Security Index from Input/Output Data: Theory and Computation

Abstract

The concept of a security index quantifies the minimum number of components that must be compromised to carry out a stealth attack. This metric enables system operators to assess the security risk of each component and implement countermeasures accordingly. In this paper, we introduce a data-driven security index that can be computed solely from input/output data when the system model is unknown. We show a sufficient condition under which the data-driven security index coincides with the model-based security index, which implies that the exact risk level of each component can be identified solely from data. We also provide an algorithm for computing the data-driven security index.

Accepted to IFAC World Congress 2026