  The rise of cyber-security concerns has brought significant attention to the
analysis and design of cyber-physical systems (CPSs). Among the various types
of cyberattacks, denial-of-service (DoS) attacks and false data injection (FDI)
attacks can be easily launched and have become prominent threats. While
resilient control against DoS attacks has received substantial research
efforts, countermeasures developed against FDI attacks have been relatively
limited, particularly when explicit system models are not available. To address
this gap, the present paper focuses on the design of data-driven controllers
for unknown linear systems subject to FDI attacks on the actuators, utilizing
input-state data. To this end, a general FDI attack model is presented, which
imposes minimally constraints on the switching frequency of attack channels and
the magnitude of attack matrices. A dynamic state feedback control law is
designed based on offline and online input-state data, which adapts to the
channel switching of FDI attacks. This is achieved by solving two data-based
semi-definite programs (SDPs) on-the-fly to yield a tight approximation of the
set of subsystems consistent with both offline clean data and online
attack-corrupted data. It is shown that under mild conditions on the attack,
the proposed SDPs are recursively feasible and controller achieves exponential
stability. Numerical examples showcase its effectiveness in mitigating the
impact of FDI attacks.
