Research on Endogenous Security Defense for Cloud-Edge Collaborative Industrial Control Systems Based on Luenberger Observer

Industrial Control Systems (ICSs) are fundamental to critical infrastructure, yet they face increasing cybersecurity threats, particularly data integrity attacks like replay and data forgery attacks. Traditional IT-centric security measures are often inadequate for the Operational Technology (OT) environment due to stringent real-time and reliability requirements. This paper proposes an endogenous security defense mechanism based on the Luenberger observer and residual analysis. By embedding a mathematical model of the physical process into the control system, this approach enables real-time state estimation and anomaly detection. We model the ICS using a linear state-space representation and design a Luenberger observer to generate a residual signal, which is the difference between the actual sensor measurements and the observer’s predictions. Under normal conditions, this residual is minimal, but it deviates significantly during a replay attack. We formalize the system model, observer design, and attack detection algorithm. The effectiveness of the proposed method is validated through a simulation of an ICS under a replay attack. The results demonstrate that the residual-based approach can detect the attack promptly and effectively, providing a lightweight yet robust solution for enhancing ICS security.