A degradation-based detection framework against covert cyberattacks on SCADA systems

Supervisory Control and Data Acquisition (SCADA) systems are commonly used in critical infrastructures. However, these systems are typically vulnerable to cyberattacks. Among the different types of cyberattacks, the covert attack is one of the hardest to detect – it is undetectable when the system is operating under normal conditions. In this article, we develop a data-driven detection framework that utilizes the degradation process of the system to detect covert attacks. We derive mathematical characteristics of the degradation processes under covert attacks that are used for developing a sequential likelihood ratio test method for attack detection. We verify our methodology through an extensive numerical study and a case study on a rotating machinery setup. Our results show that the methodology helps detect covert attacks within reasonable delay time and is applicable under real-world settings.