# Chaotic Masking Protocol for Secure Communication and Attack Detection in Remote Estimation of Cyber-Physical Systems

Tao Chen, Andreu Cecilia, Daniele Astolfi, Lei Wang, Zhitao Liu, Hongye Su

► To cite this version:

Tao Chen, Andreu Cecilia, Daniele Astolfi, Lei Wang, Zhitao Liu, et al. Chaotic Masking Protocol for Secure Communication and Attack Detection in Remote Estimation of Cyber-Physical Systems. 4th IFAC Conference of Modelling, Identification and Control of Nonlinear Systems, IFAC, Sep 2024, Lyon, France. pp.79-84, 10.1016/j.ifacol.2024.10.146. hal-04989463

HAL Id: hal-04989463

https://hal.science/hal-04989463v1

Submitted on 13 Mar 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Chaotic Masking Protocol for Secure
Communication and Attack Detection in
Remote Estimation of Cyber-Physical
Systems

Tao Chen* Andreu Cecilia ** Daniele Astolfi *** Lei Wang*
Zhitao Liu* Hongye Su*

* College of Control Science and Engineering, Zhejiang University, P.R. China
(e-mail: tao_chen; lei.wangzju; ztliu; hysu69@zju.edu.cn)

** Universitat Politècnica de Catalunya, Avinguda Diagonal, 647, 08028
Barcelona, Spain. (e-mail: andreu.cecilia@upc.edu)

*** Univ. Lyon, Université Claude Bernard Lyon 1, CNRS, LAGEPP UMR 5007,
F-69100 Villeurbanne, France (e-mail: daniele.astolfi@univ-lyon1.fr)

**Abstract:** In remote estimation of cyber-physical systems, the sensor measurement transmitted through network may be attacked by adversaries, leading to leakage risk of privacy (e.g., the system state), and/or failure of the remote estimator. To deal with this problem, a chaotic masking protocol is proposed in this paper to secure the sensor measurement transmission. In detail, at the plant side, a chaotic dynamic system is deployed to encode the sensor measurement, and at the estimator side, an estimator estimates both states of the physical plant and the chaotic system. This protocol can deal with multiple types of attacks, i.e., eavesdropping attack, replay attack, and stealthy false data injection attack.

**Keywords:** Cyber-physical systems, secure estimation, chaotic masking, attack detection.

# 1. INTRODUCTION

Integrating technologies including control, communica-
tion, and computation, cyber-physical systems (CPSs)
exhibit a substantial promise. Nevertheless, the complex
intricate nature of these systems, notably the network-
based data transmission, exposes them to vulnerabilities
and potential security breaches.

In CPSs, a remote estimator uses data collected remotely
to estimate the state of a physical plant, enabling remote
monitor and control. There exist multiple attack strategies
for the remote estimation problem, such as eavesdropping
attack (Shang and Chen, 2022), replay attack (Liu et al.,
2021), and false data injection (FDI) attack (Guo et al.,
2017). To deal with eavesdropping attack, the privacy of
the transmitted information should be enhanced. To deal

with replay attack and FDI attacks, the method to detect
them plays a fundamental role.

For protecting the transmitted data and assisting at-
tack detection, watermark-based and encode-decode-based
methods are widely studied. In general, watermarks are
random noises added to the control input to increase the
detection probability of replay and FDI attacks (Liu et al.,
2021; Naha et al., 2023). Unlike watermarks that would
increase control costs (Naha et al., 2023; Chen et al.,
2023b), encode-decode methods use random numbers to
encode the information to be transmitted and decode it
at the receiver's side, e.g., (Shang and Chen, 2022; Guo
et al., 2022; Miao et al., 2016), and would not affect the
system performance.

To ensure accurate decoding of sensor measurement, syn-
chronization of the encoding and decoding pair is essential.
However, in most researches, e.g., (Shang and Chen, 2022;
Guo et al., 2022; Miao et al., 2016), the encoding and de-
coding pair is obtained by pseudo-random number evolved
at plant and controller side, respectively, and there is no
explicit method to synchronize the pair. In (Joo et al.,
2020), chaotic oscillators are used to generate coding and
decoding signals at plant and estimator side, and there
needs a secure channel to synchronize the oscillators.

In (Cecilia et al., 2023), a quasi-periodic signal is used to
encode (mask) the sensor measurement, and a washout
filter (Wang et al., 2020) is used to remove the masking
signal. With this masking protocol, the privacy is pro-
tected and any FDI attack in the communication channel
can be detected. It is worth mentioning that this protocol

<footnote n="1">¹ This research was in part supported by the National Natural
Science Foundation of China under Grant No. 62203386, and Zhe-
jiang Provincial Natural Science Foundation of China under Grant
No. LZ23F030008. This research is carried out within the frame-
work of the EU-funded Recovery, Transformation and Resilience
Plan (Next Generation) through the project ACROBA and the
Spanish Ministry of Universities funded by the European Union -
NextGenerationEU (2022UPC-MSC-93823). This work is part of the
Project MAFALDA (PID2021-126001OB-C31) funded by MCIN/
AEI /10.13039/501100011033 and by "ERDF A way of making
Europe". This work is part of the project MASHED (TED2021-
129927B-I00), funded by MCIN/ AEI/10.13039/501100011033 and
by the European Union Next GenerationEU/PRTR. This work has
been also partially founded by the ANR project Alligator (ANR-22-
CE48-0009-01).</footnote>
does not need additional secure communication links for synchronization. Inspired by this result, in this work we use chaotic signal to encode the sensor measurement. To decode the sensor measurement, an estimator combining with the dynamics of the chaotic system is designed.

The main contribution is summarized as follows:

* This paper proposes a novel chaotic masking protocol that secures the sensor-estimator communication channel. The protocol is proven to be effective against multiple attack types, including eavesdropping, replay, and false data injection attacks.

* Similar to the coding-decoding mechanisms, the proposed protocol can recover the sensor outputs completely, without compromising estimation performance. Notably, unlike most coding-decoding mechanisms, the proposed protocol does not require an additional secure communication channel to synchro- nize the masking and de-masking pair.

**Notation.** We denote by $\mathbb{R}$ the set of real numbers, $\mathbb{C}$ the set of complex numbers, $\mathbb{R}^n$ the set of real space of $n$ dimension for any positive integer $n$. For a variable $x \in \mathbb{R}^n$, $x_i$ denotes the $i^{th}$ element of $x$. $x^\tau$ denotes the delayed signal, i.e., $x^\tau := x(t - \tau)$. Given $x \in \mathbb{R}$, $\sigma \in \mathbb{R}_{\ge 0}$, define $\text{sat}_\sigma(x) := \max\{-\sigma, \min\{\sigma, x\}\}$. Given $x \in \mathbb{R}^n$, $\sigma := (\sigma_1, ..., \sigma_n) \in \mathbb{R}_{\ge 0}^n$, define $\text{sat}_\sigma(x) := (\text{sat}_\sigma(x_1), ..., \text{sat}_\sigma(x_n))$. For $A \in \mathbb{R}^{n \times n}$, $A^\top$ denotes the transpose of matrix $A$, $A$ is called a Hurwitz matrix if all of its eigenvalues have negative real parts, and $\rho_{\max}(A)(\rho_{\min}(A))$ denotes the maximum (minimum) eigenvalue of a symmetric matrix $A$. $I_{n \times n}$ denotes identity matrix of dimension $n \times n$. For column vectors $x \in \mathbb{R}^m$ and $y \in \mathbb{R}^n$, $\text{col}(x, y) := [x^\top, y^\top]^\top$.

## 2. PROBLEM FORMULATION

### 2.1 Remote Estimator

Consider linear systems of the form

$$ \Sigma_p: \begin{cases} \dot{x} = Ax + Bu \\ y = Cx, \end{cases} \quad (1) $$

where $x \in \mathbb{R}^{n_x}$ is the system state, $u \in \mathbb{R}^{n_u}$ is the known input signal, and $y \in \mathbb{R}^{n_y}$ is the sensor measurement. For monitoring or control purposes, the sensor measurement $y$ is assumed to be transmitted through wireless networks to a remote estimator of the form

$$ \Sigma_e: \begin{cases} \dot{x} = A\hat{x} + Bu + L(y - \hat{y}) \\ \hat{y} = C\hat{x}. \end{cases} \quad (2) $$

It is well known that if $L$ is chosen such that $A - LC$ is Hurwitz, the estimation error converges to zero.

In this paper, to detect abnormal data from the received sensor measurement, the following innovation-based abnormal detector (Mehra and Peschon, 1971; Pasqualetti et al., 2013) is deployed along with the estimator as

$$ g(z) := z^\top z \underset{H_0}{\overset{H_1}{\gtrless}} \nu \quad (3) $$

where $z = y - \hat{y}$, $H_0$ means that no alarm is triggered, $H_1$ means that the detector alarms, and $\nu$ is a threshold implemented to avoid false alarms induced by sensor and/or channel noise.

In this paper, we consider that the transmission network may be attacked by adversaries, leading to leakage risk of private data (e.g., the system state), and/or failure of the remote estimator by maliciously modifying the transmitted information. Specifically, we are mainly interested in following three types of attacks.

i) **Eavesdropping attack.** The adversary has access to the transmitted information over the wireless network, and aims to eavesdrop the information of system states.

ii) **Replay attack.** The adversary records the normal sensor data and replay them in sensor-controller channel when injecting false data into the controller-actuator channel, destroying the plant while avoid being detected by detector (3).

iii) **Stealthy data injection attack.** The adversary modifies the transmitted information over the wireless network by adding stealthy signals $\{a\}$ such that the remote estimator fails while avoid being detected by detector (3).

The main purpose of this paper is securing the communication channel by protecting the transmission signal $y$. Specially, the security refers to

i) Prevent eavesdropper from estimating $x$ by using $y$ and the information of the linear system $\Sigma_p$.

ii) Invalidate the replay attack strategy.

iii) Destroy the stealthiness of the data injection attack.

## 3. PROTECTION WITH CHAOTIC MASKING

### 3.1 Masking Approach

To secure the communication channel, a chaotic signal is used to mask the sensor measurement $y$, i.e.,

$$ y := y + d, $$

where $d$ is the chaotic signal to be designed. After that, the masked sensor measurement $y$ is transmitted in the channel, instead of transmitting $y$ directly.

The chaotic signal is generated by a chaotic system of the following form

$$ \Sigma_c: \begin{cases} \dot{\xi} = \Phi\xi + \varphi(\xi) \\ d = \Lambda\xi \end{cases} \quad (4) $$

where $\xi \in \Xi \subset \bar{\Xi} \subset \mathbb{R}^{n_\xi}$ is the state of chaotic system, with $\Xi$ being a compact forward invariant set for the chaotic dynamics. $\bar{\Xi}$ is a hypercube containing $\Xi$, with the center of $\bar{\Xi}$ being $0_{n_\xi}$ and the length of its $i^{th}$ edge being $2\sigma_i$, where

$$ \sigma_i := \max_{\xi} |\xi_i|, \quad \xi \in \Xi, \quad (5) $$

which is illustrated in Fig. 1 in the case $n_\xi = 2$. It is assumed that the mapping $\varphi(\xi)$ is locally Lipschitz, i.e.,

$$ \|\varphi(\xi_1) - \varphi(\xi_2)\| \le \ell_\varphi \|\xi_1 - \xi_2\|, \quad \forall \xi_1, \xi_2 \in \bar{\Xi} \quad (6) $$

for some positive constant $\ell_\varphi$, which is related to $\Xi$. It is further assumed that the model of the chaotic system, i.e., $\Phi, \varphi(\cdot)$ and $\Lambda$ are known for remote estimator, but unknown to the potential adversaries.

Finally, by letting $x := \text{col}(\xi, x)$, the plant $\Sigma_p$ and the chaotic masking system $\Sigma_c$ are compactly rewritten as
$$ \Sigma_P := \begin{cases} \dot{\mathbf{x}} = \mathbf{A}\mathbf{x} + \mathbf{B}\mathbf{u} + \mathbf{G}(\xi) \\ \mathbf{y} = \mathbf{C}\mathbf{x}. \end{cases} \qquad (7) $$

where

$$ \mathbf{A} := \begin{bmatrix} \Phi & 0 \\ 0 & A \end{bmatrix}, \mathbf{B} := \begin{bmatrix} 0 \\ B \end{bmatrix}, \mathbf{G}(\xi) := \begin{bmatrix} \varphi(\xi) \\ 0 \end{bmatrix}, \mathbf{C} := [\Lambda \ C]. $$

Note that since $\varphi(\xi)$ is locally Lipschitz, $\mathbf{G}(\xi)$ is also locally Lipschitz with the same constant $\ell_{\varphi}$.

<figure><img src="image_2.png" /><figcaption>Fig. 1. Representation of the set $\Xi$ and $\bar{\Xi}$ in $\mathbb{R}^2$.</figcaption></figure>

Before ending this subsection, we show an example of chaotic system in the form of (4) and satisfying (6).

**Example.** (Rössler prototype-4 system) Consider the following system

$$ \begin{aligned} \dot{\xi}_1 &= -\xi_2 - \xi_3 \\ \dot{\xi}_2 &= \xi_1 \\ \dot{\xi}_3 &= a(\xi_2 - \xi_2^2) - b\xi_3 \end{aligned} \qquad (8) $$

which is chaotic when $a = b = 0.5$, as shown in Fig. 2. This system can be rewritten in the form given by (4), where $\xi = \text{col}(\xi_1, \xi_2, \xi_3)$,

$$ \Phi := \begin{bmatrix} 0 & -1 & -1 \\ 1 & 0 & 0 \\ 0 & 0.5 & -0.5 \end{bmatrix}, \quad \varphi(\xi) := \begin{bmatrix} 0 \\ 0 \\ -0.5\xi_2^2 \end{bmatrix}. $$

A numerical simulation, see Fig. (2), confirms that there exists a compact invariant set $\bar{\Xi}$. In addition, the function $\varphi(\xi)$ is polynomial hence locally lipschitz. $\square$

<figure><img src="image_3.png" /><figcaption>Fig. 2. Rössler prototype-4 system from Eq. (8) for $a = b = 0.5$ with initial condition $\xi(0) = [0.1, 0.3, 0]^T$.</figcaption></figure>

## 3.2 De-masking Approach

The de-masking of sensor measurement $y$ is achieved by estimating the extended system $\Sigma_P$. For this purpose, an extended observer is designed as

$$ \Sigma_E := \begin{cases} \dot{\mathbf{x}} = \mathbf{A}\dot{\mathbf{x}} + \mathbf{B}\mathbf{u} + \mathbf{G}(\text{sat}_\sigma(\hat{\xi})) + \mathbf{L}(\mathbf{y} - \hat{\mathbf{y}}) \\ \hat{\mathbf{y}} = \mathbf{C}\dot{\mathbf{x}} \end{cases} \qquad (9) $$

where $\sigma_i$ is calculated in (5).

Comparing $\Sigma_P$ and $\Sigma_E$ and letting $\tilde{\mathbf{x}} := \mathbf{x} - \hat{\mathbf{x}}$ be the estimation error, we have

$$ \dot{\tilde{\mathbf{x}}} = (\mathbf{A} - \mathbf{L}\mathbf{C})\tilde{\mathbf{x}} + \mathbf{G}(\xi) - \mathbf{G}(\text{sat}_\sigma(\hat{\xi})). \qquad (10) $$

The following proposition gives the sufficient condition that $\tilde{\mathbf{x}} = 0$ of system (10) is exponentially stable.

**Proposition 1.** For all $x \in \mathbb{R}^{n_x}$ and $\xi \in \Xi$, suppose that there exist symmetric positive definite matrix $\mathbf{P} \in \mathbb{R}^{(n_x+n_{\xi}) \times (n_x+n_{\xi})}$ and matrix $\mathbf{N} \in \mathbb{R}^{(n_x+n_{\xi}) \times n_y}$ satisfying

$$ \left[ \mathbf{P}\mathbf{A} + \mathbf{A}^{\top}\mathbf{P} - \mathbf{N}\mathbf{C} - \mathbf{C}^{\top}\mathbf{N}^{\top} + \begin{bmatrix} I \\ 0 \end{bmatrix} \mathbf{P} - \ell_{\varphi}^{-2}I \right] < 0. \qquad (11) $$

Then, the equilibrium point $\tilde{\mathbf{x}} = 0$ of system (10) is exponentially stable.

*Proof.* Define Lyapunov candidate $V := \tilde{\mathbf{x}}^{\top}\mathbf{P}\tilde{\mathbf{x}}$. We have

$$ \dot{V} = \tilde{\mathbf{x}}^{\top}(\mathbf{P}(\mathbf{A} - \mathbf{L}\mathbf{C}) + (\mathbf{A} - \mathbf{L}\mathbf{C})^{\top}\mathbf{P})\tilde{\mathbf{x}} + 2\tilde{\mathbf{x}}^{\top}\mathbf{P}(\mathbf{G}(\xi) - \mathbf{G}(\text{sat}_{\sigma}(\hat{\xi}))). \qquad (12) $$

Since $\text{sat}_{\sigma}(\hat{\xi})$, $\xi \in \bar{\Xi}$, according to (6) and Young's inequality, we have

$$ 2\tilde{\mathbf{x}}^{\top}\mathbf{P}(\mathbf{G}(\xi) - \mathbf{G}(\text{sat}_{\sigma}(\hat{\xi}))) \leq \ell_{\varphi}^2\mathbf{x}^{\top}\mathbf{P}\mathbf{x} + \tilde{\xi}^{\top}\tilde{\xi}. $$

Then (12) becomes

$$ \begin{aligned} \dot{V} &\leq \tilde{\mathbf{x}}^{\top}(\mathbf{P}(\mathbf{A} - \mathbf{L}\mathbf{C}) + (\mathbf{A} - \mathbf{L}\mathbf{C})^{\top}\mathbf{P} + \ell_{\varphi}^2\mathbf{P}\mathbf{P})\tilde{\mathbf{x}} + \tilde{\xi}^{\top}\tilde{\xi} \\ &= \tilde{\mathbf{x}}^{\top}\left[\mathbf{P}(\mathbf{A} - \mathbf{L}\mathbf{C}) + (\mathbf{A} - \mathbf{L}\mathbf{C})^{\top}\mathbf{P} + \ell_{\varphi}^2\mathbf{P}\mathbf{P} + \begin{bmatrix} I \\ 0 \end{bmatrix}\right]\tilde{\mathbf{x}}. \end{aligned} $$

Applying the Schur complement to inequality (11) with $Y = \mathbf{PL}$, we obtain

$$ \mathbf{P}(\mathbf{A} - \mathbf{L}\mathbf{C}) + (\mathbf{A} - \mathbf{L}\mathbf{C})^{\top}\mathbf{P} + \ell_{\varphi}^2\mathbf{P}\mathbf{P} + \begin{bmatrix} I \\ 0 \end{bmatrix} < 0, \qquad (13) $$

implying that there exist some negative definite matrix $Q$ such that

$$ \dot{V} \leq \tilde{\mathbf{x}}^{\top} Q \tilde{\mathbf{x}}. \qquad (14) $$

Recalling the positive definiteness of quadratic function $V$, we conclude that $\tilde{\mathbf{x}} = 0$ of (10) is exponentially stable. $\square$

## 3.3 Sufficient Conditions for the Existence of P and N

In the following, we will give a sufficient condition such that there exist $\mathbf{P}$ and $\mathbf{N}$ such that LMI (11) holds. Before doing so, a definition is given for systems of form

$$ \begin{aligned} \dot{x} &= Ax + \phi(x) \\ y &= Cx. \end{aligned} \qquad (15) $$

**Definition 1.** (Rajamani and Cho, 1998) *Distance to unobservability:* The distance to unobservability of the pair $(A, C)$ for $A \in \mathbb{R}^{n \times n}$ and $C \in \mathbb{R}^{p \times n}$, is defined as the magnitude of the smallest perturbation $(E, F) \in \mathbb{C}^{n \times n} \times \mathbb{C}^{n \times n}$ that makes the pair $(A + E, C + F)$ unobservable. Specifically, this is the quantity

$$ \delta(A, C) = \inf_{(A+E, C+F) \text{ unobservable}} \|(E, F)\|_2. $$

**Proposition 2.** If the distance to unobservability of the pair $(\mathbf{A}, \mathbf{C})$ is larger than the Lipschitz constant $\ell_{\varphi}$, then there exist $\mathbf{P}$ and $\mathbf{N}$ such that LMI (11) holds.

The proof of this proposition can be done by the fact that the existence of $\mathbf{P}$ and $\mathbf{L}$ for inequality

$$ \mathbf{P}(\mathbf{A} - \mathbf{L}\mathbf{C}) + (\mathbf{A} - \mathbf{L}\mathbf{C})^{\top}\mathbf{P} + \ell_{\varphi}^2\mathbf{P}\mathbf{P} + I < 0 \qquad (16) $$

is sufficient for the existence of $\mathbf{P}$ and $\mathbf{L}$ satisfying inequality (13), i.e., (11), and the conditions in this proposition is
sufficient for the existence of P and L satisfying inequality (16) (Rajamani and Cho, 1998).

# 4. DEFENSE OF EAVESDROPPING ATTACK

## 4.1 Eavesdropping Attack

In this section, we assume that an eavesdropper has access to the communication channel and has full information of the system model, i.e., {A, B, C}, but no access to the chaotic masking system (4).

It is clear that the attacker can successfully eavesdrop the states of the plant (1), i.e., $\lim_{t \to \infty} |x - \hat{x}^a| = 0$, by the following estimator

$$ \Sigma_{\text{eav}}: \begin{cases} \dot{\hat{x}}^a = A\hat{x}^a + Bu + \bar{L}(y - \hat{y}^a) \\ \hat{y}^a = C\hat{x}^a \end{cases} \quad (17) $$

where $\bar{L}$ can be any matrix such that $A - \bar{L}C$ is Hurwitz.

## 4.2 Eavesdropping Error Caused by Chaotic Masking

In this section we aim at showing that in the presence of the proposed chaotic masking protocol, the eavesdroppers' estimator $\Sigma_{\text{eav}}$ would fail to estimate the states of the plant.

Since the outputs of a chaotic system cannot be synchronized without the full knowledge of its specific class and associated internal parameters (Joo et al., 2020), the chaotic signal added on the sensor measurement is seen as bounded disturbance.

The following proposition presents the estimation error of estimator $\Sigma_{\text{eav}}$, whose proof is straightforward and thus omitted for simplicity.

**Proposition 3.** Consider system $\Sigma_p$ with chaotic masking, the eavesdropper with estimator $\Sigma_{\text{eav}}$ can only guarantee that the estimation error

$$ \|e(t)\| \le \frac{2\lambda_{\max}^2(S)\|L\|}{\lambda_{\min}(S)} \|d\|_{\infty} \quad (18) $$

where S is the solution of the Lyapunov equation $S(A - LC) + (A - LC)^T S = -I$.

It is worth noting that the privacy level of the system can be increased by designing chaotic signals such that the amplitude of d is large.

# 5. DEFENSE OF REPLAY ATTACK

## 5.1 Replay Attack

The considered replay attack strategy is given as follows. $\Sigma_{\text{replay}}$:

(1) From time $-\tau$ to time 0, the attacker records a sequence of sensor measurement $y$.

(2) From time 0 to time $\tau$, the attacker replays the recorded sensor measurements to tamper the true sensor outputs, i.e.,

$$ y^a(t) = y(t - \tau), \quad 0 \le t \le \tau. \quad (19) $$

Meanwhile, arbitrary harmful attack sequence is injected into the control channel to destroy the plant.

For simplicity, suppose that $u = -K\hat{x}$ with $A - BK$ Hurwitz. In addition, we assume that the control system has already arrived a steady state before time $-\tau$.

The following proposition shows the fact that the replay attack is unable to be detected without masking.

**Proposition 4.** Consider system $\Sigma_p$ and estimator $\Sigma_e$, that is, the case without any security mechanism. Assume that the system and the observer have already reached their steady state before a time $t = -\tau$ for some positive constant $\tau > 0$, that is, $x(-\tau) = \hat{x}(-\tau)$. Moreover, assume that $A - BK - LC$ is Hurwitz. Then, the innovation term $z := y - \hat{y}$ satisfies $z(t) = 0, \forall t \ge 0$ under the replay attack $\Sigma_{\text{replay}}$.

*Proof.* The proof can be obtained by the fact that $x^\tau = x$ in steady state, which implies that $y^a = y^\tau = y$. As a result, the attacked sensor measurement is identical to the normal data and the replay attack is not detected. □

## 5.2 Invalidating the Replay Attack Strategy

In the above subsection, the replay attack strategy relies on the fact that the physical plant stays at an equilibrium point in steady state. With chaotic masking, the extended system $\Sigma_p$ contains chaotic dynamics and has a more complex steady-state behavior, which is no longer an equilibrium, periodic oscillation, or almost-periodic oscillation. Consequently, any replay attack strategy will increase, at least during a transient time, the innovation term $z := y - \hat{y}$. This fact is formalized in the next proposition.

**Proposition 5.** Consider the extended system $\Sigma_p$ and the extended estimator $\Sigma_e$, that is, the case with chaotic masking. Assume that the extended system and the extended observer have reached their steady state before a time $-\tau$, that is, $x(-\tau) = \hat{x}(-\tau)$. Consider the replay attack $\Sigma_{\text{replay}}$, then, the innovation $z := y - \hat{y}$ cannot be zero for all $t$ such that $0 \le t \le \tau$.

*Proof.* The extended system from $-\tau$ to zero can be described in the following form

$$ \begin{aligned} \dot{\hat{x}}^\tau &= A\hat{x}^\tau + B(-Kx^\tau) + G(\xi^\tau) \\ \hat{y}^\tau &= C\hat{x}^\tau. \end{aligned} $$

The steady-state observer is

$$ \begin{aligned} \dot{\hat{x}}^\tau &= A\hat{x}^\tau + B(-Kx^\tau) + G(\text{sat}_\sigma(\hat{\xi}^\tau)) + Lz^\tau \\ \hat{y}^\tau &= C\hat{x}^\tau \end{aligned} $$

with $z^\tau = y^\tau - \hat{y}^\tau$.

When the observer is under replay attack ($0 \le t \le \tau$), it becomes

$$ \begin{aligned} \dot{\hat{x}}^a &= A\hat{x}^a + B(-Kx^a) + G(\text{sat}_\sigma(\hat{\xi}^a)) + Lz^a \\ \hat{y}^a &= C\hat{x}^a \end{aligned} \quad (20) $$

with $z^a = y^a - \hat{y}^a = y^\tau - \hat{y}^\tau$.

The following proof is by contradiction. If $z^a \equiv 0$ for all $t$ such that $0 \le t \le \tau$, the replay attack does not affect (20) and we have $\hat{x}^a(t) = \hat{x}(t)$ for $0 \le t \le \tau$. Consequently,

$$ z^a \equiv 0 \Leftrightarrow y^\tau - \hat{y}^a \equiv 0 \Leftrightarrow Cx^\tau \equiv C\hat{x}^a \Leftrightarrow Cx^\tau \equiv C\hat{x}. $$

Since the estimator has already reached steady state, we have $\hat{x} = x$, and hence we can deduce $Cx^\tau(t) \equiv Cx(t)$, $0 \le t \le \tau$, implying (since $x$ is instantaneously observable)
$$ \mathbf{x}^{\mathrm{T}}(t) \equiv \mathbf{x}(t), \quad 0 \le t \le \tau, $$

which contradicts with the fact that $\mathbf{x}$ is chaotic, that is, non-periodic. □

# 6. DEFENSE OF STEALTHY DATA INJECTION ATTACK

## 6.1 Stealthy Data Injection Attack

For simplicity, we suppose $u = 0$. To launch stealthy data injection attack, we suppose that the attack has access to the system information $\{A, B, C, L\}$ and can inject arbitrary $\{a\}$ into the sensor measurement. With stealthy data injection attack, the unprotected estimator $\Sigma_e$ becomes

$$ \begin{aligned} \dot{\hat{x}}^a &= A\hat{x}^a + L(y^a - \hat{y}^a) \\ \hat{y}^a &= C\hat{x}^a \end{aligned} \qquad (21) $$

where $y^a = y + a$ with $a$ is the attack injected by adversaries. Define estimation difference $\Delta\hat{x} := \hat{x}^a - \hat{x}$ and innovation difference $\Delta z := z^a - z$. Comparing $\Sigma_e$ with (21), we have

$$ \begin{aligned} \Delta\dot{\hat{x}} &= (A - LC)\Delta\hat{x} + La \\ \Delta z &= -C\Delta\hat{x} + a. \end{aligned} \qquad (22) $$

According to the triangular inequality $\|z^a\| \le \|z\| + \|\Delta z\|$, if $\|\Delta z\|$ is small, the detector cannot distinguish between $z^a$ and $z$ with high probability. Consequently, the detection rate of detector (3) is close to its false alarm rate. Hence the attack is assumed to be stealthy if

$$ \|\Delta z\| \le M. \qquad (23) $$

Based on (23), stealthy attack against remote estimator is designed as

$$ \Sigma_{\mathrm{FDI}} : a = C\Delta\hat{x} + \theta. \qquad (24) $$

It is noted that, without chaotic masking, $\Delta\hat{x}$ can be obtained by (22) with $\Delta\hat{x}(0) = 0$. By choosing $\theta$ as any time-varying functions satisfying $\|\theta\| \le M$, $\Sigma_{\mathrm{FDI}}$ is stealthy in the sense of (23). In addition, by specific design of $\theta$, one can regulate the estimation difference to some prescribed values (Chen et al., 2023a) or maximize it (Ning et al., 2023).

## 6.2 Destroying the Stealthiness of Data Injection Attack

In this subsection, we will show that, with chaotic masking, $\Sigma_{\mathrm{FDI}}$ is no more stealthy.

With chaotic masking, the extended estimator under stealthy attack becomes

$$ \begin{aligned} \dot{\hat{\mathbf{x}}}^a &= \mathbf{A}\hat{\mathbf{x}}^a + \mathbf{G}(\mathrm{sat}_{\sigma}(\hat{\xi}^a)) + \mathbf{L}(\mathbf{y}^a - \hat{\mathbf{y}}^a) \\ \hat{\mathbf{y}}^a &= \mathbf{C}\hat{\mathbf{x}}^a. \end{aligned} \qquad (25) $$

Let $\mathbf{z} := \mathbf{y} - \hat{\mathbf{y}}$, $\Delta\hat{\mathbf{x}} := \hat{\mathbf{x}}^a - \hat{\mathbf{x}}$ and $\Delta\mathbf{z} := \mathbf{z}^a - \mathbf{z}$. According to $\Sigma_E$ and (25), we have

$$ \begin{aligned} \Delta\dot{\hat{\mathbf{x}}} &= (\mathbf{A} - \mathbf{L}\mathbf{C})\Delta\hat{\mathbf{x}} + \mathbf{G}(\mathrm{sat}_{\sigma}(\hat{\xi}^a)) - \mathbf{G}(\mathrm{sat}_{\sigma}(\hat{\xi})) + \mathbf{L}\mathbf{a} \\ \Delta\mathbf{z} &= -\mathbf{C}\Delta\hat{\mathbf{x}} + \mathbf{a}. \end{aligned} \qquad (26) $$

Since the term $\mathbf{C}\Delta\hat{\mathbf{x}}$ contains both $\Delta\hat{x}$ and $\Delta\hat{\xi}$, it is unlikely to be offset by $\Delta\hat{x}$ in $\Sigma_{\mathrm{FDI}}$. As a result, attack $\Sigma_{\mathrm{FDI}}$ cannot guarantee that $\|\Delta\mathbf{z}\| = \| -\mathbf{C}\Delta\hat{\mathbf{x}} + \mathbf{C}\Delta\hat{x} + \theta\| \le M$. In other words, $\Sigma_{\mathrm{FDI}}$ is no more stealthy.

In addition, since the system (26) is input-to-output stable from $a$ to $\Delta\mathbf{z}$ (this fact can be verified by (Khalil, 2002, Theorem 5.1) by taking $V = \Delta\hat{\mathbf{x}}^{\mathrm{T}}\mathbf{P}\Delta\hat{\mathbf{x}}$), there exist some $\kappa$ such that if $\|a\| \le \kappa$, we have $\|\Delta\mathbf{z}\| \le M$. In other words, the attack may still be designed small enough to make sure the attack is stealthy. However, the supremum of $\kappa$ may be too small to launch any significant attacks, and, it is hard for a potential attacker to estimate the supremum of $\kappa$ without any information of $\Phi$.

# 7. SIMULATION VERIFICATION

The model used in the simulation is an longitudinal axis motion of the B747-100/200 aircraft (Franzè et al., 2021) with output matrix takes

$$ C = \begin{bmatrix} 1 & 0 & 0 & 1 \\ 0 & 0 & 1 & 1 \end{bmatrix}. $$

To mask the sensor measurement, we use the Rössler prototype-4 system with

$$ \dot{\xi}' = \begin{bmatrix} 0 & -1 & -100 \\ 1 & 0 & 0 \\ 0 & 50 & -0.5 \end{bmatrix} \xi' + \begin{bmatrix} 0 \\ 0 \\ -\frac{0.5}{\beta} \bar{y}^2 \end{bmatrix}, \quad \Lambda = \begin{bmatrix} 1 & 0 & 0 \\ 0 & 2 & 1 \end{bmatrix}. $$

For the above chaotic system, $\ell_{\varphi}$ is estimated as $\ell_{\varphi} = 0.025$. In addition, the distance to unobservability of $(\mathbf{A}, \mathbf{C})$ is about 0.3 (the way for computing distance to unobservability can be find in (Rajamani and Cho, 1998)), implying that (11) is solvable.

<figure><img src="image_4.png" /><figcaption>Fig. 3. Simulation results without attack. (a)-(c) The chaotic signal and their corresponding estimations. (d) The norm of estimation error of the physical plant.</figcaption></figure>

The simulation results without attack are given in Fig. 3, where both chaotic dynamic and physical plant are well estimated, verifying the effectiveness of the proposed masking and de-masking method.

The simulation result under eavesdropping attack is given in Fig. 4, from which we can see that if the sensor measurement is not protected, the eavesdropping error converges to zero, whereas the eavesdropping error is large and does not converge if the sensor measurement is masked.
<figure><img src="image_5.png" /><figcaption>Fig. 4. The eavesdropping error with and without masking protocol.</figcaption></figure>

<figure><img src="image_6.png" /><figcaption>Fig. 5. The innovation under replay attack.</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>Fig. 6. The innovation under FDI attack.</figcaption></figure>

The simulation result under replay attack is given in Fig. 5. We can find that, if without masking, the innovation maintains 0 when replay attack launches, whereas the innovation jumps with masking, implying that the replay can be detected.

The simulation result under FDI attack is given in Fig. 6, where *M* is supposed as 0.5. If the measurement is not protected, the FDI Σ<sub>FDI</sub> attack satisfies the stealthy condition (23). However, if the sensor measurement is masked, the FDI attack is no longer stealthy.

8. CONCLUSION

In this paper, a chaotic masking protocol has been pro-
posed to secure the remote estimator. Since an extended
estimator was designed to estimate both chaotic states
and physical system states, the masking protocol does not
require extra communication to synchronize the masking-
damasking pair and its effect can be perfectly removed. To
verify the effectiveness of the proposed chaotic masking
protocol, three types of attacks were considered. Future
works will focus on extending the proposed framework
to mask non-linear systems and to protect whole control
system loops.

REFERENCES

Cecilia, A., Astolfi, D., Casadei, G., Costa-Castelló, R., and Nešić, D. (2023). A masking protocol for private communication and attack detection in nonlinear observers. In *2023 62nd IEEE Conference on Decision and Control (CDC)*, 7495–7500. IEEE.

Chen, T., Wang, L., Liu, Z., Wang, W., and Su, H. (2023a). Optimal stealthy attack to remote estimator for estimation error regulation. In *2023 American Control Conference (ACC)*, 1998–2003. IEEE.

Chen, T., Wang, L., Ren, X., Liu, Z., and Su, H. (2023b). Replay attack detection for cyber-physical systems with sensitive states. In *2023 62nd IEEE Conference on Decision and Control (CDC)*, 2821–2826. IEEE.

Franzè, G., Lucia, W., and Tedesco, F. (2021). Resilient model predictive control for constrained cyber-physical systems subject to severe attacks on the communication channels. *IEEE Transactions on Automatic Control*, 67(4), 1822–1836.

Guo, H., Pang, Z., Sun, J., and Li, J. (2022). Detection of stealthy false data injection attacks against cyber-physical systems: A stochastic coding scheme. *Journal of Systems Science and Complexity*, 35(5), 1668–1684.

Guo, Z., Shi, D., Johansson, K.H., and Shi, L. (2017). Optimal linear cyber-attack on remote state estimation. *IEEE Transactions on Control of Network Systems*, 4(1), 4–13.

Joo, Y., Qu, Z., and Namerikawa, T. (2020). Resilient control of cyber-physical system using nonlinear encoding signal against system integrity attacks. *IEEE Transactions on Automatic Control*, PP(99), 1–1.

Khalil, H. (2002). Nonlinear systems. 3rd edition.

Liu, H., Mo, Y., and Johansson, K.H. (2021). Active detection against replay attack: A survey on watermark design for cyber-physical systems. In *Safety, Security and Privacy for Cyber-Physical Systems*, 145–171. Springer.

Mehra, R.K. and Peschon, J. (1971). An innovations approach to fault detection and diagnosis in dynamic systems. *Automatica*, 7(5), 637–640.

Miao, F., Zhu, Q., Pajic, M., and Pappas, G.J. (2016). Coding schemes for securing cyber-physical systems against stealthy data injection attacks. *IEEE Transactions on Control of Network Systems*, 4(1), 106–117.

Naha, A., Teixeira, A.M., Ahlén, A., and Dey, S. (2023). Quickest detection of deception attacks on cyber-physical systems with a parsimonious watermarking policy. *Automatica*, 155, 111147.

Ning, C., Xi, Z., and Zhang, X. (2023). Design of advanced false data injection attack in networked control systems. In *2023 American Control Conference (ACC)*, 1958–1965. IEEE.

Pasqualetti, F., Dörfler, F., and Bullo, F. (2013). Attack detection and identification in cyber-physical systems. *IEEE transactions on automatic control*, 58(11), 2715–2729.

Rajamani, R. and Cho, Y.M. (1998). Existence and design of observers for nonlinear systems: Relation to distance to unobservability. *International Journal of Control*, 69(5), 717–731.

Shang, J. and Chen, T. (2022). Linear encryption against eavesdropping on remote state estimation. *IEEE Transactions on Automatic Control*.

Wang, L., Marconi, L., Wen, C., and Su, H. (2020). Pre-processing nonlinear output regulation with non-vanishing measurements. *Automatica*, 111, 108616.