A Secure Control Design for Networked Control Systems with Linear Dynamics under a Time-Delay Switch Attack

Abstract

Networked control systems (NCSs) are designed to control and monitor large-scale and complex systems remotely. The communication connectivity in an NCS allows agents to quickly communicate with each other to respond to abrupt changes in the system quickly, thus reducing complexity and increasing efficiency. Despite all these advantages, NCSs are vulnerable to cyberattacks. Injecting cyberattacks, such as a time-delay switch (TDS) attack, into communication channels has the potential to make NCSs inefficient or even unstable. This paper presents a Lyapunov-based approach to detecting and estimating TDS attacks in real time. A secure control strategy is designed to mitigate the effects of TDS attacks in real time. The stability of the secure control system is investigated using the Lyapunov theory. The proposed TDS attack estimator’s performance and secure control strategy are evaluated in simulations and a hardware-in-the-loop environment.

1. Introduction

A networked control system (NCS) is a type of control system in which the control and feedback data packets are exchanged through communication channels between agents and the controller. NCS systems are used to enhance the efficiency and reliability of the control systems [1,2,3,4]. The simplicity and efficiency of NCSs for constructing networks among multi-agent systems have received significant attention over the past years. Although leveraging communication channels in an NCS can control and supervise the system more efficiently and reliably, NCSs are prone to cyber disruptions—either inherent or intentional ones, such as cyberattacks. The most known cyberattacks are denial of service (DoS), which disables access to the system information or a service [5], false data injection (FDI), which intentionally manipulates the exchange of data [6], replay attack, which maliciously repeats valid data transmissions [7], and a newly found attack, the time-delay switch (TDS) [3]. The number and intensity of these cyber manipulations have grown in recent years. One of these cyber attacks was the 2015 Ukraine Blackout event, in which about 225,000 customers lost their electricity for several hours. This cyber incident was a successful FDI on an actual power grid [8]. The 2019 Venezuela blackout resulted from a cyberattack on energy supplies in eighteen states that affected two-thirds of the country [9,10]. These cyber disruptions determine the criticality of studying cyber attacks on NCSs, like power grids.

A TDS attack is made by inserting time delays into communication channels of NCSs [11]. Since NCSs are time-sensitive and require updated measurement signals, a TDS can be highly destructive [11,12]. Time delays can occur purposefully or inherently in a wide range of engineering systems [12,13,14]. In general, time delays are common in control systems and can influence the stability of control systems. Even worse delays can occur when an adversary injects random TDS attacks into NCSs, making the systems inefficient or even unstable. This circumstance stems from the fact that the controller needs to receive the measurement values in real time to be able to generate the control signals. NCSs transmit the sensor measurements from agents to a centralized control unit through communication channels, and injecting TDS attacks will result in instability in NCSs. Therefore, it is crucial to design a secure NCS that is robust to both natural delays and TDS attacks [3,15].

Even though it has been shown in the literature that TDS attacks can cause instability in NCSs [11], only a few studies have focused on detecting TDS attacks in real time, and none have investigated the compensation of TDS attacks by designing a secure controller. A neural network (NN) approach was developed in [16] as a tool for estimating a time delay in industrial communication systems with nonlinear dynamics, but the stability of this controller has not been investigated. Another NN-based approach was introduced in [17] to estimate the state of the system in real time. The aforementioned proposed algorithms require offline training and cannot detect TDS attacks in real time. Although machine learning techniques have been utilized for cyber attack detection in NCSs [18], various susceptible and erroneous detection results have been reported in the literature [19,20]. These machine learning methods are prone to maliciously altering the training or test data and cause disastrous operation issues and system instability [20]. A robust controller was introduced in [21] for systems with nonlinear dynamics. The proposed approach can compensate for the effects of TDS attacks in real time without detecting them. However, the proposed controller can only mitigate small amounts of TDS attacks. The approach proposed in [22] uses a neural-network-based detection algorithm to detect and estimate the TDS attack in real time. However, the proposed approach can estimate the TDS attacks accurately, but it cannot mitigate the effects of TDS attacks in real time. To mitigate the effect of a TDS attack, Ref. [12] proposed an adaptive control algorithm that estimates TDS attacks introduced into measurement signals. This work was able to detect and mitigate TDS attacks in real time. However, the stability of the proposed method was not investigated due to the nature of the controller design. Furthermore, the convergence of attack detection and estimation requires further investigation.

Table 1. The advantages and disadvantages of the approaches in the literature.

Approach	Advantage	Disadvantage
Machine-learning-based approaches [16,17,18,19,20]	These approaches do not require the dynamic model of the system	Stability analysis of neural network (NN)-based approaches is complex; offline learning time is required
Robust controller-based approach [21]	There is no need to detect attacks in real time	The system is not efficient due to its robustness to potential faults, failures, and attacks
NN-based detection approach [22]	Ability of detection and estimation of time-delay switch (TDS) attacks	Stability analysis requires further investigation; it cannot mitigate the effects of TDS attacks
Least-mean-square-based approach [12]	Accurate estimation of TDS attacks with a linear model of the system	Stability analysis is complex

summarizes the advantages and disadvantages of approaches in the literature.

The contributions of this papers are as follows:

• It develops a novel secure control strategy to estimate and compensate TDS attacks in real time for NCSs with linear dynamics to address the current barriers in the detection and compensation of TDS attacks in the literature.
• It designs a secure controller that is able to mitigate the effects of TDS attacks using the proposed model-based algorithm.
• The controller and estimator in this paper are designed based on the Lyapunov theory to guarantee the stability of an NCS under a TDS attack. The proposed method is compared with an NN-based method [22] to show the efficacy of the proposed technique in the presence of the TDS attack.

To summarize, the contribution of the paper is its proposal of a novel TDS attack detection technique along with its design of a secure Lyapunov-based controller for NCSs with linear dynamics under TDS attacks. The proposed algorithm is a model-based method that is able to detect and compensate for TDS attacks in real time with low computational complexity compared with learning-based methods.

The rest of the paper is organized as follows. Section 2 presents a general model for an NCS under a TDS attack. The proposed controller with a Luenberger observer is described in Section 3. Section 4 verifies the controller’s stability. The case study is described in Section 5. Simulations and results are demonstrated in Section 6, and the conclusion is presented in Section 7.

2. Networked Control Systems

Despite all of the benefits of NCSs, including that they are fast, reliable, and have remote capability, NCSs are vulnerable to cyber disruptions and threats, since NCSs are highly dependent on information, communication, and cyber interfaces [1,2,3]. NCSs are used in critical infrastructures, and their security is categorized as one of the important concerns in the nation. Therefore, the vulnerability to external interruptions and attacks must be prevented. Since these systems heavily rely on networked communications, this dependency introduces delays, data packet drops, bandwidth allocations, and other cybersecurity issues in the data transfer process [11,23,24].

Specifically, delays can cause catastrophic failures in the systems that are under control. Measured data and control commands must be transferred within a limited period; otherwise, introducing delays to these signals makes the system unable to trace its operating conditions and causes an undesired response [3,25].

2.1. Dynamic Model of an NCS

A general diagram of an NCS system is presented in Figure 1. The communication between the plant and the controller takes place through a networked communication channel. Commands from the controller to the actuators and sensing signals from measurement sensors, which are vulnerable points of NCSs, must flow through the network. The NCS is mathematically represented by the following state-space model, assuming that the NCS has J agents:

$$\left\{\begin{array}{c}\dot{x}\left(t\right)=Ax\left(t\right)+Bu\left(t\right)\hfill \\ y\left(t\right)=Cx\left(t\right),\hfill \end{array}\right.$$

(1)

where $x\left(t\right)$ indicates the states of NCS and can be described as

$$x\left(t\right)={\left[x_1{\left(t\right)}^T{x}_2{\left(t\right)}^T\cdots x_J{\left(t\right)}^T\right]}^T$$

(2)

and $x_i$ is the state-space vector of the $i_{th}$ agent of the NCS.

In a similar manner, $u\left(t\right)$ is the vector of inputs and $y\left(t\right)$ is the output, the aggregated state measurements of the system, which are described as

$$u\left(t\right)={\left[u_1{\left(t\right)}^T{u}_2{\left(t\right)}^T\cdots u_J{\left(t\right)}^T\right]}^T$$

(3)

$$y\left(t\right)={\left[y_1{\left(t\right)}^T{y}_2{\left(t\right)}^T\cdots y_J{\left(t\right)}^T\right]}^T.$$

(4)

Each agent in the NCS can have a different number of inputs $u_i\left(t\right)$, outputs $y_i\left(t\right)$, and states $x_i\left(t\right)$. This means that each vector in $x\left(t\right),u\left(t\right),$ and $y\left(t\right)$ has its own dimension.

$$x_i\left(t\right)={\left[x_{i,1}\left(t\right)x_{i,2}\left(t\right)\cdots x_{i,n_{xi}}\left(t\right)\right]}^T$$

(5)

$$u_i\left(t\right)={\left[u_{i,1}\left(t\right)u_{i,2}\left(t\right)\cdots u_{i,n_{ui}}\left(t\right)\right]}^T$$

(6)

$$y_i\left(t\right)={\left[y_{i,1}\left(t\right)y_{i,2}\left(t\right)\cdots y_{i,n_{yi}}\left(t\right)\right]}^T,$$

(7)

where $n_{xi}$, $n_{ui}$, and $n_{yi}$ are the dimensions of each vector of the state-space, inputs, and outputs, respectively, for the $i_{th}$ agent.

The matrix A is described as:

$$A=\left[\begin{array}{cccc}{A}_{11}& A_{12}& \cdots & A_{1J}\\ A_{21}& A_{22}& \cdots & A_{2J}\\ ⋮& ⋮& \ddots & ⋮\\ A_{J1}& A_{J2}& \cdots & A_{JJ}\end{array}\right].$$

(8)

Here, each sub-conjunct $A_{ii}$ has the dimension $n_{xi}\times n_{xi}$ of the $i_{th}$ agent in the system. $A_{ab}$ represents the mutual dependency between agents.

If all the agents are independent of each other, the matrix changes to the following:

$$A=\left[\begin{array}{cccc}{A}_{11}& 0& \cdots & 0\\ 0& A_{22}& \cdots & 0\\ ⋮& ⋮& \ddots & ⋮\\ 0& 0& \cdots & A_{JJ}\end{array}\right].$$

(9)

In the same way, the matrix B is defined as

$$B=\left[\begin{array}{cccc}{B}_1& 0& \cdots & 0\\ 0& B_2& \cdots & 0\\ ⋮& ⋮& \ddots & ⋮\\ 0& 0& \cdots & B_J\end{array}\right].$$

(10)

Therefore, any single $B_i$ has the dimension $n_{xi}\times n_{ui}$ based on the number of terms in the state vector ($n_{xi}$) and the number of terms in the input vector ($n_{ui}$) of the $i_{th}$ agent in the NCS.

Matrix C is composed of $C_i$ for each agent in the system. The dimension of each $C_i$ is $n_{yi}\times n_{xi}$. Matrix C is defined as:

$$C=\left[\begin{array}{cccc}{C}_1& 0& \cdots & 0\\ 0& C_2& \cdots & 0\\ ⋮& ⋮& \ddots & ⋮\\ 0& 0& \cdots & C_J\end{array}\right].$$

(11)

2.2. NCS under a TDS Attack

The controller of an NCS is considered to be an optimal controller, which is described as

$$u\left(t\right)=-Kz\left(t\right),$$

(12)

where z is the signal measured by the centralized controller.

Since delays are introduced to the communication channel, the signals received by the controller from each agent in the NCS are not the $y_i\left(t\right)$ originally observed from the system output. This paper assumes that an adversary cannot access control signals and only injects the TDS attacks into the measurement signals. The measured signal under a TDS attack can be described as

$$z_i\left(t\right)=y_i(t-{\tau }_i),i\in \{1,2,...,J\},$$

(13)

where ${\tau }_i$ is the delay of the $i_{\mathrm{th}}$ element of the NCS.

3. Controller Design: Lyapunov Compensation with a Luenberger Observer

3.1. Observer Design

A Luenberger observer is designed such that the error between the system measurement and estimated output converges to zero:

$$\left\{\begin{array}{l}\dot{\widehat{x}}=Ax+Bu+L(y-\widehat{y})+{\psi }_2\\ \widehat{y}=C\widehat{x}\end{array},\right.$$

(14)

where the vectors $\widehat{x}$, $\widehat{u}$, and $\widehat{y}$ are the state-space, the inputs, and the outputs of the observer, respectively. The compensator signal ${\psi }_2$ will be designed based on the subsequent stability analysis. The Luenberger gain L is a constant scalar number that multiplies the error between the output of the system $y=Cx$ and the estimated value from the observer $\widehat{y}=C\widehat{x}$.

Substituting the y and $\widehat{y}$ elements in (14) yields

$$\left\{\begin{array}{l}\dot{\widehat{x}}=A\widehat{x}+B\widehat{u}+LC(x-\widehat{x})+{\psi }_2\\ \widehat{y}=C\widehat{x}\end{array}.\right.$$

(15)

Grouping the elements with $\widehat{x}$, the system representation can be written as

$$\left\{\begin{array}{l}\dot{\widehat{x}}\left(t\right)=(A-LC)\widehat{x}+B\widehat{u}+LCx+{\psi }_2\\ \widehat{y}=C\widehat{x}\end{array}.\right.$$

(16)

The last term in Equation (16) is the response received by the observer from the plant through the delayed channel, which is actually $x(t-\tau )$. Given this variable, the state-space representation is changed to the following:

$$\left\{\begin{array}{l}\dot{\widehat{x}}\left(t\right)=(A-LC)\widehat{x}+B\widehat{u}+LCx(t-\tau )+{\psi }_2\\ \widehat{y}=C\widehat{x}\end{array}.\right.$$

(17)

3.2. Controller Design

The proposed control diagram is presented in Figure 2.

The delay presented in the superior feedback loop is the attack delay inserted into the system. The feedback controller is the same for both the plant and observer environment (K matrix). The terms of K must be defined to implement an optimal response to the system. It was used as a linear quadratic regulator (LQR) method to create the proper K matrix with the individual gains for each state in the system [26].

The delay in the system data is estimated at the feedback loop of the observer. This estimated delay signal is applied in the controller to adjust the control commands based on the inserted delay. The system model is set with an initial condition vector and the reference signal, which is a zero vector. It is replicated on the observer, and because of that, the inputs are $u=-Kx$ and $\widehat{u}=-K\widehat{x}$.

As seen in (18) and (19), the input signal of the system is affected by the delay in the communication channel. In the same way, the estimate delay is injected into the observer feedback response to also emulate the delay at the observer.

$$u=-Kx(t-\tau )+{\psi }_1$$

(18)

$$\widehat{u}=-K\widehat{x}(t-\widehat{\tau })$$

(19)

As Figure 2 shows, ${\psi }_1$ compensates for the delay attack in the control input, and ${\psi }_2$ compensates for the delay attack in the observer process. These two terms will be further elaborated upon in the next section.

4. Proposed Delay Detection Method

In this section, ${\psi }_1$ and ${\psi }_2$ are designed using the Lyapunov approach. Furthermore, this section illustrates how TDS attacks are estimated in real time.

Consider the Lyapunov function described as

$$V_c=\frac{1}{2}\tilde{x}{\tilde{x}}^T+\frac{\alpha }{2}\tilde{\tau }{\tilde{\tau }}^T,$$

(20)

where $\alpha$ is a positive gain, $\tilde{x}\triangleq x-\widehat{x}$ is the state estimation error, and $\tilde{\tau }\triangleq \tau -\widehat{\tau }$ is the delay estimation error.

In (21), the derivative of the Lyapunov function is taken to obtain the required parameters and design a controller that is resilient against TDS attacks. It should be noted that time-delay attacks here target the input signals $u_{real}$ and $u_{obs}$. The output data y from the plant also have the delay attack shift in this model.

$${\dot{V}}_c=\tilde{x}{\dot{\tilde{x}}}^T+\alpha \tilde{\tau }{\dot{\tilde{\tau }}}^T$$

(21)

Substituting $\dot{\tilde{x}}=(\dot{x}-\dot{\widehat{x}})$ and $\dot{\tilde{\tau }}=(\dot{\tau }-\dot{\widehat{\tau }})$ into (21), we obtain:

$${\dot{V}}_c=\tilde{x}{\{\dot{x}-\dot{\widehat{x}}\}}^T+\alpha \tilde{\tau }{\{\dot{\tau }-\dot{\widehat{\tau }}\}}^T.$$

(22)

Then, $\dot{x}$ and $\dot{\widehat{x}}$ are substituted according to (1) and (14), respectively. The equation changes into:

$$\begin{array}{cc}\hfill {\dot{V}}_c=& \tilde{x}\{Ax+Bu-((A-LC)\widehat{x}+B\widehat{u}\hfill \\ & +LCx(t-\tau )+{\psi }_2{\left)\right\}}^T+\alpha \tilde{\tau }{(\dot{\tau }-\dot{\widehat{\tau }})}^T.\hfill \end{array}$$

(23)

Substituting the signals u and $\widehat{u}$ from (18) and (19), the equation becomes the following:

$$\begin{array}{cc}\hfill {\dot{V}}_c=& \tilde{x}\{Ax+B(-Kx(t-\tau )+{\psi }_1)\hfill \\ \hfill & -(A\widehat{x}+B(-K\widehat{x}(t-\widehat{\tau })\hfill \\ \hfill & +LCx(t-\tau )+{\psi }_2{\left)\right\}}^T+\alpha \tilde{\tau }{(\dot{\tau }-\dot{\widehat{\tau }})}^T.\hfill \end{array}$$

(24)

Considering a constant delay in the channel, even if it happens over short periods of time, the derivative of the delay is going to be null ($\dot{\tau }=0$). Using a Taylor series, the delayed signal is modeled approximately up to the first derivative term as $x(t-\tau )=x-\dot{x}\tau$.

$$\begin{array}{cc}\hfill {\dot{V}}_c=& \tilde{x}\{(A-LC)\tilde{x}\hfill \\ \hfill & -BK(x(t-\tau )-\widehat{x}(t-\widehat{\tau }))+B{\psi }_1\hfill \\ \hfill & +LC\dot{x}\tau -{\psi }_2{\}}^T-\alpha \tilde{\tau }{\left(\dot{\widehat{\tau }}\right)}^T\hfill \end{array}$$

(25)

Assuming that the second and third terms in (25) can cancel out each other, ${\psi }_1$ can be obtained as follows:

$${\psi }_1=K(x(t-\tau )-\widehat{x}(t-\widehat{\tau })).$$

(26)

After this, the derivative of the Lyapunov function is simplified as in (27).

$$\begin{array}{cc}\hfill {\dot{V}}_c=& \tilde{x}\{(A-LC)\tilde{x}\hfill \\ \hfill & +LC(\dot{\widehat{x}}+\dot{\tilde{x}})(\widehat{\tau }+\tilde{\tau })-{\psi }_2{\}}^T-\alpha \tilde{\tau }{\left(\dot{\widehat{\tau }}\right)}^T\hfill \end{array}$$

(27)

Applying the distributive property, Equation (27) is extended to (E:dem4):

$$\begin{array}{cc}\hfill {\dot{V}}_c=& \tilde{x}\{(A-LC)\tilde{x}\hfill \\ \hfill & +LC(\dot{\widehat{x}}\widehat{\tau }+\dot{\widehat{x}}\tilde{\tau }+\dot{\tilde{x}}\widehat{\tau }+\dot{\tilde{x}}\tilde{\tau })-{\psi }_2{\}}^T-\alpha \tilde{\tau }{\left(\dot{\widehat{\tau }}\right)}^T.\hfill \end{array}$$

(28)

Simplifying (27), we obtain the following equations, which will be used to find the estimated delay $\widehat{\tau }$:

$$\tilde{x}{LC(\dot{\widehat{x}}+\dot{\tilde{x}})\tilde{\tau }}^T=\alpha \tilde{\tau }{\left(\dot{\widehat{\tau }}\right)}^T$$

(29)

$$\dot{\widehat{\tau }}=\frac{LC}{\alpha }(\dot{\widehat{x}}+\dot{\tilde{x}})\tilde{x}.$$

(30)

The element $\alpha$ is a parameter for characterizing the system to make it possible to run the computation of the estimated delay value. Unfortunately, there is not a previous relation between the physical parameters of the system and the value of $\alpha$. The moment when the attack is deployed and the amount of delay injected have different effects on the system. The method used to get $\alpha$ is based on the peak value observed when tracking the error signal—the difference between the plant response and the observer response—and defining the $\alpha$ value. Then, some series of tests must be performed under known TDS attack conditions to validate the definition of $\alpha$. An offset may be applied according to the essay results to guarantee more precise estimates.

${\psi }_2$ is obtained below:

$${\psi }_2=LC(\dot{\widehat{x}}+\dot{\tilde{x}})\widehat{\tau }.$$

(31)

The Lyapunov theory is applied to guarantee that the system remains stable at different operating points. The Luenberger gain L must satisfy the following equation:

$$\tilde{x}{\left\{(A-LC)\tilde{x}\right\}}^T<0.$$

(32)

The derivative $\dot{\widehat{x}}$ can be taken from the observer. However, the error signal and its derivative $\dot{\tilde{x}}$ must be deduced—because it is not possible to measure data at the plant output before the delayed channel—by checking the error $x(t-\tau )-\widehat{x}(t-\widehat{\tau })$.

The Taylor series approximation must be considered; neglecting the higher-order terms, the delayed signal is represented by the following:

$$x(t-\tau )=x-\dot{x}\tau .$$

(33)

Similarly, the estimated states are obtained below:

$$\widehat{x}(t-\widehat{\tau })=\widehat{x}-\dot{\widehat{x}}\widehat{\tau }.$$

(34)

Subtracting Equations (33) from (34) will result in (36):

$$\begin{array}{cc}\hfill x(t-\tau )-\widehat{x}(t-\widehat{\tau })=& \tilde{x}-\dot{x}\tau +\dot{\widehat{x}}\widehat{\tau }\hfill \end{array}$$

(35)

$$\begin{array}{cc}\hfill x(t-\tau )-\widehat{x}(t-\widehat{\tau })=& \tilde{x}-\dot{x}(\widehat{\tau }+\tilde{\tau })+\dot{\widehat{x}}\widehat{\tau }.\hfill \end{array}$$

(36)

The term $\tilde{\tau }$ can be neglected because it is expected to go to zero due to the proper function of the proposed estimator. In this case, the Equation (36) becomes:

$$x(t-\tau )-\widehat{x}(t-\widehat{\tau })=\tilde{x}-\dot{\tilde{x}}\widehat{\tau }.$$

(37)

Considering that the system must be stable because the chosen value of L must guarantee the Lyapunov stability criteria, the Luenberger observer must bring estimation error signals in the form of $\tilde{x}=a.e^{-kt}$. Then, $\dot{\tilde{x}}=-k\tilde{x}$. Taking $k=1$ (the effects of this k can be absorbed by $\alpha$) to simplify the calculations, Equation (37) becomes

$$\begin{array}{cc}\hfill x(t-\tau )-\widehat{x}(t-\widehat{\tau })=& \tilde{x}\left(t\right)(1+\widehat{\tau })\hfill \end{array}$$

(38)

$$\begin{array}{cc}\hfill \tilde{x}\left(t\right)=& \frac{x(t-\tau )-\widehat{x}(t-\widehat{\tau }))}{1+\widehat{\tau }}.\hfill \end{array}$$

(39)

This way, it is possible to deduce $\tilde{x}\left(t\right)$ and its derivative $\dot{\tilde{x}}\left(t\right)$ used in Equations (30) and (31). They are obtained with the difference between consecutive samples in the digital readings.

5. NCS Case Study: Load Frequency Control Design for Power Grids

Load variation may create frequency oscillations and ultimately cause power grid instability. When the the grid load increases, the frequency decreases, and vice versa. Once a rapid load change is sensed, the electrical torque output is changed, which leads to a mismatch between the electrical and mechanical torques. This torque mismatch results in turbine speed changes that, in turn, cause frequency oscillations in the grid [27].

The load frequency control (LFC) of power systems is crucial in sustaining the grid frequency within a predefined range. LFC guarantees that the grid generators can properly maintain a balance between load and energy supply using the regulation of generators’ set-points [27].

The mathematical model for an NCS applied to the power grid with several agents was developed in [12]. The mathematical model presented in Equation (1) with the $x_i$ vector is defined as the following:

$$x_i\left(t\right)={[\Delta f_i\left(t\right)\Delta P_{g_i}\left(t\right)\Delta P_{t{u}_i}\left(t\right)\Delta P_{p{f}_i}\left(t\right)e_i\left(t\right)]}^T,$$

(40)

where $\Delta f_i\left(t\right)$ is the frequency deviation, $\Delta P_{g_i}\left(t\right)$ is the generated power deviation, $\Delta P_{t{u}_i}\left(t\right)$ is the turbine position, $\Delta P_{p{f}_i}\left(t\right)$ is the tie-line power flow, and $e_i{\left(t\right)]}^T$ is the control error given by $e_i\left(t\right)={\int }_0^t({\beta }_i\Delta f_i+\Delta P_{p{f}_i})dt$.

Therefore, the equations are going to have $x_i\left(t\right)$, $u_i\left(t\right)$, and $y_i\left(t\right)\in {\mathbb{R}}^5$, where $u_i\left(t\right)$ is the control input vector, $x_i\left(t\right)$ is the state vector, and $y_i\left(t\right)$ is the output of the $i_{th}$ agent in the system.

In this study, multiple grids are connected to the same tie-line within the same NCS. This means that agents can communicate with each other and exchange power among themselves through the grid. The matrix A will be similar to that presented in (8) with the following elements: Each $A_{ii}$ will be

$$A_{ii}=\left[\begin{array}{ccccc}{\displaystyle \frac{-{\mu }_i}{J_i}}& {\displaystyle \frac{1}{J_i}}& 0& {\displaystyle \frac{-1}{J_i}}& 0\\ 0& {\displaystyle \frac{-1}{T_{tu,i}}}& {\displaystyle \frac{1}{T_{tu,i}}}& 0& 0\\ {\displaystyle \frac{-1}{{\omega }_i{T}_{g,i}}}& 0& {\displaystyle \frac{-1}{T_{g,i}}}& 0& 0\\ {\displaystyle \sum _{i=j,j=1}^2}2\pi T_{i,j}& 0& 0& 0& 0\\ {\beta }_i& 0& 0& 1& 0\end{array}\right]$$

(41)

and $A_{ij}$ will be

$$A_{i,j}=\left[\begin{array}{ccccc}0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0\\ -2\pi T_{i,j}& 0& 0& 0& 0\\ 0& 0& 0& 0& 0\end{array}\right].$$

(42)

The parameters presented in (41) and (42) are described as follows:

$$\begin{array}{cc}\hfill J_i& —\mathrm{generator}\mathrm{moment}\mathrm{of}\mathrm{inertia}\hfill \\ \hfill {\beta }_i& —\mathrm{frequency}\mathrm{bias}\mathrm{factor}\hfill \\ \hfill {\omega }_i& —\mathrm{speed-drop}\mathrm{coefficient}\hfill \\ \hfill {\mu }_i& —\mathrm{damping}\mathrm{coefficient}\hfill \\ \hfill T_{g,i}& —\mathrm{governor}\mathrm{time}\mathrm{constant}\hfill \\ \hfill T_{tu,i}& —\mathrm{turbine}\mathrm{time}\mathrm{constant}\hfill \\ \hfill T_{i,j}& —\mathrm{stiffness}\mathrm{constant}\mathrm{between}{i}_{th}\mathrm{and}{j}_{th}\mathrm{agents}\hfill \end{array}$$

Similarly to (10), the matrix B is defined below:

$$B_i={\left[\begin{array}{ccccc}0& 0& {\displaystyle \frac{1}{T_{g,i}}}& 0& 0\end{array}\right]}^T.$$

(43)

Since vectors $y\left(t\right)$ and $x\left(t\right)$ are the same as those shown in Equation (1), the matrix C presented in Equation (1) is an identity matrix, and finally, the matrix D is considered null in this study.

6. Simulation Results

This section illustrates the performance of the proposed secure control design along with the TDS attack detection technique through the case study that was introduced in Section 5. On top of the simulation, the method was implemented in a hardware-in-the-loop (HIL) environment to show that the proposed method is practical. For the HIL testing, we used a DS1104 Controller Board in connection with the MATLAB Simulink software. The LFC model was implemented via MATLAB Simulink 2019a, and it was converted into a C program to be loaded into the Dspace board. The results were observed using the Dspace console in real time. To show that the proposed method can perform well under measurement noise, we added zero-mean Gaussian noise during the HIL performance testing. As shown in Figure 3, the NCS, including two agents, was subjected to TDS attacks.

Table 2. Simulated Power Areas’ Parameter Values

Description	Symbol	Power Area 1	Power Area 2
Generator Moment of Inertia	$J_1$	10	12
Frequency Bias Factor	${\beta }_1$	21.5	21
Speed-Drop Coefficient	${\omega }_1$	0.05	0.05
Damping Coefficient	${\mu }_1$	1.5	1
Governor Time Constant	$T_{g,1}$	0.12 s	0.18 s
Turbine Time Constant	$T_{tu,1}$	0.2 s	0.45 s
Stiffness Constant i-j	$T_{1,2}$	0.198 pu/rad	0.198 pu/rad

illustrates the parameter values that were used in the simulation.

The delay attacks were simulated based on the following assumptions:

Assumption 1.1.

The TDS attack takes place at a certain moment and remains constant.

Assumption 1.2.

The TDS attack affects all the states. The starting moment and the delay period are the same for all the states.

Assumption 1.3.

From the moment the attack is launched, it persists until the end of the simulation.

6.1. Vulnerability Analysis

When running the NCS in an optimal control situation, with no compensation algorithm to correct the delays, it can be observed that the system becomes unstable for attacks of $\tau =190$ ms or higher. Figure 4 and Figure 5 show the response of the system under a TDS attack. Both attacks were started at $t_0=1$ s, but the intensity of the attack is different. In the first case, $\tau =0.19$ s, and in the other one, $\tau =0.2$ s. It can be observed that the delay of $0.2$ s had an aggressive effect on the system, leading the response to a divergent behavior with a highly increasing rate. Figure 4 represents a threshold condition, where the system started facing unstable responses due to the delay. It is possible to observe that the instability started around the instant at 30 s and the oscillations grew at a low rate. However, it was an unstable condition, and the system could not work under this attack. To detect and mitigate the effects of an attack, a resilient controller must be applied.

6.2. TDS Attack Detection and State Estimation

The observer compensation technique discussed in Section 4 made the system operate correctly, even with TDS attacks of around $\tau =260$ ms. The same TDS attack as that shown in Figure 5 was simulated, but the system was equipped with the proposed secure controller. As Figure 6 shows, the adverse effect of the TDS attack was improved by the proposed state estimation mechanism.

The simulation was repeated with different time delays inserted by the TDS attack into the NCS at different starting instants ($t_0=1,2,...,5$ seconds).

Table 3. Delay estimation results—MSE.

$\mathit{\tau }$	$\widehat{\mathit{\tau }}$	MSE
(s)	(s)	(s)
0.15	0.1538	5.26%
0.22	0.2202	4.61%
0.26	0.2540	5.70%

shows the results for three different time delays $\tau$. The results show an Mean Square Error (MSE) around 5%.

The estimation of the delay depends on the parameter $\alpha$ mentioned in (30). The definition of $\alpha$ is a result of a complex set of essays running under known conditions to evaluate how the system responds to an injected delay depending on the amount of delay and the time instant at which was deployed. When an attack takes place, the error between the actual and the estimated states from the observer increases, and this is also reflected in the variations in $\widehat{x}$. Using the second derivative of $\widehat{x}$, the time instant of the TDS attack is detected (as shown in Figure 7). Thus, it is deployed, and the error is used to define the value to be chosen for $\alpha$. The solution for computing $\alpha$ was created by using a constant value for alpha and then comparing the results with the offset that should be needed to get the correct values of $\widehat{\tau }$. A polynomial approximation was created by taking the instant values of $\dot{\tilde{x}}$; then, it was incorporated in the $\alpha$ computation.

6.3. Performance Evaluation

The performance of the method proposed in this paper is compared with the performance of the control method presented in [22], which works based on an adaptive NN technique to estimate the time delay to which the NCS is exposed. The simulations were performed based on the following assumptions:

Assumption 2.1.

The delay attack takes place in a certain moment and remains constant.

Assumption 2.2.

The delay attack targets only the state of $x_3\left(t\right)$.

Assumption 2.3.

The attack persists from the moment it is launched until the end of the simulation.

A delay $\tau =1$ s was inserted from $t_0=2$ s. The state estimation errors are shown in Figure 8. The results show that the observer was able to accurately estimate measurement signals, even when the NCS was under TDS attacks. The results associated with the proposed method are presented in Figure 9. As shown in the figure, it is clear that the proposed TDS attack detection technique is more accurate than the NN-based (traditional) detection technique.

The NN approach allows consecutive computations in order to correct the estimation error and compensate frequency discrepancies in the LFC. The proposed method based on the Lyapunov theory presented in (20) depends on the parameter $\alpha$, which is a characteristic quantity of the system, but it also depends on the instant the attack takes place. A study using the values of $\dot{\dot{\widehat{x}}}$, $\dot{\widehat{x}}$, and $\tilde{x}$ was used to calculate this parameter. So, the final value of $\widehat{\tau }$ was reached more quickly, but a steady-state error can happen. The better the adjustment of the $\alpha$ parameter, the lower the steady-state error.

Another experiment to validate the Lyapunov method for avoiding TDS attack effects was made in a hardware-in-the-loop environment using external hardware equipment, the dSPACE CP1104 platform. A feedback loop was made for the $x_3$ state through the connection on the board. A time delay of $\tau =1.0$ s affected the LFC, and the resilient performance of the proposed controller was seen in the results. The signal response on $x_3$ is shown in Figure 10. This test is important because it shows the effectiveness of the solution in a real-life system, demonstrating how the correction takes place to keep the system working properly, even when it is subjected to a TDS attack.

7. Conclusions

This paper presented an approach to providing adjustments to the input signal in an NCS structure in order to keep a plant working properly, even under a TDS attack. The compensation signal is defined based on the Lyapunov theory and a Luenberger observer. The proposed approach was evaluated through a case study in which a two-agent LFC system was monitored and controlled. The performance of the controller was validated in a hardware-in-the-loop simulation using the dSPACE platform to emulate the feedback loop of the NCS under TDS attacks. It should be noted that the proposed method can be applied to any NCSs, such as cooperative driving systems.

During the transient response of the system, the proposed delay estimation is more precise compared with other techniques in the literature. Furthermore, the controller and estimator were designed based on Lyapunov stability analysis, unlike other traditional techniques. When the most significant variations take place, it is possible to detect the peaks caused by the attack. The final portion of the transient response already has lower variation, and it brings uncertainties to the estimation of $\widehat{\tau }$. If the attack is deployed at an instant close to the starting point, the estimation is also affected because the observer will get the actual values from the plant. The variation in a delay over time is also a strong challenge for estimations, but this paper considered only constant delay attacks. Future work will enhance the proposed method to investigate time-variable TDS attacks. Although this paper focused on an NCS with dependent agents, the proposed method is general and can be used for a multi-agent system with independent dynamics.