their effect on the plant. Physical watermarks, or noisy additive Gaussian inputs, have been previously used to detect several classes of integrity attacks in control systems. In this paper, we consider the analysis and design of Gaussian physical watermarks in the presence of packet drops at the control input. On one hand, this enables analysis in a more general network setting. On the other hand, we observe that in certain cases, Bernoulli packet drops can improve detection performance relative to a purely Gaussian watermark. This motivates the joint design of a Bernoulli-Gaussian watermark which incorporates both an additive Gaussian input and a Bernoulli drop process. We characterize the effect of such a watermark on system performance as well as attack detectability in two separate design scenarios. Here, we consider a correlation detector for attack recognition. We then propose efficiently solvable optimization problems to intelligently select parameters of the Gaussian input and the Bernoulli drop process while addressing security and performance trade-offs. Finally, we provide numerical results which illustrate that a watermark with packet drops can indeed outperform a Gaussian watermark.

eess.SY↗

arXiv2017

Detecting Integrity Attacks on Control Systems using a Moving Target Approach

Maintaining the security of control systems in the presence of integrity attacks is a significant challenge. In literature, several possible attacks against control systems have been formulated including replay, false data injection, and zero dynamics attacks. The detection and prevention of these attacks may require the defender to possess a particular subset of trusted communication channels. Alternatively, these attacks can be prevented by keeping the system model secret from the adversary. In this paper, we consider an adversary who has the ability to modify and read all sensor and actuator channels. To thwart this adversary, we introduce external states dependent on the state of the control system, with linear time-varying dynamics unknown to the adversary. We also include sensors to measure these states. The presence of unknown time-varying dynamics is leveraged to detect an adversary who simultaneously aims to identify the system and inject stealthy outputs. Potential attack strategies and bounds on the attacker's performance are provided.

eess.SY↗

arXiv2017

A Moving Target Approach for Identifying Malicious Sensors in Control Systems

In this paper, we consider the problem of attack identification in cyber-physical systems (CPS). Attack identification is often critical for the recovery and performance of a CPS that is targeted by malicious entities, allowing defenders to construct algorithms which bypass harmful nodes. Previous work has characterized limitations in the perfect identification of adversarial attacks on deterministic LTI systems. For instance, a system must remain observable after removing any 2q sensors to only identify q attacks. However, the ability for an attacker to create an unidentifiable attack requires knowledge of the system model. In this paper, we aim to limit the adversary's knowledge of the system model with the goal of accurately identifying all sensor attacks. Such a scheme will allow systems to withstand larger attacks or system operators to allocate fewer sensing devices to a control system while maintaining security. We explore how changing the dynamics of the system as a function of time allows us to actively identify malicious/faulty sensors in a control system. We discuss the design of time varying system matrices to meet this goal and evaluate performance in deterministic and stochastic systems.

eess.SY↗

arXiv2016

On the Efficiency and Fairness of Multiplayer HTTP-based Adaptive Video Streaming

User-perceived quality-of-experience (QoE) is critical in internet video delivery systems. Extensive prior work has studied the design of client-side bitrate adaptation algorithms to maximize single-player QoE. However, multiplayer QoE fairness becomes critical as the growth of video traffic makes it more likely that multiple players share a bottleneck in the network. Despite several recent proposals, there is still a series of open questions. In this paper, we bring the problem space to light from a control theory perspective by formalizing the multiplayer QoE fairness problem and addressing two key questions in the broader problem space. First, we derive the sufficient conditions of convergence to steady state QoE fairness under TCP-based bandwidth sharing scheme. Based on the insight from this analysis that in-network active bandwidth allocation is needed, we propose a non-linear MPC-based, router-assisted bandwidth allocation algorithm that regards each player as closed-loop systems. We use trace-driven simulation to show the improvement over existing approaches. We identify several research directions enabled by the control theoretic modeling and envision that control theory can play an important role on guiding real system design in adaptive video streaming.

cs.MM↗

arXiv2016

Minimum Sensor Placement for Robust Observability of Structured Complex Networks

This paper addresses problems on the robust structural design of complex networks. More precisely, we address the problem of deploying the minimum number of dedicated sensors, i.e., those measuring a single state variable, that ensure the network to be structurally observable under disruptive scenarios. The disruptive scenarios considered are as follows: (i) the malfunction/loss of one arbitrary sensor, and (ii) the failure of connection (either unidirectional or bidirectional communication) between a pair of agents. First, we show these problems to be NP-hard, which implies that efficient algorithms to determine a solution are unlikely to exist. Secondly, we propose an intuitive two step approach: (1) we achieve an arbitrary minimum sensor placement ensuring structural observability; (2) we develop a sequential process to find minimum number of additional sensors required for robust observability. This step can be solved by recasting it as a weighted set covering problem. Although this is known to be an NP-hard problem, feasible approximations can be determined in polynomial-time that can be used to obtain feasible approximations to the robust structural design problems with optimality guarantees.

math.OC↗

arXiv2016

Networked Constrained Cyber-Physical Systems subject to malicious attacks: a resilient set-theoretic control approach

In this paper a novel set-theoretic control framework for Networked Constrained Cyber-Physical Systems is presented. By resorting to set-theoretic ideas and the physical watermarking concept, an anomaly detector module and a control remediation strategy are formally derived with the aim to contrast severe cyber attacks affecting the communication channels. The resulting scheme ensures Uniformly Ultimate Boundedness and constraints fulfillment regardless of any admissible attack scenario. Simulation results show the effectiveness of the proposed strategy both against Denial of Service and False Data Injection attacks.

eess.SY↗

arXiv2016

Information Flow for Security in Control Systems

This paper considers the development of information flow analyses to support resilient design and active detection of adversaries in cyber physical systems (CPS). The area of CPS security, though well studied, suffers from fragmentation. In this paper, we consider control systems as an abstraction of CPS. Here, we extend the notion of information flow analysis, a well established set of methods developed in software security, to obtain a unified framework that captures and extends system theoretic results in control system security. In particular, we propose the Kullback Liebler (KL) divergence as a causal measure of information flow, which quantifies the effect of adversarial inputs on sensor outputs. We show that the proposed measure characterizes the resilience of control systems to specific attack strategies by relating the KL divergence to optimal detection techniques. We then relate information flows to stealthy attack scenarios where an adversary can bypass detection. Finally, this article examines active detection mechanisms where a defender intelligently manipulates control inputs or the system itself in order to elicit information flows from an attacker's malicious behavior. In all previous cases, we demonstrate an ability to investigate and extend existing results by utilizing the proposed information flow analyses.

eess.SY↗

arXiv2015

A Graph Theoretic Characterization of Perfect Attackability and Detection in Distributed Control Systems

This paper is concerned with the analysis and design of secure Distributed Control Systems in the face of integrity attacks on sensors and controllers by external attackers or insiders. In general a DCS consists of many heterogenous components and agents including sensors, actuators, controllers. Due to its distributed nature, some agents may start misbehaving to disrupt the system. This paper first reviews necessary and sufficient conditions for deterministic detection of integrity attacks carried out by any number of malicious agents, based on the concept of left invertibility of structural control systems. It then develops a notion equivalent to structural left invertibility in terms of vertex separators of a graph. This tool is then leveraged to design minimal communication networks for DCSs, which ensure that an adversary cannot generate undetectable attacks. Numerical examples are included to illustrate these results.

eess.SY↗

arXiv2015

Analyzing TCP Throughput Stability and Predictability with Implications for Adaptive Video Streaming

Recent work suggests that TCP throughput stability and predictability within a video viewing session can inform the design of better video bitrate adaptation algorithms. Despite a rich tradition of Internet measurement, however, our understanding of throughput stability and predictability is quite limited. To bridge this gap, we present a measurement study of throughput stability using a large-scale dataset from a video service provider. Drawing on this analysis, we propose a simple-but-effective prediction mechanism based on a hidden Markov model and demonstrate that it outperforms other approaches. We also show the practical implications in improving the user experience of adaptive video streaming.

cs.NI↗

arXiv2015

Distributed inference over directed networks: Performance limits and optimal design

We find large deviations rates for consensus-based distributed inference for directed networks. When the topology is deterministic, we establish the large deviations principle and find exactly the corresponding rate function, equal at all nodes. We show that the dependence of the rate function on the stochastic weight matrix associated with the network is fully captured by its left eigenvector corresponding to the unit eigenvalue. Further, when the sensors' observations are Gaussian, the rate function admits a closed form expression. Motivated by these observations, we formulate the optimal network design problem of finding the left eigenvector which achieves the highest value of the rate function, for a given target accuracy. This eigenvector therefore minimizes the time that the inference algorithm needs to reach the desired accuracy. For Gaussian observations, we show that the network design problem can be formulated as a semidefinite (convex) program, and hence can be solved efficiently. When observations are identically distributed across agents, the system exhibits an interesting property: the graph of the rate function always lies between the graphs of the rate function of an isolated node and the rate function of a fusion center that has access to all observations. We prove that this fundamental property holds even when the topology and the associated system matrices change randomly over time, with arbitrary distribution. Due to generality of its assumptions, the latter result requires more subtle techniques than the standard large deviations tools, contributing to the general theory of large deviations.

cs.IT↗

arXiv2015

Multi-Sensor Scheduling for State Estimation with Event-Based, Stochastic Triggers

In networked systems, state estimation is hampered by communication limits. Past approaches, which consider scheduling sensors through deterministic event-triggers, reduce communication and maintain estimation quality. However, these approaches destroy the Gaussian property of the state, making it computationally intractable to obtain an exact minimum mean squared error estimate. We propose a stochastic event-triggered sensor schedule for state estimation which preserves the Gaussianity of the system, extending previous results from the single-sensor to the multi-sensor case.

cs.IT↗

arXiv2014

Stochastic Event-triggered Sensor Schedule for Remote State Estimation

We propose an open-loop and a closed-loop stochastic event-triggered sensor schedule for remote state estimation. Both schedules overcome the essential difficulties of existing schedules in recent literature works where, through introducing a deterministic event-triggering mechanism, the Gaussian property of the innovation process is destroyed which produces a challenging nonlinear filtering problem that cannot be solved unless approximation techniques are adopted. The proposed stochastic event-triggered sensor schedules eliminate such approximations. Under these two schedules, the MMSE estimator and its estimation error covariance matrix at the remote estimator are given in a closed-form. Simulation studies demonstrate that the proposed schedules have better performance than periodic ones with the same sensor-to-estimator communication rate.

cs.IT↗