Secure state estimation for cyber-physical systems under sparse data injection attacks: a switched counteraction approach