Adversarial Regression for Detecting Attacks in Cyber-Physical Systems

1 Introduction

Cyber-physical systems (CPS) form the foundation of much of the critical infrastructure, including the electric power grid, transportation networks, water networks, and nuclear plants, among others. Malicious attacks on CPS can consequently lead to major disruptions, frommajor blackouts to nuclear incidents. Moreover, such attacks are no longer hypothetical, with Stuxnet perhaps the best-known example of an attack targeting physical infrastructure through cyber means. A crucial aspect of the Stuxnet attack-and a feature that is central to most attacks on CPS-is the corruption of sensor readings to either ensure that an attack on the controller code is undetected, or indirectly impact controller behavior. The power of sensor corruption to impact control decisions is particularly alarming: since controllers are commonly making decisions directly as a consequence of readings from critical sensors, for example, increasing or decreasing temperature to ensure it stays within a target (safe) range, tampering with these readings (e.g., temperature) can cause the controller itself to put the system into an unsafe state. With no remediation, as soon as a critical sensor is compromised, the attacker can cause major system failure by directly manipulating sensor measurements in essentially arbitrary ways.

Data-driven anomaly detection techniques have previously been proposed to mitigate against arbitrary manipulations of sensor data, both based on temporal statistics of single-sensor measurements [Ghafouri et al., 2016], as well as by modeling joint measurements to obtain a prediction for each sensor based on measurements of others [Ghafouri et al., 2017]. However, these have been limited in two ways: 1) they generally consider a specific anomaly detection method, such as a Gaussian Process regression, and 2) they do not consider attacks which can arbitrarily modify a collection of sensor measurements.

To address these limitations, we present a general framework for adversarial anomaly detection in the context of integrity attacks on a subset of sensors in CPS. We start with a general anomaly detection framework based on a collection of supervised regression models which predict a measurement for each sensor as a function of readings from other sensors. We instantiate this framework with three regression models: linear regression, neural network, and an ensemble of the two. We then develop an optimization approach for stealthy attacks on linear regression which aim to maximally increase or decrease a reading for a collection of target sensors (for example, those serving as direct inputs into a controller which maintains the system in a safe state), and extend these to consider a neural network detector, and the ensemble of these.

Next, we model robust anomaly detection as a Stackelberg game between the defender who chooses detection thresholds for each sensor to balance false alarms with impact from successful attacks, and the attacker who subsequently deploys a stealthy attack. Finally, we develop a heuristic algorithm to compute a resilient detector in this model. Our experiments show that (a) the stealthy attacks we develop are extremely effective, and (b) our resilient detector significantly reduces the impact of a stealthy attack without appreciably increasing the false alarm rate.

Related Work A number of techniques have been proposed for anomaly detection in CPS, aimed at identifying either faults or attacks. Several of these consider simplified mathematical models of the physical system, rather than using past data of normal behavior to identify anomalies [C´ardenas et al., 2011; Urbina et al., 2016]. A number of others use statistical and machine learning techniques for anomaly detection [Nader et al., 2014; Junejo and Goh, 2016; Ghafouri et al., 2016; 2017], but restrict attention to a specific model, such as Gaussian Process regression [Ghafouri et al., 2017], to a single sensor [Ghafouri et al., 2016], to unsupervised techniques [Nader et al., 2014], or to directly predict attacks based on normal and simulated attack data [Junejo and Goh, 2016]. Ours is the first approach which deals with a general framework for regression-based modeling of sensor readings based on other sensors.

In addition, considerable literature has developed around the general problem of adversarial machine learning, which considers both attacks on machine learning methods and making learning more robust [Lowd and Meek, 2005; Dalvi et al., 2004; Biggio et al., 2014; Li and Vorobeychik, 2014; Vorobeychik and Li, 2014; Li and Vorobeychik, 2018]. However, all focus on inducing mistakes in a single modelalmost universally, a classifier (Grosshans et al. [2013] is a rare exception). In contrast, we study stealthy attacks on sensor readings, where even the critical measurement can be manipulated directly, but where multiple models used for anomaly detection impose strong constraints on which sensor manipulations are feasible. As such, our framework is both conceptually and mathematically quite different from prior research on adversarial learning.

2 Regression-Based Anomaly Detection

Consider a collection of d sensors, with y representing a vector of sensor measurements, where ys is the measurement of a sensor s. In practice, such measurements often feed directly into controllers which govern the state of critical system components. For example, such a controller may maintain a safe temperature level in a nuclear reactor by cooling the reactor when the temperature reading becomes too high, or heating it when it's too low. If an attacker were to take control of the sensor which measures the temperature of the nuclear reactor, they can transmit low sensor readings to the controller, causing it to heat up the reactor to a temperature arbitrarily above a safe level!

A way to significantly reduce the degree of freedom available to the attacker in this scenario is to use anomaly detection to identify suspicious measurements. To this end, we can leverage relationships among measurements from multiple sensors: if we can effectively predict a reading from a sensor based on the measurements of others, many sensors would need to be compromised for a successful attack, and even then the attacker would face complex constraints in avoiding detection: for example, slightly modifying the one sensor may actually cause another sensor to appear anomalous.

We therefore propose the following general framework for anomaly detection in a multi-sensor CPS. For each sensor s, we learn a model fs(y-s) which maps observed readings from sensors other than s to a predicted measurement of s. 1 Learning can be accomplished by collecting a large amount of normal system behavior for all sensors, and training the model for each sensor. At operation time, we can then use these predictions, together with observed measurements, to check for each sensor s whether its measurement is anomalous based on residual rs = |fs(y-s) - ys|, and a threshold τs, where rs ≤ τs is considered normal, while rs > τs is flagged as anomalous. For easy reference, we provide the list of these and other symbols used in the paper in Table 1.

1 Note that it is direct to extend such models to use other features, such as time and control outputs.

In principle, any supervised learning approach can be used to learn the functions fs. We consider three illustrative examples: linear regression, neural network, and an ensemble of the two.

Linear Regression In this case, for each detector s, we let the predictor be a linear regression model defined as fs(y-s) = wT s y-s + bs, where ws and bs are the parameters of the linear regression model.

Neural Network In this case, for each sensor s, we let the predictor fs be a feed-forward neural network model defined by parameters θs, where the prediction fs(y-s; θs) is obtained by performing a forward-propagation.

Ensemble It has been shown in the adversarial learning literature that multiple detectors can improve adversarial robustness [Biggio et al., 2010]. We explore this idea for the ML regression-based detector by considering an ensemble model for the predictor. We consider an ensemble predictor that contains a neural network and a linear regression model. Different methods can be used for combining the results, but we consider a bagging approach where the result is computed as the average of the predictors' outputs.

3 Attacking the Anomaly Detector

We have informally argued above that the anomaly detector makes successful sensor manipulation attacks challenging. For example, the trivial attack on the critical sensors is now substantially constrained. We now study this issue systematically, and develop algorithmic approaches for stealthy attacks on sensors which attempt to optimally skew measured values of target sensors without tripping an anomaly detection alarm. While arbitrary changes to the sensor readings are no longer feasible, our experiments subsequently show that, unfortunately, a baseline anomaly detector is still quite vulnerable. Subsequently, we develop an approach for making it more robust to stealthy attacks.

3.1 Attacker Model

We define the attack model by describing the attacker's capability, knowledge, and objective. Capability: The adversary may compromise and make arbitrary modifications to the readings from up to B sensors. Knowledge: We consider a worst-case scenario where the attacker has complete knowledge of the system and anomaly detectors. Objective: The attacker's objective is to maximize or minimize the observed value for some critical sensor ¯ s among a collection of target sensors Sc. In addition, the attacker's modifications to the sensors it compromises must remain undetected (stealthy) with respect to the anomaly detection model.

Formally, let ˜ y be the sensor measurements observed after the attacker compromises a subset of sensors. We assume that the attacker can compromise at most B sensors; consequently, for the remaining d - B sensors, ˜ ys = ys. Additionally, the attacker cannot modify individual measurements of compromised sensors arbitrarily (for example, constrained by sensor-level anomaly detectors), so that |˜ ys - ys| ≤ ηs; ηs = ∞ is then a special case in which the attacker is not so constrained. The final set of constraints faced by the attacker ensures that the attack is stealthy: that is, it doesn't trigger alerts based on the anomaly detection model described in Section 2. To accomplish this, the attacker must ensure that for any sensor s, |˜ ys - fs(˜ y-s)| ≤ τs, that is, the corrupted measurements must simultaneously appear normal with respect to the detector model described above and observed measurements ˜ ys for all sensors (both attacked, and not). Note that this is a subtle constraint, since corrupted measurements for one sensor may make another appear anomalous.

For a given critical sensor ¯ s, the attacker's goal is to maximize or minimize the corrupted measurement ˜ y¯ s. Here we focus on minimization of observed values of critical sensors; approaches where the goal is to maximize these values are essentially the same. The attacker's optimization problem is then

argmin

¯

s∈Sc

˜

y ˜

where Constraints (1a) capture evasion of the anomaly detector (to ensure that the attack is stealthy), Constraints (1b) limit modifications of individual sensors, if relevant, and Constraint (1c) limits the attacker to attack at most B sensors.

Not surprisingly, the problem faced by the adversary is NPHard.

Proposition 1. The Adversarial Regression Problem is NPHard.

min y¯

s

The proof can be found in the extended version at https://arxiv.org/abs/1804.11022.

Despite the hardness result, we now present algorithmic approaches for solving Problem (1) in the context of linear regression and neural networks, as well as a simple ensemble of these described in Section 2.

3.2 Attacking Linear Regression

First, we replace the non-convex budget constraint using a collection of linear constraints. Define αs as a binary variable indicating whether the sensor s is attacked. Thus, Constraint (1c) can be re-written as ∑mi=1 αi ≤ B. Now, for each sensor s let ˜ ys = ys + δs, where δs represents the modification made by the adversary. Since δs > 0 only if s has been compromised (i.e., αs = 1), we add a constraint δs ≤ Mαs where M is a sufficiently large number.

Next, we rewrite Constraints (1a). In the case of a linear regression model for anomaly detection, Constraints (1a) become |˜ ys - wT s ˜ y-s - bs| ≤ τs. These can be represented using two sets of linear constraints: ˜ ys - wT s ˜ y-s - bs ≤ τs and -˜ ys + wT s ˜ y-s + bs ≤ τs. Finally, Constraints (1b) are similarly linearized as δs ≤ ηs and -δs ≤ ηs.

Putting everything together, we obtain the following mixed-integer linear programming (MILP) problem (actually, a minimum over a finite number of these), which solves problem (1) for the linear regression-based anomaly detector:

3.3 Attacking Neural Network Regression

Due to the non-linear structure of a neural network model, Constraints (1a) now become non-linear and non-convex. To tackle this challenge (1), we propose an iterative algorithm, described in Algorithm 1. The algorithm solves the problem by taking small steps in a direction of increasing objective function. In each iteration, the algorithm linearizes all the neural networks at their operating points, and replaces them with the obtained linearized instances. Then, for each small step, it solves the MILP (2) to obtain an optimal stealthy attack in the region around the operating point. In each iteration, in order to ensure that the obtained solution is feasible, the algorithm tests the solution with respect to the actual neural network-based anomaly detectors. If it is infeasible, the iteration is repeated using a smaller step size. Otherwise, the same process is repeated until a local optimum is found or we reach a desired maximum number of iterations.

The algorithm begins with the initial uncorrupted measurement vector ˜ y = y. For each neural network fs, it obtains a

Algorithm 1 Adversarial Regression for Neural Network

Input: Measurements ˜ y, critical sensors Sc, budget B, algorithm parameters ϵ0, nmax 1: ˜ y0 ← ˜ y, δ¯ s∗ ← 0 2: for all ¯ s ∈ Sc do 3: while number of iterations < nmax and ϵ > ϵmin do // Linearize all neural networks at ˜ y 4: [W, b] ←TAYLORAPPROXIMATION(fs(·), ˜ y) // Solve MILP and check feasibility 5: ϵ ← ϵ0 6: ˜ y′ ←SOLVE MILP(W,b,¯ s, ˜ y,ϵ) 7: for each sensor s do 8: if |˜ y′s - f (s) (˜ y′-s)| > τs then 9: ϵ ← ϵ2 10: go to Line 6 11: end if 12: end for 13: ˜ y ← ˜ y′ 14: δ¯ s ← ˜ y′¯ s 15: end while 16: if δ¯ s∗ < δ¯ s then 17: ¯ s∗ ← ¯ s, δ¯ s∗ ← δ¯ s, ˜ y∗ ← ˜ y 18: end if 19: end for 20: return ˜ y∗

linearized model using a first-order Taylor expansion around the solution estimate ˜ y in the current iteration, which yields a matrix of weights W for the corresponding linear approximation. Given matrix W , we solve the problem by converting it to the MILP (2), with a small modification: we introduce a constraint that enforces that we only make small modifications relative to the approximate solution from the previous iteration. More precisely, we let ϵ ∈ R+ be the parameter representing the maximum step size. Then, we add the constraint |∆| < ϵ to the MILP, where ∆ = y + δ - ˜ y and ˜ y the latest solution.

Let ˜ y′ be the solution obtained by solving the MILP. We check whether this solution is feasible by performing forward-propagation in all the neural networks and checking that no stealth constraint is violated. If a stealth constraint is violated, which means that our linearized model was not a good approximation of the neural network, we discard the candidate solution, reduce the maximum step size parameter ϵ to improve the approximation, and re-solve the MILP. We repeat this process until a feasible solution is found, in which case the same steps are repeated for a new operating point, or until we reach the maximum number of iterations nmax. Finally, we check whether the solution that is found for the current target sensor ¯ s outperforms the solution for the best target sensor found so far. The algorithm terminates after considering all the target sensors and returns the best attack vector found.

3.4 Attacking the Ensemble Model

We can view the ensemble as a single neural network that connects a perceptron (i.e., the linear regression model) with our initial neural network at the output layer. Thus, to solve the adversarial regression problem, we can use the same approach as in the case of neural networks by modifying Algorithm 1 to obtain linear approximation parameters W = 12 (WNN +WLR) and b = 1 2 (bNN + bLR), where WLR and bLR are the parameters of the linear regression model in the ensemble, and WNN and bNN the parameters of the Taylor approximation of the neural network piece of the ensemble.

4 Resilient Detector

Having developed stealthy attacks on the anomaly detection system we described earlier, we now consider the problem of designing robustness into such detectors. Specifically, we allow the defender to tune the thresholds τs to optimize robustness, accounting for stealthy attacks. More precisely, we model the game between the defender and attacker as a Stackelberg game in which defender first commits to a collection of thresholds τs for the anomaly detectors, and the attacker then computes an attack following the model in Section 3. The defender aims to minimize the impact of attacks D(˜ y(τ)), subject to a constraint that the number of false alarms is within γ of that for a baseline ¯ τ, typically set to achieve a target number of false alarms without consideration of attacks. The constraint reflects the common practical consideration that we wish to detect attacks without increasing the number of false alarms far beyond a target tolerance level. We seek a Stackelberg equilibrium of the resulting game, which is captured by the following optimization problem for the defender:

where FA(τ) is the number of false alarms when the threshold vector is τ.

Given thresholds τ , we define the impact of attack on a sensor s as the mean value of problem (1) over a predefined time period T: Ds(˜ y) = ∑Tt=1 (˜ yts - yts ). Similarly, we compute FA(τ) as the total number of false alarms over T time steps: F A(τ ) = ∑s ∑Tt=1 1|yts-fs(yt-s )|>τs .

The key way to reduce the attack impact D(˜ y(τ)) is by decreasing detection threshold. This can effectively force the attacker to launch attacks that follow the behavior of the physical system more closely, limiting the impact of attacks. On the other hand, smaller values of the threshold parameters may result in a higher number of false alarms. Next, we present a novel algorithm for resilient detector threshold selection as defined in Problem (3).

Let τ be initialized based on a target number of false alarms. In each iteration, given threshold values τ computed in the previous iteration, we find the (approximately) optimal stealthy attack ˜ y(τ ), with associated impact D(˜ y(τ)). Let A∗ be the set of critical sensors upon which the attack ˜ y has the largest impact, and let Amin be the set of sensors with the smallest stealthy attack impact. To reduce DA∗(˜ y(τ)), we reduce τ¯ s for each ¯ s ∈ A∗ . Then, to minimize the change in the number of false alarms, we increase the threshold τs for each s ∈ Amin to compensate for the false alarms added by detectors of sensors in A∗ . These steps are repeated until we reach a local optimum. We formalize this in Algorithm 2.

Algorithm 2 Resilient Detector

Initialize: Initial threshold setting ¯ τ, and initial ϵ 1: τ ′ = τ = ¯ τ 2: ˜ y ← ATTACK(τ ) 3: I =∞ 4: while number of iterations < nmax do 5: if maxs∈Sc Ds(˜ y) ≤ I then 6: τ ← τ ′ 7: else 8: ϵ ← ϵ2 9: end if 10: I ← maxs∈Sc Ds(˜ y) 11: A∗ ← argmaxs∈Sc Ds(˜ y) 12: Amin ← argmins∈Sc Ds(˜ y) 13: for all s ∈ A∗ do 14: τ ′s ← τs - ϵ 15: end for 16: ∆FP ←FP(τ ′ ) -FP(τ) 17: for all s ∈ Amin do 18: τ ′s ← FP -1 s (FPs(τs) - 1 |Amin| ∆F P ) 19: end for 20: ˜ y ← ATTACK(τ ′ ) 21: end while 22: return τ

5 Experiments

We evaluate our contributions using a case study of the wellknown Tennessee-Eastman process control system (TE-PCS) First, we design regression-based anomaly detectors for the critical sensors in the system (e.g., pressure of the reactor, level of the product stripper). Then, we consider scenarios where an adversary launches sensor attacks in order to drive the system to an unsafe state. Finally, we evaluate the resilience of the system against such attacks using baseline detectors and the proposed resilient detector.

5.1 Tennessee-Eastman Process Control System

We present a brief description of the Tennessee-Eastman Process Control System (TE-PCS). TE-PCS involves two simultaneous gas-liquid exothermic reactions for producing two liquid products [Downs and Vogel, 1993]. The process has five major units: reactor, condenser, vapor-liquid separator, recycle compressor, and product stripper. The chemical process consists of an irreversible reaction which occurs in the vapor phase inside the reactor. Two non-condensible reactants A and C react in the presence of an inert B to form a non-volatile liquid product D. The feed stream 1 contains A, C, and trace of B; feed stream 2 is pure A; stream 3 is the purge containing vapors of A, B, and C; and stream 4 is the exit for liquid product D.

There are 6 safety constraints that must not be violated (e.g, safety limits for the pressure and temperature of reactor). These safety constraints correspond to 5 critical sensors: pressure, level, and temperature of the reactor, level of the product stripper, and level of the separator. Further, there are several control objectives that should be satisfied, e.g., maintaining process variables at desired values and keeping system state within safe operating conditions. The monitoring and control objectives are obtained using 41 measurement outputs and 12 manipulated variables.

We use the revised Simulink model of TE-PCS [Bathelt et al., 2015]. We consider the implementation of the decentralized control law as proposed by Ricker [1996]. To launch sensor attacks against TE-PCS, we update the Simulink model to obtain an information flow in which the adversary receives all the sensor measurements and control inputs, solves the adversarial regression problem, and then adds the error vector to the actual measurements.

Figure 1 shows how a sensor attack may drive the system to an unsafe state. In this scenario, the pressure of the reactor exceeds 3000 kPa which is beyond the safety limit and can result in reactor explosion.

5.2 Regression-Based Anomaly Detector

To protect the system against sensor attacks, we build a detector for each critical sensor. To train the detectors we run simulations that model the system operation for 72 hours, and collect the sensor measurements and control inputs. Each simulation consists of 7200 time steps and thus, for each simulation scenario, we record 7200×53 datapoints. To make sure that the dataset represents different modes of operation, we repeat the same steps for different initial state values. We consider a total of 20 different initial state values which gives us 20×7200×53 ≈ 7.5 million datapoints.

Linear Regression-Based Detector Using our collected data, we train linear regression models for the critical sensors. We use the current value of the remaining 36 non-critical sensors as well as the 9 non-constant control inputs as features of the model. Figure 2a shows the performance of the linear regression predictor on training and test data. Note that since the data is sequential, the train and test data cannot be randomly sampled and instead, we divide the data in two blocks. Also, to be able to compare the performance of predictors trained for different variables, we compute the MSE for normalized values instead of the actual values.

Neural Network-Based Detector Next, we train the neural network regression models for the critical sensors. Unlike linear regression models, neural networks require several hyperparameters to be selected (e.g., network architecture, activation function, optimization algorithm, regularization technique). We considered neural networks with 2 to 4 hidden layers and 10 to 20 neurons in each layer. All the neurons in the hidden layers use tanh activation functions. We also experimented with ReLU activation functions but tanh performs better. We trained the networks in Tensorflow for 5000 epochs using Adam optimizer with β1 = 0.9, β2 = 0.999, and ϵ = 10-8 , and a learning rate of 0.01. Figure 2a shows the MSE for training and test data, which outperforms the linear regression model. Finally, Figure 2a shows the result for the ensemble model.

5.3 Attacking Anomaly Detection

Figure 2b shows the attack solution for each critical sensor considering different detectors. As it can be seen, the temperature of the reactor is the least critical sensor while the level of the stripper is the most critical. Interestingly, neural network models, as well as ensembles, tend to be more vulnerableoften significantly-then the linear regression-based detectors. This is reminiscent of the observed vulnerability of neural network models to adversarial tampering [Goodfellow et al., 2015], ours is the first observation that neural networks can be more fragile than simple linear models.

5.4 Resilient Detector

We use the resilient detector algorithm to find threshold values that reduce the stealthy attack impact as described in Section 4. We do this in the context of linear regression. Let T ∗ = 1 hour, be the desired value for the expected time between false alarms for all detectors. As a baseline, for each detector s, we set threshold values τs = FP -1 s ( T ∗ d ).

Then, we use Algorithm 2 to change thresholds in order to obtain better resilience. In the first iteration, stripper level is the most critical sensor, and reactor temperature the least critical. Therefore, we decrease the threshold corresponding to stripper level and increase the value of threshold for reactor temperature. We repeat these steps using Algorithm 2 until we obtain results shown in Figure 3. As we can see, we can significantly reduce the impact of the stealthy attack compared to the baseline (Figure 3a) without increasing the total number of false alarms (Figure 3b, where the total number of false alarms is the sum over all sensors).

6 Conclusions

We studied the design of resilient anomaly detection systems in CPS. We considered a scenario where the CPS is monitored by machine learning regression-based anomaly detectors, and an omniscient adversary capable of perturbing the values of a subset of sensors. The adversary's objective is to lead the system to an unsafe state (e.g., raising the pressure of a reactor in a process control system beyond its safety limit) without being detected. We compute an optimal stealthy attack for linear regression, neural network, and a simple ensemble of these. Finally, we present an approach to mitigate the impact of stealthy attacks through resilient configuration of detector thresholds. We demonstrated the effectiveness of our methods using a case study of a process control system.

Acknowledgments

This research was partially supported by the National Science Foundation (CNS-1238956, CNS-1640624, IIS-1649972, OISE-1743772), Air Force Research Laboratory (8750-14-20180), Office of Naval Research (N00014-15-1-2621), Army Research Office (W911NF-16-1-0069), National Institutes of Health (R01HG006844-05), and National Institute of Standards and Technology (70NANB17H266).