Data-Driven Detection of Stealthy IA Attacks in Industrial Cyber-Physical Systems via DGM Quantification

Industrial cyber-physical systems face increasing security threats from sophisticated cyber attacks. Traditional anomaly detectors generally require exact system models and noise statistics, which are often unavailable in practical industrial environments. To address this, this paper proposes a data-driven security detection framework based on the quantification of differences in generalized models (DGM). Utilizing only accessible operational data from the control layer, the method employs closed-loop subspace orthogonal projections to construct two detection variables: a static innovation sequence estimator and an extended dynamic Markov matrix estimator. The static estimator identifies fundamental model mismatches caused by standard denial-of-service and essential false data injection attacks. Meanwhile, the dynamic estimator successfully captures the structural distortions induced by advanced stealthy attacks that typically deceive Kullback–Leibler divergence detectors. The proposed methods were validated using a hardware-in-the-loop platform featuring a two degree-of-freedom robot and a DC servo motor. Experimental results confirm that the DGM framework effectively detects multiple types of stealthy integrity and availability (IA) attacks without relying on system parameters or degrading optimal control performance.