Defending against cyber-attacks in building HVAC systems through energy performance evaluation using a physics-informed dynamic Bayesian network (PIDBN)

The increasing use of Internet communications in smart building automation systems (BAS) has escalated the risk of cyber-attacks targeting HVAC systems, which are primary energy consumers. This paper introduces a defensive strategy based on energy performance evaluation, extending beyond conventional network-based measures. At its core is a physics-informed dynamic Bayesian network (PIDBN) for cyber-attack detection and diagnostics (CADD), which integrates the physical building model into the dynamic Bayesian framework. This approach enhances real-time detection by balancing data-driven processes with physics-based modeling, reducing reliance on extensive data and complex model development. The PIDBN-CADD framework is validated through simulations in Dymola software and a real-world demonstration in the Research I (R1) building. Compared to conventional fault detection and diagnostics (FDD) methods, such as air handling unit performance assessment rules (APAR), PIDBN-CADD excels in detecting sensor and control signal faults caused by cyber-attacks. Specifically, PIDBN-CADD achieves a correct alarm rate (CAR) of 94.4% with a true positive rate (TPR) of 48.2% for sensor attacks, and a 100% CAR with 78.9% TPR for control signal attacks, significantly outperforming APAR-based FDD. This paper is among the first to introduce a physics-informed Bayesian network, providing robust and real-time protection against emerging cyber threats in smart buildings.