(14b) A Framework for the Identification and Mitigation of Cyber-Attacks in Networked Process Control Systems

Process operations have become increasingly reliant on networked control system architectures in which dedicated sensor‐controller and controller‐actuator links are replaced by real-time shared communication networks (wired or wireless). The integration of a shared communication network in the control system can substantially improve the operational flexibility and fault‐tolerance capabilities of an industrial control system, in addition to reducing the installation, reconfiguration and maintenance times and costs.

Despite the economic and operational benefits of networked control systems, the increased reliance on a shard communication network comes with a host of fundamental challenges. Some of these challenges are tied to the inherent limitations on the transmission and processing capabilities of the communication medium. For example, issues such as network resource constraints, data losses, communication delays and real-time scheduling constraints can cause operational instabilities or closed-loop performance deterioration if left unaddressed. These challenges have motivated a significant body of research work in this area (e.g., [1], [2], [3], [4]).

Another challenge that networked control systems face, especially in the context of wireless networks, is the issue of network cyber-security. Owing to the deployment of large-scale sensor and actuator networks and the open nature of wireless networks, networked control systems have become more vulnerable to cyber-attacks. Cyber-attacks generally aim to alter process inputs and cause them to deviate from their normal operating values. One form of such attacks is the falsification of sensor measurements sent to the feedback controller, resulting in incorrect signals to the control actuators, or manipulating stored process data [5]. If left unchecked, these cyber-security risks can potentially lead to injury, death or physical damage, and are therefore a critical problem to address.

An approach to mitigate the risk of sensor measurement falsification cyber-attacks in networked control systems has been proposed in an earlier study [6]. In that study, a model-based networked control structure that enforces closed-loop stability was developed wherein a set of predictive models were embedded within the local control systems. Utilizing local state measurements local control actions were generated when communication between the sensor and network was suspended, and the model states were eventually updated when communication was re-established, at discrete times. In doing this, a minimum communication rate that guarantees closed-loop stability was established. To mitigate the effect of a cyber-attack, an assessment of the robustness of the networked control system to the cyber-attack was performed by modeling the cyber-attack in the closed-loop system formulation thus making it possible to explicitly characterize the stability of the closed-loop system in terms of the measurement error resulting from the cyber-attack as well as the communication rate and the controller design parameters. Using this characterization, the range of feasible operating conditions within which robust stability is guaranteed under cyber-attacks can be obtained. This characterization also reveals the parameters that play a critical role in the mitigation of the cyber-attack.

While the results of this study are promising in that they confirm the feasibility of the proposed cyber-attack mitigation strategy, the study does not provide a mechanism by which these cyber-attacks can be detected. Furthermore, in order to characterize the stability region, knowledge of the magnitude of the sensor measurement error is required, thus the magnitude of the cyber-attack must be identified before the proposed mitigation strategy can be implemented.

Motivated by these considerations, the objective of this contribution is to integrate a data-based method for the detection of a cyber-attack and the identification of the size of the attack in order to determine the magnitude of the sensor measurement error. To this end we utilize machine learning methods (e.g., [7], [8]) to build a neural network (NN) based detection system. To achieve our objective of detecting both the occurrence and the magnitude of the cyber-attack, the NN training data set is constructed with data for the system under normal operation and the system under different cyber-attack magnitudes, all subject to process disturbances. While this NN is utilized as a classification tool, training the NN with different cyber-attack magnitudes allows for the classification of both the existence of a cyber-attack and the approximate magnitude of this attack. The choice of the range and resolution of the training data set under different cyber-attack magnitudes affects the accuracy of the classification of the size of the cyber-attack. The NN is trained off-line and then used on-line to identify the occurrence and magnitude of the cyber-attack. The implementation and efficacy of the integrated cyber-attack identification and mitigation strategies are demonstrated using a chemical process example.

References:

[1] Hespanha JP, Naghshtabrizi P, Xu Y. A survey of recent results in networked control systems. Proceedings of the IEEE. 2007; 95:138–162.

[2] Sun Y, El-Farra NH. Quasi-decentralized model-based networked control of process systems. Computers & Chemical Engineering. 2008; 32(9):2016–2029.

[3] Sun Y, El-Farra NH. Resource-aware quasi-decentralized control of networked process systems over wireless sensor networks. Chemical Engineering Science. 2012; 69:93-106.

[4] You KY, Xie LH. Survey of recent progress in networked control systems. Acta Automatica Sinica. 2013; 39:101–117.

[5] Khorrami F, Krishnamurthy P, Karri R. Cybersecurity for control systems: A process-aware perspective. IEEE Design and Test. 2016; 33:75–83.

[6] Zedan A, El-Farra NH. A model-based approach for the analysis and mitigation of cyber-attacks in networked process control systems. In: AIChE Annual Meeting.2019.

[7] Wu Z, Albalawi F, Zhang J, Zhang Z, Durand H, Christofides PD. Detecting and handling cyber-attacks in model predictive control of chemical processes. Mathematics. 2018; 6(10).

[8] Wu Z, Tran A, Rincon D, Christofides PD. Machine-learning-based predictive control of nonlinear processes. Part II: Computational implementation. AIChE Journal. 2019; 65 (11).