An Industrial Control System (ICS) is used to monitor and control industrial processes and critical infrastructure, and is therefore crucial to modern society. This makes them attractive targets for malicious cyber-attacks, which have become more advanced and abundant in recent history. To properly defend ICSs from these cyber-attacks, appropriate cyber-defensive mechanisms should be continuously designed and updated, cyber-attack detection mechanisms included. These mechanisms should undergo sufficient testing before being implemented in actual ICSs to minimise unforeseen consequences. Existing literature indicates that Dynamic Multiplicative Watermarking (DMWM) is a promising form of cyber-attack detection, which could improve overall detection performance. Thus far, this technique has not yet been applied to Automatic Generation Control (AGC) (a prominent form of Load Frequency Control (LFC) in power grids) to detect data integrity attacks (specifically scaling and replay attacks).

Ergo, this research aims at testing the performance of DMWM against data integrity attacks on AGC. To perform attack detection, a Luenberger observer it utilised. This observer generates a residual, which is compared to a robustly designed threshold. For the purpose of adequate testing, the HILDA (Hardware-In-the-Loop Detection of Attacks) testbed is designed and constructed. By using this testbed, more realistic scenarios can be simulated than with regular desktop simulations. After verifying the correct construction of the testbed, the DMWM performance is examined both on a desktop simulation environment using MATLAB & Simulink, and on the HILDA testbed. It is shown that the addition of DMWM increases the detection performance in the context of both scaling and replay attacks. For replay attacks, this performance increases notably, while for scaling attacks the improvement is more modest. It is shown that, overall, the attacks are detected more quickly when simulated on the HILDA testbed compared to simulations performed on the MATLAB & Simulink environment. On the other hand, the overall detection ratio was better when simulated on the MATLAB & Simulink environment. This discrepancy in detection performance demonstrates the added value of the HILDA testbed.

Due to the increase in traffic, road congestion has gone up. Vehicle platooning is a possible way to increase the capacity of a given road, by decreasing the distance between the vehicles in the platoon. At the moment, the control of vehicle platoons is commonly done using PDD controllers. The advantage of this is that it requires little computational resources. With improvements in computing technology in recent years, the possibility of using a more computationally costly method has opened up. MPC is such a method, with a couple of important advantages for vehicle platooning. Firstly it is (finite-time) optimal so should lead to smaller deviations from the desired trajectory, thereby decreasing the minimum safe distance between the vehicles. Secondly, it is inherently able to include constraints on the behaviour of the platoon. This is important because it allows for explicitly enforcing the minimum safe distance between the vehicles, thereby preventing collisions.
While many studies have looked into the possibility of using MPC for vehicle platooning before. None of them have made the direct comparison with the current standard e.i. PDD control in a practical setup. This is important as it will give a good indication of both the possible advantages and pitfalls MPC could have in real platoons. To investigate this both a PDD and MPC controller are implemented on a platoon of RC-vehicles and their performance is compared.
To compare the performance five metrics are used on four scenarios. The metrics used are coherence, combined local error, velocity error, energy expenditure and minimum headway. The scenarios are a step up, step down, ramp up and a ramp down.

From the simulation results, it is clear that in an idealised case the MPC outperforms the PDD controller. However, when looking at the lab results this difference is less pronounced. In the lab setting, it is also clear that both controllers struggle to reliably deal with the added uncertainties caused by measurement noise and inconsistent behaviour of the vehicles.
In future research more emphasis should be placed on the robustness of the controllers used, to mitigate these problems.

Industrial control systems (ICSs) are used widely throughout the world for the control of large, complex industrial plants and consist of the entire setups of control system including sensors, PLCs (Programmable Logic Controllers), actuators and communication devices. The communication between these ICS devices is performed using industrial communication protocols such as Modbus, EtherCAT, etc. With the advancements in the use of the internet, ICS are being enabled to share real-time information over the internet worldwide. While these features make the ICS more accessible for remote supervisory control, they also make them vulnerable to cyber-attacks. This makes it the need of the hour to investigate risks and impacts of cyber attacks on ICS. Generating, injecting and testing cyber attacks on real world ICS, controlling critical infrastructure will involve several financial risks and safety issues. This gives rise to the necessity of an ICS testbed, with the ability to inject and test cyber attacks, in a safe and secure environment. A testbed provides a cheaper alternative for testing impacts of cyber attacks and also offers more flexibility to simulate multiple industrial scenarios. Together, these aspects form the core reasons behind the requirement of an ICS testbed. As the real world ICSs are often costly and specialized for industrial usage, there are not many research laboratories around the world with the availability of a testbed to study cyber attacks. Therefore, this Master of science thesis, through its primary research question, investigates if a cyber-attack testbed can be built in the NERD lab at the Delft University of Technology, which is able to replicate a real-world ICS network to identify and test vulnerabilities of ICSs working on Modbus protocol to cyber-attacks? To answer this question, this report studies the vulnerabilities in ICS working with Modbus protocol. A novel design for an ICS testbed for generating and testing cyber attacks at NERD Lab in TU Delft is presented during this thesis. The proposed testbed utilizes real world ICS components such as PLC and HMI, combined with a plant simulator, which is used for simulating an industrial process. The testbed utilizes a Linux based attack PC to generate and inject various cyber attacks. A virtualization platform connects the attack PC to the ICS network, giving the flexibility of injecting attacks on the testbed, without the attacker being physically present on the plant site. With the use of real world ICS, the testbed therefore allows to replicate a typical ICS scenario in the real world industry. Further, a simulated version of the actual testbed, with open source softwares, mimicking the ICS systems has been developed in this report. This simulated version provides a cheaper and flexible platform to perform initial testing on the working of the testbed and checks the feasibility of the actual testbed. The testbed simulates a plant, controller, and HMI in Matlab/Simulink on different physical PCs, which communicate with the Modbus protocol. An attack PC with a virtualization environment has been used to launch cyber attacks on the simulated testbed, same as that to be used in the proposed testbed at Delft University of Technology. Two main types of cyber attacks namely, Man-In-The-Middle (MITM) and Denial-of-Service (DoS) attack have been successfully implemented on this simulated testbed. To conclude this thesis, advanced versions of these attacks have also been developed and their impacts have been analysed.

Road intersections have a large impact on road accidents and travel delay. Applying infrastructure, such as stop signs and traffic lights, are supposed to prevent collisions on the intersection. However, such methods contribute to the travel delay, while accidents still occur due to human errors. Considering the rise of automation within vehicles, the automation of intersections becomes possible. Vehicles exchange information with each other (distributed techniques) or with a central unit (centralized techniques) to determine the velocity profile needed to efficiently cross the intersection without causing any collisions. This information exchange is established through the creation of spontaneous wireless networks between vehicles and infrastructure, also known as a Vehicular Ad-Hoc Network (VANET).

However, the addition of wireless communication to autonomous vehicles presents a dangerous vulnerability to cyber attacks. In the literature, many studies investigate what types of cyber attacks are most likely to occur on the VANET. From these studies, it is chosen to test the cyber attack called "false data injection" on Virtual Platooning based Intersection Control.

It is shown in simulations that an alteration in the broadcasted messages for a duration of $1.3$ seconds already leads to a collision on the intersection. In order to prevent such events from happening, a Sliding Mode Observer (SMO) is designed to monitor the received data from the surrounding vehicles. Treating the false injected data as an unknown input to the system, the SMO is designed to reconstruct the anomalous data.

The accuracy of the unknown input reconstruction using an SMO depends on how well the model describes the dynamics of the vehicles. Thus the SMO is designed for both a linear as well as a non-linear vehicle model. To analyze the performance of the SMO, the observer is applied to both simulations and experiments. Under the assumption that the vehicles can measure the relative velocity to each other, both the simulations and the experiments show promising results.

Sensors are used all around us in various industries, for instance: agricultural, medical,aerospace and automotive. It is important for these industries to have reliable sensor data because the functionality of technologies depends on it. In this work, the industry of inter-est is automotive, specifically in the field of Cooperative Adaptive Cruise Control (CACC). The control of vehicles depends on measurement data from radars, which are carried by each vehicle in a platoon. If these measurements are faulty, it could affect CACC and cause a crash. This work models the Radio Control (RC) vehicle, implements CACC and aims to identify such faults in the radar measurement data before they could impact the behavior of the platoon. The results are obtained in simulation, comprising the mathematical model of the vehicles, the implemented CACC controller and a virtual radar exposed to 4 different faults, with which the chosen method for fault detection is evaluated. The results of the CACC operating in ideal conditions and with faulty measurement data are depicted. The work ends with analysing the results and concluding, whether the chosen method is capable of identifying the faulty measurement data.