Evaluating the Effectiveness of Control Charting Schemes in Detecting Malicious Attacks Targeting Manufacturing Systems

Abstract

ABSTRACT The increasing risk and impact of cyber‐physical attacks on the manufacturing industry are driven by vulnerabilities in industrial control systems and digital manufacturing technologies. These attacks can be strategically engineered to modify product dimensions while evading detection by current quality control (QC) tools. With the rise of cyber‐physical attacks, new malicious process shift types are possible. Although QC studies have examined transient shifts from assignable causes, they have not specifically addressed intelligently designed attacks, which can dynamically alter both shift magnitude and duration, causing severe damage. This study aims to evaluate the performance of five control charting schemes in detecting intelligently designed cyber‐physical transient attacks. Three types of transient attacks were developed and investigated: (1) alternating shifts, (2) constant shifts, and (3) trending shifts. These attacks were designed from an attacker's perspective, exploiting control chart vulnerabilities in manufacturing processes by leveraging knowledge of statistical process control methods. The performance of the control charting schemes was assessed using the average run length (ARL), average number of successful attacks (ANSAs), average quality loss (AQL), and detection probability (DP). The design of these attacks considers three critical factors: the magnitude ( δ ), the duration (), and the frequency or time between attacks (TBA). Our findings indicate that schemes relying solely on the exponentially weighted moving average chart are particularly vulnerable to alternating attacks, recording the highest ARL, ANSA, and AQL compared to other schemes. This vulnerability arises from the inherent characteristics of the chart, specifically its memory. In contrast, schemes that incorporate the and/or charts performed significantly better when subjected to alternating attacks. Additionally, constant shifts resulted in a lower ARL for schemes using and/or charts for the δ values considered in this paper. For trending attacks, the scheme exhibited the lowest ANSA, while the chart scheme demonstrated the highest. Overall, the combination of and showed improved sensitivity and detection time across different attacks.