The Dynamic Watermarking Method for the Cybersecurity of the Tennessee Eastman Process Control System

Networked cyber-physical systems are central to several critical infrastructures such as process industries, energy systems, and transportation systems. However, as several recent incidents have shown, they are vulnerable to cyber attacks. Sensors or networks carrying sensor measurements can be compromised, and the resulting malfunctioning of the control system can cause misbehavior. Since the infrastructure systems are safety and economy critical, it is important to detect such attacks and take appropriate steps to make them resilient. This paper addresses the first step: How to detect such attacks? It studies this problem for the process industries by studying the cyber-security of the Tennessee Eastman Process (TEP), which is an open source benchmark that has been developed for the purpose of evaluating process control technology [1] used in industries such as chemical plants and oil refineries. We explore the use of Dynamic Watermarking [2], a pro-active method for detecting attacks. One can employ recursive system identification to develop ARMAX models of the system. The models show that the TEP is non-minimum phase, placing it outside the scope of previous methods. So motivated, we develop a new method that allows the use of Dynamic Watermarking for detecting attacks on non-minimum phase systems. We explore the use of this method to detect a range of attacks on the TEP, including replay attacks, noise injection attacks, and bias injection attacks.