  In cyber-physical systems, malicious and resourceful attackers could
penetrate the system through cyber means and cause significant physical damage.
Consequently, detection of such attacks becomes integral towards making these
systems resilient to attacks. To achieve this objective, intrusion detection
systems (IDS) that are able to detect malicious behavior can be deployed.
However, practical IDS are imperfect and sometimes they may produce false
alarms for a normal system behavior. Since alarms need to be investigated for
any potential damage, a large number of false alarms may increase the
operational costs significantly. Thus, IDS need to be configured properly, as
oversensitive IDS could detect attacks early but at the cost of a higher number
of false alarms. Similarly, IDS with low sensitivity could reduce the false
alarms while increasing the time to detect the attacks. The configuration of
IDS to strike the right balance between time to detecting attacks and the rate
of false positives is a challenging task, especially in dynamic environments,
in which the damage incurred by a successful attack is time-varying.
  In this paper, we study the problem of finding optimal detection thresholds
for anomaly-based detectors implemented in dynamical systems in the face of
strategic attacks. We formulate the problem as an attacker-defender security
game, and determine thresholds for the detector to achieve an optimal trade-off
between the detection delay and the false positive rates. In this direction,
first, we provide an algorithm that computes optimal fixed threshold that
remains fixed throughout. Second, we allow detector's threshold to change with
time to further minimize the defender's loss and provide an algorithm to
compute time-varying thresholds, which we call adaptive thresholds. Finally, we
numerically evaluate our results using a water distribution network as a
case-study.
