Detecting Injection Attacks in Linear Time Invariant Systems

A novel technique to detect injection attacks in linear time invariant systems is proposed. Detection involves the use of a cross-correlator that dynamically increases its analysis window to increase the probability of detection. For correlation analysis and potential remediation, the cross-correlator makes reference to a linear (internal) model of the system sensor. Unlike some existing techniques, it does not require the construction of a complex internal model of the entire control system, pre-knowledge of the attacking signal characteristics or perturbation of the control system. Performance simulations show probabilities of detection that can reach 100% with bounded analysis window size. Sensitivity analysis also show that the cross-correlator exhibits good robustness against unlikely to occasional transient sensor failures.