A Game-Based Framework Towards Cyber-Attacks on State Estimation in ICSs

  • Cong Chen
  • Dongdai Lin
  • Wei Zhang
  • Xiaojun Zhou
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10726)


The security issue on remote state estimation process against false data injection (FDI) attacks in Industrial Control Systems (ICSs) is considered in this paper. To be practically, it is more reasonable to assume whether or not a meter measurement could be compromised by an adversary does depend on the defense budget deployed on it by the system defender. Based on this premise, this paper focuses on designing the defense budget strategy to protect state estimation process in ICSs against FDI attacks by applying a game-based framework. With resource-constraints for both the defender and the attacker side, the decision making process of how to deploy the defending budget for defenders and how to launch attacks on the meters for an attacker are investigated. A game-based framework is formulated and it has been proved that the Nash equilibrium is existed. For practical computation convenience, an on-line updating algorithm is proposed. What’s more, the simulation of the game-based framework described in this paper is demonstrated to verify its validity and efficiency. The experimental results have shown that the game-based framework could improve performance of the decision making and estimation process and mitigate the impact of the FDI attack. This may provide a novel and feasible perspective to protect the state estimation process and improve the intrusion tolerance in ICSs.


Industrial Control System (ICS) Critical infrastructures False data injection (FDI) State estimation Intrusion tolerance Game theory Nash equilibrium 



The authors would like to thank anonymous reviewers for considerate and helpful comments. The work described in this paper is supported by National Natural Science Foundation of China (61379139) and the “Strategic Priority Research Program” of the Chinese Academy of Sciences, Grant No. XDA06010701.


  1. 1.
    Clark, A., Zhu, Q., Poovendran, R., Başar, T.: An impact-aware defense against stuxnet. In: 2013 American Control Conference, pp. 4140–4147. IEEE (2013)Google Scholar
  2. 2.
    Cheminod, M., Durante, L., Valenzano, A.: Review of security issues in industrial networks. IEEE Trans. Industr. Inf. 9(1), 277–293 (2013)CrossRefGoogle Scholar
  3. 3.
    Stouffer, K., Falco, J., Scarfone, K.: Guide to industrial control systems (ICS) security. NIST Spec. Publ. 800(82), 16–16 (2011)Google Scholar
  4. 4.
    Slay, J., Miller, M.: Lessons learned from the maroochy water breach. In: Goetz, E., Shenoi, S. (eds.) ICCIP 2007. IIFIP, vol. 253, pp. 73–82. Springer, Boston, MA (2008). CrossRefGoogle Scholar
  5. 5.
    Byres, E., Ginter, A., Langill, J.: How stuxnet spreads-a study of infection paths in best practice systems. Tofino Security, White paper (2011)Google Scholar
  6. 6.
    Falliere, N., Murchu, L.O., Chien, E.: W32. Stuxnet Dossier. White paper, Symantec Corp., Security Response, 5, 6 (2011)Google Scholar
  7. 7.
    Albright, D., Brannan, P., Walrond, C.: Did Stuxnet Take Out 1,000 Centrifuges at the Natanz Enrichment Plant? Institute for Science and International Security (2010)Google Scholar
  8. 8.
    Amin, S., Cárdenas, A.A., Sastry, S.S.: Safe and secure networked control systems under denial-of-service attacks. In: Majumdar, R., Tabuada, P. (eds.) HSCC 2009. LNCS, vol. 5469, pp. 31–45. Springer, Heidelberg (2009). CrossRefGoogle Scholar
  9. 9.
    Liu, Y., Ning, P., Reiter, M.K.: False data injection attacks against state estimation in electric power grids. ACM Trans. Inf. Syst. Secur. (TISSEC) 14(1), 13 (2011)CrossRefGoogle Scholar
  10. 10.
    Teixeira, A., Amin, S., Sandberg, H., Johansson, K.H., Sastry, S.S.: Cyber security analysis of state estimators in electric power systems. In: 49th IEEE Conference on Decision and Control (CDC), pp. 5991–5998. IEEE (2010)Google Scholar
  11. 11.
    Mo, Y., Sinopoli, B.: Secure control against replay attacks. In: 47th Annual Allerton Conference on Communication, Control, and Computing, Allerton 2009, pp. 911–918. IEEE (2009)Google Scholar
  12. 12.
    Smith, R.S.: A decoupled feedback structure for covertly appropriating networked control systems. IFAC Proc. Volumes 44(1), 90–95 (2011)CrossRefGoogle Scholar
  13. 13.
    Krotofil, M., Cárdenas, Á.A.: Is this a good time?: Deciding when to launch attacks on process control systems. In: Proceedings of the 3rd International Conference on High Confidence Networked Systems, pp. 65–66. ACM (2014)Google Scholar
  14. 14.
    Krotofil, M., Cardenas, A., Larsen, J., Gollmann, D.: Vulnerabilities of cyber-physical systems to stale data–determining the optimal time to launch attacks. Int. J. Crit. Infrastruct. Prot. 7(4), 213–232 (2014)CrossRefGoogle Scholar
  15. 15.
    Zhang, H., Cheng, P., Shi, L., Chen, J.: Optimal dos attack scheduling in wireless networked control system. IEEE Trans. Control Syst. Technol. 24(3), 843–852 (2016)CrossRefGoogle Scholar
  16. 16.
    Pasqualetti, F., Dörfler, F., Bullo, F.: Attack detection and identification in cyber-physical systems. IEEE Trans. Autom. Control 58(11), 2715–2729 (2013)MathSciNetCrossRefMATHGoogle Scholar
  17. 17.
    Krotofil, M., Larsen, J., Gollmann, D.: The process matters: ensuring data veracity in cyber-physical systems. In: Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, pp. 133–144. ACM (2015)Google Scholar
  18. 18.
    Bobba, R.B., Rogers, K.M., Wang, Q., Khurana, H., Nahrstedt, K., Overbye, T.J.: Detecting false data injection attacks on DC state estimation. In: Preprints of the First Workshop on Secure Control Systems, CPSWEEK, vol. 2010 (2010)Google Scholar
  19. 19.
    Kim, T.T., Vincent Poor, H.: Strategic protection against data injection attacks on power grids. IEEE Trans. Smart Grid 2(2), 326–333 (2011)CrossRefGoogle Scholar
  20. 20.
    Jia, L., Thomas, R.J., Tong, L.: Impacts of malicious data on real-time price of electricity market operations. In: 2012 45th Hawaii International Conference on System Science (HICSS), pp. 1907–1914. IEEE (2012)Google Scholar
  21. 21.
    Bhattacharya, S., Başar, T.: Game-theoretic analysis of an aerial jamming attack on a UAV communication network. In: Proceedings of the 2010 American Control Conference, pp. 818–823. IEEE (2010)Google Scholar
  22. 22.
    Roy, S., Ellis, C., Shiva, S., Dasgupta, D., Shandilya, V., Wu, Q.: A survey of game theory as applied to network security. In: 2010 43rd Hawaii International Conference on System Sciences (HICSS), pp. 1–10. IEEE (2010)Google Scholar
  23. 23.
    Kashyap, A., Basar, T., Srikant, R.: Correlated jamming on mimo Gaussian fading channels. IEEE Trans. Inf. Theory 50(9), 2119–2123 (2004)MathSciNetCrossRefMATHGoogle Scholar
  24. 24.
    Gupta, A., Langbort, C., Başar, T.: Optimal control in the presence of an intelligent jammer with limited actions. In: 49th IEEE Conference on Decision and Control (CDC), pp. 1096–1101. IEEE (2010)Google Scholar
  25. 25.
    Agah, A., Das, S.K., Basu, K.: A game theory based approach for security in wireless sensor networks. In: 2004 IEEE International Conference on Performance, Computing, and Communications, pp. 259–263. IEEE (2004)Google Scholar
  26. 26.
    Li, Y., Shi, L., Cheng, P., Chen, J., Quevedo, D.E.: Jamming attacks on remote state estimation in cyber-physical systems: a game-theoretic approach. IEEE Trans. Autom. Control 60(10), 2831–2836 (2015)MathSciNetCrossRefMATHGoogle Scholar
  27. 27.
    Li, Y., Quevedo, D.E., Dey, S., Shi, L.: Sinr-based DoS attack on remote state estimation: a game-theoretic approach (2016)Google Scholar
  28. 28.
    Ekneligoda, N.C., Weaver, W.W.: A game theoretic bus selection method for loads in multibus DC power systems. IEEE Trans. Industr. Electron. 61(4), 1669–1678 (2014)CrossRefGoogle Scholar
  29. 29.
    Chen, C., Lin, D.: Cyber-attacks on remote state estimation in industrial control system: a game-based framework. In: Chen, K., Lin, D., Yung, M. (eds.) Inscrypt 2016. LNCS, vol. 10143, pp. 431–450. Springer, Cham (2017). CrossRefGoogle Scholar
  30. 30.
    Wood, A.J., Wollenberg, B.F.: Power Generation, Operation, and Control. Wiley, New York (2012)Google Scholar
  31. 31.
    Anderson, B.D.O., Moore, J.B.: Optimal filtering. Courier Corporation (2012)Google Scholar
  32. 32.
    Li, Y., Shi, L., Cheng, P., Chen, J., Quevedo, D.E.: Jamming attack on cyber-physical systems: a game-theoretic approach. In: 2013 IEEE 3rd Annual International Conference on Cyber Technology in Automation, Control and Intelligent Systems (CYBER), pp. 252–257. IEEE (2013)Google Scholar
  33. 33.
    Shi, L., Epstein, M., Murray, R.M.: Kalman filtering over a packet-dropping network: a probabilistic perspective. IEEE Trans. Autom. Control 55(3), 594–604 (2010)MathSciNetCrossRefMATHGoogle Scholar
  34. 34.
    Deng, R., Xiao, G., Rongxing, L.: Defending against false data injection attacks on power system state estimation. IEEE Trans. Industr. Inf. 13(1), 198–207 (2017)CrossRefGoogle Scholar
  35. 35.
    Gibbons, R.: A Primer in Game Theory. Harvester Wheatsheaf, New York (1992)MATHGoogle Scholar

Copyright information

© Springer International Publishing AG, part of Springer Nature 2018

Authors and Affiliations

  • Cong Chen
    • 1
    • 2
  • Dongdai Lin
    • 1
  • Wei Zhang
    • 1
    • 2
  • Xiaojun Zhou
    • 1
    • 2
  1. 1.State Key Laboratory of Information Security, Institute of Information EngineeringChinese Academy of SciencesBeijingChina
  2. 2.School of Cyber SecurityUniversity of Chinese Academy of SciencesBeijingChina

Personalised recommendations