Open access peer-reviewed chapter

Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode Observer Approach

By Shamila Nateghi, Yuri Shtessel, Christopher Edwards and Jean-Pierre Barbot

Submitted: May 7th 2019Reviewed: July 18th 2019Published: September 18th 2019

DOI: 10.5772/intechopen.88669

Downloaded: 210

Abstract

A cyber-physical system (CPS) is a tight coupling of computational resources, network communication, and physical processes. They are composed of a set of networked components, including sensors, actuators, control processing units, and communication agents that instrument the physical world to make “smarter.” However, cyber components are also the source of new, unprecedented vulnerabilities to malicious attacks. In order to protect a CPS from attacks, three security levels of protection, detection, and identification are considered. In this chapter, we will discuss the identification level, i.e., secure state estimation and attack reconstruction of CPS with corrupted states and measurements. Considering different attack plans that may assault the states, sensors, or both of them, different online attack reconstruction approaches are discussed. Fixed-gain and adaptive-gain finite-time convergent observation algorithms, specifically sliding mode observers, are applied to online reconstruction of sensor and state attacks. Next, the corrupted measurements and states are to be cleaned up online in order to stop the attack propagation to the CPS via the control signal. The proposed methodologies are applied to an electric power network, whose states and sensors are under attack. Simulation results illustrate the efficacy of the proposed observers.

Keywords

  • cyber-physical systems
  • sensor attack
  • state attack
  • sliding mode observers

1. Introduction

Cyber-physical systems (CPS) are the integration of the cyber-world of computing and communications with the physical world. In many systems, control of a physical plant is integrated with a wireless communication network, for example, transportation networks, electric power networks, integrated biological systems, industrial automation systems, and economic systems [1, 2]. Since CPSs use open computation and communication platform architectures, they are vulnerable to suffering adversarial physical faults or cyber-attacks. Faults and cyber-attacks are referred to as attacks throughout this chapter.

Recent real-world cyber-attacks, including multiple power blackouts in Brazil [3], and the Stuxnet attack [4] in 2010, showed the importance of providing security to CPSs. Identification and modeling process as [5, 6] which are based on data can be seriously affected by corrupted data. As a result, information security techniques [7] may be not sufficient for protecting systems from sophisticated cyber-attacks. It is suggested in [8] that information security mechanisms have to be complemented by specially designed resilient control systems. Controlling CPS with sensors and actuators, who are hijacked/corrupted remotely or physically by the attackers, is a challenge. The use of novel control/observation algorithms is proposed in this chapter for recovering CPS performance online if an attacker penetrates the information security mechanisms.

Cyber security of CPS must provide three main security goals: availability, confidentiality, and integrity [7]. This means that the CPS is to be accessible and usable upon demand, the information has to be kept secret from unauthorized users, and the trustworthiness of data has to be guaranteed. Lack of availability, confidentiality, and integrity yields denial of service, disclosure, and deception, respectively. A specific kind of deception attack called a replay attack has been investigated when the system model is unknown to the attackers but they have access to the all sensors [9, 10]. Replay attacks are carried out by “hijacking” the sensors, recording the readings for a certain time, and repeating such readings while injecting them together with an exogenous signal into the system’s sensors. It is shown that these attacks can be detected by injecting a random signal, unknown to the attacker, into the system. In the case when the system’s dynamic model is known to the attacker, another kind of deception attack, called a cover attack, has been studied in [11], and the proposed algorithm allows cancelling out the effect of this attack on the system dynamics. In systems with unstable modes, false data injection attacks are applied to make some unstable modes unobservable [12]. Denial of service attacks assaults data availability through blocking information flows between different components of the CPS. The attacker can jam the communication channels, modify devices, and prevent them from sending data, violate the routing protocols, etc. [13]. In a stealth attack, the attacker modifies some sensor readings by physically tampering with the individual meters or by getting access to some communication channels [14, 15]. As a result, detecting and isolating of cyber-attacks in CPSs has received immense attention [16]. However, how to ensure the CPS can continue functioning properly if a cyber-attack has happened is another serious problem that should be investigated; therefore, the focus of this chapter is on resilient control of CPS.

In [17], new adaptive control architectures that can foil malicious sensor and actuator attacks are developed without reconstructing the attacks, by means of feedback control only. A sparse recovery algorithm is applied to reconstruct online the cyber-attacks in [18]. Sliding mode control with advantages of quick response and strong robustness is one of the best approaches to control CPS [19, 20, 21, 22]. In [23], a finite-time convergent higher-order sliding mode (HOSM) observer, based on a HOSM differentiator and a sparse recovery algorithm, are used to reconstruct online the cyber-attack in a nonlinear system. Detection and observation of a scalar attack by a sliding mode observer (SMO) has been accomplished for a linearized differential-algebraic model of an electric power network when plant and sensor attacks do not occur simultaneously [24]. Cyber-attacks against phasor measurement unit (PMU) networks are considered in [25], where a risk mitigation technique determines whether a certain PMU should be kept connected to network or removed. In [26] a sliding mode-based observation algorithm is used to reconstruct the attacks asymptotically. This reconstruction is approximate only, since pseudo-inverse techniques are used.

In this chapter, CPSs controlled by a control input subject to sensor attacks and state/plant attacks are considered. The corrupted measurements propagate the attack signals to the CPS through the control signals causing CPS performance degradation. The main challenge that is addressed in the chapter is online exact reconstruction of the sensor and state attacks with an application to an electric power network. The contribution of this chapter is:

  • Novel fixed and adaptive-gain SMO for the linearized/linear CPS under attack are proposed for the online reconstruction of sensor attacks. The time-varying attacks are reconstructed via the proposed SMO that includes a newly designed dynamic filter. Note that the well-known SMO proposed in [27] reconstructs the slow-varying perturbations only.

  • A super twisting SMO is applied to reconstruct the state/plant time-varying attacks of the linearized/linear CPS under attack.

  • For online state/plant attack reconstruction in nonlinear CPS under attack, a higher-order sliding mode disturbance observer [28] is used.

  • An algorithm that use sliding mode differentiation techniques [29] in concert with the finite-time convergent observer for the sparse signal recovery is applied to online reconstruction of time-varying attack in nonlinear CPS under attack when we have limited measurements and more possible sources of attack [30].

2. Motivation example: electric power network under attack

In a real-world power network, only a small group of generator rotor angles and rates is directly measured, and typical attacks aim at injecting disturbance signals that mainly affect the sensorless generators [24].

The small-signal version of the classic structure-preserving power network model is adopted to describe the dynamics of a power network. Consider a connected power network consisting of n1generators g1gn1and n2load buses bn1+1bn1+n2. The interconnection structure of the power network is encoded by a connected susceptance-weighted graph G. The vertices of G are the generators giand the buses bi. The edges of G are the transmission lines bibjand the connections gibiweighted by their susceptance values. The Laplacian associated with the susceptance-weighted graph is the symmetric susceptance matrix LRn1+n2×n1+n2defined by Lθ=Lg,gθLg,lθLl,gθLl,lθ[8].

The CPS that motivates the results presented in this work is the US Western Electricity Coordinating Council (WECC) power system [8] under attack with three generators and six buses, whose electrical schematic is presented in Figure 1. The mathematical model of the power network in Figure 1 under sensor stealth attack and deception attack can be represented as the following descriptor equations that consist of differential and algebraic equations [8]:

Figure 1.

The WECC power system [8].

I000Mg0000δ̇ω̇θ̇=0I0Lg,gθEgLg,lθLl,gθ0Ll,lθδωθx+0BωBθBdx+0PωPθ,y=Cx+DdyE1

where the state vector x=δTωTθTTincludes the vector of rotor angles δR3, the vector of generator speed deviations from synchronicity ωR3, as well as the vector of voltage angles at the buses θR6. The yRpis the measurement vector, dxRm1is the Deception attack corrupting the states, and dyRmm1is the stealth attack vector spoofing the measurements. Note that the states of the plant are under attack even if they are not attacked directly but via propagation.

The measurement corruption attacks through an output control feedback. The matrices Eg,MgR3×3are diagonal whose nonzero entries consist of the damping coefficients and the normalized inertias of the generators, respectively:

Mg=0.1250000.0340000.016,Eg=0.1250000.0680000.048E2

The inputs Pωand Pθare due to known changes in the mechanical input power to the generators and real power demands at the loads. The matrices BR12×m1and DRp×mm1are the attack distribution matrices, and CRp×12is the output gain matrix. The LθR9×9withLg,gθR3×3,Lg,lθR3×6,Ll,gθR6×3,Ll,lθR6×6is giving by

Lθ=0.058000.0580000000.063000.0630000000.059000.0590000.058000.265000.0850.092000.063000.29600.16100.072000.059000.33000.1700.1010000.0850.16100.246000000.09200.17000.262000000.0720.101000.173E3

Note that ωi0 i=1,2,3in a case of the nominal performance of the studied network. Consider the case when the outputs of system, which are the measurement sensors ω1,ω2,ω3, are corrupted by the following stealth attacks.

d1=ω1+2sinπt,d2=ω2+cos0.5πt,d3=ω3+sinπtE4

The system (1) was simulated with and without above attacks. Based on the simulation results shown in Figures 2 and 3, the stealth attack in (4) yields inappropriate degradation of the power network performance.

Figure 2.

Comparing corrupted sensor measurements ( ω 1 , ω 2 , ω 3 under attack) and sensor measurements when there is no attack.

Figure 3.

Comparing corrupted states ( δ 1 , δ 2 , δ 3 under attack) and stats when there is no attack.

This motivates why online reconstruction of the attacks followed by cleanup of the measurements prior to using them in control signal is of prime importance for retaining the performance of the power network (as it will be shown in Section VI where the proposed SMO is applied to achieve this goal). The case study of the power network (1) will be further discussed in details in Section 6.

3. Cyber-physical system dynamics

Consider the following completely observable and asymptotically stable system

ẋ=fx+Bxdty=Cx+DdtE5

where xRnis the state vector, fxRnis a smooth vector field, dtRmdenotes the attack/fault vector which is additive and matched to the control signal, yRpis the measurement vector, pm, CxRpis the output smooth vector field, BxRn×mand DRp×mdenote the attack/fault distribution matrices. For notational convenience, and without affecting generality, the input distribution matrices can be partitioned as

Bx=B1x01,D=02D1E6

where B1xRn×m1,D1Rp×mm1,01Rn×mm1,02Rp×m1where m1m.

Assumption (A1): B1x,D1are of full rank.

The attack/fault vector is partitioned accordingly as

d=dxdywheredxRm1anddyRmm1E7

Therefore, Eq. (5) can be rewritten as

ẋ=fx+B1xdxty=Cx+D1dytE8

where dxt, dytrepresent the state and the sensor attack vectors, respectively. Different attack strategies are shown in Table 1 and discussed in Section 1.

Attack plandxt0dyt0Access to all sensorsNeed to know the system model
Stealth attack
Deception attack
Reply attack
Covert attack
False data injection attack

Table 1.

Cyber-attack strategies.

Since pmm1, the system (8) can be partitioned using a nonsingular transformation MRp×p

y=My¯E9

selected so that

M1D1=0pmm1×mm1D¯1mm1×mm1E10

Taking into account (10), system (8) is reduced to

ẋ=fx+B1xdxty¯1=C1x,y¯2=C2x+D¯1dytE11

where y¯1Rp1with p1=pmm1and y¯2Rp2where p2=mm1. Note that the state attack vector dxtis additive and matched to the control input that is embedded in system Eq. (11) already.

4. Problem formulation

Assumption (A2): Attacks are detectable, i.e., the invariant zeros of Eq. (11) are stable.

The problem is to protect the closed loop system (11) from the sensor attack dyRmm1and state/plant attack dxtRm1by means of designing fixed-gain and adaptive-gain SMOs that allow: (a) reconstructing online the sensor attack dy, the state/plant attack dxt, and the plant states xso that

d̂xtdxt,d̂ytdyt,x̂xE12

as time increases and.

(b) “cleanup” of the plant and sensors so that the dynamics of the CPS under attack (11) approaches,

ẋclean=fx̂+B1x̂dxtd̂xt,yclean=yD1d̂y=Cx̂+D1dytd̂yt.E13

as time increases, to.

Note that Eq. (13) represents the compensated CPS that converges to CPS without attack as time increases.

5. Results: secure state estimation

In this chapter, for the linearized case of the system in Eq. (5), two SMOs for state estimation and attack reconstruction are discussed. Two other SMO strategies for nonlinear system (5) are also proposed and investigated.

5.1 Attack reconstruction in linear system via filtering by adaptive sliding mode observer

Consider the linearized system in Eq. (5) with Cx=Cxand Bx=B

ẋ=Ax+Bdt,y=Cx+DdtE14

5.1.1 System’s transformation

Considering system Eq. (14) and assuming assumption (A1) holds, then as show in [29] there exists a matrix NRnp×nsuch that the square matrix

Tc=NCE15

is nonsingular and the change of coordinates xTcxcreates, without loss of generality, a new state-space representation ABCDwhere

A=TcATc1,B=TcB,C=CTc1=0p×npIp×pE16

After the linear changing of coordinate, the CPS Eq. (14) is rewritten as

ẋ1=A11x1+A12x2+B1dẋ2=A21x1+A22x2+B2dy=x2+DdwhereA=A11A12A21A22,B=B1B2E17

with x1Rnp,x2Rp, B1Rnp×m, B2Rp×m, A11Rnp×np, A12Rnp×p, A21Rp×np,A22Rp×p. It is well known that ACis observable if and only if A11A21is observable [31].

Defining a further change of coordinates x¯1=x1+Lx2where LRnp×pis the design matrix, then the system Eq. (17) can be rewritten as

x¯̇1=A˜11x¯1+A˜12x2+B˜1dẋ2=A˜21x¯1+A˜22x2+B˜2d, y=x2+DdE18

where A˜11=A11+LA21,A˜12=A11L+A12LA21L+LA22, B˜1=B1+LB2, A˜21=A21, A˜22=A22A21L, B˜2=B2. Since A11A21is observable, there exist choices of the matrix Lso that the matrix A˜11=A11+LA21is Hurwitz.

Assumption (A3): The attack dtand its derivative are norm bounded, i.e.,

d<kdand ḋ<ldwhere kd,ld>0and are known.

Since p>m, there exists a nonsingular scaling matrix QRp×psuch that

QD=0pm×mD2E19

where D2Rm×mis nonsingular. Define y¯as the scaling of the measured outputs yaccording to y¯=Qy. Partition the output of the CPS into unpolluted measurements y¯1Rpmand polluted measurements y¯2Rmas

y¯=y¯1y¯2=Q1x2Q2x2+D2d=Qx2+0pm×mD2dE20

Scale state component x2and define x¯2=Qx2. Then Eq. (18) can be rewritten as

x¯̇1=A¯11x¯1+A¯12x¯2+B¯1dx¯̇2=A¯21x¯1+A¯22x¯2+B¯2d, y¯=x¯2+0D2dE21

where A¯11=A˜11, A¯12=A˜12Q1, B¯1=B˜1, A¯21=QA˜21, A¯22=QA˜22Q1, and B¯2=QB˜2. Define x¯2=colx¯21x¯22, where x¯21Rpmand x¯22Rm. Consequently the system in Eq. (21) can be written in partitioned form as

x¯̇=A¯x¯+B¯dy¯1=C¯1x¯, y¯2=C¯2x¯+D2d,x¯=x¯1x¯21x¯22,A¯=A¯11A¯12aA¯12bA¯21aA¯22aA¯22bA¯21bA¯22cA¯22d,B¯=B¯1B¯21B¯22C¯1=0pm×npIpm×pm0pm×m, C¯2=0m×nmIm×mE22

where A¯11is Hurwitz and the virtual measurement y¯1presents the protected measurements and y¯2shows the attacked/corrupted measurements.

5.1.2 Attack observation

A SMO is proposed to reconstruct the attack in order to clean up the measurements and states and to allow the use of clean measurement in the control signal.

Define a (sliding mode) observer for the system Eq. (22) as

z¯̇=A¯z¯+G¯1y¯1z¯21+G¯2y¯2z¯22GnυE23

where z¯=colz¯1z¯21z¯22is conformal with the partition of x¯in Eq. (22). In Eq. (23), υis a nonlinear injection signal that depends on y¯2z¯22and is used to induce a sliding motion in the estimation error space, and

G¯1=A¯12aA¯22aA22s0m×pm,G¯2=A¯12bA¯22bA¯22dA33s,Gn=0np×m0pm×mIm×mE24

are the gain matrices where A¯12aRnp×pm, A¯22aRpm×pm, A¯12bRnp×m, A¯22bRpm×m, A¯22dRm×m, and the matrices A22sRpm×pmand A33sRm×mare user-selected Hurwitz matrices, while A33sis symmetric negative definite. The injection signal υRmis defined as

υ=ρ+ηy¯2z¯22y¯2z¯22,ρ,η>0E25

where scalar gain ρwill be defined in the sequel, and ηis a positive design scalar.

Assumption (A4): Matrix sIAis invertible, where A=A¯B¯D21C¯2G¯1C¯1.

Defining e¯=x¯z¯, then it follows e¯=cole¯1e¯21e¯22where e¯1=x¯1z¯1, e¯21=x¯21z¯21, e¯22=x¯22z¯22. It follows

ey2=y¯2z¯22=e¯22+D2dE26

and by direct substitution from Eqs. (22) and (23) that

e¯̇=A¯1100A¯21aA22s0A¯21bA¯22cA33se¯A¯12bA¯22bA¯22dA33sD2d+B¯1B¯21B¯22d+00ImυE27

The idea is to force a sliding motion on

ey2=y¯2z¯22=0E28

The first main results, based on the SMO with the fixed-gain injection term, is formulated in the following theorem.

Theorem 1: Assuming (A3)–(A4) hold and m0>0satisfies the condition

ϕtm0kd,ϕ=A¯21bA¯22ce¯11A¯22dB¯22D21D2d,e¯11=cole¯1e¯21E29

Then, as soon as the sliding mode is established in finite time in Eq. (27) on the sliding surface Eq. (28) by means of the injection term Eq. (25) with ρ=m0kd+D2ld, the attack dis asymptotically estimated as

d̂=GsυeqwhereGs=CsIA1B,B=0np×m0pm×mIm×m,C=0m×nmD21E30

where υeqis the equivalent injection term [31] and a close approximation and υ¯eqcan be obtained in real time by low-pass filtering of the switching signal Eq. (25) [29]. Replacing υeqby υ¯eqin Eq. (30) gives

d̂¯=Gsυ¯eqE31

Proof of the Theorem 1 is omitted for brevity.

Remark 1: The SMO (31) is a dynamic filter that allows reconstructing the time-varying attack dt. This filter is the main novel feature of the proposed observer.

5.1.3 Adaptive-gain attack observer design

In Eq. (29), it was assumed that the perturbation term φis locally norm-bounded and ρ>0in Eq. (25) is known. In many practical cases, the boundary of attacks is unknown, and the gain of the sliding mode injection term Eq. (25) in the fixed-gain observer in Eq. (23) can be overestimated. The gain overestimation could increase chattering that is difficult to attenuate.

The constant gain ρ>0can be replaced by an adaptive-gain ρtby applying the dual layer nested adaptive sliding mode observation algorithm [32], i.e.,

υ=ρt+ηy¯2z¯22y¯2z¯22E32

A sufficient condition to ensure sliding on ey2=0in finite time is

ρt>A33sey2+ϕ+D2ḋE33

An error signal is defined as

σt=ρt1αυ¯eqtεE34

where the scalars 0<α<1, ε>0. The adaptation dynamics of ρtin Eq. (32) is defined as [32].

ρ̇t=rtsignσtE35

where the time-varying scalar rt>0satisfies an adaptive scheme. It is assumed that rthas the structure

rt=0+tE36

where 0is a fixed positive scalar. The evolution of tis chosen to satisfy an adaptive law [32]:

̇t=γσtifσt>σ00otherwiseE37

where γ>0,σ0>0are design scalars. The second main results are summarized in Theorem 2 as:

Theorem 2: Consider the system in Eq. (27) and

at=A33sey2+ϕ+D2ḋE38

and assume that at<a0,ȧt<a1, where a0and a1are finite but unknown. A SMO is designed as in Eq. (23) with the adaptive injection term in Eqs. (32)(37). If ε>0in (34) is chosen to satisfy

14ε2>σ02+1γqa1α2E39

for any given σ0, q>1, and, 0<α<1, then the injection term (32) exploiting the dual layer adaptive scheme given by Eqs. (35)(37) drives σtto a domain σt<ε/2in finite time and consequently ensures a sliding motion ey=0can be reached in finite time and sustained thereafter. The gains rtand ρtremain bounded. The sensor attack signal dtis reconstructed as in Eq. (30) with the equivalent adaptive injection term υeqor υ¯eq.

Proof of Theorem 2 is based on the results in [32] and is omitted for brevity.

Remark 2: The proposed unit vector injection gain-adaptation algorithm in Eqs. (32)(37) does not require the knowledge of the boundaries kd,ld>0in d<kdand ḋ<ld.

5.2 State estimation and attack reconstruction in linear systems by using super twisting SMO

Consider the completely observable linearized system Eq. (11) with C1x=C1x, C2x=C2x, B1x=B, that is,

ẋ=Ax+B1dxt,y¯1=C1x,y¯2=C2x+D¯1dytE40

where B1Rn×m1, C1Rpmm1×n, C2Rmm1×n.

Assumption (A5): The number of uncorrupted/protected measurements is equal or larger than the number of state/plant attack, i.e., p1=pmm1m1.

The system Eq. (40) is assumed to have an input-output vector relative degree r=r1r2rp1, where relative degree rifor i=1,2,,p1is defined as follows:

C1iAjB1=0forallj<ri1C1iAri1B10E41

Without loss of generality, it is assumed that r1rp1.

5.2.1 Attack observation

Assumption (A6): there exists a full rank matrix.

Ca=C1C1Arα11Cp1Cp1Arαp11E42

where integers 1rαiriare such that rankCaB=rankBand rαiare chosen such that i=1p1rαiis minimal.

The following SMO [33] is used to estimate the states of system Eq. (40):

x̂̇=Ax̂+GlyaCax̂+GnυcyaCax̂E43

where the matrices of appropriate dimensions Gland Gnare to be designed, and υc.is an injection vector

υcyaCax̂=ρPyaCax̂PyaCax̂ifyaCax̂00otherwiseE44

where ρ>0is larger than the upper bound of unknown input dt.

The definition of the symmetric positive definite matrix Pcan be found in [33]. The auxiliary output yais defined by

ya=y1νy1y11νy˜1r11y˜1r11yp1νy˜p1rp11yp1rp11E45

where the constituent signals in Eq. (45) are given from the continuous second-order sliding mode observer as

ẏi1=νyiyi1ẏi2=E1νy˜i2yi2ẏirαi1=Erαi2νy˜irαi1yirαi1E46

for 1ip1, with

y˜i1=yi,y˜ij=νy˜ij1yij1,2jrαi1E47

The scalar function Eiis defined as

Ei=1ify˜ji+1yji+1ε forallji,elseEi=0E48

and the continuous injection term ν.is given by the super twisting algorithm [34]:

νs=ξs+λss12signsξ̇s=βssigns,λs,βs>0E49

Theorem 3: Assuming the assumptions (A5) and (A6) hold for system Eq. (40), then state/plant attacks are reconstructed as follows:

d̂x=CaBTCaB1CaBTCaGnυceqE50

Proof: Defining the state estimation error as e=xx̂and the augmented output estimation error ey=Caxy¯with

ey=e11e1rαi1ep11ep1rαi1T,y=y11y1rαi1yp11yp1rαi1TE51

then it follows that

ė=xx̂̇=Ae+B1dxtGlyaCax̂GnυcyaCax̂E52

By choosing suitable gains λsand βsin the output injections Eq. (49), then.

ya=CaxE53

for all t>T[33]. Then, the error dynamics Eq. (52) is rewritten as

ė=A¯GlCae+B¯1dxtGnυcCaeE54

Since rankCaB¯1=rankB¯1and by assumption the invariant zeros of the triple ABCalie in the left half plane, based on the design methodologies in [35], It follows that e=0is an asymptotically stable equilibrium point of Eq. (52) and dynamics are independent of dxtonce a sliding motion on the sliding manifold s=Cae=0has been attained. During the sliding mode ṡ=s=0, it is

ṡ=Caė=CaA¯GlCae+CaB¯1dxtCaGnυcCae=0E55

as e0; then

CaGnυceqCaB¯1dxtE56

where υceqis the equivalent output error injection required to maintain the system on the sliding manifold. Since CaB¯1is full rank, the attack reconstruction is obtained as (50).

According to (A1), D¯1is full rank; then sensor attacks in Eq. (40) are reconstructed

d̂yt=D¯11y¯2C2x̂E57

5.3 The state and disturbance observer for nonlinear systems using higher-order sliding mode differentiator

Consider the locally stable system Eq. (11) where y¯1and B1xare y¯1=y1y2,,yp1T, B=b1b2bm1Rn×m1, biRn,i=1,,m1are smooth vector fields defined on an open ΩRn. According to (A5), we consider p1=m1here. The following properties introduced by Isidori [36] are assumed for xΩ.

Assumption (A7): The system in Eq. (11) is assumed to have vector relative degree r=r1r2rm1and total relative degree rt=i=1m1ri,rtn, i.e.,

LbjLfkyix=0j=1,,m1,k<ri1,i=1,,m1LbjLfri1yix0foratleastone1jm1E58

Assumption (A8): The following Lie derivative matrix is of full rank.

Lx=Lb1Lfr11y1Lb2Lfr11y1Lbm1Lfr11y1Lb1Lfr21y2Lb2Lfr21y2Lbm1Lfr21y2Lb1Lfrm11ym1Lb2Lfrm1ym1Lbm1Lfrm11ym1E59

Assumption (A9): The distribution Γ=spanb1b2bm1is involutive [36].

The system given by Eq. (11) with the involutive distribution Γand total relative degree rtcan be rewritten as

δ̇i=0100001000000ri×riδi+00Lfriyix+00j=1m1LbjLfri1yixdt,i=1,,m1γ̇=gδγE60

where δ=δ1δ2δm1Tand

δi=δi1δi2δir1=ηi1xηi2xηir1x=yixLfyixLfr11yixRrii=1,,m1,γ=γ1γ2γnr=ηr+1xηr+2xηnxE61

With an involutive distribution Γas defined in (A9), it is always possible to identify the variables ηr+1x,,ηnxwhich satisfy

Lbjηix=0i=r+1,,n,j=1,,m1E62

Assumption (A10): The norm-bounded solution of the internal dynamics γ̇=gδγis assumed to be locally asymptotically stable [29].

If assumption (A9) is satisfied, then it is always possible to find nrfunctions ηr+1x,,ηnxsuch that

Ψx=colη11xη1r1xηm11xηm1rm1xηr+1xηnxRnE63

is a local diffeomorphism in a neighborhood of any point xΩ¯ΩRn, i.e.,

x=Ψ1δγE64

In order to estimate the derivatives δijti=1,,m1,j=1,,riof the output.

yiin finite time, higher-order sliding mode differentiators [28] are used here

ż0i=v0i,v0i=λ0iz0iyitri/ri+1signz0iyit+z1i,ż1i=v1iżri1i=vri1i,vri1i=λri1izri1ivri2i1/2signzri1ivri2i+zrii,żrii=λriisignzriivri1iE65

for i=1,,m1. By construction,

δ̂11=η̂11x=z01,,δ̂11=η̂r11x=zr111,δ̂̇ r11=η̂̇ r11x=zr11δ̂1m1=η̂1m1x=z0m1,,δ̂rm1m1=η̂rm1m1x=zrm11m1,δ̂̇r1m1=η̂̇rm1m1x=zrm11E66

Therefore, the following exact estimates are available in finite time:

δ̂i=δ̂i1δ̂i2δ̂ir1T=η̂i1x̂η̂i2x̂η̂ir1x̂TRrii=1,,m1,δ̂=δ̂1δ̂2δ̂m1TRrtE67

Next, integrate Eq. (60) with δreplaced by δ̂; estimate of internal dynamics is

γ̂̇=gδ̂γ̂E68

and with some initial condition from the stability domain of the internal dynamics, a asymptotic estimate γ̂can be obtained locally

γ̂=γ̂1γ̂2γ̂nr=η̂r+1x̂η̂r+2x̂η̂nx̂E69

Therefore, the asymptotic estimate for the mapping (63) is identified as

Ψx̂=colη̂11x̂η̂1r1x̂η̂m11x̂η̂m1rm1x̂η̂r+1x̂η̂nx̂E70

asymptotic estimate x̂of the state vector xcan be identified via Eqs. (67) and (69)

x̂=Ψ1δ̂γ̂E71

Since the finite-time exact estimates δ̇̂iriof δ̇iri, i=1,,m1are available via the higher-order sliding mode differentiator, and using the estimates δ̂,γ̂for δ,γ, an asymptotic estimate d̂tof disturbance dtin Eq. (11) is identified as [28].

d̂t=L1Ψ1δ̂γ̂δ̇̂1r1δ̇̂2r2δ̇̂m1rm1Lfr1y11Ψ1δ̂γ̂Lfr2y12Ψ1δ̂γ̂Lfrm1y1m1Ψ1δ̂γ̂E72

where LΨ1δ̂γ̂=j=1m1LbjLfri1y1ix. Finally, x̂tand d̂tare obtained.

from Eqs. (71) and (72).

Remark 3: The convergence d̂dcan be achieved only locally and as time increases due to the local asymptotic stability of the norm-bounded solution of the internal dynamics γ̇=gδγ. However convergence will be achieved in finite time if the total relative degree r=nand no internal dynamics exist.

Considering Eq. (11) and D¯1is full rank, sensor attack can be reconstructed as

d̂yt=D¯11y¯2C2x̂E73

5.4 Attack reconstruction in nonlinear system by sparse recovery algorithm

In some applications, there are a limited number of measurements, p, and more sources of attack, m. Previously, we investigated the cases where p>m. Now, consider system (5) with more attacks than measurements, m>p.

Notice that a more general format of (5) is considered here where matrix Dis a function of xas well.

Assumption (A11): Assume that the attack vector dtis sparse, meaning that numerous attacks are possible, but the attacks are not coordinated, and only few nonzero attacks happen at the same time.

5.4.1 Sparse recovering algorithm

The problem of recovering an unknown input signal from measurements is well known, as a left invertibility problem, as seen in several works [30, 37], but this problem was only treated in the case where the number of measurements is equal or greater than the number of unknown inputs. The left invertibility problem in the case of fewer measurements than unknown inputs has no solution or more exactly has an infinity of solutions.

In particular, the objective of exact recovery under sparse assumptions denoted for the sake of simplicity as “sparse recovery” (SR) is to find a concise representation of a signal using a few atoms from some specified (over-complete) dictionary,

ξ=Φs¯+ε0E74

where s¯RNare the unknown inputs with no more than jnonzero entries, ξRMare the measurements, ε0is a measurement noise, and ΦRM×Nis the dictionary where MN.

Definition 1: The Restricted Isometry Property (RIP) condition of j-order with constant ςj01(ςjis as small as possible for computational reasons) of the matrix Φyields

1ςs¯s¯22Φs¯221+ςs¯s¯22E75

for any jsparse of signal s¯. Considering ΦΓas the index set of nonzero elements of s¯, then Eq. (75) is equivalent to [23]:

1ςs¯eigΦΓTΦΓ1+ςs¯E76

where ΦΓis the sub-matrix of Φwith active nodes.

The problem of SR is often cast as an optimization problem that minimizes a cost function constructed by leveraging the observation error term and the sparsity inducing term [37], i.e.,

s¯=argmins¯RN12ξΦs¯22+λΘs¯E77

In Eq. (77) the original sparsity term is the quasi norm s¯0; but as long as the RIP conditions hold, it can be replaced by Θs¯=s¯1is¯i. Note that λ>0in Eq. (77) is the balancing parameter and s¯is the critical point, i.e., the solution of Eq. (74). Typically, for sparse vectors s¯with j-sparsity, where jmust be equal or smaller than M12[37], the solution to the SR problem is unique and coincides with the critical point of Eq. (74) providing that RIP condition for Φwith order 2jis verified. In other words, in order to guarantee the existence of a unique solution to the optimization problem Eq. (74), Φshould satisfy restricted isometry property [37].

Under the sparse assumption of s¯and the fulfillment of the j-RIP condition of the matrix Φ, the estimation algorithm proposed in [37] is

μv̇t=vt+ΦTΦIN×NatΦTξβ ,and s¯̂t=atE78

where vRNis the state vector, s¯̂trepresents the estimate of the sparse signal s¯of (74), and μ>0is a time-constant determined by the physical properties of the implementing system. .β=.βsign.and at=Hλvwhere Hλ.is a continuous soft thresholding function:

Hλv=maxvλ0sgnvE79

where λ>0is chosen with respect to the noise and the minimum absolute value of the nonzero terms.

Under Definition 1, the state vof Eq. (78) converges in finite time to its equilibrium point v, and s¯̂tin Eq.(78) converges in finite time to ŝof Eq. (77).

5.4.2 Attack reconstruction

The measured output under attack yof the system Eq. (5) is fed to the input of the low-pass filter that facilitates filtering out the possible measurement noise

ż=1τz+Cx+DxdtE80

The filter output zRpis available. Then, system Eq. (5) with filter Eq. (80) is rewritten as

ξ̇=ηξ+Ωdtψ=C¯ξE81

where ψRp, and

ξ=zxp+n×1,ηξ=1τIp×p000zx+1τCxfx,C=C1C2Cp+n=Ip×p0p×nE82
Ω=1τDxBx=Ω1Ω2Ωm,ΩiRp+ni=1,,m

If assumption (A2), (A7), and (A9) hold for system Eq. (81), i.e., the relative degree vector of Eq. (81) is r=r1r2rp, the distribution Γ=spanΩ1Ω2Ωmis involutive, and if zero dynamics exist, they are assumed asymptotically stable and may be left alone. Here it is assumed that there are no zero dynamics in system Eq. (81) and it is presented as

ϒ̇i=0100000000000ϒi+00Lfriψiξ+00j=1mLΩjLfri1ψiξdj,ϒi=ϒ1iξϒ2iξϒriiξ=ψiξLfψiξLfri1ψiξE83

for i=1,,p, where ψiξis the ithentry of vector ψξand satisfies

ϒ̇riiξ=Lfriψiξ+j=1mLΩjLfri1ψidj,i=1,,pE84

Then, the following algebraic equation is found from Eq. (84):

Zp=FξdtE85

where ZpRp, FξRp×m, and

Zp=ϒ̇r11ϒ̇rppLfr1ψ1ξLfrpψpξ,Fξ=LΩ1Lfr11ψ1LΩ2Lfr11ψ1LΩαLfr11ψ1LΩ1Lfr21ψ2LΩ2Lfr21ψ2LΩαLfr21ψ2LΩ1Lfrp1ψpLΩ2Lfrm1ψpLΩαLfrp1ψpE86

Finally, filtered system Eq. (5), as it is rewritten in Eq. (85), is in the same form of Eq. (74). Then, sparse recovery algorithm discussed in Section 5.4.1 is applied to Eq. (85) to reconstruct dt.

Remark 4: The derivatives ϒ̇r11,,ϒ̇rppare computed exactly in finite time using higher-order sliding mode differentiators [28] discussed in Eqs. (65) and (66).

6. Case study

Consider the mathematical models (1)(4) of the US Western Electricity Coordinating Council (WECC) power system [8] with three generators and six buses (Figure 1) when the sensors of the generator speed deviations from synchronicity are under stealth attack and plant is under deception attack.

Assumption (A12): The matrix Ll,lθin (3) is nonsingular.

If (A12) holds, then the variable θcan be rewritten as

θ=Ll,lθ1Rl,gθδ+Pθ+BθdE87

Substituting (87) into (1), then it follows that

δ̇ω̇=0Ip×pMg1Lg,gθ+Lg,lθLl,lθ1Ll,gθMg1Egδω+0Pθω+BδBθωdt,y=Cδω+DδDωdtPθω=Mg1PωLg,lθLl,lθ1Pθ,Bθω=Mg1BωLg,lθLl,lθ1BθE88

6.1 Simulation setup

  1. The three sensors of rotor angles, δR3, are assumed protected from attack, but the three sensors of the generator speed deviations from synchronicity, ωR3, are assumed to be attacked.

  2. The B1ω=I3,B1θ=06×3,Dδ=03×6are given, and then Eq. (88) is reduced to

υ̇=φδδω,ω̇=φωδω+Pθω+Mg1dxty1=C1υ,y2=C2ω+D1ωdyt,where C1=C2=I3×3,Dω=012011100210001010E89

Remark 5: D1ωsatisfies RIP condition defined in Eq. (75).

In the first step of attack reconstruction, dxtis estimated by using protected measurements y1and the SMO described in Section 5.2. It is easy to verify that

C¯δ1B¯=0,C¯δ1AB¯0C¯δ2B¯=0,C¯δ2AB¯0C¯δ3B¯=0,C¯δ3AB¯0Ca=C1C1AC2C2AC3C3A=100000000100010000000010001000000001,ya=y1μy1ŷ1y2μy2ŷ2y3μy3ŷ3E90

where C¯δiis the ith row of C¯δ. The states of the system, δ̂,ω̂, and plant attacks d̂xtare reconstructed using Eqs. (43) and (50). Then, ω̂is used in Eq. (89) to find

Dωdyt=y2ω̂E91

There are six sources dy1,,dy6attacking three measurements ω1,ω2,ω3, and at any time, just one out of six attack signals is nonzero. The SR algorithm in Section 5.2 is applied to find d̂yt. The following attacks are considered for simulation.

dx1dx2dx3=1t10.sin0.5t1t1t4+1t8.51t13+1t17.5cost+0.5sin3t,dyt=1t10.0000sint0T.E92

Deception attacks dx1, dx2, and dx3are reconstructed very accurately as shown in Figures 46. The only nonzero sensor attack is detected and accurately estimated by using the SR algorithm as shown in Figure 7. In Figure 8a and 8b, the corrupted system outputs (which are system states in our case) are compared to the “cleaned” outputs that are computed by subtracting the estimated attacks from the corrupted sensors and actuators and to the system outputs when the system is not under attack.

Figure 4.

Plant attack d x 1 compared to estimated d ̂ x 1 .

Figure 5.

Plant attack d x 2 compared to estimated d ̂ x 2 .

Figure 6.

Plant attack d x 3 compared to estimated d ̂ x 3 .

Figure 7.

Sensor attack d y reconstruction.

Figure 8.

(a) Corrupted output y 1 , y 2 , y 3 compared with compensated and without any attack output and (b) corrupted output y 4 , y 5 , y 6 compared with compensated and without any attack output.

7. Conclusion

The critical infrastructures like power grid, water resources, etc. are large interconnected cyber-physical systems whose reliable operation depends critically on their cyber substructure. In this chapter, cyber-physical systems when their sensors and/or states are under attack or experiencing faults are investigated. The sensor and states/plant attacks are reconstructed online by using a fixed-gain and adaptive-gain sliding mode observers. As soon as the attacks are reconstructed, corrupted measurements and states are cleaned from attacks, and the control signal that uses cleaned measurements provides cyber-physical system performance close to the one without attack. The effectiveness of the proposed approach is shown by simulation results of a real electrical power network with sensors under stealth attack and states under deception attacks.

© 2019 The Author(s). Licensee IntechOpen. This chapter is distributed under the terms of the Creative Commons Attribution 3.0 License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

How to cite and reference

Link to this chapter Copy to clipboard

Cite this chapter Copy to clipboard

Shamila Nateghi, Yuri Shtessel, Christopher Edwards and Jean-Pierre Barbot (September 18th 2019). Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode Observer Approach, Control Theory in Engineering, Constantin Volosencu, Ali Saghafinia, Xian Du and Sohom Chakrabarty, IntechOpen, DOI: 10.5772/intechopen.88669. Available from:

chapter statistics

210total chapter downloads

More statistics for editors and authors

Login to your personal dashboard for more detailed statistics on your publications.

Access personal reporting

Related Content

This Book

Next chapter

Nyquist-Like Stability Criteria for Fractional-Order Linear Dynamical Systems

By Jun Zhou

Related Book

First chapter

Microassembly Using Water Drop

By Taksehi Mizuno

We are IntechOpen, the world's leading publisher of Open Access books. Built by scientists, for scientists. Our readership spans scientists, professors, researchers, librarians, and students, as well as business professionals. We share our knowledge and peer-reveiwed research papers with libraries, scientific and engineering societies, and also work with corporate R&D departments and government entities.

More About Us