Causality Countermeasures for Anomaly Detection in Cyber-Physical Systems

The problem of attack detection in cyber-physical systems is considered in this paper. Transfer-entropy-based causality countermeasures are introduced for both sensor measurements and innovation sequences, which can be evaluated in a data-driven fashion without relying on a model of the underlying dynamic system. The relationships between the countermeasures and the system parameters as well as the noise statistics are investigated, based on which conditions that guarantee the time convergence of the countermeasures are obtained. The effectiveness of the transfer entropy countermeasures in attack detection is evaluated via theoretical analysis, numerical demonstrations, as well as comparative simulations with classical χ2 detectors. Four types of attacks are considered: denial-of-service, replay, innovation-based deception, and data injection attacks. Abnormal behavior of the transfer entropy can be observed after the occurrence of each of these attacks.