Probabilistic state estimation for labeled continuous time Markov models with applications to attack detection

Dimitri Lefebvre (1) , Carla Seatzu (2) , Christoforos Hadjicostis (3) , Alessandro Giua (2)

1 GREAH - Groupe de Recherche en Electrotechnique et Automatique du Havre
2 UniCa - Università degli Studi di Cagliari = University of Cagliari
3 UCY - University of Cyprus [Nicosia]

This paper is about state estimation in a timed probabilistic setting. The main contribution is a general procedure to design an observer for computing the probabilities of the states for labeled continuous time Markov models as functions of time, based on a sequence of observations and their associated time stamps that have been collected thus far. Two notions of state consistency with respect to such a timed observation sequence are introduced and related necessary and sufficient conditions are derived. The method is then applied to the detection of cyber-attacks. The plant and the possible attacks are described in terms of a labeled continuous time Markov model that includes both observable and unobservable events, and where each attack corresponds to a particular subset of states. Consequently, attack detection is reformulated as a state estimation problem.

Mots clés: Discrete event systems; Stochastic systems; Markov model; Cyber-security; State estimation

Domaines: Automatique

Dimitri Lefebvre, Carla Seatzu, Christoforos Hadjicostis, Alessandro Giua. Probabilistic state estimation for labeled continuous time Markov models with applications to attack detection. Discrete Event Dynamic Systems, 2022, 32 (1), pp.65-88. ⟨10.1007/s10626-021-00348-y⟩. ⟨hal-03678976⟩