In this paper, the problem of attack detection and isolation for a fleet of naval vessels as a multi-agent Cyber-Physical System (CPS) will be addressed. Towards this, in the first step, a time-varying distributed formation control for a fleet of naval vessels as a network of leader-follower multi-agent systems using adaptive observer is presented. After solving formation control for the fleet of naval vessel, the detection and isolation of cyber-attacks for the system based on the obtained protocol will be considered. We demonstrate that the adaptive observers employed by each agent can identify cyber-attacks on communication channels originating from neighboring vessels. Additionally, through the development of a bank of adaptive observers that utilize received information from neighboring vessels and subsequent analysis of available residuals, we can isolate the compromised communication channels. Several cyber-attack scenarios will be discussed to show the performance of the proposed methodology for a fleet of naval vessels.

This paper deals with the detection and identification of the type of cyber-attack in switched Cyber-Physical Systems (CPS) operating under the synchronous switching conditions. The suggested approach involves an auxiliary system with a particular structure on the plant side, along with three switched observers on the Command and Control (C& C) side. To accomplish detection and identification objectives, the output of the auxiliary system needs to be communicated as well as real measurements of the system. Using the communicated information, three sets of residuals are obtained based on output estimation errors of two Switched Unknown Input Observers (SUIO) and a Switched Luenberger Observer (SLO). In the suggested approach, no secure channel or system is required and the least possible amount of information needs to be secured, which corresponds to the delay between the mode of the plant and auxiliary systems. Various attack scenarios such as covert attack, False Data Injection (FDI) attack on the input channels, FDI attack on the measurement channels and zero-dynamics attacks can be efficiently detected and identified by the proposed methodology. Simulation results are provided to demonstrate the effectiveness of the proposed scheme.