To improve cyber-resilience in CPS, recent efforts have focused on machine learning (ML)-based approaches for attack detection and state reconstruction [3-5]. Methods employing feedforward neural networks (FNNs), recurrent neural networks (RNNs), and Lyapunov-based MPC formulations have shown promise in detecting cyber-attacks and restoring corrupted measurements for system stabilization [6-8]. However, the effectiveness of these techniques can be limited in integrated process systems, where the complexity of inter-unit dependencies and recycles increases the difficulty of isolating and mitigating attacks. Highly integrated chemical processes involve complex interactions among unit operations, shared sensing infrastructures, and tightly coupled control loops [9,10]. In such environments, a localized cyber-attack on a single sensor can cascade through the network, affecting multiple downstream units and amplifying disruption. Traditional anomaly detection methods often fail in these settings due to their limited ability to model the dynamic interdependencies across subsystems.
This work presents a data-driven, transformer-based framework for detecting and identifying cyber-attacks in highly integrated process systems, focusing on the benzene alkylation benchmark process. The system includes five temperature sensors, which may be subjected to singular or simultaneous attacks. Two complementary approaches are proposed for cyber-incident detection and sensor compromise identification. The first approach employs a centralized self-attention transformer that processes sequences of historical sensor measurements to capture temporal patterns indicative of cyber-attacks [11]. This model performs joint detection and identification using a multi-label classification strategy, enabling both the detection of an attack event and the localization of compromised sensors. However, this joint task suffers from performance degradation due to class imbalance, particularly in scenarios involving multi-sensor attacks, which are relatively rare in the training data compared to single-sensor or no-attack instances.
To address this challenge, we propose a two-tier detection-identification architecture. The first tier uses an FNN trained as a binary classifier to detect the presence of an attack. Upon detection, the second tier—a self-attention transformer—identifies the compromised sensors through a multi-label classification task explicitly trained on imbalanced datasets. This separation enhances detection accuracy and mitigates the effects of class imbalance in sensor identification. Both approaches are integrated with an Extended Kalman Filter (EKF) for post-attack state reconstruction. By incorporating the outputs of the ML-based detection and identification modules with EFK-based estimation, the proposed method enables the recovery of reliable internal states even in the presence of compromised measurements, further enhancing the control system’s resilience and stability.
References:
[1] Rodrigo Lopez-Negrete, Fernando J. D’Amato, Lorenz T. Biegler, and Aditya Kumar. Fast nonlinear model predictive control: Formulation and industrial process applications. Computers and Chemical Engineering, 51:55–64, 2013.
[2] James B. Rawlings. Tutorial overview of model predictive control. IEEE Control Systems Magazine, 20(3):662–676, 2000.
[3] Scarlett Chen, Zhe Wu, and Panagiotis D. Christofides. Cyber-security of centralized, decentralized, and distributed control-detector architectures for nonlinear processes. Chemical Engineering Research and Design, 159:248-261, 2021.
[4] Hamza Fawzi, Paulo Tabuada, and Suhas Diggavi. Secure estimation and control for cyber-physical systems under adversarial attacks. IEEE Transactions on Automatic Control, 59(6):1454–1467, 2014.
[5] Yash A. Kadakia, Atharva Suryavanshi, Aisha Alnajdi, Fahim Abdullah, and Panagiotis D. Christofides. Integrating machine learning detection and encrypted control for enhanced cybersecurity of nonlinear processes. Computers & Chemical Engineering, 180:108498, 2024.
[6] Prashant Mhaskar, Adiwinata Gani, Nael H. El-Farra, Charles McFall, Panagiotis D. Christofides, and James F. Davis. Integrated fault-detection and fault-tolerant control of process systems. AIChE Journal, 52(6):2129–2148, 2006.
[7] Zhe Wu, Fahad Albalawi, Junfeng Zhang, Zhihao Zhang, Helen Durand, and Panagiotis D. Christofides. Detecting and handling cyber-attacks in model predictive control of chemical processes. Mathematics, 6(10):173, 2018.
[8] Keshav Kasturi Rangan, Henrique Oyama, and Helen Durand. Integrated cyberattack detection and handling for nonlinear systems with evolving process dynamics under Lyapunov-based economic model predictive control. Chemical Engineering Research and Design, 170:147-179, 2021.
[9] AmirMohammad Ebrahimi and Davood B. Pourkargar. An adaptive distributed architecture for multi-agent state estimation and control of complex process systems. Chemical Engineering Research and Design, 210: 594-604, 2024.
[10] Davood B. Pourkargar, Manjiri Moharir, Ali Almansoori, and Prodromos Daoutidis. Distributed estimation and nonlinear model predictive control using community detection. Industrial & Engineering Chemistry Research, 58(30):13495–13507, 2019.
[11] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Information Processing Systems, 30:1-11, 2017.