Short Interval Replay Attack Detection for Industrial Cyber-Physical Systems Based on Wavelet Coherence

Most of existing data-driven methods for industrial Cyber-Physical Systems (CPSs) replay attacks detection require an obvious difference between the replayed historical data and real current data. However, for short interval replay attacks, attackers replay data to the system instantly after they finish recording measurements, making it difficult to distinguish the normal data from the attacked data according to the slight variation of distance index. In this paper, we propose a coherence-based, which is between sensor measurements and control signals, detection scheme against short interval replay attacks. We first compute wavelet coherence between measurements and control signals. Two sample Kolmogorov-Smirnov test is employed to detect replay attacks according to the mean values of wavelet coherence between measurements and control signals. To deal with the noise of measurements, wavelet denoise is used to improve the detection performance. Simulation tests are demonstrated on a semi-physical simulation testbed. The experimental results illustrate that the proposed method can accurately detect not only short interval replay attacks but also long interval continuous replay attacks and intermittent replay attacks.