  This paper proposes a distributed attack detection and mitigation technique
based on distributed estimation over a multi-agent network, where the agents
take partial system measurements susceptible to (possible) biasing attacks. In
particular, we assume that the system is not locally observable via the
measurements in the direct neighborhood of any agent. First, for performance
analysis in the attack-free case, we show that the proposed distributed
estimation is unbiased with bounded mean-square deviation in steady-state.
Then, we propose a residual-based strategy to locally detect possible attacks
at agents. In contrast to the deterministic thresholds in the literature
assuming an upper bound on the noise support, we define the thresholds on the
residuals in a probabilistic sense. After detecting and isolating the attacked
agent, a system-digraph-based mitigation strategy is proposed to replace the
attacked measurement with a new observationally-equivalent one to recover
potential observability loss. We adopt a graph-theoretic method to classify the
agents based on their measurements, to distinguish between the agents
recovering the system rank-deficiency and the ones recovering
output-connectivity of the system digraph. The attack detection/mitigation
strategy is specifically described for each type, which is of polynomial-order
complexity for large-scale applications. Illustrative simulations support our
theoretical results.
