  Sequential attack detection in a distributed estimation system is considered,
where each sensor successively produces one-bit quantized samples of a desired
deterministic scalar parameter corrupted by additive noise. The unknown
parameters in the pre-attack and post-attack models, namely the desired
parameter to be estimated and the injected malicious data at the attacked
sensors pose a significant challenge for designing a computationally efficient
scheme for each sensor to detect the occurrence of attacks by only using local
communication with neighboring sensors. The generalized Cumulative Sum (GCUSUM)
algorithm is considered, which replaces the unknown parameters with their
maximum likelihood estimates in the CUSUM test statistic. For the problem under
consideration, a sufficient condition is provided under which the expected
false alarm period of the GCUSUM can be guaranteed to be larger than any given
value. Next, we consider the distributed implementation of the GCUSUM. We first
propose an alternative test statistic which is asymptotically equivalent to
that of GCUSUM. Then based on the proposed alternative test statistic and
running consensus algorithms, we propose a distributed approximate GCUSUM
algorithm which significantly reduce the prohibitively high computational
complexity of the centralized GCUSUM. Numerical results show that the
distributed approximate GCUSUM algorithm can provide a performance that is
comparable to the centralized GCUSUM.
