{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T11:26:42Z","timestamp":1762342002241,"version":"build-2065373602"},"reference-count":54,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2023,3,3]],"date-time":"2023-03-03T00:00:00Z","timestamp":1677801600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000780","name":"European Funds","doi-asserted-by":"publisher","award":["POIR.01.01.01-00-0541\/20"],"award-info":[{"award-number":["POIR.01.01.01-00-0541\/20"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>This article deals with the cyber security of industrial control systems. Methods for detecting and isolating process faults and cyber-attacks, consisting of elementary actions named \u201ccybernetic faults\u201d that penetrate the control system and destructively affect its operation, are analysed. FDI fault detection and isolation methods and the assessment of control loop performance methods developed in the automation community are used to diagnose these anomalies. An integration of both approaches is proposed, which consists of checking the correct functioning of the control algorithm based on its model and tracking changes in the values of selected control loop performance indicators to supervise the control circuit. A binary diagnostic matrix was used to isolate anomalies. The presented approach requires only standard operating data (process variable (PV), setpoint (SP), and control signal (CV). The proposed concept was tested using the example of a control system for superheaters in a steam line of a power unit boiler. Cyber-attacks targeting other parts of the process were also included in the study to test the proposed approach\u2019s applicability, effectiveness, and limitations and identify further research directions.<\/jats:p>","DOI":"10.3390\/s23052778","type":"journal-article","created":{"date-parts":[[2023,3,3]],"date-time":"2023-03-03T03:32:52Z","timestamp":1677814372000},"page":"2778","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Controller Cyber-Attack Detection and Isolation"],"prefix":"10.3390","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6464-8194","authenticated-orcid":false,"given":"Anna","family":"Sztyber-Betley","sequence":"first","affiliation":[{"name":"Faculty of Mechatronics, Warsaw University of Technology, 00-661 Warsaw, Poland"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7741-607X","authenticated-orcid":false,"given":"Micha\u0142","family":"Syfert","sequence":"additional","affiliation":[{"name":"Faculty of Mechatronics, Warsaw University of Technology, 00-661 Warsaw, Poland"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8947-2025","authenticated-orcid":false,"given":"Jan Maciej","family":"Ko\u015bcielny","sequence":"additional","affiliation":[{"name":"Faculty of Mechatronics, Warsaw University of Technology, 00-661 Warsaw, Poland"}]},{"given":"Zuzanna","family":"G\u00f3recka","sequence":"additional","affiliation":[{"name":"Faculty of Mechatronics, Warsaw University of Technology, 00-661 Warsaw, Poland"}]}],"member":"1968","published-online":{"date-parts":[[2023,3,3]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1016\/j.ijcip.2015.04.001","article-title":"A System Dynamics Approach for Assessing the Impact of Cyber Attacks on Critical Infrastructures","volume":"10","author":"Genge","year":"2015","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_2","unstructured":"Ko\u015bcielny, J., Syfert, M., Ordys, A., Wnuk, P., Mo\u017caryn, J., Fajdek, B., Puig, V., and Kukie\u0142ka, K. (July, January 29). Towards a unified approach to detection of faults and cyber-attacks in industrial installations. Proceedings of the European Control Conference, Delft, The Netherlands."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Rubio, J.E., Rom\u00e1n, R., and L\u00f3pez, J. (2017, January 8\u201313). Analysis of Cybersecurity Threats in Industry 4.0: The Case of Intrusion Detection. Proceedings of the CRITIS, Lucca, Italy.","DOI":"10.1007\/978-3-319-99843-5_11"},{"key":"ref_4","unstructured":"Korbicz, J., Kowalczuk, Z., Ko\u015bcielny, J.M., and Cholewa, W. (1998). Fault Diagnosis: Models, Artificial Intelligence Methods, Applications, Springer."},{"key":"ref_5","unstructured":"Gertler, J. (1998). Fault Detection and Diagnosis in Engineering Systems, Marcel Dekker, Inc."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1016\/j.neucom.2018.04.037","article-title":"A survey on model-based fault diagnosis for linear discrete time-varying systems","volume":"306","author":"Zhong","year":"2018","journal-title":"Neurocomputing"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"111990","DOI":"10.1016\/j.sna.2020.111990","article-title":"Recent advances in sensor fault diagnosis: A review","volume":"309","author":"Li","year":"2020","journal-title":"Sens. Actuators A Phys."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Park, Y.J., Fan, S.K.S., and Hsu, C.Y. (2020). A Review on Fault Detection and Process Diagnostics in Industrial Processes. Processes, 8.","DOI":"10.3390\/pr8091123"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"3390","DOI":"10.1080\/00207721.2021.1998722","article-title":"Fault detection of networked dynamical systems: A survey of trends and techniques","volume":"52","author":"Ju","year":"2021","journal-title":"Int. J. Syst. Sci."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.jprocont.2015.11.002","article-title":"The current state of control loop performance monitoring\u2014A survey of application in industry","volume":"38","author":"Bauer","year":"2016","journal-title":"J. Process Control"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"856","DOI":"10.1002\/cjce.5450670519","article-title":"Assessment of control loop performance","volume":"67","author":"Harris","year":"1989","journal-title":"Can. J. Chem. Eng."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"526","DOI":"10.1016\/j.ifacol.2016.07.396","article-title":"Control loop performance monitoring\u2014ABB\u2019s experience over two decades","volume":"49","author":"Starr","year":"2016","journal-title":"IFAC-PapersOnLine"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Ordys, A., Uduehi, D., and Johnson, M.A. (2007). Process Control Performance Assessment: From Theory to Implementation, Springer.","DOI":"10.1007\/978-1-84628-624-7"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Jelali, M. (2013). Control Performance Management in Industrial Automation: Assessment, Diagnosis and Improvement of Control Loop Performance, Springer.","DOI":"10.1007\/978-1-4471-4546-2"},{"key":"ref_15","unstructured":"Kowalczuk, Z. (2022, January 5\u20137). Controller Modelling as a Tool for Cyber-Attacks Detection. Proceedings of the International Conference on Diagnostics of Processes and Systems DPS 2022, Chmielno, Poland. Intelligent and Safe Computer Systems in Control and Diagnostics."},{"key":"ref_16","unstructured":"Cardenas, A., Amin, S., Sinopoli, B., Giani, A., Perrig, A., and Sastry, S. (2009, January 22\u201324). Challenges for Securing Cyber Physical Systems. Proceedings of the Workshop on Future Directions in Cyber-Physical Systems Security, Newark, NJ, USA."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1674","DOI":"10.1016\/j.neucom.2017.10.009","article-title":"A Survey on Security Control and Attack Detection for Industrial Cyber-Physical Systems","volume":"275","author":"Ding","year":"2018","journal-title":"Neurocomputing"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"973","DOI":"10.1016\/j.jcss.2014.02.005","article-title":"A survey of emerging threats in cybersecurity","volume":"80","author":"Nepal","year":"2014","journal-title":"J. Comput. Syst. Sci."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"103","DOI":"10.1016\/j.arcontrol.2019.08.002","article-title":"Bibliographical review on cyber attacks from a control oriented perspective","volume":"48","author":"Rotondo","year":"2019","journal-title":"Annu. Rev. Control"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"101","DOI":"10.1016\/j.neucom.2019.01.099","article-title":"Modeling and control of Cyber-Physical Systems subject to cyber attacks: A survey of recent advances and challenges","volume":"338","author":"Mahmoud","year":"2019","journal-title":"Neurocomputing"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Loukas, G. (2015). Cyber-Physical Attacks, Butterworth-Heinemann.","DOI":"10.1016\/B978-0-12-801290-1.00007-2"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2542049","article-title":"A Survey of Intrusion Detection Techniques for Cyber-Physical Systems","volume":"46","author":"Mitchell","year":"2014","journal-title":"ACM Comput. Surv."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1016\/j.automatica.2014.10.067","article-title":"A secure control framework for resource-limited adversaries","volume":"51","author":"Teixeira","year":"2015","journal-title":"Automatica"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Hu, Y., Li, H., Yang, H., Sun, Y., Sun, L., and Wang, Z. (2019). Detecting stealthy attacks against industrial control systems based on residual skewness analysis. EURASIP J. Wirel. Commun. Netw., 74.","DOI":"10.1186\/s13638-019-1389-1"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Urbina, D.I., Giraldo, J.A., Cardenas, A.A., Tippenhauer, N.O., Valente, J., Faisal, M., Ruths, J., Candell, R., and Sandberg, H. (2016, January 24\u201328). Limiting the Impact of Stealthy Attacks on Industrial Control Systems. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria.","DOI":"10.1145\/2976749.2978388"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Trapiello, C., Rotondo, D., Sanchez, H., and Puig, V. (2019, January 23\u201326). Detection of replay attacks in CPSs using observer-based signature compensation. Proceedings of the 2019 6th International Conference on Control, Decision and Information Technologies (CoDIT), Paris, France.","DOI":"10.1109\/CoDIT.2019.8820639"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Trapiello, C., and Puig, V. (2020, January 11\u201314). Replay attack detection using a zonotopic KF and LQ approach. Proceedings of the 2020 IEEE International Conference on Systems, Man, and Cybernetics (SMC), Toronto, ON, Canada.","DOI":"10.1109\/SMC42975.2020.9282865"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"11094","DOI":"10.1016\/j.ifacol.2020.12.254","article-title":"Input Design for Active Dectection of Integrity Attacks using Set-based Approach","volume":"53","author":"Trapiello","year":"2020","journal-title":"IFAC-PapersOnLine"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"2715","DOI":"10.1109\/TAC.2013.2266831","article-title":"Attack Detection and Identification in Cyber-Physical Systems","volume":"58","author":"Pasqualetti","year":"2013","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1458","DOI":"10.1049\/iet-cta.2015.1147","article-title":"Adaptive cyber-physical system attack detection and reconstruction with application to power systems","volume":"10","author":"Ao","year":"2016","journal-title":"IET Control Theory Appl."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"1453","DOI":"10.1109\/TAC.2004.834121","article-title":"Kalman filtering with intermittent observations","volume":"49","author":"Sinopoli","year":"2004","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"2192","DOI":"10.1109\/TCST.2020.3027809","article-title":"Anomaly Detection and Mode Identification in Multimode Processes Using the Field Kalman Filter","volume":"29","author":"Cong","year":"2021","journal-title":"IEEE Trans. Control Syst. Technol."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"103814","DOI":"10.1016\/j.micpro.2020.103814","article-title":"Detection of attacks in IoT sensors networks using machine learning algorithm","volume":"82","author":"Bedi","year":"2021","journal-title":"Microprocess. Microsyst."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Abbaspour, A., Sargolzaei, A., and Yen, K. (2017, January 17\u201319). Detection of false data injection attack on load frequency control in distributed power systems. Proceedings of the 2017 North American Power Symposium (NAPS), Morgantown, WV, USA.","DOI":"10.1109\/NAPS.2017.8107333"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Wu, Z., Albalawi, F., Zhang, J., Zhang, Z., Durand, H., and Christofides, P.D. (2018). Detecting and Handling Cyber-Attacks in Model Predictive Control of Chemical Processes. Mathematics, 6.","DOI":"10.3390\/math6100173"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"239","DOI":"10.1016\/j.neucom.2021.10.070","article-title":"Attack isolation and location for a complex network cyber-physical system via zonotope theory","volume":"469","author":"Zhang","year":"2022","journal-title":"Neurocomputing"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Ko\u015bcielny, J.M., Syfert, M., and Sztyber, A. (2018). Advanced Solutions in Diagnostics and Fault Tolerant Control, Springer.","DOI":"10.1007\/978-3-319-64474-5"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Syfert, M., Ordys, A., Ko\u015bcielny, J.M., Wnuk, P., Mo\u017caryn, J., and Kukie\u0142ka, K. (2022). Integrated Approach to Diagnostics of Failures and Cyber-Attacks in Industrial Control Systems. Energies, 15.","DOI":"10.3390\/en15176212"},{"key":"ref_39","unstructured":"Kowalczuk, Z. (2022, January 5\u20137). Simulation Model and Scenarios for Testing Detectability of Cyberattacks in Industrial Control Systems. Proceedings of the International Conference on Diagnostics of Processes and Systems DPS 2022, Chmielno, Poland. Intelligent and Safe Computer Systems in Control and Diagnostics."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"770","DOI":"10.1016\/j.ifacol.2018.09.662","article-title":"A two-tank benchmark for detection and isolation of cyber attacks","volume":"51","author":"Quevedo","year":"2018","journal-title":"IFAC-PapersOnLine"},{"key":"ref_41","unstructured":"Bobba, R.B., Rogers, K.M., Wang, Q., Khurana, H., Nahrstedt, K., and Overbye, T.J. (2010). Preprints of the First Workshop on Secure Control Systems, CPSWEEK."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"717","DOI":"10.1109\/TPDS.2013.92","article-title":"On False Data-Injection Attacks against Power System State Estimation: Modeling and Countermeasures","volume":"25","author":"Yang","year":"2014","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"2476","DOI":"10.1109\/TSG.2015.2388545","article-title":"Detecting False Data Injection Attacks in AC State Estimation","volume":"6","author":"Chaojun","year":"2015","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_44","unstructured":"Huang, Y., Li, H., Campbell, K.A., and Han, Z. (2011, January 23\u201325). Defending false data injection attack on smart grid network using adaptive CUSUM test. Proceedings of the 2011 45th Annual Conference on Information Sciences and Systems, Baltimore, MD, USA."},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"11094","DOI":"10.1016\/j.ifacol.2017.08.2493","article-title":"Impact Analysis of a Bias Injection Cyber-Attack on a Power Plant","volume":"50","author":"Kontouras","year":"2017","journal-title":"IFAC-PapersOnLine"},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"6498","DOI":"10.1109\/JIOT.2019.2916670","article-title":"Detection and Isolation of False Data Injection Attacks in Smart Grids via Nonlinear Interval Observer","volume":"6","author":"Wang","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Hoehn, A., and Zhang, P. (2016, January 6\u20138). Detection of replay attacks in cyber-physical systems. Proceedings of the 2016 American Control Conference (ACC), Boston, MA, USA.","DOI":"10.1109\/ACC.2016.7524930"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Manandhar, K., and Cao, X. (2014, January 4\u20137). Attacks\/faults detection and isolation in the Smart Grid using Kalman Filter. Proceedings of the 2014 23rd International Conference on Computer Communication and Networks (ICCCN), Shanghai, China.","DOI":"10.1109\/ICCCN.2014.6911809"},{"key":"ref_49","unstructured":"Taheri, M., Khorasani, K., Shames, I., and Meskin, N. (2020). Cyber Attack and Machine Induced Fault Detection and Isolation Methodologies for Cyber-Physical Systems. arXiv."},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Mo\u017caryn, J.F., Fr\u0105tczak, M., Stebel, K., K\u0142opot, T., Noco\u0144, W., Ordys, A., and Ozana, S. (2023). Stealthy Cyberattacks Detection Based on Control Performance Assessment Methods for the Air Conditioning Industrial Installation. Energies, 16.","DOI":"10.3390\/en16031290"},{"key":"ref_51","unstructured":"Swanda, A., and Seborg, D. (1999, January 2\u20134). Controller performance assessment based on setpoint response data. Proceedings of the 1999 American Control Conference (Cat. No. 99CH36251), San Diego, CA, USA."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"1543","DOI":"10.1016\/0967-0661(95)00164-P","article-title":"A control-loop performance monitor","volume":"3","year":"1995","journal-title":"Control Eng. Pract."},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"91","DOI":"10.1016\/S0959-1524(02)00007-0","article-title":"Detection of multiple oscillations in control loops","volume":"13","author":"Thornhill","year":"2003","journal-title":"J. Process Control"},{"key":"ref_54","unstructured":"B\u0159ezina, T., and Jablo\u0144ski, R. (2013, January 7\u20139). Signal Processing in DiaSter System for Simulation and Diagnostic Purposes. Proceedings of the 10th International Conference Mechatronics 2013, Brno, Czech Republic. Mechatronics 2013."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/5\/2778\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T18:46:53Z","timestamp":1760122013000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/5\/2778"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,3,3]]},"references-count":54,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2023,3]]}},"alternative-id":["s23052778"],"URL":"https:\/\/doi.org\/10.3390\/s23052778","relation":{},"ISSN":["1424-8220"],"issn-type":[{"type":"electronic","value":"1424-8220"}],"subject":[],"published":{"date-parts":[[2023,3,3]]}}}