Skip to content
SecurityHardware

Cybervert

A private signal hidden in an inverter's control loop, so faked sensor data gives itself away.

Harvard ES145 and independent research · 2025 to present

Nine panels in three columns comparing the detector across an accurate model, an inaccurate model, and a noise change with no attack. In the two attack columns the test statistic falls through the lower threshold and the alarm latches on.
The auxiliary test statistic across three cases. In the two attack cases it falls through the lower threshold within milliseconds of the attack and the alarm latches. In the third case the noise changes but no attack occurs, and the detector mostly holds.

The problem

A grid-tied inverter acts on what its sensors tell it. Change those readings and the inverter acts on a grid that is not real, and the control loop cooperates.

A careful attacker does not have to send anything that looks wrong. A replayed window of genuine past measurements is, by construction, statistically ordinary. Watching for anomalies will not catch it, because there is no anomaly.

The idea

Rather than watch the measurements, change them. The inverter adds a small private random signal, a watermark, on top of its own control action. It knows what it injected, so it knows what the measured current should do in response.

If the sensor path is honest, the watermark shows up in the returned measurement with the relationship physics says it should have. If an attacker is replaying old data or synthesising their own, their data cannot contain a reaction to a random signal that was generated after the data was recorded. The correlation collapses, and the collapse is what raises the alarm. The attacker does not have to make a mistake. They just have to not be able to see the future.

The dynamic watermarking technique itself comes from the control-theory literature. My work is on making it hold up on an inverter under conditions that resemble a real feeder rather than a clean simulation.

Six-panel plot on a black background. The panels show a grid disturbance profile with a voltage sag, frequency deviation and spike, an irradiance profile with cloud cover, a harmonic distortion spectrum with third, fifth and seventh harmonics, current transformer measurement noise, the T3 test statistic dropping through its threshold at the moment of attack, and the resulting alarm signal firing under both clean and stressed conditions.
The same detector run in simulation against a stressed feeder rather than a clean one. The disturbance profile follows IEEE 1547-2018, with cloud cover on the irradiance, third, fifth and seventh harmonics from a nonlinear load, and measurement noise on the current transformer. The alarm still fires at the attack under both the clean and the stressed profile. This is a simulated feeder, not a hardware test.

What I built

I wrote the full detection pipeline in MATLAB, from signal processing and statistical testing to automated Monte Carlo validation, reaching 98.4% attack detection with a 2.6% false-alarm rate in signal-level Monte Carlo runs. Through systematic debugging of a high-fidelity Simulink model, I traced a persistent detection failure to a broken control loop. With the loop fixed, the method worked in simulation once the underlying physics were sound.

The detector had to survive all of it without alarming, while still catching an attacker trying to stay quiet.

98.4%
Attacks detected, signal-level Monte Carlo
2.6%
False alarm rate, same runs
~15 ms
Typical detection latency, signal level
98%
Attacks detected under the full stressor profile, average-value inverter model
<1%
Per-sample false alarms, average-value inverter model
~100 ms
Detection latency on the average-value model
Two stacked plots. The upper plot shows the T3 test statistic for a baseline run with stressors off and an attack run with stressors on, both tracking together until the attack, when the statistic falls sharply through the three sigma threshold. The lower plot shows the alarm going from off to fired at that moment and staying fired.
A single replay attack at one second. The statistic tracks the unstressed baseline closely until the attack begins, then falls through the threshold and stays there.

Where it stands

The method works on a model that genuinely tracks, under a realistic stressor profile, with the detection and false-alarm rates quoted above. It has not been validated on hardware in the loop, and I do not claim a maturity level it has not earned. The next real step is hardware, and after that the more interesting question, which is what an inverter should safely do in the seconds after the alarm fires rather than merely that it fired.

Stack

MATLAB and Simulink, with Simscape Electrical for the converter models. Monte Carlo harnesses and ablation studies in MATLAB. The project began as coursework in Harvard's ES145 and I now take it forward independently.