Robust Intrusion Detection for Resilience Enhancement of Industrial Control Systems: An Extended State Observer Approach

Abstract

We address the problem of attack signal estimation in industrial control systems that are subjected to actuator false data injection attack (FDIA) and where the sensor measurements are corrupted by non-negligible high-frequency measurement noise. The actuator FDIA signal is categorized as disturbance to be estimated and subsequently compensated, based on the concept of extended state observer (ESO). We investigate the efficacy of two alternatives to conventional ESO namely, cascade ESO (CESO) and low-power higher-order ESO (LHESO), that guarantee improved estimation performance in case of noisy measurement data as well as time-varying attack signals. Simulation and experimental results under different types of FDIAs demonstrate the advantages of designed schemes in comparison to conventional linear and nonlinear ESOs, using network motion control system as an illustrative example. The results highlight the limitations of conventional ESO under noisy measurement data, particularly nonlinear ESO which is based on <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$fal(\cdot)$</tex-math></inline-formula> function and commonly used in control literature.