具有多传感器的CPS系统的攻击检测  

Attack Detection of CPS System with Multi-sensors

作　　者：杨康 王瑞[1,2] 关永[2] 李晓娟[1,2] 施智平[2] Xiaoyu SONG YANG Kang;WANG Rui;GUAN Yong;LI Xiao-Juan;SHI Zhi-Ping(Beijing Key Laboratory of Light Industrial Robots and Safety Verification (College of Information Engineering, Capital Normal University), Beijing 100048, China;National International Science and Technology Cooperation Demonstration Base of Interdisciplinary of Electronic System Reliability and Mathematics (Capital Normal University), Beijing 100048, China)

机构地区：[1]轻型工业机器人与安全验证北京市重点实验室(首都师范大学信息工程学院),北京100048 [2]电子系统可靠性与数理交叉学科国家国际科技合作示范型基地(首都师范大学),北京100048 [3]Portland State University, Portland 97230, OR 97230, USA

出　　处：《软件学报》2019年第7期2018-2032,共15页Journal of Software

基　　金：国家自然科学基金(61877040,61702348,61602325);国家重点研发计划(2017YFB1301100)~~

摘　　要：信息物理系统(cyber-physical systems,简称CPS)是基于环境感知实现计算、通信与物理元素紧密结合的下一代智能系统,广泛应用于安全攸关的系统和工业控制等领域。信息技术与物理世界的相互作用使得CPS容易受到各种恶意攻击,从而破坏其安全性。主要研究存在瞬态故障的CPS中传感器的攻击检测问题。考虑具有多个传感器测量相同物理变量的系统,其中一些传感器可能受到恶意攻击并提供错误的测量。此外,使用抽象传感器模型,每个传感器为控制器提供一个真实值的可能间隔。已有的用于检测传感器被恶意攻击的方法是保守的。当专业攻击者在一段时间内轻微地或不频繁地操纵传感器的输出时,现有方法很难捕获到攻击,如隐身攻击。为了解决这个问题,设计了一种基于融合间隔和历史测量的传感器攻击检测方法。该方法首先为不同的传感器构建不同的故障模型,使用系统动力学方程把历史测量融入到攻击检测方法中,从不同的方面分析传感器的测量。另外,利用历史测量和融合间隔解决了两个传感器的测量相交时是否存在故障的问题。该方法的核心思想是利用传感器之间的成对不一致关系检测和识别攻击。从EV3地面车辆上获得真实的测量数据来验证算法的性能。实验结果表明,所提出的方法优于现有方法,对各种攻击类型都有较好的检测和识别性能,特别是对于隐身攻击,检测率和识别率大约提高了90%以上。sensor model where each sensor provides the controller with an interval of possible values for the true value.Existing methods for detecting sensor malicious attacks are conservative.When a professional attacker manipulates the sensor’s output slightly or infrequently over a period of time,existing methods are difficult to capture attacks,such as stealth attacks.In order to solve this problem,this study designs a sensor attack detection algorithm based on fusion intervals and historical measurements.First,the algorithm constructs different fault models for different sensors,integrates historical measurements into the attack detection method using system dynamics equations,and analyzes sensor measurements from different aspects.In addition,combined with historical measurement and fusion interval,the problem of whether there are faults when the two sensors intersect is solved.The core idea of this method is to detect and identify attack by using pairwise inconsistency between sensors.This study obtains real measurement data from EV3 ground vehicles to verify the performance of the algorithm.The experimental results show that the proposed method is superior to the state-of-the-art algorithm,and has better detection and recognition performance for various attack types.Especially for stealth attacks,the detection rate and recognition rate are increased by more than 90%.

关 键 词：CPS 安全性 瞬态故障 多传感器融合算法 传感器攻击检测和识别 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]