网络控制系统中利用主动丢包的重放攻击检测方法  

Detection method for replay attacks using active packet loss in networked control systems

作　　者：胡健坤 尹逊和[1] 陈丽红[2] HU Jiankun;YIN Xunhe;CHEN Lihong(School of Automation and Intelligence,Beijing Jiaotong University,Beijing 100044,China;Chinese Mechanical Engineering Society,Beijing 100048,China)

机构地区：[1]北京交通大学自动化与智能学院,北京100044 [2]中国机械工程学会,北京100048

出　　处：《北京交通大学学报》2024年第2期134-143,共10页JOURNAL OF BEIJING JIAOTONG UNIVERSITY

基　　金：国家自然科学基金(62176019)。

摘　　要：为实现网络控制系统(Networked Control Systems,NCS)中重放攻击的检测,在现有研究利用物理水印检测重放攻击的启发下,设计了利用主动丢包对重放攻击进行实时检测的方法 .首先,在理论层面上,利用系统输出的残差构建检测函数,并通过受攻击前后检测函数的变化,证明该检测方法的有效性.然后,以一辆四轮汽车为被控对象,比较车辆受攻击前后速度与检测函数的变化.最后,综合考虑车辆对重放攻击的检测结果与速度跟踪结果,确定车辆的最优主动丢包率的范围区间.结果表明:加入主动丢包前,车辆受到重放攻击时,速度会发生剧烈变化而检测函数几乎没有变化;加入主动丢包后,车辆受到重放攻击时,速度剧烈变化的同时检测函数也产生了剧烈的变化;主动丢包率为12%~16%时,系统既能够准确地检测出重放攻击,又能够保证车辆平稳行驶,为后续的重放攻击检测研究提供了参考.To detect replay attacks in Networked Control Systems(NCS),inspired by existing research utilizing physical watermarking,this paper proposes a real-time detection method employing active packet loss.Firstly,at the theoretical level,a detection function is constructed,using system output residuals and demonstrating the effectiveness of the method by observing changes in the detection func-tion pre and post attack.Then,using a four-wheel vehicle as the controlled object,the changes in ve-hicle speed and detection function pre and post attack are compared.Finally,considering both the de-tection results of replay attacks and the vehicle’s speed tracking,the optimal range of active packet loss rates for the vehicle is determined.Results indicate that prior to active packet loss implementa-tion,vehicle speed undergoes significant changes while the detection function remains relatively stable under replay attacks.Conversely,with active packet loss,both vehicle speed and detection function exhibit dramatic changes during replay attacks.Within an active packet loss rate of 12%to 16%,the system accurately detects replay attacks while ensuring smooth vehicle operation,providing valuable insights for future replay attack detection research.

关 键 词：网络控制系统 重放攻击 主动丢包 卡方检测 

分 类 号：TP273[自动化与计算机技术—检测技术与自动化装置]