Detection of stealthy false data injection attacks against networked control systems via active data modification

• A Kalman filter-based output tracking control system is presented. • A refined definition is given for stealthy false data injection attacks (SFDIAs). • Additive SFDIAs are designed to destroy system performance without being detected. • Effectiveness of an active data modification scheme to detect SFDIAs is checked. This paper investigates the design and detection problems of stealthy false data injection (FDI) attacks against networked control systems from the different perspectives of an attacker and a defender, respectively. First, a Kalman filter-based output tracking control system is presented, where stealthy FDI attacks are designed for its feedback and forward channels so as to destroy the system performance while bypassing a traditional residual-based detector. Second, to successfully detect such two-channel stealthy attacks, an active data modification scheme is proposed, by which the measurement and control data are amended before transmitting them through communication networks. Theoretical analysis is then carried out for both ideal and practical cases to evaluate the effectiveness of the detection scheme. An interesting finding is that the attacks designed based on a false model obtained from those modified data can remain stealthy. Finally, simulation results are provided to validate the proposed attack design and detection schemes.