An alternative procedure to cumulative sum for cyber-physical attack detection

Abstract

Motivated by the importance of change detection in cyber-physical systems security, an alternative procedure to the classical cumulative sum (CUSUM) algorithm is explored. By capitalizing on recent results appeared in the statistical literature, it is shown that superior performance can be obtained in terms of reaction time while being robust against parameter mismatches. In order to translate such quickest-detection-theoretic advances into practical system-engineering tools, a simple pseudocode is provided that ensures approximately flat response with respect to the change time. We believe the latter is a very important property that is missing in CUSUM-based detection approaches.