Abstract Intrusion detection is one of the key techniques for the security of industrial control systems. Most existing intrusion detection methods only detect the existence and type of attacks without a more specific description of the attacks. Knowing the specific waveform of the attack signals can greatly facilitate the design of defense strategy. This paper investigates the attack signal estimation for intrusion detection of actuator false data injection attacks. Taking advantage of extended state observer, the attack signal is described as system disturbance and can be estimated. We propose two attack signal estimators, i.e., linear attack signal estimator (LASE) and nonlinear attack signal estimator (NASE). Through the analysis in the frequency domain, the influence of the attack signal frequency on the estimation performance of LASE is obtained. Both simulation and experimental results illustrate that the proposed estimators can achieve good performance.

中文翻译：

---

工控系统入侵检测攻击信号估计

摘要 入侵检测是工业控制系统安全的关键技术之一。大多数现有的入侵检测方法只检测攻击的存在和类型，而没有对攻击进行更具体的描述。了解攻击信号的具体波形可以极大地方便防御策略的设计。本文研究了用于执行器虚假数据注入攻击的入侵检测的攻击信号估计。利用扩展状态观测器，攻击信号被描述为系统扰动并且可以被估计。我们提出了两种攻击信号估计器，即线性攻击信号估计器（LASE）和非线性攻击信号估计器（NASE）。通过频域分析，得到了攻击信号频率对LASE估计性能的影响。仿真和实验结果都表明，所提出的估计器可以实现良好的性能。