# Filtering Approaches for Dealing with Noise in Anomaly Detection

Navid Hashemi1, Eduardo Verdugo German2, Jonatan Pena Ramirez2, and Justin
Ruths1 *This work is supported by the ConTex grant award 2018-56A and 2018-56B
.1These authors are with the Departments of Mechanical and Systems Engineering
at the University of Texas at Dallas, Richardson, Texas, USA navid.hashemi@,
<EMAIL_ADDRESS>authors are with the Department of Electronics and
Telecommunications at the Scientific Research and Advanced Studies Center of
Ensenada, Mexico (CICESE<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

The leading workhorse of anomaly (and attack) detection in the literature has
been residual-based detectors, where the residual is the discrepancy between
the observed output provided by the sensors (inclusive of any tampering along
the way) and the estimated output provided by an observer. These techniques
calculate some statistic of the residual and apply a threshold to determine
whether or not to raise an alarm. To date, these methods have not leveraged
the frequency content of the residual signal in making the detection problem
easier, specifically dealing with the case of (e.g., measurement) noise. Here
we demonstrate some opportunities to combine filtering to enhance the
performance of residual-based detectors. We also demonstrate how filtering can
provide a compelling alternative to residual-based methods when paired with a
robust observer. In this process, we consider the class of attacks that are
stealthy, or undetectable, by such filtered detection methods and the impact
they can have on the system.

##  I INTRODUCTION

In anomaly detection, we seek to differentiate normal behavior from anomalous
behavior - essentially anything that deviates away from the nominal model.
This task is easy if our confidence is high in the nominal model but as
uncertainty rises, distinguishing normal from anomalous becomes more
challenging. From a control theory perspective, one of the most fundamental
sources of uncertainty is measurement noise and in this work we present an
intuitive, but to-date-unexplored, idea of combining traditional model-based
detection schemes with low-pass filtering to reduce the impact of noise on our
ability to detect anomalies in control systems. Beyond demonstrating that this
approach enables better detection, the novelty lies in characterizing this
performance boost analytically, in characterizing how this effects the impact
an attacker can have on the system, and in understanding what new kind of
attacks are possible when filtering is involved.

There is a deep literature from Fault Detection that leverages model-based
detectors to identify the occurrence of faults [1]. More recently these tools
have been reused in identifying the presence of attacks in control systems
[2]-[11]. Attacks, in particular their strategic and exploitative nature,
offer new challenges to both control theory and anomaly detection. While many
research groups have rallied behind the banner of analyzing attacks in control
systems and the challenges they raise, in what follows we describe the main
representative contributions of these groups that relate to characterizing the
tuning and performance of model-based detectors.

While all papers [2]-[11] investigate the use of model-based detectors, and
[2]-[10] consider various types of attacks, it has only been recently that the
impact of these attacks has been evaluated [6]-[10]. Of these [4, 8, 10] use
the reachable set to characterize attack impact and [6, 7, 9] use various
norms of system state or the estimation error covariance [5]. To a large
extent this work on attacker impact has been facilitated by analytic methods
to tune model-based detectors, as provided in [4, 7, 8, 9, 10, 11] and for
work to define various types of worst-case attacks [3], [5]-[10]. In all of
these cases Gaussian noise(s) are assumed on the measurements of the system
(and possibly the system state), except in [11] which tunes a detector for
generalized noise distributions.

While much has been done with model-based detectors, no study has integrated a
low-pass filter to attenuate the effect of the noise on the attacker’s
capabilities to change the system state. The recent work to to tune classical
detectors to desired levels of performance (desired false alarm rate) and to
characterize the attacker’s impact on the system state (given the attacker’s
desire to remain stealthy to classical detectors) positions us well to now add
another layer, i.e., filtering, to the detection scheme. In Section III, we
characterize the improvement gained by adding the filter (in terms of
sensitivity to attacks and reduction in attacker capabilities) traded off with
the new attack definitions that are stealthy to the introduced low-pass chi-
squared detector.

This notion of filtering is not exclusive to retrofit conventional residual-
based detectors, but generalizes in compelling ways to other types of model-
based observers. In particular, in Section IV, we review how the discontinuous
observer, an estimator that uses a sliding mode to yield finite-time
convergence, produces a discontinuous term that can be filtered to produce an
estimate of the disturbance that enters a system [12]. In this case, we
reframe the disturbance estimation problem as a method to approximate the
anomaly (e.g., failure and/or attack), which provides an attractive
alternative to residual-based detectors. In this case the disturbance estimate
not only provides a way to detect the presence of an anomaly, but also find
the form of the anomaly so that advanced mitigation strategies can be employed
- such as using the estimated anomaly as feedback to avoid the estimate to
deviate away from the true state value.

In Section II we introduce the system and our notation as well as the attack
context; in Section V we provide an example that combines and compares both of
these tools.

##  II SYSTEM & CONTEXT

We consider a continuous, linear, time-invariant control system

$\left\\{\begin{aligned} \dot{x}(t)&=Ax(t)+Bu(t),\\\ y(t)&=Cx(t)+\eta(t),\\\
\end{aligned}\right.$ (1)

in which $x(t)\in\mathbb{R}^{n}$ is the system state, $u(t)\in\mathbb{R}^{m}$
is the input, A$\in\mathbb{R}^{n\times n}$ is the system matrix,
$B\in\mathbb{R}^{n\times m}$ is the input matrix, $y\in\mathbb{R}^{p}$ is the
system output, and $\eta(t)\in\mathbb{R}^{p}$ is zero mean Gaussian additive
measurement noise with covariance $R$, i.e., $\eta(t)\sim\mathcal{N}(0,R)$.
The pair $(A,C)$ is detectable and the pair $(A,B)$ is stablizable.

We use the output $y$ and an estimator to produce an estimate of the state,
$\hat{x}(t)$. In this work we consider two different choices of estimators. We
use this estimate for to construct the feedback law,

$u(t)=K\hat{x}(t).$ (2)

The process measurements are potentially corrupted by an attacker, who is able
to read and arbitrarily change the sensor measurements. We model this as an
additive attack $\delta(t)\in\mathbb{R}^{p}$ such that $y(t)$ is changed to
$\bar{y}(t)$,

$\bar{y}(t)=y(t)+\delta(t)=Cx(t)+\eta(t)+\delta(t).$ (3)

###  II-A Attacker Capabilities

In this work we assume that the attacker has access to all system information
including, e.g., dynamics, states, estimator states, and detector parameters.
In particular, the attacker can view (disclosure) and edit (disruption) sensor
measurements.

##  III RESIDUAL-BASED ANOMALY DETECTION

The residual quantifies the difference between what we receive from the
sensor, $\bar{y}(t)$ and what we expect based on an estimator,
$\hat{y}(t)=C\hat{x}(t)$,

$r(t)=\bar{y}(t)-C\hat{x}(t),$ (4)

Anomaly detectors use this quantity to make real-time choices in the state of
the control system they monitor.

To build an estimate of the system state we use a Luenberger observer with
observer gain $L\in\mathbb{R}^{n\times p}$,

$\displaystyle\dot{\hat{x}}(t)=$ $\displaystyle
A\hat{x}(t)+Bu(t)+L(\bar{y}(t)-C\hat{x}(t)).$ (5)

Armed with this estimator, we can express the difference between the state and
expected state as the estimation error $e(t)=x(t)-\hat{x}(t)$, which leads to
the following coupled closed-loop equations,

$\left\\{\begin{aligned} \dot{x}(t)&=\big{(}A+BK\big{)}x(t)-BKe(t),\\\
\dot{e}(t)&=\big{(}A-LC\big{)}e(t)-L\eta(t)-L\delta(t),\\\
r(t)&=Ce(t)+\eta(t)+\delta(t).\end{aligned}\right.$ (6)

The steady state Kalman filter is the standard choice of estimator used when
employing residual based detectors. This allows us to calculate the steady
state covariance of the estimation error from the stochastic dynamics of
$e(t)$ using the following Riccati equation,

$\dot{P}=0=(A-LC)P+P(A-LC)^{\prime}+LRL^{\prime}.$ (7)

Because the detection process is inherently a sampled approach we discretize
(6) with uniform step size $\tau$ such that $\xi(k\tau)=\xi_{k}$,

$\left\\{\begin{aligned} x_{k+1}&=Fx_{k}+Ge_{k},\\\
e_{k+1}&=He_{k}-L_{d}(\eta_{k}+\delta_{k}),\\\
r_{k}&=Ce_{k}+\eta_{k}+\delta_{k}.\end{aligned}\right.$ (8)

Residual-based detection relies on quantifying the distribution of the
residual under nominal operation, i.e., without attacks/anomalies. These
statistics form a one-sided hypothesis test that is either accepted (no
anomalies) or rejected (alarm raised). The discrete covariance of $\eta_{k}$
is $\Sigma_{\eta}=\tau R$ and the discrete covariance of the estimation error
is $\Sigma_{e}=\tau P$. In the absence of attack the distribution of the
residual follows a zero-mean Gaussian distribution with the covariance [13],

$\Sigma_{r}=E[r_{k}r^{\prime}_{k}]=C\Sigma_{e}C^{\prime}+\Sigma_{\eta}.$ (9)

In the following subsections we will review the conventional chi-squared
detector and subsequently extend this detector to enhance its performance.

###  III-A Chi-Squared Detector

The role of the detector is to create a non-negative scalar-valued random
variable from the residual that can be easily compared with a threshold. One
of the most widely used approaches to do this is given by the chi-squared
detector which introduces a distance measure

$z(t)=r^{\prime}(t)\Sigma_{r}^{-1}r(t).$ (10)

Since the residual is normally distributed, the distance measure, as a sum of
squared Gaussian random variables, is chi-squared distributed (with $p$
degrees of freedom, where $p$ is the number of the sensors). By normalizing
the residual covariance, we eliminate system dependence. The detection
procedure for the chi-squared detector is summarized as follows. For given a
threshold $\alpha\in\mathbb{R}_{>0}$ and the distance measure in (10)

$\left\\{\begin{aligned} z(t)\leq\alpha&\quad\longrightarrow\quad\text{no
alarm},\\\
z(t)>\alpha&\quad\longrightarrow\quad\text{alarm}.\end{aligned}\right.$ (11)

Since the chi-squared distribution has $p$ degrees of freedom the distance
measure has mean $E[z(t)]=p$ and covariance $E[z^{2}]=2p$ during nominal (no
anomaly) operation. In the presence of attacks/anomalies the distance measure
will, in general, not fall according to a chi-squared distribution with mean
value $p$ and covariance $2p$. As indicated in (11), the detector is required
to make a decision to raise or not raise an alarm at every time instant.
Therefore, it is impractical to build a sample distribution of “current
behavior” to decide if the distance measure was still distributed in chi-
squared fashion - this would take too long. Instead, the alarms, and more
specifically, the rate of alarms can be used as a metric for how deviated the
system is from nominal behavior.

Here alarm rate is defined as the rate of generation of alarms by the
detector, which empirically is the fraction of time instants in which an alarm
was raised. We expect alarms to be raised regularly, even under normal
operation, because of the infinite support of the measurement noise. We can
predict the false alarm rate $\mathcal{A}$ \- the alarm rate under normal
operation - from the distance measure distribution,
$\textbf{Pr}(z>\alpha)=\mathcal{A}$. More importantly, we can set the false
alarm rate to a desired value $\mathcal{A}^{*}$ by selecting the threshold
$\alpha$ appropriately.

###### Lemma 1

[13]. Consider a stochastic LTI system under normal operation and a chi-
squared detector, with threshold $\alpha\in\mathbb{R}_{>0}$,
$r_{k}\sim\mathcal{N}(0,\Sigma)$. Let
$\alpha=\alpha^{*}:=2P^{-1}(1-\mathcal{A}^{*},\frac{p}{2})$, where
$P^{-1}(\cdot,\cdot)$ denotes the inverse regularized lower incomplete gamma
function, then ${\mathcal{A}}={\mathcal{A}}^{*}$.

If the attacker wants to remain stealthy (undetected) to the detector, the
threshold of the chi-squared detector puts a limit on the distance measure.
It, therefore, limits the capabilities of stealthy attacks to change the
system behavior. We derive worst-case stealthy attacks by assuming a powerful,
knowledgeable attacker that knows the noisy measurement $Cx+\eta$ and also
knows the state estimate $\hat{x}$, the attack can compensate for the terms in
the residual

$\delta_{k}=-\bar{y}_{k}+C\hat{x}_{k}+\Sigma_{r}^{\frac{1}{2}}\bar{\delta}_{k},$
(12)

such that

$z_{k}=\bar{\delta}^{\prime}_{k}\bar{\delta}_{k}.$ (13)

By increasing the norm of $\bar{\delta}_{k}$ the attacker can increase the
impact of the attack up to the point where the attack is identified by the
detector; the “direction” of the vector $\bar{\delta}_{k}$ indicates the
extent to which the attack impacts each sensor.

In zero alarm attacks the attacker takes the perspective that raising no
alarms is the way to avoid detection, essentially keeping the distance measure
below the threshold,

$z_{k}=\bar{\delta}^{\prime}_{k}\bar{\delta}_{k}\leq\alpha,$ (14)

and hence $\|\bar{\delta}_{k}\|\leq\sqrt{\alpha}$.

In hidden attacks, the attacker realizes that under normal operation alarms
are generated at the rate of $\mathcal{A}^{*}$, hence, it is reasonable to
generate an attack sequence that mimics the false alarm rate,

$\textbf{Pr}(z_{k}>\alpha)=\textbf{Pr}\big{(}\|\bar{\delta}_{k}\|>\sqrt{\alpha}\big{)}=\mathcal{A}^{*}.$
(15)

Hidden attacks are inherently more potent than zero-alarm attacks, especially
when keeping in mind that the norm of the attack can be arbitrarily large at
the time instants in which alarms are raised.

For more detail on these attacks and ways in which to evaluate the impact of
these attacks through state deviation or the induced reachable set see [9,
10].

###  III-B Filtered Chi-Squared Detector

In this section we introduce a modification to the chi-squared detector to
leverage apriori knowledge that the noise is typically composed of
substantially higher frequencies than the disturbances or many types of
anomalies. By filtering the residual signal, we aim to reduce the covariance
of the statistic that forms the distance measure so that attacks are more
readily apparent. Exploiting frequency domain information has not been
combined with attack detection and here we introduce the approach and
characterize its performance.

We filter the residual element-wise using a bank of $p$ identical Butterworth
filters (of second order) such that
$\xi_{i}(t)=[\xi_{1i}(t),\xi_{2i}(t)]^{\prime}$ and

$\left\\{\begin{aligned} \dot{\xi}_{i}(t)&=\Phi\xi_{i}(t)+\Psi r_{i}(t),\\\
\rho_{i}(t)&=[1\ 0]\xi_{i}(t)\end{aligned}\right.$ (16)

for $i=1,\dots,p$ and where

$\Phi=\begin{bmatrix}0&1\\\ -\omega_{c}^{2}&-\sqrt{2}\omega_{c}\end{bmatrix},\
\ \Psi=\begin{bmatrix}0\\\ \omega_{c}^{2}\end{bmatrix}.$ (17)

and we use the filtered output $\rho(t)$ to construct a new distance measure.
To characterize the distribution of this distance measure, first characterize
the covariance of $\rho_{i}(t)$.

###### Theorem 1

Given a residual signal $r_{k}\sim\mathcal{N}(0,\Sigma_{r})$ filtered through
the Butterworth filter in (16)-(17) with bandwidth $\omega_{c}$, the discrete-
time filter with sampling rate $\tau$ output $\rho_{k}$ is zero mean Gaussian
with covariance,

$\Sigma_{\rho}=\frac{\tau\omega_{c}}{2\sqrt{2}}\Sigma_{r}.$ (18)

###### Proof:

We first discretize the filter with time step $\tau$

$\left\\{\begin{aligned}
\xi_{k}^{(i)}&=\Phi_{d}\xi^{(i)}_{k}+\Psi_{d}r^{(i)}_{k},\\\
\rho_{k}^{(i)}&=[1\ 0]\xi^{(i)}_{k}\end{aligned}\right.$ (19)

where $\zeta^{(i)}_{k}=\zeta_{i}(k\tau)$ and for small enough $\tau$,
$\Phi_{d}=I+\Phi\tau$ and $\Psi_{d}=\Psi\tau$. To find the covariance of the
filtered residual vector $\rho_{k}$ we collect all filters together,

$\dot{\xi}_{k}=\widetilde{\Phi}\xi_{k}+\widetilde{\Psi}r_{k},$ (20)

with $\widetilde{\Phi}=\Phi_{d}\otimes I_{p}$ and
$\widetilde{\Psi}=\Psi_{d}\otimes I_{p}$ and where
$\xi_{k}\in\mathbb{R}^{2p}$, $\widetilde{\Phi}\in\mathbb{R}^{2p\times 2p}$ and
$\widetilde{\Psi}\in\mathbb{R}^{2p\times p}$. We can define the covariance of
$\xi_{k}$ as $\mathcal{P}=[\mathcal{P}_{i,j}]$, $i=1,\dots,p$ and
$j=1,\dots,p$, where $\mathcal{P}_{i,j}\in\mathbb{R}^{2\times 2}$. This total
covariance is supplied by the discrete-time Riccati equation (in steady
state),

$0=\widetilde{\Phi}\mathcal{P}\widetilde{\Phi}^{\prime}-\mathcal{P}+\widetilde{\Psi}\Sigma_{r}\widetilde{\Psi}^{\prime},$
(21)

and following some algebra manipulation reveals that we can split this into
Riccati equations on each subblock

$\Phi_{d}\mathcal{P}_{i,j}\Phi_{d}^{\prime}-\mathcal{P}_{i,j}+\Psi_{d}[\Sigma_{r}]_{i,j}\Psi_{d}^{\prime}=0.$
(22)

From (22) we see that $\mathcal{P}_{i,j}=\mathcal{P}_{j,i}$ because
$[\Sigma_{r}]_{i,j}=[\Sigma_{r}]_{j,i}$ and in addition based on (21), we know
that $\mathcal{P}_{i,j}=\mathcal{P}_{j,i}^{\prime}$, therefore matrix
$\mathcal{P}_{i,j}$ is a symmetric square matrix. The covariance of $\rho(t)$
can be computed element-wise using the structure of $\Phi_{d}$ and $\Psi_{d}$
leaving,

$\displaystyle[\Sigma_{\rho}]$ ${}_{i,j}=[\mathcal{P}_{i,j}]_{11}$ (23)
$\displaystyle=-\tau\omega_{c}{\tiny\frac{(\tau\omega_{c})^{2}-\sqrt{2}\tau\omega_{c}+2}{(\tau\omega_{c})^{3}-3\sqrt{2}(\tau\omega_{c})^{2}+8\tau\omega_{c}-4\sqrt{2}}}\Sigma_{r}$

If the sampling time is taken small enough the higher order terms vanish
leaving

$[\Sigma_{\rho}]_{i,j}=\frac{\tau\omega_{c}}{2\sqrt{2}}[\Sigma_{r}]_{i,j},$
(24)

which leads directly to (18). ∎

###### Remark 1

Note that $\tau$ is the sampling time of the system, which highlights that the
filtered covariance is expected to be significantly smaller than the
covariance of the original residual. By reducing the covariance of the nominal
behavior using this filtering technique the aim is to make it easier to
distinguish attacks and anomalies (especially those with low frequency
components).

Using this covariance, we can create a new normalized distance measure

$z_{k}=\rho^{\prime}_{k}\Sigma_{\rho}^{-1}\rho_{k}=\frac{2\sqrt{2}}{\tau\omega_{c}}\rho^{\prime}_{k}\Sigma_{r}^{-1}\rho_{k}.$
(25)

Because $\rho_{k}$ is a Gaussian random variable, $z(t)$ is also chi-squared.
In fact, because of the normalization by the covariance, this functions
exactly like the conventional chi-squared detector (including using Lemma 1 to
select the threshold). The major difference lies in the scale of the
normalizing covariance; here being smaller provides an advantage to identify
smaller attacks. To execute these attacks, attackers will also need to know
the cut-off frequency of the filter. Analogous to (12), we define

$\delta_{k}=-y_{k}+C\hat{x}_{k}+\left(\frac{\tau\omega_{c}}{2\sqrt{2}}\Sigma_{r}\right)^{\frac{1}{2}}\
\bar{\delta}_{k},$ (26)

where $\bar{\delta}_{k}$ is an independent random variable that attackers may
select to define different classes of stealthy attacks.

As before the zero alarm attack is generated in a way so that no alarm is
generated by the detector. The precise characterization of the sequence
$\bar{\delta}_{k}$ is a topic for future work, however, intuitively the fact
that the attack signal is also filtered by the low-pass filter, it follows
that the frequency content (as quantified by a Fourier Transform) and not just
the amplitude (norm) of the attack vector plays a role in quantifying zero
alarm attacks. To start, note that zero alarm attacks of the conventional chi-
squared detector will also be zero alarm attacks of the filtered chi-squared
detector. On top of this, there is an opportunity to inject high frequency
content into the attack, which would be attenuated by the action of filter. If
the filtered chi-squared used an ideal low pass filter, it would be possible
to inject any signal that had frequency content higher than the cut-off
frequency of the filter. The second order filter requires some adjustment to
balance the small contributions from the stopband frequencies with that of the
passband frequencies.

Similar to the unfiltered case, we employ the zero alarm attack constraint in
a probabilistic fashion for the corresponding hidden attack. In this case
$\bar{\delta}_{k}$ is selected such that the Fourier frequency content is now
bounded in probability. Again the full characterization of these attacks are
for future work.

##  IV DISCONTINUOUS OBSERVER

In this section, we present an anomaly detector for smooth attacks
$\delta(t)$, based on a robust observer and a low pass filter, which is
applicable for a particular class of second order systems, i.e., systems of
the form (1) with $x=[x_{1}\ x_{2}]^{T}$, $A\in\mathbb{R}^{2\times 2}$,
$B\in\mathbb{R}^{2}$, and $C\in\mathbb{R}^{1\times 2}$. Note, however, that
any physical plant that can be partitioned into a collection of second order
systems can be captured by an extended version of the presented methods.

The observer is given by [12]

$\displaystyle\dot{\hat{x}}$ $\displaystyle=A\hat{x}+Bu+\Gamma
e+Bc_{3}\hbox{sign}(\bar{y}-\hat{y}),$ (27) $\displaystyle\hat{y}$
$\displaystyle=C\hat{x},$ (28)

where $\hat{x}=[\hat{x}_{1}\ \hat{x}_{2}]^{T}$, $e=[(\bar{y}-\hat{y})\
(x_{2}-\hat{x}_{2})]^{T}$, $\hat{x}_{i}\in\mathbb{R}$, and the diagonal matrix
$\Gamma=\mbox{diag}(c_{1},c_{2})$, with $c_{1},c_{2}>0$. Finally, the gain
$c_{3}$ of the discontinuous term can be chosen as described in [12].

An interesting feature of this observer is that, by filtering the
discontinuous term, it is possible to identify disturbances/anomalies. This is
shown as follows. First, assume that the measurement is free of noise, i.e.,
$\eta(t)=0$ in (3), and define the observation errors

$e_{1}=\bar{y}-\hat{y},\ \ \ \mbox{and}\ \ \ \ e_{2}=x_{2}-\hat{x}_{2}.$ (29)

Then, by considering the output vector $C=[1\ 0]$, the corresponding
observation error dynamics is described by

$\displaystyle\dot{e}_{1}$ $\displaystyle=e_{2}-c_{1}e_{1}+\dot{\delta},$ (30)
$\displaystyle\dot{e}_{2}$
$\displaystyle=-(a+c_{2})e_{1}-be_{2}-c_{3}\mbox{sign}(e_{1})+a\delta.$ (31)

When the system reaches the discontinuous surface, it follows that
$e_{1}=\dot{e}_{1}=0$. Substituting this into (30) it follows that on the
discontinuous surface, the observation error $e_{2}$ satisfies

$e_{2}=-\dot{\delta},$ (32)

and consequently, it also holds that

$\dot{e}_{2}=-\ddot{\delta}.$ (33)

Next, by using the equivalent control method [14], it follows from (31)-(33)
that, on the discontinuous surface, the filtered version of the discontinuous
term $c_{3}\mbox{sign}(e_{1})$ satisfies

$\mkern 1.5mu\overline{\mkern-1.5muc_{3}\mbox{sign}(e_{1})\mkern-1.5mu}\mkern
1.5mu=\ddot{\delta}+a\delta+b\dot{\delta},$ (34)

where the over bar denotes filtering.

In order to obtain $\mkern
1.5mu\overline{\mkern-1.5muc_{3}\mbox{sign}(e_{1})\mkern-1.5mu}\mkern 1.5mu$,
we use the low-pass Butterworth filter, written in state-space form

$\displaystyle\dot{x}_{f}$
$\displaystyle=A_{f}x_{f}+B_{f}c_{3}\mbox{sign}(e_{1}),$ (35) $\displaystyle
y_{f}$ $\displaystyle=C_{f}x_{f},$ (36)

where $x_{f}=[x_{f1}\ x_{f2}]^{T}$ and

$\displaystyle A_{f}$ $\displaystyle=\left[\begin{array}[]{cc}0&1\\\
-\omega_{c}^{2}&-1.4142\omega_{c}\end{array}\right],\ \
B_{f}=\left[\begin{array}[]{c}0\\\ \omega_{c}^{2}\end{array}\right],$ (41)
$\displaystyle C_{f}$
$\displaystyle=\left[\begin{array}[]{cc}1&0\end{array}\right],$ (43)

where $\omega_{c}$ is the cut-off frequency of the filter. Then, by choosing a
$\omega_{c}$ that minimizes the phase delay, it is possible to assume that

$y_{f}\approx\ddot{\delta}+a\delta+b\dot{\delta}.$ (44)

###  IV-A Anomaly output detector with robust observer and filter

In order to design the anomaly output detector, it is worth nothing that the
output $y_{f}$ of the filter, see (44), can indeed be seen as a residual
because it contains information about the attack/anomaly in the output of the
plant.

Then, similar to (11), we define the following detector

$\left\\{\begin{aligned}
\left|y_{f}(t)\right|\leq\alpha_{f}&\longrightarrow\text{no
alarm}\quad\longrightarrow\quad alarm=0,\\\
\left|y_{f}(t)\right|>\alpha_{f}&\quad\longrightarrow\text{alarm}\quad\longrightarrow\quad
alarm=1.\end{aligned}\right.$ (45)

For the time being, we do not have a formal procedure for determining the
upper threshold $\alpha_{f}$. Instead, the value of $\alpha_{f}$ is
numerically determined by directly measuring the output of the filter, for
sufficiently long time, and then the value of $\alpha_{f}$ will correspond to
the $L_{\infty}$-norm computed from the obtained measurement.

###### Remark 2

Note that for the free-noise case, i.e., $\eta=0$, and considering that the
attack is constant, i.e., $\delta:=\delta_{0}$, with
$\delta_{0}\in\mathbb{R}$, then the output of the filter, see (44), satisfies

$y_{f}\approx a\delta_{0}.$ (46)

Hence, in this case, it is possible to reconstruct the attack. Note that this
fact opens the possibility of using the estimated attack in the control in
order to make the system/plant immune to constant attacks by preventing the
drift of the estimation error. However, it should be noted that in order to
estimate the attack $\delta_{0}$, it is necessary to have knowledge of
parameter $a$, which is a parameter of the plant.

##  V EXAMPLE

This section presents a numerical example, which illustrates the performance
of the detectors presented in Sections III and IV. In particular, we consider
a second order system of the form (1) with

$A=\left[\begin{array}[]{cc}0&1\\\ -4&-20\end{array}\right],\
B=\left[\begin{array}[]{c}0\\\ 1\end{array}\right],\
C=\left[\begin{array}[]{cc}1&0\end{array}\right].$ (47)

Furthermore it is assumed that the output is influenced by zero-mean Gaussian
noise $\eta(t)\sim\mathcal{N}(0,R)$.

###  V-A Residual-Based Methods

We now demonstrate these tools and provide a comparison between the filtered
and unfiltered version of the chi-squared detector. The system matrices are
provided above; here we use a control gain $K=[1,1]$ and an observer gain
$L=[0,2]^{\prime}$. The sampling time is $T=0.001$ and the corresponding
measurement noise covariance is $\Sigma_{\eta}=2$.

The idea behind this comparison is that filtration makes the covariance of the
filtered residual smaller and removes the high frequency content of the
measurement noise, therefore, the attack will be more identifiable when filter
is applied. This ease of detecting the attack is apparent when the alarm rate
corresponding to the filtered detector deviates more significantly from the
desired/tuned false alarm rate, indicating the detector’s sensitivity to the
attack is higher. We consider a simple attack to demonstrate this point,

$\delta(t)=1.$ (48)

Figure 1: This figure shows the performance of the proposed filter-based
detector. Using a threshold of $\alpha=3.84$ both detectors have been tuned to
provide a $\mathcal{A}^{*}=0.05$ (5%) false alarm rate. The green curve plots
the cumulative distribution function of the distance measure under attack when
computed from the filtered residual $\rho_{k}$ and exhibits a dramatic
difference from what the distribution looks like under normal operation (red).
This is quantified by a higher than expected false alarm rate
$\mathcal{A}=0.55$ (55%). In contrast, the blue curve plots the cumulative
distribution function of the distance measure under attack when computed from
the residual without filtering. Not only does the distribution stay quite
similar under attack, but the alarm rate is $7\%$ which is only $2\%$ bigger
than the false alarm rate. Figure 2: The probability density functions, since
they are not normalized, aptly demonstrate the role of shrinking covariance in
the detection problem. The difference between the attacked and nominal
behavior is more dramatic in the filtered residual $\rho_{k}$ (lower panel)
than in the residual $r_{k}$ (upper panel).

Figure 1 shows the cumulative distribution of distance measure calculated from
$r_{k}$ under attack (blue) compared with the cumulative distribution of the
distance measure under no attacks (red). Because the distributions are closely
similar, the conventional chi-squared detector is not able to easily
distinguish the attack. This figure also compares the cumulative distribution
of the distance measure calculated from the filtered residual $\rho_{k}$
(green). In this case the small attack significantly changes the distribution
of the distance measure and detection is easy. This is captured quantitatively
by comparing the false alarm rates. Here the detectors were tuned to provide
$\mathcal{A}^{*}=0.05$ (5%) false alarms (i.e., under no attacks) by selecting
the threshold as $\alpha=3.84$.

Under attack the conventional detector’s alarm rate was 7% whereas the
filtered detector’s alarm rate was 55%, demonstrating the dramatic difference
in sensitivity provided by the additional filtration.

Because the residual and filtered residual are not themselves normalized (as
opposed to the distance measure which is normalized), the role that covariance
plays is quite clear in Fig. 2. Here the reduced covariance of the filtered
residual clearly distinguishes the attack scenario from the normal operation.
This distinction is less obvious in the unfiltered residual.

###  V-B Discontinuous Observer

For the case of the observer-based detector discussed in Section IV, we
consider observer (27)-(28) with $A$, $B$, and $C$ as given in (47) and the
gains $c_{1}=c_{2}=5$, and $c_{3}=12$. For this choice of $c_{i}$,
$i=1,\ldots,3$, the observation error is globally asymptotically stable for
the noise free ($\eta=0$) and attack free ($\delta=0$) case, see [12].
Furthermore, the chosen cut-off frequency $\omega_{c}$ for the low-pass filter
(35)-(43) is $\omega_{c}=12$ [rad/s].

Figure 3: Residual signal for the noise free case. a) Residual for the time
varying attack (49). Black line: measured residual. Gray line: predicted
residual from (44). b) Residual for the constant attack (50). Black line:
measured residual. Gray line: predicted residual from Eq. (46).

Next, the performance of the observed-based detector is evaluated for two
different attacks, namely a time varying attack and a constant attack. The
time varying attack is described by

$\delta(t)=\left\\{\begin{array}[]{ccc}0&\mbox{if}&t\leq 15,\\\
0.1\sin{t}&\mbox{otherwise},&\end{array}\right.$ (49)

whereas the constant attack is given by

$\delta(t)=\left\\{\begin{array}[]{ccc}0&\mbox{if}&t\leq 15,\\\
0.1&\mbox{otherwise}.&\end{array}\right.$ (50)

Figure 3 shows the numerical and theoretical residuals $y_{f}$. Clearly, in
both cases, the measured residual corresponds to the predicted residuals (44)
and (46). The numerical results have been obtained by using Simulink (MATLAB)
and the solver Runge-Kutta with fixed step size of 0.001.

On the other hand, for the case of noisy output, it is assumed that the output
contains zero-mean Gaussian noise $\eta$ with covariance
$\Sigma_{\eta}=0.001$. In this case, by using the empirical procedure
mentioned in Subsection IV-A, it has been obtained that the threshold value of
the detector (45) is $\alpha_{f}=1.55$. It can be shown that if the attacks
(49) and (50) are added to the noisy output, then the detector raises an
alarm, i.e., those attacks can be identified.

##  VI CONCLUSIONS

In this paper we’ve introduced two techniques to exploit the a priori
knowledge that the noise is a high frequency disturbance to make the
attack/anomaly detection task easier. In the first case, we retrofit the
conventional chi-squared detector with a filter to reduce the covariance of
the detector’s distance measure statistic. In the second case, we adopted a
robust observer with a discontinuous term that reveals the presence of an
attack or anomaly in the system. As fault and anomaly detection tools are
poised to bridge to industry, such practical techniques are compelling ways to
boost performance and constrain potential attackers even further.

## References

  * [1] J. Chen and R. J. Patton, _Robust Model-based Fault Diagnosis for Dynamic Systems_. Norwell, MA, USA: Kluwer Academic Publishers, 1999.
  * [2] A. Cárdenas, S. Amin, Z. Lin, Y. Huang, C. Huang, and S. Sastry, “Attacks against process control systems: Risk assessment, detection, and response,” in _Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security_ , 2011, pp. 355–366.
  * [3] Y. Mo, R. Chabukswar, and B. Sinopoli, “Detecting integrity attacks on scada systems,” _IEEE Transactions on Control Systems Technology_ , vol. 22, no. 4, pp. 1396–1407, 2014.
  * [4] Y. Mo and B. Sinopoli, “On the performance degradation of cyber-physical systems under stealthy integrity attacks,” _IEEE Transactions on Automatic Control_ , vol. 61, pp. 2618–2624, 2016.
  * [5] Z. Guo, D. Shi, K. H. Johansson, and L. Shi, “Optimal Linear Cyber-Attack on Remote State Estimation,” _IEEE Transactions on Control of Network Systems_ , vol. PP, no. 99, pp. 1–10, 2016.
  * [6] J. Milošević, D. Umsonst, H. Sandberg, and K. H. Johansson, “Quantifying the impact of cyber-attack strategies for control systems equipped with an anomaly detector,” in _2018 European Control Conference (ECC)_. IEEE, 2018, pp. 331–337.
  * [7] D. Umsonst and H. Sandberg, “Anomaly detector metrics for sensor data attacks in control systems,” in _2018 Annual American Control Conference (ACC)_. IEEE, 2018, pp. 153–158.
  * [8] C. Murguia and J. Ruths, “On reachable sets of hidden cps sensor attacks,” in _2018 Annual American Control Conference (ACC)_. IEEE, 2018, pp. 178–184.
  * [9] R. Tunga, C. Murguia, and J. Ruths, “Tuning windowed chi-squared detectors for sensor attacks,” in _2018 Annual American Control Conference (ACC)_. IEEE, 2018, pp. 1752–1757.
  * [10] N. Hashemi, C. Murguia, and J. Ruths, “A comparison of stealthy sensor attacks on control systems,” in _2018 Annual American Control Conference (ACC)_. IEEE, 2018, pp. 973–979.
  * [11] N. Hashemi and J. Ruths, “Generalized chi-squared detector for lti systems with non-gaussian noise,” in _2019 Annual American Control Conference (ACC)_. IEEE, 2019.
  * [12] D. I. Rosas Almeida, J. Alvarez, and L. Fridman, “Robust observation and identification of ndof lagrangian systems,” _International Journal of Robust and Nonlinear Control_ , vol. 17, no. 9, pp. 842–861. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/rnc.1156
  * [13] C. Murguia and J. Ruths, “Cusum and chi-squared attack detection of compromised sensors,” in _proceedings of the IEEE Multi-Conference on Systems and Control (MSC)_ , 2016.
  * [14] V. I. Utkin, _Sliding Modes in Control and Optimization_. Springer-Verlag Berlin Heidelberg, 1992.