Noise Matters: Using Sensor and Process Noise Fingerprint to Detect Stealthy Cyber Attacks and Authenticate sensors in CPS

A novel scheme is proposed to identify sensors and detect data integrity attacks in a Cyber Physical System. Proposed scheme uses hardware characteristics of a sensor and Physics of the process to create unique patterns (herein called as fingerprints) for each sensor. The sensor fingerprint is a function of sensor and process noise in sensor measurements. Uniqueness in the noise appears due to manufacturing imperfections and due to unique process features. To create a sensor's fingerprint a system model based approach is used. A noise based fingerprint, is created during the normal operation of the system. It is shown that under data injection attacks on sensors, noise pattern deviates from the fingerprinted pattern enabling the proposed scheme to detect attacks. Experiments are performed on a dataset from a real-world water treatment (SWaT) facility. A class of stealthy attacks, is designed against the proposed scheme and extensive security analysis is carried out. Results show that a range of sensors can be uniquely identified with an accuracy as high as 98%. Extensive sensor identification experiments are carried out on a set of sensors in SWaT testbed. The proposed scheme is tested on a variety of attack scenarios from the reference literature which could be detected with high accuracy.