Attack Signal Estimation for Intrusion Detection in Industrial Control System

Intrusion detection is one of the key techniques for the security of industrial control systems. Most existing intrusion detection methods only detect the existence and type of attacks without a more specific description of the attacks. Knowing the specific waveform of the attack signals can greatly facilitate the design of defense strategy. This paper investigates the attack signal estimation for intrusion detection of actuator false data injection attacks. Taking advantage of extended state observer, the attack signal is described as system disturbance and can be estimated. We propose two attack signal estimators, i.e., linear attack signal estimator (LASE) and nonlinear attack signal estimator (NASE). Through the analysis in the frequency domain, the influence of the attack signal frequency on the estimation performance of LASE is obtained. Both simulation and experimental results illustrate that the proposed estimators can achieve good performance.