This paper proposes an improved proactive defense strategy for secure remote state estimation in cyber-physical systems (CPSs) subject to unknown-but-bounded (UBB) noises, disturbances and man-in-the-middle (MITM) attacks. First, an unknown input observer (UIO) is designed to estimate the system state. To improve the estimation accuracy, a decoupling approach, which can be used to decouple the UBB measurement noise and disturbances, is proposed to overcome the effect of measurement noises and process disturbances in the error system. Then, H∞ optimization is introduced to enhance the robustness of the error system. Subsequently, an unpredictable and time-varying zonotopic watermarking mechanism is introduced into the sensor-to-estimator communication channel. Furthermore, this proactive defense mechanism operates with strict transparency, eliminating false alarms and preserving nominal estimation performance under attack-free conditions, while inherently forcing stealthy data manipulations to violate predefined detection thresholds. Finally, numerical simulations on a second-order linear system demonstrate that the proposed strategy effectively amplifies malicious interceptions, guaranteeing reliable MITM attack detection against stealthy MITM attacks.
- Open Access
- Article
Interval Estimation and Attack Detection for CPSs Based on Unknown Input Observer and Watermarking
- Zelong Lu,
- Chaojiang Liang,
- Zhenhua Wang *
Author Information
Received: 28 Apr 2026 | Revised: 28 May 2026 | Accepted: 02 Jun 2026 | Published: 30 Jul 2026
Abstract
Keywords
cyber-physical systems (CPSs) | man-in-the-middle (MITM) attacks | state estimation | unknown-but-bounded (UBB) noises | watermarking
References
- 1.
Ding, D.; Han, Q.-L.; Ge, X.; et al. Secure State Estimation and Control of Cyber-Physical Systems: A Survey. IEEE Trans. Syst. Man Cybern. Syst. 2021, 51, 176–190.
- 2.
Guo, Z.; Shi, D.; Johansson, K.H.; et al. Worst-Case Stealthy Innovation-Based Linear Attack on Remote State Estimation. Automatica 2018, 89, 117–124.
- 3.
Huang, J.; Ho, D.W.C.; Li, F.; et al. Secure Remote State Estimation Against Linear Man-in-the-Middle Attacks Using Watermarking. Automatica 2020, 121, 109182.
- 4.
Zhang, Y.; Peng, Z.; Wen, G.; et al. Optimal Stealthy Linear Man-in-the-Middle Attacks with Resource Constraints on Remote State Estimation. IEEE Trans. Syst. Man Cybern. Syst. 2024, 54, 445–456.
- 5.
Jovanov, I.; Pajic, M. Relaxing Integrity Requirements for Attack-Resilient Cyber-Physical Systems. IEEE Trans. Autom. Control 2019, 64, 4843–4858.
- 6.
Gao, Y.; Sun, G.; Liu, J.; et al. State Estimation and Self-Triggered Control of CPSs against Joint Sensor and Actuator Attacks. Automatica 2020, 113, 108687.
- 7.
Guo, Z.; Wang, X.; Tian, M.; et al. Zonotopic State Estimation and Fault Detection for Discrete-Time Linear Systems Under DoS Attacks: A Switching Controller Design Mechanism. Automatica 2026, 185, 112833.
- 8.
Hu, C.; Ding, S.; Xie, X. Event-Based Distributed Set-Membership Estimation for Complex Networks under Deception Attacks. IEEE Trans. Autom. Sci. Eng. 2024, 21, 3719–3729.
- 9.
Shoukry, Y.; Nuzzo, P.; Puggelli, A.; et al. Secure State Estimation for Cyber-Physical Systems Under Sensor Attacks: A Satisfiability Modulo Theory Approach. IEEE Trans. Autom. Control 2017, 62, 4917–4932.
- 10.
Hu, S.; Chen, X.; Li, J.; et al. Observer-Based Resilient Controller Design for Networked Stochastic Systems under Coordinated DoS and FDI Attacks. IEEE Trans. Control Netw. Syst. 2024, 11, 890–901.
- 11.
Zhu, K.; Wang, Z.; Ding, D.; et al. Encryption-Decryption-Based Set-Membership Filtering for Two-Dimensional Systems: On Security and Boundedness. Automatica 2025, 173, 112091.
- 12.
Hu, C.; Xie, X.; Ding, S.; et al. Distributed Set-Membership Fusion Estimation for Complex Networks with Communication Constraints. IEEE Trans. Autom. Sci. Eng. 2025, 22, 3877–3886.
- 13.
Casini, M.; Garulli, A.; Vicino, A. Set Membership State Estimation for Discrete-Time Linear Systems with Binary Sensor Measurements. Automatica 2024, 159, 111396.
- 14.
Yang, H.; Yan, H.; Li, Z.; et al. Set-Membership Estimation for Nonlinear Systems Based on Zonotope Analysis. Automatica 2025, 177, 112278.
- 15.
Wang, Z.; Lian, D.; Puig, V.; et al. Fault Detection for Brushless Direct-Current Motor Using Descriptor System-Based Set-Membership Estimation. IEEE Trans. Control Syst. Technol. 2025, 33, 1640–1650.
- 16.
Efimov, D.; Raissi, T.; Zolghadri, A. Control of Nonlinear and LPV Systems: Interval Observer-Based Framework. IEEE Trans. Autom. Control 2013, 58, 773–778.
- 17.
Li, G.; Wang, Z.; Bai, X.; et al. Dynamic Event-Triggered State Estimation for Power Harmonics with Quantization Effects: A Zonotopic Set-Membership Approach. IEEE Trans. Sustain. Comput. 2024, 9, 803–813.
- 18.
Espindola-Winck, G.; Hardouin, L.; Lhommeau, M. On the Set-Estimation of Uncertain Max-Plus Linear Systems. Automatica 2025, 171, 111899.
- 19.
Han, W.; Wang, Z.; Shen, Y.; et al. Interval Estimation for Uncertain Systems via Polynomial Chaos Expansions. IEEE Trans. Autom. Control 2021, 66, 468–475.
- 20.
Yang, H.; Yan, H.; Shi, Y.; et al. Distributed Zonotopic State Estimation for 2-D Systems over Wireless Sensor Networks. Automatica 2026, 190, 113070.
- 21.
Fei, Z.; Yang, L.; Sun, X.-M.; et al. Zonotopic Set-Membership State Estimation for Switched Systems with Restricted Switching. IEEE Trans. Autom. Control 2022, 67, 6127–6134.
- 22.
Kulmburg, A.; Schfer, L.; Althoff, M. Approximability of the Containment Problem for Zonotopes and Ellipsotopes. IEEE Trans. Autom. Control 2025, 70, 8104–8119.
- 23.
Liang, C.; Niu, B.; Guo, Z.; et al. Interval Estimation for Discrete-Time Linear Systems Based on Unknown Input Observer and Reachability Analysis. Asian J. Control 2026, 28, 773–781.
- 24.
Yang, G.; Rezaee, H.; Serrani, A.; et al. Sensor Fault-Tolerant State Estimation by Networks of Distributed Observers. IEEE Trans. Autom. Control 2022, 67, 5348–5360.
- 25.
Xing, M.; Lu, J.; Liu, Y. Remote Secure Fusion Estimation of Cyber–Physical Systems under False Data Injection Attacks. Automatica 2025, 177, 112271.
- 26.
Liu, Q.; Wang, J.; Ni, Y.; et al. Performance Analysis for Cyber–Physical Systems under Two Types of Stealthy Deception Attacks. Automatica 2024, 160, 111446.
- 27.
Liu, H.; Wang, S.; Niu, B.; et al. A Novel Attack Detection for Linear Systems with Unknown-But-Bounded Noises. IEEE Trans. Syst. Man Cybern. Syst. 2022, 52, 4223–4232.
- 28.
Keshk, M.; Sitnikova, E.; Moustafa, N.; et al. An Integrated Framework for Privacy-Preserving Based Anomaly Detection for Cyber-Physical Systems. IEEE Trans. Sustain. Comput. 2021, 6, 66–79.
- 29.
Samineni, N.R.; Barbhuiya, F.A.; Nandi, S. Stealth and Semi-Stealth MITM Attacks, Detection and Defense in IPv4 Networks. In Proceedings of the 2nd IEEE International Conference on Parallel, Distributed and Grid Computing, Solan, India, 6–8 December 2012; pp. 364–367.
- 30.
Liang, C.; Guo, Z.; Niu, B.; et al. Sensor Attacks Detection and Reconstruction for AUVs: An Improved Zonotopic Analysis Approach. IEEE Internet Things J. 2025, 12, 40620–40627.
- 31.
Liang, C.; Niu, B.; Guo, Z.; et al. Attack Detection and Reconstruction for CPSs Based on Unknown Input Observer and Reachability Analysis. IEEE Trans. Syst. Man Cybern. Syst. 2025, 55, 9645–9654.
- 32.
Zhang, K.; Keliris, C.; Parisini, T.; et al. Passive Attack Detection for a Class of Stealthy Intermittent Integrity Attacks. IEEE/CAA J. Autom. Sin. 2023, 10, 898–915.
- 33.
Pasqualetti, F.; Drfler, F.; Bullo, F. Attack Detection and Identification in Cyber-Physical Systems. IEEE Trans. Autom. Control 2013, 58, 2715–2729.
- 34.
Liu, H.; Li, Y.; Han, Q.-L.; et al. Watermark-Based Proactive Defense Strategy Design for Cyber-Physical Systems with Unknown-but-Bounded Noises. IEEE Trans. Autom. Control 2023, 68, 3300–3315.
- 35.
Porter, M.; Hespanhol, P.; Aswani, A.; et al. Detecting Generalized Replay Attacks via Time-Varying Dynamic Watermarking. IEEE Trans. Autom. Control 2021, 66, 3502–3517.
- 36.
Hespanhol, P.; Porter, M.; Vasudevan, R.; et al. Sensor Switching Control Under Attacks Detectable by Finite Sample Dynamic Watermarking Tests. IEEE Trans. Autom. Control 2021, 66, 4560–4574.
- 37.
Shangguan, L.; Chour, K.; Ko, W.H.; et al. Dynamic Watermarking for Cybersecurity of Autonomous Vehicles. IEEE Trans. Ind. Electron. 2023, 70, 11735–11743.
- 38.
Combastel, C. Zonotopes and Kalman Observers: Gain Optimality under Distinct Uncertainty Paradigms and Robust Convergence. Automatica 2015, 55, 265–273.
- 39.
Tang, W.; Wang, Z.; Shen, Y. Interval Estimation for Discrete-Time Linear Systems: A Two-Step Method. Syst. Control Lett. 2019, 123, 69–74.
- 40.
Qing, H. Set Membership State Estimation for Nonlinear Systems in the Presence of Bounded Disturbances. In Proceedings of the 2007 Chinese Control Conference, Zhangjiajie, China, 26–31 July 2007; pp. 196–201.
- 41.
Silvestre, D. Comparison of Recent Advances in Set-Membership Techniques: Application to State Estimation, Fault Detection and Collision Avoidance. Eur. J. Control 2025, 81, 101161.
- 42.
Xi, R.; Tang, W.; Chen, J. Robust Sliding Mode Control Based on Set-Membership Estimation for UAV Trajectory Tracking Under External Disturbances. In Proceedings of the 14th IEEE Data Driven Control and Learning Systems (DDCLS), Wuxi, China, 9–11 May 2025; pp. 1008–1013.
- 43.
Zhang, F., ed. The Schur Complement and Its Applications; Springer Science & Business Media: Berlin/Heidelberg, Germany, 2006.
- 44.
Barata, J.C.A.; Hussein, M.S. The Moore-Penrose Pseudoinverse: A Tutorial Review of the Theory. Braz. J. Phys. 2012, 42, 146–165.
- 45.
Guan, Y.; Saif, M. A Novel Approach to the Design of Unknown Input Observers. IEEE Trans. Autom. Control 1991, 36, 632–635.
- 46.
Cao, G.; Wang, J. Distributed Unknown Input Observer. IEEE Trans. Autom. Control 2023, 68, 8244–8251.
- 47.
Penrose, R. A Generalized Inverse for Matrices. In Mathematical Proceedings of the Cambridge Philosophical Society; Cambridge University Press: London, UK, 1955; Vol. 51, pp. 406–413.
- 48.
Kopetzki, A.-K.; Sch¨urmann, B.; Althoff, M. Methods for Order Reduction of Zonotopes. In Proceedings of the 56th IEEE Annual Conference on Decision and Control (CDC), Melbourne, VIC, Australia, 12–15 December 2017; pp. 5626–5633.
This work is licensed under a Creative Commons Attribution 4.0 International License.
Suite 4002 Level 4, 447 Collins Street, Melbourne, Victoria 3000, Australia
General Inquiries: info@sciltp.com