# Enhancing Unmanned Marine Vehicle Security: A Periodic Watermark-Based Detection of Replay Attacks
## 3 A Periodic Watermark-Based Detection of Replay Attacks
### Detection of Replay Attacks
\begin{split} g(k,m)&=(r^{e}(k,m))^{T}\Sigma_{r}^{-1 }r^{e}(k,m)\\ &=(r(k))^{T}\Sigma_{r}^{-1}r(k)\\ &=g(k)\end{split}  \tag{22}\]  
Assume compensatory signal \(\mathbb{Y}^{f}(m)\) is injected at time \(k\). It has been established that the chi-squared detection function for compensated residual matches the \(g(k)\) observed on the condition of no control quantity watermark is introduced. If at time \(k-1\), a control quantity watermark signal \(o(k-1)=o(i-1)\) was injected, and at time \(k\), the compensatory signal \(\mathbb{Y}^{f}(i)\) is introduced with \(j\
eq i\), then the measurement processed by the Kalman filter is as follows:  
\[ \begin{split} y^{e}(k,j)&=y^{e}(k)+\mathbb{Y}^{f}(j )\\ &=y^{e}(k)+\mathbb{Y}^{f}(k)+\mathbb{Y}^{f}(j)-\mathbb{Y}^{f}(k)\\ &=y^{e}(k)+\mathbb{Y}^{f}(i)+\mathbb{Y}^{f}(j)-\mathbb{Y}^{f}(i)\\ &=y(k)+\mathbb{Y}^{f}(j)-\mathbb{Y}^{f}(i)\end{split}  \tag{23}\]  
At this point, the residual \(r^{e}(k,j)\) is as follows:  
\[ \begin{split} r^{e}(k,j)&=y^{e}(k,j)-C\hat{x}^{e} (k|k-1)\\ &=y(k)+\mathbb{Y}^{s}(j)-\mathbb{Y}^{s}(i)-C\hat{x}^{e}(k,j)\\ &=y(k)-C\hat{x}(k|k-1)+\mathbb{Y}^{s}(j)-\mathbb{Y}^{s}(i)\\ &=r(k)+\mathbb{Y}^{s}(j)-\mathbb{Y}^{s}(i)\end{split}  \tag{24}\]  
The chi-squared detection signal based on the residual is defined as:  
\[ \begin{split} g(k,j)=&(r^{e}(k,m))^{T}\Sigma_{r}^{-1 }(r^{e}(k,j))\\ =&(r(k)+\mathbb{Y}^{f}(j)-\mathbb{Y}^{f}(i))^{T} \Sigma_{r}^{-1}(r(k)+\mathbb{Y}^{f}(j)-\mathbb{Y}^{f}(i))\\ =& r^{T}(k)\Sigma_{r}^{-1}r(k)+\Big{(}\mathbb{Y}^{f }(j)-\mathbb{Y}^{f}(i)\Big{)}^{T}\Sigma_{r}^{-1}(\mathbb{Y}^{f}(j)-\mathbb{Y}^{ f}(i))\\ =& g(k)+\Big{|}\Sigma_{r}^{-1}\Big{|}\Big{\|} \mathbb{Y}^{f}(j)-\mathbb{Y}^{f}(i)\Big{\|}^{2}_{2}\end{split}  \tag{25}\]Given that \(j\
eq i\) and the compensatory signals within the same period are distinct, it invariably holds that \(\left\|\mathbb{Y}^{f}(j)-\mathbb{Y}^{f}(i)\right\|_{2}^{2}>0\). Therefore, it is deduced that \(g(k,j)>g(k)=g(k,i)\). Based on Theorem 2, the following replay attack detection method can be devised. Commencing from moment \(t_{0}\), a periodic watermark signal is continuously injected into the control variable. At moment \(k-1\), this watermark signal is given by \(o(k-1)=o(i-1)\), where \(i=(k-t_{0})\mod T\). At moment \(k\), where \(k=t_{0}+nT+i\), and \(i\in[0,T-1]\), \(n\geq n_{0}\), the minimum value of the chi-squared detection function after incorporating different compensatory signals is denoted by:  
\[a(k)=\min_{m}g(k,m),\quad m=0,\ldots,T-1 \tag{26}\]  
A decision function is defined as:  
\[G(k)=a(k)-i \tag{27}\]  
In accordance with (27), the following hypothesis test is proposed: If \(G(k)=0\), UMVs are considered to be operating normally. Otherwise, UMVs are presumed to be under a replay attack. For a UMV system as depicted by (7), replay attacks can be detected to assume the delay of the replayed data is not an integer multiple of the watermark signal period, utilizing the approach described in this paper. It is established from Theorem 2 that during normal system operation at moment \(k=t_{0}+nT+i\), the compensatory signal \(\mathbb{Y}^{f}(m)\) that minimizes \(g(k)\) satisfies \(m=i\), with (26) yielding \(a(k)=m\). Therefore, under the scheme proposed in this paper, the detection signal during normal operation is \(G(k)=a(k)-i=m-i=0\). When a replay attack occurs at time \(k=t_{0}+nT+i\), where data from a normal state at time \(k_{1}=t_{0}+n_{1}T+m_{1}\) is replayed, the corresponding control quantity watermark of the replayed measurement signal is \(\Delta o(k_{1}-1)=\Delta o(m_{1}-1)\), with \(m_{1}=(k_{1}-t_{0})\mod T\). Given that the system operates normally at time \(k-1\), it follows that \(y^{\varepsilon}(k-1)=y(k-1)\), and \(\hat{\varepsilon}^{\varepsilon}(k|k-1)=\hat{\varepsilon}(k|k-1)\). According to Theorem 2, for the detection function to achieve a minimal value, the injected compensatory signal should be \(y^{f}(k_{1})=\mathbb{Y}^{f}(m_{1})\), resulting in \(a(k)=m_{1}\).