Consistency‐Based Detection of Additive False Data Injection Attacks via Trusted Output Reconstruction

ABSTRACT

This paper investigates the detection of additive false data injection (FDI) attacks on monitored output channels in linear time‐invariant systems with a trusted and monitored output partition. Since the monitored output channel may contain unknown constant bias and slowly varying baseline drift, direct thresholding is generally unreliable. To address this problem, a trusted‐output‐driven observer is used to reconstruct the monitored output, and a consistency residual is generated by comparing the measured monitored output with its reconstruction. A bias‐aware windowed detection statistic based on mean removal is then developed to suppress constant bias and mitigate slowly varying baseline drift. Under bounded disturbance assumptions, deterministic no‐false‐alarm and guaranteed‐detection conditions are established with an explicit nuisance bound. Furthermore, quantitative mean‐removal effects are derived for representative attack classes, including step, sinusoidal and ramp‐like attacks, which clarifies which attack patterns retain sufficient mean‐removed energy for guaranteed detection. Simulation studies employ empirically calibrated thresholds, investigate detection performance under different attack scenarios, and validate the proposed method through numerical simulations. The results show that the proposed method can detect additive FDI attacks that are invisible to trusted‐output‐only residual generators while maintaining robustness to baseline uncertainty and measurement disturbances.