Interactive Bias Injection Attacks Against Cyber-Physical Control Systems

Abstract

As industrial infrastructure increasingly relies on high-performance motion control, the security of feedback loops in Cyber-Physical Systems (CPS) has become a critical concern. This dissertation investigates cyber-attack vulnerabilities in closed-loop controlled Brushless DC (BLDC) motor systems, demonstrating that standard state estimation techniques like the Kalman Filter can be exploited to mask catastrophic physical damage. Through systematic modeling and simulation, this research establishes a taxonomy of six distinct bias injection attack modalities: Probing Mode attacks for reconnaissance; Current Drainage attacks exploiting saw-function modulation; Voltage Hopping attacks achieving high-frequency manipulation above circuit cutoff frequencies; and three pulsation-based attacks (Induced, Extended, and Hyper-Spiking) that exploit dynamic resonance and phase synchronization. This classification distinguishes between transient disruptions and more persistent threats, demonstrating that Extended Pulsation is a necessary condition for the manifestation of latent Hyper-Spiking phenomena.

Novel contributions include the discovery of the voltage hopping phenomenon, where voltage excursions of +/- 500 V occur at 2.1875 kHz with minimal impact on observable state variables, and the hyper-spiking attack mechanism producing voltage spikes up to 6000 V through phase-tuned resonance. The "attack withdrawal syndrome" is identified and characterized, demonstrating that abrupt attack termination can produce transients exceeding attack peak values by factors of up to 3.8. A comprehensive taxonomy relating saw-function asymmetry parameter (KS) to current drainage signatures reveals that symmetric profiles enhance stealth while asymmetric profiles maximize damage observability.

A Linear Defense Strategy using parallel linear-dynamic prediction is proposed to neutralize current drainage and induced pulsation attacks. By employing anticipatory compensation, the strategy also effectively mitigates attack withdrawal syndrome, as confirmed through experimental validation. The defense architecture operates within an asymmetric Stackelberg game framework, achieving real-time performance suitable for embedded controllers. By establishing the theoretical foundations for securing feedback loops against resonance-based manipulation, this research provides the necessary framework for designing resilient next-generation industrial controllers.