Static ramp model leaves detectable residuals on Siemens PROFINET drives
Original title: Covert System Identification Under Timing Constraints: A Static Linear Model and Its Detectability Implications
PASAD and CUSUM flag the omitted overshoot residual, and evaluated N4SID models did not improve stealth.
The paper studies covert system identification, where an attacker infers plant dynamics while trying to remain stealthy. A static linear model treats setpoint-change time as proportional to commanded speed difference. On a Siemens PROFINET testbed the gain matches ramp response but not terminal overshoot, and that residual is detected by PASAD and CUSUM. Across cascade identification and staircase attacks, stealth is limited by the plant's settling transients under the paper's detector calibration.
Unconfirmed: Findings come from one Siemens PROFINET testbed and the paper's detector-calibration regime.
- The linear model captures drive ramp response but not terminal overshoot.
- N4SID models trained at multiple excitation amplitudes did not improve stealth.
- Per-cycle computation is negligible for both identification procedures.
- The binding limit is refreshing a model without detectable perturbations.
From the original article
1 min read at arxiv.orgThis paper studies covert system identification in cyber-physical systems, where an attacker infers plant dynamics while attempting to remain stealthy. We introduce a lightweight static linear model in which the time to execute a setpoint change is proportional to the commanded speed difference. On a Siemens PROFINET testbed this gain captures the drive's ramp response accurately but not its terminal overshoot.
By Victor Mattos · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.