---
title: Non-Stationary Concurrent Replay Attacks
url: https://www.emergentmind.com/topics/non-stationary-concurrent-replay-attacks
type: topic
---

# Non-Stationary Concurrent Replay Attacks

Non-stationary concurrent replay attacks are integrity attacks in which an adversary records evolving measurements or signals during one interval and later re-injects them across multiple channels while the underlying process continues to evolve. In nuclear reactor cyber-physical systems, this means capturing multivariate time series of sensor readings during one operational regime and then injecting those previously recorded values concurrently on a subset of sensors; in control systems, it includes replaying past outputs while simultaneously injecting actuator inputs; in GNSS, record-and-replay attacks are commonly termed meaconing and can be carried out by relaying or replaying live signals or navigation-message content [2508.12428] [1706.08182] [2202.11341]. The distinguishing technical difficulty is non-stationarity: startup, transients, steady state, shutdown, time-varying secret dynamics, or mobile radio conditions all make successful replay contingent on matching an evolving trajectory rather than a fixed statistical profile.

## 1. Formalization and threat model

A reactor-centered formulation models the true multivariate sensor vector as $X(t)\in\mathbb{R}^n$, with components $x_i(t)$, evolving along a non-stationary trajectory driven by physics and control actions. An adversary records a sequence
$$
X(t-\tau),\, X(t-\tau+1),\dots,X(t-\tau+L-1)
$$
and then, starting at time $t$, injects these past values concurrently on a subset of sensors $\mathcal{S}\subseteq\{1,\dots,n\}$. The observed measurements become
$$
\tilde X_i(t + k)= \begin{cases} x_i(t-\tau+k),&i\in\mathcal{S},\;k=0,\dots,L-1,\\ x_i(t+k),&i\notin\mathcal{S}. \end{cases}
$$
A successful attack must maintain
$$
\|\tilde X(t)-X(t)\|\le\varepsilon\quad\forall\,t
$$
for small $\varepsilon>0$ in order to remain stealthy, yet eventually drive the reactor toward an unsafe region by causing
$$
\|\tilde X(t)-X(t)\|>E_H,
$$
where $E_H$ is the minimum deviation to induce harm. The defender’s goal is to raise an alarm as soon as
$$
\varepsilon<\|\tilde X(t)-X(t)\|\le E_H,
$$
that is, before physical safety is compromised [2508.12428].

The same concurrency appears in the moving-target control setting considered by Weerakkody and Sinopoli, where an adversary can read and modify every $u_k$ and $y_k$ channel, record blocks of true outputs $\bar y_k$ over some past interval, replay them to the detector, and simultaneously inject $u_k^a$ on the actuators so as to push the real state [1706.08182]. In GNSS, Lenhart et al. describe distributed attacks in which signals from different locations are relayed over the Internet and replayed within range of the victim receiver, and the message-level variant allows replaying signals from multiple GNSS constellations and/or bands simultaneously [2202.11341].

| Domain | Replay object | Concurrent aspect |
|---|---|---|
| Nuclear reactor signals | Previously recorded multivariate sensor values | Several sensors at once |
| Moving-target control systems | Past outputs $\bar y_k$ | Replay plus actuator injection |
| GNSS meaconing | Raw I/Q or decoded parameters and nav-bits | Multiple satellites, constellations, and/or bands simultaneously |

This suggests that “concurrent” does not merely indicate multiplicity of channels; it denotes coordinated manipulation across sensing and, in some settings, actuation, with timing chosen to preserve short-horizon plausibility under non-stationary dynamics.

## 2. Why non-stationarity makes replay both stealthy and detectable

The reactor study states that false data injections have been shown to bypass conventional linear time-invariant state estimators and failure detectors based on statistical thresholds, and that the dynamic, nonlinear, multi-variate nature of sensor signals, combined with inherent noise and limited availability of real-world training data, makes characterization of such threats and their differentiation from anticipated process anomalies particularly challenging [2508.12428]. This is the central paradox of non-stationary replay: the attack can be difficult to distinguish from legitimate trajectory evolution precisely because the nominal process is itself changing.

A related point appears explicitly in the moving-target formulation. In a stationary or purely deterministic-model setting, an adversary who recorded a long block of past $\bar y$ values can replay them perfectly and drive the real $x_k$ arbitrarily without ever upsetting the filter residual. By contrast, when the defender augments the plant with extraneous modes whose dynamics are linear time-varying and secret, any replay of old extraneous-sensor values will quickly mismatch the filter’s prediction unless the adversary perfectly predicts the secret matrices [1706.08182]. Non-stationarity is therefore ambivalent: it can mask replay when defenders assume fixed models, but it can also expose replay when defenders deliberately introduce secret variation.

GNSS provides a different manifestation of the same issue. Navigation Message Authentication prevents spoofing by simulation, but authentication does not prevent record-and-replay attacks, commonly termed meaconing. In other words, cryptographic validity of the content does not preclude malicious displacement in time, space, or delay structure [2202.11341]. A common misconception is that authenticated content is therefore sufficient; the GNSS results directly contradict that assumption.

The reactor results also show the practical cost of simplistic detection. Single-point thresholding, for example $r(t)>0.1$, yielded only $73$–$76\%$ per-second detection on FDI sets, whereas the two-window residual scheme materially improved detection [2508.12428]. The significance is methodological: in non-stationary settings, short-horizon residual spikes and longer-horizon drifts need to be aggregated differently.

## 3. One-class recurrent prediction and adaptive residual analysis

The reactor framework learns a one-class predictor $f_\theta$ of future reactor states, training only on normal data $\{X(t)\}$. Given a sliding window of length $k$, the input is
$$
\mathbf{X}_{t} = \bigl[X(t),\,X(t-1),\,\dots,\,X(t-k+1)\bigr]\in\mathbb{R}^{k\times n}.
$$
The study explores standard RNNs, Gated Recurrent Units, and Long Short-Term Memory cells. For a GRU cell,
$$
\begin{aligned}
z_t & = \sigma\bigl(W_z\,x_t + U_z\,h_{t-1} + b_z\bigr),\\
r_t & = \sigma\bigl(W_r\,x_t + U_r\,h_{t-1} + b_r\bigr),\\
\tilde h_t & = \tanh\bigl(W_h\,x_t + U_h\,(r_t\odot h_{t-1}) + b_h\bigr),\\
h_t & = (1-z_t)\odot h_{t-1} + z_t\odot \tilde h_t,\\
y_t & = V\,h_t + c,
\end{aligned}
$$
where $h_t\in\mathbb{R}^d$ is the hidden state, $x_t\in\mathbb{R}^n$ the current input, and $y_t\in\mathbb{R}^n$ the one-step-ahead prediction of $X(t+1)$. Training minimizes the mean squared prediction error
$$
\mathcal{L}(\theta) \;=\; \frac{1}{N}\sum_{t}\bigl\|X(t+1)\;-\;y_t\bigr\|^2_2.
$$
The reported hyperparameters, selected by grid search, are window length $k=30$, hidden dimension $d=100$, batch size $256$, learning rate $1\times10^{-4}$, and epochs $50$ [2508.12428].

At run time, each prediction yields the per-step residual
$$
r(t)=\bigl\|X(t)\;-\;f_\theta\bigl(\mathbf{X}_{t-1}\bigr)\bigr\|_2.
$$
Rather than thresholding $r(t)$ alone, the framework forms two rolling averages,
$$
\bar r_s(t)=\frac{1}{w_s}\sum_{j=0}^{w_s-1}r(t-j),\qquad \bar r_m(t)=\frac{1}{w_m}\sum_{j=0}^{w_m-1}r(t-j),
$$
with $w_s=5\,\mathrm{s}$ and $w_m=60\,\mathrm{s}$. An anomaly flag is raised whenever
$$
\bar r_s(t) > E_s\quad\text{or}\quad\bar r_m(t)> E_m,
$$
with $E_s=0.07$ and $E_m=0.04$ [2508.12428]. The paper describes this as an adaptive two-window scheme that detects both sudden large perturbations via the short window and longer but subtler drifts via the medium window.

The one-class structure is consequential because the model is trained only on normal operational data. This directly addresses the limited availability of real-world attack data noted in the reactor setting and frames replay detection as deviation from learned normal temporal structure rather than classification across a catalog of attack labels.

## 4. Explainability and sensor-level attribution

The reactor framework couples residual analysis with explainability modules: a modified SHAP algorithm and rule-based correlations. The modified WindowSHAP groups each sensor’s $k$-length history into one feature window and computes, for each sensor $j$,
$$
\phi_j \;=\;\sum_{S\subseteq\{1,\dots,n\}\setminus\{j\}} \frac{|S|!\,(n-|S|-1)!}{n!}\Bigl[f_{S\cup\{j\}}(x_{S\cup j}) -f_S(x_S)\Bigr].
$$
Unlike classic SHAP, missing windows are occluded by replacing them with a moving baseline equal to each signal’s first value in the window; for count-rates, zero is used. The result is a per-sensor contribution to the current prediction error, where negative $\phi_j$ means that the sensor’s trend correlates with the model error, while near-zero or positive values imply conformity to nominal behavior [2508.12428].

The rule-based layer encodes domain rules linking control-rod active state $D(t)\in\{-1,0,1\}$ to measured position $P(t)$, and neutron count $N(t)$ to measured change rate $\mathrm{CR}(t)$. For each rod, if $\lvert P(t)-P(t-1)\rvert>0.7$ cm but $D(t)\neq\mathrm{sign}(P(t)-P(t-1))$, the rule flags an anomaly; if two consecutive time steps are anomalous and data valid, it is classified as FDI for that rod. For the count-rate sensor, the rule checks
$$
\bigl|\mathrm{CR}(t)\;-\;\tfrac{100\,[N(t)-N(t-1)]}{N(t-1)}\bigr|\;>\;2\%/\mathrm{s},
$$
with no corresponding rod motion [2508.12428].

These two explainability modes serve different functions. SHAP attributes anomalous prediction error to specific signal histories, whereas the rule system tests whether physically meaningful correlations have been broken. The paper reports that modified SHAP correctly highlighted falsified signals and suppressed nominal ones, and that rule breaks pinpointed exactly which sensors were attacked [2508.12428]. This is significant because replay attacks in multivariate systems are not only a detection problem; they are also an origin-identification problem.

## 5. Empirical validation on PUR-1 and the structure of the observed attacks

The reactor experiments use a real-world dataset from Purdue’s PUR-1 research reactor, described as fully digital instrumentation and control. Data were collected over $265\,\mathrm{k\,s}$. Of these, $200\,\mathrm{k\,s}$ of normal operation, comprising $33$ cycles, were split $60/20/20$ into train, validation, and test. The remaining $65\,\mathrm{k\,s}$ were partitioned into five challenge sets: \#2 Transients with $9$ cases, \#3 Scrams with $11$ genuine scrams, \#4 FDI-A with neutron counts falsified, \#5 FDI-B with counts and change-rate falsified, and \#6 FDI-C with counts, rate, and $3$ rod positions falsified. Inputs were min–max normalized, windowed at $1\,\mathrm{s}$ cadence, and fed into the GRU model with window length $30$, hidden size $100$, learning rate $1\mathrm{e}{-4}$, and $50$ epochs. Detection performance was measured by per-second accuracy, precision, recall, and F1 score under the dual-window residual analysis [2508.12428].

Forecasting accuracy on normal, transient, and scram test sets remained high, with RMSE $<0.02$. For attack detection, single-point thresholding yielded only $73$–$76\%$ per-second detection on FDI sets. By contrast, the two-window residual scheme achieved $93.4\%$ detection accuracy on all FDI sets, with false positives below $1\%$ on all normal sets; recall was approximately $80.7\%$ and $F_1$ approximately $0.893$ [2508.12428]. The abstract also states that the framework was able to detect false data injections with accuracy higher than $0.93$ and less than $0.01$ false positives, differentiate from expected process anomalies, and identify the origin of the falsified signals [2508.12428].

Two limitations are stated directly. First, there can be some delay at the very onset of an FDI, when the replayed data still closely matches plant dynamics. Second, the rule-based component requires domain-specific rule tuning [2508.12428]. A plausible implication is that high-fidelity replay is most difficult to detect during the interval in which adversarially injected trajectories remain locally consistent with ongoing plant evolution.

## 6. Moving-target defenses and the role of secret time variation

The moving-target approach begins with the ordinary linear-Gaussian plant
$$
x_{k+1}=Ax_k+Bu_k+w_k,\qquad y_k=Cx_k+v_k,
$$
with $w_k\sim\mathcal{N}(0,Q)$ and $v_k\sim\mathcal{N}(0,R)$. The controller uses the steady-state Kalman filter
$$
\hat x_{k|k-1} = A\,\hat x_{k-1|k-1} + B\,u_{k-1},\qquad
\hat x_{k|k} = (I-KC)\,\hat x_{k|k-1} + K\,y_k,
$$
with gain $K=PC^\top(CPC^\top+R)^{-1}$, and applies the LQG law $u_k=L\hat x_{k|k}$ to minimize the infinite-horizon cost
$$
J = E\sum (x_k^\top W x_k + u_k^\top U u_k).
$$
To thwart an adversary who knows $(A,B,C)$ and can read and modify all sensor and actuator channels, the defender augments the state with extraneous modes $\tilde x_k$ whose dynamics are linear time-varying and secret. With stacked state $\bar x_k=[\,\tilde x_k;\,x_k\,]$, the augmented system is
$$
\bar x_{k+1} = \mathcal{A}_k\,\bar x_k + \mathcal{B}_k\,u_k + \bar w_k,
$$
where
$$
\mathcal{A}_k=
\begin{bmatrix}
A_{1,k} & A_{2,k}\\
0 & A
\end{bmatrix},\qquad
\mathcal{B}_k=
\begin{bmatrix}
B_k\\
B
\end{bmatrix},
$$
and $(A_{1,k},A_{2,k},B_k)$ are IID random matrices drawn each step from a distribution known only to the defender [1706.08182].

New sensors measure the extraneous states through
$$
\tilde y_k=C_k\tilde x_k+\tilde v_k,
$$
so the full measurement is
$$
\bar y_k=
\begin{bmatrix}
\tilde y_k\\
y_k
\end{bmatrix}
=\mathcal{C}_k\bar x_k+\bar v_k,\qquad
\mathcal{C}_k=
\begin{bmatrix}
C_k & 0\\
0 & C
\end{bmatrix},
$$
with $C_k$ IID random and secret [1706.08182]. The defender runs a Kalman filter on $\bar x_k$ and forms the one-step residual
$$
z_k \coloneqq \bar y_k-\mathcal{C}_k\hat{\bar x}_{k|k-1},
$$
which under no attack is zero-mean Gaussian with covariance
$$
\Sigma_k=\mathcal{C}_k\mathcal{P}_k\mathcal{C}_k^\top+\mathcal{R}.
$$
The detector is
$$
g_k = z_k^\top\Sigma_k^{-1}z_k \;\gtrless_{H_0}^{H_1}\; \eta,
$$
where $\eta$ is chosen to achieve a desired false-alarm rate $\alpha$ [1706.08182].

The paper then analyzes an almost omnipotent adversary who knows the original plant, the LQG gains, and the distribution of the secret matrices, but not their realizations. Two canonical strategies are considered: “Subtract-influence,” in which the attacker estimates the bias his own $u_k^a$ would cause and injects a canceling term, and “Estimate-expected,” in which the attacker tries to track the defender’s one-step prediction and injects a signal to drive the residual toward zero [1706.08182]. Because the defender’s secrets change each step, the attacker faces a time-varying identification problem under noise. The paper invokes the Bayesian Cramér–Rao bound and gives a recursive formula for the Fisher information; it then proves that even the best-possible stealthy choice of attacked measurements yields a residual cost lower bounded by
$$
\min E[g_k]   \ge   \mathrm{trace}(\mathcal{C}_k^\top\Sigma_k^{-1}\mathcal{C}_k Z_k).
$$
If this bound exceeds $\eta$, the attack must be detected with high probability [1706.08182].

The technical significance is direct: one can exploit non-stationarity defensively by embedding hidden, rapidly changing dynamics in extra sensors. This stands in contrast to the reactor setting, where one learns normal non-stationary evolution and detects deviations from it.

## 7. GNSS meaconing, authenticated replay, and broader implications

Lenhart et al. describe a non-stationary, distributed meaconing system with two logical nodes, ARX and ATX, connected by an IP network. ARX samples genuine Signal In Space signals, extracts navigation-level data, and forwards either raw I/Q in signal-level mode or decoded parameters and nav-bits in message-level mode to one or more ATX nodes; each ATX then re-generates RF waveforms and radiates them into the victim’s antenna environment [2202.11341]. The implementation uses off-the-shelf hardware, including BladeRF 2.0 or LimeSDR USB, a u-blox LEA-6T reference receiver, a u-blox Zed-F9P victim receiver, GNU Radio, GNSS-SDR, LTE Cat-12 USB modem with OpenVPN, and GPS-SDR-SIM forked to accept live nav bits and auth bits [2202.11341].

The bandwidth contrast between replay modalities is sharp. Signal-level relay requires
$$
B_{RF}=2\cdot f_s\cdot q\cdot N_{ch},
$$
which is approximately $32\,\mathrm{Mb/s}$ for $f_s=1\mathrm{e}6$, $q=16$, and $N_{ch}=1$. Message-level relay uses
$$
B_{msg}=M\cdot(50+8\cdot64)\,\mathrm{bit/s}\approx M\cdot562\,\mathrm{bit/s},
$$
so with $M\le 12$, $B_{msg}\le 6.7\,\mathrm{kb/s}$, while measured load peaked at approximately $15\,\mathrm{KB/s}$ to allow margin and multi-constellation [2202.11341]. To sustain replay without underrun, the one-way IP delay $\delta$ and jitter $\sigma_j$ must satisfy
$$
\delta+3\sigma_j<\Delta_{tolerable},
$$
with $\Delta_{tolerable}\approx 20\,\mathrm{ms}$ [2202.11341].

The paper emphasizes that OS-NMA still becomes public after a short prediction window, so message-level relay can preserve and forward exactly the authenticated bits, including the TESLA-style time-delayed MACs. ARX demodulates the frame, collects $(m_{i,k},\alpha_{i,k})$, forwards them with timestamp $TOW_i$, and ATX re-injects them into GPS-SDR-SIM’s nav-frame builder so that the victim’s native OS-NMA verification logic passes unchanged [2202.11341]. Selective signal delays $\Delta t_i$ bias the PVT solution through the linearized pseudorange equations
$$
\rho_i + c\Delta t_i = \|x-x_i\| + c\tau,
$$
yielding perturbation
$$
\Delta r = (G^\top G)^{-1}G^\top(c\Delta t).
$$
By coordinating delays on several signals, the attacker can steer the victim along an arbitrary small-motion trajectory, or induce purely temporal offsets, depending on the chosen delay vector [2202.11341].

Experimentally, signal-level relay achieved victim take-over approximately $100\,\mathrm{s}$ after start, with position-tracking error less than $0.5\,\mathrm{m}$ RMS after steady state and velocity-tracking error less than $0.05\,\mathrm{m/s}$ RMS; message-level relay typically achieved victim lock at $150\,\mathrm{s}$, then followed the ARX path with $2$–$3\,\mathrm{m}$ RMS error and velocity error approximately $0.1\,\mathrm{m/s}$, though occasional LTE dropouts caused transient $5$–$10\,\mathrm{m}$ jumps or brief re-acquisition delays [2202.11341]. The countermeasure discussion points to Angle-of-Arrival and multi-antenna checks, time-consistency and PVT-RAIM, network-assisted cross-checks with inertial dead-reckoning, multiple internal PVT hypotheses, and challenge mechanisms over the data link [2202.11341].

Taken together, the reactor, control, and GNSS results indicate two broad defense patterns. One pattern is predictive monitoring with one-class training, adaptive residual aggregation, and explanation modules that separate falsified trajectories from expected process anomalies [2508.12428]. The other is deliberate introduction of hidden, time-varying structure so that replay becomes self-inconsistent [1706.08182]. GNSS shows that cryptographic authenticity alone is insufficient against replay and that physical-layer or hybrid checks are required [2202.11341]. Future work identified in the reactor study includes attention-based architectures, ensemble forecasting, and broader FDI scenarios such as drift and scaling attacks [2508.12428].

Source: https://www.emergentmind.com/topics/non-stationary-concurrent-replay-attacks