论文标题
基于行为攻击检测的直接与间接方法
Direct vs Indirect Methods for Behavior-based Attack Detection
论文作者
论文摘要
我们仅使用输入输出行为数据研究数据驱动的LTI系统的数据驱动攻击检测问题。与基于模型的检测器相比，我们使用输出预测器中的错误来检测攻击，我们研究了基于行为的数据驱动检测器。我们构建了一个基于行为的卡方检测器，该检测器使用一系列输入和输出及其协方差。行为的协方差是使用两种方法估算的。第一种（直接）方法采用样本协方差作为行为协方差的估计。第二种（间接）方法使用从数据确定的较低维生成模型来估计行为的协方差。我们证明了两种估计方法的一致性，并提供有限的样本误差界限。最后，我们从数值上比较性能，并在数据集大小的不同范围内与检测范围的长度之间建立权衡。我们的数值研究表明，这两种方法都不是不变的，并且揭示了两种方法的性能的存在，其中与检测范围的长度相对于数据集较大的情况，直接方法是优越的，而间接方法在较小的数据集的情况下是优越的。
We study the problem of data-driven attack detection for unknown LTI systems using only input-output behavioral data. In contrast with model-based detectors that use errors from an output predictor to detect attacks, we study behavior-based data-driven detectors. We construct a behavior-based chi-squared detector that uses a sequence of inputs and outputs and their covariance. The covariance of the behaviors is estimated using data by two methods. The first (direct) method employs the sample covariance as an estimate of the covariance of behaviors. The second (indirect) method uses a lower dimensional generative model identified from data to estimate the covariance of behaviors. We prove the consistency of the two methods of estimation and provide finite sample error bounds. Finally, we numerically compare the performance and establish a tradeoff between the methods at different regimes of the size of the data set and the length of the detection horizon. Our numerical study indicates that neither method is invariable superior, and reveals the existence of two regimes for the performance of the two methods, wherein the direct method is superior in cases with large data sets relative to the length of the detection horizon, while the indirect method is superior in cases with small data sets.
