Discrete event system framework for fault diagnosis with measurement inconsistency: case study of rogue DHCP attack

Fault detection and diagnosis ( FDD ) facilitates reliable operation of systems. Various approaches have been proposed for FDD like Analytical redundancy ( AR ), Principal component analysis ( PCA ), Discrete event system ( DES ) model etc., in the literature. Performance of FDD schemes greatly depends on accuracy of the sensors which measure the system parameters. Due to various reasons like faults, communication errors etc., sensors may occasionally miss or report erroneous values of some system parameters to FDD engine, resulting in measurement inconsistency of these parameters. Schemes like AR, PCA etc., have mechanisms to handle measurement inconsistency, however, they are computationally heavy. DES based FDD techniques are widely used because of computational simplicity, but they cannot handle measurement inconsistency efficiently. Existing DES based schemes do not use Measurement inconsistent ( MI ) parameters for FDD. These parameters are not permanently unmeasurable or erroneous, so ignoring them may lead to weak diagnosis. To address this issue, we propose a Measurement inconsistent discrete event system ( MIDES ) framework, which uses MI parameters for FDD at the instances they are measured by the sensors. Otherwise, when they are unmeasurable or erroneously reported, the MIDES invokes an estimator diagnoser that predicts the state( s ) the system is expected to be in, using the subsequent parameters measured by the other sensors. The efficacy of the proposed method is illustrated using a pump-valve system. In addition, an MIDES based intrusion detection system has been developed for detection of rogue dynamic host configuration protocol ( DHCP) server attack by mapping the attack to a fault in the DES framework.