A Posteriori Detection of Moment of Attack on Cyber-physical Systems: A Back-and-forth Observer Approach^⁎

In this paper, we address the problem of finding the moment at which an attack to a cyber-physical system initiates, which we call the “moment of attack.” The proposed algorithm is not a real-time method, but the search is performed a posteriori. Nevertheless, the problem becomes of particular interest for forensic evidence, or for high-cost manufacturing processes. In fact, when a production system is attacked, the manufactured output before the attack does not have to be discarded if exact time of the attack is found. To tackle the problem for “temporarily stealthy” sensor attack of polynomial types (with which the conventional real-time anomaly detectors hardly estimate the moment of attack), we propose a batch-type detection algorithm for the moment of attack via the back-and-forth observer approach.