Asymptotic Performance Limitations in Cyberattack Detection

Abstract

In this paper, we consider the difficulty of cyberattack detection with $d$ sensors and $n$ observations, and derive performance bounds that are valid independent of the attack detection algorithm used. In other words, regardless of whether it is an artificial intelligence (AI) or sensor fusion based approach or it is derived using a completely new innovative idea, a cyberattack detector using multiple observations does have certain fundamental performance bounds that are independent of the algorithm used. Cyberattacks introduce different forms of anomalies that may be small or large, and given enough measured data, even tiny anomalies will become more noticeable and cyberattack detection problem will be easier provided that a carefully designed attack detection algorithm is used. For example, False Data Injection (FDI) attacks with small injected error may be harder to detect, but such attacks can cause major failures if continued over a long time period. A natural question to ask is to what degree the cyberattack detection problem becomes easier if more and more measurements acquired over a long time period are used for threat assessment, and the risk level reduction achieved for each new observation. For a cyberattack detector, the false alarm rate is the probability of triggering an alarm when there is no cyberattack, and the probability of miss is the probability of not detecting a cyberattack. The risk level of a cyberattack detector is defined as the sum of the probability of false alarm and the probability of miss. By using the notion of Hellinger distance and total variation norm between probability distributions, we derive upper and lower bounds for the minimum possible (achievable) risk level under multiple measurements, and study asymptotic properties of such bounds. These performance bounds are valid regardless of the cyberattack detection algorithm selection; they imply certain fundamental performance limits in cyberattack detection applications with given number of observations; and also help us to understand the number of observations needed for a given cyberattack detection performance level.