CN107544472A - A kind of optimal switching false data method for implanting - Google Patents

Abstract

The present invention provides an optimal switching false data injection method, the specific process is: injection matrix design: in the case of injecting false data into a limited number of subsystems, consider all possible subsystem injection combinations, and design different injection combinations for different injection combinations matrix; optimal switching strategy: calculate the switching time of the injection matrix online, select different injection matrices at the switching time, and maximize the secondary performance index time through switching; optimal false data injection: construct the most The optimal false data is injected into the corresponding subsystem. The invention improves the flexibility and effectiveness of the false data injection method, and can be used to test the defense effect of the industrial control system for the false data injection.

Description

An Optimal Handoff False Data Injection Method

technical field

The invention relates to the security of an industrial control system and a cyber-physical fusion system, and designs an optimal switching false data injection method for the industrial control system and the cyber-physical fusion system.

Background technique

Industrial control systems are widely used in fields such as electric power, metallurgy, petrochemical, railway and aviation, and are closely connected with national critical infrastructure. Once a major security incident occurs in an industrial control system, it may have a major impact on the reliable and safe operation of the physical system that depends on it, not only causing economic losses, threatening the safety of life and property, but also threatening national security. The industrial control system is already an important part of the national security strategy. Once the industrial control system is maliciously attacked, the losses caused will be incalculable.

The traditional industrial control system is usually based on the factory area, which is relatively isolated and has less communication with the outside world. However, with the popularization and development of Internet technology, especially the rise of Internet of Things technology, under the guidance of the comprehensive automation needs of enterprises, industrial control systems are also developing towards networking. The modern industrial system is no longer an isolated island of information, but has become a typical information-physical fusion system. In recent years, case reports on security issues of industrial control systems are common. For example, in 2010, the "Stuxnet" virus invaded Iran's Bushehr nuclear power plant and attacked Siemens' data collection and monitoring system, forcing Iran's nuclear program to be postponed repeatedly. Countries such as Europe and the United States have listed industrial control security as a national strategy. In recent years, the safety of industrial control systems has also been highly valued by the administrative and scientific research management departments of our country, and has been incorporated into relevant research plans.

Communication networks of industrial control systems are vulnerable to hackers. The intruder breaks through the industrial firewall, accesses the field bus to access the communication network, and uses methods such as eavesdropping, blocking, delaying, tampering, injecting, and replaying the communication messages. Block or maliciously modify the sensor data and control program codes transmitted on the network. When the attacker accesses the controller covertly, he executes the designed malicious program, making the executor malfunction and deteriorating the performance of the controlled object. Studying the false data injection method of the industrial control system can achieve "knowing what you know" and laying a good foundation for better security defense. Studying fake data injection methods requires analyzing the intention and strategy of the injector from the perspective of system theory. Yilin Mo et al. analyzed how to inject false data into some sensors in the literature (Falsedata injection attacks against state estimation in wireless sensor networks, in Proc.49th IEEE Conf. Decision and Control (CDC), 2010, pp.5967-5972.) , to change the estimate of the steady-state Kalman filter and avoid fault detector alarms. The fake data injection problem is described as a constrained optimization problem, and the upper and lower bounds of its reachable region are obtained. Annarita Giani et al. pointed out in the literature (Smart Grid Data Integrity Attacks.IEEE Transaction on Smart Grid.2013:4(3),pp.1244-1253.) that due to geographical restrictions, injecting false data into a large number of power measuring instruments at the same time is impossible. And a method for all undetectable injections under two situations of injecting into two power meters and injecting into an arbitrary power meter is proposed. In the literature (Sparse Malicious False Data Injection Attacks and Defense Mechanisms in Smart Grids. IEEETransactions on Industrial Informatics, 2015:11(5), pp.1198-1209.), Jinping Hao et al. How to inject sparse fake data into the wide-area measurement and control system of smart grid under the two situations of state variables. A search algorithm is proposed to find a set of measurements that are immune to fake data injection to protect the system. In the literature (Optimal Data Integrity Attack on Actuators in Cyber-Physical Systems, American Control Conference (ACC), 2016, pp.1160-1164.), Guangyu Wu et al. analyzed how to inject false data into the actuators of the control system, so that the secondary The error index is optimal, and the optimality condition and the special solution of the problem are given. Anibal Sanjab et al. introduced the existence of multiple attackers and a defense The defender's Stackelberg game model, the defender can predict the behavior of the attacker before deciding which measurements to protect, and a distributed learning algorithm is proposed to find the balance point.

In large-scale industrial control systems, sensor and actuator nodes are often distributed in a wider area, and the energy of intruders is often limited, so it is impossible to inject false data to all sensor or actuator nodes at the same time. Therefore, how to optimally select the order of injecting fake data is a problem that needs to be considered.

Contents of the invention

The purpose of the present invention is to provide a method of optimal switching false data injection for a large-scale physical information system including multiple subsystems, which can arbitrarily select the number of subsystems injected each time, and provide a design method and switching principle of the injection matrix , and the design rules of fake data, this method provides testing means for the design of defense methods.

The technical scheme that the present invention solves its technical problem is:

A method for injecting optimal switching false data, the specific process is:

Injection matrix design: In the case of injecting false data into a limited number of subsystems, consider all possible injection combinations of subsystems, and design different injection matrices for different injection combinations;

Optimal switching strategy: Calculate the switching time of the injection matrix online, select a different injection matrix at the switching time, and maximize the secondary performance index time through switching;

Optimal false data injection: Construct optimal false data through state information of all subsystems, and inject optimal false data into corresponding subsystems.

Further, the secondary performance evaluation index of the present invention is:

in, is a finite time interval, the weight matrix S and Q are n×n semi-positive definite weight matrices, the weight matrix R is a m×m positive definite weight matrix, x _c is the state of n fake data injected into the system, and u _a is the injected m dimensional dummy data vector.

Further, the injection matrix design of the present invention: Let the form of the injection matrix be i=1,...,N, is an m-dimensional row vector, j=1,...,n, n is the number of false data injection systems, and r is the number of subsystems capable of injecting false data at the same time within the same period of time; r non-zero row vectors in the injection matrix are arbitrarily set.

Furthermore, the optimal switching strategy of the present invention: solve the optimal switching time through the maximum value principle to maximize the secondary performance index, and obtain the online switching condition of the injection matrix as

in, is a finite time range, x _c (t ₀ ), x _c (t _f ) represent the state of n fake data injected into the system at time t ₀ and t _f respectively, and λ(t _f ) represents the co-state variable at time t _f .

Further, the optimal false data injection of the present invention is:

Among them, u _a is the optimal false data, that is, the injected m-dimensional false data vector, x _c is the state of the false data injected into the system, and P _i is the solution of the algebraic Riccati equation;

Among them, A is an n×n system matrix.

Beneficial effect

First, the optimal false data of the present invention is constructed in the form of state feedback, which is easy to implement, and the switching strategy of the present invention can be calculated online in real time, which is convenient for obtaining the global optimal solution.

Second, the present invention changes the dynamic performance of the control system by tampering with the transmission data containing information such as control and sensing, and is suitable for testing the defense effect of industrial control systems and cyber-physical fusion systems on false data injection, providing a basis for the design of defense methods. means of testing.

Description of drawings

Fig. 1 is the flow chart of optimal switching false data injection method of the present invention;

Figure 2 is a structural diagram of a physical information system and an attacker including 3 subsystems;

Figure 3 is a switching time diagram of three injection combinations;

Figure 4 is a state trajectory diagram after injecting fake data into the system.

detailed description

Embodiments of the invention are described in detail below, examples of which are illustrated in the accompanying drawings. The embodiments described below by referring to the figures are exemplary only for explaining the present invention and should not be construed as limiting the present invention.

Suppose a model of a healthy system is:

The model of fake data injection system is:

Among them, x _c is an n-dimensional column vector, which respectively represent the states of n fake data injected into the system, and u _a is an injected m-dimensional fake data vector. Suppose {A,B _a } is controllable. for a limited time Inside, define the secondary performance evaluation index as:

Among them, A is an n×n system matrix, B _a is an m×m injection matrix, and its structure represents the injection direction. The weight matrices S and Q are positive semi-definite weight matrices of n×n, and the weight matrix R is positive definite weight matrix of m×m.

A kind of optimal switching false data injection method of the present invention, as shown in Figure 1, specific process is:

(1) Injection matrix design:

It is assumed that the injector can monitor the state information of all subsystems online, but due to the limited energy of the injector or the wide distribution of subsystems, the injector cannot inject false data into all subsystems at the same time, and only has the ability to simultaneously inject r Subsystem injection. Then the injected matrix has There are several forms to choose from, and each injection matrix has r non-zero rows. The injection combination of different subsystems will bring different injection effects. In order to achieve the optimal effect, the injector should inject false data into different subsystems at different times to maximize the secondary performance evaluation index.

Define the injection matrix: i=1,...,N, is an m-dimensional row vector, j=1,...,n. The injector can arbitrarily design the values of the non-zero row vectors of the injection matrix to determine different injection matrices.

(2) Optimal switching strategy:

The optimal switching injection problem is solved by the maximum value principle, and the costate equation is obtained:

Equation of state:

and boundary conditions:

λ(t _f )=Sx _c (t _f )

The online switching condition of injection matrix is:

Given x _c (t ₀ ), x _c (t _f ) and λ(t _f ), the initial value of the costate variable λ(t ₀ ) and the switching time can be obtained by solving the two-point boundary value problem.

The invention obtains the optimal state feedback under the infinite time performance evaluation index by solving the algebraic Riccati equation, and determines the optimal switching sequence between different injection matrices by calculating the component sum of co-state variables.

(3) Optimal fake data injection:

Inject optimal fake data into the corresponding subsystem:

When t _f →∞, the co-state variable λ(t)=P _i x _c (t), and P _i is the solution of the algebraic Riccati equation, which satisfies:

Using a suitable combination of Q, R and _Bi , the Riccati equation has a solution, and the optimal false data becomes:

u _a is constructed as a form of state feedback.

Discretize this process, and set the sampling period as T.

Step 1: Initialize i(0) and x _c (0)

λ(0)=P _i(0) x _c (0)

Step 2: Loop calculation:

λ(k)=P _i(k) x _c (k)

The implementation of the present invention will be described in detail below with reference to the accompanying drawings.

Figure 2 is a structural diagram of an injector injecting false data into a physical information system interconnected with three subsystems. The injector injects false data into the dynamic equations of the subsystems, and injects only two subsystems each time. The system parameters are selected as follows:

Initial conditions: x ₀ =[2,2,2] ^T , λ(0)=P ₁ x ₀ =[0.7,0.65,0.65] ^T . The injection matrix is designed as follows:

The solutions to the algebraic Riccati equations corresponding to the three injected matrices are:

Figure 3 is a switching time diagram of three injection combinations.

Figure 4 is a state trajectory diagram after injecting fake data into the system.

It can be seen from the figure that the trajectory of the injected subsystem deviates severely from that of the healthy system, but eventually tends to a steady state. The optimal switching time and the selection of the injection matrix are obtained online, and the performance evaluation index corresponding to the optimal sequence is better than other switching sequences.

What has been described above is only a preferred embodiment of the present invention, and the present invention is not limited to the above-mentioned embodiment, and all local changes, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention should be included in within the protection scope of the present invention.

Claims (5)

1. A method for optimally switching false data injection, characterized in that the specific process is: Injection matrix design: In the case of injecting false data into a limited number of subsystems, consider all possible injection combinations of subsystems, and design different injection matrices for different injection combinations; Optimal switching strategy: Calculate the switching time of the injection matrix online, select a different injection matrix at the switching time, and maximize the secondary performance index time through switching; Optimal false data injection: Construct optimal false data through state information of all subsystems, and inject optimal false data into corresponding subsystems. 2. according to the described optimal switching false data injection method of claim 1, it is characterized in that, described secondary performance evaluation index is: <mrow><mi>max</mi><mi></mi><mi>J</mi><mo>=</mo><mfrac><mn>1</mn><mn>2</mn></mfrac><msubsup><mi>x</mi><mi>c</mi><mi>T</mi></msubsup><mrow><mo>(</mo><msub><mi>t</mi><mi>f</mi></msub><mo>)</mo></mrow><msub><mi>Sx</mi><mi>c</mi></msub><mrow><mo>(</mo><msub><mi>t</mi><mi>f</mi></msub><mo>)</mo></mrow><mo>+</mo><mfrac><mn>1</mn><mn>2</mn></mfrac><msubsup><mo>&amp;Integral;</mo><msub><mi>t</mi><mn>0</mn></msub><msub><mi>t</mi><mi>f</mi></msub></msubsup><mrow><mo>(</mo><msubsup><mi>x</mi><mi>c</mi><mi>T</mi></msubsup><msub><mi>Qx</mi><mi>c</mi></msub><mo>-</mo><msubsup><mi>u</mi><mi>a</mi><mi>T</mi></msubsup><msub><mi>Ru</mi><mi>a</mi></msub><mo>)</mo></mrow><mi>d</mi><mi>t</mi></mrow> in, is a finite time interval, the weight matrix S and Q are n×n semi-positive definite weight matrices, the weight matrix R is a m×m positive definite weight matrix, x _c is the state of n fake data injected into the system, and u _a is the injected m dimensional dummy data vector. 3. according to the described optimum switching false data injection method of claim 2, it is characterized in that, described injection matrix design: let the form of injection matrix be i=1,...,N, is an m-dimensional row vector, j=1,...,n, n is the number of false data injection systems, and r is the number of subsystems capable of injecting false data at the same time within the same period of time; r non-zero row vectors in the injection matrix are arbitrarily set. 4. according to claim 3 described optimal switching false data injection method, it is characterized in that, optimal switching strategy: solve optimal switching moment by maximum value principle and make secondary performance index reach maximum, obtain the online switching condition of injection matrix for <mrow><mi>i</mi><mrow><mo>(</mo><mi>t</mi><mo>)</mo></mrow><mo>=</mo><mi>arg</mi><munder><mrow><mi>m</mi><mi>a</mi><mi>x</mi></mrow><mrow><mi>i</mi><mo>=</mo><mn>1</mn><mo>,</mo><mo>...</mo><mi>N</mi></mrow></munder><mi>&amp;lambda;</mi><mrow><mo>(</mo><mi>t</mi><mo>)</mo></mrow><msub><mi>B</mi><mi>i</mi></msub><msup><mi>R</mi><mrow><mo>-</mo><mn>1</mn></mrow></msup><msubsup><mi>B</mi><mi>i</mi><mi>T</mi></msubsup><mi>&amp;lambda;</mi><msup><mrow><mo>(</mo><mi>t</mi><mo>)</mo></mrow><mi>T</mi></msup></mrow> in, is a finite time range, x _c (t ₀ ), x _c (t _f ) represent the state of n fake data injected into the system at time t ₀ and t _f respectively, and λ(t _f ) represents the co-state variable at time t _f . 5. according to the described optimal switching false data injection method of claim 4, it is characterized in that, optimal false data injection is: <mrow><msub><mi>u</mi><mi>a</mi></msub><mo>=</mo><msup><mi>R</mi><mrow><mo>-</mo><mn>1</mn></mrow></msup><msubsup><mi>B</mi><mi>i</mi><mi>T</mi></msubsup><msub><mi>P</mi><mi>i</mi></msub><msub><mi>x</mi><mi>c</mi></msub></mrow> Among them, u _a is the optimal false data, that is, the injected m-dimensional false data vector, x _c is the state of the false data injected into the system, and P _i is the solution of the algebraic Riccati equation; <mrow><msup><mi>A</mi><mi>T</mi></msup><msub><mi>P</mi><mi>i</mi></msub><mo>+</mo><msub><mi>P</mi><mi>i</mi></msub><msup><mi>A</mi><mi>T</mi></msup><mo>+</mo><msub><mi>P</mi><mi>i</mi></msub><msub><mi>B</mi><mi>i</mi></msub><msup><mi>R</mi><mrow><mo>-</mo><mn>1</mn></mrow></msup><msubsup><mi>B</mi><mi>i</mi><mi>T</mi></msubsup><msub><mi>P</mi><mi>i</mi></msub><mo>+</mo><mi>Q</mi><mo>=</mo><mn>0</mn></mrow> Among them, A is an n×n system matrix.