Jose Rubio-Hernan
email: jose.rubiohernan@telecom-sudparis.com

Luca De Cicco
email: luca.decicco@poliba.it

Joaquin Garcia-Alfaro
email: joaquin.garciaalfaro@telecom-sudparis.com

José Rubio-Hernán

Samovar

Joaquín García-Alfaro

Revisiting a watermark-based

Keywords: Cyber-Physical Security, Critical Infrastructures, Attack detection, Adversary Model, Attack Mitigation, Networked Control System

come

I. INTRODUCTION

In an effort of reducing complexity and costs, traditional industrial control systems are being upgraded with novel computing, communication and interconnection capabilities. Industrial control systems that close the loop through a communication network are hereinafter denoted cyber-physical systems. The adoption of new communication capabilities comes at the cost of introducing new security threats that are required to be holistically handled, both in terms of safety and security (in the traditional ICT sense). The recently coined cyber-physical security term refers to the mechanisms that address this specific challenge [START_REF] Corman | NITRD Cyber-Physical Security Panel[END_REF].

In this paper, we focus on the adaptation of physical-layer failure detection mechanisms (e.g., systems for the detection of faults and accidents) to handle, as well, attacks (e.g., replay and integrity attacks conducted by malicious adversaries). We reexamine the security of a specific scheme by Mo et al. proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF]. This scheme relies on the adaptation of a real-time failure detector based on a linear time-invariant model of the system. Built upon Kalman filters and linearquadratic regulators, the scheme employs authentication watermarks to protect the integrity of physical measurements communicated over the cyber and physical control domains of a networked control system (NCS). Without the protection of the messages, malicious actions can be conducted to mislead the system towards unauthorized or improper actions and affect the availability of the system services.

The main contributions of this paper are summarized as follows:

• We reexamine the security of the attack detector proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] under a new adversary model.

• We show security weaknesses in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] under the new adversary model.

• An enhanced detector approach is presented and validated via numerical simulations.

Section II provides the related work. Section III reviews the detector scheme in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF], provides a new adversary model and reexamines the security of the detector under the new adversary model. Section IV presents a novel multi-watermark detection scheme that handles the uncovered limitations of the previous construction. Section V concludes the paper.

II. RELATED WORK

Security of cyber-physical systems is drawing a great deal of attention recently [START_REF] Corman | NITRD Cyber-Physical Security Panel[END_REF] after the infamous StuxNet malware [START_REF] Falliere | W32. stuxnet dossier[END_REF] uncovered the potential of successful security attacks carried out against such systems. Several authors have studied the requirements to take into account the new security issues when designing security mechanisms for cyber-physical systems. In [START_REF] Cardenas | Secure control: Towards survivable cyber-physical systems[END_REF], Cardenas et al. define the issue of secure control by analyzing separately the problem first from a information security point of view and then by looking at specific control issues. In [START_REF] Cardenas | Challenges for securing cyber physical systems[END_REF], Cardenas et al. also outline for the first time the difference between corporate ICT security and cyber-physical system security.

From a cyber perspective, the protocols for industrial control systems built upon a networked control system must cover regulation rules such as delays and faults [START_REF] Iec | Functional safety of electrical/electronic/programmable electronic safety related systems[END_REF]. Indeed, most industrial control protocols (e.g., Modbus, DNP3, AGA-12, PROFINET and Ethernet/IP), are not designed to provide security from a traditional information or network perspective. Nevertheless, there are some protocols with security extensions. AGA-12 uses cryptography to add integrity and confidentiality protection, but with high deployment cost [START_REF] Clayton | Cybersecurity: How US utilities passed up chance to protect their networks[END_REF]. DNP3 has an extension named DNP3-SA (fifth version IEEE-1815-2012), adding new security features to DNP3, ensuring integrity and authentication for the message. Even so, current NCSs use these protocols over TCP/IP or UDP/IP communication (e.g., Modbus and DNP3 over TCP, PROFINET over TCP, Ethernet/IP over TCP or UDP). Over Ethernet network communication, there is traditional ICT security until application layer. In the application layer, we find the NCSs protocols, such as PROFINET which has a new layer, PROFIsafe, but this layer has been designed to ensure safety, hence protecting the PROFINET protocol against malfunction (e.g., transmission errors). It does not ensure security against intentional malicious acts [START_REF] Åkerberg | Exploring network security in profisafe[END_REF]. It is worth noting that most of the protocols of application layer are modifications of serial protocols and do not provide security. So, although transport and network layers can provide some security elements, these mechanism are not sufficient to ensure control-data protection [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF]. To solve the problem of control-data protection, cryptography could also be used. However, without underestimating a cryptographic solution, in this paper we revisit and analyze a complementary and alternative solution proposed by Mo et al. [START_REF] Mo | Detecting integrity attacks on scada systems[END_REF], to ensure the integrity and the authentication of control-data using also the control domain of the networked-control system. This security solution proves to be useful, e.g., in the case where a cyber adversary bypasses a cryptographic solution, by adding an additional protection layer.

The line of research that is more closely related to this paper is the one that explicitly considers the interconnection between cyber and physical control domains in networked control systems. Recently, the control system community started to study security of cyber-physical systems both under the methodological point of view and from a more technological standpoint by looking at particular problems arising in, e.g., smart grids, power grids, water distribution systems. Figure 1 shows the way how an adversary conducting a cyberphysical attack can be represented through a block diagram, a representation typically used by the control system community. The symbol in the figure represents a summing junction, i.e., a linear element that outputs the sum of a number of input signals. In a nutshell, the figure represents the control loop of a monitored system, and how an adversary succeeds at modifying some of the readings, by recording and replicating previous measurements corresponding to normal operation conditions. Then, the adversary modifies the control input u to affect the system state and disrupt normal operation conditions. If, on one hand, the adversary is not required to have the knowledge of the system process model, on the other hand access to all sensors (i.e., it has access to all components of the vector y) or insecure communication protocols is required to carry out a successful attack. This type of adversary is undetectable with a monitor detector which only verifies faulty measurements.

Several studies have proposed the adaptation of fault detection systems to detect as well attacks. Sophisticated variations of the attack in Figure 1 include (i) bias-injection cyber-physical attacks, in which the new data injected by the adversary corresponds to a bias from the legitimate data, with the aim of leading the system to wrong control decisions (e.g., to cause malfunction in the long-term); and (ii) geometricinjection cyber-physical attacks, in which the bias is gradu-

Controller Network Plant Adversary Adversary u t y t -y t + y t y t -u t + u t u t
Fig. 1: Representation of a cyber-physical attack against a networked control system. ally injected. The attack may remain undetected when data compatible with the system dynamics are injected, potentially leading the system to irreversible damages. Teixeira et al. propose in [START_REF] Teixeira | A secure control framework for resource-limited adversaries[END_REF] a mathematical framework to model several attack strategies. They show how to model each considered attack policy within this framework with the goal of evaluating its impact based on the mathematical concept of safe sets. An alternative modeling approach is taken by Pasqualetti et al. in [START_REF] Pasqualetti | Cyber-physical security via geometric control: Distributed monitoring and malicious attacks[END_REF], where the authors propose to employ the theory of geometric control to model cyber-physical systems attacks. Within this framework, a characterization of undetectable and unidentifiable attacks is provided.

Techniques to prevent the aforementioned cyber-physical attacks have been proposed in the literature. In [START_REF] Arvani | Detection and protection against intrusions on smart grid systems[END_REF], Franklin et al. describe a signal-based detector method, using discrete wavelet transformations. Brumback and Srinath study in [START_REF] Do | A statistical method for detecting cyber/physical attacks on scada systems[END_REF] strategies for handling cyber-physical attacks using statistical detection methods. Mo et al. propose in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] the use of watermark-based detection by adapting traditional failure detection mechanisms (e.g., detectors to handle faults and errors). In the following sections, we elaborate further on the watermark-based technique by Mo et al., discuss about some security limitations and propose an improved technique.

III. WATERMARK-BASED ATTACK DETECTION

In [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF], a watermark-based strategy is proposed with the aim of detecting replay and injection attacks against cyberphysical systems. The overall goal of this section is to provide a brief review of the mechanism proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] and to assess its performance when a new adversary model, that we name cyber-physical adversary, is employed. In particular, this section is organized as follows: in Section III-A we provide some necessary definitions and background concerning the class of control systems considered in this paper; Section III-B describes the attack detection scheme proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF]; in Section III-C, we propose the cyber-physical adversary; in Section III-D, we show a practical method that can be employed by the adversary to guess the watermark; finally, we evaluate the performance of the detection scheme when attacked by the cyber-physical adversary via numerical simulations.

A. Definitions and Background

We consider plants of industrial control systems that can be mathematically modeled as discrete linear time-invariant (LTI) systems. It is worth mentioning that a mathematical model provides a rigorous way to describe the dynamical behaviour of a given system. Such class of systems can be described as follows:

x t+1 = Ax t + Bu t + w t (1)
where x t ∈ R n is the vector of the state variables (or state) at the t-th time step, u t ∈ R p is the control signal, and w t ∈ R n is the process noise that is assumed to be a zero mean Gaussian white noise with covariance Q, i.e. w t ∼ N (0, Q). Moreover, A ∈ R n×n and B ∈ R n×p are respectively the state matrix and the input matrix.

A static relation maps the state x t to the system output y t ∈ R m :

y t = Cx t + v t (2)
where C ∈ R m×n is the output matrix. The value of the output vector y t represents the measurement produced by the sensors that is affected by a noise v t assumed as a zero mean Gaussian white noise and covariance R, i.e. v t ∼ N (0, R).

For such a class of systems, a widely used control technique is the Linear Quadratic Gaussian (LQG) approach. The overall goal of an LQG controller is to produce a control law u t such that a quadratic cost J, that is function of both the state x and the control input u, is minimized:

J = lim n→∞ E 1 n n-1 i=0 (x T i W x i + u T i U u i ) (3)
where W and U represent positive definite cost matrices [START_REF] Franklin | Digital control of dynamic systems[END_REF].

It is well-known that such a control problem has, under some technical conditions, an optimal solution that, thanks to the separation principle, is made of two components that can be designed independently:

1) a Kalman filter that, based on the noisy measurements, produces an optimal state estimation xt of the state x; 2) a Linear Quadratic Regulator (LQR) that, based on the state estimation xt , provides the control law u t that solves the LQR problem (3).

Let us briefly illustrate how these two components are designed. The Kalman filter estimates the state as follows:

• Predict (a priori) system state xt|t-1 and covariance:

xt|t-1 = Ax t-1 + Bu t-1 P t|t-1 = AP t-1 A T + Q
• Update parameters and (a posteriori) system state and covariance:

K t = (P t|t-1 C T )(CP t|t-1 C T + R) -1 xt = xt|t-1 + K t (y t -C xt|t-1 ) P t = (I -K t C)P t|t-1
where K t and P t denote, respectively, the Kalman gain and the a posteriori error covariance matrix, and I is the identity matrix of appropriate dimensions.

The optimal control law u t provided by the LQR is a linear controller:

u t = Lx t (4)
where L denotes the feedback gain of a linear-quadratic regulator (LQR) which minimizes the control cost (3) and it is defined as follows (see [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] for further details):

L = -(B T SB + U ) -1 B T SA,
with S being the matrix that solves the following discrete time algebraic Riccati equation:

S = A T SA + W -A T SB[B T SB + U ] -1 B T SA.

B. The χ 2 Detector

This section briefly describes the detection scheme proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF]. The procedure is applicable to discrete LTI plants controlled by a LQG controller as detailed in Section III-A.

Before presenting the detection scheme, we provide a definition of the adversary model considered in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF]: Definition 1. An attacker that has the ability to eavesdrop all the messages containing the sensor outputs y t and to inject messages with a signal y t to conduct malicious actions is defined as a cyber adversary.

Remark. It is important to notice that the definition given above does not suppose that the attacker possesses (or makes attempts to gather) any knowledge about the system model, reason why we name such attacker a cyber adversary.

In the following, we will denote with u * t the output of the LQR controller given by Equation ( 4) and with u t the control input that is sent to the plant (see Equation [START_REF] Corman | NITRD Cyber-Physical Security Panel[END_REF]). The idea is to superpose to the optimal control law u * t a watermark signal ∆u t ∈ R p that serves as an authentication signal. Thus, the control input u t is given by:

u t = u * t + ∆u t (5)
The watermark signal is a Gaussian random signal with zero mean that is independent both from the state noise w t and the measurement noise v t . Such an authentication watermark is expected to detect replay and integrity attacks modeled by the cyber adversary defined above. Now that the optimal control law u * t is equipped with the authentication signal ∆u t , a detector -physically co-located with the controller -can be designed having the goal of generating alarms when an attack takes place. Towards this end, [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] propose to employ a χ 2 detector, a well-known category of real-time anomaly detectors classically used for fault detection in control systems [START_REF] Brumback | A chi-square test for fault-detection in kalman filters[END_REF], for the purpose of attack detection.

An alarm signal g t is computed based on the residues r t = y t -C xt|t-1 generated by the estimator. Then, g t is compared with a threshold γ to decide whether the system is in a normal state. The threshold is tuned to minimize false alarms [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF]. The alarm signal g t is computed as follows:

g t = t i=t-w+1 (y i -C xi|i-1 ) T P -1 (y i -C xi|i-1 ) (6)
where w is the size of the detection window and P = (CP C T + R) is the co-variance of an independent and identically distributed (i.i.d.) Gaussian input signal from the sensors.

The system is considered not under attack if g t < γ, otherwise if g t ≥ γ the system is considered to be under attack and the detector generates an alarm.

C. Cyber-Physical Adversary

Let us assume the system employs the detector described in Section III-B, so that the controller superposes its output with an authentication watermark ∆u t . At steady-state, i.e. after the transient has been exhausted, the output of the system can be considered as the sum of its steady-state value and a component that is due to watermark signal that shall be only known by the controller.

Let us now introduce an enhanced adversary that is aware of the fact that the system employs the χ 2 detector presented above. Since the detector is based on the watermark signal ∆u t , we will show that an adversary that is able to extract a stationary signal ∆u t , from the signal u t is able to conduct a replay attack while remaining undetected. Definition 2. An attacker that, in addition to the capabilities of the cyber adversary, is also able to eavesdrop the messages containing the output of the controller u t with the intention of improving its knowledge about the system model is defined as a cyber-physical adversary.

Let us consider a cyber-physical adversary that wants to carry out a replay attack. Signals u t and y t are assumed to be respectively the output of the controller and the output of the measurement when a replay attack is taking place. We denote with ∆u t the watermark guessed by the cyber-physical adversary. For the time being, we do not consider the algorithm employed by the adversary to guess the watermark. See Section III-D for such details.

Proposition. A cyber-physical adversary that is able to exactly estimate the watermark signal injected by the controller cannot be detected by the χ 2 detector (6).

Proof: We consider an attack is started at time T 0 and we compute the residues r t for t ∈ [T 0 , T 0 + T -1]:

r t = y t -C xt|t-T (7)
Moreover, it is easy to show that the following holds:

xt|t-T = x t|t-T + A t-T0 (x T0|T0-1 -x T0|T0-1 ) + t-T0-1 i=0 (A i B(∆u t-1-i -∆u t-1-i )) (8)
where x is the estimated state when the system is under attack and A = (A + BL)(I -KC) is a stable matrix [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF]. Substitution of ( 8) in ( 7) yields:

r t = y t -C x t|t-T First term -CA t-T0 (x T0|T0-1 -x T0|T0-1 ) Second term -C t-T0-1 i=0 (A i B(∆u t-1-i -∆u t-1-i ))
Third term

Let us consider separately the three terms in the equation written above: the first term follows the same distribution of (y t -C xt|t-1 ); since A is asymptotically stable -i.e. all its eigenvalues are inside the open unit disk of the complex plane -the second term converges exponentially fast to zero. In fact, the entries of A t-T0 converge exponentially fast to zero. Now, if the third term would be equal to zero, the dynamics of r t would recover the dynamics of the residues when no attack is undergoing and thus, the attack would not be detected. Under the hypothesis of this proposition, the adversary knows exactly the watermark signal and thus ∆u t = ∆u t which makes the third term equal to zero and concludes the proof.

D. Acquiring the Watermark Signal

Motivated by Proposition III-C, we show now a practical method that can be used to acquire the watermark signal ∆u t . In particular, we propose an adversary that employs an adaptive Least Mean Square (LMS) filter with the purpose of running an online identification of the system model. With the identified model, it is possible to obtain the watermark and, finally, using it to authenticate messages with the aim of driving the system to an undesired state.

We denote with p the LMS filter order and with µ its step size. The step size µ is upper bounded by 2/λ max , where λ max is the maximum eigenvalue of the auto-correlation matrix R = E[XX H ], where X H is the Hermitian transpose, or conjugate transpose, of X. Observe that if µ is chosen too small, the time to converge to optimal weights tends to be large [START_REF] Widrow | Stationary and nonstationary learning characteristics of the lms adaptive filter[END_REF]. The adversary initializes the weight matrix W to be equal to the zero matrix. Then, the adversary's algorithm shown in Algorithm 1, is run online. It is worth noting that in this algorithm; X is the input signal, e is the error, ē is its complex conjugate, and d is the desired output signal.

Once the system model has been identified, the adversary is able to extract the watermark and to carry out the replay attack. In particular, the adversary follows the steps described below:

1) Eavesdropping of u t and y t and decomposition:

The adversary captures both the control law u t and the sensors output y t to make the decomposition between the information data and the watermark using the LMS filter as a ini ← jp + 1.

10: e(ini) ← d(ini) -W T X[x(ini), ... x(j)].

11:

W ← W + µē(ini)X[x(ini), ... x(j)].

12: j ← j + i.

13:

i ← i + 1.

14:

goto loop. 2) Acquiring the weight matrix, W: The adversary uses the LMS adaptive filter described before, as a system identification method.

3) Computing the attack sensor measurement y t : The adversary attacks the system by sending fake sensor measurements y t , where y ∆u t is computed using the watermark ∆u t as follows:

y ∆u t = W T ∆u t
and y t = y * t-1 + y ∆u t . In the remainder of this section, we show via numerical simulations that the detection mechanism proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] is not sufficiently robust and is not able to detect cyber-physical adversaries (see Section III-C) that are able to identify the system model by eavesdropping the data channel.

In order to simulate the NCS, we have employed a simplified version of the Tennesse Eastman control challenge problem [START_REF] Ricker | Model predictive control of a continuous, nonlinear, twophase reactor[END_REF] also used as a benchmark in [START_REF] Chabukswar | Detecting integrity attacks on scada systems[END_REF]. This system simulates a MIMO system of order n = 7 with p = 4 inputs and m = 4 outputs. In particular the model of the discrete LTI system described by Equations ( 1)-( 2) is defined by the following matrices: 9) for 500 simulations (both cyber and cyber-physical adversary cases). Moreover, the co-variance matrices are equal to Q = 0.01I and R = I, whereas the cost matrices are W = 1.5I and U = 10I.

A=          0.987 0 0 0 0 0 0 0 0.895 -0.025 0 0 0 0 0 0.036 0.999 0 0 0 0 0 0 0 1 -0.008 0 0 0 0 0 0.005 0.960 0 0 0 0 0 0 0 0.999 0 0 0 0 0 0 0 0.990          , B=          0.
In order to quantify the detector performance, we define the DR (Detection Ratio) metric as follows:

DR = T0+Ta t=T0 1 gt≥γ T a (9)
where T a is the attack duration, and 1 is the indicator function whose output is equal to 1 if the Boolean condition given as its argument (g t ≥ γ) is true; or it is equal to 0 otherwise. In a nutshell, DR ∈ [0, 1] can be considered as an efficiency index for the detector: DR is equal to one when the attack is always detected; and it is equal to zero when the attack is always undetected.

Figure 2 shows the CDF (Cumulative Distribution Function) of the detection ratio obtained by measuring DR for 500 simulations both in the case of the cyber-physical and the cyber adversary. The figure shows that the detection scheme proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] is able to provide a median detection ratio that is larger than 0.9 when a cyber adversary attacks the system. However, using a cyber-physical adversary that acquires the watermark, the median detection ratio drops to around 0.2. This quantitatively shows that the detection strategy proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] is not sufficiently robust for security.

IV. MULTI-WATERMARK BASED ATTACK DETECTION

In the previous section we have shown that the watermarkbased detection scheme in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] is able to properly handle attacks carried out by cyber adversaries, but it fails at detecting cyber-physical adversaries. In this section, we propose a detection scheme that extends the one presented in Section III-B and overcomes the limitations shown in the previous section.

A. The Proposed Multi-watermark Signal

The goal of the new detection scheme is to increase the difficulty in retrieving the authentication watermark ∆u t from the control signal u t , so that the probability of detecting an attack from a cyber-physical adversary can be increased. We assume that the NCS employs exactly the same LQG controller and the same detection strategy presented in Section III. The only difference in the proposed detection scheme is the way the watermark signal ∆u t is generated. The control input u t , as in the case of the detection scheme presented in Section III-B, is computed as the superposition of the optimal control signal u * t produced by the LQR controller and the multi-watermark signal ∆u t . The idea is to construct the watermark signal by switching between N different and independent processes with different co-variance and average (offsets). More precisely, the non-stationary watermark, ∆u t , is obtained by periodically switching, with a period T , between N signals ∆u

(i)
t , with i ∈ I = {0, 1, . . . , N -1}, extracted by different stochastic processes. Hence, the watermark signal ∆u t can be formalized as follows:

∆u t = ∆u (s(t,T )) t (10)
where s : N × R → I is a static function that maps the time sample t and the switching period T to an element of the index set I, defined as follows:

s(t, T ) = 1 T mod (t, N T ) (11)
where mod (x, y) is the modulo operator and • is the floor function.

By using the proposed watermark (see Equation 10), we now have an adaptive protection mechanism with two main configurable parameters: the number of distributions N and the switching frequency f = 1/T . It is worth to notice that the original watermark signal described in Section III is recovered when f → 0 and when ∆u (0) t being a stationary zero mean Gaussian process.

B. Validation

This section validates through numerical simulations the detection scheme proposed in Section IV-A. In particular, we aim at showing that the proposed watermark signal is able to detect cyber-physical adversaries (see Section III-C) with a higher detection ratio with respect to the one obtained with the watermark proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF]. Towards this end, we start with a system described by the following matrices:

A = 0.5 0.8 0 0.8 , B = 0 1 , C = [ 1 0 ] . (12)
and co-variance matrices equal to Q = 0.8I and R = I. The positive definite cost matrices W and U are both equal to the identity matrix. The simulation uses a Simulink NCS model under a cyber-physical adversary starting the attack at t = 700s. We have used N = 3 different distributions switched at random: a Gaussian, a Rician and a Rayleigh distribution.

Table I shows the co-variance and offset configured in the simulations for each distribution.

To validate the proposed attack detection scheme, we compare the system dynamics considering two different switching frequencies. We have simulated a high frequency switching watermark configured to switch each 7 time samples, and a low frequency switching configured to switch each 20 time samples. Figures 3(a) and (c) show the plant dynamics and the dynamics of the states estimated by the controller in the case of a switching frequency watermark configured to 7 time samples and a cyber-physical adversary attack. Figure 3(a) shows that the adversary is able to drive the states to an undesired value. Nevertheless, the controller misled by the adversary, does not perceive such situation (see Figure 3(c)). Figures 3(b) and (d) show the plant dynamics and the dynamics of the states estimated by the controller when the watermark is switched each 20 time samples. The dynamics show exactly the same behavior described above.

Figures 3(e) and 3(f) show the dynamics of the alarm signal g t produced by the detector, respectively in the case of high and low switching frequency. Notice that switching the watermark distributions at a high frequency provides better detection performances compared to the case of a low switching frequency.

To quantify the effectiveness of the proposed detection scheme, we compute the detection ratio DR as a function of the switching frequency. In particular, for each considered frequency f we run 500 Monte Carlo simulations (with randomly generated system parameters) both in the case of the cyber-physical and the cyber adversary, and we compute the CDF of the detection ratio.

Let us now confront the performance obtained with the detection strategy based on multiple watermark signals proposed in this paper with that proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF] in both the case of a cyber-physical and a cyber adversary. In the case of the proposed multi-watermark strategy we consider two switching frequencies f L = 0.05Hz (switching watermark each 20 time steps) and f H = 0.14Hz (switching watermark each 7 time steps). The results of this comparison are shown in Figure 4. Let us focus on the detection strategy proposed in [START_REF] Mo | Secure control against replay attacks[END_REF], [START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF]: as shown before, the detector is able to consistently detect cyber attack but it performs poorly when a cyber-physical adversary attacks the system. On the other hand, the proposed detection strategy based on multiple watermarks is able to provide a higher detection ratio: in particular we notice that the detector employing a higher switching frequency f H provides better performances with respect to the case of using the lower switching frequency f L .

V. CONCLUSION

We have addressed security issues in industrial control systems. We have focused on the adaptation of failure detection mechanisms. The goal is to handle, in addition to faults and errors, the detection of cyber-physical attacks. Cyber-physical attacks refer to malicious activities conducted over industrial control systems with upgraded computing, communication and interconnection capabilities. In other words, they refer to threats against industrial environments that close their loops through networked control systems.

We have revisited a watermark-based attack detection scheme. The approach relies on the adaptation of a failure detector, by adding a complementary authentication watermark signal for the detection of the malicious activities. The approach only requires to inject the watermark from the system controller. The monitored system continues to work regardless of the added watermark signal. This way, the strategy is free from desynchronization. Nevertheless, we have shown that the detection strategy is not sufficiently robust from a security standpoint. Indeed, we have quantitatively shown that the approach only detects cyber adversaries, i.e., attackers with the ability to eavesdrop information from the system, but that do not attempt to get any knowledge about the system model itself. We have validated that the detector fails at covering cyber-physical adversaries, i.e., attackers that, in addition to the capabilities of the cyber adversary, are also able to infer the system model to evade the detection.

We have then presented a multi-watermark based adaptive detection scheme with two main configurable parameters: number of distributions and switching frequency. The novel multi-watermark proposal succeeds at properly detecting both cyber and cyber-physical adversaries under the assumption that the watermark distributions change frequently. The rationale is that, even under the presence of adversaries with knowledge about the system dynamics, the detector succeeds at reducing their chances of acquiring the authentication watermark and bypass the detector. Numerical simulations validate the detection performance of the new construction.

Fig. 2 :

 2 Fig. 2: Cumulative distribution function (CDF) of the detection ratio associated to the χ 2 detector (see Section III-B), obtained by measuring the DR metric (see Equation9) for 500 simulations (both cyber and cyber-physical adversary cases).

  Plant states under a cyber-physical adversary attack and switching frequency set to 0.14Hz, meaning that every 7 time steps, the controller changes the distribution associated to the watermark. Plant states under a cyber-physical adversary attack and switching frequency set to 0.05Hz, meaning that every 20 time steps, the controller changes the distribution associated to the watermark. Estimated states in the controller under a cyber-physical adversary attack and switching frequency set to 0.14Hz. Estimated states in the controller under a cyber-physical adversary attack and switching frequency set to 0.05Hz. Detector results, switching frequency set to 0.14Hz. Detector results, switching frequency set to 0.05Hz.

Fig. 3 :

 3 Fig. 3: Simulation results where State 1 and State 2 are the temperatures of two different chemical processes. Attacks start at t = 700s. (a),(b) The dynamics of the states vector in the plant under a cyber-physical adversary attack and switching frequency configured with two different configurations (0.14Hz and 0.05Hz). (c),(d) The dynamics of the states vector estimated in the controller, under the same scenarios. (e),(f) The dynamics of the alarm signal g t produced by the multi-watermark based detector, under the same scenarios.

Fig. 4 :

 4 Fig.4: Confronting the performance of the two detectors. (a) χ 2 detector in[START_REF] Mo | Secure control against replay attacks[END_REF],[START_REF] Mo | Physical authentication of control systems: Designing watermarked control inputs to detect counterfeit sensor outputs[END_REF], and cyber adversary. (b) χ 2 detector and cyber-physical adversary. (c) Multi-watermark detector with switching frequency set to 0.14Hz, and cyber-physical adversary. (d) Multi-watermark detector with switching frequency set to 0.05Hz, and cyber-physical adversary.

TABLE I :

 I Sample parameters used in the multi-watermark Simulink model.

	Distribution	Co-variance	Offset
	Gaussian	2.560	0.0
	Rician	1.113	2.401
	Rayleigh	0.576	1.500

Acknowledgements. The authors acknowledge support from the Cyber CNI Chair of Institut Mines-Télécom. The chair is held by Télécom Bretagne and supported by Airbus Defence and Space, Amossys, EDF, Orange, La Poste, Nokia, Société Générale and the Regional Council of Brittany. It has been acknowledged by the Center of excellence in Cybersecurity.