Control mode switching for guaranteed detection of false data injection attacks on process control systems

Control-enabled cyberattack detection approaches are necessary for enhancing the cybersecurity of process control systems (PCSs), as evidenced by recent successful cyberattacks against these systems. One type of cyberattack is false data injection attacks (FDIAs), which manipulate data over sensor-controller and/or controller–actuator communication links. This work presents an active detection strategy based on control mode switching, where the control parameters and/or the set-point are adjusted to induce perturbations that reveal stealthy FDIAs which would otherwise go undetected. To guarantee attack detection, the perturbations introduced by the detection method must be “attack-revealing”, a concept formally defined using reachability analysis in this work. Building on this foundation and considering a specific class of FDIAs, a screening algorithm is developed for selecting control modes that guarantee attack-revealing perturbations in the presence of an attack. A theoretical result is established, identifying control modes incapable of guaranteeing attack detection for a subset of these attacks—specifically, non-bias adding attacks, which do not cause a steady-state offset. This result simplifies the screening process by reducing the candidate control mode set and ensuring that only effective control modes are considered. The applicability of the screening algorithm is demonstrated for several FDIAs, including: (1) multiplicative attacks, (2) non-bias adding multiplicative attacks, and (3) replay attacks, where historic process data is injected into communication channels. The simulation results on an illustrative process validate the effectiveness of the modified screening algorithm and the active detection method in detecting non-biased additive and multiplicative replay attacks.