Moving Horizon FDIA: Stealthy Attack Design

• The paper introduces MH-FDIA, a methodology that designs attack sequences over a moving horizon to maximize estimator bias while maintaining stealth.
• It leverages a receding window optimization that ensures recursive feasibility, with validations on linear power grid and nonlinear autonomous vehicle case studies.
• The approach offers theoretical guarantees and utilizes projected gradient iterations, highlighting both attack strategies and potential defender countermeasures.

Moving-Horizon False Data Injection Attack (MH-FDIA) is a systematic methodology for constructing stealthy and effective attack sequences targeting moving horizon estimators (MHE) in cyber-physical systems (CPS). It addresses fundamental weaknesses of conventional (static) false data injection attacks (FDIA) by designing the attack over a receding time window, explicitly enforcing recursive feasibility and stealthiness constraints across the moving horizon. The methodology provides theoretical guarantees and outperforms prior FDIA methods when evaluated on linear power grid and nonlinear autonomous vehicle case studies (Zheng et al., 2023).

1. System and Estimator Framework

MH-FDIA is developed for discrete-time linear time-invariant (LTI) systems described by: $$x_{k+1} = A\,x_k + B\,u_k + w_k, \qquad y_k = C\,x_k + v_k,$$ where $x_k$ is the state, $u_k$ the input, $y_k$ the measurement, and $w_k$, $v_k$ are bounded process and measurement noise.

A moving-horizon estimator (MHE) of fixed window length $N$ reconstructs the state trajectory $X_{k-N+1:k} = [x_{k-N+1}^\top,\dots,x_k^\top]^\top$ at each time $k$ by solving the optimization: $$\hat X_{k-N+1:k} = \arg\min_{X_{k-N+1:k}} \left\{ \|x_{k-N+1} - \bar{x}\|^2_{P^{-1}} + \sum_{i=k-N+1}^k \|y_i - C x_i\|^2_{R^{-1}} \right\}$$ subject to $x_k$0.

After estimation, a residual-based bad data detector (BDD) computes: $x_k$1 where $x_k$2, triggering an alarm if $x_k$3.

2. Limitations of Conventional FDIA

Classical FDIAs operate at a single time step, seeking $x_k$4 to maximize bias: $x_k$5 and enforce stealthiness under a static (single-sample) BDD.

These static designs exploit the algebraic structure of $x_k$6, constructing $x_k$7 in the range of $x_k$8 to evade BDD. However, in MHE, the BDD operates over a moving window, and the constraint becomes: $x_k$9 As the time window recedes, past attack injections that satisfied the single-sample test may cause the sliding-window residual to exceed threshold, breaking stealthiness and recursive feasibility. Thus, static FDIAs are generally ineffective against MHE.

3. MH-FDIA Optimization Formulation

MH-FDIA formulates attack design over the moving window. The attacker selects an injection sequence $u_k$0 to maximize state estimate bias while maintaining stealth throughout the horizon. The formal optimization is: $u_k$1 where the stage cost $u_k$2 (with $u_k$3 being the stacked vector of attack injections) measures the MHE bias.

This approach explicitly incorporates the attack history and window-wide stealthiness, ensuring recursive feasibility as the MHE horizon shifts.

4. Theoretical Properties and Guarantees

Under standard assumptions—$u_k$4 stable, $u_k$5 observable, bounded noise, and restricted attack support (only selected rows of $u_k$6 are compromised)—MH-FDIA provides:

• Complete Parameterization: All stealthy attacks over a fixed window can be described, via singular value decomposition $u_k$7, as $u_k$8, characterizing attack success in $u_k$9.
• Recursive Feasibility: Letting $y_k$0 span the null of un-attacked rows, feasibility of $y_k$1 is equivalent to $y_k$2.
• Projected Gradient Iteration: The bias function $y_k$3 can be iteratively increased via $y_k$4 with $y_k$5 in the gradient direction of $y_k$6 and step-size $y_k$7 adjusted to keep the residual constraint active but not violated.
• Monotonicity and Feasibility: Steps can be constructed so that each iterate increases attack bias without ever violating stealth constraints.

This systematic methodology guarantees that the attack sequence remains stealthy under the receding-horizon BDD and continually increases influence on the MHE state estimate.

5. Representative Numerical Studies

MH-FDIA is validated through simulations on both linear and nonlinear CPS benchmarks:

a) IEEE-14 Bus System

• Linearized swing dynamics, window $y_k$8, sampling $y_k$9 s, stealth threshold $w_k$0, attack support $w_k$1 of measurements.
• Baseline: static eigenvalue-maximization FDIA (Liu–Ning–Reiter method)
• Metrics: steady-state estimator bias $w_k$2, maximum BDD residual
• Results: MH-FDIA achieves up to $w_k$3 higher bias while keeping residuals below detection threshold, fully utilizing the feasible region unlike the static baseline. Projected-gradient iterations typically converge within a few thousand steps, with convergence speed significantly improved by increasing the step-size parameter $w_k$4.

b) Autonomous Vehicle Path-Tracking (Nonlinear DDWMR Model)

• Kinematics with UKF state estimation, sliding-window linearization, window $w_k$5, stealth threshold $w_k$6 per step ($w_k$7).
• Attacks on 2 encoder channels, with trajectories including straight, circular, and figure-8 paths.
• Metrics: path deviation $w_k$8, BDD residual.
• Results: Robot systematically deviates from its planned path post-injection, while BDD residual remains within detectability limits. The trajectory’s qualitative shape persists, as the MH-FDIA accounts for attack history and system evolution.

6. Implications for Attacker and Defender Strategies

MH-FDIA conclusively demonstrates that recursive feasibility is essential for stealthy attack success against MHE. Any attack sequence not designed with the fullhorizon window in mind is almost certainly detectable after a few steps.

Recommended countermeasures for defenders include:

• Randomizing MHE window length $w_k$9 or detection threshold $v_k$0
• Sensor “probing” via known artificial offsets
• Cross-window consistency checks or higher-order residual computations
• Parallel observers with staggered onset times and comparison of corresponding estimates

A plausible implication is that broadened MHE window management and sensor fusion may provide enhanced resilience if implemented with these countermeasures.

7. Open Research Directions

Extensions and open questions highlighted in the literature include:

• Generalization of MH-FDIA to nonlinear MHE without reliance on windowed linearization
• Data-driven MH-FDIA design that circumvents the need for full model knowledge, enabling practical applicability to partially-known CPSes
• Rigorous stability analysis of closed-loop systems under attack, including the interplay between attack-induced bias and control system performance

These research directions suggest the continuing evolution of MH-FDIA approaches will shape both resilient estimator design and advanced anomaly detection in complex cyber-physical systems (Zheng et al., 2023).