Performance Bounds for Cyberattack Detectors Using Multiple Observations

In this paper, we consider False Data Injection (FDI) attacks with small injected error, and derive risk upper bounds for cyberattack detectors using multiple observations. FDI attacks with small injected error are "slow" attacks which are harder to detect, but such slow attacks can cause major failures if continuously applied over a long time period. A natural question to ask is to what degree the cyberattack detection problem becomes easier if multiple observations acquired over a long time period are used for threat assessment, and the risk level reduction achieved for each new observation. For a cyberattack detector, the false alarm rate is the probability of triggering an alarm when there is no cyberattack, and the probability of miss is the probability of not detecting a cyberattack. The risk level of a cyberattack detector is defined as the sum of the probability of false alarm and the probability of miss. By using the notion of Hellinger distance, we derive bounds on the minimum possible (achievable) risk level under multiple observations, and study asymptotic properties of such bounds. It is proved that that the minimum possible risk level converges to zero exponentially as the number of observations goes to infinity.