On Reachable Sets of Hidden CPS Sensor Attacks

For given system dynamics, observer structure, and observer-based fault/attack detection procedure, we provide mathematical tools - in terms of Linear Matrix Inequalities (LMIs) - for computing outer ellipsoidal bounds on the set of estimation errors that attacks can induce while maintaining the alarm rate of the detector equal to its attack-free false alarm rate. We refer to these sets to as hidden reachable sets. These bounds quantify the...