Secure State Estimation For Cyber Physical Systems Under Sensor Attacks: A Satisfiability Modulo Theory Approach (1412.4324v2)

Abstract: We address the problem of detecting and mitigating the effect of malicious attacks to the sensors of a linear dynamical system. We develop a novel, efficient algorithm that uses a Satisfiability-Modulo-Theory approach to isolate the compromised sensors and estimate the system state despite the presence of the attack, thus harnessing the intrinsic combinatorial complexity of the problem. By leveraging results from formal methods over real numbers, we provide guarantees on the soundness and completeness of our algorithm. We then report simulation results to compare its runtime performance with alternative techniques. Finally, we demonstrate its application to the problem of controlling an unmanned ground vehicle.

• The paper recasts secure state estimation into an SMT framework, providing sound and complete solutions under sparse sensor attacks.
• It introduces Imhotep-SMT, a solver that integrates SAT and theory solvers to efficiently identify compromised sensors in linear dynamical systems.
• The approach achieves significant scalability improvements while offering strong theoretical guarantees validated by numerical simulations.

Overview of "Secure State Estimation For Cyber Physical Systems Under Sensor Attacks: A Satisfiability Modulo Theory Approach"

The paper "Secure State Estimation For Cyber Physical Systems Under Sensor Attacks: A Satisfiability Modulo Theory Approach" addresses the problem of secure state estimation in cyber-physical systems (CPS) vulnerable to sensor attacks. In such systems, estimating the state accurately is critical, especially when sensors can be compromised. Traditionally, methods like brute force search and convex relaxations have been employed, yet they either suffer from scalability issues or lack soundness guarantees. This paper presents a novel algorithm utilizing the Satisfiability-Modulo-Theories (SMT) paradigm to efficiently manage the combinatorial complexity of the secure state estimation problem.

Problem Context and Methodology

The paper focuses on linear dynamical systems where sensor attacks are modeled as sparse additive perturbations to the measurement vector. Under this framework, the challenge is to reconstruct the system state despite potentially malicious intrusions in sensory data. The problem is framed as a Secure State Estimation task, defined formally with constraints that allow differentiation between attacked and uncompromised sensors. The ultimate goal is to identify the smallest set of sensors under attack (i.e., minimal attack support) and accurately estimate the underlying system state.

The proposed approach leverages formal methods over real numbers, ensuring soundness and completeness with respect to satisfiability (referred to as $\delta$-completeness in the paper). The algorithm operates by alternately engaging a SAT solver for boolean logic and a theory solver for real numbers (i.e., the SMT approach), checking for consistencies in sensor readings and exploring potential sensor attack scenarios.

Key Contributions and Results

The main contributions of this paper are as follows:

1. Formulation of State Estimation as an SMT Problem: The paper elegantly recasts the secure state estimation into an SMT problem, systematically combining logic constraints with convex constraints.
2. Development of Imhotep-SMT: The authors introduce Imhotep-SMT, a solver that is proven to provide sound and complete (or $\delta$-complete under noise) solutions to the state estimation problem.
3. Scalability and Scalability Heuristics: The solver's efficiency and scalability are supported both theoretically and by numerical simulations, showing dramatic reductions in execution time compared to traditional algorithms. The paper also outlines heuristics aimed at accelerating the detection process by learning conflicts and harnessing certain geometric structures of the problem.
4. Theoretical Guarantees: Under the assumption of $2\overline{s}$-sparse observability, the paper provides strong theoretical guarantees for both the existence and uniqueness of a solution, and it outlines the conditions under which this observability is sufficient.

Implications for Future Research

The results of this paper have significant implications for both the theory and practice of secure state estimation in CPS. Practically, the proposed SMT-based algorithm enhances the reliability of CPS by improving the robustness of state estimation against adversarial attacks. Theoretically, the paper sets the stage for further investigation into scalability concerning other problem classes, such as nonlinear or hybrid systems. Future research could also explore more efficient integration of SMT solving strategies with machine learning techniques, potentially addressing attack detection in more complex or less structured environments.

In conclusion, the paper makes a substantive contribution to secure state estimation by introducing a robust methodology that manages to maintain scalability while guaranteeing correctness, thereby carving a path forward for future research and developments in the field of CPS security.