Wang Jun-Sheng, Yang Guang-Hong
IEEE Trans Cybern. 2019 Aug;49(8):3020-3031. doi: 10.1109/TCYB.2018.2837874. Epub 2018 Jun 5.
Most of the existing stealthy attack schemes for cyber-physical systems (CPSs) are presented under the assumption that the model parameters of CPS are known to attackers. Presently, there are only a few model-independent stealthy attack approaches, which, however, need the assumption that attackers know sensor measurements and can modify them. This paper aims to remove the aforementioned conservative assumptions and give a stealthy attack methodology for closed-loop CPS with reference signals, that is, transmission control protocol/Internet protocol (TCP/IP)-based networked control systems. To this end, under the condition that the model parameters of the CPS are unknown, a benchmark platform (consisting of an attack detector and a TCP/IP-based networked dc servo system) used for testing the stealthy attack technology is constructed via data-driven methods. A plan is made, which is utilized for eavesdropping the information of the TCP/IP-based CPS. On this basis, an approach to blocking network communications and injecting the false sensor data into the CPS is explored. A closed-loop recursive identification strategy for the dynamic characteristic matrix of the CPS is designed. By employing all of the above-obtained results, a data-driven stealthy attack scheme for the CPS is proposed and, subsequently, its effectiveness and practicability are validated by experiment.
大多数现有的针对网络物理系统（CPS）的隐蔽攻击方案都是在攻击者已知CPS模型参数的假设下提出的。目前，只有少数与模型无关的隐蔽攻击方法，然而，这些方法需要攻击者知道传感器测量值并能对其进行修改的假设。本文旨在消除上述保守假设，并为具有参考信号的闭环CPS给出一种隐蔽攻击方法，即基于传输控制协议/互联网协议（TCP/IP）的网络控制系统。为此，在CPS模型参数未知的情况下，通过数据驱动方法构建了一个用于测试隐蔽攻击技术的基准平台（由一个攻击检测器和一个基于TCP/IP的网络直流伺服系统组成）。制定了一个计划，用于窃听基于TCP/IP的CPS的信息。在此基础上，探索了一种阻断网络通信并将虚假传感器数据注入CPS的方法。设计了一种用于CPS动态特性矩阵的闭环递归辨识策略。利用上述所有结果，提出了一种针对CPS的数据驱动隐蔽攻击方案，随后通过实验验证了其有效性和实用性。
