**6. Case study**

*<sup>z</sup>*\_ <sup>¼</sup> <sup>1</sup> *τ*

\_

2 4

(

*, η ξ*ð Þ¼ � <sup>1</sup>

� � <sup>¼</sup> *Ip*�*<sup>p</sup>* <sup>0</sup>

*ψ* ¼ *Cξ*

*τ*

rewritten as

where *ψ* ∈ R*p*, and

*Control Theory in Engineering*

*<sup>ξ</sup>* <sup>¼</sup> *<sup>z</sup> x* " #

> 1 *τ D x*ð Þ *B x*ð Þ

010 ⋯ 0 000 ⋯ 0 ⋮⋮⋮⋯⋮ 000 0 0

2 4

Ω ¼

<sup>ϒ</sup>\_ *<sup>i</sup>* <sup>¼</sup>

*Zp* ¼

**20**

ϒ\_ 1 *r*1 ⋮ ϒ\_ *p rp*

Eq. (85) to reconstruct *d t*ð Þ.

ð Þ� *p*þ*n* 1

*C* ¼ *C*<sup>1</sup> *C*<sup>2</sup> … *Cp*þ*<sup>n</sup>*

3

degree vector of Eq. (81) is *r* ¼ *r*1*;r*2*;* …*;rp*

for *i* ¼ 1*,* …*, p*, where *ψi*ð Þ*ξ* is the *i*

ð Þ¼ *<sup>ξ</sup> Lri*

*, F*ð Þ¼ *ξ*

ϒ\_ *i ri*

where *Zp* <sup>∈</sup> <sup>R</sup>*<sup>p</sup>*, *<sup>F</sup>*ð Þ*<sup>ξ</sup>* <sup>∈</sup> <sup>R</sup>*<sup>p</sup>*�*<sup>m</sup>*, and

*Lr*1 *<sup>f</sup> ψ*1ð Þ*ξ* ⋮ *Lrp <sup>f</sup> ψp*ð Þ*ξ*

dynamics in system Eq. (81) and it is presented as

0 0 ⋮ *Lri <sup>f</sup> ψi*ð Þ*ξ*

*<sup>f</sup> <sup>ψ</sup>i*ð Þþ *<sup>ξ</sup>* <sup>X</sup>*<sup>m</sup>*

Then, the following algebraic equation is found from Eq. (84):

*j*¼1 *L*<sup>Ω</sup>*<sup>j</sup> Lri*�<sup>1</sup>

*L*<sup>Ω</sup>1*L<sup>r</sup>*1�<sup>1</sup>

*L*<sup>Ω</sup>1*L<sup>r</sup>*2�<sup>1</sup>

*<sup>L</sup>*<sup>Ω</sup>1*Lrp*�<sup>1</sup>

Finally, filtered system Eq. (5), as it is rewritten in Eq. (85), is in the same form of Eq. (74). Then, sparse recovery algorithm discussed in Section 5.4.1 is applied to

*<sup>f</sup> <sup>ψ</sup>*<sup>1</sup> *<sup>L</sup>*<sup>Ω</sup>2*L<sup>r</sup>*1�<sup>1</sup>

*<sup>f</sup> <sup>ψ</sup>*<sup>2</sup> *<sup>L</sup>*<sup>Ω</sup>2*L<sup>r</sup>*2�<sup>1</sup>

*<sup>f</sup> <sup>ψ</sup><sup>p</sup> <sup>L</sup>*<sup>Ω</sup>2*Lrm*�<sup>1</sup>

The filter output *z*∈ R*<sup>p</sup>* is available. Then, system Eq. (5) with filter Eq. (80) is

*ξ* ¼ *η ξ*ð Þþ Ω*d t*ð Þ

*Ip*�*<sup>p</sup>* 0 0 0 3 5 *z x* " #

*p*�*n* h i

<sup>5</sup> <sup>¼</sup> ½ � <sup>Ω</sup><sup>1</sup> <sup>Ω</sup><sup>2</sup> … <sup>Ω</sup>*<sup>m</sup> ,* <sup>Ω</sup>*<sup>i</sup>* <sup>∈</sup> <sup>R</sup>*<sup>p</sup>*þ*<sup>n</sup>* <sup>∀</sup>*<sup>i</sup>* <sup>¼</sup> <sup>1</sup>*,* …*, m*

� �, the distribution

0 0 ⋮

*,* ϒ*<sup>i</sup>* ¼

*th* entry of vector *ψ ξ*ð Þ and satisfies

*Zp* ¼ *F*ð Þ*ξ d t*ð Þ (85)

*<sup>f</sup> <sup>ψ</sup>*<sup>1</sup> <sup>⋯</sup> *<sup>L</sup>*<sup>Ω</sup>*αLr*1�<sup>1</sup>

*<sup>f</sup> <sup>ψ</sup>*<sup>2</sup> *<sup>L</sup>*<sup>Ω</sup>*αL<sup>r</sup>*2�<sup>1</sup>

*<sup>f</sup> <sup>ψ</sup><sup>p</sup>* <sup>⋯</sup> *<sup>L</sup>*<sup>Ω</sup>*αLrp*�<sup>1</sup>

⋮ ⋮

*<sup>f</sup> ψ*<sup>1</sup>

(86)

*<sup>f</sup> ψ*<sup>2</sup>

*<sup>f</sup> ψ<sup>p</sup>*

ϒ*i* <sup>1</sup>ð Þ*ξ* ϒ*i* <sup>2</sup>ð Þ*ξ* ⋮ ϒ*i ri* ð Þ*ξ*

*<sup>f</sup> ψidj, i* ¼ 1*,* …*, p* (84)

*ψi*ð Þ*ξ Lf ψi*ð Þ*ξ*

(83)

*Lri*�<sup>1</sup> *<sup>f</sup> ψi*ð Þ*ξ*

If assumption (A2), (A7), and (A9) hold for system Eq. (81), i.e., the relative

Γ ¼ *span*f g Ω1*;* Ω2*;* …*;* Ω*<sup>m</sup>* is involutive, and if zero dynamics exist, they are assumed asymptotically stable and may be left alone. Here it is assumed that there are no zero

> X*m j*¼1 *L*<sup>Ω</sup>*<sup>j</sup> Lri*�<sup>1</sup> *<sup>f</sup> ψi*ð Þ*ξ dj*

þ

1 *τ C x*ð Þ

2 4

*f x*ð Þ

3 5*,*

ð Þ �*z* þ *C x*ð Þþ *D x*ð Þ*d t*ð Þ (80)

(81)

(82)

Consider the mathematical models (1)–(4) of the US Western Electricity Coordinating Council (WECC) power system [8] with three generators and six buses (**Figure 1**) when the sensors of the generator speed deviations from synchronicity are under stealth attack and plant is under deception attack.

**Assumption (A12):** The matrix *L<sup>θ</sup> l,l* in (3) is nonsingular.

If (A12) holds, then the variable *θ* can be rewritten as

$$\theta = \left(L\_{l,l}^{\theta}\right)^{-1} \left(-R\_{l,\mathbf{g}}^{\theta}\delta + P\_{\theta} + B\_{\theta}d\right) \tag{87}$$

Substituting (87) into (1), then it follows that

$$
\begin{bmatrix} \dot{\delta} \\ \dot{\alpha} \end{bmatrix} = \begin{bmatrix} 0 & I\_{p \times p} \\ M\_{\mathcal{E}}^{-1} \left( -L\_{\mathcal{E}\mathcal{E}}^{\theta} + L\_{\mathcal{E},l}^{\theta} \left( L\_{l,l}^{\theta} \right)^{-1} L\_{l,\mathcal{E}}^{\theta} \right) & -M\_{\mathcal{E}}^{-1} E\_{\mathcal{E}} \\ M\_{\mathcal{E}}^{-1} \left( -L\_{\mathcal{E}}^{\theta} - L\_{\mathcal{E},l}^{\theta} \left( L\_{l,l}^{\theta} \right)^{-1} P\_{\theta} \right) & B\_{\theta \alpha} = M\_{\mathcal{E}}^{-1} \left( B\_{\alpha} - L\_{\mathcal{E},l}^{\theta} \left( L\_{l,l}^{\theta} \right)^{-1} B\_{\theta} \right) \end{bmatrix} \tag{88}
$$

$$
\dot{P}\_{\theta \nu} = M\_{\mathcal{E}}^{-1} \left( P\_{\alpha} - L\_{\mathcal{E},l}^{\theta} \left( L\_{l,l}^{\theta} \right)^{-1} P\_{\theta} \right), \quad B\_{\theta \nu} = M\_{\mathcal{E}}^{-1} \left( B\_{\alpha} - L\_{\mathcal{E},l}^{\theta} \left( L\_{l,l}^{\theta} \right)^{-1} B\_{\theta} \right) \tag{89}
$$

#### **6.1 Simulation setup**

a. The three sensors of rotor angles, *δ*∈ R<sup>3</sup> , are assumed protected from attack, but the three sensors of the generator speed deviations from synchronicity, *ω* ∈ R<sup>3</sup> , are assumed to be attacked.

b. The *B*1*<sup>ω</sup>* ¼ *I*3*, B*1*<sup>θ</sup>* ¼ 06�<sup>3</sup>*, D<sup>δ</sup>* ¼ 03�<sup>6</sup> are given, and then Eq. (88) is reduced to

$$\begin{cases} \dot{\nu} = \rho\_{\delta}(\delta, \omega), \\ \dot{\omega} = \rho\_{\omega}(\delta, \omega) + P\_{\theta \nu} + M\_{\xi}^{-1} d\_{x}(t) \\ \quad y\_{1} = C\_{1} \nu, \quad y\_{2} = C\_{2} \nu + D\_{\text{la}} d\_{\text{\textquotedblleft}}(t) \end{cases}, \\ \text{where } C\_{1} = C\_{2} = I\_{3 \times 3}, D\_{\text{\textquotedblleft}} = \begin{bmatrix} 0 & 1 & 2 & 0 & 1 & 1 \\ 1 & 0 & 0 & 2 & 1 & 0 \\ 0 & 0 & 1 & 0 & 1 & 0 \end{bmatrix} \tag{89}$$

**Remark 5:** *D*1*<sup>ω</sup>* satisfies RIP condition defined in Eq. (75).

In the first step of attack reconstruction, *dx*ð Þ*t* is estimated by using protected measurements *y*<sup>1</sup> and the SMO described in Section 5.2. It is easy to verify that

$$
\begin{aligned}
\overline{C}\_{\delta\delta}\overline{B} &= 0, \quad \overline{C}\_{\delta 1}A\overline{B} \neq 0 \\
\overline{C}\_{\delta\overline{B}}\overline{B} &= 0, \quad \overline{C}\_{\delta 2}A\overline{B} \neq 0 \\
\overline{C}\_{\delta\overline{B}}\overline{B} &= 0, \quad \overline{C}\_{\delta\delta}A\overline{B} \neq 0 \\
&\overline{C}\_{\delta\delta}A\overline{B} \neq 0 \\
&\overline{C}\_{3} \\
&C\_{3}A
\end{aligned}
\tag{9}
\qquad
\begin{aligned}
\overline{C}\_{1}A &= \\
&\overline{C}\_{1}A \\
&= \begin{bmatrix}1 & 0 & 0 & 0 & 0 & 0 \\
0 & 0 & 0 & 1 & 0 & 0 \\
0 & 1 & 0 & 0 & 0 & 0 \\
0 & 0 & 0 & 0 & 1 & 0 \\
0 & 0 & 1 & 0 & 0 & 0 \\
0 & 0 & 0 & 0 & 0 & 1
\end{bmatrix}, \\
Y\_{3} &= \begin{bmatrix}y\_{1} \\
\mu(y\_{1} - \dot{y}\_{1}) \\
\mu(y\_{2} - \dot{y}\_{2}) \\
y\_{3} \\
\mu(y\_{3} - \dot{y}\_{3})
\end{bmatrix},
\end{aligned}
\tag{9}
$$

where *C<sup>δ</sup><sup>i</sup>* is the *i*th row of *Cδ*. The states of the system, *δ* ^*,ω*^, and plant attacks ^ *dx*ð Þ*t* are reconstructed using Eqs. (43) and (50). Then, *ω*^ is used in Eq. (89) to find

$$D\_{\alpha}d\_{\mathfrak{I}}(t) = \mathcal{Y}\_2 - \hat{\alpha} \tag{91}$$

**Figure 6.**

**Figure 7.**

**Figure 8.**

**23**

*Sensor attack dy reconstruction.*

*Plant attack dx*<sup>3</sup> *compared to estimated* ^

*DOI: http://dx.doi.org/10.5772/intechopen.88669*

*dx*<sup>3</sup> *.*

*Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode…*

*(a) Corrupted output y*1*, y*2*, y*<sup>3</sup> *compared with compensated and without any attack output and (b) corrupted*

*output y*4*, y*5*, y*<sup>6</sup> *compared with compensated and without any attack output.*

There are six sources *dy*1*,* …*, dy*<sup>6</sup> attacking three measurements *ω*1*, ω*2*, ω*3, and at any time, just one out of six attack signals is nonzero. The SR algorithm in Section 5.2 is applied to find ^ *dy*ð Þ*t* . The following attacks are considered for simulation.

$$\begin{bmatrix} d\_{x1} \\ d\_{x2} \\ d\_{x3} \end{bmatrix} = \mathbf{1}(t - \mathbf{10}) \cdot \begin{bmatrix} \sin\left(0.5t\right) \\ \mathbf{1}(t) - \mathbf{1}(t - 4) + \mathbf{1}(t - 8.5) - \mathbf{1}(t - 13) + \mathbf{1}(t - 17.5) \\ \cos\left(t \right) + \mathbf{0.5}\sin\left(3t\right) \end{bmatrix},\tag{92}$$
 
$$d\_{\mathcal{I}}(t) = \mathbf{1}(t - \mathbf{10}) \cdot \begin{bmatrix} \mathbf{0} & \mathbf{0} & \mathbf{0} & \mathbf{0} & \sin\left(t\right) & \mathbf{0} \end{bmatrix}^{T}$$

**Figure 4.**

*Plant attack dx*<sup>1</sup> *compared to estimated* ^ *dx*<sup>1</sup> *.*

**Figure 5.** *Plant attack dx*<sup>2</sup> *compared to estimated* ^ *dx*<sup>2</sup> *.*

*Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode… DOI: http://dx.doi.org/10.5772/intechopen.88669*

#### **Figure 6.** *Plant attack dx*<sup>3</sup> *compared to estimated* ^ *dx*<sup>3</sup> *.*

where *C<sup>δ</sup><sup>i</sup>* is the *i*th row of *Cδ*. The states of the system, *δ*

*dx*ð Þ*t* are reconstructed using Eqs. (43) and (50). Then, *ω*^ is used in Eq. (89) to find

There are six sources *dy*1*,* …*, dy*<sup>6</sup> attacking three measurements *ω*1*, ω*2*, ω*3, and at any time, just one out of six attack signals is nonzero. The SR algorithm in Section 5.2

*dy*ð Þ*t* . The following attacks are considered for simulation.

sin 0ð Þ *:*5*t* 1ðÞ�*t* 1ð Þþ *t* � 4 1ð Þ� *t* � 8*:*5 1ð Þþ *t* � 13 1ð Þ *t* � 17*:*5 cosðÞþ*t* 0*:*5 sin 3ð Þ*t*

^

is applied to find ^

3 7 7

<sup>5</sup> <sup>¼</sup> <sup>1</sup>ð Þ *<sup>t</sup>* � <sup>10</sup> *:*

*Control Theory in Engineering*

*dy*ðÞ¼ *<sup>t</sup>* <sup>1</sup>ð Þ *<sup>t</sup>* � <sup>10</sup> *:*½ � 0 0 0 0 sin ð Þ*<sup>t</sup>* <sup>0</sup> *<sup>T</sup>*

*dx*<sup>1</sup> *dx*<sup>2</sup> *dx*<sup>3</sup>

**Figure 4.**

**Figure 5.**

**22**

*Plant attack dx*<sup>1</sup> *compared to estimated* ^

*Plant attack dx*<sup>2</sup> *compared to estimated* ^

*dx*<sup>1</sup> *.*

*dx*<sup>2</sup> *.*

^*,ω*^, and plant attacks

*:* (92)

*Dωdy*ðÞ¼ *t y*<sup>2</sup> � *ω*^ (91)

**Figure 7.** *Sensor attack dy reconstruction.*

#### **Figure 8.**

*(a) Corrupted output y*1*, y*2*, y*<sup>3</sup> *compared with compensated and without any attack output and (b) corrupted output y*4*, y*5*, y*<sup>6</sup> *compared with compensated and without any attack output.*

Deception attacks *dx*1, *dx*2, and *dx*<sup>3</sup> are reconstructed very accurately as shown in **Figures 4–6**. The only nonzero sensor attack is detected and accurately estimated by using the SR algorithm as shown in **Figure 7**. In **Figure 8a** and **8b**, the corrupted system outputs (which are system states in our case) are compared to the "cleaned" outputs that are computed by subtracting the estimated attacks from the corrupted sensors and actuators and to the system outputs when the system is not under attack.

**References**

TAC.2014.2363897

2010.0410

pp. 1-6

10.29007/q7pr

pp. 495-500

**25**

[1] Antsaklis P. Goals and challenges in cyber-physical systems research. IEEE Transactions on Automatic Control. 2014;**59**:3117-3119. DOI: 10.1109/

*DOI: http://dx.doi.org/10.5772/intechopen.88669*

[9] Mo Y, Sinopoli B. Secure control against replay attacks. In: Proceedings of

Salmasi RF. Replay attack detection in a multi agent system using stability

watermarking. In: Annual American Control Conference; Seattle: WA, USA. 2017. pp. 4778-4783. DOI: 10.23919/

[11] Smith R. A decoupled feedback structure for covertly appropriating network control systems. IFAC Proceedings Volumes. 2011;**44**:90-95.

DOI: 10.3182/20110828-6-IT-

[12] Mo Y, Sinopoli B. False data injection attacks in control systems. In: Preprints of the 1st Workshop on Secure

Control Systems. 2010. pp. 1-6

TSE.1984.5010241

pp. 214-219

pp. 973-979

IEEE Int. Conf. Smart Grid Communications; USA. 2010.

[13] Gligor VD. A note on denial-ofservice in operating systems. IEEE Transactions on Software Engineering. 1984;**SE-10**:320-324. DOI: 10.1109/

[14] Dan G, Sandberg H. Stealth attacks and protection schemes for state estimators in power systems. In: Proc.

[15] Hashemi N, Murguia C, Ruths J. A comparison of stealthy sensor attacks on control systems. In: American Control Conference; Milwaukee: USA. 2018.

[16] Pasqualetti F, Dorfler F, Bullo F. Attack detection and identification in

cyber-physical systems. IEEE Transactions on Automatic Control.

Allerton Conf. Communications, Control Computing; Monticello: USA.

[10] Khazraei A, Kebriaei H,

analysis and loss effective

ACC.2017.7963694

1002.01721

2009. pp. 911-918

*Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode…*

[2] Baheti R, Gill H. Cyber-physical systems. The Impact of Control Technology. 2011;**12**:161-166

[3] Conti JP. The day the samba stopped. Engineering and Technology.

2010;**5**:46-47. DOI: 10.1049/et.

Australia. 2011. pp. 4490-4494

algorithm. In: Annual IEEE

[5] Farhat A, Cheok CK. Improving adaptive network fuzzy inference system with Levenberg-Marquardt

[6] Farhat A, Hagen K, Cheok KC, Boominathan B. Neuro-fuzzy-based electronic brake system modeling using real time vehicle data. EPiC Series in Computing. 2019;**58**:444-453. DOI:

International Systems Conference 24-27 April 2017; Montreal: QC, Canada. 2017.

[7] Cardenas A, Amin S, Sastry S. Secure control: Towards survivable cyberphysical systems. In: The 28th

International Conference on Distributed Computing Systems Workshops. 2008.

[8] Pasqualetti F, Dörfler F, Bullo F. Control-theoretic methods for cyberphysical security: Geometric principle for optimal cross-layer resilient control

systems. IEEE Control Systems Magazine. 2015;**35**:110-127. DOI: 10.1109/MCS.2014.2364725

[4] Karnouskos S. Stuxnet worm impact on industrial cyber-physical system security. In: 37th Annual Conference of the IEEE Industrial Electronics Society 7-10 November 2011; Melbourne: VIC,
