Detecting Feedback-path Delay Injection Attacks Using Interacting Multiple Model Filtering

Abstract: Time-delays are known to have a detrimental effect on feedback systems. In the context of networked cyber-physical systems, delays can be injected by malicious adversaries. Detecting them early is an important challenge. This paper proposes a novel variation of Interacting Multiple Model filtering to detect delay injection attacks in feedback control systems, when hidden in an open loop setting. The detection scheme is formalised by treating delay as alternative modes of the system, and theoretical analysis of the stationary distribution informs a reduction to a three parameter model as well as the choices of hyper parameter values. The method is evaluated on a cruise control application, and shows detection within a few seconds and a low false alarm probability.