Stealthy Sensor Attacks on IoT-Enabled Model Predictive Control of Perishable-Goods Production: Residual-Based Detection, Mitigation, and Secure Sensing Design

IoT-enabled model predictive control (MPC) lowers cost and spoilage in perishable-goods production but depends on sensor data that an attacker can falsify, which network intrusion detection cannot verify. We study sensor attacks on a published IoT-MPC plant model and a defense that needs no additional model: a CUSUM test on the innovations of the Kalman filter already in the loop, isolation of flagged sensors, and re-estimation from the attack onset. With accurate sensors and an exact model, a falsified energy meter raises the tracking cost by 71% and replay raises spoilage by 27%; the defense detects them in 89% and 100% of runs at a nominal 1% false-alarm rate and limits the cost increases to 9% and 3%. In closed loop, static detectors miss moderate and slow attacks that predictive detectors find. Detection weakens with sensor noise and model error; a fully informed attacker raises the cost by 93% undetected, but model errors expose it, and a redundant meter on an independent path limits it to about 15%. On the HAI testbed, an identified-model residual detector finds 32 of 34 attacks at 0.24 false alarms per day, against 27 for a windowed autoencoder and 21 for a static range check.