A Mission-Centric Cyber-Resilience Benchmark for Silent-Watch Operation of Electrified Ground-Platform Power Architectures

Technical Summary: A Mission-Centric Cyber-Resilience Benchmark for Silent-Watch Operation of Electrified Ground-Platform Power Architectures

Problem Statement
The electrification of military ground platforms introduces a new threat surface for mission planners, particularly during "silent-watch" operations where the engine is off and mission loads must be sustained solely by stored battery energy. In this mode, a supervisory controller arbitrates between critical loads (e.g., sensors, communications) and sheddable loads (e.g., climate control) based on the perceived state of charge (SOC). If an adversary compromises the supervisor's perception of the state—specifically through SOC spoofing—the platform may lose endurance and critical-load service even if the physical hardware remains intact. While prior research has established the technical plausibility of such attacks in civilian vehicles and power systems, there is a lack of a compact benchmark that evaluates these cyber-physical attacks based on their direct consequences for mission objectives (such as endurance and critical-load continuity) rather than solely on intrusion detection metrics.

Methodology
The authors propose a reduced-order, architecture-level benchmark designed to evaluate cyber-resilience in silent-watch scenarios. The system is modeled as a DC-bus-centered source-storage-load-control system with a battery, an optional auxiliary source (held at zero for silent watch), and decomposed loads.

• Threat Model: The primary threat is positive bias injection into the SOC measurement ($s_m$) received by the supervisor. This causes the supervisor to overestimate available energy, delaying protective shedding of non-critical loads. Two attack window variants are tested: a single continuous window and a multi-window variant.
• Defense Model: The defense layer employs a residual-based detector that compares the biased measurement ($s_m$) against an independently propagated estimate ($\hat{s}$) derived from measured battery power balance. If the residual exceeds a threshold for a confirmation window, a fallback controller triggers aggressive shedding of the remaining sheddable load.
• Evaluation Framework: The benchmark compares three reference cases:
  1. Nominal: No attack, no defense.
  2. Attacked: Attack active, no defense.
  3. Defended: Attack active, with residual detection and fallback shedding.
• Metrics: Four mission-facing metrics are recorded: Silent-watch endurance (time to mission abort), critical-load served ratio, unsafe-voltage duration (time spent below safe voltage bands), and time to detection.
• Implementation: The benchmark is implemented in both a MATLAB reference model and a Simulink model. A regression harness verifies parity between the two across five scenarios to ensure a software-verified basis for future Hardware-in-the-Loop (HIL) testing with OPAL-RT and EXataCPS.

Key Contributions

1. Mission-Centric Benchmark Formulation: The paper formulates a benchmark that links SOC spoofing directly to mission outcomes (endurance, critical-load service) rather than evaluating attacks solely through detector response or control error.
2. Stealth-versus-Impact Envelope Characterization: The study characterizes a three-regime structure under SOC-bias sweeps:
   • Stealth Regime: Small biases remain below the detector's noise floor with negligible mission impact.
   • Delay Regime: Intermediate biases trigger detection but cause an endurance deficit bounded by a derived closed-form expression involving bias magnitude, shed power, and average battery draw.
   • Full-Blind Regime: Large biases (exceeding the difference between warning and critical SOC thresholds) disable the SOC-driven guard entirely.
3. Fallback-Depth Design Constraint: The paper identifies that defense value is contingent on the depth of the fallback action. It demonstrates that an undersized fallback shedding fraction can result in a "Defended" case that performs worse than the "Attacked" case (accumulating more unsafe-voltage exposure) until the shed fraction exceeds a specific threshold (approximately 0.4 in the reported configuration).

Results

• Headline Comparison: Under a large bias attack ($b_a = 0.50$), the "Attacked" case reduced endurance by ~5 minutes and more than doubled unsafe-voltage exposure compared to the "Nominal" case. The "Defended" case, utilizing a 5-second detection latency, eliminated unsafe-voltage exposure entirely and extended endurance beyond the Nominal case by restoring critical-load service to unity.
• Regime Analysis: The closed-form endurance bound for the delay regime accurately predicted simulation results with deviations under one minute. The transition to the full-blind regime occurs when the bias exceeds the margin between the SOC warning and critical thresholds.
• Defense Sensitivity: Sensitivity analysis revealed that if the fallback shedding fraction is too low (e.g., 0.2), the defense fails to lift the bus voltage out of the unsafe band, leading to 810 seconds of unsafe exposure compared to 516 seconds in the undefended case. A shed fraction above 0.4 is required for the defense to outperform the undefended case, and 0.6 is required to eliminate unsafe exposure for the tested bias magnitude.
• Software Verification: The MATLAB and Simulink implementations showed exact parity in mission metrics and trajectory differences of zero to reported precision, validating the model for future HIL deployment.

Significance and Claims
The paper claims to fill a gap in cyber-physical security research by providing a benchmark that allows mission planners and defense developers to compare attacks and defenses on a common, mission-facing basis. It argues that for silent-watch operations, the critical question is not merely whether an intrusion is detected, but whether the platform can still complete its assigned task.

The authors modestly frame the results as changes in endurance and service metrics relative to a fixed, reduced-order model, rather than absolute predictions for a specific vehicle platform. The primary significance lies in demonstrating that:

1. SOC spoofing creates a structured, analytically approximated attack envelope.
2. Detection alone is insufficient; the depth of the fallback action is a critical architectural design variable.
3. A software-verified baseline exists to support future high-fidelity HIL testing of silent-watch supervisory loops against coordinated multi-channel adversaries.