Non-Stationary Concurrent Replay Attacks

• The paper identifies non-stationary concurrent replay attacks as integrity breaches where adversaries replay recorded, evolving sensor data across multiple channels to mimic normal operation.
• It highlights that the changing dynamics in systems like nuclear reactors, moving-target control, and GNSS complicate traditional detection methods while enabling stealthy manipulation.
• Adaptive detection techniques, including dual-window residual analysis and moving-target defenses, have shown improved accuracy (over 93%) in distinguishing legitimate from falsified signals.

Non-stationary concurrent replay attacks are integrity attacks in which an adversary records evolving measurements or signals during one interval and later re-injects them across multiple channels while the underlying process continues to evolve. In nuclear reactor cyber-physical systems, this means capturing multivariate time series of sensor readings during one operational regime and then injecting those previously recorded values concurrently on a subset of sensors; in control systems, it includes replaying past outputs while simultaneously injecting actuator inputs; in GNSS, record-and-replay attacks are commonly termed meaconing and can be carried out by relaying or replaying live signals or navigation-message content (Dahm et al., 17 Aug 2025, Weerakkody et al., 2017, Lenhart et al., 2022). The distinguishing technical difficulty is non-stationarity: startup, transients, steady state, shutdown, time-varying secret dynamics, or mobile radio conditions all make successful replay contingent on matching an evolving trajectory rather than a fixed statistical profile.

1. Formalization and threat model

A reactor-centered formulation models the true multivariate sensor vector as $X(t)\in\mathbb{R}^n$, with components $x_i(t)$, evolving along a non-stationary trajectory driven by physics and control actions. An adversary records a sequence

$X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$

and then, starting at time $t$, injects these past values concurrently on a subset of sensors $\mathcal{S}\subseteq\{1,\dots,n\}$. The observed measurements become

$$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$

A successful attack must maintain

$\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$

for small $\varepsilon>0$ in order to remain stealthy, yet eventually drive the reactor toward an unsafe region by causing

$\|\tilde X(t)-X(t)\|>E_H,$

where $E_H$ is the minimum deviation to induce harm. The defender’s goal is to raise an alarm as soon as

$x_i(t)$0

that is, before physical safety is compromised (Dahm et al., 17 Aug 2025).

The same concurrency appears in the moving-target control setting considered by Weerakkody and Sinopoli, where an adversary can read and modify every $x_i(t)$1 and $x_i(t)$2 channel, record blocks of true outputs $x_i(t)$3 over some past interval, replay them to the detector, and simultaneously inject $x_i(t)$4 on the actuators so as to push the real state (Weerakkody et al., 2017). In GNSS, Lenhart et al. describe distributed attacks in which signals from different locations are relayed over the Internet and replayed within range of the victim receiver, and the message-level variant allows replaying signals from multiple GNSS constellations and/or bands simultaneously (Lenhart et al., 2022).

Domain	Replay object	Concurrent aspect
Nuclear reactor signals	Previously recorded multivariate sensor values	Several sensors at once
Moving-target control systems	Past outputs $x_i(t)$5	Replay plus actuator injection
GNSS meaconing	Raw I/Q or decoded parameters and nav-bits	Multiple satellites, constellations, and/or bands simultaneously

This suggests that “concurrent” does not merely indicate multiplicity of channels; it denotes coordinated manipulation across sensing and, in some settings, actuation, with timing chosen to preserve short-horizon plausibility under non-stationary dynamics.

2. Why non-stationarity makes replay both stealthy and detectable

The reactor study states that false data injections have been shown to bypass conventional linear time-invariant state estimators and failure detectors based on statistical thresholds, and that the dynamic, nonlinear, multi-variate nature of sensor signals, combined with inherent noise and limited availability of real-world training data, makes characterization of such threats and their differentiation from anticipated process anomalies particularly challenging (Dahm et al., 17 Aug 2025). This is the central paradox of non-stationary replay: the attack can be difficult to distinguish from legitimate trajectory evolution precisely because the nominal process is itself changing.

A related point appears explicitly in the moving-target formulation. In a stationary or purely deterministic-model setting, an adversary who recorded a long block of past $x_i(t)$6 values can replay them perfectly and drive the real $x_i(t)$7 arbitrarily without ever upsetting the filter residual. By contrast, when the defender augments the plant with extraneous modes whose dynamics are linear time-varying and secret, any replay of old extraneous-sensor values will quickly mismatch the filter’s prediction unless the adversary perfectly predicts the secret matrices (Weerakkody et al., 2017). Non-stationarity is therefore ambivalent: it can mask replay when defenders assume fixed models, but it can also expose replay when defenders deliberately introduce secret variation.

GNSS provides a different manifestation of the same issue. Navigation Message Authentication prevents spoofing by simulation, but authentication does not prevent record-and-replay attacks, commonly termed meaconing. In other words, cryptographic validity of the content does not preclude malicious displacement in time, space, or delay structure (Lenhart et al., 2022). A common misconception is that authenticated content is therefore sufficient; the GNSS results directly contradict that assumption.

The reactor results also show the practical cost of simplistic detection. Single-point thresholding, for example $x_i(t)$8, yielded only $x_i(t)$9–$X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$0 per-second detection on FDI sets, whereas the two-window residual scheme materially improved detection (Dahm et al., 17 Aug 2025). The significance is methodological: in non-stationary settings, short-horizon residual spikes and longer-horizon drifts need to be aggregated differently.

3. One-class recurrent prediction and adaptive residual analysis

The reactor framework learns a one-class predictor $X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$1 of future reactor states, training only on normal data $X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$2. Given a sliding window of length $X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$3, the input is

$X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$4

The study explores standard RNNs, Gated Recurrent Units, and Long Short-Term Memory cells. For a GRU cell,

$X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$5

where $X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$6 is the hidden state, $X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$7 the current input, and $X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$8 the one-step-ahead prediction of $X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)$9. Training minimizes the mean squared prediction error

$t$0

The reported hyperparameters, selected by grid search, are window length $t$1, hidden dimension $t$2, batch size $t$3, learning rate $t$4, and epochs $t$5 (Dahm et al., 17 Aug 2025).

At run time, each prediction yields the per-step residual

$t$6

Rather than thresholding $t$7 alone, the framework forms two rolling averages,

$t$8

with $t$9 and $\mathcal{S}\subseteq\{1,\dots,n\}$0. An anomaly flag is raised whenever

$\mathcal{S}\subseteq\{1,\dots,n\}$1

with $\mathcal{S}\subseteq\{1,\dots,n\}$2 and $\mathcal{S}\subseteq\{1,\dots,n\}$3 (Dahm et al., 17 Aug 2025). The paper describes this as an adaptive two-window scheme that detects both sudden large perturbations via the short window and longer but subtler drifts via the medium window.

The one-class structure is consequential because the model is trained only on normal operational data. This directly addresses the limited availability of real-world attack data noted in the reactor setting and frames replay detection as deviation from learned normal temporal structure rather than classification across a catalog of attack labels.

4. Explainability and sensor-level attribution

The reactor framework couples residual analysis with explainability modules: a modified SHAP algorithm and rule-based correlations. The modified WindowSHAP groups each sensor’s $\mathcal{S}\subseteq\{1,\dots,n\}$4-length history into one feature window and computes, for each sensor $\mathcal{S}\subseteq\{1,\dots,n\}$5,

$\mathcal{S}\subseteq\{1,\dots,n\}$6

Unlike classic SHAP, missing windows are occluded by replacing them with a moving baseline equal to each signal’s first value in the window; for count-rates, zero is used. The result is a per-sensor contribution to the current prediction error, where negative $\mathcal{S}\subseteq\{1,\dots,n\}$7 means that the sensor’s trend correlates with the model error, while near-zero or positive values imply conformity to nominal behavior (Dahm et al., 17 Aug 2025).

The rule-based layer encodes domain rules linking control-rod active state $\mathcal{S}\subseteq\{1,\dots,n\}$8 to measured position $\mathcal{S}\subseteq\{1,\dots,n\}$9, and neutron count $$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$0 to measured change rate $$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$1. For each rod, if $$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$2 cm but $$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$3, the rule flags an anomaly; if two consecutive time steps are anomalous and data valid, it is classified as FDI for that rod. For the count-rate sensor, the rule checks

$$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$4

with no corresponding rod motion (Dahm et al., 17 Aug 2025).

These two explainability modes serve different functions. SHAP attributes anomalous prediction error to specific signal histories, whereas the rule system tests whether physically meaningful correlations have been broken. The paper reports that modified SHAP correctly highlighted falsified signals and suppressed nominal ones, and that rule breaks pinpointed exactly which sensors were attacked (Dahm et al., 17 Aug 2025). This is significant because replay attacks in multivariate systems are not only a detection problem; they are also an origin-identification problem.

5. Empirical validation on PUR-1 and the structure of the observed attacks

The reactor experiments use a real-world dataset from Purdue’s PUR-1 research reactor, described as fully digital instrumentation and control. Data were collected over $$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$5. Of these, $$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$6 of normal operation, comprising $$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$7 cycles, were split $$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$8 into train, validation, and test. The remaining $$\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}$$9 were partitioned into five challenge sets: #2 Transients with $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$0 cases, #3 Scrams with $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$1 genuine scrams, #4 FDI-A with neutron counts falsified, #5 FDI-B with counts and change-rate falsified, and #6 FDI-C with counts, rate, and $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$2 rod positions falsified. Inputs were min–max normalized, windowed at $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$3 cadence, and fed into the GRU model with window length $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$4, hidden size $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$5, learning rate $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$6, and $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$7 epochs. Detection performance was measured by per-second accuracy, precision, recall, and F1 score under the dual-window residual analysis (Dahm et al., 17 Aug 2025).

Forecasting accuracy on normal, transient, and scram test sets remained high, with RMSE $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$8. For attack detection, single-point thresholding yielded only $\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t$9–$\varepsilon>0$0 per-second detection on FDI sets. By contrast, the two-window residual scheme achieved $\varepsilon>0$1 detection accuracy on all FDI sets, with false positives below $\varepsilon>0$2 on all normal sets; recall was approximately $\varepsilon>0$3 and $\varepsilon>0$4 approximately $\varepsilon>0$5 (Dahm et al., 17 Aug 2025). The abstract also states that the framework was able to detect false data injections with accuracy higher than $\varepsilon>0$6 and less than $\varepsilon>0$7 false positives, differentiate from expected process anomalies, and identify the origin of the falsified signals (Dahm et al., 17 Aug 2025).

Two limitations are stated directly. First, there can be some delay at the very onset of an FDI, when the replayed data still closely matches plant dynamics. Second, the rule-based component requires domain-specific rule tuning (Dahm et al., 17 Aug 2025). A plausible implication is that high-fidelity replay is most difficult to detect during the interval in which adversarially injected trajectories remain locally consistent with ongoing plant evolution.

6. Moving-target defenses and the role of secret time variation

The moving-target approach begins with the ordinary linear-Gaussian plant

$\varepsilon>0$8

with $\varepsilon>0$9 and $\|\tilde X(t)-X(t)\|>E_H,$0. The controller uses the steady-state Kalman filter

$\|\tilde X(t)-X(t)\|>E_H,$1

with gain $\|\tilde X(t)-X(t)\|>E_H,$2, and applies the LQG law $\|\tilde X(t)-X(t)\|>E_H,$3 to minimize the infinite-horizon cost

$\|\tilde X(t)-X(t)\|>E_H,$4

To thwart an adversary who knows $\|\tilde X(t)-X(t)\|>E_H,$5 and can read and modify all sensor and actuator channels, the defender augments the state with extraneous modes $\|\tilde X(t)-X(t)\|>E_H,$6 whose dynamics are linear time-varying and secret. With stacked state $\|\tilde X(t)-X(t)\|>E_H,$7, the augmented system is

$\|\tilde X(t)-X(t)\|>E_H,$8

where

$\|\tilde X(t)-X(t)\|>E_H,$9

and $E_H$0 are IID random matrices drawn each step from a distribution known only to the defender (Weerakkody et al., 2017).

New sensors measure the extraneous states through

$E_H$1

so the full measurement is

$E_H$2

with $E_H$3 IID random and secret (Weerakkody et al., 2017). The defender runs a Kalman filter on $E_H$4 and forms the one-step residual

$E_H$5

which under no attack is zero-mean Gaussian with covariance

$E_H$6

The detector is

$E_H$7

where $E_H$8 is chosen to achieve a desired false-alarm rate $E_H$9 (Weerakkody et al., 2017).

The paper then analyzes an almost omnipotent adversary who knows the original plant, the LQG gains, and the distribution of the secret matrices, but not their realizations. Two canonical strategies are considered: “Subtract-influence,” in which the attacker estimates the bias his own $x_i(t)$00 would cause and injects a canceling term, and “Estimate-expected,” in which the attacker tries to track the defender’s one-step prediction and injects a signal to drive the residual toward zero (Weerakkody et al., 2017). Because the defender’s secrets change each step, the attacker faces a time-varying identification problem under noise. The paper invokes the Bayesian Cramér–Rao bound and gives a recursive formula for the Fisher information; it then proves that even the best-possible stealthy choice of attacked measurements yields a residual cost lower bounded by

$x_i(t)$01

If this bound exceeds $x_i(t)$02, the attack must be detected with high probability (Weerakkody et al., 2017).

The technical significance is direct: one can exploit non-stationarity defensively by embedding hidden, rapidly changing dynamics in extra sensors. This stands in contrast to the reactor setting, where one learns normal non-stationary evolution and detects deviations from it.

7. GNSS meaconing, authenticated replay, and broader implications

Lenhart et al. describe a non-stationary, distributed meaconing system with two logical nodes, ARX and ATX, connected by an IP network. ARX samples genuine Signal In Space signals, extracts navigation-level data, and forwards either raw I/Q in signal-level mode or decoded parameters and nav-bits in message-level mode to one or more ATX nodes; each ATX then re-generates RF waveforms and radiates them into the victim’s antenna environment (Lenhart et al., 2022). The implementation uses off-the-shelf hardware, including BladeRF 2.0 or LimeSDR USB, a u-blox LEA-6T reference receiver, a u-blox Zed-F9P victim receiver, GNU Radio, GNSS-SDR, LTE Cat-12 USB modem with OpenVPN, and GPS-SDR-SIM forked to accept live nav bits and auth bits (Lenhart et al., 2022).

The bandwidth contrast between replay modalities is sharp. Signal-level relay requires

$x_i(t)$03

which is approximately $x_i(t)$04 for $x_i(t)$05, $x_i(t)$06, and $x_i(t)$07. Message-level relay uses

$x_i(t)$08

so with $x_i(t)$09, $x_i(t)$10, while measured load peaked at approximately $x_i(t)$11 to allow margin and multi-constellation (Lenhart et al., 2022). To sustain replay without underrun, the one-way IP delay $x_i(t)$12 and jitter $x_i(t)$13 must satisfy

$x_i(t)$14

with $x_i(t)$15 (Lenhart et al., 2022).

The paper emphasizes that OS-NMA still becomes public after a short prediction window, so message-level relay can preserve and forward exactly the authenticated bits, including the TESLA-style time-delayed MACs. ARX demodulates the frame, collects $x_i(t)$16, forwards them with timestamp $x_i(t)$17, and ATX re-injects them into GPS-SDR-SIM’s nav-frame builder so that the victim’s native OS-NMA verification logic passes unchanged (Lenhart et al., 2022). Selective signal delays $x_i(t)$18 bias the PVT solution through the linearized pseudorange equations

$x_i(t)$19

yielding perturbation

$x_i(t)$20

By coordinating delays on several signals, the attacker can steer the victim along an arbitrary small-motion trajectory, or induce purely temporal offsets, depending on the chosen delay vector (Lenhart et al., 2022).

Experimentally, signal-level relay achieved victim take-over approximately $x_i(t)$21 after start, with position-tracking error less than $x_i(t)$22 RMS after steady state and velocity-tracking error less than $x_i(t)$23 RMS; message-level relay typically achieved victim lock at $x_i(t)$24, then followed the ARX path with $x_i(t)$25–$x_i(t)$26 RMS error and velocity error approximately $x_i(t)$27, though occasional LTE dropouts caused transient $x_i(t)$28–$x_i(t)$29 jumps or brief re-acquisition delays (Lenhart et al., 2022). The countermeasure discussion points to Angle-of-Arrival and multi-antenna checks, time-consistency and PVT-RAIM, network-assisted cross-checks with inertial dead-reckoning, multiple internal PVT hypotheses, and challenge mechanisms over the data link (Lenhart et al., 2022).

Taken together, the reactor, control, and GNSS results indicate two broad defense patterns. One pattern is predictive monitoring with one-class training, adaptive residual aggregation, and explanation modules that separate falsified trajectories from expected process anomalies (Dahm et al., 17 Aug 2025). The other is deliberate introduction of hidden, time-varying structure so that replay becomes self-inconsistent (Weerakkody et al., 2017). GNSS shows that cryptographic authenticity alone is insufficient against replay and that physical-layer or hybrid checks are required (Lenhart et al., 2022). Future work identified in the reactor study includes attention-based architectures, ensemble forecasting, and broader FDI scenarios such as drift and scaling attacks (Dahm et al., 17 Aug 2025).