  For industrial control systems (ICS), many existing defense solutions focus
on detecting attacks only when they make the system behave anomalously.
Instead, in this work, we study how to detect attackers who are still in their
hiding phase. Specifically, we consider an off-path false-data-injection
attacker who makes the original sensor's readings unavailable and then
impersonates that sensor by sending out legitimate-looking fake readings, so
that she can stay hidden in the system for a prolonged period of time (e.g., to
gain more information or to launch the actual devastating attack on a specific
time). To expose such hidden attackers, our approach relies on continuous
injection of ``micro distortion'' to the original sensor's readings, either
through digital or physical means. We keep the distortions strictly within a
small magnitude (e.g., $0.5\%$ of the possible operating value range) to ensure
that it does not affect the normal functioning of the ICS. Micro-distortions
are generated based on secret key(s) shared only between the targeted sensor
and the defender. For digitally-inserted micro-distortions, we propose and
discuss the pros and cons of a two-layer least-significant-bit-based detection
algorithm. Alternatively, when the micro-distortions are added physically, a
main design challenge is to ensure the introduced micro-distortions do not get
overwhelmed by the fluctuation of actual readings and can still provide
accurate detection capability. Towards that, we propose a simple yet effective
Filtered-$\Delta$-Mean-Difference algorithm that can expose the hidden
attackers in a highly accurate and fast manner. We demonstrate the
effectiveness and versatility of our defense by using real-world sensor reading
traces from different industrial control (including smart grid) systems.
