False data injection attacks detection method based on super-twisting extended state observer algorithm

Industrial control systems (ICSs) face escalating risks from network-layer cyberattacks. False data injection attacks (FDIAs) undermine operational security by manipulating data transmitted through communication networks, leading the controller to receive compromised state information and subsequently make erroneous decisions. This paper proposes a novel detection framework for FDIAs based on a super-twisting extended state observer (STESO). First, we design a third-order STESO and rigorously prove its finite-time stability through Lyapunov function analysis, enabling rapid and accurate estimation of system states and disturbances. Second, the FDIA detection mechanism is established by constructing a reference model based on disturbance estimate, where deviations between the reference system states and the observed states under steady-state conditions serve as detection indicator. The proposed mechanism effectively avoids false alarms caused by disturbances. In addition, the introduction of the observer reduces the detection system’s reliance on real states, making it more suitable for ICS where state information is often unavailable. Finally, numerical simulations validated the effectiveness of the proposed detection method and insensitivity to disturbances.