# Attack-Resilient Design for Connected and Automated Vehicles

Tianci Yang 1, Carlos Murguia 2, Dragan Nešić3, _Fellow, IEEE_ , and Chau
Yuen1, _Fellow, IEEE_ 1 T. Yang and Chau Yuen are with Nanyang Technological
University, Singapore. Emails: {tianci.yang<EMAIL_ADDRESS>Carlos
Murguia is with the Department of Mechanical Engineering, Eindhoven University
of Technology, The Netherlands. Email<EMAIL_ADDRESS>Dragan Nešić is
with the Department of Electrical and Electronics Engineering, University of
Melbourne, Australia. Email<EMAIL_ADDRESS>
###### Abstract

By sharing local sensor information via Vehicle-to-Vehicle (V2V) wireless
communication networks, Cooperative Adaptive Cruise Control (CACC) is a
technology that enables Connected and Automated Vehicles (CAVs) to drive
autonomously on the highway in closely-coupled platoons. The use of CACC
technologies increases safety and the traffic throughput, and decreases fuel
consumption and CO2 emissions. However, CAVs heavily rely on embedded
software, hardware, and communication networks that make them vulnerable to a
range of cyberattacks. Cyberattacks to a particular CAV compromise the entire
platoon as CACC schemes propagate corrupted data to neighboring vehicles
potentially leading to traffic delays and collisions. Physics-based monitors
can be used to detect the presence of False Data Injection (FDI) attacks to
CAV sensors; however, unavoidable system disturbances and modelling
uncertainty often translates to conservative detection results. Given enough
system knowledge, adversaries are still able to launch a range of attacks that
can surpass the detection scheme by hiding within the system disturbances and
uncertainty – we refer to this class of attacks as stealthy FDI attacks.
Stealthy attacks are hard to deal with as they affect the platoon dynamics
without being noticed. In this manuscript, we propose a co-design methodology
(built around a series convex programs) to synthesize distributed attack
monitors and $H_{\infty}$ CACC controllers that minimize the joint effect of
stealthy FDI attacks and system disturbances on the platoon dynamics while
guaranteeing a prescribed platooning performance (in terms of tracking and
string stability). Computer simulations are provided to illustrate the
performance of out tools.

###### Index Terms:

Connected vehicles, cyber-physical systems, model-based fault/attack monitors,
stealthy attacks, resilience, CACC.

##  I Introduction

Nowadays, our society is facing serious traffic congestion problems caused by
the population increase in urban areas and limited road capacity. Taking
advantage of recent sensing and wireless communication technologies, Connected
and Automated Vehicles (CAVs) use on-board sensors and software to perceive
the surroundings so that different driving tasks (e.g., lane keeping, vehicle
following, and obstacle avoidance) can be carried out. Therefore, accurate
sensor readings play a vital role for guaranteeing safety and security of
CAVs. Inaccurate sensor information resulting from faults or cyberattacks can
cause traffic accidents and even fatalities in the worst case. However, CAVs
sensors remain vulnerable to adversarial attacks as they can be accessed
remotely through compromised networks, road units, and vehicle computers. In
[1], Petit et al. show that radars and LiDARs that measure relative
distance/velocity can be attacked remotely. In [2], the authors show that
adversaries are able to compromise the LiDAR of a self-driving vehicle by
generating artificial echoes of objects and vehicles. In [3], the
vulnerability of millimeter-wave radars, ultrasonic sensors, and forward-
looking cameras to attacks is investigated. They show that off-the-shelf
hardware can be used to perform jamming and spoofing attacks on the Tesla
Model S automobile. Moreover, in the context of Cooperative Adaptive Cruise
Control (CACC), groups of CAVs drive together in tightly coupled platoons by
sharing local sensor information with adjacent vehicles and roadside units via
wireless communication networks [4]-[6]. Therefore, for this class of
cooperative driving schemes, the effect of malicious sensor readings in one
vehicle propagates throughout the platoon leading to an amplified effect in
the overall platoon dynamics. The above mentioned work highlights the fact
that emerging CAVs not only bring convenience, efficiency, and comfort, but
also many new security challenges to be addressed before these technologies
can be widely used in society.

Existing results to deal with compromised sensors mainly focus on the problem
of attack detection and isolation for vehicles under sensor attacks. For
instance, in [7, 8], the authors exploit sensor redundancy and provide
detection and isolation algorithms for a single vehicle under sensor attacks.
In [9], the authors provide an algorithm for detecting sensor attacks on
connected vehicles using a set-membership filtering technique. In [10], the
problem of attack detection and estimation for connected vehicles under sensor
attacks is solved using an unbiased finite impulse response (UFIR) estimator.
In our previous work [11], we provide an attack-resilient sensor fusion
algorithm for obtaining a secure estimation of vehicle states when some of the
sensors are under attack. Then, the state estimation is used for attack
detection and isolation.

Standard residual-based fault/attack detectors are widely used for identifying
system faults and cyberattacks [12][13]. The detection schemes compute the
residual as the deviation between the sensor readings and the estimated values
provided by a system estimator. If the residual crosses a predefined
threshold, alarms are triggered. This standard detection procedure has also
been shown effective for detecting faults/attacks on CAVs [14]-[17]. When
anomalous sensors are detected, a CAV might stop the engine for preventing
severe consequences, e.g., vehicle collisions. However, detection schemes are
often conservative due to modeling uncertainties, sensor noise, network
effects, etc. In many cases, attack signals can hardly be distinguished from
the system disturbances under normal conditions. Therefore, by carefully
designing the attack strategy, malicious signals that go undetected by the
system attack detector can be injected into CAV sensors. We refer to this
class of attacks as stealthy attacks. Stealthy attacks can be a great threat
to CAVs security since they affect the vehicle dynamics without being noticed.
It follows that methodologies for constraining the capability of adversaries
to inject stealthy attacks are highly needed.

In this manuscript, we consider platoons of CAVs driving cooperatively via
CACC. We derive mathematical tools, in terms of semi-definite programs, for
designing optimal fault/attack detectors and CACC controllers so that the
platoon performance degradation caused by stealthy sensor attacks is minimal
and not harmful. As a metric to quantify the impact of attacks, we use the
“size” (in terms of volume) of the set of state trajectories (e.g., relative
positions, velocities, and accelerations) that stealthy sensor attacks can
induced in each CAV. We refer to these sets as stealthy reachable sets. Large
(small) reachable sets imply that the attack can induce a large (small) set of
driving trajectories in the vehicle. Even for linear models of CAVs, computing
reachable sets exactly is computationally expensive and often not even
tractable. Instead, we work with ellipsoidal outer approximations of reachable
sets and design detectors and controllers to minimize their volume (reducing
thus the size of the actual reachable set). As a second security metric, we
use the minimum distance of stealthy reachable sets to critical states –
states that if reached compromise the integrity and safety of the vehicle,
e.g., abnormally high/low velocities or too small inter-vehicle distances.
This distance characterizes if stealthy attacks can actually cause a critical
event or not given how they access the platoon dynamics (i.e., what
sensors/vehicles are compromised). Hence, as design specification, we aim to
synthesise detectors and controllers that make it impossible for stealthy
attacks to reach a critical state.

There are a few related results in the literature. In [18], Dadras et al.
provide a reachability analysis for a non-cooperative vehicle platoon, among
which one malicious vehicle modifies its own acceleration randomly to degrade
the platooning performance. Similarly, in [19], reachability analysis is
provided for CAVs under random false-data injection and message delay attacks
on V2V networks. We remark that the problem we consider is fundamentally
different from the ones considered in [18] and [19]. First, the injected false
data in [18] and [19] is randomly constructed without using model knowledge.
These attack signals can usually be detected by standard fault detectors and
hence are, by definition, not stealthy. Besides, [18] and [19] assume no
system disturbances exist, even though noise in sensors and V2V communication
networks and modeling uncertainty are unavoidable. Most importantly, [18] and
[19] focus on analysis, i.e., they analyze the attacker’s reachable set after
different system components such as estimators and controllers are already
designed without security considerations. On the contrary, our work focuses on
synthesis, i.e., system components are designed to minimize the impact of
stealthy attacks quantified by our two proposed security metrics (stealthy
reachable sets and distance to critical states). The mathematical machinery
used here is inspired by the results in [20], where reachability analysis
approaches are provided for general Cyber-Physical Systems (CPSs) under
different classes of disturbances and attacks. Summarizing, the main
contribution of this manuscript is a set of synthesis tools (in terms of the
solution a series of convex programs) to design robust state estimators,
estimator-based fault/attack detectors, and CACC controllers for CAVs driving
in platoons such that: 1) prescribed attack-free platooning performance is
guaranteed (in terms of tracking and string stability); 2) the platooning
performance degradation caused by stealthy sensors attacks is minimal (in
terms of the size of stealthy reachable sets) and unharmful (characterized by
strictly positive distances from reachable sets to critical states).

The paper is organized as follows. In Section II, some preliminary results
needed for the subsequent sections are introduced. In Section III, the
considered vehicle platoon system is described. In Section IV, we provide
tools for designing state estimators, an fault/attack detector, and
controllers that minimize the attacker’s capabilities with attack-free
performance guaranteed. A method for evaluating the resilience of CAVs to
stealthy attacks is given in Section V. Simulation study is conducted in
Section VI to demonstrate the performance of our tools. Finally, in Section
VII, concluding remarks are given.

##  II Preliminaries

###  II-A Notation

We denote the set of real numbers by $\mathbb{R}$, the set of natural numbers
by $\mathbb{N}$, and $\mathbb{R}^{n\times m}$ the set of $n\times m$ matrices
for any $m,n\in\mathbb{N}$. For any vector $v\in\mathbb{R}^{n}$, we denote
$v^{J}$ the stacking of all $v_{i}$, $i\in J$,
$J\subset\left\\{1,\ldots,n\right\\}$, $|v|=\sqrt{v^{\top}v}$. We say that a
signal $v(t):\mathbb{R}_{\geq 0}\to\mathbb{R}^{n}$ belongs to $l_{\infty}$,
$\left\\{v(t)\right\\}\in l_{\infty}$, if $||v||_{\infty}<\infty$.
$||v(t)||_{\mathcal{L}_{p}}$ is the p-norm of signal $v(t)$. We denote a
variable $m$ uniformly distributed in the interval $(z_{1},z_{2})$ as
$m\sim\mathcal{U}(z_{1},z_{2})$.

###  II-B Definitions and Preliminary Results

######  Definition 1 (Vehicle String Stability).

_[21]_ Consider a string of $m\in N$ interconnected vehicles. This system is
string stable if and only if

$\begin{split}||z_{i}(t)||_{\mathcal{L}_{p}}\leq||z_{i-1}(t)||_{\mathcal{L}_{p}},\hskip
5.69054pt\forall\hskip 2.84526ptt\geq 0,\hskip 2.84526pt2\leq i\leq
m,\end{split}$ (1)

where $z_{i}(t)$ can either be the intervehicle distance error $e_{i}(t)$, the
velocity $v_{i}(t)$, or the acceleration $a_{i}(t)$ of vehicle i;
$z_{1}(t)\in\mathcal{L}_{p}$ is a given input signal, and $z_{i}(0)=0$ for
$2\leq i\leq m$.

######  Definition 2 (Reachable Set).

_[20]_ Consider the perturbed Linear Time-Invariant (LTI) system:

$\zeta(k+1)=\mathcal{A}\zeta(k)+\sum_{i=1}^{N}\mathcal{B}_{i}w_{i}(k),$ (2)

with $k\in\mathbb{N}$, state $\zeta\in\mathbb{R}^{n_{\zeta}}$, perturbation
$w_{i}\in\mathbb{R}^{p_{i}}$ satisfying $w_{i}^{\top}W_{i}w_{i}\leq 1$ for
some positive definite matrix $W_{i}\in\mathbb{R}^{p_{i}\times p_{i}}$,
$i=1,\ldots,N,N\in\mathbb{N}$, and matrices
$\mathcal{A}\in\mathbb{R}^{n_{\zeta}\times n_{\zeta}}$ and
$\mathcal{B}_{i}\in\mathbb{R}^{n_{\zeta}\times p_{i}}$. The reachable set
$\mathcal{R}_{k}^{\zeta}$ at time instant $k\geq 0$ from the initial condition
$\zeta_{1}\in\mathbb{R}^{n_{\zeta}}$ is the set of states reachable in $k$
steps by system (2) through all possible disturbances satisfying
$w_{i}(k)^{\top}W_{i}w_{i}(k)\leq 1$, i.e.,

$\mathcal{R}^{\zeta}_{k}:=\left\\{\zeta\in\mathbb{R}^{n_{\zeta}}\left|\begin{split}&\zeta=\zeta(k),\hskip
1.42262pt\text{$\zeta(k)$ solution to \eqref{s1}},\\\ &\text{and}\hskip
2.84526ptw_{i}(k)^{\top}W_{i}w_{i}(k)\leq 1,\\\ \end{split}\right.\right\\}.$
(3)

######  Corollary 1 (Ellipsoidal Approximation).

_[20]_ Consider the perturbed LTI system (2) and the reachable set
$\mathcal{R}_{k}^{\zeta}$ introduced in Definition 2. For a given $a\in(0,1)$,
if there exist constants $a_{1}$, $\ldots$, $a_{N}$ and matrix $P$ satisfying

$\left\\{\begin{split}&\text{\emph{s.t.}}\hskip
2.84526pta_{1},\ldots,a_{N}\in(0,1),\hskip 1.42262pta_{1}+\ldots+a_{N}\geq
a,\\\ &P>0,\begin{bmatrix}aP&\mathcal{A}^{\top}P&\mathbf{0}\\\
P\mathcal{A}&P&P\mathcal{B}\\\
\mathbf{0}&\mathcal{B}^{\top}P&W_{a}\end{bmatrix}\geq 0,\end{split}\right.$
(4)

with
$W_{a}:=\operatorname*{diag}\begin{bmatrix}(1-a_{1})W_{1},\ldots,(1-a_{N})W_{N}\end{bmatrix}\in\mathbb{R}^{\bar{p}\times\bar{p}}$,
$\mathcal{B}:=(\mathcal{B}_{1},\ldots,\mathcal{B}_{N})\in\mathbb{R}^{n_{\zeta}\times\bar{p}}$,
and $\bar{p}=\sum_{i=1}^{N}p_{i}$; then, for all $k\geq k^{*}$,
$\mathcal{R}_{k}^{\zeta}\subseteq\mathcal{E}_{k}^{\zeta}:=\left\\{\zeta^{\top}P^{\zeta}\zeta\leq\alpha_{k}^{\zeta}\right\\}$,
with
$\alpha_{k}^{\zeta}:=a^{k-1}\zeta(k^{*})^{\top}P\zeta(k^{*})+((N-a)(1-a^{k-1}))/(1-a)$.

######  Lemma 1 (Projection).

_[20]_ Consider the ellipsoid:

$\begin{split}\mathcal{E}:=\left\\{x\in\mathbb{R}^{n},y\in\mathbb{R}^{m}\bigg{|}\begin{bmatrix}x\\\
y\end{bmatrix}^{\top}\begin{bmatrix}Q_{1}&Q_{2}\\\
Q_{2}^{\top}&Q_{3}\end{bmatrix}\begin{bmatrix}x\\\
y\end{bmatrix}=\alpha\right\\},\end{split}$ (5)

for some positive definite matrix $Q\in\mathbb{R}^{(n+m)\times(n+m)}$ and
constant $\alpha\in\mathbb{R}_{>0}$. The projection $\mathcal{E}^{\prime}$ of
$\mathcal{E}$ onto the $x$-hyperplane is given by the ellipsoid:

$\mathcal{E}^{\prime}:=\left\\{x\in\mathbb{R}^{n}\vline\hskip
5.69054ptx^{\top}\begin{bmatrix}Q_{1}-Q_{2}Q_{3}^{-1}Q_{2}^{\top}\end{bmatrix}x=\alpha\right\\}.$
(6)

Figure 1: CACC-equipped vehicle platoon: each vehicle is equipped with radars
which might be under attacks.

##  III System Description

In this section, we introduce the platoon dynamics that we consider, the
control scheme, state estimator, and the fault/attack detector for CAVs.

###  III-A Vehicle Platoon Dynamics and the Control Scheme

Consider a homogeneous string of $m$ vehicles as shown in Figure 1. The
distance between vehicle $i$ and its preceding vehicle $i-1$ is denoted as
$d_{i}$, and its velocity is denoted as $v_{i}$. The objective of each vehicle
is to keep a desired distance with its preceding vehicle:

$d_{r,i}(t)=s_{i}+hv_{i}(t),i\in S_{m},$ (7)

with the time headway $h>0$, the standstill distance $s_{i}>0$.
$S_{m}=\left\\{i\in\mathbb{N}|1\leq i\leq m\right\\}$ denotes the set of all
vehicles in a platoon of length $m\in\mathbb{N}$. The spacing policy adopted
here is expected to improve string stability [22, 21]. The spacing error
$e_{ri}(t)$ is then defined as

$\begin{split}e_{ri}(t)=&d_{i}(t)-d_{r,i}(t),\\\
=&(q_{i-1}(t)-q_{i}(t)-L_{i})-(s_{i}+hv_{i}(t)),\end{split}$ (8)

where $q_{i}$ denotes the rear-bumper position of vehicle $i$ and $L_{i}$
denotes its length. We consider the following vehicle model adopted in [21],

$\begin{split}\begin{bmatrix}\dot{d}_{i}\\\ \dot{v}_{i}\\\
\dot{a}_{i}\end{bmatrix}=\begin{bmatrix}v_{i-1}-v_{i}\\\ a_{i}\\\
-\frac{1}{\tau}a_{i}+\frac{1}{\tau}u_{i}\end{bmatrix},\hskip 5.69054pti\in
S_{m},\end{split}$ (9)

with $\tau$ being a time constant representing driveline dynamics, $a_{i}$
denoting the acceleration of vehicle $i$; $u_{i}$ denoting the desired
accelerations of vehicles $i$. The controller described in [21] that fulfills
the vehicle-following objective and the string stability is adopted, where a
new input $\epsilon_{i}$ is defined such that

$\begin{split}h\dot{u}_{i}=-u_{i}+\epsilon_{i},\end{split}$ (10)

with $\epsilon_{i}$ given as follows:

$\begin{split}\epsilon_{i}=&K\begin{bmatrix}e_{ri}+\omega_{di1}+\delta_{i1}\\\
\dot{e}_{ri}+\omega_{di2}+\delta_{i2}\end{bmatrix}+u_{i-1}+\omega_{ui},\\\
=&K\left(\begin{bmatrix}e_{ri}\\\
\dot{e}_{ri}\end{bmatrix}+\omega_{di}+\delta_{i}\right)+u_{i-1}+\omega_{ui},\hskip
2.84526pti\in S_{m}.\end{split}$ (11)

where $K=\begin{bmatrix}k_{p}&k_{d}\end{bmatrix}$. In [21], it has been proved
that in the attack-free case, i.e., $\delta_{i}(t)=\mathbf{0}$, the vehicle
following and string stability objectives are both fulfilled with any choice
for $k_{p},k_{d}>0$, $k_{d}>k_{p}\tau$. The feedforward term $u_{i-1}$ is
transmitted from vehicle $i-1$ to vehicle $i$ through a wireless communication
channel, which is perturbed by channel noise. $\omega_{di}$ represent the
noise in the radar sensor satisfying
$\omega_{di}^{\top}\omega_{di}\leq\bar{\omega}_{1}$,
$\omega_{ui}\in\mathbb{R}$ denotes the noise in the communication channel
induced by network imperfections such as delay, pack dropouts etc., satisfying
$\omega_{ui}^{2}\leq\bar{\omega}_{2}$. $\delta_{i}\in\mathbb{R}^{2}$
represents the injected attack signal into radars, i.e.,
$\delta_{i}(t)\neq\mathbf{0}$ for some $t\geq 0$ if the radars are
compromised; otherwise $\delta_{i}(t)=\mathbf{0}$ for all $t\geq 0$. Let
$\triangle v_{i}:=v_{i-1}-v_{i}$. Note that $\delta_{i}$ is a two-dimension
vector, and this is because attacks on radars/lidars will affect $e_{ri}$ and
$\dot{e}_{ri}$ both by modifying the information of $d_{i}$ and $\triangle
v_{i}$.

Using the model (7)-(11) with
$x_{i}:=\begin{bmatrix}e_{ri}&v_{i}&a_{i}&\triangle
v_{i}&a_{i-1}\end{bmatrix}$, the following platoon model is obtained:

$\begin{split}\begin{bmatrix}\dot{e}_{ri}\\\ \dot{v}_{i}\\\ \dot{a}_{i}\\\
\dot{\triangle v}_{i}\\\
\dot{a}_{i-1}\end{bmatrix}=&\begin{bmatrix}0&0&-h&1&0\\\ 0&0&1&0&0\\\
0&0&-\frac{1}{\tau}&0&0\\\ 0&0&-1&0&1\\\
0&0&0&0&-\frac{1}{\tau}\end{bmatrix}\begin{bmatrix}{e}_{ri}\\\ {v}_{i}\\\
{a}_{i}\\\ {\triangle v}_{i}\\\ a_{i-1}\end{bmatrix}\\\ &+\begin{bmatrix}0\\\
0\\\ \frac{1}{\tau}\\\ 0\\\ 0\end{bmatrix}u_{i}+\begin{bmatrix}0\\\ 0\\\ 0\\\
0\\\ \frac{1}{\tau}\end{bmatrix}u_{i-1},\\\
=&A_{c}x_{i}+B_{c1}u_{i}+B_{c2}u_{i-1},\hskip 8.53581pti\in S_{m}.\end{split}$
(12)

(11) can be rewritten as follows:

$\begin{split}\epsilon_{i}=&K\left(\begin{bmatrix}1&0&0&0&0\\\
0&0&-h&1&0\end{bmatrix}x_{i}+\omega_{di}+\delta_{i}\right)+u_{i-1}+\omega_{ui},\\\
=&K(Cx_{i}+w_{di}+\delta_{i})+u_{i-1}+\omega_{ui},\\\
=&Ky_{i}+u_{i-1}+\omega_{ui},\hskip 2.84526pti\in S_{m}.\end{split}$ (13)

with $y_{i}\in\mathbb{R}^{2}$ and $C\in\mathbb{R}^{2\times 5}$ defined
accordingly. Similarly, substituting (13) into (10) gives

$\dot{u}_{i}=-\frac{1}{h}u_{i}+\frac{1}{h}(Ky_{i}+u_{i-1}+\omega_{ui}),\hskip
2.84526pti\in S_{m}.$ (14)

The first vehicle, without a preceding vehicle in front, will follow a virtual
reference vehicle $(i=0)$, so that the same controller as the other vehicles
can be employed to the lead vehicle. We formulate the virtual reference
vehicle as follows:

$\begin{split}\begin{bmatrix}\dot{e}_{r0}\\\ \dot{v}_{0}\\\ \dot{a}_{0}\\\
\dot{u}_{0}\end{bmatrix}=\begin{bmatrix}0&0&0&0\\\ 0&0&1&0\\\
0&0&-\frac{1}{\tau}&\frac{1}{\tau}\\\
0&0&0&-\frac{1}{h}\end{bmatrix}\begin{bmatrix}e_{r0}\\\ v_{0}\\\ a_{0}\\\
u_{0}\end{bmatrix}+\begin{bmatrix}0\\\ 0\\\ 0\\\
-\frac{1}{h}\end{bmatrix}\epsilon_{0},\end{split}$ (15)

where $\epsilon_{0}$ denotes external platoon input.

The closed-loop system (12)-(14) can be written in a compact form as follows:

$\left\\{\begin{split}\dot{x}_{i}=&A_{c}x_{i}+B_{c1}u_{i}+B_{c2}u_{i-1},\\\
y_{i}=&Cx_{i}+\omega_{di}+\delta_{i},\\\
\dot{u}_{i}=&-\frac{1}{h}u_{i}+\frac{1}{h}Ky_{i}+\frac{1}{h}u_{i-1}+\frac{1}{h}\omega_{ui},\end{split}\right.$
(16)

with

$\begin{split}A_{c}=&\begin{bmatrix}0&0&-h&1&0\\\ 0&0&1&0&0\\\
0&0&-\frac{1}{\tau}&0&0\\\ 0&0&-1&0&1\\\
0&0&0&0&-\frac{1}{\tau}\end{bmatrix},B_{c1}=\begin{bmatrix}0\\\ 0\\\
\frac{1}{\tau}\\\ 0\\\ 0\end{bmatrix},B_{c2}=\begin{bmatrix}0\\\ 0\\\ 0\\\
0\\\ \frac{1}{\tau}\end{bmatrix},\\\ C=&\begin{bmatrix}1&0&0&0&0\\\
0&0&-h&1&0\end{bmatrix},K=\begin{bmatrix}k_{p}&k_{d}\end{bmatrix}.\end{split}$
(17)

Adopting exact discretization method with sampling time $T_{s}$ to discretize
(16),

$\displaystyle x_{i}(k+1)=Ax_{i}(k)+B_{1}u_{i}(k)+B_{2}u_{i-1}(k),$ (18a)
$\displaystyle y_{i}(k)=Cx_{i}(k)+\omega_{di}(k)+\delta_{i}(k),$ (18b)
$\displaystyle{u}_{i}(k+1)=a_{u}u_{i}(k)+b_{u}Ky_{i}(k)+b_{u}u_{i-1}(k)+b_{u}\omega_{ui}(k),$
(18c)

with

$\begin{split}A=&e^{A_{c}T_{s}},B_{1}=\left(\int_{0}^{T_{s}}e^{A_{c}(T_{s}-s)}ds\right)B_{c1},\\\
B_{2}=&\left(\int_{0}^{T_{s}}e^{A_{c}(T_{s}-s)}ds\right)B_{c2},a_{u}=e^{-\frac{1}{h}T_{s}},\\\
b_{u}=&\left(\int_{0}^{T_{s}}e^{-\frac{1}{h}(T_{s}-s)}ds\right)\frac{1}{h}.\end{split}$
(19)

###  III-B Estimator and Residual

Here, we consider CAVs are equipped with radars, speed and acceleration
sensors for measuring the relative distance, relative velocity, velocity and
acceleration respectively. An estimator is utilized by each vehicle in the
platoon to compute state estimates from noisy sensor measurements. The
estimation residual is used then by a detector for identifying sensor attacks.

Here, we provide an estimator with the following structure for system (18a).

$\begin{split}\hat{x}_{i}(k+1)=&A\hat{x}_{i}(k)+B_{1}u_{i}(k)+B_{2}(u_{i-1}(k)+\omega_{ui}(k))\\\
&+L\big{(}y_{ei}(k)-C_{e}\hat{x}_{i}(k)\big{)},\end{split}$ (20)

with $y_{ei}(k)=C_{e}x_{i}(k)+\omega_{ei}(k)+\Gamma\delta_{i}(k)$,

$C_{e}=\begin{bmatrix}1&0&0&0&0\\\ 0&1&0&0&0\\\ 0&0&1&0&0\\\
0&0&0&1&0\end{bmatrix},\Gamma=\begin{bmatrix}1&0\\\ 0&0\\\ 0&0\\\
0&1\end{bmatrix},$ (21)

$\omega_{ei}\in\mathbb{R}^{4}$ denoting the sensor noise satisfying
$\omega_{ei}^{\top}\omega_{ei}\leq\bar{\omega}_{3}$,
$\hat{x}_{i}(k)\in\mathbb{R}^{5}$ is the state estimate of $x_{i}$ and
$L\in\mathbb{R}^{5\times 4}$ is the estimator gain. It can be verified that
$(A,C_{e})$ is observable. Define the estimation error
$e_{i}:=x_{i}-\hat{x}_{i}$. Given the system dynamics (18) and the estimator
(20), the estimation error dynamics is described by the following difference
equation:

$\begin{split}e_{i}(k+1)=&(A-LC_{e})e_{i}(k)-B_{2}\omega_{ui}(k)\\\
&-L\omega_{ei}(k)-L\Gamma\delta_{i}(k).\end{split}$ (22)

######  Remark 1.

Since the error dynamics of the estimator designed for (18a) depends on
$\delta_{i}$, it can be used for detecting faults or attacks on sensors.

In the attack-free case, i.e., $\delta_{i}(k)=\mathbf{0}$ for $k\geq 0$, we
have

$\begin{split}\bar{e}_{i}(k+1)=&(A-LC_{e})\bar{e}_{i}(k)-B_{2}\omega_{ui}(k)-L\omega_{ei}(k),\end{split}$
(23)

where $\bar{e}_{i}$ represents the estimation error in the attack-free case,
i.e., $\delta_{i}(k)=\mathbf{0}$ for $k\geq 0$. Define the residual as follows

$\begin{split}r_{i}(k)=&y_{ei}(k)-C_{e}\hat{x}_{i}(k).\end{split}$ (24)

The estimation error and the residual evolves according to the difference
equation:

$\left\\{\begin{split}e_{i}(k+1)=&(A-LC_{e})e_{i}(k)-B_{2}\omega_{ui}(k)\\\
&-L\omega_{ei}(k)-L\Gamma\delta_{i}(k),\\\
r_{i}(k)=&C_{e}e_{i}(k)+\omega_{ei}(k)+\Gamma\delta_{i}(k),\end{split}\right.$
(25)

and in the attack-free case, we have

$\left\\{\begin{split}\bar{e}_{i}(k+1)=&(A-LC_{e})e_{i}(k)-B_{2}\omega_{ui}(k)-L\omega_{ei}(k),\\\
r_{i}(k)=&C_{e}e_{i}(k)+\omega_{ei}(k).\end{split}\right.$ (26)

###  III-C System Monitor

Next, we develop a standard fault detector for each CAV in the platoon such
that if estimation residual in (25) is larger than expected, alarms are
triggered and a fault or an attack on the vehicle is detected. Consider the
detection procedure is a distance measure $z_{i}\in\mathbb{R}$ that measures
how deviated the estimator is from the attack-free dynamics. A quadratic form
of the residual is considered here, i.e., $z_{i}:=r_{i}^{\top}\Pi r_{i}$ for
some positive definite matrix $\Pi\in\mathbb{R}^{4\times 4}$. Consider the
monitor given in (27).

System Monitor:

$\text{If}\hskip 2.84526ptz_{i}(k)=r_{i}(k)^{\top}\Pi r_{i}(k)>1,\text{for
some}\hskip 2.84526ptk.$ (27)

Design parameter: positive semidefinite matrix $\Pi\in\mathbb{R}^{4\times 4}$.
Output: alarm time(s) $k$.

The monitor is designed such that alarms are triggered if $z_{i}(k)>1$.
Therefore, $z_{i}(k)\leq 1$ is supposed to contain all attack-free
trajectories, i.e., $\Pi$ is selected such that for all $k\geq k^{*}$, the
ellipsoid $r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ contains all the possible
trajectories that $\omega_{ui}(k)$, $\omega_{ei}(k)$ can induce in the
residual given in (25) with
$\omega_{ui}(k)^{\top}\omega_{ui}(k)\leq\bar{\omega}_{2}$,
$\omega_{ei}^{\top}(k)\omega_{ei}(k)\leq\bar{\omega}_{3}$,
$\delta_{i}(k)=\mathbf{0}$.

Note that this is a novel fault/attack detector that is useful for identifying
faults (sensor, actuator, and dynamics faults) and _non-stealthy_ FDI attacks,
which covers a large class of anomalous behaviors. However, by definition, no
monitor (including (27)) can identify stealthy FDI attacks. This is
schematically depicted in Figure 2.

Figure 2: A standard fault/attack detector is useful for identifying a large
class of anomalous behaviors including faults or general FDI attacks; but it
cannot work in the presence of stealthy FDI attacks.

##  IV Resilient Estimator, Detector, and Controller Design

In this section, we assume the attacker has knowledge of the vehicle model and
the detector structure so that the injected $\delta_{i}$ does not trigger
alarms by monitor (27). For each CAV in a platoon, we aim to design the
estimator, the detector, and the controller that are resilient to stealthy
radar attacks, i.e., the damage caused by stealthy attacks on radars is
minimized. This class of stealthy attacks can be characterized as a
constrained control problem in $\delta_{i}$:

$\left\\{\delta_{i}\in\mathbb{R}\hskip 2.84526pt\vline\hskip
2.84526pt\text{$r_{i}(k)$ satisfies \eqref{er} and }r_{i}(k)^{\top}\Pi
r_{i}(k)\leq 1\right\\}.$ (28)

The closed-loop systems (18) can be written as follows:

$\left\\{\begin{split}x_{i}(k+1)=&Ax_{i}(k)+B_{1}u_{i}(k)+B_{2}u_{i-1}(k),\\\
{u}_{i}(k+1)=&a_{u}u_{i}(k)+b_{u}KCx_{i}(k)+b_{u}u_{i-1}(k)\\\
&+b_{u}\omega_{ui}(k)+b_{u}K\omega_{di}(k)+b_{u}K\delta_{i}(k).\end{split}\right.$
(29)

We are interested in the vehicle state trajectories that the attacker can
induce by injecting attack signals satisfying (28) into the radar sensors.
This motivates the following definition.

######  Definition 3 (Stealthy Reachable Set).

The stealthy reachable set of vehicle $i$ at time-instant $k$,
$\mathcal{R}_{k}^{x_{i}}$, is the set of all states reachable by system (18a)
through all possible initial conditions and disturbances satisfying
$u_{i-1}^{2}\leq\bar{u}$,
$\omega_{di}^{\top}(k)\omega_{di}(k)\leq\bar{\omega}_{1}$
$\omega_{ui}^{\top}\omega_{ui}\leq\bar{\omega}_{2}$, and attack sequences
satisfying (28), i.e.,

$\mathcal{R}_{k}^{x_{i}}:=\left\\{x_{i}\in\mathbb{R}^{5}\left|\begin{split}&x_{i}\text{
and }u_{i}\hskip 2.84526pt\text{satisfy \eqref{closed2}},\\\ &\delta_{i}\hskip
2.84526pt\text{satisfies}\hskip
2.84526pt\eqref{stealthy},u_{i-1}^{2}\leq\bar{u},\\\
&\omega_{di}^{\top}(k)\omega_{di}(k)\leq\bar{\omega}_{1},\\\
&\omega_{ui}(k)^{\top}\omega_{ui}(k)\leq\bar{\omega}_{2},k\in\mathbb{N}.\\\
\end{split}\right.\right\\}.$ (30)

Since $\mathcal{R}_{k}^{x_{i}}$ contains all the state trajectories that the
attacker can induce by injecting stealthy attacks, we use the volume of the
set $\mathcal{R}_{k}^{x_{i}}$ to quantify the attacker’s capabilities [20].
Note that it is in general not tractable to compute $\mathcal{R}_{k}^{x_{i}}$
exactly, we look for an outer ellipsoidal approximation of the form
$\mathcal{E}_{k}^{x_{i}}:=\left\\{x_{i}\in\mathbb{R}^{5}|\hskip
2.84526ptx_{i}^{\top}P^{x_{i}}x_{i}\leq\alpha_{k}^{x_{i}}\right\\}$ such that
$\mathcal{R}_{k}^{x_{i}}\subseteq\mathcal{E}_{k}^{x_{i}}$ for all
$k\in\mathbb{N}$. This means that the ellipsoid
$x_{i}^{\top}P^{x}x_{i}=\alpha_{k}^{x_{i}}$ contains all the possible
trajectories induced by stealthy attacks satisfying (28). For Linear Time-
Invariant (LTI) systems, $\mathcal{E}_{k}^{x_{i}}$ is a good approximation of
$\mathcal{R}_{k}^{x_{i}}$ and it can be computed efficiently using LMIs,
hence, we use the volume of $\mathcal{E}_{k}^{x_{i}}$ instead for assessing
attacker’s capabilities.

Consider $r_{i}(k)$ in (25), since $\Gamma$ has full column rank, we can
compute $\delta_{i}(k)$ as follows:

$\begin{split}\delta_{i}(k)=\Gamma^{\dagger}\big{(}r_{i}(k)-C_{e}e_{i}(k)-\omega_{ei}(k)\big{)},\end{split}$
(31)

where $\Gamma^{\dagger}$ denotes the Moore-Penrose inverse of $\Gamma$.
Substituting (31) into (29) yields

$\left\\{\begin{split}x_{i}(k+1)=&Ax_{i}(k)+B_{1}u_{i}(k)+B_{2}u_{i-1}(k),\\\
{u}_{i}(k+1)=&a_{u}u_{i}(k)+b_{u}KCx_{i}(k)+b_{u}u_{i-1}(k)\\\
&+b_{u}\omega_{ui}(k)+b_{u}K\omega_{di}(k)\\\
&+b_{u}K\Gamma^{\dagger}(r_{i}(k)-C_{e}e_{i}(k)-\omega_{ei}(k)).\end{split}\right.$
(32)

Define the extended state
$\zeta_{i}=\begin{bmatrix}x_{i}^{\top}&u_{i}^{\top}\end{bmatrix}^{\top}$, the
closed-loop dynamics (29) can be written compactly as follows:

$\begin{split}\zeta_{i}(k+1)=&\mathcal{A}\zeta_{i}(k)+\mathcal{B}_{1}u_{i-1}(k)+\mathcal{B}_{2}\omega_{di}(k)+\mathcal{B}_{3}\omega_{ui}(k)\\\
&+\mathcal{B}_{4}\omega_{ei}(k)+\mathcal{B}_{5}r_{i}(k)+\mathcal{B}_{6}e_{i}(k),\end{split}$
(33)

with

$\begin{split}\mathcal{A}=&\begin{bmatrix}A&B_{1}\\\
b_{u}KC&a_{u}\end{bmatrix},\\\ \mathcal{B}_{1}=&\begin{bmatrix}B_{2}\\\
b_{u}\end{bmatrix},\mathcal{B}_{2}=\begin{bmatrix}\mathbf{0}\\\ b_{u}K\\\
\end{bmatrix},\\\ \mathcal{B}_{3}=&\begin{bmatrix}\mathbf{0}\\\
b_{u}\end{bmatrix},\mathcal{B}_{4}=\begin{bmatrix}\mathbf{0}\\\
-b_{u}K\Gamma^{\dagger}\end{bmatrix},\\\
\mathcal{B}_{5}=&\begin{bmatrix}\mathbf{0}\\\
b_{u}K\Gamma^{\dagger}\end{bmatrix},\mathcal{B}_{6}=\begin{bmatrix}\mathbf{0}\\\
-b_{u}K\Gamma^{\dagger}C_{e}\end{bmatrix}.\end{split}$ (34)

The closed-loop dynamics (33) is now written in the form (2) driven by peak-
bounded perturbations $u_{i-1}$, $\omega_{di}$, $\omega_{ei}$, $\omega_{ui}$,
$r_{i}$, and $e_{i}$. The residual $r_{i}$ acts as a peak-bounded perturbation
because the attack sequence $\delta_{i}$ satisfies (28) (i.e.,
$r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ for all $k\in\mathbb{N}$). Next, we
introduce the method of selecting $L$ and $\Pi$ such that
$e_{i}(k)^{\top}P^{e}e_{i}(k)\leq\alpha_{k}^{e_{i}}$ for some $P^{e}>0$ and
$\alpha_{k}^{e_{i}}>0$.

Define the reachable set for (33):

$\mathcal{R}_{k}^{\zeta_{i}}:=\left\\{\zeta_{i}\in\mathbb{R}^{6}\left|\begin{split}&\zeta_{i}\hskip
2.84526pt\text{satisfies \eqref{zeta}},r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1,\\\
&e_{i}(k)^{\top}P^{e}e_{i}(k)\leq\alpha_{k}^{e_{i}},\\\
&u_{i-1}(k)^{\top}u_{i-1}(k)\leq\bar{u},\\\
&\omega_{di}(k)^{\top}\omega_{di}(k)\leq\bar{\omega}_{1},\\\
&\omega_{ui}(k)^{\top}\omega_{ui}(k)\leq\bar{\omega}_{2},\\\
&\omega_{ei}(k)^{\top}\omega_{ei}(k)\leq\bar{\omega}_{3},k\in\mathbb{N}.\end{split}\right.\right\\}.$
(35)

######  Remark 2.

We are ultimately interested in the stealthy reachable set of the vehicle
states $\mathcal{R}_{k}^{x_{i}}$ introduced in (30). Note that
$\mathcal{R}_{k}^{x_{i}}$ is the projection of $\mathcal{R}_{k}^{\zeta_{i}}$
onto the $x_{i}$-hyperplane. Hence, if
$\mathcal{R}_{k}^{\zeta_{i}}\subseteq\mathcal{E}_{k}^{\zeta_{i}}$, then
$\mathcal{R}_{k}^{x_{i}}\subseteq\mathcal{E}_{k}^{\zeta_{i}}||_{x_{i}}$, where
$\mathcal{E}_{k}^{\zeta_{i}}||_{x_{i}}$ denotes the projection of
$\mathcal{E}_{k}^{\zeta_{i}}$ onto the $x_{i}$-hyperplane. Therefore, to
obtain the ellipsoid $\mathcal{E}_{k}^{x_{i}}$ containing
$\mathcal{R}_{k}^{x_{i}}$, we can first obtain $\mathcal{E}_{k}^{\zeta_{i}}$
containing $\mathcal{R}_{k}^{x_{i}}$ and then project it onto the
$x_{i}$-hyperplane to obtain $\mathcal{E}_{k}^{x_{i}}$.

###  IV-A Resilient Estimator and Monitor

From (35), it can be seen that if we select $L$ and $\Pi$ such that the
volumes of ellipsoids $e_{i}(k)^{\top}P^{e}e_{i}(k)\leq\alpha_{k}^{e_{i}}$ and
$r_{i}^{\top}(k)\Pi r_{i}(k)\leq 1$ are reduced, then the volume of
$\mathcal{R}_{k}^{\zeta_{i}}$ will also be reduced. This indicates such
estimator and monitor restrict attacker’s capabilities and show higher
resilience towards stealthy attacks.

Substituting (31) into (25) yields

$\begin{split}e_{i}(k+1)=&(A-L(I-\Gamma\Gamma^{\dagger})C_{e})e_{i}(k)-B_{2}\omega_{ui}(k)\\\
&-L(I-\Gamma\Gamma^{\dagger})\omega_{ei}(k)-L\Gamma\Gamma^{\dagger}r_{i}(k).\end{split}$
(36)

The reachable set of the estimation error with dynamics (36) is given as

$\mathcal{R}_{k}^{e_{i}}:=\left\\{e_{i}\in\mathbb{R}^{5}\left|\begin{split}&e_{i}\hskip
2.84526pt\text{satisfy \eqref{er1}},\\\ &r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1,\\\
&\omega_{ui}(k)^{\top}\omega_{ui}(k)\leq\bar{\omega}_{2},\\\
&\omega_{ei}(k)^{\top}\omega_{ei}(k)\leq\bar{\omega}_{3},\end{split}\right.\right\\}.$
(37)

Since it is analytically intractable to compute $\mathcal{R}_{k}^{\zeta_{i}}$
and $\mathcal{R}_{k}^{e_{i}}$, we use Corollary 1 to derive outer ellipsoidal
bounds of the form
$\mathcal{E}_{k}^{\zeta_{i}}=\left\\{\zeta_{i}\in\mathbb{R}^{6}|\zeta_{i}(k)^{\top}P^{\zeta}\zeta_{i}(k)\leq\alpha_{k}^{\zeta_{i}}\right\\}$
and
$\mathcal{E}_{k}^{e_{i}}=\left\\{e_{i}\in\mathbb{R}^{5}|e_{i}(k)^{\top}P^{e}e_{i}(k)\leq\alpha_{k}^{e_{i}}\right\\}$
such that $\mathcal{R}_{k}^{\zeta_{i}}\subseteq\mathcal{E}_{k}^{\zeta_{i}}$
and $\mathcal{R}_{i}^{e_{i}}\subseteq\mathcal{E}_{k}^{e_{i}}$. Note that the
$e_{i}$ dynamics in (36) does not depend on $\zeta_{i}(k)$. Thus we first
compute $\mathcal{E}_{k}^{e_{i}}$ and then analyze how it propagates to
$\mathcal{E}_{k}^{\zeta_{i}}$. Note that the dynamics of $\zeta_{i}$ given in
(33) depends on bounded disturbances $e_{i}$ and $r_{i}$ both. Therefore, we
use Corollary 1 to select $L$ and $\Pi$ such that a weighted sum of the
volumes of $\mathcal{E}_{k}^{e_{i}}$ and $r_{i}(k)^{\top}\Pi r_{i}(k)=1$ is
minimized.

######  Theorem 1.

Consider the estimation error dynamics (36) with matrices
$(A,C_{e},B_{2},\Gamma)$, the perturbation bounds $\bar{\omega}_{2}$,
$\bar{\omega}_{3}$. For a given $a\in(0,1)$, tuning parameters
$\alpha_{1},\alpha_{2}>0$ with $\alpha_{1}+\alpha_{2}=1$, $\epsilon>0$, if
there exist constants $a_{1}$, $a_{2}$, $a_{3}$, and matrices $P^{e}$, $L$,
$\tau_{1}$, $\tau_{2}$, $\Pi$ solution of the following optimization:

$\left\\{\begin{split}&\min_{P^{e},\Pi,a_{1},a_{2},a_{3}}-\alpha_{1}\log\det[P^{e}]-\alpha_{2}\log\det[\Pi],\\\
&s.t.\hskip 2.84526pta_{1},a_{2},a_{3}\in(0,1),a_{1}+a_{2}+a_{3}\geq a,\\\
&\tau_{1}\geq 0,\tau_{2}\geq 0,P^{e}>0,{\Pi}>0,\\\
&L_{1}:=\begin{bmatrix}aP^{e}&A^{\top}P^{e}-C_{e}^{\top}(I-\Gamma\Gamma^{\dagger})^{\top}L^{\top}P^{e}&\mathbf{0}\\\
*&P^{e}&Z\\\ *&*&{W}_{a}\end{bmatrix}\geq 0,\\\
&L_{2}:=\begin{bmatrix}f_{1}&-C_{e}^{\top}\Pi&\mathbf{0}\\\
*&\tau_{2}I-\Pi&\mathbf{0}\\\ *&*&f_{2}\end{bmatrix}\geq 0,\\\
&f_{1}=\tau_{1}P^{e}-C_{e}^{\top}\Pi C_{e},\\\
&f_{2}=1-\tau_{1}(\alpha_{\infty}^{e_{i}}+\epsilon)-\tau_{2}\bar{\omega}_{3},\end{split}\right.$
(38)

with
$Z=\begin{bmatrix}-P^{e}B_{2}&-P^{e}L(I-\Gamma\Gamma^{\dagger})&-P^{e}L\Gamma\Gamma^{\dagger}\end{bmatrix}$,
${W}_{a}=\operatorname*{diag}\begin{bmatrix}\frac{1-a_{1}}{\bar{\omega}_{2}},\frac{1-a_{2}}{\bar{\omega}_{3}}I_{4},(1-a_{3}){\Pi}\end{bmatrix}\in\mathbb{R}^{9\times
9}$, $\alpha_{\infty}^{e_{i}}=(3-a)/(1-a)$. Then for all $k\geq 1$,
$\mathcal{R}_{k}^{e_{i}}\subseteq\mathcal{E}_{k}^{e_{i}}:=\left\\{e_{i}\in\mathbb{R}^{5}|e_{i}^{\top}(k)P^{e}e_{i}(k)\leq\alpha_{k}^{e_{i}}\right\\}$,
and
$\alpha_{k}^{e_{i}}:=a^{k-1}e_{i}(1)^{\top}P^{e}e_{i}(1)+\big{(}(3-a)(1-a^{k-1})\big{)}/(1-a)$,
the monitor $r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ is satisfied for all
$e_{i}(k)$ satisfying
$e_{i}(k)^{\top}P^{e}e_{i}(k)\leq\alpha_{\infty}^{e_{i}}+\epsilon$ and
$\omega_{ei}(k)$ satisfying
$\omega_{ei}(k)^{\top}\omega_{ei}(k)\leq\bar{\omega}_{3}$, and the weighted
sum of the volumes of ellipsoid $\mathcal{E}_{k}^{e_{i}}$ and
$r_{i}(k)^{\top}\Pi r_{i}(k)=1$ is minimized in the sense of Corollary 1.

Proof: The reachable set $\mathcal{R}_{k}^{e_{i}}$ in (37) is a LTI system
driven by peak-bounded perturbations. It follows that, under the conditions
stated in Theorem 1, Corollary 1 can be used to obtain outer ellipsoidal
approximations of the form
$\mathcal{E}_{k}^{e_{i}}=\left\\{e_{i}\in\mathbb{R}^{5}|e_{i}^{\top}(k)P^{\zeta}e_{i}(k)\leq\alpha_{k}^{e_{i}}\right\\}$,
such that $\mathcal{R}_{k}^{e_{i}}\subseteq\mathcal{E}_{k}^{e_{i}}$, where the
sequence
$\alpha_{k}^{e_{i}}=a^{k-1}e_{i}(1)^{\top}P^{e}e_{i}(1)+(3-a)(1-a^{k-1})/(1-a)$,
$P^{e}$. Since $a\in(0,1)$, we have that $0<1-a^{k-1}<1$ and

$\alpha_{k}^{e_{i}}\leq
a^{k-1}e_{i}(1)^{\top}P^{e}e_{i}(1)+\alpha_{\infty}^{e_{i}},$ (39)

also because $a\in(0,1)$, for any $\epsilon>0$, there exists $k^{*}$ such that
$a^{k-1}e_{i}(1)^{\top}P^{*}e_{i}(1)<\epsilon.$ Therefore, for any
$\epsilon>0$, there exists $k^{*}$ such that
$\alpha_{k}^{e_{i}}\leq\alpha_{\infty}^{e_{i}}+\epsilon$, the trajectories of
estimation error dynamics (25) satisfy
$e_{i}(k)^{\top}P^{e}e_{i}(k)\leq\alpha_{\infty}^{e_{i}}+\epsilon$ for all
$k\geq k^{*}$. By the $S$-procedure [23], if there exist $\tau_{1},\tau_{2}>0$
such that

$\begin{split}&(C_{e}e_{i}(k)+\omega_{ei}(k))^{\top}\Pi(C_{e}e_{i}(k)+\omega_{ei}(k))-1\\\
&-\tau_{1}(e_{i}(k)^{\top}P^{e}e_{i}(k)-\alpha_{\infty}^{e_{i}}-\epsilon)\\\
&-\tau_{2}(\omega_{ei}(k)^{\top}\omega_{ei}(k)-\bar{\omega}_{3})\leq
0,\end{split}$ (40)

then,
$(C_{e}e_{i}(k)+\omega_{ei}(k))^{\top}\Pi(C_{e}e_{i}(k)+\omega_{ei}(k))\leq 1$
is satisfied for all $e_{i}(k)$ and $\omega_{ei}(k)$ satisfying
$e_{i}(k)^{\top}P^{e}e_{i}(k)\leq\alpha_{\infty}^{e_{i}}+\epsilon$ and
$\omega_{ei}^{\top}(k)\omega_{ei}(k)\leq\bar{\omega}_{3}$. Inequality (40) can
be written as

$\sigma(k)^{\top}\begin{bmatrix}f_{1}&-C_{e}^{\top}\Pi&\mathbf{0}\\\
*&\tau_{2}I-\Pi&\mathbf{0}\\\ *&*&f_{2}\end{bmatrix}\sigma(k)\geq 0,$ (41)

with
$\sigma(k)=\begin{bmatrix}e_{i}(k)^{\top},\omega_{ei}(k),1\end{bmatrix}^{\top}$.
The above inequality is satisfied if and only if $\mathcal{L}_{2}$ in (38) is
positive semi-definite. Therefore, for $k\geq k^{*}$, $r_{i}(k)^{\top}\Pi
r_{i}(k)\leq 1$ for any $\Pi$ solution of (38). We minimize
$-\alpha_{1}\log\det[P]-\alpha_{2}\log\det[\Pi]$ to ensure that the
ellipsoidal bounds are as tight as possible. $\blacksquare$

Moreover, the observer gain $L$ and the monitor $\Pi$ should be chosen such
that $z_{i}(k)\leq 1$ contains all attack-free trajectories of dynamics (26),
i.e., when $\delta_{i}(k)=\mathbf{0}$, there exists some
$\bar{k}^{*}\in\mathbb{N}$ such that the monitor matrix $\Pi$ satisfies that
$r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ for all $k\geq\bar{k}^{*}$.

In the attack-free case, the reachable set of the estimation error with
dynamics (26) is given as

$\bar{\mathcal{R}}_{k}^{e_{i}}:=\left\\{\bar{e}_{i}\in\mathbb{R}^{5}\left|\begin{split}&\bar{e}_{i}\hskip
2.84526pt\text{satisfies \eqref{err}},\\\
&\omega_{ui}(k)^{\top}\omega_{ui}(k)\leq\bar{\omega}_{2},\\\
&\omega_{ei}(k)^{\top}\omega_{ei}(k)\leq\bar{\omega}_{3},\end{split}\right.\right\\}.$
(42)

######  Proposition 1.

Consider the system matrices $(A,B_{2},C_{e})$ and the perturbation bounds
$\bar{\omega}_{2},\bar{\omega}_{3}>0$. Assume no attacks occur on the system,
i.e., $\delta_{i}(k)=\mathbf{0}$. For a given $c\in(0,1)$, constant
$\bar{\alpha}_{\infty}^{e_{i}}:=(2-c)/(1-c)$, and $\epsilon>0$, if there exist
constants $c_{1},c_{2}\in(0,1)$ and matrices $Y\in\mathbb{R}^{5\times 4}$,
$P^{e}>0$ such that:

$\left\\{\begin{split}&c_{1},c_{2},\in(0,1),c_{1}+c_{2}\geq
c,P^{e}>0,{\Pi}>0,\\\
&L_{3}:=\begin{bmatrix}cP^{e}&A^{\top}P^{e}-C_{e}^{\top}L^{\top}P^{e}&\mathbf{0}&\mathbf{0}\\\
*&P^{e}&-P^{e}B_{2}&-P^{e}L\\\
*&*&\frac{1-c_{1}}{\bar{\omega}_{2}}&\mathbf{0}\\\
*&*&*&\frac{1-c_{2}}{\bar{\omega}_{3}}I\end{bmatrix}\geq 0,\\\
&L_{4}:=\begin{bmatrix}\frac{1}{\bar{\alpha}_{\infty}^{e_{i}}+\epsilon+\bar{\omega}_{3}}P^{e}-C_{e}^{\top}\Pi
C_{e}&-C_{e}^{\top}\Pi\\\ -\Pi
C_{e}&\frac{1}{\bar{\alpha}_{\infty}^{e_{i}}+\epsilon+\bar{\omega}_{3}}I-\Pi\end{bmatrix}\geq
0,\end{split}\right.$ (43)

then, the residual dynamics (26) satisfies $r_{i}^{\top}\Pi r_{i}(k)\leq 1$
for all $k\geq\bar{k}^{*}$, where

$\bar{k}^{*}:=\min\left\\{k\in\mathbb{N}|c^{k-1}(\bar{e}_{i}(1)^{\top}P^{e}\bar{e}_{i}(1)-\bar{\alpha}_{\infty}^{e_{i}})\leq\epsilon\right\\}.$

Proof: The inequality $\mathcal{L}_{3}$ is of the form (4) in Corollary 1 with
$\mathcal{A}=A-LC_{e}$, $N=2$, $\mathcal{B}_{1}=-B_{2}$, $\mathcal{B}_{2}=-L$,
$W_{1}=(1/\bar{\omega}_{2})$, $W_{2}=\bar{\omega}_{3}I$, $p_{1}=1$, $p_{2}=4$.
From Corollary 1, we have
$\bar{e}_{i}(k)^{\top}P^{e}e_{i}(k)\leq\bar{\alpha}_{k}^{e_{i}}$ for all
$k\geq 0$, and $\bar{e}_{i}(k)$ be the solution of (23),
$\bar{\alpha}_{k}^{e_{i}}=c^{k-1}\bar{e}_{i}(1)^{\top}P^{e}\bar{e}_{i}(1)+\bar{\alpha}_{\infty}^{e_{i}}(1-c^{k-1})$,
and $\bar{\alpha}_{\infty}^{e_{i}}=(2-c)/(1-c)$. Since $c\in(0,1)$, for any
given $\epsilon>0$, there exists $\bar{k}^{*}$ such that
$\bar{e}_{i}(k)^{\top}P^{e}\bar{e}_{i}(k)\leq\bar{\alpha}_{\infty}^{e_{i}}+\epsilon$.
Since $\omega_{ei}(k)^{\top}\omega_{ei}(k)\leq\bar{\omega}_{3}$, by defining
$w(k):=\begin{bmatrix}\bar{e}_{i}(k)^{\top}&\omega_{ei}(k)^{\top}\end{bmatrix}^{\top}$,
we have $w(k)^{\top}Q_{1}w(k)\leq 1$, with
$Q_{1}=\frac{1}{\bar{\alpha}_{\infty}^{e_{i}}+\epsilon+\bar{\omega}_{3}}\operatorname*{diag}[P^{e},I]$.
Therefore, $r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ can be written as
$w(k)^{\top}Q_{2}w(k)\leq 1$ with

$Q_{2}=\begin{bmatrix}C_{e}^{\top}\Pi C_{e}&C_{e}\Pi\\\ \Pi
C_{e}&\Pi\end{bmatrix}.$

Therefore, if inequality $\mathcal{L}_{4}$ in (43) is satisfied, then
$Q_{2}\leq Q_{1}$, and we have $w(k)^{\top}Q_{2}w(k)\leq 1$ for all
$w(k)\in\mathbb{R}^{9}$, and $k\geq\bar{k}^{*}$. $\blacksquare$

Therefore, the gains of the estimator and the detector $L$ and $\Pi$ can be
obtained by solving programs (38) and (43) simultaneously. However, because
$(L,\Pi,P^{e},a_{3},\tau_{1})$ are variables, the blocks $P^{e}L$, $a_{3}\Pi$,
$\tau_{1}P^{e}$ are nonlinear. Note that $\alpha_{\infty}^{e_{i}}+\epsilon>1$,
$\tau_{1}\in(0,1)$ is a necessary condition for $f_{2}>0$, which is hence a
necessary condition for $\mathcal{L}_{2}\geq 0$. To linearize the program, we
let $Y=P^{e}L$ and use a grid search method over $a_{3}\in(0,1)$ and
$\tau_{1}\in(0,1)$. By doing this, programs (38) and (43) become convex, and
we can compute $L=(P^{e})^{-1}Y$.

In the following corollary of Theorem 1 and Proposition 1, we formulate the
optimization problem for designing the observer gain $L$ and the monitor $\Pi$
such that the weighted sum of the volumes of ellipsoid
$\mathcal{E}_{k}^{e_{i}}$ and $r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ is
minimized.

######  Corollary 2.

Consider the estimation error dynamics (36) with matrices
$(A,C_{e},B_{2},\Gamma)$, the perturbation bounds $\bar{\omega}_{2}$,
$\bar{\omega}_{3}$. For a given $a\in(0,1)$, $c\in(0,1)$, $a_{3}\in(0,1)$,
$\tau_{1}\in(0,1)$, tuning parameters $\alpha_{1},\alpha_{2}>0$ with
$\alpha_{1}+\alpha_{2}=1$, $\epsilon>0$, if there exist constants $a_{1}$,
$a_{2}$, $c_{1}$, $c_{2}$, $\tau_{2}$, and matrices $P^{e}$, $Y$, $\Pi$
solution of the following optimization:

$\left\\{\begin{split}&\min_{P^{e},\Pi,a_{1},a_{2},a_{3}}-\alpha_{1}\log\det[P^{e}]-\alpha_{2}\log\det[\Pi],\\\
&s.t.\hskip 2.84526pta_{1},a_{2}\in(0,1),a_{1}+a_{2}+a_{3}\geq a,\\\
&c_{1},c_{2}\in(0,1),c_{1}+c_{2}>c,\\\ &\tau_{2}\geq 0,P^{e}>0,{\Pi}>0,\\\
&L_{5}:=\begin{bmatrix}aP^{e}&A^{\top}P^{e}-C_{e}^{\top}(I-\Gamma\Gamma^{\dagger})^{\top}Y^{\top}&\mathbf{0}\\\
*&P^{e}&Z\\\ *&*&{W}_{a}\end{bmatrix}\geq 0,\\\
&L_{6}:=\begin{bmatrix}f_{1}&-C_{e}^{\top}\Pi&\mathbf{0}\\\
*&\tau_{2}I-\Pi&\mathbf{0}\\\ *&*&f_{2}\end{bmatrix}\geq 0,\\\
&L_{7}:=\begin{bmatrix}cP^{e}&A^{\top}P^{e}-C_{e}^{\top}Y^{\top}&\mathbf{0}&\mathbf{0}\\\
*&P^{e}&-P^{e}B_{2}&-Y\\\ *&*&\frac{1-c_{1}}{\bar{\omega}_{2}}&\mathbf{0}\\\
*&*&*&\frac{1-c_{2}}{\bar{\omega}_{3}}I\end{bmatrix}\geq 0,\\\
&L_{8}:=\begin{bmatrix}\frac{1}{\bar{\alpha}_{\infty}^{e_{i}}+\epsilon+\bar{\omega}_{3}}P^{e}-C_{e}^{\top}\Pi
C_{e}&-C_{e}^{\top}\Pi\\\ -\Pi
C_{e}&\frac{1}{\bar{\alpha}_{\infty}^{e_{i}}+\epsilon+\bar{\omega}_{3}}I-\Pi\end{bmatrix}\geq
0,\\\ &f_{1}=\tau_{1}P^{e}-C_{e}^{\top}\Pi C_{e},\\\
&f_{2}=1-\tau_{1}(\alpha_{\infty}^{e_{i}}+\epsilon)-\tau_{2}\bar{\omega}_{3},\end{split}\right.$
(44)

with
$Z=\begin{bmatrix}-P^{e}B_{2}&-Y(I-\Gamma\Gamma^{\dagger})&-Y\Gamma\Gamma^{\dagger}\end{bmatrix}$,
${W}_{a}=\operatorname*{diag}\begin{bmatrix}\frac{1-a_{1}}{\bar{\omega}_{2}},\frac{1-a_{2}}{\bar{\omega}_{3}}I_{4},(1-a_{3}){\Pi}\end{bmatrix}\in\mathbb{R}^{9\times
9}$, $\alpha_{\infty}^{e_{i}}=(3-a)/(1-a)$,
$\bar{\alpha}_{\infty}^{e_{i}}=(2-c)/(1-c)$. Then for all $k\geq 0$,
$\mathcal{R}_{k}^{e_{i}}\subseteq\mathcal{E}_{k}^{e_{i}}:=\left\\{e_{i}\in\mathbb{R}^{5}|e_{i}^{\top}P^{e}e_{i}\leq\alpha_{k}^{e_{i}}\right\\}$,
and
$\alpha_{k}^{e_{i}}:=a^{k-1}e_{i}(1)^{\top}P^{e}e_{i}(1)+\big{(}(3-a)(1-a^{k-1})\big{)}/(1-a)$.
The monitor $r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ is satisfied for all
$e_{i}(k)$ satisfying

$e_{i}(k)^{\top}P^{e}e_{i}(k)\leq\alpha_{\infty}^{e_{i}}+\epsilon,\hskip
5.69054pt\delta_{i}(k)\neq\mathbf{0},$

and $\bar{e}_{i}(k)$ satisfying

$\bar{e}_{i}(k)^{\top}P^{e}\bar{e}_{i}(k)\leq\bar{\alpha}_{\infty}^{e_{i}}+\epsilon,\hskip
5.69054pt\delta_{i}(k)=\mathbf{0},$

and $\omega_{ei}(k)^{\top}\omega_{ei}(k)\leq\bar{\omega}_{3}$, and the
weighted sum of the volumes of ellipsoid $\mathcal{E}_{k}^{e_{i}}$ and
$r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ is minimized in the sense of Corollary 1.

Proof: Corollary 2 follows from Theorem 1 and Proposition 1. $\blacksquare$

######  Remark 3.

By solving (44), the matrix $L$ and $\Pi$ are chosen such that the ellipsoid
$r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ contains all the possible trajectories
that $\omega_{ui}(k)$, $\omega_{ei}(k)$ can induce in the residual given in
(25) with $\omega_{ui}(k)^{\top}\omega_{ui}(k)\leq\bar{\omega}_{2}$,
$\omega_{ei}^{\top}(k)\omega_{ei}(k)\leq\bar{\omega}_{3}$, $\delta_{i}(k)=0$.
Meanwhile, the volumes of the ellipsoids $\mathcal{E}_{k}^{e_{i}}$ and
$r_{i}(k)^{\top}\Pi r_{i}(k)\leq 1$ are proportional to $(\det[P^{e}])^{-1/2}$
and $(\det[\Pi])^{-1/2}$ respectively, and $(\det[P^{e}])^{-1/2}$,
$(\det[\Pi])^{-1/2}$ share the same minimizer with $-\log\det[P^{e}]$ and
$-\log\det[\Pi]$ respectively. Therefore, the objective function in (44) is
chosen as $-\alpha_{1}\log\det[P^{e}]-\alpha_{2}\log\det[\Pi]$ as it is convex
in $P^{e}$ and $\Pi$ and leads to the tightest ellipsoidal bounds (in terms of
volumes).

###  IV-B Resilient Controller

We design the controller such that the attacker’s reachable set is constrained
to the best extent. We use Corollary 1 to obtain outer approximations of the
form
$\mathcal{E}_{k}^{\zeta_{i}}=\left\\{\zeta_{i}\in\mathbb{R}^{6}|\zeta_{i}^{\top}P^{\zeta}\zeta_{i}\leq\alpha_{k}^{\zeta_{i}}\right\\}$
such that $\mathcal{R}_{k}^{\zeta_{i}}\subseteq\mathcal{E}_{k}^{\zeta_{i}}$.
Then, we select the controller gain $K$ such that the volume of
$\mathcal{E}_{k}^{\zeta_{i}}$ is minimized. Meanwhile, matrix $K$ should be
selected to guarantee the vehicle platoon attack-free performance, e.g.,
vehicle following and string stability objectives should be fulfilled.

######  Theorem 2.

Consider the closed-loop dynamics (33)-(34) with system matrices
$(A,B_{1},B_{2},a_{u},b_{u},C,C_{e})$, estimator gain $L$, monitor matrix
$\Pi$, and perturbation bounds
$\bar{u},\bar{\omega}_{1},\bar{\omega}_{2},\bar{\omega}_{3}$. For a given
$a\in(0,1)$, $\epsilon>0$, if there exist constants $a_{1}$, $a_{2}$, $a_{3}$,
$a_{4}$, $a_{5}$, $a_{6}$ and matrices $P^{\zeta}$ and $K$ solution of the
following program:

$\left\\{\begin{split}&\min_{P^{\zeta},a_{1},\ldots,a_{6}}-\log\det[P^{\zeta}],\\\
&s.t.\hskip 2.84526pta_{1},a_{2},a_{3},a_{4},a_{5},a_{6}\in(0,1),\\\
&a_{1}+a_{2}+a_{3}+a_{4}+a_{5}+a_{6}\geq a,\\\ &P^{\zeta}>0,\\\
&\mathcal{L}:\begin{bmatrix}aP^{\zeta}&\mathcal{A}^{\top}P^{\zeta}&\mathbf{0}\\\
P^{\zeta}\mathcal{A}&P^{\zeta}&P^{\zeta}\mathcal{B}\\\
\mathbf{0}&\mathcal{B}^{\top}P^{\zeta}&W_{a}\end{bmatrix}\geq
0,\end{split}\right.$ (45)

with
$W_{a}:=\operatorname*{diag}\begin{bmatrix}(1-a_{1})W_{1},\ldots,(1-a_{6})W_{6}\end{bmatrix}\in\mathbb{R}^{17\times
17}$,
$\mathcal{B}:=(\mathcal{B}_{1},\mathcal{B}_{2},\mathcal{B}_{3},\mathcal{B}_{4},\mathcal{B}_{5},\mathcal{B}_{6})\in\mathbb{R}^{6\times
17},W_{1}=\frac{1}{\bar{u}},W_{2}=\frac{1}{\bar{w}_{1}}I_{2},W_{3}=\frac{1}{\bar{w}_{2}},W_{4}=\frac{1}{\bar{w}_{3}}I_{4},W_{5}=\Pi,W_{6}=\frac{1}{\alpha_{\infty}^{e_{i}}+\epsilon}P^{e}$;
then for all $k\geq k^{*}$,
$\mathcal{R}_{k}^{\zeta_{i}}\subseteq\mathcal{E}_{k}^{\zeta_{i}}:=\left\\{\zeta_{i}\in\mathbb{R}^{6}\vline\hskip
5.69054pt\zeta_{i}^{\top}P^{\zeta}\zeta_{i}\leq\alpha_{k}^{\zeta_{i}}\right\\}$,
and
$\alpha_{k}^{\zeta_{i}}:=a^{k-1}\zeta_{i}(1)^{\top}P^{*}\zeta_{i}(1)+((6-a)(1-a^{k-1}))/(1-a)$,
with $\zeta_{i}(1)$ the initial value of $\zeta_{i}$, and ellipsoid
$\mathcal{E}_{k}^{\zeta_{i}}$ has minimum volume in the sense of Corollary 1.

Proof: Consider the reachable set $\mathcal{R}_{k}^{\zeta_{i}}$ in (35), which
is a LTI system driven by peak-bounded perturbations. It follows that, under
the conditions stated in Theorem 2, Corollary 1 can be used to obtain outer
ellipsoidal approximations of the form
$\mathcal{E}_{k}^{\zeta_{i}}=\left\\{\zeta_{i}\in\mathbb{R}^{6}|\zeta_{i}^{\top}P^{\zeta}\zeta_{i}\leq\alpha_{k}^{\zeta_{i}}\right\\}$
such that $\mathcal{R}_{k}^{\zeta_{i}}\subseteq\mathcal{E}_{k}^{\zeta_{i}}$,
where the sequence $\alpha_{k}^{\zeta_{i}}$ is given by
$\alpha_{k}^{\zeta_{i}}=a^{k-1}\zeta_{i}(1)^{\top}P^{\zeta_{i}}\zeta_{i}(1)+(6-a)(1-a^{k-1})/(1-a)$,
$P^{\zeta}$ is the solution of (45). The volume of
$\mathcal{E}_{k}^{\zeta_{i}}$ is minimal in the sense of Corollary 1.
$\blacksquare$

Next, we select matrix $K$ to guarantee the controller performance in the
attack-free case. First, $K=\begin{bmatrix}k_{p}&k_{d}\end{bmatrix}$ should
satisfy that $k_{p},k_{d}>0$ with $k_{d}>k_{p}\tau$ in order to fulfill the
vehicle following and string stability objectives [21]. Besides, the
controller needs to ensure that the vehicle error dynamics has an acceptable
decay rate:

$\begin{split}\begin{bmatrix}\dot{e}_{1,i}\\\ \dot{e}_{2,i}\\\
\dot{e}_{3,i}\end{bmatrix}=\begin{bmatrix}0&1&0\\\ 0&0&1\\\
0&0&-\frac{1}{\tau}\end{bmatrix}\begin{bmatrix}e_{1,i}\\\ e_{2,i}\\\
e_{3,i}\end{bmatrix}+\begin{bmatrix}0\\\ 0\\\
-\frac{1}{\tau}\end{bmatrix}u_{i},\hskip 5.69054pt2\leq i\leq m,\end{split}$
(46)

with $u_{i}=K\begin{bmatrix}e_{1,i}\\\ e_{2,i}\end{bmatrix}$,
$K=\begin{bmatrix}k_{p}&k_{d}\end{bmatrix}$, and

$\begin{bmatrix}e_{1,i}\\\ e_{2,i}\\\
e_{3,i}\end{bmatrix}=\begin{bmatrix}e_{ri}\\\ \dot{e}_{ri}\\\
\ddot{e}_{ri}\end{bmatrix},\hskip 5.69054pt2\leq i\leq m.$ (47)

Substituting
$u_{i}=\begin{bmatrix}k_{p}&k_{d}\end{bmatrix}\begin{bmatrix}e_{1,i}\\\
e_{2,i}\end{bmatrix}$ into (46) yields

$\begin{bmatrix}\dot{e}_{1,i}\\\ \dot{e}_{2,i}\\\
\dot{e}_{3,i}\end{bmatrix}=\underbrace{\begin{bmatrix}0&1&0\\\ 0&0&1\\\
-\frac{k_{p}}{\tau}&-\frac{k_{d}}{\tau}&-\frac{1}{\tau}\end{bmatrix}}_{A_{e}}\begin{bmatrix}e_{1,i}\\\
e_{2,i}\\\ e_{3,i}\end{bmatrix}.$ (48)

We enforce the decay rate of system (48) by enforcing the real parts of all
the eigenvalues of $A_{e}$ to be smaller than a given constant
$\lambda_{\max}<0$. This can be achieved by letting

$\left\\{\begin{split}-\frac{1}{3\tau}<&\lambda_{\max},\\\
\frac{1}{3\tau}>k_{d}>&-2\lambda_{\max}-3\tau\lambda_{\max}^{2},\\\
k_{p}>&-\lambda_{\max}k_{d}-\lambda_{\max}^{2}-\tau\lambda_{\max}^{3}.\end{split}\right.$
(49)

In the following corollary, we formulate the optimization problem for
designing the controller $K$ such that the volume of ellipsoid
$\mathcal{E}_{k}^{\zeta_{i}}$ is minimized and vehicle following and string
stability objectives in the attack-free case are fulfilled with decay rate of
system (46) enforced.

######  Corollary 3.

Consider the closed-loop dynamics (33)-(34) with system matrices
$(A,B_{1},B_{2},a_{u},b_{u},C,C_{e})$, estimator gain $L$, monitor matrix
$\Pi$, and perturbation bounds
$\bar{u},\bar{\omega}_{1},\bar{\omega}_{2},\bar{\omega}_{3}$. For a given
$a\in(0,1)$, $\epsilon>0$, $\lambda_{\max}<0$,
$\tau\in(0,-\frac{1}{3\lambda_{\max}})$, if there exist constants $a_{1}$,
$a_{2}$, $a_{3}$, $a_{4}$, $a_{5}$, $a_{6}$, $\gamma>0$, and matrices
$P^{\zeta}$, $P_{s}$, and $K=\begin{bmatrix}k_{p}&k_{d}\end{bmatrix}$ solution
of

$\left\\{\begin{split}&\min_{P^{\zeta},a_{1},\ldots,a_{6}}-\log\det[P^{\zeta}],\\\
&s.t.\hskip 2.84526pta_{1},a_{2},a_{3},a_{4},a_{5},a_{6}\in(0,1),\\\
&a_{1}+a_{2}+a_{3}+a_{4}+a_{5}+a_{6}\geq a,\\\
&k_{p}>0,k_{d}>0,k_{d}>k_{p}\tau,\\\
&k_{d}>-2\lambda_{\max}-3\tau\lambda_{\max}^{2},\\\
&k_{p}>-\lambda_{\max}k_{d}-\lambda_{\max}^{2}-\tau\lambda_{\max}^{3},\\\
&P^{\zeta}>0,\\\
&\mathcal{L}:\begin{bmatrix}aP^{\zeta}&\mathcal{A}^{\top}P^{\zeta}&\mathbf{0}\\\
P^{\zeta}\mathcal{A}&P^{\zeta}&P^{\zeta}\mathcal{B}\\\
\mathbf{0}&\mathcal{B}^{\top}P^{\zeta}&W_{a}\end{bmatrix}\geq
0,\end{split}\right.$ (50)

with
$W_{a}:=\operatorname*{diag}\begin{bmatrix}(1-a_{1})W_{1},\ldots,(1-a_{6})W_{6}\end{bmatrix}\in\mathbb{R}^{17\times
17}$,
$\mathcal{B}:=(\mathcal{B}_{1},\mathcal{B}_{2},\mathcal{B}_{3},\mathcal{B}_{4},\mathcal{B}_{5},\mathcal{B}_{6})\in\mathbb{R}^{6\times
17},W_{1}=\frac{1}{\bar{u}},W_{2}=\frac{1}{\bar{w}_{1}}I_{2},W_{3}=\frac{1}{\bar{w}_{2}},W_{4}=\frac{1}{\bar{w}_{3}}I_{4},W_{5}=\Pi,W_{6}=\frac{1}{\alpha_{\infty}^{e_{i}}+\epsilon}P^{e}$,
$\tilde{\mathcal{B}}=(\mathcal{B}_{1},\mathcal{B}_{2},\mathcal{B}_{2})\in\mathbb{R}^{6\times
4}$; then for all $k\geq k^{*}$,
$\mathcal{R}_{k}^{\zeta_{i}}\subseteq\mathcal{E}_{k}^{\zeta_{i}}:=\left\\{\zeta_{i}^{\top}P^{\zeta}\zeta_{i}\leq\alpha_{k}^{\zeta_{i}}\right\\}$,
and
$\alpha_{k}^{\zeta_{i}}:=a^{k-1}\zeta_{i}(1)^{\top}P^{*}\zeta_{i}(1)+((6-a)(1-a^{k-1}))/(1-a)$,
with $\zeta_{i}(1)$ the initial value of $\zeta_{i}$, the ellipsoid
$\mathcal{E}_{k}^{\zeta_{i}}$ has minimum volume in the sense of Corollary 1;
vehicle following and string stability objectives are satisfied and the real
parts of all the eigenvalues of $A_{e}$ are smaller than $\lambda_{\max}$.

Note that $P^{\zeta}$ and $K$ are both variables, the terms
$P^{\zeta}\mathcal{A}$, $P^{\zeta}\mathcal{B}$ are nonlinear. To linearize the
program (50), we impose some structure on the matrices $P^{\zeta}$. Let
$P^{\zeta}$ be positive definite and of the form

$P^{\zeta}:=\begin{bmatrix}X&\mathbf{0}\\\ \mathbf{0}&\tilde{x}\end{bmatrix},$
(51)

with $X\in\mathbb{R}^{5\times 5}$, $X>0$, and $\tilde{x}>0$. We have

$P^{\zeta}\mathcal{A}=\begin{bmatrix}XA&XB_{1}\\\
b_{u}\tilde{x}KC&a_{u}\tilde{x}\end{bmatrix},$ (52)

and

$\begin{split}&P^{\zeta}\mathcal{B}=\\\
&\begin{bmatrix}XB_{2}&\mathbf{0}&\mathbf{0}&\mathbf{0}&\mathbf{0}&\mathbf{0}\\\
b_{u}\tilde{x}&b_{u}\tilde{x}K&b_{u}\tilde{x}&-b_{u}\tilde{x}K\Gamma^{\dagger}&b_{u}\tilde{x}K\Gamma^{\dagger}&-b_{u}\tilde{x}K\Gamma^{\dagger}C_{e}\end{bmatrix}.\end{split}$
(53)

We define a new variable $\tilde{K}:=\tilde{x}K$ and (52)-(53) become linear
in $X,\tilde{x}$ and $\tilde{K}$, and hence $\mathcal{L}$ in (50) is
linearized.

Hence, the program (45) becomes convex. By solving the program in (45), we can
compute $K=\frac{\tilde{K}}{\tilde{x}}$ and obtain $P^{\zeta}$ and use the
following corollary for obtaining $P^{x}$ and $\mathcal{E}_{k}^{x_{i}}$.

######  Corollary 4.

Let the conditions of Theorem 2 be satisfied and consider the corresponding
matrix $P^{\zeta_{i}}$ and function $\alpha_{k}^{\zeta_{i}}$. Let
$P^{\zeta_{i}}$ be partitioned as

$P^{\zeta_{i}}=:\begin{bmatrix}P_{1}^{\zeta_{i}}&P_{2}^{\zeta_{i}}\\\
P_{2}^{\zeta_{i}^{\top}}&P_{3}^{\zeta_{i}}\end{bmatrix},$ (54)

with $P_{1}^{\zeta_{i}}\in\mathbb{R}^{5}$,
$P_{2}^{\zeta_{i}}\in\mathbb{R}^{5\times 1}$, and $P_{3}^{\zeta_{i}}\in R$.
Then, for $k\geq k^{*}$,
$\mathcal{R}_{k}^{x_{i}}\subseteq\mathcal{E}_{k}^{x_{i}}:=\left\\{x_{i}\in\mathbb{R}^{5}|x_{i}^{\top}P^{x}x_{i}\leq\alpha_{k}^{x_{i}}\right\\}$
with
$P^{x}:=P_{1}^{\zeta_{i}}-P_{2}^{\zeta_{i}}(P_{3}^{\zeta_{i}})^{-1}(P_{2}^{\zeta_{i}})^{\top}$
and $\alpha_{k}^{x_{i}}:=\alpha_{k}^{\zeta_{i}}$.

Proof: By theorem 2, the trajectories of (33) satisfy
$\zeta_{i}^{\top}P^{\zeta}\zeta_{i}\leq\alpha_{k}^{\zeta_{i}}$ for $k\geq
k^{*}$. By Lemma 1, the projection of
$\zeta_{i}(k)^{\top}P^{\zeta}\zeta_{i}(k)\leq\alpha_{k}^{\zeta_{i}}$ onto the
$x_{i}$-hyperplane is given by $\mathcal{E}_{k}^{x_{i}}$ defined above. Thus,
in light of Remark 2, the trajectories of the vehicle dynamics are contained
in $\mathcal{E}_{k}^{x_{i}}$, i.e.,
$\mathcal{R}_{k}^{x_{i}}\subseteq\mathcal{E}_{k}^{x_{i}}$ for all $k\geq
k^{*}$. $\blacksquare$

######  Remark 4.

Since the gains of the estimator, the monitor, and the controller, i.e.,
$L,\Pi,$ and $K$ are all selected with the purposed of minimizing the volumes
of $\mathcal{E}_{k}^{\zeta_{i}}$, and $\mathcal{E}_{k}^{x_{i}}$ is the
projection of $\mathcal{E}_{k}^{\zeta_{i}}$ onto the $x_{i}$-hyperplane,
hence, the volume of $\mathcal{E}_{k}^{x_{i}}$ is also minimized. This
indicates our design approaches minimize the platooning performance
deterioration caused by stealthy attacks.

##  V A Security Assessment: Distance to Critical States

In this section, we aim to provide a security assessment method for evaluating
CAV resilience to cyberattacks. . We introduce the notion of _critical states_
$\mathcal{C}^{x_{i}}$ – states that, if reached, compromise the integrity or
safe operation of the vehicles. Such a region may represent states in which, a
collision between two neighboring vehicles occurs, or the velocity of the
vehicle exceeds the maximum allowed value. So far, we have characterized all
the states that attacks can induce in the platoon while being stealthy to the
system monitor (the stealthy reachable set $\mathcal{R}_{k}^{x_{i}}$).
Therefore, if the intersection between $\mathcal{C}^{x_{i}}$ and
$\mathcal{R}_{k}^{x_{i}}$ is not empty, there exist attack sequences
$\delta_{i}$ that can induce a critical event by tampering with radars.
Conversely, if such an intersection is empty, we can ensure that critical
events cannot be induced by stealthy attacks on radars. Here, we compute the
minimum distance $d_{k}^{x_{i}}$ from $\mathcal{E}_{k}^{x_{i}}$ to
$\mathcal{C}^{x_{i}}$ and use it as an approximation of the distance between
$\mathcal{R}_{k}^{x_{i}}$ and $\mathcal{C}^{x_{i}}$ (because computing
$\mathcal{R}_{k}^{x_{i}}$ exactly is not tractable, we only have the
approximation $\mathcal{E}_{k}^{x_{i}}$). The distance $d_{k}^{x_{i}}$ gives
us intuition of how far the actual reachable set $\mathcal{R}_{k}^{x_{i}}$ is
from $\mathcal{C}^{x_{i}}$.

From (8), we have that the tracking error of each vehicle at the sampling
time-instants is given by

$e_{ri}(k)=d_{i}(k)-(s_{i}+hv_{i}(k)).$ (55)

Since $d_{i}(k)<0$ indicates a collision between vehicles $i$ and $i-1$, one
subset of critical states is clearly given by:

$\begin{split}e_{ri}(k)<-s_{i}-hv_{i}(k).\end{split}$ (56)

Another potential subset of critical states is that the maximum allowed
velocity $v_{\max}$ is exceeded, i.e.,

$v_{i}(k)>v_{\max}.$ (57)

Combining (56) and (57), the set of critical states is characterized by the
union of half-spaces:

$\mathcal{C}^{x_{i}}:=\big{\\{}x_{i}\in\mathbb{R}^{5}\vline\hskip
2.84526ptc_{1}^{\top}x_{i}>s_{i}\text{ and
}c_{2}^{\top}x_{i}>v_{\max}\big{\\}},$ (58)

with $c_{1}^{\top}=\begin{bmatrix}-1&-h&0&0&0\end{bmatrix}$, and
$c_{2}^{\top}=\begin{bmatrix}0&1&0&0&0\end{bmatrix}$.

######  Corollary 5.

Consider the set of critical states $\mathcal{C}^{x_{i}}$ defined in (58) and
the matrix $P^{x}$ and the function $\alpha_{k}^{x_{i}}$ obtained in Theorem
1. The minimum distance, $d_{k}^{x_{i}}$, between the outer ellipsoidal
approximation of $\mathcal{R}_{k}^{x_{i}}$,
$\mathcal{E}_{k}^{x_{i}}=\left\\{x_{i}\in\mathbb{R}^{5}\vline\hskip
2.84526ptx_{i}^{\top}P^{x}x_{i}\leq\alpha_{k}^{x_{i}}\right\\}$, and
$\mathcal{C}^{x_{i}}$ is given by

$d_{k}^{x_{i}}=\min\left(\frac{|b_{j}|-\sqrt{c_{j}^{\top}(P^{x})^{-1}c_{j}/\alpha_{k}^{x_{i}}}}{c_{j}^{\top}c_{j}}\right),j=1,2.$
(59)

Proof: The minimum distance between an ellipsoid centered at the origin
$\left\\{x\in\mathbb{R}^{n}|x^{\top}Px=1\right\\}$, $P>0$, and a hyperplane
$\left\\{x\in\mathbb{R}^{n}|\hskip 2.84526ptc^{\top}x=b\right\\}$,
$c\in\mathbb{R}^{n}$, $b\in\mathbb{R}$ is given by
$(|b|-\sqrt{c^{\top}P^{-1}c})/c^{\top}c$ [24]. The minimum distance between
$\mathcal{C}^{x_{i}}$ and $\mathcal{E}^{x_{i}}_{k}$ is hence given by (59).
$\blacksquare$

######  Remark 5.

If $d_{k}^{x_{i}}>0$ for all $k\in\mathbb{N}$, the ellipsoid
$\mathcal{E}_{k}^{x_{i}}$ does not intersect with the set of critical states
$\mathcal{C}^{x_{i}}$. Since
$\mathcal{R}_{k}^{x_{i}}\subseteq\mathcal{E}_{k}^{x_{i}}$, the intersection
between $\mathcal{C}^{x_{i}}$ and $\mathcal{R}_{k}^{x_{i}}$ is also empty.
This indicates no collision will occur between the $i$-th and the $i-1$-th
CAVs and its velocity will not exceed $v_{\max}$ under stealthy attacks. We
can thus conclude the $i$-th CAV is resilient to stealthy attacks on radars. A
schematic representation of this idea is given in Figures 3-4. On the
contrary, if $d_{k}^{x_{i}}<0$ for some $k\in\mathbb{N}$, the intersection
between the ellipsoid $\mathcal{E}_{k}^{x_{i}}$ and the set of critical states
$\mathcal{C}^{x_{i}}$ is not empty. This indicates that collisions between
vehicles $i$ and $i-1$ is possible or the $i$-th CAV might be speeding under
stealthy attacks. The latter case is depicted in Figure 5. However, due to the
potential conservatism of the ellipsoidal bounds, the scenario depicted in
Figure 6 may also occur, i.e., $d_{k}^{x_{i}}<0$ but the intersection between
$\mathcal{R}_{k}^{x_{i}}$ and $\mathcal{C}^{x_{i}}$ is empty. Therefore, if
$d_{k}^{x_{i}}>0$, the $i$-th CAV is risk-free in the presence of stealthy FDI
attacks; otherwise, the $i$-th CAV is under risk.

Figure 3: Stealthy reachable set of the $i$-th CAV $\mathcal{R}_{k}^{x_{i}}$
and outer ellipsoidal approximation $\mathcal{E}_{k}^{x_{i}}$ of
$\mathcal{R}_{k}^{x_{i}}$. Figure 4: Minimum distance $d_{k}^{x_{i}}>0$
implies the $i$-th CAV is resilient to stealthy FDI attacks. Figure 5: Minimum
distance $d_{k}^{x_{i}}<0$ and there is an intersection between
$\mathcal{R}_{k}^{x_{i}}$ and $\mathcal{C}^{x_{i}}$ \- the $i$-th CAV is
vulnerable to stealthy FDI attacks. Figure 6: Minimum distance
$d_{k}^{x_{i}}<0$ but there is no intersection between
$\mathcal{R}_{k}^{x_{i}}$ and $\mathcal{C}^{x_{i}}$ \- the $i$-th CAV is
resilient to stealthy FDI attacks.

##  VI Simulation

In this section, we use a simulation study to illustrate the effectiveness of
our approaches.

Consider two homogeneous vehicles in a platoon with initial speed $30m/s$.
Suppose $h=0.5$, $\tau=0.1$. Using exact discretization approach, we obtain
the discrete-time system (29) with sampling interval $T_{s}=0.1$ seconds.
Suppose the desired acceleration of vehicle $i$ ranges from $-2m/s^{2}$ to
$2m/s^{2}$, i.e., $u_{1}\in[-2,2]$. At each time step $k$, $u_{1}(k)$ is
transmitted from vehicle $1$ to vehicle $2$. Disturbances $\omega_{d2}$,
$\omega_{u2}$ are uniformly distributed in the intervals $(-0.1,0.1)$ and
$(-0.01,0.01)$ respectively, i.e., $\omega_{d2}\in\mathcal{U}(-0.1,0.1)$,
$\omega_{u2}\in\mathcal{U}(-0.01,0.01)$. Let $\bar{u}=4$,
$\bar{\omega}_{1}=0.01$, $\bar{\omega}_{2}=0.0001$, $\bar{\omega}_{3}=0.02$.
At each time step $k$, $u_{1}(k)$ is transmitted from vehicle $1$ to vehicle
$2$ via the communication network. We use Corollary 2 to obtain the optimal
state estimator and the monitor matrix $Pi$. We let the tuning parameters
$\alpha_{1}=0.95$, $\alpha_{2}=0.05$, by solving (44) using a grid search over
$a\in(0,1)$, $c\in(0,1)$, $a_{3}\in(0,1)$, and $\tau_{1}\in(0,1)$, we can
obtain the estimator and monitor matrices as follows:

$L=\begin{bmatrix}0.2773&-0.0109&-0.0382&0.0000\\\
-0.0000&0.8754&0.0118&-0.0000\\\ -0.0000&0.0006&0.0403&-0.0000\\\
0.0000&-0.0265&-0.0961&0.2772\\\ -0.0001&-0.0007&-0.0123&0.0013\end{bmatrix},$
(60) $\Pi=\begin{bmatrix}0.0001&0.0000&-0.0000&0.0000\\\
0.0000&0.2470&-0.0001&0.0000\\\ -0.0000&-0.0001&0.2578&-0.0000\\\
0.0000&0.0000&-0.0000&0.0001\end{bmatrix}.$ (61)

Next, we use Corollary 3 to obtain the optimal controller. We solve (50) and
enforce the real parts of all the eigenvalues of $A_{e}$ to be smaller than
$\lambda_{\max}=-0.01$ and we have

$K=\begin{bmatrix}0.0051&0.0204\end{bmatrix}.$ (62)

Suppose $u_{1}(k)=2e^{-0.1k}$, the initial condition of vehicle $2$ is given
as $x_{2}(1)=\begin{bmatrix}0&30&0&0&0\end{bmatrix}$. The initial condition of
the estimator $\hat{x}_{2}(1)$ is randomly chosen. The performance of the
estimator is shown in Figure 7.

Figure 7: The estimation $\hat{x}_{2}(k)$ converges to the true vehicle state
$x_{2}(k).$

Suppose the maximum allowed speed is $35m/s$, i.e., $v_{\max}=35$; the average
standstill distance $s_{2}=3$ meters is adopted as given in [25]. Therefore,
In Section V, the ellipsoidal approximation $\mathcal{E}_{k}^{x_{i}}$ is
$k$-dependent; however, since $a\in(0,1)$, the function $\alpha_{k}^{x_{i}}$
conforming $\mathcal{E}_{k}^{x_{i}}$ converges to
$\alpha_{\infty}^{x_{i}}=(6-a)/(1-a)$ exponentially. Therefore, in a few time
steps,
$\mathcal{E}_{k}^{x_{2}}\approx\mathcal{E}_{\infty}^{x_{2}}=\left\\{x_{2}\in\mathbb{R}^{5}|\hskip
5.69054ptx_{2}^{\top}P^{x}x_{2}\leq(6-a)/(1-a)\right\\}$. Therefore, we
compute the distance between $C^{x_{2}}$ and $\mathcal{E}_{\infty}^{x_{2}}$ as

$d_{\infty}^{x_{2}}=\min\left(\frac{|b_{j}|-\sqrt{c_{j}^{\top}(P^{x})^{-1}c_{j}/\alpha_{\infty}^{x_{2}}}}{c_{j}^{\top}c_{j}}\right),j=1,2.$
(63)

We obtain that $d_{\infty}^{x_{2}}=1.3978$, which is positive. This indicates
that the vehicle equipped with estimator $L$ and monitor $\Pi$ given as (60)
and (61) is resilient to stealthy attacks on radars. However, if we design
estimator $L$, monitor $\Pi$ and controller $K$ without using our synthesis
approach, $d_{\infty}^{x_{2}}$ can be negative, which indicates the vehicle
platoon is under risk in the presence of stealthy attacks on radars. For
example, if we consider designing an estimator optimal in terms of minimizing
the effect of disturbances on estimation error, we can choose $L$ such that
the $H_{\infty}$ gain from
$\omega_{2}(k)=\begin{bmatrix}\omega_{u2}(k)&\omega_{e2}^{\top}(k)\end{bmatrix}^{\top}$
to $e_{2}(k)$ is minimized, we can obtain the estimator gain given as follows:

$\tilde{L}=\begin{bmatrix}0.0245&-0.0001&0.0001&-0.0994\\\
-0.0001&0.0147&-0.0001&-0.0000\\\ 0.0000&-0.0001&0.0012&0.0000\\\
-0.0994&-0.0000&-0.0000&1.0083\\\ -0.0105&-0.0000&0.0001&0.1053\end{bmatrix}$
(64)

with $H_{\infty}$ gain equal to $1.0425$ [26]. Solving (43) by substituting
$L$ as given in (64), we can obtain the monitor with $\tilde{\Pi}$ given as:

$\tilde{\Pi}=\begin{bmatrix}0.1863&0.0001&-0.0002&0.0173\\\
0.0001&0.1879&0.0004&0.0000\\\ -0.0002&0.0004&0.2239&-0.0000\\\
0.0173&0.0000&-0.0000&0.0151\end{bmatrix}.$ (65)

Moreover, suppose we adopt the controller introduced in [21] with
$\tilde{K}=\begin{bmatrix}0.2&0.7\end{bmatrix}$. Note that such a controller
gain is selected in [21] to fulfill the vehicle following and string stability
objectives without security considerations. We can now compute
$d_{\infty}^{x_{2}}$ from (63) and obtain $d_{\infty}^{x_{2}}=-3.738\times
10^{3}$. This indicates that vehicle $2$ equipped with estimator $\tilde{L}$,
monitor $\tilde{\Pi}$, and controller $\tilde{K}$ might collide with vehicle
$1$ or might be speeding if its radars are under stealthy attacks.

##  VII Conclusion

We have provided algorithmic tools for designing estimators, fault/attack
detectors and controllers for enhancing the resilience of CAVs in a platoon to
sensor attacks. We have given design methods for constructing the estimator,
the detector and the controller such that their attack-free performances are
guaranteed, i.e., the estimator and detector can be used for state estimation
and identifying faults or general FDI attacks on CAV sensors and the
controller can fulfill vehicle following and string stability objectives; and
at the same time, they minimize the degradation of platooning performance
caused by stealthy sensor attacks – attacks that are intelligent enough to
surpass the detector by hiding within the system uncertainties. A security
assessment method has been provided to evaluate the resilience of CAVs to
stealthy attacks. The method has also been used to show the effectiveness of
our approaches.

## References

  * [1] J. Petit and S. E. Shladover, “Potential cyberattacks on automated vehicles,” IEEE Transactions on Intelligent transportation systems, vol. 16, no. 2, pp. 546–556, 2014.
  * [2] M. Harris, “Researcher hacks self-driving car sensors,” IEEE Spectrum, vol. 9, 2015.
  * [3] C. Yan, W. Xu, and J. Liu, “Can you trust autonomous vehicles: Contactless attacks against sensors of self-driving vehicle,” DEF CON, vol. 24, no. 8, p. 109, 2016.
  * [4] N. Lu, N. Cheng, N. Zhang, X. Shen, and J. W. Mark, “Connected vehicles: Solutions and challenges,” IEEE Internet of Things Journal, vol. 1, no. 4, pp. 289–299, 2014.
  * [5] T. Litman, Autonomous vehicle implementation predictions.  Victoria Transport Policy Institute Victoria, Canada, 2017.
  * [6] J. M. Anderson, K. Nidhi, K. D. Stanley, P. Sorensen, C. Samaras, and O. A. Oluwatola, Autonomous vehicle technology: A guide for policymakers.  Rand Corporation, 2014.
  * [7] Q. Liu, Y. Mo, X. Mo, C. Lv, E. Mihankhah, and D. Wang, “Secure Pose Estimation for Autonomous Vehicles under Cyber Attacks,” Intelligent Vehicles Symposium, no. Iv, pp. 1401–1406, 2019.
  * [8] F. van Wyk, Y. Wang, A. Khojandi, and N. Masoud, “Real-Time Sensor Anomaly Detection and Identification in Automated Vehicles,” IEEE Transactions on Intelligent Transportation Systems, pp. 1–13, 2019.
  * [9] E. Mousavinejad, F. Yang, Q.-L. Han, X. Ge, and L. Vlacic, “Distributed cyber attacks detection and recovery mechanism for vehicle platooning,” IEEE Transactions on Intelligent Transportation Systems, vol. 21, no. 9, pp. 3821–3834, 2019.
  * [10] Z. Ju, H. Zhang, and Y. Tan, “Deception attack detection and estimation for a local vehicle in vehicle platooning based on a modified ufir estimator,” IEEE Internet of Things Journal, vol. 7, no. 5, pp. 3693–3705, 2020.
  * [11] T. Yang and C. Lv, “A secure sensor fusion framework for connected and automated vehicles under sensor attacks,” IEEE Internet of Things Journal, 2021.  doi:10.1109/JIOT.2021.3101502.
  * [12] P. M. Frank and X. Ding, “Survey of robust residual generation and evaluation methods in observer-based fault detection systems,” Journal of process control, vol. 7, no. 6, pp. 403–424, 1997.
  * [13] R. Isermann, “Model-based fault-detection and diagnosis–status and applications,” Annual Reviews in control, vol. 29, no. 1, pp. 71–85, 2005\.
  * [14] A. Lopes and R. E. Araújo, “Active fault diagnosis method for vehicles in platoon formation,” IEEE Transactions on Vehicular Technology, vol. 69, no. 4, pp. 3590–3603, 2020.
  * [15] Y. Wang, N. Masoud, and A. Khojandi, “Anomaly detection in connected and automated vehicles using an augmented state formulation,” in 2020 Forum on Integrated and Sustainable Transportation Systems (FISTS), pp. 156–161, IEEE, 2020.
  * [16] T. Yang, C. Murguia, D. Nešić, and C. Lv, “A robust cacc scheme against cyberattacks via multiple vehicle-to-vehicle networks,” IEEE Transactions on Vehicular Technology, 2023.
  * [17] K. Jeong, S. B. Choi, and H. Choi, “Sensor fault detection and isolation using a support vector machine for vehicle suspension systems,” IEEE Transactions on Vehicular Technology, vol. 69, no. 4, pp. 3852–3863, 2020.
  * [18] S. Dadras, S. Dadras, and C. Winstead, “Reachable set analysis of vehicular platooning in adversarial environment,” in 2018 Annual American Control Conference (ACC), pp. 5568–5575, IEEE, 2018.
  * [19] M. Sun, A. Al-Hashimi, M. Li, and R. Gerdes, “Impacts of constrained sensing and communication based attacks on vehicular platoons,” IEEE Transactions on Vehicular Technology, vol. 69, no. 5, pp. 4773–4787, 2020.
  * [20] C. Murguia, I. Shames, J. Ruths, and D. Nešić, “Security metrics and synthesis of secure control systems,” Automatica, vol. 115, p. 108757, 2020\.
  * [21] J. Ploeg, N. Van De Wouw, and H. Nijmeijer, “Lp string stability of cascaded systems: Application to vehicle platooning,” IEEE Transactions on Control Systems Technology, vol. 22, no. 2, pp. 786–793, 2014\.
  * [22] C. Paper and S. Darbha, “String Stability of Interconnected Systems - Automatic Control, IEEE Transactions on,” IEEE Transactions on Automatic Control, vol. 41, pp. 349–357, 1996.
  * [23] S. Boyd, S. P. Boyd, and L. Vandenberghe, Convex optimization.  Cambridge university press, 2004.
  * [24] A. A. Kurzhanskiy and P. Varaiya, “Ellipsoidal toolbox (et),” in Proceedings of the 45th IEEE Conference on Decision and Control, pp. 1498–1503, IEEE, 2006.
  * [25] A. Houchin, J. Dong, N. Hawkins, and S. Knickerbocker, “Measurement and analysis of heterogenous vehicle following behavior on urban freeways: Time headways and standstill distances,” in 2015 IEEE 18th International Conference on Intelligent Transportation Systems, pp. 888–893, IEEE, 2015.
  * [26] G. E. Dullerud and F. Paganini, A course in robust control theory: a convex approach, vol. 36.  Springer Science & Business Media, 2013.