Increasing reliance on wireless communication and complexity of cyberattacks have rendered industrial control systems (ICSs) such as process control systems (PCSs) (which are ICSs that operate chemical manufacturing processes) vulnerable to cyberattacks by malicious agents. In the past decade, several highly sophisticated cyberattacks (e.g., Stuxnet virus (2010), German steel mill attack (2014), Ukrainian power grid attack (2015), TRITON (2017)) have demonstrated that information technology (IT) infrastructure-based solutions to handling cyberattacks on control systems are insufficient on their own. An increasing body of research has focused on developing operational technology (OT)-based approaches to enhance the cyberattack resilience of PCSs. Cyberattack resilience here is defined as the ability of a PCS to minimize the impact of a cyberattack and recover from it. Research on cyberattack resilience of PCSs involves approaches that range from designing PCSs that are inherently attack-resilient to developing cyberattack detection, identification and mitigation schemes. Cyberattack detection schemes are OT-based anomaly detection schemes that reveal the presence of a cyberattack on a PCS by monitoring the process operational data for anomalies and are an important component of a cyberattack resilient PCS.
The motivating realization behind the work presented in this dissertation is that the influence of PCS design parameters may be exploited to reveal the presence of an ongoing cyberattack on a PCS. In the chapters that follow, several approaches for cyberattack detection are presented. First, a control screening approach that may be used to incorporate attack detectability within the conventional PCS design considerations is presented. The screening algorithm is based on a characterization of the interdependence between the PCS design parameters, and the ability of the detection scheme to detect the attack (attack detectability). Next, for a certain class of detection schemes monitoring a process, the relationship between the PCS design parameters, the closed-loop stability of the attacked process, and the detectability of certain attacks is rigorously characterized. Based on the characterization, for attack detection, it may be preferred to operate the process under performance degrading ``attack-sensitive'' parameters. To manage a potential tradeoff between attack detection and closed-loop performance, an active detection method utilizing switching between two control modes is developed. Under the active detection method, extended process operation is under a first (nominal) mode, the control parameters (called nominal parameters) for which are selected to meet traditional control design criteria. Under the second (attack-sensitive) mode, the process is operated with attack-sensitive parameters. The process is operated under the attack-sensitive mode intermittently to probe the process for an ongoing attack. Control parameter switching on a process under steady-state operation may induce transient behavior, which may trigger false alarms in the class of detection schemes. For processes with an invertible output matrix, a switching condition is imposed to select control parameter switching instances such that false alarms in the system are minimized.
To eliminate false alarms due to control switching on processes with a non-invertible output matrix, a reachable set-based detection scheme is developed. The reachable set-based cyberattack detection scheme guarantees a zero false alarm rate during transient attack-free process operation by tracking the evolution of the monitoring variable values with respect to their reachable sets of the attack-free process at each time step. Following this, a switching-enabled active detection method that utilizes the reachable set-based detection scheme to enable attack detection with a zero false alarm rate is presented. Furthermore, the control parameter switching instances between the nominal to attack-sensitive modes are randomized, thereby preserving the confidentiality of the detection method. Destabilization of a process for attack detection (as with operation under attack-sensitive mode) may not always be preferred. Two different alternate control modes that may be used to induce perturbations for active attack detection without destabilizing the attacked process are presented. To guarantee attack detection, the alternate control mode selected must induce ``attack-revealing'' perturbations in the process. Reachability analysis is used to present a set-based condition that if satisfied means that the control mode selected induces attack-revealing perturbations. Different models of false data injection attacks are considered. A screening algorithm that may be used to select an attack-revealing control mode for the active detection of attacks is presented. The application of all methods are applied to simulations of different illustrative processes to demonstrate their attack detection capabilities.