  The leading workhorse of anomaly (and attack) detection in the literature has
been residual-based detectors, where the residual is the discrepancy between
the observed output provided by the sensors (inclusive of any tampering along
the way) and the estimated output provided by an observer. These techniques
calculate some statistic of the residual and apply a threshold to determine
whether or not to raise an alarm. To date, these methods have not leveraged the
frequency content of the residual signal in making the detection problem
easier, specifically dealing with the case of (e.g., measurement) noise. Here
we demonstrate some opportunities to combine filtering to enhance the
performance of residual-based detectors. We also demonstrate how filtering can
provide a compelling alternative to residual-based methods when paired with a
robust observer. In this process, we consider the class of attacks that are
stealthy, or undetectable, by such filtered detection methods and the impact
they can have on the system.
