A degradation-based detection framework against covert cyberattacks on SCADA systems. (16th April 2021)

• Record Type: Journal Article
• Authors: Li, Dan; Paynabar, Kamran; Gebraeel, Nagi
• Is Part Of: IISE transactions. Volume 53:Number 7(2021)
• Page Start: 812
• Page End: 829
• Publication Date: 2021-04-16
• Subjects: Cybersecurity -- SCADA -- covert attack -- reliability -- attack detection; Industrial engineering -- Periodicals; Systems engineering -- Periodicals; Industrial engineering; Systems engineering; Electronic journals; Periodicals; 670.285
• DOI: 10.1080/24725854.2020.1802537
• Languages: English
• ISSNs: 2472-5854

Abstract

Abstract: Supervisory Control and Data Acquisition (SCADA) systems are commonly used in critical infrastructures. However, these systems are typically vulnerable to cyberattacks. Among the different types of cyberattacks, the covert attack is one of the hardest to detect – it is undetectable when the system is operating under normal conditions. In this article, we develop a data-driven detection framework that utilizes the degradation process of the system to detect covert attacks. We derive mathematical characteristics of the degradation processes under covert attacks that are used for developing a sequential likelihood ratio test method for attack detection. We verify our methodology through an extensive numerical study and a case study on a rotating machinery setup. Our results show that the methodology helps detect covert attacks within reasonable delay time and is applicable under real-world settings.