Hidden Markov Model-Based Attack Detection for Networked Control Systems Subject to Random Packet Dropouts

• Published in: IEEE transactions on industrial electronics (1982) Vol. 68; no. 1; pp. 642 - 653
• Main Authors: Lu, Genghong, Feng, Dongqin, Huang, Biao
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.01.2021; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Algorithms; Computer worms; Control systems; Cybersecurity; Dropouts; expectation maximization (EM) algorithm; Hazards; hidden Markov model (HMM); Hidden Markov models; Industrial electronics; Markov chains; Networked control systems; Parameter estimation; Process control; Stuxnet attack; time-varying transition probabilities; Transition probabilities
• ISSN: 0278-0046; 1557-9948
• DOI: 10.1109/TIE.2020.2965467

The problem of attack detection for Stuxnet in the industrial control system is discussed in this article. Different operating modes (normal and hazard modes) may occur in the nominal process. In this article, we consider that the transition between different modes follows a Markov chain model with a certain transition probability. However, when the Stuxnet attack is launched, the attack signals with random multitude and frequency will be injected to trigger more hazard modes, and finally, hasten fatigue of control devices. Under this unpredictable attack, the transition between operating modes will not follow the regular transition probabilities. Therefore, a hidden Markov model with time-varying transition probabilities is utilized to describe the Stuxnet attack. The transition probabilities are estimated based on the measurements. By recognizing operating modes and predicting the number of the occurrence of hazard modes, the Stuxnet attack can be detected earlier if the predicted value exceeds the threshold. In the operating mode recognition, the expectation maximization algorithm is used to estimate the parameters considering random packet dropouts caused by the unreliable network. A simulation is conducted to verify the effectiveness of the proposed method.