Cyberattack Detection and Detector Limitations for Stochastic Processes

In this paper, we consider cyberattack detection and detector performance limitations in the context of stochastic processes. In cyberattack detection, the main problem is to make a decision based on certain observations, and depending on the methodology used for detector design, one can have varying degrees of performance. A “good” detector will catch almost all anomalies (Low type II error rate,
$P_{II}$
), and will generate almost no false alarms (Low type I error rate,
$P_{1}$
). Therefore, we define
$1-(P_{I}+P_{II})/2$
as the detector performance metric. In our mathematical framework, we consider two stochastic processes; one corresponding to normal system operation and the other corresponding to cyberattack. The detector will be the “device” that will use certain number of observations and decide whether the system is operating under normal mode or not. Minute anomalies that may be hard to detect with few number of observations will be increasingly easier to detect as we gather more and more observations. In cyberattack detection applications, there are two fundamental requirements: (1) Detectors should have high performance, and (2) Attack assessment should be made as quickly as possible. These two requirements are naturally conflicting with each other, and finding a good balance between the two is essential for any kind of cyberattack detector design. In this paper, we study the best achievable cyberattack detector performance as a function of the number of observations, and derive practical bounds for “good” detector design. As an application of the developed theory, we will consider the false data injection (FDI) attack and derive bounds on the minimum number of observations to achieve “good” detector performance.