Statistical Approach to Detection of Attacks for Stochastic Cyber-Physical Systems

We study the problem of detecting an attack on a stochastic cyber-physical system. We aim to treat the problem in its most general form. We start by introducing the notion of asymptotically detectable attacks, as those attacks introducing changes to the system's output statistics which persist asymptotically. We then provide a necessary and sufficient condition for asymptotic detectability. This condition preserves generality as it holds under no restrictive assumption on the system and attacking scheme. To show the importance of this condition, we apply it to detect certain attacking schemes which are undetectable using simple statistics. Our necessary and sufficient condition naturally leads to an algorithm which gives a confidence level for attack detection. We present simulation results to illustrate the performance of this algorithm.