An Integrated Statistical Approach to Anomaly Detection in Interconnected Stochastic Cyber‐Physical Systems

ABSTRACT In this paper, we address an anomaly detection problem in interconnected stochastic cyber‐physical systems. We introduce an integrated anomaly detection scheme that combines a modified state partition‐based estimator design with a statistical approach. Our method is tested on several representative anomalies that are typically challenging to detect, including model parameter changes, replay attacks, and intricate types of attacks. These anomalies are shown to be detectable using our proposed scheme. Additionally, the efficacy of our anomaly detection method is demonstrated on a power network system subjected to these representative anomalies. Compared to simpler threshold‐based residual methods, our approach proves to be more capable and reliable in detecting anomalies.